@skaile/workspaces 0.22.0 → 0.24.0

package/dist/{chunk-7HSXUKNB.js → chunk-N6TA6RSH.js}

@@ -1,8 +1,8 @@
-import { removeAsset, deployAll, createScaffold } from './chunk-2RYQERIT.js';
-import { writeLock, buildLockFile, readLock, verifyLock, extractForPatch, generatePatch, savePatch, applyPatch } from './chunk-ETMUGBHF.js';
-import { resolveRuntimeAssets } from './chunk-PFOXL4SH.js';
-import { resolveSkWorkspaceConfig, getRepoCommit, ensureRepo, buildProvenanceIndex, resolveAll, scanRepo, checkRepoStatus, resolveAsset, readLinks, getGlobalCacheDir } from './chunk-V5TBKO5Q.js';
-import { parseAssetRef } from './chunk-VUCPJBAG.js';
+import { removeAsset, deployAll, createScaffold } from './chunk-2RFOFHSM.js';
+import { writeLock, buildLockFile, readLock, verifyLock, extractForPatch, generatePatch, savePatch, applyPatch } from './chunk-Z3M5K67G.js';
+import { resolveRuntimeAssets } from './chunk-5ESCS2OS.js';
+import { resolveSkWorkspaceConfig, getRepoCommit, ensureRepo, buildProvenanceIndex, resolveAll, scanRepo, checkRepoStatus, resolveAsset, readLinks, getGlobalCacheDir } from './chunk-542K7SR6.js';
+import { parseAssetRef } from './chunk-YX3UWPJ5.js';
 import { deployedBase, isDeployed, deployedDir } from './chunk-JKNWJ64A.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
@@ -16,16 +16,17 @@ function sourceSlug(url) {
   return url.replace(/\.git$/, "").split(/[/:]/).pop() ?? "source";
 }
 function parseCanonicalLockKey(key) {
-  const slash = key.indexOf("/");
-  const colon = key.indexOf(":", slash + 1);
-  const at = key.lastIndexOf("@");
-  if (slash === -1 || colon === -1 || at === -1 || at < colon) return {};
-  return {
-    publisher: key.slice(0, slash),
-    kind: key.slice(slash + 1, colon),
-    name: key.slice(colon + 1, at),
-    version: key.slice(at + 1)
-  };
+  try {
+    const ref = parseAssetRef(key);
+    return {
+      publisher: ref.publisher,
+      kind: ref.kind,
+      name: ref.name,
+      version: ref.pin
+    };
+  } catch {
+    return {};
+  }
 }
 var AssetManager = class {
   /** Resolved absolute path to the workspace root. */
@@ -942,6 +943,6 @@ var AssetManager = class {
   }
 };
 
-export { AssetManager };
-//# sourceMappingURL=chunk-7HSXUKNB.js.map
-//# sourceMappingURL=chunk-7HSXUKNB.js.map
+export { AssetManager, parseCanonicalLockKey };
+//# sourceMappingURL=chunk-N6TA6RSH.js.map
+//# sourceMappingURL=chunk-N6TA6RSH.js.map

package/dist/chunk-N6TA6RSH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../asset-manager/src/index.ts"],"names":["parseYaml","stringifyYaml"],"mappings":";;;;;;;;;;;;;;AAwEA,SAAS,WAAW,GAAA,EAAqB;AACvC,EAAA,OACE,GAAA,CACG,QAAQ,QAAA,EAAU,EAAE,EACpB,KAAA,CAAM,MAAM,CAAA,CACZ,GAAA,EAAI,IAAK,QAAA;AAEhB;AAWO,SAAS,sBAAsB,GAAA,EAKpC;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,cAAc,GAAG,CAAA;AAC7B,IAAA,OAAO;AAAA,MACL,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,SAAS,GAAA,CAAI;AAAA,KACf;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAgOO,IAAM,eAAN,MAAmB;AAAA;AAAA,EAEf,UAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EAET,YAAY,IAAA,EAA2B;AACrC,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AACzC,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,YAAA,IAAiB,aAAA;AAC1C,IAAA,IAAA,CAAK,MAAA,GAAS,KAAK,MAAA,IAAU,KAAA;AAAA,EAC/B;AAAA,EAEA,IAAY,QAAA,GAAmB;AAC7B,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAA,EAAW,OAAO,CAAA;AAAA,EACjD;AAAA,EAEA,IAAY,QAAA,GAAmB;AAC7B,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,kBAAkB,CAAA;AAAA,EACjD;AAAA,EAEA,IAAY,QAAA,GAAmB;AAC7B,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAA,EAAW,SAAS,CAAA;AAAA,EACnD;AAAA,EAEA,IAAY,UAAA,GAA4B;AACtC,IAAA,OAAO,EAAE,cAAc,IAAA,CAAK,YAAA,EAAc,QAAQ,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,IAAA,CAAK,UAAA,EAAW;AAAA,EACtF;AAAA,EAEQ,UAAA,GAQN;AAGA,IAAA,MAAM,MAAA,GAAS,wBAAA,CAAyB,IAAA,CAAK,UAAU,CAAA;AAEvD,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,IAAW,EAAC;AACnC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,EAAC;AACjC,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,EAAC;AAC7C,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,SAAA,IAAa,EAAC;AACvC,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,IAAW,EAAC;AAKnC,IAAA,MAAM,aAAa,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACvE,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AAC7C,IAAA,MAAM,eAAkD,EAAC;AACzD,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,IAAA,GAAO,UAAA,CAAW,CAAA,CAAE,GAAG,CAAA;AAC7B,MAAA,IAAI,YAAA,CAAa,IAAI,CAAA,EAAG;AACxB,MAAA,YAAA,CAAa,IAAI,CAAA,GAAI,EAAE,IAAA,EAAM,IAAA,CAAK,YAAY,IAAI,CAAA,EAAG,GAAA,EAAK,CAAA,CAAE,GAAA,EAAI;AAAA,IAClE;AAEA,IAAA,OAAO,EAAE,YAAA,EAAc,OAAA,EAAS,QAAQ,YAAA,EAAc,SAAA,EAAW,SAAS,MAAA,EAAO;AAAA,EACnF;AAAA;AAAA,EAGQ,YAAY,YAAA,EAAgE;AAClF,IAAA,MAAM,SAAwB,EAAC;AAC/B,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,IAAI,CAAA;AAChD,MAAA,IAAI,CAAC,SAAA,IAAa,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG;AAC1C,MAAA,MAAM,SAAS,aAAA,CAAc,SAAS,CAAA,IAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AACxD,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,SAAA;AAAA,QACA,SAAA,EAAW,KAAK,GAAA,IAAO,SAAA;AAAA,QACvB,MAAA;AAAA,QACA,KAAK,IAAA,CAAK;AAAA,OACX,CAAA;AAAA,IACH;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,uBAAA,CACN,GACA,YAAA,EACqB;AAErB,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,QAAA;AACJ,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACpD,MAAA,IAAI,IAAA,CAAK,GAAA,KAAQ,CAAA,CAAE,SAAA,EAAW;AAC5B,QAAA,IAAA,GAAO,CAAA;AACP,QAAA,QAAA,GAAW,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,CAAC,CAAA,IAAK,MAAA;AAC3C,QAAA;AAAA,MACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,QAAA,EAAU;AAEb,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,OAAA,CAAQ,YAAY,EAAE,CAAC,CAAA;AAC5C,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAA,GAAO,MAAM,CAAC,CAAA;AACd,QAAA,QAAA,GAAW,IAAA,CAAK,eAAe,KAAA,CAAM,CAAC,GAAG,KAAA,CAAM,CAAC,CAAC,CAAA,IAAK,MAAA;AAAA,MACxD;AAAA,IACF;AACA,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,IAAA,EAAM,OAAO,IAAA;AAE/B,IAAA,MAAM,UAAA,GAAqC;AAAA,MACzC,KAAA,EAAO,UAAA;AAAA,MACP,KAAA,EAAO,UAAA;AAAA,MACP,MAAA,EAAQ,WAAA;AAAA,MACR,YAAA,EAAc,QAAA;AAAA,MACd,SAAA,EAAW,cAAA;AAAA,MACX,MAAA,EAAQ,WAAA;AAAA,MACR,QAAA,EAAU;AAAA,KACZ;AACA,IAAA,MAAM,MAAA,GAAS,UAAA,CAAW,CAAA,CAAE,IAAI,CAAA;AAChC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAO,MAAA,GAAS,CAAA,CAAE,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,GAAI,KAAM,CAAA,EAAG,IAAA;AAC/E,IAAA,MAAM,MAAA,GAAS,KAAA,GAAQ,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA,GAAI,QAAA;AAE/C,IAAA,OAAO;AAAA,MACL,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,WAAA,EAAa,EAAA;AAAA,MACb,MAAA;AAAA,MACA,SAAA,EAAW,IAAA;AAAA,MACX,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,UAAU,EAAC;AAAA,MACX,cAAc,EAAC;AAAA,MACf,UAAU,CAAA,CAAE;AAAA,KACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,QAAQ,IAAA,EAAqD;AACjE,IAAA,MAAM,EAAE,cAAc,OAAA,EAAS,MAAA,EAAQ,cAAc,SAAA,EAAW,OAAA,EAAQ,GAAI,IAAA,CAAK,UAAA,EAAW;AAE5F,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,OAAO,IAAA,CAAK,aAAA,CAAc,YAAA,EAAc,OAAO,CAAA;AAAA,IACjD;AAGA,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAC,CAAA,KAAM,CAAC,UAAA,CAAW,EAAE,GAAG,CAAA,EAAG,CAAA,CAAE,GAAG,CAAC,CAAC,CAAA;AACxE,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,IAAA,CAAK,QAAA,EAAU;AAAA,UACpC,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,GAAA,EAAK,SAAA,CAAU,GAAA,CAAI,IAAI;AAAA,SACxB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO;AAAA,UACL,UAAU,EAAC;AAAA,UACX,SAAS,EAAC;AAAA,UACV,OAAA,EAAS,CAAC,CAAA,OAAA,EAAU,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,UAChF,WAAA,EAAa;AAAA,SACf;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,eAAA,GAAkB,oBAAA,CAAqB,IAAA,CAAK,WAAA,CAAY,YAAY,CAAA,EAAG;AAAA,MAC3E,YAAY,IAAA,CAAK;AAAA,KAClB,CAAA;AACD,IAAA,MAAM,EAAE,QAAA,EAAU,OAAA,EAAS,kBAAiB,GAAI,MAAM,WAAW,YAAA,EAAc;AAAA,MAC7E,eAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA,MACA,YAAA,EAAc,IAAA,CAAK,iBAAA,CAAkB,MAAM,CAAA;AAAA,MAC3C,YAAY,IAAA,CAAK;AAAA,KAClB,CAAA;AAGD,IAAA,MAAM,OAAA,GAAU,KAAK,WAAA,EAAY;AACjC,IAAA,MAAM,eAAe,IAAI,GAAA;AAAA,MACvB,SAAS,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,EAAE,SAAS,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,IAAI,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE;AAAA,KACvE;AACA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC7C,QAAA,IAAI,CAAC,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA,EAAG;AAC1B,UAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,sBAAsB,GAAG,CAAA;AAChD,UAAA,IAAI,QAAQ,IAAA,EAAM;AAChB,YAAA,WAAA,CAAY,IAAA,EAAM,IAAA,EAAM,IAAA,CAAK,UAAU,CAAA;AACvC,YAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,OAAA,GAAU,QAAA,CACb,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,uBAAA,CAAwB,CAAA,EAAG,YAAY,CAAC,CAAA,CACxD,MAAA,CAAO,CAAC,CAAA,KAAyB,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,WAAW,SAAA,CAAU,OAAA,EAAS,YAAA,EAAc,OAAA,EAAS,KAAK,UAAU,CAAA;AAG1E,IAAA,SAAA,CAAU,IAAA,CAAK,QAAA,EAAU,aAAA,CAAc,QAAA,EAAU,gBAAgB,CAAC,CAAA;AAGlE,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,aAAA,CAAc,KAAK,UAAA,EAAY;AAAA,QAC7B,GAAA;AAAA,QACA,MAAA,EAAQ,KAAA;AAAA,QACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,QAClC,OAAA,EAAS,IAAA,CAAK,MAAA,GAAS,QAAA,GAAW;AAAA,OACnC,CAAA;AAAA,IACH;AACA,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,aAAA,CAAc,KAAK,UAAA,EAAY;AAAA,QAC7B,GAAA;AAAA,QACA,MAAA,EAAQ,QAAA;AAAA,QACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,QAClC,OAAA,EAAS,IAAA,CAAK,MAAA,GAAS,QAAA,GAAW;AAAA,OACnC,CAAA;AAAA,IACH;AAGA,IAAA,MAAM,EAAE,YAAA,EAAc,SAAA,EAAU,GAAI,MAAM,KAAK,uBAAA,EAAwB;AAEvE,IAAA,OAAO,EAAE,QAAA,EAAU,OAAA,EAAS,SAAS,WAAA,EAAa,IAAA,EAAM,cAAc,SAAA,EAAU;AAAA,EAClF;AAAA;AAAA,EAGQ,WAAA,GAA+B;AACrC,IAAA,IAAI;AACF,MAAA,OAAO,QAAA,CAAS,KAAK,QAAQ,CAAA;AAAA,IAC/B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGQ,kBAAkB,MAAA,EAAgD;AACxE,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAChC,IAAA,OAAO;AAAA,MACL,kBAAA,EAAoB,OAAO,QAAA,EAAU,GAAA,KAAQ;AAC3C,QAAA,MAAM,EAAE,mBAAA,EAAqB,gBAAA,EAAiB,GAAI,MAAM,OACtD,oBACF,CAAA;AACA,QAAA,MAAM,MAAM,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,UAAU,CAAA;AACzD,QAAA,IAAI;AACF,UAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,kBAAA,CAAmB,GAAG,CAAA;AAC1C,UAAA,OAAO;AAAA,YACL,SAAA,EAAW,EAAE,MAAA,CAAO,GAAA;AAAA,YACpB,MAAA,EAAQ,EAAE,MAAA,CAAO,SAAA;AAAA,YACjB,QAAQ,CAAA,CAAE,MAAA;AAAA,YACV,OAAO,CAAA,CAAE;AAAA,WACX;AAAA,QACF,SAAS,GAAA,EAAK;AACZ,UAAA,IAAI,GAAA,YAAe,gBAAA,IAAoB,GAAA,CAAI,MAAA,KAAW,KAAK,OAAO,IAAA;AAClE,UAAA,MAAM,GAAA;AAAA,QACR;AAAA,MACF,CAAA;AAAA,MACA,kBAAA,EAAoB,OAAO,QAAA,EAAU,GAAA,KAAQ;AAC3C,QAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACzE,QAAA,MAAM,MAAM,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,UAAU,CAAA;AACzD,QAAA,OAAO,GAAA,CAAI,mBAAmB,GAAG,CAAA;AAAA,MACnC;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,uBAAA,GAGX;AACD,IAAA,MAAM,eAAyB,EAAC;AAChC,IAAA,MAAM,YAAsB,EAAC;AAC7B,IAAA,IAAI,aAAA,GAAyE,IAAA;AAC7E,IAAA,IAAI;AACF,MAAA,aAAA,GAAgB,MAAM,oBAAA,CAAqB,IAAA,CAAK,UAAU,CAAA;AAAA,IAC5D,CAAA,CAAA,MAAQ;AAGN,MAAA,OAAO,EAAE,cAAc,SAAA,EAAU;AAAA,IACnC;AAEA,IAAA,MAAM,QAAA,GAAW,cAAc,eAAA,CAAgB,QAAA;AAC/C,IAAA,IAAI,SAAS,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,cAAc,SAAA,EAAU;AAE5D,IAAA,MAAM,EAAE,mBAAA,EAAqB,kBAAA,EAAmB,GAAI,MAAM,OACxD,uBACF,CAAA;AACA,IAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,QAAA,EAAU,IAAA,CAAK,UAAU,CAAA;AAC7D,IAAA,IAAI,QAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,cAAc,SAAA,EAAU;AAE3D,IAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,OAAA,EAAS,KAAK,UAAU,CAAA;AAChE,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,YAAA,CAAa,IAAA,CAAK,GAAG,OAAO,CAAA;AAAA,IAC9B,CAAA,MAAO;AACL,MAAA,SAAA,CAAU,IAAA,CAAK,GAAG,OAAO,CAAA;AAAA,IAC3B;AACA,IAAA,OAAO,EAAE,cAAc,SAAA,EAAU;AAAA,EACnC;AAAA,EAEQ,aAAA,CACN,cACA,OAAA,EACe;AACf,IAAA,MAