@skaile/workspaces 0.25.0 → 0.27.0

package/dist/{chunk-LSGAYQ2E.js → chunk-5YO3H5Q4.js}

@@ -1,5 +1,5 @@
 import { findAiAssetsRoot } from './chunk-XCBG2KDC.js';
-import { parseSkillRequirements, validateRequirements, buildRequiresPreamble, parseSkillFrontmatter } from './chunk-IPUYL6TD.js';
+import { parseSkillRequirements, validateRequirements, buildRequiresPreamble, parseSkillFrontmatter } from './chunk-TV72ZJYN.js';
 import { okJson, err, ok } from './chunk-X5YPJV4N.js';
 import fs from 'fs/promises';
 import path from 'path';
@@ -162,5 +162,5 @@ async function skillGetPreamble(projectDir, skillId) {
 }
 
 export { skillCheckRequirements, skillGetPreamble, skillList, skillListDomains, skillSearch, skillShow };
-//# sourceMappingURL=chunk-LSGAYQ2E.js.map
-//# sourceMappingURL=chunk-LSGAYQ2E.js.map
+//# sourceMappingURL=chunk-5YO3H5Q4.js.map
+//# sourceMappingURL=chunk-5YO3H5Q4.js.map

package/dist/{chunk-LSGAYQ2E.js.map → chunk-5YO3H5Q4.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../workspace-plugin/src/tools/skills.ts"],"names":[],"mappings":";;;;;;AAyBA,eAAe,cAAA,CAAe,GAAA,EAAa,MAAA,EAAgB,GAAA,EAAkC;AAC3F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,EAAA,CAAG,OAAA,CAAQ,KAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,MAAA,EAAO,IAAK,CAAA,CAAE,IAAA,KAAS,UAAU,CAAA;AAC1E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAU,CAAA;AAC7C,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,QAAA,CAAS,aAAa,OAAO,CAAA;AACtD,MAAA,MAAM,EAAA,GAAK,sBAAsB,OAAO,CAAA;AACxC,MAAA,MAAM,IAAA,GAAO,OAAO,EAAA,CAAG,IAAA,KAAS,WAAW,EAAA,CAAG,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AACtE,MAAA,MAAM,cAAc,OAAO,EAAA,CAAG,WAAA,KAAgB,QAAA,GAAW,GAAG,WAAA,GAAc,EAAA;AAC1E,MAAA,MAAM,SAAS,OAAO,EAAA,CAAG,MAAA,KAAW,QAAA,GAAW,GAAG,MAAA,GAAS,KAAA,CAAA;AAC3D,MAAA,MAAM,UAAU,OAAO,EAAA,CAAG,OAAA,KAAY,QAAA,GAAW,GAAG,OAAA,GAAU,KAAA,CAAA;AAC9D,MAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,GAAG,QAAQ,CAAA,GAAK,GAAG,QAAA,GAAwB,KAAA,CAAA;AAC1E,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,EAAA,EAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAAA,QACrB,IAAA;AAAA,QACA,WAAA;AAAA,QACA,MAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA,EAAM,WAAA;AAAA,QACN;AAAA,OACD,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,MAAA,MAAM,cAAA,CAAe,KAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA,EAAG,QAAQ,GAAG,CAAA;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,eAAe,UAAA,CAAW,cAAsB,YAAA,EAA8C;AAC5F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,OAAA,CAAQ,cAAc,EAAE,aAAA,EAAe,MAAM,CAAA;AACtE,IAAA,OAAA,GAAU,OAAA,CACP,OAAO,CAAC,CAAA,KAAM,EAAE,WAAA,EAAa,EAC7B,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAI,EACjB,MAAA,CAAO,CAAC,SAAS,CAAC,YAAA,IAAgB,SAAS,YAAY,CAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,QAAQ,QAAQ,CAAA;AAC1D,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,CAAG,OAAO,SAAS,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,cAAA,CAAe,SAAA,EAAW,MAAA,EAAQ,GAAG,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,GAAA;AACT;AAgBA,eAAsB,SAAA,CACpB,YACA,MAAA,EACqB;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,MAAA,CAAO,EAAE,CAAA;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,MAAM,CAAA;AACpD,IAAA,OAAO,MAAA;AAAA,MACL,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjB,IAAI,CAAA,CAAE,EAAA;AAAA,QACN,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,aAAa,CAAA,CAAE,WAAA;AAAA,QACf,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,QAAQ,CAAA,CAAE;AAAA,OACZ,CAAE;AAAA,KACJ;AAAA,EACF,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAYA,eAAsB,iBAAiB,UAAA,EAAyC;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,MAAA,CAAO,EAAE,CAAA;AACnC,IAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,OAAA,CAAQ,cAAc,EAAE,aAAA,EAAe,MAAM,CAAA;AACtE,IAAA,MAAM,OAAA,GAAU,QACb,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,WAAA,EAAa,CAAA,CAC7B,GAAA,CAAI,CAAC,OAAO,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,IAAA,EAAM,IAAA,CAAK,KAAK,YAAA,EAAc,CAAA,CAAE,IAAI,CAAA,EAAE,CAAE,CAAA;AACvE,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,SAAA,CAAU,YAAoB,OAAA,EAAsC;AACxF,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,KAAA,CAAS,CAAA;AACvD,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,OAAO,CAAA;AACjD,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,MAAM,UAAU,MAAM,EAAA,CAAG,QAAA,CAAS,KAAA,CAAM,MAAM,OAAO,CAAA;AACrD,IAAA,OAAO,GAAG,OAAO,CAAA;AAAA,EACnB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAaA,eAAsB,WAAA,CAAY,YAAoB,KAAA,EAAoC;AACxF,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,MAAA,CAAO,EAAE,CAAA;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,KAAA,CAAS,CAAA;AACvD,IAAA,MAAM,CAAA,GAAI,MAAM,WAAA,EAAY;AAC5B,IAAA,MAAM,UAAU,MAAA,CAAO,MAAA;AAAA,MACrB,CAAC,CAAA,KACC,CAAA,CAAE,IAAA,CAAK,aAAY,CAAE,QAAA,CAAS,CAAC,CAAA,IAC/B,EAAE,WAAA,CAAY,WAAA,EAAY,CAAE,QAAA,CAAS,CAAC,CAAA,IACtC,CAAA,CAAE,EAAA,CAAG,WAAA,GAAc,QAAA,CAAS,CAAC,CAAA,IAAA,CAC5B,CAAA,CAAE,YAAY,EAAC,EAAG,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,WAAA,EAAY,CAAE,QAAA,CAAS,CAAC,CAAC;AAAA,KAC9D;AACA,IAAA,OAAO,MAAA;AAAA,MACL,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAClB,IAAI,CAAA,CAAE,EAAA;AAAA,QACN,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,aAAa,CAAA,CAAE,WAAA;AAAA,QACf,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,QAAQ,CAAA,CAAE;AAAA,OACZ,CAAE;AAAA,KACJ;AAAA,EACF,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAgBA,eAAsB,sBAAA,CACpB,UAAA,EACA,OAAA,EACA,SAAA,EACqB;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,KAAA,CAAS,CAAA;AACvD,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,OAAO,CAAA;AACjD,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,MAAM,UAAU,MAAM,EAAA,CAAG,QAAA,CAAS,KAAA,CAAM,MAAM,OAAO,CAAA;AAErD,IAAA,MAAM,YAAA,GAAe,uBAAuB,OAAO,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,OAAA,EAAS,YAAA,EAAc,SAAS,CAAA;AACpE,IAAA,OAAO,OAAO,MAAM,CAAA;AAAA,EACtB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,gBAAA,CAAiB,YAAoB,OAAA,EAAsC;AAC/F,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,KAAA,CAAS,CAAA;AACvD,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,OAAO,CAAA;AACjD,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,MAAM,UAAU,MAAM,EAAA,CAAG,QAAA,CAAS,KAAA,CAAM,MAAM,OAAO,CAAA;AAErD,IAAA,MAAM,YAAA,GAAe,uBAAuB,OAAO,CAAA;AACnD,IAAA,MAAM,QAAA,GAAW,qBAAA,CAAsB,YAAA,EAAc,OAAO,CAAA;AAC5D,IAAA,OAAO,EAAA,CAAG,YAAY,4BAA4B,CAAA;AAAA,EACpD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF","file":"chunk-LSGAYQ2E.js","sourcesContent":["// src/tools/skills.ts\nimport fs from \"node:fs/promises\";\nimport type { Dirent } from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  parseSkillFrontmatter,\n  parseSkillRequirements,\n  validateRequirements,\n  buildRequiresPreamble,\n} from \"@skaile/workspaces/resolver\";\nimport { err, ok, okJson } from \"../types.js\";\nimport type { ToolResult } from \"../types.js\";\nimport { findAiAssetsRoot } from \"../utils/ai-assets.js\";\n\ninterface SkillEntry {\n  id: string;\n  name: string;\n  description: string;\n  source?: string;\n  version?: string;\n  keywords?: string[];\n  path: string;\n  domain: string;\n}\n\nasync function walkForSkillMd(dir: string, domain: string, acc: SkillEntry[]): Promise<void> {\n  let entries: Dirent<string>[];\n  try {\n    entries = await fs.readdir(dir, { withFileTypes: true });\n  } catch {\n    return;\n  }\n\n  // Check if this directory contains a SKILL.md\n  const hasSkillMd = entries.some((e) => e.isFile() && e.name === \"SKILL.md\");\n  if (hasSkillMd) {\n    const skillMdPath = path.join(dir, \"SKILL.md\");\n    try {\n      const content = await fs.readFile(skillMdPath, \"utf-8\");\n      const fm = parseSkillFrontmatter(content);\n      const name = typeof fm.name === \"string\" ? fm.name : path.basename(dir);\n      const description = typeof fm.description === \"string\" ? fm.description : \"\";\n      const source = typeof fm.source === \"string\" ? fm.source : undefined;\n      const version = typeof fm.version === \"string\" ? fm.version : undefined;\n      const keywords = Array.isArray(fm.keywords) ? (fm.keywords as string[]) : undefined;\n      acc.push({\n        id: path.basename(dir),\n        name,\n        description,\n        source,\n        version,\n        keywords,\n        path: skillMdPath,\n        domain,\n      });\n    } catch {\n      // skip unreadable files\n    }\n    return; // don't recurse inside a skill directory\n  }\n\n  // Recurse into subdirectories\n  for (const entry of entries) {\n    if (entry.isDirectory()) {\n      await walkForSkillMd(path.join(dir, entry.name), domain, acc);\n    }\n  }\n}\n\nasync function scanSkills(aiAssetsRoot: string, domainFilter?: string): Promise<SkillEntry[]> {\n  let domains: string[];\n  try {\n    const entries = await fs.readdir(aiAssetsRoot, { withFileTypes: true });\n    domains = entries\n      .filter((e) => e.isDirectory())\n      .map((e) => e.name)\n      .filter((name) => !domainFilter || name === domainFilter);\n  } catch {\n    return [];\n  }\n\n  const acc: SkillEntry[] = [];\n  for (const domain of domains) {\n    const skillsDir = path.join(aiAssetsRoot, domain, \"skills\");\n    try {\n      await fs.access(skillsDir);\n    } catch {\n      continue; // no skills/ dir in this domain\n    }\n    await walkForSkillMd(skillsDir, domain, acc);\n  }\n  return acc;\n}\n\n// ── Exported tool functions ────────────────────────────────────────────────────\n\n/**\n * List all skills in the `ai-assets` catalog, optionally filtered by domain.\n *\n * Walks every `<domain>/skills/` directory under the `ai-assets` root looking\n * for `SKILL.md` files.  