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AAC9B,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IACnE;AAIA,IAAA,MAAM,aAAa,IAAI,GAAA,CAAI,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAC,CAAA;AACvD,IAAA,KAAA,MAAW,GAAA,IAAO,KAAK,OAAA,EAAS;AAC9B,MAAA,MAAM,IAAA,GAAO,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA;AAC/B,MAAA,MAAM,IAAA,GAAO,WAAW,GAAA,CAAI,IAAI,KAAK,EAAE,GAAA,EAAK,IAAI,GAAA,EAAI;AACpD,MAAA,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,IAAA,CAAK,QAAA,EAAU,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAY,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,CAAA;AAAA,IACxF;AAGA,IAAA,MAAM,eAAA,GAAkB,CAAC,SAAA,KAAqC;AAC5D,MAAA,MAAM,IAAA,GAAO,WAAW,SAAS,CAAA;AACjC,MAAA,MAAM,OAAO,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,IAAK,EAAE,KAAK,SAAA,EAAU;AACtD,MAAA,OAAO,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,IAAI,CAAA;AAAA,IACvC,CAAA;AAGA,IAAA,MAAM,YAAA,GAAe,UAAA,CAAW,IAAA,EAAM,eAAe,CAAA;AACrD,IAAA,IAAI,CAAC,aAAa,EAAA,EAAI;AACpB,MAAA,MAAM,MAAA,GAAS;AAAA,QACb,GAAG,aAAa,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE,CAAA;AAAA,QAClD,GAAG,aAAa,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE;AAAA,OACpD;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAAA,EAAqC,MAAA,CAAO,IAAA,CAAK,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,IAC5E;AAGA,IAAA,MAAM,WAA2B,EAAC;AAClC,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA,EAAG;AACtD,MAAA,MAAM,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAK,GAAI,sBAAsB,GAAG,CAAA;AAC3D,MAAA,IAAI,CAAC,SAAA,IAAa,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM;AAClC,MAAA,MAAM,IAAA,GAAO,UAAA,CAAW,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA;AACxC,MAAA,MAAM,QAAA,GAAW,gBAAgB,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAC9E,MAAA,MAAM,QACJ,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,CAAC,MAAM,eAAA,CAAgB,IAAA,CAAK,CAAA,CAAE,IAAI,CAAC,CAAA,EAAG,IAAA,IAAQ,MAAM,KAAA,CAAM,CAAC,GAAG,IAAA,IAAQ,EAAA;AACzF,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,IAAA;AAAA,QACA,IAAA;AAAA,QACA,WAAA,EAAa,EAAA;AAAA,QACb,MAAA,EAAQ,KAAA,GAAQ,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA,GAAI,QAAA;AAAA,QACxC,SAAA,EAAW,IAAA;AAAA,QACX,OAAA,EAAS,MAAM,MAAA,CAAO,MAAA;AAAA,QACtB,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OAChB,CAAA;AAED,MAAA,IAAI,CAAC,YAAA,CAAa,IAAI,CAAA,EAAG,YAAA,CAAa,IAAI,CAAA,GAAI,EAAE,GAAA,EAAK,KAAA,CAAM,MAAA,CAAO,GAAA,EAAK,MAAM,QAAA,EAAS;AAAA,IACxF;AAEA,IAAA,MAAM,WAAW,SAAA,CAAU,QAAA,EAAU,YAAA,EAAc,OAAA,EAAS,KAAK,UAAU,CAAA;AAC3E,IAAA,OAAO,EAAE,UAAU,OAAA,EAAS,IAAI,OAAA,EAAS,EAAC,EAAG,WAAA,EAAa,KAAA,EAAM;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,IAAI,GAAA,EAAgC;AACxC,IAAA,MAAM,EAAE,YAAA,EAAc,MAAA,EAAQ,WAAW,OAAA,EAAQ,GAAI,KAAK,UAAA,EAAW;AACrE,IAAe,cAAc,GAAG;AAGhC,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,IAAA,EAAM,MAAM,IAAA,CAAK,QAAA,EAAU,EAAE,UAAA,EAAY,IAAA,CAAK,YAAY,CAAA;AAAA,MACvE,CAAA,CAAA,MAAQ;AAAA,MAAC;AAAA,IACX;AAEA,IAAA,MAAM,eAAA,GAAkB,oBAAA,CAAqB,IAAA,CAAK,WAAA,CAAY,YAAY,CAAA,EAAG;AAAA,MAC3E,YAAY,IAAA,CAAK;AAAA,KAClB,CAAA;AACD,IAAA,MAAM,EAAE,UAAU,OAAA,EAAQ,GAAI,MAAM,UAAA,CAAW,CAAC,GAAG,CAAA,EAAG;AAAA,MACpD,eAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA,MACA,YAAA,EAAc,IAAA,CAAK,iBAAA,CAAkB,MAAM,CAAA;AAAA,MAC3C,YAAY,IAAA,CAAK;AAAA,KAClB,CAAA;AACD,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,iBAAA,EAAoB,GAAG,CAAA,EAAG,OAAA,CAAQ,MAAA,GAAS,CAAA,WAAA,EAAc,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA;AAAA,OACrF;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,QAAA,CACb,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,uBAAA,CAAwB,CAAA,EAAG,YAAY,CAAC,CAAA,CACxD,MAAA,CAAO,CAAC,CAAA,KAAyB,MAAM,IAAI,CAAA;AAC9C,IAAA,MAAM,WAAW,SAAA,CAAU,OAAA,EAAS,YAAA,EAAc,OAAA,EAAS,KAAK,UAAU,CAAA;AAG1E,IAAA,IAAA,CAAK,sBAAsB,GAAG,CAAA;AAE9B,IAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,MAAA,aAAA,CAAc,KAAK,UAAA,EAAY;AAAA,QAC7B,GAAA,EAAK,CAAA;AAAA,QACL,MAAA,EAAQ,KAAA;AAAA,QACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,QAClC,OAAA,EAAS,IAAA,CAAK,MAAA,GAAS,QAAA,GAAW;AAAA,OACnC,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,GAAA,EAAsB;AAC3B,IAAA,MAAM,MAAA,GAAS,cAAc,GAAG,CAAA;AAChC,IAAA,MAAM,KAAK,WAAA,CAAY,MAAA,CAAO,MAAM,MAAA,CAAO,IAAA,EAAM,KAAK,UAAU,CAAA;AAChE,IAAA,IAAI,EAAA,EAAI;AACN,MAAA,MAAM,SAAS,CAAA,EAAG,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI,OAAO,IAAI,CAAA,CAAA;AAC5C,MAAA,IAAA,CAAK,2BAA2B,MAAM,CAAA;AAEtC,MAAA,aAAA,CAAc,KAAK,UAAA,EAAY;AAAA,QAC7B,GAAA,EAAK,MAAA;AAAA,QACL,MAAA,EAAQ,QAAA;AAAA,QACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,QAClC,OAAA,EAAS,IAAA,CAAK,MAAA,GAAS,QAAA,GAAW;AAAA,OACnC,CAAA;AAAA,IACH;AACA,IAAA,OAAO,EAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAA,CAAO,OAAgB,IAAA,EAA+B;AACpD,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,IAAA,CAAK,UAAA,EAAW;AACzC,IAAA,IAAI,MAAsB,EAAC;AAE3B,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,IAAI,CAAA;AAC9C,MAAA,IAAI,CAAC,OAAA,EAAS;AACd,MAAA,GAAA,GAAM,CAAC,GAAG,GAAA,EAAK,GAAG,QAAA,CAAS,OAAA,EAAS,IAAI,CAAC,CAAA;AAAA,IAC3C;AAEA,IAAA,IAAI,IAAA,QAAY,GAAA,CAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,IAAI,CAAA;AACjD,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,CAAA,GAAI,MAAM,WAAA,EAAY;AAC5B,MAAA,GAAA,GAAM,GAAA,CAAI,MAAA;AAAA,QACR,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,aAAY,CAAE,QAAA,CAAS,CAAC,CAAA,IAAK,CAAA,CAAE,WAAA,CAAY,WAAA,EAAY,CAAE,SAAS,CAAC;AAAA,OACnF;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,KAAK,GAAA,EAAkC;AACrC,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,IAAA,CAAK,UAAA,EAAW;AACzC,IAAA,MAAM,MAAA,GAAS,cAAc,GAAG,CAAA;AAEhC,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,IAAI,CAAA;AAC9C,MAAA,IAAI,CAAC,OAAA,EAAS;AACd,MAAA,IAAI,MAAA,CAAO,SAAA,IAAa,MAAA,CAAO,SAAA,KAAc,IAAA,EAAM;AACnD,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,OAAA,EAAS,IAAI,CAAA;AACtC,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,MAAA,CAAO,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,MAAA,CAAO,IAAI,CAAA;AAClF,MAAA,IAAI,OAAO,OAAO,KAAA;AAAA,IACpB;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,IAAA,EAA+B;AAE1C,IAAA,MAAM,KAAA,GACJ,IAAA,GAAO,CAAC,IAAI,CAAA,GAAI,CAAC,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,MAAA,EAAQ,UAAU,CAAA;AAEjE,IAAA,MAAM,SAAyB,EAAC;AAChC,IAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,IAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,aAAa,CAAA,EAAG,IAAA,CAAK,cAAc,IAAA,CAAK,MAAA,EAAQ,KAAK,UAAU,CAAA;AAC5E,QAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG;AACvB,QAAA,KAAA,MAAW,QAAQ,WAAA,CAAY,IAAA,EAAM,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAI7D,UAAA,IAAI,IAAA;AACJ,UAAA,IAAI,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,gBAAe,EAAG;AAC/C,YAAA,IAAA,GAAO,IAAA,CAAK,IAAA;AAAA,UACd,CAAA,MAAA,IAAW,IAAA,CAAK,MAAA,EAAO,EAAG;AACxB,YAAA,IAAA,GAAO,KAAK,IAAA,CACT,OAAA,CAAQ,eAAA,EAAiB,EAAE,EAC3B,OAAA,CAAQ,sBAAA,EAAwB,EAAE,CAAA,CAClC,QAAQ,iBAAA,EAAmB,EAAE,CAAA,CAC7B,OAAA,CAAQ,0BAA0B,EAAE,CAAA;AAAA,UACzC,CAAA,MAAO;AACL,YAAA;AAAA,UACF;AACA,UAAA,MAAM,GAAA,GAAM,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AACxB,UAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,UAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,UAAA,MAAA,CAAO,IAAA,CAAK;AAAA,YACV,IAAA;AAAA,YACA,IAAA,EAAM,CAAA;AAAA,YACN,WAAA,EAAa,EAAA;AAAA,YACb,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,IAAI,CAAA;AAAA,YAC5B,OAAA,EAAS,EAAA;AAAA,YACT,UAAU,EAAC;AAAA,YACX,cAAc;AAAC,WAChB,CAAA;AAAA,QACH;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAC;AAAA,IACX;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,QAAA,GAA2B;AACzB,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,IAAA,CAAK,UAAA,EAAW;AACzC,IAAA,MAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AAC9B,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AAGnC,IAAA,MAAM,YAAA,uBAAmB,GAAA,EAA4B;AACrD,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,KAAK,QAAQ,CAAA;AACxD,MAAA,YAAA,CAAa,IAAI,IAAA,EAAM;AAAA,QACrB,IAAA;AAAA,QACA,MAAM,MAAA,CAAO,IAAA;AAAA,QACb,QAAQ,MAAA,CAAO,MAAA;AAAA,QACf,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,OAAO,MAAA,CAAO;AAAA,OACf,CAAA;AAAA,IACH;AAGA,IAAA,MAAM,cAAA,uBAAqB,GAAA,EAAiE;AAC5F,IAAA,KAAA,MAAW,CAAC,GAAG,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,EAAM,MAAA,IAAU,EAAE,CAAA,EAAG;AACtD,MAAA,MAAM,MAAA,GAAS,sBAAsB,GAAG,CAAA;AACxC,MAAA,IAAI,OAAO,IAAA,IAAQ,MAAA,CAAO,QAAQ,MAAA,CAAO,SAAA,IAAa,OAAO,OAAA,EAAS;AACpE,QAAA,cAAA,CAAe,IAAI,CAAA,EAAG,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI;AAAA,UAClD,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,SAAS,MAAA,CAAO,OAAA;AAAA,UAChB,GAAA,EAAK,IAAA,CAAM,MAAA,CAAO,GAAG,EAAG,MAAA,CAAO;AAAA,SAChC,CAAA;AAAA,MACH;AAAA,IACF;AAIA,IAAA,MAAM,UAA2B,EAAC;AAClC,IAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,MAAA,MAAM,SAAA,GAAY,eAAe,GAAA,CAAI,CAAA,EAAG,EAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAC1D,MAAA,MAAM,SAAA,GAAY,WAAW,SAAA,IAAa,EAAA;AAC1C,MAAA,MAAM,OAAA,GAAU,WAAW,OAAA,IAAW,EAAA;AACtC,MAAA,MAAM,IAAA,GAAO,SAAA,GAAY,UAAA,CAAW,SAAA,CAAU,GAAG,CAAA,GAAI,EAAA;AACrD,MAAA,IAAI,UAAA,GAAa,SAAA;AACjB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,MAAM,UAAA,GAAa,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACxC,QAAA,IAAI,CAAC,YAAY,UAAA,GAAa,SAAA;AAAA,aAAA,IACrB,UAAA,CAAW,IAAA,KAAS,OAAA,EAAS,UAAA,GAAa,OAAA;AAAA,aAAA,IAC1C,UAAA,CAAW,OAAO,UAAA,GAAa,OAAA;AAAA,aAAA,IAC/B,UAAA,CAAW,UAAU,UAAA,GAAa,QAAA;AAAA,aACtC,UAAA,GAAa,UAAA;AAAA,MACpB;AACA,MAAA,MAAM,SAAS,SAAA,IAAa,SAAA;AAC5B,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,UAAA,EAAY,CAAA;AAAA,IACrF;AAGA,IAAA,MAAM,QAAA,uBAAe,GAAA,EAA6B;AAClD,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,CAAA,CAAE,MAAM,CAAA,EAAG,QAAA,CAAS,GAAA,CAAI,CAAA,CAAE,MAAA,EAAQ,EAAE,CAAA;AACtD,MAAA,QAAA,CAAS,GAAA,CAAI,CAAA,CAAE,MAAM,CAAA,CAAG,KAAK,CAAC,CAAA;AAAA,IAChC;AAGA,IAAA,MAAM,MAAA,uBAAa,GAAA,EAA6B;AAChD,IAAA,KAAA,MAAW,GAAA,IAAO,CAAC,GAAG,QAAA,CAAS,MAAM,CAAA,CAAE,MAAK,EAAG;AAC7C,MAAA,MAAA,CAAO,GAAA;AAAA,QACL,GAAA;AAAA,QACA,QAAA,CACG,GAAA,CAAI,GAAG,CAAA,CACP,IAAA;AAAA,UAAK,CAAC,CAAA,EAAG,CAAA,KACR,CAAA,CAAE,IAAA,KAAS,EAAE,IAAA,GAAO,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,EAAE,IAAI,CAAA,GAAI,EAAE,IAAA,CAAK,aAAA,CAAc,EAAE,IAAI;AAAA;AAChF,OACJ;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,MAAA;AAAA,MACV,OAAO,OAAA,CAAQ,MAAA;AAAA,MACf,KAAA,EAAO,CAAC,GAAG,YAAA,CAAa,QAAQ;AAAA,KAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAA,GAAuB;AACrB,IAAA,MAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AAC9B,IAAA,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,gBAAA,EAAkB,QAAA,EAAU,EAAC,EAAE;AAIxD,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,SAAA;AAAA,MACL,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,MAAS,EAAE,GAAA,EAAK,QAAA,EAAU,IAAG,CAAE;AAAA,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,GAAA,EAAuB;AACzB,IAAA,MAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AAC9B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,SAAU,EAAC;AAG/B,IAAA,OAAO,CAAC,KAAK,sBAAsB,CAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,QAAA,GAA4B;AAC1B,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,IAAA,CAAK,UAAA,EAAW;AACzC,IAAA,MAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AAC9B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AAEnB,IAAA,MAAM,SAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,GAAA,IAAO,KAAK,OAAA,EAAS;AAC9B,MAAA,MAAM,IAAA,GAAO,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA;AAC/B,MAAA,MAAM,IAAA,GAAO,aAAa,IAAI,CAAA;AAC9B,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,IAAA,EAAM;AACxB,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,KAAK,QAAQ,CAAA;AACxD,MAAA,IAAI,MAAA,CAAO,UAAU,CAAA,EAAG;AACxB,MAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA,EAAG;AACtD,QAAA,IAAI,KAAA,CAAM,MAAA,CAAO,GAAA,KAAQ,GAAA,CAAI,GAAA,EAAK;AAClC,QAAA,MAAM,EAAE,SAAA,EAAW,IAAA,EAAM