Returns a JSON array of skill summaries\n * `{ id, name, description, source, version, keywords, domain }`.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param domain     - Optional domain name filter (e.g. `\"skaile-development\"`).\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillList(\n  projectDir: string,\n  domain: string | undefined,\n): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return okJson([]);\n    const skills = await scanSkills(aiAssetsRoot, domain);\n    return okJson(\n      skills.map((s) => ({\n        id: s.id,\n        name: s.name,\n        description: s.description,\n        source: s.source,\n        version: s.version,\n        keywords: s.keywords,\n        domain: s.domain,\n      })),\n    );\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * List all skill domains — the top-level directories under `ai-assets` that\n * contain a `skills/` subdirectory.\n *\n * Returns a JSON array of `{ name, path }` objects.\n *\n * @param projectDir - Absolute path to the skaile project root.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillListDomains(projectDir: string): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return okJson([]);\n    const entries = await fs.readdir(aiAssetsRoot, { withFileTypes: true });\n    const domains = entries\n      .filter((e) => e.isDirectory())\n      .map((e) => ({ name: e.name, path: path.join(aiAssetsRoot, e.name) }));\n    return okJson(domains);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Show the full `SKILL.md` content for a skill.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param skillId    - Skill ID (directory name) as returned by {@link skillList}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillShow(projectDir: string, skillId: string): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return err(`Skill not found: ${skillId}`);\n    const skills = await scanSkills(aiAssetsRoot, undefined);\n    const skill = skills.find((s) => s.id === skillId);\n    if (!skill) return err(`Skill not found: ${skillId}`);\n    const content = await fs.readFile(skill.path, \"utf-8\");\n    return ok(content);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Search skills by name, description, ID, or keywords.\n *\n * Case-insensitive substring match against all text fields in every skill\n * entry.  Returns the same summary shape as {@link skillList}.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param query      - Search string.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillSearch(projectDir: string, query: string): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return okJson([]);\n    const skills = await scanSkills(aiAssetsRoot, undefined);\n    const q = query.toLowerCase();\n    const matched = skills.filter(\n      (s) =>\n        s.name.toLowerCase().includes(q) ||\n        s.description.toLowerCase().includes(q) ||\n        s.id.toLowerCase().includes(q) ||\n        (s.keywords ?? []).some((k) => k.toLowerCase().includes(q)),\n    );\n    return okJson(\n      matched.map((s) => ({\n        id: s.id,\n        name: s.name,\n        description: s.description,\n        source: s.source,\n        version: s.version,\n        keywords: s.keywords,\n        domain: s.domain,\n      })),\n    );\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Validate that all prerequisites declared in a skill's `SKILL.md` are\n * satisfied in `targetDir`.\n *\n * Uses `@skaile/workspaces/resolver` to parse the `REQUIRES` / `READS` / `WRITES`\n * DSL and run the requirement checks against the filesystem.  Returns a\n * validation report as JSON.\n *\n * @param projectDir - Absolute path to the skaile project root (for skill lookup).\n * @param skillId    - Skill ID as returned by {@link skillList}.\n * @param targetDir  - Directory to validate against (typically the user's project).\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillCheckRequirements(\n  projectDir: string,\n  skillId: string,\n  targetDir: string,\n): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return err(`Skill not found: ${skillId}`);\n    const skills = await scanSkills(aiAssetsRoot, undefined);\n    const skill = skills.find((s) => s.id === skillId);\n    if (!skill) return err(`Skill not found: ${skillId}`);\n    const content = await fs.readFile(skill.path, \"utf-8\");\n\n    const requirements = parseSkillRequirements(content);\n    const report = validateRequirements(skillId, requirements, targetDir);\n    return okJson(report);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Get the formatted `REQUIRES`/`INPUT`/`READS`/`WRITES` DSL preamble for a skill.\n *\n * Uses `@skaile/workspaces/resolver` to build the requirements preamble that can be\n * prepended to the skill prompt for injection into the agent's context.\n * Returns `\"(no requirements declared)\"` when the skill has no requirements.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param skillId    - Skill ID as returned by {@link skillList}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillGetPreamble(projectDir: string, skillId: string): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return err(`Skill not found: ${skillId}`);\n    const skills = await scanSkills(aiAssetsRoot, undefined);\n    const skill = skills.find((s) => s.id === skillId);\n    if (!skill) return err(`Skill not found: ${skillId}`);\n    const content = await fs.readFile(skill.path, \"utf-8\");\n\n    const requirements = parseSkillRequirements(content);\n    const preamble = buildRequiresPreamble(requirements, skillId);\n    return ok(preamble || \"(no requirements declared)\");\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n"]}
+{"version":3,"sources":["../workspace-plugin/src/tools/skills.ts"],"names":[],"mappings":";;;;;;AAyBA,eAAe,cAAA,CAAe,GAAA,EAAa,MAAA,EAAgB,GAAA,EAAkC;AAC3F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,EAAA,CAAG,OAAA,CAAQ,KAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,MAAA,EAAO,IAAK,CAAA,CAAE,IAAA,KAAS,UAAU,CAAA;AAC1E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAU,CAAA;AAC7C,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,QAAA,CAAS,aAAa,OAAO,CAAA;AACtD,MAAA,MAAM,EAAA,GAAK,sBAAsB,OAAO,CAAA;AACxC,MAAA,MAAM,IAAA,GAAO,OAAO,EAAA,CAAG,IAAA,KAAS,WAAW,EAAA,CAAG,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AACtE,MAAA,MAAM,cAAc,OAAO,EAAA,CAAG,WAAA,KAAgB,QAAA,GAAW,GAAG,WAAA,GAAc,EAAA;AAC1E,MAAA,MAAM,SAAS,OAAO,EAAA,CAAG,MAAA,KAAW,QAAA,GAAW,GAAG,MAAA,GAAS,KAAA,CAAA;AAC3D,MAAA,MAAM,UAAU,OAAO,EAAA,CAAG,OAAA,KAAY,QAAA,GAAW,GAAG,OAAA,GAAU,KAAA,CAAA;AAC9D,MAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,GAAG,QAAQ,CAAA,GAAK,GAAG,QAAA,GAAwB,KAAA,CAAA;AAC1E,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,EAAA,EAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAAA,QACrB,IAAA;AAAA,QACA,WAAA;AAAA,QACA,MAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA,EAAM,WAAA;AAAA,QACN;AAAA,OACD,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,MAAA,MAAM,cAAA,CAAe,KAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA,EAAG,QAAQ,GAAG,CAAA;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,eAAe,UAAA,CAAW,cAAsB,YAAA,EAA8C;AAC5F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,OAAA,CAAQ,cAAc,EAAE,aAAA,EAAe,MAAM,CAAA;AACtE,IAAA,OAAA,GAAU,OAAA,CACP,OAAO,CAAC,CAAA,KAAM,EAAE,WAAA,EAAa,EAC7B,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAI,EACjB,MAAA,CAAO,CAAC,SAAS,CAAC,YAAA,IAAgB,SAAS,YAAY,CAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,QAAQ,QAAQ,CAAA;AAC1D,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,CAAG,OAAO,SAAS,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,cAAA,CAAe,SAAA,EAAW,MAAA,EAAQ,GAAG,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,GAAA;AACT;AAgBA,eAAsB,SAAA,CACpB,YACA,MAAA,EACqB;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,MAAA,CAAO,EAAE,CAAA;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,MAAM,CAAA;AACpD,IAAA,OAAO,MAAA;AAAA,MACL,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjB,IAAI,CAAA,CAAE,EAAA;AAAA,QACN,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,aAAa,CAAA,CAAE,WAAA;AAAA,QACf,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,QAAQ,CAAA,CAAE;AAAA,OACZ,CAAE;AAAA,KACJ;AAAA,EACF,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAYA,eAAsB,iBAAiB,UAAA,EAAyC;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,MAAA,CAAO,EAAE,CAAA;AACnC,IAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,OAAA,CAAQ,cAAc,EAAE,aAAA,EAAe,MAAM,CAAA;AACtE,IAAA,MAAM,OAAA,GAAU,QACb,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,WAAA,EAAa,CAAA,CAC7B,GAAA,CAAI,CAAC,OAAO,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,IAAA,EAAM,IAAA,CAAK,KAAK,YAAA,EAAc,CAAA,CAAE,IAAI,CAAA,EAAE,CAAE,CAAA;AACvE,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,SAAA,CAAU,YAAoB,OAAA,EAAsC;AACxF,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,KAAA,CAAS,CAAA;AACvD,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,OAAO,CAAA;AACjD,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,MAAM,UAAU,MAAM,EAAA,CAAG,QAAA,CAAS,KAAA,CAAM,MAAM,OAAO,CAAA;AACrD,IAAA,OAAO,GAAG,OAAO,CAAA;AAAA,EACnB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAaA,eAAsB,WAAA,CAAY,YAAoB,KAAA,EAAoC;AACxF,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,MAAA,CAAO,EAAE,CAAA;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,KAAA,CAAS,CAAA;AACvD,IAAA,MAAM,CAAA,GAAI,MAAM,WAAA,EAAY;AAC5B,IAAA,MAAM,UAAU,MAAA,CAAO,MAAA;AAAA,MACrB,CAAC,CAAA,KACC,CAAA,CAAE,IAAA,CAAK,aAAY,CAAE,QAAA,CAAS,CAAC,CAAA,IAC/B,EAAE,WAAA,CAAY,WAAA,EAAY,CAAE,QAAA,CAAS,CAAC,CAAA,IACtC,CAAA,CAAE,EAAA,CAAG,WAAA,GAAc,QAAA,CAAS,CAAC,CAAA,IAAA,CAC5B,CAAA,CAAE,YAAY,EAAC,EAAG,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,WAAA,EAAY,CAAE,QAAA,CAAS,CAAC,CAAC;AAAA,KAC9D;AACA,IAAA,OAAO,MAAA;AAAA,MACL,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAClB,IAAI,CAAA,CAAE,EAAA;AAAA,QACN,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,aAAa,CAAA,CAAE,WAAA;AAAA,QACf,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,QAAQ,CAAA,CAAE;AAAA,OACZ,CAAE;AAAA,KACJ;AAAA,EACF,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAgBA,eAAsB,sBAAA,CACpB,UAAA,EACA,OAAA,EACA,SAAA,EACqB;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,KAAA,CAAS,CAAA;AACvD,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,OAAO,CAAA;AACjD,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,MAAM,UAAU,MAAM,EAAA,CAAG,QAAA,CAAS,KAAA,CAAM,MAAM,OAAO,CAAA;AAErD,IAAA,MAAM,YAAA,GAAe,uBAAuB,OAAO,CAAA;AACnD,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,OAAA,EAAS,YAAA,EAAc,SAAS,CAAA;AACpE,IAAA,OAAO,OAAO,MAAM,CAAA;AAAA,EACtB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,gBAAA,CAAiB,YAAoB,OAAA,EAAsC;AAC/F,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,iBAAiB,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,YAAA,EAAc,KAAA,CAAS,CAAA;AACvD,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,OAAO,CAAA;AACjD,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,MAAM,UAAU,MAAM,EAAA,CAAG,QAAA,CAAS,KAAA,CAAM,MAAM,OAAO,CAAA;AAErD,IAAA,MAAM,YAAA,GAAe,uBAAuB,OAAO,CAAA;AACnD,IAAA,MAAM,QAAA,GAAW,qBAAA,CAAsB,YAAA,EAAc,OAAO,CAAA;AAC5D,IAAA,OAAO,EAAA,CAAG,YAAY,4BAA4B,CAAA;AAAA,EACpD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF","file":"chunk-5YO3H5Q4.js","sourcesContent":["// src/tools/skills.ts\nimport fs from \"node:fs/promises\";\nimport type { Dirent } from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  parseSkillFrontmatter,\n  parseSkillRequirements,\n  validateRequirements,\n  buildRequiresPreamble,\n} from \"@skaile/workspaces/resolver\";\nimport { err, ok, okJson } from \"../types.js\";\nimport type { ToolResult } from \"../types.js\";\nimport { findAiAssetsRoot } from \"../utils/ai-assets.js\";\n\ninterface SkillEntry {\n  id: string;\n  name: string;\n  description: string;\n  source?: string;\n  version?: string;\n  keywords?: string[];\n  path: string;\n  domain: string;\n}\n\nasync function walkForSkillMd(dir: string, domain: string, acc: SkillEntry[]): Promise<void> {\n  let entries: Dirent<string>[];\n  try {\n    entries = await fs.readdir(dir, { withFileTypes: true });\n  } catch {\n    return;\n  }\n\n  // Check if this directory contains a SKILL.md\n  const hasSkillMd = entries.some((e) => e.isFile() && e.name === \"SKILL.md\");\n  if (hasSkillMd) {\n    const skillMdPath = path.join(dir, \"SKILL.md\");\n    try {\n      const content = await fs.readFile(skillMdPath, \"utf-8\");\n      const fm = parseSkillFrontmatter(content);\n      const name = typeof fm.name === \"string\" ? fm.name : path.basename(dir);\n      const description = typeof fm.description === \"string\" ? fm.description : \"\";\n      const source = typeof fm.source === \"string\" ? fm.source : undefined;\n      const version = typeof fm.version === \"string\" ? fm.version : undefined;\n      const keywords = Array.isArray(fm.keywords) ? (fm.keywords as string[]) : undefined;\n      acc.push({\n        id: path.basename(dir),\n        name,\n        description,\n        source,\n        version,\n        keywords,\n        path: skillMdPath,\n        domain,\n      });\n    } catch {\n      // skip unreadable files\n    }\n    return; // don't recurse inside a skill directory\n  }\n\n  // Recurse into subdirectories\n  for (const entry of entries) {\n    if (entry.isDirectory()) {\n      await walkForSkillMd(path.join(dir, entry.name), domain, acc);\n    }\n  }\n}\n\nasync function scanSkills(aiAssetsRoot: string, domainFilter?: string): Promise<SkillEntry[]> {\n  let domains: string[];\n  try {\n    const entries = await fs.readdir(aiAssetsRoot, { withFileTypes: true });\n    domains = entries\n      .filter((e) => e.isDirectory())\n      .map((e) => e.name)\n      .filter((name) => !domainFilter || name === domainFilter);\n  } catch {\n    return [];\n  }\n\n  const acc: SkillEntry[] = [];\n  for (const domain of domains) {\n    const skillsDir = path.join(aiAssetsRoot, domain, \"skills\");\n    try {\n      await fs.access(skillsDir);\n    } catch {\n      continue; // no skills/ dir in this domain\n    }\n    await walkForSkillMd(skillsDir, domain, acc);\n  }\n  return acc;\n}\n\n// ── Exported tool functions ────────────────────────────────────────────────────\n\n/**\n * List all skills in the `ai-assets` catalog, optionally filtered by domain.\n *\n * Walks every `<domain>/skills/` directory under the `ai-assets` root looking\n * for `SKILL.md` files.  Returns a JSON array of skill summaries\n * `{ id, name, description, source, version, keywords, domain }`.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param domain     - Optional domain name filter (e.g. `\"skaile-development\"`).\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillList(\n  projectDir: string,\n  domain: string | undefined,\n): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return okJson([]);\n    const skills = await scanSkills(aiAssetsRoot, domain);\n    return okJson(\n      skills.map((s) => ({\n        id: s.id,\n        name: s.name,\n        description: s.description,\n        source: s.source,\n        version: s.version,\n        keywords: s.keywords,\n        domain: s.domain,\n      })),\n    );\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * List all skill domains — the top-level directories under `ai-assets` that\n * contain a `skills/` subdirectory.\n *\n * Returns a JSON array of `{ name, path }` objects.\n *\n * @param projectDir - Absolute path to the skaile project root.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillListDomains(projectDir: string): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return okJson([]);\n    const entries = await fs.readdir(aiAssetsRoot, { withFileTypes: true });\n    const domains = entries\n      .filter((e) => e.isDirectory())\n      .map((e) => ({ name: e.name, path: path.join(aiAssetsRoot, e.name) }));\n    return okJson(domains);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Show the full `SKILL.md` content for a skill.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param skillId    - Skill ID (directory name) as returned by {@link skillList}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillShow(projectDir: string, skillId: string): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return err(`Skill not found: ${skillId}`);\n    const skills = await scanSkills(aiAssetsRoot, undefined);\n    const skill = skills.find((s) => s.id === skillId);\n    if (!skill) return err(`Skill not found: ${skillId}`);\n    const content = await fs.readFile(skill.path, \"utf-8\");\n    return ok(content);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Search skills by name, description, ID, or keywords.\n *\n * Case-insensitive substring match against all text fields in every skill\n * entry.  Returns the same summary shape as {@link skillList}.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param query      - Search string.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillSearch(projectDir: string, query: string): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return okJson([]);\n    const skills = await scanSkills(aiAssetsRoot, undefined);\n    const q = query.toLowerCase();\n    const matched = skills.filter(\n      (s) =>\n        s.name.toLowerCase().includes(q) ||\n        s.description.toLowerCase().includes(q) ||\n        s.id.toLowerCase().includes(q) ||\n        (s.keywords ?? []).some((k) => k.toLowerCase().includes(q)),\n    );\n    return okJson(\n      matched.map((s) => ({\n        id: s.id,\n        name: s.name,\n        description: s.description,\n        source: s.source,\n        version: s.version,\n        keywords: s.keywords,\n        domain: s.domain,\n      })),\n    );\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Validate that all prerequisites declared in a skill's `SKILL.md` are\n * satisfied in `targetDir`.\n *\n * Uses `@skaile/workspaces/resolver` to parse the `REQUIRES` / `READS` / `WRITES`\n * DSL and run the requirement checks against the filesystem.  Returns a\n * validation report as JSON.\n *\n * @param projectDir - Absolute path to the skaile project root (for skill lookup).\n * @param skillId    - Skill ID as returned by {@link skillList}.\n * @param targetDir  - Directory to validate against (typically the user's project).\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillCheckRequirements(\n  projectDir: string,\n  skillId: string,\n  targetDir: string,\n): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return err(`Skill not found: ${skillId}`);\n    const skills = await scanSkills(aiAssetsRoot, undefined);\n    const skill = skills.find((s) => s.id === skillId);\n    if (!skill) return err(`Skill not found: ${skillId}`);\n    const content = await fs.readFile(skill.path, \"utf-8\");\n\n    const requirements = parseSkillRequirements(content);\n    const report = validateRequirements(skillId, requirements, targetDir);\n    return okJson(report);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Get the formatted `REQUIRES`/`INPUT`/`READS`/`WRITES` DSL preamble for a skill.\n *\n * Uses `@skaile/workspaces/resolver` to build the requirements preamble that can be\n * prepended to the skill prompt for injection into the agent's context.\n * Returns `\"(no requirements declared)\"` when the skill has no requirements.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param skillId    - Skill ID as returned by {@link skillList}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function skillGetPreamble(projectDir: string, skillId: string): Promise<ToolResult> {\n  try {\n    const aiAssetsRoot = findAiAssetsRoot(projectDir);\n    if (!aiAssetsRoot) return err(`Skill not found: ${skillId}`);\n    const skills = await scanSkills(aiAssetsRoot, undefined);\n    const skill = skills.find((s) => s.id === skillId);\n    if (!skill) return err(`Skill not found: ${skillId}`);\n    const content = await fs.readFile(skill.path, \"utf-8\");\n\n    const requirements = parseSkillRequirements(content);\n    const preamble = buildRequiresPreamble(requirements, skillId);\n    return ok(preamble || \"(no requirements declared)\");\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n"]}