,MAAM,OAAA,EAAQ,GAAI,sBAAsB,GAAG,CAAA;AACpE,QAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM;AACpB,QAAA,MAAA,CAAO,IAAA,CAAK;AAAA,UACV,IAAA;AAAA,UACA,IAAA;AAAA,UACA,WAAW,SAAA,IAAa,IAAA;AAAA,UACxB,gBAAgB,OAAA,IAAW,EAAA;AAAA,UAC3B,QAAQ,MAAA,CAAO;AAAA,SAChB,CAAA;AAAA,MACH;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,KAAK,GAAA,EAA4B;AAC/B,IAAA,MAAM,MAAA,GAAS,cAAc,GAAG,CAAA;AAChC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AAEnB,IAAA,MAAM,YAAA,GAAe,IAAA;AAAA,MACnB,YAAA,CAAa,OAAO,IAAA,EAAqB,IAAA,CAAK,cAAc,IAAA,CAAK,MAAA,EAAQ,KAAK,UAAU,CAAA;AAAA,MACxF,MAAA,CAAO;AAAA,KACT;AACA,IAAA,IAAI,CAAC,WAAW,YAAY,CAAA,IAAK,CAAC,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG,OAAO,IAAA;AAEnE,IAAA,MAAM,CAAA,GAAI,SAAA,CAAU,MAAA,EAAQ,CAAC,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,YAAY,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,CAAA;AACtF,IAAA,OAAO,CAAA,CAAE,MAAA,KAAW,CAAA,GAAI,CAAA,CAAE,MAAA,GAAS,IAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,IAAA,GAA0B;AAC9B,IAAA,MAAM,EAAE,YAAA,EAAc,MAAA,EAAQ,cAAc,SAAA,EAAU,GAAI,KAAK,UAAA,EAAW;AAE1E,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,IAAA,EAAM,MAAM,IAAA,CAAK,QAAA,EAAU,EAAE,UAAA,EAAY,IAAA,CAAK,YAAY,CAAA;AAAA,MACvE,CAAA,CAAA,MAAQ;AAAA,MAAC;AAAA,IACX;AAEA,IAAA,MAAM,eAAA,GAAkB,oBAAA,CAAqB,IAAA,CAAK,WAAA,CAAY,YAAY,CAAA,EAAG;AAAA,MAC3E,YAAY,IAAA,CAAK;AAAA,KAClB,CAAA;AACD,IAAA,MAAM,EAAE,QAAA,EAAU,gBAAA,EAAiB,GAAI,MAAM,WAAW,YAAA,EAAc;AAAA,MACpE,eAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA,MACA,YAAA,EAAc,IAAA,CAAK,iBAAA,CAAkB,MAAM,CAAA;AAAA,MAC3C,YAAY,IAAA,CAAK;AAAA,KAClB,CAAA;AACD,IAAA,MAAM,QAAA,GAAW,aAAA,CAAc,QAAA,EAAU,gBAAgB,CAAA;AACzD,IAAA,SAAA,CAAU,IAAA,CAAK,UAAU,QAAQ,CAAA;AACjC,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,GAAA,EAAqB;AACzB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,CAAE,CAAA;AACrD,IAAA,OAAO,eAAA,CAAgB,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,YAAY,GAAA,EAAqB;AAC/B,IAAA,MAAM,MAAA,GAAS,cAAc,GAAG,CAAA;AAChC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,CAAE,CAAA;AAErD,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,CAAA,EAAG,OAAO,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACtE,IAAA,IAAI,CAAC,UAAA,CAAW,UAAU,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,GAAG,CAAA,SAAA,CAAW,CAAA;AAAA,IAClF;AAEA,IAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA;AACxC,IAAA,MAAM,OAAA,GAAU,aAAA,CAAc,WAAA,EAAa,UAAU,CAAA;AACrD,IAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,uBAAuB,CAAA;AAErD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,CAAA,EAAG,OAAO,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,MAAA,CAAQ,CAAA;AAC3E,IAAA,SAAA,CAAU,WAAW,OAAO,CAAA;AAC5B,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,YAAY,GAAA,EAAmB;AAC7B,IAAA,MAAM,MAAA,GAAS,cAAc,GAAG,CAAA;AAChC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,OAAO,SAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AAEhF,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,IAAA,CAAK,UAAA,EAAW;AACzC,IAAA,MAAM,IAAA,GAAO,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA;AACzC,IAAA,IAAI,CAAC,IAAA,EAAM,GAAA,EAAK,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAE7E,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,MAAM,SAAS,CAAA;AACnD,IAAA,MAAM,aAAa,CAAA,MAAA,EAAS,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI,OAAO,IAAI,CAAA,CAAA;AAGtD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,CAAA,EAAG,OAAO,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,MAAA,CAAQ,CAAA;AAC3E,IAAA,IAAI,CAAC,UAAA,CAAW,SAAS,GAAG,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAE7F,IAAA,UAAA,CAAe,SAAS,SAAS,CAAA;AACjC,IAAA,aAAA,CAAc,OAAA,EAAS,gBAAgB,MAAA,CAAO,IAAI,IAAI,MAAA,CAAO,IAAI,IAAI,UAAU,CAAA;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,GAAA,EAAmB;AAC7B,IAAA,MAAM,MAAA,GAAS,cAAc,GAAG,CAAA;AAChC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,CAAA,EAAG,OAAO,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,MAAA,CAAQ,CAAA;AAC3E,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,CAAA,EAAG,OAAO,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACtE,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,SAAS,CAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AAAA,IAAC;AACT,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,UAAA,EAAY,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,IACxC,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAA,GAAqB;AACnB,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,IAAA,CAAK,UAAA,EAAW;AACzC,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AACnC,IAAA,MAAM,SAAqB,EAAC;AAE5B,IAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,MAAA,MAAM,IAAA,GAAO,KAAK,IAAA,CAAK,CAAA,EAAG,MAAM,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,CAAE,CAAA;AACpD,MAAA,IAAI,CAAC,IAAA,EAAM;AACX,MAAA,KAAA,MAAW,GAAA,IAAO,KAAK,QAAA,EAAU;AAC/B,QAAA,IACE,CAAC,UAAA;AAAA,UACC,GAAA,CAAI,IAAA;AAAA,UACJ,GAAA,CAAI,IAAA;AAAA,UACJ,IAAA,CAAK,YAAA;AAAA,UACL,IAAA,CAAK,MAAA;AAAA,UACL,IAAA,CAAK;AAAA,SACP,EACA;AACA,UAAA,MAAM,OAAA,GACJ,YAAA,CAAa,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,IAAA,EAAM,GAAA,CAAI,IAAA,EAAK,EAAG,YAAA,EAAc,IAAA,CAAK,QAAQ,CAAA,KAAM,IAAA;AACpF,UAAA,MAAA,CAAO,IAAA,CAAK;AAAA,YACV,WAAW,KAAA,CAAM,IAAA;AAAA,YACjB,WAAW,KAAA,CAAM,IAAA;AAAA,YACjB,SAAS,GAAA,CAAI,IAAA;AAAA,YACb,SAAS,GAAA,CAAI,IAAA;AAAA,YACb;AAAA,WACD,CAAA;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAA,CAAO,IAAA,EAAc,IAAA,EAAc,OAAA,EAAgD;AACjF,IAAA,OAAO,cAAA,CAAe,IAAA,EAAM,IAAA,EAAM,OAAO,CAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,OAAA,CAAQ,QAAQ,EAAA,EAAoB;AAClC,IAAA,OAAO,gBAAA,CAAiB,IAAA,CAAK,UAAA,EAAY,KAAK,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,YAAA,GAAqB;AACnB,IAAA,YAAA,CAAa,KAAK,UAAU,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,IAAA,EAIJ;AACA,IAAA,MAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AAC9B,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,UAAkD,EAAC;AAEzD,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,EAAG;AAC1C,QAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,sBAAsB,GAAG,CAAA;AAChD,QAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM;AACpB,QAAA,MAAM,IAAA,GAAO,WAAA;AAAA,UACX,IAAA;AAAA,UACA,IAAA;AAAA,UACA,IAAA,CAAK,YAAA;AAAA,UACL,IAAA,CAAK,MAAA;AAAA,UACL,IAAA,CAAK;AAAA,SACP;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,UAAA,IAAI,IAAA,CAAK,cAAA,EAAe,EAAG,UAAA,CAAW,IAAI,CAAA;AAAA,sBAC9B,IAAA,EAAM,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAClD,UAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,QAClB,CAAA,CAAA,MAAQ;AAEN,UAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAIA,IAAA,MAAM,QAAA,GAAW,OACb,IAAI,GAAA;AAAA,MACF,OAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM;AAClC,QAAA,MAAM,CAAA,GAAI,sBAAsB,CAAC,CAAA;AACjC,QAAA,OAAO,CAAA,CAAE,IAAA,IAAQ,CAAA,CAAE,IAAA,GAAO,CAAA,EAAG,EAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAA,GAAK,CAAA;AAAA,MACpD,CAAC;AAAA,KACH,uBACI,GAAA,EAAY;AACpB,IAAA,MAAM,YAAsB,EAAC;AAC7B,IAAA,MAAM,WAAA,GAAc,KAAK,YAAA,EAAa;AACtC,IAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,MAAA,MAAM,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,CAAA;AAC/B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACtB,QAAA,SAAA,CAAU,KAAK,GAAG,CAAA;AAAA,MACpB;AAAA,IACF;AAEA,IAAA,IAAI,MAAM,GAAA,EAAK;AAEb,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,WAAW,cAAc,CAAA;AACnE,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,WAAW,CAAA;AAAA,MACxB,CAAA,CAAA,MAAQ;AAAA,MAAC;AAGT,MAAA,IAAI;AACF,QAAA,MAAA,CAAO,KAAK,QAAA,EAAU,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACxD,CAAA,CAAA,MAAQ;AAAA,MAAC;AAGT,MAAA,IAAI;AACF,QAAA,MAAA,CAAO,KAAK,QAAA,EAAU,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACxD,CAAA,CAAA,MAAQ;AAAA,MAAC;AAGT,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,KAAK,QAAQ,CAAA;AAAA,MAC1B,CAAA,CAAA,MAAQ;AAAA,MAAC;AAAA,IACX;AAEA,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,SAAA,EAAU;AAAA,EACvC;AAAA;AAAA;AAAA,EAKQ,sBAAsB,GAAA,EAAmB;AAC/C,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,aAAa,CAAA;AACtD,IAAA,IAAI,CAAC,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,IAAA,MAAM,MAAMA,KAAA,CAAU,YAAA,CAAa,YAAY,MAAM,CAAC,KAAK,EAAC;AAC5D,IAAA,IAAI,CAAC,GAAA,CAAI,YAAA,EAAc,GAAA,CAAI,eAAe,EAAC;AAC3C,IAAA,IAAI,CAAC,GAAA,CAAI,YAAA,CAAa,QAAA,CAAS,GAAG,CAAA,EAAG;AACnC,MAAA,GAAA,CAAI,YAAA,CAAa,KAAK,GAAG,CAAA;AACzB,MAAA,aAAA,CAAc,YAAYC,SAAA,CAAc,GAAA,EAAK,EAAE,SAAA,EAAW,GAAA,EAAK,CAAC,CAAA;AAAA,IAClE;AAAA,EACF;AAAA;AAAA,EAGQ,2BAA2B,GAAA,EAAmB;AACpD,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,aAAa,CAAA;AACtD,IAAA,IAAI,CAAC,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,IAAA,MAAM,MAAMD,KAAA,CAAU,YAAA,CAAa,YAAY,MAAM,CAAC,KAAK,EAAC;AAC5D,IAAA,IAAI,CAAC,IAAI,YAAA,EAAc;AACvB,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA;AACxC,IAAA,IAAI,QAAQ,EAAA,EAAI;AACd,MAAA,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,GAAA,EAAK,CAAC,CAAA;AAC9B,MAAA,aAAA,CAAc,YAAYC,SAAA,CAAc,GAAA,EAAK,EAAE,SAAA,EAAW,GAAA,EAAK,CAAC,CAAA;AAAA,IAClE;AAAA,EACF;AAAA,EAEQ,cAAA,CAAe,MAAyB,IAAA,EAA6B;AAE3E,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,IAAA,CAAK,UAAU,CAAA;AACvC,IAAA,IAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AACf,MAAA,OAAO,WAAW,KAAA,CAAM,IAAI,CAAC,CAAA,GAAI,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,IACjD;AAEA,IAAA,IAAI,KAAK,IAAA,EAAM;AACb,MAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,IAAA,CAAK,UAAA,EAAY,KAAK,IAAI,CAAA;AACnD,MAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,IAAA;AAAA,IAC3C;AAGA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AACrC,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,IAAA;AAE7B,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,iBAAA,EAAkB,EAAG,IAAI,CAAA;AACjD,IAAA,IAAI,WAAW,IAAA,CAAK,UAAA,EAAY,MAAM,CAAC,GAAG,OAAO,UAAA;AAEjD,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"chunk-N6TA6RSH.js","sourcesContent":["/**\n * @skaile/asset-manager — programmatic AI asset management API.\n *\n * Manages project-local repositories, dependency resolution, deployment,\n * lock files, patches, and contribution workflows.\n *\n * Usage:\n *   import { AssetManager } from \"@skaile/workspaces/asset-manager\"\n *   const am = new AssetManager({ projectDir: \"/path/to/project\" })\n *   await am.install()\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport {\n  existsSync,\n  lstatSync,\n  readFileSync,\n  readdirSync,\n  rmSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport type {\n  AiComponent,\n  CatalogEntry,\n  LockFile,\n  OverrideEntry,\n  ProvenanceCandidate,\n  SkWorkspaceConfig,\n  SourceClone,\n  SourceDeclaration,\n  SourceEntry,\n  StoreEntry,\n  StoreFetcher,\n} from \"@skaile/workspaces/core\";\nimport type { DriverTarget } from \"@skaile/workspaces/core\";\nimport {\n  buildProvenanceIndex,\n  deployedBase,\n  deployedDir,\n  getRepoCommit,\n  isDeployed,\n  parseAssetRef,\n  resolveRuntimeAssets,\n  resolveSkWorkspaceConfig,\n} from \"@skaile/workspaces/core\";\nimport { buildLockFile, readLock, verifyLock, writeLock } from \"@skaile/workspaces/core\";\nimport {\n  checkRepoStatus,\n  ensureRepo,\n  getGlobalCacheDir,\n  readLinks,\n  resolveAll,\n  resolveAsset,\n  scanRepo,\n} from \"@skaile/workspaces/core\";\nimport {\n  extractForPatch,\n  generatePatch,\n  savePatch,\n  applyPatch as coreApplyPatch,\n} from \"@skaile/workspaces/core\";\nimport type { DeployOptions } from \"./installer.js\";\nimport { createScaffold, deployAll, removeAsset } from \"./installer.js\";\nimport type { HistoryEntry } from \"./history.js\";\nimport { appendHistory, clearHistory, getRecentHistory } from \"./history.js\";\nimport { commitChanges } from \"./contrib.js\";\n\n/** Derive a cache slug from a source git URL (`<host>/<owner>/<repo>` → `<repo>`). */\nfunction sourceSlug(url: string): string {\n  return (\n    url\n      .replace(/\\.git$/, \"\")\n      .split(/[/:]/)\n      .pop() ?? \"source\"\n  );\n}\n\n/**\n * Parse a canonical lock key (`<kind>:@<publisher>/<name>#<version>`) into its\n * parts. The lock key is now a canonical asset ref, so this delegates to the one\n * ref parser; `AssetRef.pin` is exposed as `version` so the callers' destructuring\n * is unchanged. Stays total — callers rely on `{}`-then-`continue`, but\n * `parseAssetRef` throws, so a malformed key is caught and returned as `{}`.\n *\n * @internal Exported for unit tests; not part of the stable public surface.\n */\nexport function parseCanonicalLockKey(key: string): {\n  publisher?: string;\n  kind?: string;\n  name?: string;\n  version?: string;\n} {\n  try {\n    const ref = parseAssetRef(key);\n    return {\n      publisher: ref.publisher,\n      kind: ref.kind,\n      name: ref.name,\n      version: ref.pin,\n    };\n  } catch {\n    return {};\n  }\n}\n\n// Re-export sub-modules\nexport type { DeployOptions } from \"./installer.js\";\nexport type { Log } from \"./renderers.js\";\nexport type { HistoryEntry } from \"./history.js\";\nexport { createScaffold, deployAll, removeAsset } from \"./installer.js\";\nexport { renderAgentToFramework } from \"./renderers.js\";\nexport {\n  appendHistory,\n  clearHistory,\n  getRecentHistory,\n  loadHistory,\n} from \"./history.js\";\n// Contrib helpers (commitChanges et al.) are still used internally by the\n// patch-submit flow but are no longer part of the public API surface — the\n// `skaile repo contrib *` command tree was removed on 2026-05-12.\n\n// ── Types ────────────────────────────────────────────────────────────────────\n\n/**\n * Metadata about a repository declared in `skaile.yaml`.\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport interface RepoInfo {\n  /** Repository name as declared in `skaile.yaml`. */\n  name: string;\n  /** How the repo is sourced: cloned from a URL, mounted from a local path, or symlinked via `skaile repo link`. */\n  kind: \"local\" | \"remote\" | \"linked\";\n  /** Remote URL (present when `kind === \"remote\"`). */\n  url?: string;\n  /** Filesystem path (present when `kind === \"local\"` or `kind === \"linked\"`). */\n  path?: string;\n  /** Git branch configured for this repository. */\n  branch: string;\n  /** Whether the repository has been cloned/resolved locally. */\n  cloned: boolean;\n}\n\n/**\n * Live sync status for a repository.\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport interface RepoStatusInfo {\n  /** Repository name as declared in `skaile.yaml`. */\n  name: string;\n  /** How the repo is sourced. */\n  kind: \"local\" | \"remote\" | \"linked\";\n  /** Number of commits the local clone is behind the remote. */\n  behind: number;\n  /** `true` when the local clone matches the remote HEAD. */\n  upToDate: boolean;\n  /** Error message when status check failed. */\n  error?: string;\n}\n\n/**\n * Result of a full `skaile install` or `skaile add` run.\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport interface InstallResult {\n  /** Asset refs (`kind:name`) successfully deployed in this run. */\n  deployed: string[];\n  /** Asset refs (`kind:name`) removed because they are no longer in the resolved set. */\n  removed: string[];\n  /** Asset refs that could not be resolved in any configured repository. */\n  missing: string[];\n  /** Whether `skaile.lock.yaml` was written or updated. */\n  lockWritten: boolean;\n  /**\n   * npm packages installed as a side effect of resolving runtime asset peer\n   * deps (connectors / mounts declared in skaile.yaml). Empty when nothing\n   * needed installing or when the runtime-deps step was skipped.\n   */\n  npmInstalled?: string[];\n  /**\n   * npm packages that the runtime-deps step tried but failed to install.\n   * Non-fatal — listed for telemetry and CLI reporting.\n   */\n  npmFailed?: string[];\n}\n\n/**\n * An installed asset whose source repository is behind the remote.\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport interface OutdatedEntry {\n  /** Asset kind (`skill`, `agent`, `prompt`, `flow`, `contract`). */\n  kind: string;\n  /** Asset name as registered in the catalog. */\n  name: string;\n  /** Repository that provides this asset. */\n  publisher: string;\n  /** Version string recorded in the lock file at install time. */\n  currentVersion: string;\n  /** Number of commits the local repository is behind the remote. */\n  behind: number;\n}\n\n/**\n * A node in the resolved dependency tree (returned by `AssetManager.tree()`).\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport interface DependencyNode {\n  /** Asset ref (`kind:name`) or `\"project\"` for the root node. */\n  ref: string;\n  /** Transitive dependencies resolved by this node. */\n  children: DependencyNode[];\n}\n\n/**\n * A missing dependency detected by `AssetManager.doctor()`.\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport interface DepIssue {\n  /** Kind of the asset that has the unsatisfied requirement. */\n  assetKind: string;\n  /** Name of the asset that has the unsatisfied requirement. */\n  assetName: string;\n  /** Kind of the missing dependency. */\n  depKind: string;\n  /** Name of the missing dependency. */\n  depName: string;\n  /** `true` when the missing dependency exists in a configured repository but has not been installed. */\n  inRepos: boolean;\n}\n\n/**\n * A single deployed asset shown in the workspace overview.\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport interface OverviewEntry {\n  /** Asset kind (`skill`, `agent`, `prompt`, `flow`, `contract`). */\n  kind: string;\n  /** Asset name. */\n  name: string;\n  /** Domain the asset belongs to (from the lock file; `\"unknown\"` when unresolvable). */\n  domain: string;\n  /** Repository that provides this asset. */\n  publisher: string;\n  /** Version string from the lock file. */\n  version: string;\n  /**\n   * Sync status relative to the source repository.\n   * - `\"synced\"` — local clone matches remote HEAD\n   * - `\"outdated\"` — local clone is behind the remote\n   * - `\"local\"` — sourced from a local path, no remote to compare\n   * - `\"error\"` — status check failed\n   * - `\"unknown\"` — repository not found or lock entry missing\n   */\n  syncStatus: string;\n}\n\n/**\n * Aggregated workspace overview returned by `AssetManager.overview()`.\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport interface OverviewResult {\n  /** Entries grouped by domain, sorted alphabetically. Each group is sorted by kind then name. */\n  byDomain: Map<string, OverviewEntry[]>;\n  /** Total number of deployed assets. */\n  total: number;\n  /** Sync status for each configured repository. */\n  repos: RepoStatusInfo[];\n}\n\n// ── AssetManager ─────────────────────────────────────────────────────────────\n\n/**\n * Options for constructing an {@link AssetManager}.\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport interface AssetManagerOptions {\n  /** Absolute or relative path to the workspace root (must contain `skaile.yaml`). */\n  projectDir: string;\n  /**\n   * Agent framework to target for asset deployment.\n   * Determines which framework directories (``.claude/``, ``.omp/``, etc.) are used.\n   * Defaults to `\"claude-code\"`.\n   */\n  driverTarget?: DriverTarget;\n  /**\n   * When `true`, assets are installed into the global Skaile cache rather than the\n   * project workspace. Skips `skaile.yaml` dependency updates.\n   */\n  global?: boolean;\n}\n\n/**\n * Programmatic API for managing AI assets in a Skaile workspace.\n *\n * `AssetManager` wraps repository management, catalog search, asset installation,\n * lock-file tracking, patch workflows, and workspace diagnostics. The CLI delegates\n * all `skaile catalog`, `skaile repo`, `skaile install`, `skaile add`, and\n * `skaile init` commands to this class.\n *\n * @example\n * ```typescript\n * import { AssetManager } from \"@skaile/workspaces/asset-manager\";\n *\n * const am = new AssetManager({ projectDir: \"/my-project\" });\n *\n * // Install all dependencies declared in skaile.yaml\n * const result = await am.install();\n * console.log(`Deployed: ${result.deployed.join(\", \")}`);\n *\n * // Add a single skill (resolves transitive deps, updates skaile.yaml)\n * const deployed = am.add(\"skill:my-skill\");\n *\n * // Search the catalog\n * const skills = am.search(\"code review\", \"skill\");\n * ```\n *\n * @docLink packages/asset-manager/concepts#asset-manager\n */\nexport class AssetManager {\n  /** Resolved absolute path to the workspace root. */\n  readonly projectDir: string;\n  /** Agent framework driver target used for all deploy operations. */\n  readonly driverTarget: DriverTarget;\n  /** Whether this instance operates in global-install mode. */\n  readonly global: boolean;\n\n  constructor(opts: AssetManagerOptions) {\n    this.projectDir = resolve(opts.projectDir);\n    this.driverTarget = opts.driverTarget ?? (\"claude-code\" as DriverTarget);\n    this.global = opts.global ?? false;\n  }\n\n  private get reposDir(): string {\n    return join(this.projectDir, \".skaile\", \"repos\");\n  }\n\n  private get lockPath(): string {\n    return join(this.projectDir, \"skaile.lock.yaml\");\n  }\n\n  private get patchDir(): string {\n    return join(this.projectDir, \".skaile\", \"patches\");\n  }\n\n  private get deployOpts(): DeployOptions {\n    return { driverTarget: this.driverTarget, global: this.global, cwd: this.projectDir };\n  }\n\n  private loadConfig(): {\n    repositories: Record<string, SourceDeclaration>;\n    sources: SourceEntry[];\n    stores: StoreEntry[];\n    dependencies: string[];\n    overrides: OverrideEntry[];\n    patches: Record<string, string>;\n    config: SkWorkspaceConfig;\n  } {\n    // resolveSkWorkspaceConfig runs the canonical normalizer and throws on\n    // legacy keys (`repositories:` / `ai_resources:`) — propagate to the caller.\n    const config = resolveSkWorkspaceConfig(this.projectDir);\n\n    const sources = config.sources ?? [];\n    const stores = config.stores ?? [];\n    const dependencies = config.dependencies ?? [];\n    const overrides = config.overrides ?? [];\n    const patches = config.patches ?? {};\n\n    // Internal install-pipeline map: slug (derived from the source URL) →\n    // SourceDeclaration pointing at the machine-cache clone under\n    // ~/.skaile/sources/<slug>/. The slug is also the cache key for ensureRepo.\n    const skaileHome = process.env.SKAILE_HOME ?? join(homedir(), \".skaile\");\n    const sourcesDir = join(skaileHome, \"sources\");\n    const repositories: Record<string, SourceDeclaration> = {};\n    for (const s of sources) {\n      const slug = sourceSlug(s.url);\n      if (repositories[slug]) continue;\n      repositories[slug] = { path: join(sourcesDir, slug), url: s.url };\n    }\n\n    return { repositories, sources, stores, dependencies, overrides, patches, config };\n  }\n\n  /** Build provenance-index clones from the resolved source declarations. */\n  private buildClones(repositories: Record<string, SourceDeclaration>): SourceClone[] {\n    const clones: SourceClone[] = [];\n    for (const [slug, decl] of Object.entries(repositories)) {\n      const localPath = this.resolveRepoDir(decl, slug);\n      if (!localPath || !existsSync(localPath)) continue;\n      const commit = getRepoCommit(localPath) ?? \"0\".repeat(40);\n      clones.push({\n        localPath,\n        sourceUrl: decl.url ?? localPath,\n        commit,\n        tag: decl.branch,\n      });\n    }\n    return clones;\n  }\n\n  /**\n   * Bridge a resolved {@link ProvenanceCandidate} to a {@link CatalogEntry} for\n   * the deploy pipeline. `source` is the absolute path to the asset's primary\n   * manifest (or its directory) inside the clone; `publisher` is set to the\n   * clone slug so `deployAll`'s repositories lookup resolves local-vs-remote.