package/dist/{chunk-JDX54X4Y.js → chunk-7GWYRVAX.js}

@@ -261,6 +261,7 @@ var LocalSecretsProvider = class {
       const salt = this.salt;
       const newPassphrase = strategy === "passphrase" ? effectivePassphrase : strategy === "keychain" ? await this.getPassphraseForStrategy("keychain") : getMachinePassphrase();
       const newKey = deriveMasterKey(newPassphrase, salt);
+      const failed = [];
       for (const encFile of encFiles) {
         const filePath = path.join(this.secretsDir, encFile);
         const blob = fs.readFileSync(filePath);
@@ -269,12 +270,14 @@ var LocalSecretsProvider = class {
           const reEncrypted = encrypt(plaintext, newKey);
           fs.writeFileSync(filePath, reEncrypted, { mode: 384 });
         } catch {
-          process.stderr.write(
-            `[skaile/secrets] Warning: could not re-encrypt ${encFile}. It may need to be re-created.
-`
-          );
+          failed.push(encFile);
         }
       }
+      if (failed.length > 0) {
+        throw new Error(
+          `[skaile/secrets] Key-strategy switch aborted: could not re-encrypt ${failed.length} secret(s) (${failed.join(", ")}). The previous strategy is unchanged; resolve the failing secrets before retrying.`
+        );
+      }
     }
     if (strategy === "passphrase") {
       const masterPath = path.join(this.secretsDir, ".master");
@@ -438,6 +441,7 @@ var LocalSecretsProvider = class {
 };
 
 // secrets/src/providers/env.ts
+var ENV_UNKNOWN_TIMESTAMP = /* @__PURE__ */ new Date(0);
 var EnvSecretsProvider = class {
   id = "env";
   async getSecret(ref) {
@@ -471,11 +475,10 @@ var EnvSecretsProvider = class {
     if (value === void 0) {
       throw new SecretNotFoundError(ref);
     }
-    const now = /* @__PURE__ */ new Date();
     return {
       ref,
-      createdAt: now,
-      updatedAt: now,
+      createdAt: ENV_UNKNOWN_TIMESTAMP,
+      updatedAt: ENV_UNKNOWN_TIMESTAMP,
       scopeSummary: "environment variable (read-only)"
     };
   }
@@ -531,5 +534,5 @@ var CredentialLifecycleService = class {
 var VERSION = "0.0.0";
 
 export { CredentialLifecycleService, EnvSecretsProvider, LocalSecretsProvider, SecretsRouter, VERSION };
-//# sourceMappingURL=chunk-JDX54X4Y.js.map
-//# sourceMappingURL=chunk-JDX54X4Y.js.map
+//# sourceMappingURL=chunk-7GWYRVAX.js.map
+//# sourceMappingURL=chunk-7GWYRVAX.js.map

package/dist/chunk-7GWYRVAX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../secrets/src/router.ts","../secrets/src/providers/local.ts","../secrets/src/providers/env.ts","../secrets/src/lifecycle.ts","../secrets/src/index.ts"],"names":["provider"],"mappings":";;;;;;;AAyFO,IAAM,gBAAN,MAAoB;AAAA,EACjB,SAAA,uBAAgB,GAAA,EAA8B;AAAA,EAC9C,MAAA;AAAA,EACA,QAAqB,EAAC;AAAA;AAAA,EAG9B,eAAA;AAAA,EACA,cAAA;AAAA,EAEA,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA,EAIA,SAAS,QAAA,EAAkC;AACzC,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC1C;AAAA,EAEA,WAAW,EAAA,EAAkB;AAC3B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,EAC1B;AAAA,EAEA,aAAA,GAA0B;AACxB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAA,EAClC;AAAA;AAAA,EAIA,QAAQ,IAAA,EAAuB;AAC7B,IAAA,IAAA,CAAK,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACtB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,SAAA,EAA4C,UAAA,EAA0B;AAC9F,IAAA,MAAM,KAAA,GAA4B;AAAA,MAChC,cAAA,EAAgB,GAAA;AAAA,MAChB,SAAA;AAAA,MACA,WAAA,EAAa,UAAA;AAAA,MACb,mBAAmB,IAAA,CAAK,eAAA;AAAA,MACxB,kBAAkB,IAAA,CAAK,cAAA;AAAA,MACvB,SAAA,sBAAe,IAAA;AAAK,KACtB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIQ,QAAQ,GAAA,EAA+B;AAE7C,IAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO;AACpC,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,MAAMA,SAAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,KAAK,WAAW,CAAA;AACpD,UAAA,IAAIA,WAAU,OAAOA,SAAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,KAAK,MAAA,CAAO,gBAAA;AAAA,QACZ,CAAA,uCAAA,EAA0C,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,UAAU,GAAG,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,IAAI,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,QAAA,CAAS,EAAE,CAAA;AACpC,IAAA,OAAO,QAAA,CAAS,aAAa,GAAG,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AAIxD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,CAAS,EAAE,CAAA;AAClC,IAAA,OAAO,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAA,EAAY,QAAA,CAAS,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,CAAS,YAAY,GAAG,CAAA;AAAA,EACjC;AAAA,EAEA,gBAAgB,UAAA,EAAkD;AAChE,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,EAAU,iBAAgB,IAAK,IAAA;AAAA,EACxC;AAAA,EAEA,MAAM,eACJ,UAAA,EAC8D;AAC9D,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,UAAA,EAAa,EAAE,CAAA,gBAAA,CAAA,EAAmB;AAAA,IAC/D;AACA,IAAA,OAAO,SAAS,cAAA,EAAe;AAAA,EACjC;AACF;ACrLA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,aAAA,GAAgB,QAAA;AAEtB,IAAM,gBAAA,GAAmB,gBAAA;AACzB,IAAM,gBAAA,GAAmB,YAAA;AAGzB,IAAM,cAAA,GAAiB,2BAAA;AAoBvB,SAAS,eAAA,CAAgB,YAAoB,IAAA,EAAsB;AACjE,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,iBAAA,EAAmB,YAAY,aAAa,CAAA;AACzF;AAEA,SAAS,oBAAA,GAA+B;AAEtC,EAAA,OAAO,UAAa,EAAA,CAAA,QAAA,EAAU,CAAA,CAAA,EAAO,EAAA,CAAA,QAAA,GAAW,QAAQ,CAAA,CAAA;AAC1D;AAGA,SAAS,eAAe,UAAA,EAA4B;AAClD,EAAA,OAAc,kBAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACpE;AAMA,SAAS,UAAU,GAAA,EAAqB;AACtC,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC1E;AAMA,SAAS,OAAA,CAAQ,MAAkB,GAAA,EAAqB;AACtD,EAAA,MAAM,EAAA,GAAY,mBAAY,SAAS,CAAA;AACvC,EAAA,MAAM,MAAA,GAAgB,sBAAe,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC3F,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,EAAA,EAAI,OAAA,EAAS,SAAS,CAAC,CAAA;AAC/C;AAEA,SAAS,OAAA,CAAQ,MAAc,GAAA,EAAqB;AAClD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,CAAA,EAAG,SAAS,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,YAAY,eAAe,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,QAAA,CAAS,SAAA,GAAY,eAAe,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAkB,wBAAiB,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC/F,EAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACtE;AAMO,IAAM,uBAAN,MAAuD;AAAA,EACnD,EAAA,GAAK,OAAA;AAAA,EACN,UAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAC3B,IAAA,GAAsB,IAAA;AAAA,EACtB,QAAA,GAAwB,SAAA;AAAA,EAEhC,YAAY,UAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,aAAa,UAAA,IAAmB,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,WAAW,SAAS,CAAA;AAAA,EAC9E;AAAA;AAAA,EAIQ,SAAA,GAAkB;AACxB,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,EAAG;AACnC,MAAG,EAAA,CAAA,SAAA,CAAU,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,gBAAA,GAA2B;AACjC,IAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,OAAU,gBAAa,QAAQ,CAAA;AAAA,IACjC;AACA,IAAA,MAAM,IAAA,GAAc,mBAAY,WAAW,CAAA;AAC3C,IAAG,iBAAc,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAA,GAA2B;AACvC,IAAA,IAAI,KAAK,SAAA,EAAW;AAEpB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,gBAAA,EAAiB;AAGlC,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,IAAA,CAAK,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,EAAE,IAAA,EAAK;AAAA,IAC9D,CAAA,MAAO;AAEL,MAAA,IAAA,CAAK,QAAA,GAAY,MAAM,IAAA,CAAK,mBAAA,KAAyB,UAAA,GAAa,SAAA;AAClE,MAAG,iBAAc,YAAA,EAAc,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,wBAAA,CAAyB,KAAK,QAAQ,CAAA;AACpE,IAAA,IAAA,CAAK,SAAA,GAAY,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAAA,EACxD;AAAA,EAEA,MAAc,mBAAA,GAAwC;AACpD,IAAA,IAAI;AAGF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AACxE,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,GAAgB,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACjD,QAAA,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAA,EAAkB,gBAAA,EAAkB,MAAM,CAAA;AAAA,MACrE;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,yBAAyB,QAAA,EAAwC;AAC7E,IAAA,QAAQ,QAAA;AAAU,MAChB,KAAK,UAAA,EAAY;AACf,QAAA,IAAI;AAGF,UAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AAC1E,UAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,QACrB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,QAAA,IAAI,aAAA,EAAe;AAEjB,UAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,UAAA,IAAO,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,YAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC7D,YAAA,IAAI,cAAA,CAAe,aAAa,CAAA,KAAM,UAAA,EAAY;AAChD,cAAA,MAAM,IAAI,YAAA;AAAA,gBACR,mBAAmB,cAAc,CAAA,kFAAA,CAAA;AAAA,gBAEjC;AAAA,eACF;AAAA,YACF;AAAA,UACF;AACA,UAAA,OAAO,aAAA;AAAA,QACT;AAIA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,6BAAA,EAAgC,cAAc,CAAA,8CAAA,EACR,cAAc,CAAA,MAAA,CAAA;AAAA,UACpD;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,SAAA;AACH,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AACE,QAAA,OAAO,oBAAA,EAAqB;AAAA;AAChC,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CAAe,QAAA,EAAuB,UAAA,EAAoC;AAC9E,IAAA,IAAA,CAAK,SAAA,EAAU;AAIf,IAAA,MAAM,mBAAA,GAAsB,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEpE,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,sDAAsD,cAAc,CAAA,CAAA,CAAA;AAAA,UACpE;