\n   */\n  private candidateToCatalogEntry(\n    c: ProvenanceCandidate,\n    repositories: Record<string, SourceDeclaration>,\n  ): CatalogEntry | null {\n    // Find the clone slug whose declaration URL matches the candidate's source.\n    let slug: string | undefined;\n    let cloneDir: string | undefined;\n    for (const [s, decl] of Object.entries(repositories)) {\n      if (decl.url === c.sourceUrl) {\n        slug = s;\n        cloneDir = this.resolveRepoDir(decl, s) ?? undefined;\n        break;\n      }\n    }\n    if (!cloneDir) {\n      // Store-resolved or unknown source — fall back to the first source clone.\n      const first = Object.entries(repositories)[0];\n      if (first) {\n        slug = first[0];\n        cloneDir = this.resolveRepoDir(first[1], first[0]) ?? undefined;\n      }\n    }\n    if (!cloneDir || !slug) return null;\n\n    const MD_BY_KIND: Record<string, string> = {\n      skill: \"SKILL.md\",\n      agent: \"AGENT.md\",\n      bundle: \"BUNDLE.md\",\n      \"mcp-server\": \"MCP.md\",\n      connector: \"CONNECTOR.md\",\n      prompt: \"PROMPT.md\",\n      contract: \"CONTRACT.md\",\n    };\n    const mdName = MD_BY_KIND[c.kind];\n    const mdRel = c.files.find((f) => (mdName ? f.path.endsWith(mdName) : false))?.path;\n    const source = mdRel ? join(cloneDir, mdRel) : cloneDir;\n\n    return {\n      name: c.name,\n      kind: c.kind as CatalogEntry[\"kind\"],\n      description: \"\",\n      source,\n      publisher: slug,\n      version: c.version,\n      requires: [],\n      dependencies: [],\n      metadata: c.metadata,\n    };\n  }\n\n  // ── Install / resolve ──────────────────────────────────────────────────\n\n  /**\n   * Install all dependencies declared in `skaile.yaml`.\n   *\n   * Steps: clone/pull repositories → resolve transitive dependencies → reconcile\n   * (remove stale assets) → deploy new assets → write `skaile.lock.yaml` → record history.\n   *\n   * @param opts - Optional installation options.\n   * @param opts.locked - When `true`, restore the exact versions recorded in the existing\n   *   lock file instead of resolving from source. Throws if no lock file is found.\n   * @returns {@link InstallResult} summarising what was deployed, what was missing, and any collisions.\n   */\n  async install(opts?: { locked?: boolean }): Promise<InstallResult> {\n    const { repositories, sources, stores, dependencies, overrides, patches } = this.loadConfig();\n\n    if (opts?.locked) {\n      return this.installLocked(repositories, patches);\n    }\n\n    // 1. Ensure all source clones are present/up to date.\n    const pinBySlug = new Map(sources.map((s) => [sourceSlug(s.url), s.pin]));\n    for (const [name, decl] of Object.entries(repositories)) {\n      try {\n        ensureRepo(decl, name, this.reposDir, {\n          projectDir: this.projectDir,\n          pin: pinBySlug.get(name),\n        });\n      } catch (err) {\n        return {\n          deployed: [],\n          removed: [],\n          missing: [`source:${name} (${err instanceof Error ? err.message : String(err)})`],\n          lockWritten: false,\n        };\n      }\n    }\n\n    // 2. Build the provenance index from the clones and resolve.\n    const provenanceIndex = buildProvenanceIndex(this.buildClones(repositories), {\n      projectDir: this.projectDir,\n    });\n    const { resolved, missing, overridesApplied } = await resolveAll(dependencies, {\n      provenanceIndex,\n      overrides,\n      stores,\n      storeFetcher: this.buildStoreFetcher(stores),\n      projectDir: this.projectDir,\n    });\n\n    // 3. Reconcile: remove stale assets (in old lock but not in new resolved set).\n    const oldLock = this.tryReadLock();\n    const resolvedRefs = new Set(\n      resolved.map((c) => `${c.publisher}/${c.kind}:${c.name}@${c.version}`),\n    );\n    const removed: string[] = [];\n    if (oldLock) {\n      for (const ref of Object.keys(oldLock.assets)) {\n        if (!resolvedRefs.has(ref)) {\n          const { kind, name } = parseCanonicalLockKey(ref);\n          if (kind && name) {\n            removeAsset(kind, name, this.deployOpts);\n            removed.push(ref);\n          }\n        }\n      }\n    }\n\n    // 4. Map candidates to catalog entries and deploy.\n    const entries = resolved\n      .map((c) => this.candidateToCatalogEntry(c, repositories))\n      .filter((e): e is CatalogEntry => e !== null);\n    const deployed = deployAll(entries, repositories, patches, this.deployOpts);\n\n    // 5. Write the v2 lock file.\n    writeLock(this.lockPath, buildLockFile(resolved, overridesApplied));\n\n    // 6. Record history.\n    for (const ref of deployed) {\n      appendHistory(this.projectDir, {\n        ref,\n        action: \"add\",\n        timestamp: new Date().toISOString(),\n        context: this.global ? \"global\" : \"project\",\n      });\n    }\n    for (const ref of removed) {\n      appendHistory(this.projectDir, {\n        ref,\n        action: \"remove\",\n        timestamp: new Date().toISOString(),\n        context: this.global ? \"global\" : \"project\",\n      });\n    }\n\n    // 7. Install npm peer deps for any mount/connector declared in skaile.yaml.\n    const { npmInstalled, npmFailed } = await this.installRuntimeAssetDeps();\n\n    return { deployed, removed, missing, lockWritten: true, npmInstalled, npmFailed };\n  }\n\n  /** Read the lock, returning null on a legacy v1 lock instead of throwing. */\n  private tryReadLock(): LockFile | null {\n    try {\n      return readLock(this.lockPath);\n    } catch {\n      return null;\n    }\n  }\n\n  /** Build a store fetcher from the configured stores, or undefined when none. */\n  private buildStoreFetcher(stores: StoreEntry[]): StoreFetcher | undefined {\n    if (stores.length === 0) return undefined;\n    return {\n      getInstallManifest: async (storeUrl, ref) => {\n        const { RemoteCatalogSource, CatalogHttpError } = await import(\n          \"@skaile/workspaces/library\"\n        );\n        const src = new RemoteCatalogSource({ baseUrl: storeUrl });\n        try {\n          const m = await src.getInstallManifest(ref);\n          return {\n            sourceUrl: m.source.url,\n            commit: m.source.commitSha,\n            sha256: m.sha256,\n            files: m.files,\n          };\n        } catch (err) {\n          if (err instanceof CatalogHttpError && err.status === 404) return null;\n          throw err;\n        }\n      },\n      getCanonicalDigest: async (storeUrl, ref) => {\n        const { RemoteCatalogSource } = await import(\"@skaile/workspaces/library\");\n        const src = new RemoteCatalogSource({ baseUrl: storeUrl });\n        return src.getCanonicalDigest(ref);\n      },\n    };\n  }\n\n  /**\n   * Resolve runtime assets and install any missing npm peer deps.\n   *\n   * - Required deps: installed via `bun add --optional`. Failure is recorded\n   *   in `npmFailed` but does not throw — install() proceeds so users get a\n   *   useful error message rather than a hung command.\n   * - Optional deps: not installed automatically (would force every consumer\n   *   to pull every connector's deps). Future: add a flag to opt in.\n   */\n  private async installRuntimeAssetDeps(): Promise<{\n    npmInstalled: string[];\n    npmFailed: string[];\n  }> {\n    const npmInstalled: string[] = [];\n    const npmFailed: string[] = [];\n    let runtimeAssets: Awaited<ReturnType<typeof resolveRuntimeAssets>> | null = null;\n    try {\n      runtimeAssets = await resolveRuntimeAssets(this.projectDir);\n    } catch {\n      // Non-fatal — projects with no skaile.yaml or unresolvable base-assets\n      // simply have no runtime deps to install.\n      return { npmInstalled, npmFailed };\n    }\n\n    const required = runtimeAssets.requiredNpmDeps.required;\n    if (required.length === 0) return { npmInstalled, npmFailed };\n\n    const { findMissingPackages, installNpmPackages } = await import(\n      \"@skaile/workspaces/connectors\"\n    );\n    const missing = findMissingPackages(required, this.projectDir);\n    if (missing.length === 0) return { npmInstalled, npmFailed };\n\n    const result = await installNpmPackages(missing, this.projectDir);\n    if (result.success) {\n      npmInstalled.push(...missing);\n    } else {\n      npmFailed.push(...missing);\n    }\n    return { npmInstalled, npmFailed };\n  }\n\n  private installLocked(\n    repositories: Record<string, SourceDeclaration>,\n    patches: Record<string, string>,\n  ): InstallResult {\n    const lock = this.tryReadLock();\n    if (!lock) {\n      throw new Error(\"No lock file found. Run `skaile install` first.\");\n    }\n\n    // Ensure every contributing source clone exists at its pinned commit. Sources\n    // are keyed by URL slug; the lock's `sources[]` carries the URL + commit.\n    const declBySlug = new Map(Object.entries(repositories));\n    for (const src of lock.sources) {\n      const slug = sourceSlug(src.url);\n      const decl = declBySlug.get(slug) ?? { url: src.url };\n      ensureRepo(decl, slug, this.reposDir, { projectDir: this.projectDir, pin: src.commit });\n    }\n\n    // Resolve a source URL to its on-disk clone for verification.\n    const resolveCloneDir = (sourceUrl: string): string | null => {\n      const slug = sourceSlug(sourceUrl);\n      const decl = declBySlug.get(slug) ?? { url: sourceUrl };\n      return this.resolveRepoDir(decl, slug);\n    };\n\n    // Verify integrity against the v2 lock.\n    const verification = verifyLock(lock, resolveCloneDir);\n    if (!verification.ok) {\n      const issues = [\n        ...verification.drifted.map((r) => `drifted: ${r}`),\n        ...verification.missing.map((r) => `missing: ${r}`),\n      ];\n      throw new Error(`Lock file verification failed:\\n  ${issues.join(\"\\n  \")}`);\n    }\n\n    // Rebuild catalog entries from the lock and deploy.\n    const resolved: CatalogEntry[] = [];\n    for (const [ref, entry] of Object.entries(lock.assets)) {\n      const { publisher, kind, name } = parseCanonicalLockKey(ref);\n      if (!publisher || !kind || !name) continue;\n      const slug = sourceSlug(entry.source.url);\n      const cloneDir = resolveCloneDir(entry.source.url) ?? join(this.reposDir, slug);\n      const mdRel =\n        entry.files.find((f) => /\\.(md|yaml)$/i.test(f.path))?.path ?? entry.files[0]?.path ?? \"\";\n      resolved.push({\n        name,\n        kind: kind as CatalogEntry[\"kind\"],\n        description: \"\",\n        source: mdRel ? join(cloneDir, mdRel) : cloneDir,\n        publisher: slug,\n        version: entry.source.commit,\n        requires: [],\n        dependencies: [],\n      });\n      // Ensure the repositories map has an entry for deployAll's local/remote check.\n      if (!repositories[slug]) repositories[slug] = { url: entry.source.url, path: cloneDir };\n    }\n\n    const deployed = deployAll(resolved, repositories, patches, this.deployOpts);\n    return { deployed, removed: [], missing: [], lockWritten: false };\n  }\n\n  /**\n   * Add a single asset (and its transitive dependencies) to the workspace.\n   *\n   * Resolves `ref`, deploys the asset and all requirements, then records the ref\n   * in `skaile.yaml` `dependencies` so subsequent `skaile install` runs re-deploy it.\n   *\n   * @param ref - Asset ref in `kind:name` or `repo/kind:name` form (e.g. `skill:my-skill`).\n   * @returns Array of asset refs that were deployed in this call.\n   * @throws When the asset cannot be found in any configured repository.\n   */\n  async add(ref: string): Promise<string[]> {\n    const { repositories, stores, overrides, patches } = this.loadConfig();\n    const parsed = parseAssetRef(ref);\n\n    // Ensure clones.