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC/C,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,wBAAA,CAAyB,OAAA,EAAS,2BAA2B,CAAA;AAAA,MACzE;AAAA,IACF;AAOA,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AACnC,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,KAAK,SAAA,EAAU;AACrB,MAAA,MAAM,SAAS,IAAA,CAAK,SAAA;AAGpB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,MAAA,MAAM,aAAA,GACJ,QAAA,KAAa,YAAA,GACT,mBAAA,GACA,QAAA,KAAa,UAAA,GACX,MAAM,IAAA,CAAK,wBAAA,CAAyB,UAAU,CAAA,GAC9C,oBAAA,EAAqB;AAC7B,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,aAAA,EAAe,IAAI,CAAA;AAOlD,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,QAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AACtC,UAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AAC7C,UAAG,iBAAc,QAAA,EAAU,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,QACzD,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,QACrB;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sEACK,MAAA,CAAO,MAAM,eAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,mFAAA;AAAA,SAEpD;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,MAAG,EAAA,CAAA,aAAA,CAAc,YAAY,cAAA,CAAe,mBAAoB,GAAG,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAG,iBAAc,YAAA,EAAc,QAAA,EAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AACxD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,cAAA,GAA8B;AAC5B,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,OAAU,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAA,CAAE,IAAA,EAAK;AAAA,IACrD;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA,EAIQ,YAAY,GAAA,EAAqB;AACvC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,IAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,aAAa,GAAA,EAAqB;AACxC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,UAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,SAAS,GAAA,EAAqB;AACpC,IAAA,OAAY,UAAK,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,YAAA,CAAa,GAAG,CAAC,CAAA;AAAA,EAC1D;AAAA,EAEQ,YAAA,GAAyB;AAC/B,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,SAAU,EAAC;AAC7C,IAAA,OAAU,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACzE;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,IAAA,CAAK,SAAU,CAAA;AAG/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC1D,QAAA,IAAA,CAAK,cAAA,GAAA,iBAAiB,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAC7C,QAAG,EAAA,CAAA,aAAA,CAAc,UAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,MAClE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,WAAW,SAAS,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,EAAO,IAAA,CAAK,SAAU,CAAA;AAChD,IAAG,iBAAc,QAAA,EAAU,SAAA,EAAW,EAAE,IAAA,EAAM,KAAO,CAAA;AAGrD,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,GAAA;AAAA,MACA,SAAA,EAAW,SAAS,SAAA,IAAa,GAAA;AAAA,MACjC,SAAA,EAAW,GAAA;AAAA,MACX,cAAA,EAAgB,GAAA;AAAA,MAChB,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,IAAA,CAAK,QAAA,KAAa,EAAC;AAAA,MACpD,GAAI,IAAA,EAAM,UAAA,GACN,EAAE,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY,KACvE;AAAC,KACP;AACA,IAAG,EAAA,CAAA,aAAA,CAAc,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAG,cAAW,QAAQ,CAAA;AACtB,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAG,cAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAA,CAAK,SAAA,EAAU;AAEf,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,YAAY,CAAC,CAAA;AACxF,IAAA,IAAI,OAAiB,EAAC;AACtB,IAAA,KAAA,MAAW,MAAM,SAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,UAAA,EAAY,EAAE,CAAA,EAAG,OAAO,CAAC,CAAA;AAChF,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,MAClC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,SAAA,EAAU;AAErB,MAAA,MAAM,UAAU,CAAA,OAAA,EAAiB,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AAC/D,MAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,SAAS,CAAA;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,aAAa,OAAO,CAAA;AAC/B,MAAA,IAAI,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACnD;AACA,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAW,IAAA,CAAK,GAAA,KAAQ,KAAA,EAAM;AAAA,IACnD,SAAS,CAAA,EAAG;AACV,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,QACxB,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC;AAAA,OAClD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,GAAA,EAAK,IAAI,GAAA,IAAO,GAAA;AAAA,QAChB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,gBAAgB,GAAA,CAAI,cAAA,GAAiB,IAAI,IAAA,CAAK,GAAA,CAAI,cAAc,CAAA,GAAI,MAAA;AAAA,QACpE,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAU,YAAS,QAAQ,CAAA;AACjC,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,KAAA;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;;;ACtdA,IAAM,qBAAA,mBAAwB,IAAI,IAAA,CAAK,CAAC,CAAA;AAEjC,IAAM,qBAAN,MAAqD;AAAA,EACjD,EAAA,GAAK,KAAA;AAAA,EAEd,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvC;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,MAAA,EAAoB,KAAA,EAAyC;AACzF,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,aAAa,IAAA,EAA6B;AAC9C,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAClC,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AAKA,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,qBAAA;AAAA,MACX,SAAA,EAAW,qBAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;;;AC/CA,IAAM,cAAA,GAA4C;AAAA,EAChD,kBAAA,EAAoB;AAAA;AACtB,CAAA;AAEO,IAAM,6BAAN,MAAiC;AAAA,EAC9B,MAAA;AAAA,EACA,MAAA;AAAA,EAER,WAAA,CAAY,QAAuB,MAAA,EAA6C;AAC9E,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,EAAE,GAAG,cAAA,EAAgB,GAAG,MAAA,EAAO;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,aAAA,EAA+C;AAGnE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA;AAC3C,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,IACtD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAkB,OAAO,sBAAA,EAAuB;AAAA,IACrF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,aAAA,EAAyC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AACzC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;AC9EO,IAAM,OAAA,GAAU","file":"chunk-7GWYRVAX.js","sourcesContent":["/**\n * SecretsRouter — audit chokepoint for all secret operations.\n *\n * Registers {@link ISecretsProvider} implementations by id, routes credential refs by\n * prefix or via routing config, and emits {@link CredentialAccessed} events for every\n * get, set, delete, list, and metadata operation. Routing rules are evaluated top-to-bottom;\n * the first matching prefix wins and falls back to the configured default provider.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\n\nimport type {\n  ISecretsProvider,\n  SetSecretOptions,\n  ListFilter,\n  SecretMetadata,\n  ProviderCapabilities,\n} from \"@skaile/workspaces/plugins\";\nimport { ProviderUnavailableError } from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Audit event\n// ---------------------------------------------------------------------------\n\n/**\n * Audit event emitted by {@link SecretsRouter} after every secret operation.\n *\n * Delivered synchronously to all registered {@link AuditSink} functions. Errors thrown\n * by sinks are swallowed to ensure they never break the underlying secret operation.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface CredentialAccessed {\n  credential_ref: string;\n  operation: \"get\" | \"set\" | \"delete\" | \"list\" | \"metadata\";\n  provider_id: string;\n  caller_session_id?: string;\n  caller_tool_call?: string;\n  timestamp: Date;\n}\n\n/**\n * Callback function that receives {@link CredentialAccessed} audit events from {@link SecretsRouter}.\n *\n * Register sinks via `SecretsRouter.addSink()`. Sinks run synchronously after each operation;\n * exceptions are caught and suppressed so they cannot interrupt credential resolution.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport type AuditSink = (event: CredentialAccessed) => void;\n\n// ---------------------------------------------------------------------------\n// Routing config\n// ---------------------------------------------------------------------------\n\n/**\n * A single routing rule that maps a credential ref prefix to a provider.\n *\n * Rules in {@link SecretsRouterConfig.rules} are evaluated top-to-bottom;\n * the first rule whose `prefix` matches the start of the credential ref wins.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface RoutingRule {\n  /** Prefix match on credential_ref. First match wins. */\n  prefix: string;\n  /** Provider id to route to. */\n  provider_id: string;\n}\n\n/**\n * Configuration object for {@link SecretsRouter}.\n *\n * Specifies the default provider id used when no routing rule matches, and an optional\n * ordered list of {@link RoutingRule} entries for prefix-based routing.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface SecretsRouterConfig {\n  /** Default provider id when no routing rule matches. */\n  default_provider: string;\n  /** Ordered routing rules. Evaluated top-to-bottom; first prefix match wins. */\n  rules?: RoutingRule[];\n}\n\n// ---------------------------------------------------------------------------\n// Router\n// ---------------------------------------------------------------------------\n\nexport class SecretsRouter {\n  private providers = new Map<string, ISecretsProvider>();\n  private config: SecretsRouterConfig;\n  private sinks: AuditSink[] = [];\n\n  /** Caller context for audit events (set per-request by the runner). */\n  callerSessionId?: string;\n  callerToolCall?: string;\n\n  constructor(config: SecretsRouterConfig) {\n    this.config = config;\n  }\n\n  // -- Provider registration ------------------------------------------------\n\n  register(provider: ISecretsProvider): void {\n    this.providers.set(provider.id, provider);\n  }\n\n  unregister(id: string): void {\n    this.providers.delete(id);\n  }\n\n  listProviders(): string[] {\n    return [...this.providers.keys()];\n  }\n\n  // -- Audit sinks -----------------------------------------------------------\n\n  addSink(sink: AuditSink): void {\n    this.sinks.push(sink);\n  }\n\n  private emit(ref: string, operation: CredentialAccessed[\"operation\"], providerId: string): void {\n    const event: CredentialAccessed = {\n      credential_ref: ref,\n      operation,\n      provider_id: providerId,\n      caller_session_id: this.callerSessionId,\n      caller_tool_call: this.callerToolCall,\n      timestamp: new Date(),\n    };\n    for (const sink of this.sinks) {\n      try {\n        sink(event);\n      } catch {\n        // Audit sink errors must not break the secret operation.