\n    for (const [name, decl] of Object.entries(repositories)) {\n      try {\n        ensureRepo(decl, name, this.reposDir, { projectDir: this.projectDir });\n      } catch {}\n    }\n\n    const provenanceIndex = buildProvenanceIndex(this.buildClones(repositories), {\n      projectDir: this.projectDir,\n    });\n    const { resolved, missing } = await resolveAll([ref], {\n      provenanceIndex,\n      overrides,\n      stores,\n      storeFetcher: this.buildStoreFetcher(stores),\n      projectDir: this.projectDir,\n    });\n    if (resolved.length === 0) {\n      throw new Error(\n        `Asset not found: ${ref}${missing.length ? ` (missing: ${missing.join(\", \")})` : \"\"}`,\n      );\n    }\n\n    const entries = resolved\n      .map((c) => this.candidateToCatalogEntry(c, repositories))\n      .filter((e): e is CatalogEntry => e !== null);\n    const deployed = deployAll(entries, repositories, patches, this.deployOpts);\n\n    // Add to skaile.yaml dependencies (canonical ref string).\n    this.addDependencyToConfig(ref);\n\n    for (const d of deployed) {\n      appendHistory(this.projectDir, {\n        ref: d,\n        action: \"add\",\n        timestamp: new Date().toISOString(),\n        context: this.global ? \"global\" : \"project\",\n      });\n    }\n\n    return deployed;\n  }\n\n  /**\n   * Remove a deployed asset and unregister it from `skaile.yaml`.\n   *\n   * @param ref - Asset ref in `kind:name` form (e.g. `skill:my-skill`).\n   * @returns `true` if the asset was found and removed, `false` if it was not deployed.\n   */\n  remove(ref: string): boolean {\n    const parsed = parseAssetRef(ref);\n    const ok = removeAsset(parsed.kind, parsed.name, this.deployOpts);\n    if (ok) {\n      const depRef = `${parsed.kind}:${parsed.name}`;\n      this.removeDependencyFromConfig(depRef);\n\n      appendHistory(this.projectDir, {\n        ref: depRef,\n        action: \"remove\",\n        timestamp: new Date().toISOString(),\n        context: this.global ? \"global\" : \"project\",\n      });\n    }\n    return ok;\n  }\n\n  // ── Query ──────────────────────────────────────────────────────────────\n\n  /**\n   * Search the catalog across all configured repositories.\n   *\n   * @param query - Substring to match against entry names and descriptions (case-insensitive).\n   *   Omit to return all entries.\n   * @param kind - Filter by asset kind (`\"skill\"`, `\"agent\"`, `\"prompt\"`, `\"flow\"`, `\"contract\"`).\n   *   Omit to return all kinds.\n   * @returns Array of matching {@link CatalogEntry} objects from all accessible repositories.\n   */\n  search(query?: string, kind?: string): CatalogEntry[] {\n    const { repositories } = this.loadConfig();\n    let all: CatalogEntry[] = [];\n\n    for (const [name, decl] of Object.entries(repositories)) {\n      const repoDir = this.resolveRepoDir(decl, name);\n      if (!repoDir) continue;\n      all = [...all, ...scanRepo(repoDir, name)];\n    }\n\n    if (kind) all = all.filter((e) => e.kind === kind);\n    if (query) {\n      const q = query.toLowerCase();\n      all = all.filter(\n        (e) => e.name.toLowerCase().includes(q) || e.description.toLowerCase().includes(q),\n      );\n    }\n    return all;\n  }\n\n  /**\n   * Look up a single asset's full catalog entry.\n   *\n   * @param ref - Asset ref in `kind:name` or `repo/kind:name` form.\n   * @returns The matching {@link CatalogEntry}, or `null` when not found.\n   */\n  info(ref: string): CatalogEntry | null {\n    const { repositories } = this.loadConfig();\n    const parsed = parseAssetRef(ref);\n\n    for (const [name, decl] of Object.entries(repositories)) {\n      const repoDir = this.resolveRepoDir(decl, name);\n      if (!repoDir) continue;\n      if (parsed.publisher && parsed.publisher !== name) continue;\n      const entries = scanRepo(repoDir, name);\n      const match = entries.find((e) => e.kind === parsed.kind && e.name === parsed.name);\n      if (match) return match;\n    }\n    return null;\n  }\n\n  /**\n   * List all assets currently deployed in the workspace (or global cache).\n   *\n   * Scans the framework deploy directories rather than the lock file, so it\n   * also returns assets that were installed manually or outside of `skaile install`.\n   *\n   * @param kind - Filter by asset kind. Omit to return all kinds.\n   * @returns Shallow {@link CatalogEntry} objects (description and version will be empty).\n   */\n  listDeployed(kind?: string): CatalogEntry[] {\n    // Bundles are dependency groups, not deployed as files — exclude from scan\n    const kinds = (\n      kind ? [kind] : [\"skill\", \"agent\", \"prompt\", \"flow\", \"contract\"]\n    ) as AiComponent[];\n    const result: CatalogEntry[] = [];\n    const seen = new Set<string>();\n    for (const k of kinds) {\n      try {\n        const base = deployedBase(k, this.driverTarget, this.global, this.projectDir);\n        if (!existsSync(base)) continue;\n        for (const item of readdirSync(base, { withFileTypes: true })) {\n          // Directories and symlinks use the directory name directly (skills, omp agents, etc.)\n          // Files use the stem without extension (claude-code agents → .md, codex agents → .toml,\n          // prompts → .prompt.md, flows → .flow.yaml/.flow.json)\n          let name: string;\n          if (item.isDirectory() || item.isSymbolicLink()) {\n            name = item.name;\n          } else if (item.isFile()) {\n            name = item.name\n              .replace(/\\.prompt\\.md$/, \"\")\n              .replace(/\\.flow\\.(yaml|json)$/, \"\")\n              .replace(/\\.bundle\\.yaml$/, \"\")\n              .replace(/\\.(md|toml|yaml|json)$/, \"\");\n          } else {\n            continue;\n          }\n          const key = `${k}:${name}`;\n          if (seen.has(key)) continue;\n          seen.add(key);\n          result.push({\n            name,\n            kind: k as any,\n            description: \"\",\n            source: join(base, item.name),\n            version: \"\",\n            requires: [],\n            dependencies: [],\n          });\n        }\n      } catch {}\n    }\n    return result;\n  }\n\n  /**\n   * Build an aggregated workspace overview with domain grouping and sync status.\n   *\n   * Combines deployed assets, lock file metadata, and live repository status\n   * into a single structured result. Used by `skaile status`.\n   *\n   * @returns {@link OverviewResult} with entries grouped by domain and per-repo sync status.\n   */\n  overview(): OverviewResult {\n    const { repositories } = this.loadConfig();\n    const lock = this.tryReadLock();\n    const deployed = this.listDeployed();\n\n    // Get repo sync status\n    const repoStatuses = new Map<string, RepoStatusInfo>();\n    for (const [name, decl] of Object.entries(repositories)) {\n      const status = checkRepoStatus(decl, name, this.reposDir);\n      repoStatuses.set(name, {\n        name,\n        kind: status.kind,\n        behind: status.behind,\n        upToDate: status.upToDate,\n        error: status.error,\n      });\n    }\n\n    // Index lock entries by their <kind>:<name> suffix for deployed-asset lookup.\n    const lockByKindName = new Map<string, { publisher: string; version: string; url: string }>();\n    for (const [key] of Object.entries(lock?.assets ?? {})) {\n      const parsed = parseCanonicalLockKey(key);\n      if (parsed.kind && parsed.name && parsed.publisher && parsed.version) {\n        lockByKindName.set(`${parsed.kind}:${parsed.name}`, {\n          publisher: parsed.publisher,\n          version: parsed.version,\n          url: lock!.assets[key]!.source.url,\n        });\n      }\n    }\n\n    // Build entries with publisher + sync info. Domain grouping is by publisher\n    // now that the lock no longer records a project-local domain.\n    const entries: OverviewEntry[] = [];\n    for (const d of deployed) {\n      const lockEntry = lockByKindName.get(`${d.kind}:${d.name}`);\n      const publisher = lockEntry?.publisher ?? \"\";\n      const version = lockEntry?.version ?? \"\";\n      const slug = lockEntry ? sourceSlug(lockEntry.url) : \"\";\n      let syncStatus = \"unknown\";\n      if (slug) {\n        const repoStatus = repoStatuses.get(slug);\n        if (!repoStatus) syncStatus = \"unknown\";\n        else if (repoStatus.kind === \"local\") syncStatus = \"local\";\n        else if (repoStatus.error) syncStatus = \"error\";\n        else if (repoStatus.upToDate) syncStatus = \"synced\";\n        else syncStatus = \"outdated\";\n      }\n      const domain = publisher || \"unknown\";\n      entries.push({ kind: d.kind, name: d.name, domain, publisher, version, syncStatus });\n    }\n\n    // Group by domain (= publisher)\n    const byDomain = new Map<string, OverviewEntry[]>();\n    for (const e of entries) {\n      if (!byDomain.has(e.domain)) byDomain.set(e.domain, []);\n      byDomain.get(e.domain)!.push(e);\n    }\n\n    // Sort domains alphabetically, entries within domain by kind then name\n    const sorted = new Map<string, OverviewEntry[]>();\n    for (const key of [...byDomain.keys()].sort()) {\n      sorted.set(\n        key,\n        byDomain\n          .get(key)!\n          .sort((a, b) =>\n            a.kind !== b.kind ? a.kind.localeCompare(b.kind) : a.name.localeCompare(b.name),\n          ),\n      );\n    }\n\n    return {\n      byDomain: sorted,\n      total: entries.length,\n      repos: [...repoStatuses.values()],\n    };\n  }\n\n  /**\n   * Build the resolved dependency tree from the lock file.\n   *\n   * @returns Root {@link DependencyNode} with `ref === \"project\"` whose children\n   *   are the directly-declared dependencies, each with their own transitive subtrees.\n   *   Returns a single node with `ref === \"(no lock file)\"` when no lock exists.\n   */\n  tree(): DependencyNode {\n    const lock = this.tryReadLock();\n    if (!lock) return { ref: \"(no lock file)\", children: [] };\n\n    // v2 lock no longer records per-asset parent provenance — every locked asset\n    // is shown as a direct child of the project (flat tree).\n    return {\n      ref: \"project\",\n      children: Object.keys(lock.assets).map((ref) => ({ ref, children: [] })),\n    };\n  }\n\n  /**\n   * Explain why an asset is installed by tracing its dependency chain in the lock file.\n   *\n   * @param ref - Asset ref in `kind:name` form.\n   * @returns Chain of refs from the asset back to `\"direct (skaile.yaml)\"`, or `[]` when\n   *   the asset is not in the lock file.\n   */\n  why(ref: string): string[] {\n    const lock = this.tryReadLock();\n    if (!lock) return [];\n    if (!lock.assets[ref]) return []; // not in lock file\n    // v2 lock no longer records a dep chain — every locked asset is reported as\n    // directly declared. (Transitive provenance reconstruction is out of scope.)\n    return [ref, \"direct (skaile.yaml)\"];\n  }\n\n  /**\n   * List installed assets whose source repository is behind the remote.\n   *\n   * Only remote repositories (not local paths) are checked for staleness.\n   *\n   * @returns Array of {@link OutdatedEntry} objects, one per asset in a repository\n   *   that has commits not yet pulled locally.\n   */\n  outdated(): OutdatedEntry[] {\n    const { repositories } = this.loadConfig();\n    const lock = this.tryReadLock();\n    if (!lock) return [];\n\n    const result: OutdatedEntry[] = [];\n    for (const src of lock.sources) {\n      const slug = sourceSlug(src.url);\n      const decl = repositories[slug];\n      if (!decl || decl.path) continue; // skip unknown / local sources\n      const status = checkRepoStatus(decl, slug, this.reposDir);\n      if (status.behind <= 0) continue;\n      for (const [ref, entry] of Object.entries(lock.assets)) {\n        if (entry.source.url !== src.url) continue;\n        const { publisher, kind, name, version } = parseCanonicalLockKey(ref);\n        if (!kind || !name) continue;\n        result.push({\n          kind,\n          name,\n          publisher: publisher ?? slug,\n          currentVersion: version ?? \"\",\n          behind: status.behind,\n        });\n      }\n    }\n    return result;\n  }\n\n  /**\n   * Produce a unified diff between the deployed asset and its catalog source.\n   *\n   * Useful for detecting manual edits to deployed files or verifying that a patch\n   * was applied correctly.\n   *\n   * @param ref - Asset ref in `kind:name` form.\n   * @returns Unified diff string, or `null` when there are no differences or the\n   *   asset is not deployed/resolvable.\n   */\n  diff(ref: string): string | null {\n    const parsed = parseAssetRef(ref);\n    const entry = this.info(ref);\n    if (!entry) return null;\n\n    const deployedPath = join(\n      deployedBase(parsed.kind as AiComponent, this.driverTarget, this.global, this.projectDir),\n      parsed.name,\n    );\n    if (!existsSync(deployedPath) || !existsSync(entry.source)) return null;\n\n    const r = spawnSync(\"diff\", [\"-ruN\", entry.source, deployedPath], { encoding: \"utf8\" });\n    return r.status === 1 ? r.stdout : null;\n  }\n\n  // ── Lock ───────────────────────────────────────────────────────────────\n\n  /**\n   * Resolve all declared dependencies and write (or overwrite) `skaile.lock.yaml`.\n   *\n   * Performs repository sync and full dependency resolution without deploying assets.\n   * Use this to regenerate the lock file after manually editing `skaile.yaml`.\n   *\n   * @returns The written {@link LockFile} data.\n   */\n  async lock(): Promise<LockFile> {\n    const { repositories, stores, dependencies, overrides } = this.loadConfig();\n\n    for (const [name, decl] of Object.entries(repositories)) {\n      try {\n        ensureRepo(decl, name, this.reposDir, { projectDir: this.projectDir });\n      } catch {}\n    }\n\n    const provenanceIndex = buildProvenanceIndex(this.buildClones(repositories), {\n      projectDir: this.projectDir,\n    });\n    const { resolved, overridesApplied } = await resolveAll(dependencies, {\n      provenanceIndex,\n      overrides,\n      stores,\n      storeFetcher: this.buildStoreFetcher(stores),\n      projectDir: this.projectDir,\n    });\n    const lockData = buildLockFile(resolved, overridesApplied);\n    writeLock(this.lockPath, lockData);\n    return lockData;\n  }\n\n  // ── Patch workflow ─────────────────────────────────────────────────────\n\n  /**\n   * Extract a deployed asset into a patch working directory for editing.\n   *\n   * Copies the deployed asset to `.skaile/patches/<kind>-<name>/` so changes\n   * can be made there and then committed as a patch file via `patchCommit`.\n   *\n   * @param ref - Asset ref in `kind:name` form.\n   * @returns Absolute path to the patch working directory.\n   * @throws When the asset cannot be found in the catalog.\n   */\n  patch(ref: string): string {\n    const entry = this.info(ref);\n    if (!entry) throw new Error(`Asset not found: ${ref}`);\n    return extractForPatch(entry, this.patchDir);\n  }\n\n  /**\n   * Generate a `.patch` file from changes made in the patch working directory.\n   *\n   * Diffs the patch working directory against the original catalog source and\n   * writes the result to `.skaile/patches/<kind>-<name>.patch`.\n   *\n   * @param ref - Asset ref in `kind:name` form.\n   * @returns Absolute path to the generated `.patch` file.\n   * @throws When the patch working directory does not exist or no differences are found.\n   */\n  patchCommit(ref: string): string {\n    const parsed = parseAssetRef(ref);\n    const entry = this.info(ref);\n    if (!entry) throw new Error(`Asset not found: ${ref}`);\n\n    const patchedDir = join(this.patchDir, `${parsed.kind}-${parsed.name}`);\n    if (!existsSync(patchedDir)) {\n      throw new Error(`No patch working dir found. Run \\`skaile patch ${ref}\\` first.`);\n    }\n\n    const originalDir = dirname(entry.source);\n    const content = generatePatch(originalDir, patchedDir);\n    if (!content) throw new Error(\"No differences found.\");\n\n    const patchFile = join(this.patchDir, `${parsed.kind}-${parsed.name}.patch`);\n    savePatch(patchFile, content);\n    return patchFile;\n  }\n\n  /**\n   * Apply the committed patch file to the repository clone and open a contribution branch.\n   *\n   * Applies `.skaile/patches/<kind>-<name>.patch` to the repository clone, creates a\n   * `patch/<kind>-<name>` branch, and stages a commit — ready to push via `contribPush`.\n   *\n   * @param ref - Asset ref in `kind:name` form.\n   * @throws When the asset is not found, has no repository, or the patch file is missing.\n   */\n  patchSubmit(ref: string): void {\n    const parsed = parseAssetRef(ref);\n    const entry = this.info(ref);\n    if (!entry?.publisher) throw new Error(`Asset not found or no publisher: ${ref}`);\n\n    const { repositories } = this.loadConfig();\n    const decl = repositories[entry.publisher];\n    if (!decl?.url) throw new Error(\"Can only submit patches for remote sources.\");\n\n    const repoDir = join(this.reposDir, entry.publisher);\n    const branchName = `patch/${parsed.kind}-${parsed.name}`;\n\n    // Apply patch to repo clone\n    const patchFile = join(this.patchDir, `${parsed.kind}-${parsed.name}.patch`);\n    if (!existsSync(patchFile)) throw new Error(\"No patch file. Run `skaile patch-commit` first.\");\n\n    coreApplyPatch(repoDir, patchFile);\n    commitChanges(repoDir, `fix: improve ${parsed.kind} ${parsed.name}`, branchName);\n  }\n\n  /**\n   * Delete the patch working directory and patch file for an asset.\n   *\n   * @param ref - Asset ref in `kind:name` form.\n   */\n  patchRemove(ref: string): void {\n    const parsed = parseAssetRef(ref);\n    const patchFile = join(this.patchDir, `${parsed.kind}-${parsed.name}.patch`);\n    const patchedDir = join(this.patchDir, `${parsed.kind}-${parsed.name}`);\n    try {\n      rmSync(patchFile);\n    } catch {}\n    try {\n      rmSync(patchedDir, { recursive: true });\n    } catch {}\n  }\n\n  // ── Doctor ─────────────────────────────────────────────────────────────\n\n  /**\n   * Scan deployed assets for unsatisfied transitive dependencies.\n   *\n   * For each deployed asset, checks that all entries in its `requires` list are\n   * also deployed. Returns a list of issues with a flag indicating whether the\n   * missing dependency can be resolved from a configured repository.\n   *\n   * @returns Array of {@link DepIssue} objects. An empty array means the workspace is healthy.\n   */\n  doctor(): DepIssue[] {\n    const { repositories } = this.loadConfig();\n    const deployed = this.listDeployed();\n    const issues: DepIssue[] = [];\n\n    for (const entry of deployed) {\n      const full = this.info(`${entry.kind}:${entry.name}`);\n      if (!full) continue;\n      for (const req of full.requires) {\n        if (\n          !isDeployed(\n            req.kind as AiComponent,\n            req.name,\n            this.driverTarget,\n            this.global,\n            this.projectDir,\n          )\n        ) {\n          const inRepos =\n            resolveAsset({ kind: req.kind, name: req.name }, repositories, this.reposDir) !== null;\n          issues.push({\n            assetKind: entry.kind,\n            assetName: entry.name,\n            depKind: req.kind,\n            depName: req.name,\n            inRepos,\n          });\n        }\n      }\n    }\n    return issues;\n  }\n\n  // ── Scaffold ───────────────────────────────────────────────────────────\n\n  /**\n   * Create a minimal asset scaffold directory (delegates to {@link createScaffold}).\n   *\n   * @param name - Asset name (also used as the directory name).\n   * @param kind - Asset kind: `skill` | `agent` | `bundle` | `flow` | `prompt` | `contract`.\n   * @param destDir - Parent directory to create the asset in.\n   * @returns `{ ok: true, path }` on success, `{ ok: false, path: errorMessage }` if the\n   *   directory already exists.\n   */\n  create(name: string, kind: string, destDir: string): { ok: boolean; path: string } {\n    return createScaffold(name, kind, destDir);\n  }\n\n  // ── Contrib (REMOVED 2026-05-12) ───────────────────────────────────────\n  //\n  // The `contribChanges / contribDiff / contribCommit / contribPush /\n  // contribCompare` methods were retired alongside `skaile repo contrib *`.\n  // The refinement push-back workflow is being re-introduced in Phase 4 as\n  // `skaile publish` + `skaile preset push` against the Library Source model.\n\n  // ── History ────────────────────────────────────────────────────────────\n\n  /**\n   * Return recent asset action history entries, newest first.\n   *\n   * @param limit - Maximum number of entries to return. Defaults to `20`.\n   * @returns Array of {@link HistoryEntry} objects in reverse-chronological order.\n   */\n  history(limit = 20): HistoryEntry[] {\n    return getRecentHistory(this.projectDir, limit);\n  }\n\n  /**\n   * Erase all asset action history for this workspace.\n   */\n  clearHistory(): void {\n    clearHistory(this.projectDir);\n  }\n\n  // ── Clean ───────────────────────────────────────────────────────────────\n\n  /**\n   * Remove deployed assets tracked by the lock file and report unmanaged ones.\n   *\n   * With `opts.all`, also deletes `.skaile/history.yaml`, `.skaile/patches/`,\n   * `.skaile/repos/`, and `skaile.lock.yaml` — effectively resetting the workspace\n   * to a pre-install state.\n   *\n   * @param opts - Optional cleanup options.\n   * @param opts.all - When `true`, remove all Skaile-managed state in addition to deployed assets.\n   * @returns Object with `removed` (successfully cleaned refs), `skipped` (with reasons),\n   *   and `unmanaged` (deployed assets not in the lock file).\n   */\n  clean(opts?: { all?: boolean }): {\n    removed: string[];\n    skipped: Array<{ ref: string; reason: string }>;\n    unmanaged: string[];\n  } {\n    const lock = this.tryReadLock();\n    const removed: string[] = [];\n    const skipped: Array<{ ref: string; reason: string }> = [];\n\n    if (lock) {\n      for (const ref of Object.keys(lock.assets)) {\n        const { kind, name } = parseCanonicalLockKey(ref);\n        if (!kind || !name) continue;\n        const dest = deployedDir(\n          kind as AiComponent,\n          name,\n          this.driverTarget,\n          this.global,\n          this.projectDir,\n        );\n\n        try {\n          const stat = lstatSync(dest);\n          if (stat.isSymbolicLink()) unlinkSync(dest);\n          else rmSync(dest, { recursive: true, force: true });\n          removed.push(ref);\n        } catch {\n          // Already gone — count as removed\n          removed.push(ref);\n        }\n      }\n    }\n\n    // Collect unmanaged assets for reporting. Deployed assets are keyed by\n    // <kind>:<name>; map lock canonical refs to that shape for comparison.