\n      }\n    }\n  }\n\n  // -- Routing ---------------------------------------------------------------\n\n  private resolve(ref: string): ISecretsProvider {\n    // Check routing rules first\n    if (this.config.rules) {\n      for (const rule of this.config.rules) {\n        if (ref.startsWith(rule.prefix)) {\n          const provider = this.providers.get(rule.provider_id);\n          if (provider) return provider;\n        }\n      }\n    }\n\n    // Fall back to default\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) {\n      throw new ProviderUnavailableError(\n        this.config.default_provider,\n        `No provider registered for default id \"${this.config.default_provider}\"`,\n      );\n    }\n    return provider;\n  }\n\n  // -- Delegated operations --------------------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"get\", provider.id);\n    return provider.getSecret(ref);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"set\", provider.id);\n    return provider.setSecret(ref, value, opts);\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"delete\", provider.id);\n    return provider.deleteSecret(ref);\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    // List aggregates from the default provider only (per-provider listing\n    // would require iterating all providers; deferred to Phase 3 with\n    // federated catalogs).\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) return [];\n    this.emit(\"*\", \"list\", provider.id);\n    return provider.listSecrets(filter);\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"metadata\", provider.id);\n    return provider.getMetadata(ref);\n  }\n\n  getCapabilities(providerId?: string): ProviderCapabilities | null {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    return provider?.getCapabilities() ?? null;\n  }\n\n  async testConnection(\n    providerId?: string,\n  ): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    if (!provider) {\n      return { ok: false, error: `Provider \"${id}\" not registered` };\n    }\n    return provider.testConnection();\n  }\n}\n","/**\n * LocalSecretsProvider — AES-256-GCM encrypted file-blob storage at `~/.skaile/secrets/`.\n *\n * Each secret is stored as a separate `.enc` file named by the SHA-256 hash of the ref\n * (collision-free, filesystem-safe). A companion `.meta.json` stores the original ref,\n * timestamps, and optional user metadata. The master key is derived via PBKDF2-SHA-512\n * from one of three {@link KeyStrategy} sources: OS keychain (keytar), a passphrase from\n * `SKAILE_SECRETS_PASSPHRASE`, or a machine-derived passphrase as last resort.\n * Switching strategies re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as os from \"node:os\";\n\nimport type {\n  ISecretsProvider,\n  SecretMetadata,\n  ProviderCapabilities,\n  SetSecretOptions,\n  ListFilter,\n} from \"@skaile/workspaces/plugins\";\nimport {\n  SecretNotFoundError,\n  ProviderUnavailableError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\nconst KEY_LENGTH = 32;\nconst PBKDF2_ITERATIONS = 100_000;\nconst PBKDF2_DIGEST = \"sha512\";\n\nconst KEYCHAIN_SERVICE = \"skaile-secrets\";\nconst KEYCHAIN_ACCOUNT = \"master-key\";\n\n/** Env var that provides the passphrase at runtime (never stored on disk). */\nconst PASSPHRASE_ENV = \"SKAILE_SECRETS_PASSPHRASE\";\n\n/**\n * Master key derivation strategy used by {@link LocalSecretsProvider}.\n *\n * - `keychain` — OS keychain (via keytar); most secure, requires keytar to be installed.\n * - `passphrase` — PBKDF2 from `SKAILE_SECRETS_PASSPHRASE` env var; portable across machines.\n * - `machine` — deterministic from hostname + username; least secure, last-resort fallback.\n *\n * The active strategy is persisted in `~/.skaile/secrets/.key-strategy`. Switching strategies\n * re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\nexport type KeyStrategy = \"keychain\" | \"passphrase\" | \"machine\";\n\n// ---------------------------------------------------------------------------\n// Key derivation\n// ---------------------------------------------------------------------------\n\nfunction deriveMasterKey(passphrase: string, salt: Buffer): Buffer {\n  return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);\n}\n\nfunction getMachinePassphrase(): string {\n  // Deterministic but not secret -- last resort only.\n  return `skaile:${os.hostname()}:${os.userInfo().username}`;\n}\n\n/** Hash a passphrase for verification (stored in .master). */\nfunction hashPassphrase(passphrase: string): string {\n  return crypto.createHash(\"sha256\").update(passphrase).digest(\"hex\");\n}\n\n// ---------------------------------------------------------------------------\n// Filename hashing (injective: sha256 of ref)\n// ---------------------------------------------------------------------------\n\nfunction refToHash(ref: string): string {\n  return crypto.createHash(\"sha256\").update(ref).digest(\"hex\").slice(0, 40);\n}\n\n// ---------------------------------------------------------------------------\n// Encryption / decryption\n// ---------------------------------------------------------------------------\n\nfunction encrypt(data: Uint8Array, key: Buffer): Buffer {\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);\n  const authTag = cipher.getAuthTag();\n  // Format: [iv (12)] [authTag (16)] [ciphertext (...)]\n  return Buffer.concat([iv, authTag, encrypted]);\n}\n\nfunction decrypt(blob: Buffer, key: Buffer): Buffer {\n  const iv = blob.subarray(0, IV_LENGTH);\n  const authTag = blob.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);\n  const ciphertext = blob.subarray(IV_LENGTH + AUTH_TAG_LENGTH);\n  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  decipher.setAuthTag(authTag);\n  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n}\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport class LocalSecretsProvider implements ISecretsProvider {\n  readonly id = \"local\";\n  private secretsDir: string;\n  private masterKey: Buffer | null = null;\n  private salt: Buffer | null = null;\n  private strategy: KeyStrategy = \"machine\";\n\n  constructor(secretsDir?: string) {\n    this.secretsDir = secretsDir ?? path.join(os.homedir(), \".skaile\", \"secrets\");\n  }\n\n  // -- Initialization --------------------------------------------------------\n\n  private ensureDir(): void {\n    if (!fs.existsSync(this.secretsDir)) {\n      fs.mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });\n    }\n  }\n\n  private loadOrCreateSalt(): Buffer {\n    const saltPath = path.join(this.secretsDir, \".salt\");\n    if (fs.existsSync(saltPath)) {\n      return fs.readFileSync(saltPath);\n    }\n    const salt = crypto.randomBytes(SALT_LENGTH);\n    fs.writeFileSync(saltPath, salt, { mode: 0o600 });\n    return salt;\n  }\n\n  private async ensureKey(): Promise<void> {\n    if (this.masterKey) return;\n\n    this.ensureDir();\n    this.salt = this.loadOrCreateSalt();\n\n    // Determine strategy\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      this.strategy = fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    } else {\n      // Auto-detect: try keychain, fall back to machine\n      this.strategy = (await this.tryKeychainStrategy()) ? \"keychain\" : \"machine\";\n      fs.writeFileSync(strategyPath, this.strategy, { mode: 0o600 });\n    }\n\n    // Derive key from strategy\n    const passphrase = await this.getPassphraseForStrategy(this.strategy);\n    this.masterKey = deriveMasterKey(passphrase, this.salt);\n  }\n\n  private async tryKeychainStrategy(): Promise<boolean> {\n    try {\n      // `keytar` is an optional OS-keychain native module the user installs\n      // themselves; the `as string` specifier keeps it out of tsc resolution.\n      const keytar = await import(\"keytar\" as string);\n      let stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n      if (!stored) {\n        stored = crypto.randomBytes(32).toString(\"base64\");\n        await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, stored);\n      }\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private async getPassphraseForStrategy(strategy: KeyStrategy): Promise<string> {\n    switch (strategy) {\n      case \"keychain\": {\n        try {\n          // `keytar` is an optional OS-keychain native module the user installs\n          // themselves; the `as string` specifier keeps it out of tsc resolution.\n          const keytar = await import(\"keytar\" as string);\n          const stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n          if (stored) return stored;\n        } catch {\n          // Keychain failed; fall through to machine\n        }\n        return getMachinePassphrase();\n      }\n      case \"passphrase\": {\n        const envPassphrase = process.env[PASSPHRASE_ENV];\n        if (envPassphrase) {\n          // Verify against stored hash if it exists\n          const masterPath = path.join(this.secretsDir, \".master\");\n          if (fs.existsSync(masterPath)) {\n            const storedHash = fs.readFileSync(masterPath, \"utf-8\").trim();\n            if (hashPassphrase(envPassphrase) !