\n    const lockRefs = lock\n      ? new Set(\n          Object.keys(lock.assets).map((r) => {\n            const p = parseCanonicalLockKey(r);\n            return p.kind && p.name ? `${p.kind}:${p.name}` : r;\n          }),\n        )\n      : new Set<string>();\n    const unmanaged: string[] = [];\n    const allDeployed = this.listDeployed();\n    for (const d of allDeployed) {\n      const ref = `${d.kind}:${d.name}`;\n      if (!lockRefs.has(ref)) {\n        unmanaged.push(ref);\n      }\n    }\n\n    if (opts?.all) {\n      // Delete history file\n      const historyFile = join(this.projectDir, \".skaile\", \"history.yaml\");\n      try {\n        unlinkSync(historyFile);\n      } catch {}\n\n      // Remove patches dir\n      try {\n        rmSync(this.patchDir, { recursive: true, force: true });\n      } catch {}\n\n      // Remove repos dir\n      try {\n        rmSync(this.reposDir, { recursive: true, force: true });\n      } catch {}\n\n      // Remove lock file\n      try {\n        unlinkSync(this.lockPath);\n      } catch {}\n    }\n\n    return { removed, skipped, unmanaged };\n  }\n\n  // ── Helpers ────────────────────────────────────────────────────────────\n\n  /** Add a dependency ref to skaile.yaml if not already present. */\n  private addDependencyToConfig(ref: string): void {\n    if (this.global) return; // global installs don't modify skaile.yaml\n    const configPath = join(this.projectDir, \"skaile.yaml\");\n    if (!existsSync(configPath)) return;\n    const raw = parseYaml(readFileSync(configPath, \"utf8\")) ?? {};\n    if (!raw.dependencies) raw.dependencies = [];\n    if (!raw.dependencies.includes(ref)) {\n      raw.dependencies.push(ref);\n      writeFileSync(configPath, stringifyYaml(raw, { lineWidth: 120 }));\n    }\n  }\n\n  /** Remove a dependency ref from skaile.yaml. */\n  private removeDependencyFromConfig(ref: string): void {\n    if (this.global) return;\n    const configPath = join(this.projectDir, \"skaile.yaml\");\n    if (!existsSync(configPath)) return;\n    const raw = parseYaml(readFileSync(configPath, \"utf8\")) ?? {};\n    if (!raw.dependencies) return;\n    const idx = raw.dependencies.indexOf(ref);\n    if (idx !== -1) {\n      raw.dependencies.splice(idx, 1);\n      writeFileSync(configPath, stringifyYaml(raw, { lineWidth: 120 }));\n    }\n  }\n\n  private resolveRepoDir(decl: SourceDeclaration, name: string): string | null {\n    // Check links first\n    const links = readLinks(this.projectDir);\n    if (links[name]) {\n      return existsSync(links[name]) ? links[name] : null;\n    }\n\n    if (decl.path) {\n      const resolved = resolve(this.projectDir, decl.path);\n      return existsSync(resolved) ? resolved : null;\n    }\n\n    // Check project-local symlink, then global cache\n    const dest = join(this.reposDir, name);\n    if (existsSync(dest)) return dest;\n\n    const globalDest = join(getGlobalCacheDir(), name);\n    if (existsSync(join(globalDest, \".git\"))) return globalDest;\n\n    return null;\n  }\n}\n\n// ── Agent install (renders GitAgent packages to framework-native files) ──\n\nexport { installAgent } from \"./install-agent.js\";\n\n// ── Renderers ─────────────────────────────────────────────────────────────\n\nexport {\n  AGENT_RENDERERS,\n  claudeCodeRenderer,\n  codexRenderer,\n  driverTargetSupportsAgents,\n  ompRenderer,\n} from \"./renderers.js\";\nexport type { AgentRenderer, AgentRenderInput, AgentRenderResult } from \"./renderers.js\";\n\n// ── Fragments ─────────────────────────────────────────────────────────────\n\nexport type {\n  AbilityRef,\n  ConnectorRef,\n  ContractRef,\n  FragmentContext,\n  FragmentId,\n} from \"./fragments.js\";\nexport { BUILT_IN_FRAGMENTS, resolveFragments, loadPromptExtensions } from \"./fragments.js\";\n"]}

package/dist/{chunk-NBJ5TOEC.js → chunk-ODPII24X.js}

@@ -1,4 +1,4 @@
-import { resolveSkWorkspaceConfig } from './chunk-V5TBKO5Q.js';
+import { resolveSkWorkspaceConfig } from './chunk-542K7SR6.js';
 import { createLogger } from './chunk-24UIWON4.js';
 
 // connectors/src/secrets.ts
@@ -302,5 +302,5 @@ function resolveAuthRef(auth, mountId) {
 }
 
 export { EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, loadConnectorDeclarations, resolveAuth, resolveAuthRef, resolveBackendAuthFor };
-//# sourceMappingURL=chunk-NBJ5TOEC.js.map
-//# sourceMappingURL=chunk-NBJ5TOEC.js.map
+//# sourceMappingURL=chunk-ODPII24X.js.map
+//# sourceMappingURL=chunk-ODPII24X.js.map

package/dist/{chunk-NBJ5TOEC.js.map → chunk-ODPII24X.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;AAUA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAGT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,GAAA,CAAI,IAAA,EAA6B,EAAA,EAAY,IAAA,EAAiC;AAC5E,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAA6B,EAAA,EAAqB;AACtD,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAA6B,EAAA,EAA6C;AAChF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,IAAI,UAAA,CAAW,QAAQ,KAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,CAAA,EAAI,OAAO,MAAA;AACxE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,QAAA,EAAU,OAAO,KAAA,EAAO,QAAA,EAAU,UAAU,YAAY,CAAA;AAExF,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AChaO,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,UAAA,IAAc,MAAA,CAAO,WAAW,MAAA,KAAW,CAAA,SAAU,EAAC;AAClE,EAAA,OAAO,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA;AAC9D;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AAWO,SAAS,WAAA,CACd,MACA,OAAA,EACoB;AACpB,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI,OAAA,EAAS,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AACxC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC3B,IAAA,OAAO,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,IAAA;AACT;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD","file":"chunk-NBJ5TOEC.js","sourcesContent":["/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>` and `connector:<id>`. Returns\n * `undefined` for any other ref so the chain falls through to the next\n * provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n * capabilities stay strictly in-process — no round trip to the platform to\n * mint while the mount is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n   * capability handlers when the platform delivers new credentials\n   * mid-session.\n   */\n  set(kind: \"mount\" | \"connector\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\"))) return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\"env:\", \"forge:\", \"op:\", \"kp:\", \"oauth:\", \"mount:\", \"connector:\"] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Array of connector declarations, or an empty array if none are declared.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  if (!config.connectors || config.connectors.length === 0) return [];\n  return config.connectors.map(workspaceConnectorToDeclaration);\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  }\n\n  return decl;\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n/**\n * Resolve a credential reference using a `SecretProvider`, or fall back to `env:NAME` lookup.\n * @param auth - Credential reference (e.g. `\"env:GIT_TOKEN\"`).\n * @param secrets - Optional provider; falls back to `process.env` if omitted.\n * @returns Resolved secret value or `undefined`.\n * @deprecated Use `SecretProviderChain.resolve()` instead.\n * @docLink packages/connectors/api-reference#resolve-auth\n */\n// @TODO: Code-Review: deprecated shim kept for backward compat — remove once all callers migrate to SecretProviderChain.resolve()\nexport function resolveAuth(\n  auth: string | undefined,\n  secrets?: import(\"./secrets.js\").SecretProvider,\n): string | undefined {\n  if (!auth) return undefined;\n  if (secrets) return secrets.resolve(auth);\n  if (auth.startsWith(\"env:\")) {\n    const envVar = auth.slice(4);\n    return process.env[envVar];\n  }\n  return auth;\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n"]}
+{"version":3,"sources":["../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;AAUA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAGT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,GAAA,CAAI,IAAA,EAA6B,EAAA,EAAY,IAAA,EAAiC;AAC5E,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAA6B,EAAA,EAAqB;AACtD,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAA6B,EAAA,EAA6C;AAChF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,IAAI,UAAA,CAAW,QAAQ,KAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,CAAA,EAAI,OAAO,MAAA;AACxE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,QAAA,EAAU,OAAO,KAAA,EAAO,QAAA,EAAU,UAAU,YAAY,CAAA;AAExF,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AChaO,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,UAAA,IAAc,MAAA,CAAO,WAAW,MAAA,KAAW,CAAA,SAAU,EAAC;AAClE,EAAA,OAAO,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA;AAC9D;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AAWO,SAAS,WAAA,CACd,MACA,OAAA,EACoB;AACpB,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI,OAAA,EAAS,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AACxC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC3B,IAAA,OAAO,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,IAAA;AACT;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD","file":"chunk-ODPII24X.js","sourcesContent":["/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>` and `connector:<id>`. Returns\n * `undefined` for any other ref so the chain falls through to the next\n * provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n * capabilities stay strictly in-process — no round trip to the platform to\n * mint while the mount is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n   * capability handlers when the platform delivers new credentials\n   * mid-session.\n   */\n  set(kind: \"mount\" | \"connector\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\"))) return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\"env:\", \"forge:\", \"op:\", \"kp:\", \"oauth:\", \"mount:\", \"connector:\"] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Array of connector declarations, or an empty array if none are declared.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  if (!config.connectors || config.connectors.length === 0) return [];\n  return config.connectors.map(workspaceConnectorToDeclaration);\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  }\n\n  return decl;\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n/**\n * Resolve a credential reference using a `SecretProvider`, or fall back to `env:NAME` lookup.\n * @param auth - Credential reference (e.g. `\"env:GIT_TOKEN\"`).\n * @param secrets - Optional provider; falls back to `process.env` if omitted.\n * @returns Resolved secret value or `undefined`.\n * @deprecated Use `SecretProviderChain.resolve()` instead.\n * @docLink packages/connectors/api-reference#resolve-auth\n */\n// @TODO: Code-Review: deprecated shim kept for backward compat — remove once all callers migrate to SecretProviderChain.resolve()\nexport function resolveAuth(\n  auth: string | undefined,\n  secrets?: import(\"./secrets.js\").SecretProvider,\n): string | undefined {\n  if (!auth) return undefined;\n  if (secrets) return secrets.resolve(auth);\n  if (auth.startsWith(\"env:\")) {\n    const envVar = auth.slice(4);\n    return process.env[envVar];\n  }\n  return auth;\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n"]}

package/dist/{chunk-53UNDY6K.js → chunk-OYRW5RCM.js}

@@ -1,10 +1,10 @@
 import { initTelemetry } from './chunk-GCJXPUHG.js';
 import { parseSkillFrontmatter, validateFlowVersions } from './chunk-IPUYL6TD.js';
-import { FlowAdapter } from './chunk-OJN25VJO.js';
+import { FlowAdapter } from './chunk-HIIARTRZ.js';
 import { loadFlow } from './chunk-ICS76R4T.js';
 import { buildOrchestratorPrompt, renderStimulusPrompt } from './chunk-GZWJGNNN.js';
-import { resolveSettings } from './chunk-ETMUGBHF.js';
-import { resolveAgentDir, resolveSkWorkspaceConfig } from './chunk-V5TBKO5Q.js';
+import { resolveSettings } from './chunk-Z3M5K67G.js';
+import { resolveAgentDir, resolveSkWorkspaceConfig } from './chunk-542K7SR6.js';
 import { createLogger } from './chunk-24UIWON4.js';
 import fs from 'fs';
 import path from 'path';
@@ -389,5 +389,5 @@ function walkForSkill(dir, skillId) {
 }
 
 export { resumeFlow, runFlow };
-//# sourceMappingURL=chunk-53UNDY6K.js.map
-//# sourceMappingURL=chunk-53UNDY6K.js.map
+//# sourceMappingURL=chunk-OYRW5RCM.js.map
+//# sourceMappingURL=chunk-OYRW5RCM.js.map