== storedHash) {\n              throw new SecretsError(\n                `Passphrase from ${PASSPHRASE_ENV} does not match stored hash. ` +\n                  \"Use skaile auth set-key-strategy passphrase to reset.\",\n                \"PASSPHRASE_MISMATCH\",\n              );\n            }\n          }\n          return envPassphrase;\n        }\n        // No env var -- hard error. Silent fallback to machine would\n        // produce a different key, causing AES-GCM auth-tag failures\n        // on secrets encrypted with the real passphrase.\n        throw new SecretsError(\n          `Strategy is \"passphrase\" but ${PASSPHRASE_ENV} is not set. ` +\n            `Export it before running: export ${PASSPHRASE_ENV}='...'`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n      case \"machine\":\n        return getMachinePassphrase();\n      default:\n        return getMachinePassphrase();\n    }\n  }\n\n  // -- Strategy management ---------------------------------------------------\n\n  /**\n   * Set the key strategy explicitly. Called by `skaile auth set-key-strategy`.\n   *\n   * When existing secrets are present, they are re-encrypted with the new key\n   * to prevent data loss from key mismatch.\n   */\n  async setKeyStrategy(strategy: KeyStrategy, passphrase?: string): Promise<void> {\n    this.ensureDir();\n\n    // --- 1. Validate new strategy prerequisites -------------------------\n\n    const effectivePassphrase = passphrase ?? process.env[PASSPHRASE_ENV];\n\n    if (strategy === \"passphrase\") {\n      if (!effectivePassphrase) {\n        throw new SecretsError(\n          `Passphrase required. Pass it as an argument or set ${PASSPHRASE_ENV}.`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n    }\n\n    if (strategy === \"keychain\") {\n      const success = await this.tryKeychainStrategy();\n      if (!success) {\n        throw new ProviderUnavailableError(\"local\", \"OS keychain not available\");\n      }\n    }\n\n    // --- 2. Load the OLD key under the current strategy -----------------\n    // ensureKey() reads the current strategy file and derives the key\n    // that was used to encrypt existing secrets. This is critical for\n    // cross-process scenarios where masterKey starts as null.\n\n    const encFiles = this.listEncFiles();\n    if (encFiles.length > 0) {\n      await this.ensureKey();\n      const oldKey = this.masterKey!;\n\n      // Derive the new key\n      const salt = this.salt!;\n      const newPassphrase =\n        strategy === \"passphrase\"\n          ? effectivePassphrase!\n          : strategy === \"keychain\"\n            ? await this.getPassphraseForStrategy(\"keychain\")\n            : getMachinePassphrase();\n      const newKey = deriveMasterKey(newPassphrase, salt);\n\n      // Re-encrypt each secret with the new key. A single failure must abort the\n      // whole switch: committing the new strategy while a secret is still under\n      // the old key orphans that secret (the registry advertises a key that no\n      // longer decrypts it). Collect failures and throw before the commit below,\n      // leaving `.key-strategy`/`.master` — and every secret — on the old key.\n      const failed: string[] = [];\n      for (const encFile of encFiles) {\n        const filePath = path.join(this.secretsDir, encFile);\n        const blob = fs.readFileSync(filePath);\n        try {\n          const plaintext = decrypt(blob, oldKey);\n          const reEncrypted = encrypt(plaintext, newKey);\n          fs.writeFileSync(filePath, reEncrypted, { mode: 0o600 });\n        } catch {\n          failed.push(encFile);\n        }\n      }\n      if (failed.length > 0) {\n        throw new Error(\n          `[skaile/secrets] Key-strategy switch aborted: could not re-encrypt ` +\n            `${failed.length} secret(s) (${failed.join(\", \")}). The previous strategy ` +\n            \"is unchanged; resolve the failing secrets before retrying.\",\n        );\n      }\n    }\n\n    // --- 3. Commit the new strategy (last write -- failure above leaves\n    //        the old strategy intact) ------------------------------------\n\n    if (strategy === \"passphrase\") {\n      const masterPath = path.join(this.secretsDir, \".master\");\n      fs.writeFileSync(masterPath, hashPassphrase(effectivePassphrase!), { mode: 0o600 });\n    }\n\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    fs.writeFileSync(strategyPath, strategy, { mode: 0o600 });\n    this.masterKey = null;\n    this.strategy = strategy;\n  }\n\n  getKeyStrategy(): KeyStrategy {\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      return fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    }\n    return \"machine\";\n  }\n\n  // -- File helpers ----------------------------------------------------------\n\n  private encFilename(ref: string): string {\n    return `${refToHash(ref)}.enc`;\n  }\n\n  private metaFilename(ref: string): string {\n    return `${refToHash(ref)}.meta.json`;\n  }\n\n  private metaPath(ref: string): string {\n    return path.join(this.secretsDir, this.metaFilename(ref));\n  }\n\n  private listEncFiles(): string[] {\n    if (!fs.existsSync(this.secretsDir)) return [];\n    return fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".enc\"));\n  }\n\n  // -- ISecretsProvider implementation ----------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    await this.ensureKey();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    const blob = fs.readFileSync(filePath);\n    const decrypted = decrypt(blob, this.masterKey!);\n\n    // Update lastAccessedAt\n    const metaFile = this.metaPath(ref);\n    if (fs.existsSync(metaFile)) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n        meta.lastAccessedAt = new Date().toISOString();\n        fs.writeFileSync(metaFile, JSON.stringify(meta), { mode: 0o600 });\n      } catch {\n        // Non-fatal\n      }\n    }\n\n    return new Uint8Array(decrypted);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    await this.ensureKey();\n    this.ensureDir();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const encrypted = encrypt(value, this.masterKey!);\n    fs.writeFileSync(filePath, encrypted, { mode: 0o600 });\n\n    // Write metadata (stores the original ref for reverse lookup)\n    const now = new Date().toISOString();\n    const metaFile = this.metaPath(ref);\n    let existing: Record<string, unknown> = {};\n    if (fs.existsSync(metaFile)) {\n      try {\n        existing = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      } catch {\n        // Overwrite corrupt meta\n      }\n    }\n    const meta = {\n      ref,\n      createdAt: existing.createdAt ?? now,\n      updatedAt: now,\n      lastAccessedAt: now,\n      ...(opts?.metadata ? { userMeta: opts.metadata } : {}),\n      ...(opts?.ttlSeconds\n        ? { expiresAt: new Date(Date.now() + opts.ttlSeconds * 1000).toISOString() }\n        : {}),\n    };\n    fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2), { mode: 0o600 });\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const metaFile = this.metaPath(ref);\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    fs.unlinkSync(filePath);\n    if (fs.existsSync(metaFile)) {\n      fs.unlinkSync(metaFile);\n    }\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    this.ensureDir();\n    // Read refs from meta files (the .enc filenames are hashes, not refs)\n    const metaFiles = fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".meta.json\"));\n    let refs: string[] = [];\n    for (const mf of metaFiles) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(path.join(this.secretsDir, mf), \"utf-8\"));\n        if (meta.ref) refs.push(meta.ref);\n      } catch {\n        // Skip corrupt meta files\n      }\n    }\n    if (filter?.prefix) {\n      refs = refs.filter((r) => r.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      refs = refs.slice(0, filter.limit);\n    }\n    return refs;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const start = Date.now();\n    try {\n      await this.ensureKey();\n      // Write + read + delete a test secret\n      const testRef = `__test_${crypto.randomBytes(4).toString(\"hex\")}`;\n      const testValue = new TextEncoder().encode(\"test\");\n      await this.setSecret(testRef, testValue);\n      const read = await this.getSecret(testRef);\n      await this.deleteSecret(testRef);\n      if (new TextDecoder().decode(read) !== \"test\") {\n        return { ok: false, error: \"Round-trip mismatch\" };\n      }\n      return { ok: true, latencyMs: Date.now() - start };\n    } catch (e) {\n      return {\n        ok: false,\n        latencyMs: Date.now() - start,\n        error: e instanceof Error ? e.message : String(e),\n      };\n    }\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const metaFile = this.metaPath(ref);\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    if (fs.existsSync(metaFile)) {\n      const raw = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      return {\n        ref: raw.ref ?? ref,\n        createdAt: new Date(raw.createdAt),\n        updatedAt: new Date(raw.updatedAt),\n        lastAccessedAt: raw.lastAccessedAt ? new Date(raw.lastAccessedAt) : undefined,\n        owner: raw.owner,\n        scopeSummary: \"local encrypted file\",\n      };\n    }\n    // Fallback: derive from file stat\n    const stat = fs.statSync(filePath);\n    return {\n      ref,\n      createdAt: stat.birthtime,\n      updatedAt: stat.mtime,\n      scopeSummary: \"local encrypted file\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * EnvSecretsProvider — read-only provider that resolves secrets from environment variables.\n *\n * Refs are expected to be plain env var names (e.g. `DATABASE_URL`). The provider is\n * always available with zero configuration and requires no encryption or keychain access.\n * `setSecret` and `deleteSecret` always throw `SecretAccessDeniedError` because\n * environment variables are managed externally to the running process.\n *\n * @docLink packages/secrets/concepts#env-secrets-provider\n */\n\nimport type {\n  ISecretsProvider,\n  SecretMetadata,\n  ProviderCapabilities,\n  SetSecretOptions,\n  ListFilter,\n} from \"@skaile/workspaces/plugins\";\nimport { SecretAccessDeniedError, SecretNotFoundError } from \"@skaile/workspaces/plugins\";\n\n/**\n * Sentinel timestamp for env secrets, which have no real created/updated time.\n * The Unix epoch is unambiguously not \"now\", so consumers can recognise it as\n * \"unknown\" rather than treating it as a genuine recent timestamp.\n */\nconst ENV_UNKNOWN_TIMESTAMP = new Date(0);\n\nexport class EnvSecretsProvider implements ISecretsProvider {\n  readonly id = \"env\";\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    return new TextEncoder().encode(value);\n  }\n\n  async setSecret(_ref: string, _value: Uint8Array, _opts?: SetSecretOptions): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async deleteSecret(_ref: string): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    let keys = Object.keys(process.env);\n    if (filter?.prefix) {\n      keys = keys.filter((k) => k.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      keys = keys.slice(0, filter.limit);\n    }\n    return keys;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    return { ok: true, latencyMs: 0 };\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    // Env vars carry no creation/modification time. `SecretMetadata` requires\n    // both fields, so use the Unix epoch as a documented \"unknown\" sentinel\n    // rather than `new Date()`, which would falsely imply the secret was just\n    // created/updated. The read-only scope summary already signals the source.\n    return {\n      ref,\n      createdAt: ENV_UNKNOWN_TIMESTAMP,\n      updatedAt: ENV_UNKNOWN_TIMESTAMP,\n      scopeSummary: \"environment variable (read-only)\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * CredentialLifecycleService — manages OAuth token refresh outside the SecretsRouter.\n *\n * Works with opaque token blobs stored via the {@link SecretsRouter}; providers remain\n * OAuth-unaware. Phase 1 ships non-OAuth paths (always returns `not_applicable`).\n * Full proactive OAuth refresh with expiry checking ships in Phase 3.4.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\n\nimport type { SecretsRouter } from \"./router.js\";\n\n/**\n * Configuration for {@link CredentialLifecycleService}.\n *\n * Controls how aggressively the service proactively refreshes credentials before they expire.\n * The default lead time is 300 seconds (5 minutes).\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface CredentialLifecycleConfig {\n  /** How far before expiry to trigger a proactive refresh (seconds). */\n  refreshLeadTimeSec: number;\n}\n\n/**\n * Result returned by {@link CredentialLifecycleService.refreshIfNeeded}.\n *\n * The `reason` discriminant indicates why a refresh did or did not occur.\n * An `error` string is present only when `reason` is `refresh_failed`.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface RefreshResult {\n  refreshed: boolean;\n  reason: \"not_applicable\" | \"still_valid\" | \"refreshed\" | \"refresh_failed\";\n  error?: string;\n}\n\nconst DEFAULT_CONFIG: CredentialLifecycleConfig = {\n  refreshLeadTimeSec: 300, // 5 minutes\n};\n\nexport class CredentialLifecycleService {\n  private router: SecretsRouter;\n  private config: CredentialLifecycleConfig;\n\n  constructor(router: SecretsRouter, config?: Partial<CredentialLifecycleConfig>) {\n    this.router = router;\n    this.config = { ...DEFAULT_CONFIG, ...config };\n  }\n\n  /**\n   * Attempt to refresh a credential if needed.\n   * Phase 1: always returns not_applicable (no OAuth support yet).\n   */\n  async refreshIfNeeded(credentialRef: string): Promise<RefreshResult> {\n    // Phase 1: no OAuth refresh implemented.\n    // The credential exists and is valid as-is (static secrets, env vars, etc.)\n    try {\n      await this.router.getMetadata(credentialRef);\n      return { refreshed: false, reason: \"not_applicable\" };\n    } catch {\n      return { refreshed: false, reason: \"refresh_failed\", error: \"Credential not found\" };\n    }\n  }\n\n  /**\n   * Check if a credential is still valid (not expired).\n   * Phase 1: always returns true for non-OAuth credentials.\n   */\n  async isValid(credentialRef: string): Promise<boolean> {\n    try {\n      await this.router.getSecret(credentialRef);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","/** Package version of `@skaile/secrets`. */\nexport const VERSION = \"0.0.0\";\n\n// Re-export interface + errors from plugins (convenience for consumers)\nexport type {\n  ISecretsProvider,\n  SecretMetadata,\n  ProviderCapabilities,\n  SetSecretOptions,\n  ListFilter,\n} from \"@skaile/workspaces/plugins\";\nexport {\n  SecretsError,\n  SecretNotFoundError,\n  SecretAccessDeniedError,\n  SecretExpiredError,\n  ProviderUnavailableError,\n} from \"@skaile/workspaces/plugins\";\n\n// Router\nexport { SecretsRouter } from \"./router.js\";\nexport type { CredentialAccessed, AuditSink, RoutingRule, SecretsRouterConfig } from \"./router.js\";\n\n// Built-in providers\nexport { LocalSecretsProvider } from \"./providers/local.js\";\nexport type { KeyStrategy } from \"./providers/local.js\";\nexport { EnvSecretsProvider } from \"./providers/env.js\";\n\n// Lifecycle\nexport { CredentialLifecycleService } from \"./lifecycle.js\";\nexport type { CredentialLifecycleConfig, RefreshResult } from \"./lifecycle.js\";\n"]}

package/dist/{chunk-B4ZXBH57.js → chunk-A4ASAIKK.js}

@@ -1,8 +1,8 @@
-import { removeAsset, deployAll, createScaffold } from './chunk-QXC62DOF.js';
-import { writeLock, buildLockFile, readLock, verifyLock, extractForPatch, generatePatch, savePatch, applyPatch } from './chunk-XVL22AWE.js';
-import { resolveRuntimeAssets } from './chunk-UD4ZLXGS.js';
-import { resolveSkWorkspaceConfig, getRepoCommit, ensureRepo, buildProvenanceIndex, resolveAll, scanRepo, checkRepoStatus, resolveAsset, readLinks, getGlobalCacheDir } from './chunk-3QTZWPGH.js';
-import { parseAssetRef } from './chunk-WIAHJOMG.js';
+import { removeAsset, deployAll, createScaffold } from './chunk-SF4GWVR5.js';
+import { writeLock, buildLockFile, readLock, verifyLock, extractForPatch, generatePatch, savePatch, applyPatch } from './chunk-M4KLIEIJ.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-FWHOU3CX.js';
+import { resolveSkWorkspaceConfig, getRepoCommit, ensureRepo, buildProvenanceIndex, resolveAll, scanRepo, checkRepoStatus, resolveAsset, readLinks, getGlobalCacheDir } from './chunk-3QQSSRYN.js';
+import { parseAssetRef } from './chunk-IEJ5IOC3.js';
 import { deployedBase, isDeployed, deployedDir } from './chunk-JKNWJ64A.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
@@ -15,6 +15,9 @@ import { parse, stringify } from 'yaml';
 function sourceSlug(url) {
   return url.replace(/\.git$/, "").split(/[/:]/).pop() ?? "source";
 }
+function normalizeRepoUrl(url) {
+  return url.trim().replace(/^git@([^:]+):/, "https://$1/").replace(/^[a-z]+:\/\//i, "").replace(/\.git$/i, "").replace(/\/+$/, "").toLowerCase();
+}
 function parseCanonicalLockKey(key) {
   try {
     const ref = parseAssetRef(key);
@@ -28,6 +31,29 @@ function parseCanonicalLockKey(key) {
     return {};
   }
 }
+var FACTORY_SOURCE_URL = "https://github.com/skaile-ai/ai-assets";
+function resolveFactoryAssetsDir() {
+  for (const dir of factoryAssetRoots()) {
+    if (existsSync(join(dir, "skaile.manifest.yaml"))) return dir;
+  }
+  return null;
+}
+function readDeclaredPublisher(sourceDir) {
+  try {
+    const raw = parse(readFileSync(join(sourceDir, "skaile.manifest.yaml"), "utf8"));
+    return raw && typeof raw.publisher === "string" && raw.publisher.length > 0 ? raw.publisher : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var factorySourceCache;
+function resolveFactorySource() {
+  if (factorySourceCache !== void 0) return factorySourceCache;
+  const dir = resolveFactoryAssetsDir();
+  const publisher = dir ? readDeclaredPublisher(dir) : void 0;
+  factorySourceCache = dir && publisher ? { dir, publisher } : null;
+  return factorySourceCache;
+}
 var AssetManager = class {
   /** Resolved absolute path to the workspace root. */
   projectDir;
@@ -67,6 +93,18 @@ var AssetManager = class {
       if (repositories[slug]) continue;
       repositories[slug] = { path: join(sourcesDir, slug), url: s.url };
     }
+    const factory = resolveFactorySource();
+    const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
+    const alreadyDeclared = Object.values(repositories).some(
+      (d) => d.url !== void 0 && normalizeRepoUrl(d.url) === factoryUrl
+    );
+    if (factory && !alreadyDeclared && !repositories[factory.publisher]) {
+      repositories[factory.publisher] = {
+        path: factory.dir,
+        url: FACTORY_SOURCE_URL,
+        factory: true
+      };
+    }
     return { repositories, sources, stores, dependencies, overrides, patches, config };
   }
   /** Build provenance-index clones from the resolved source declarations. */
@@ -121,17 +159,23 @@ var AssetManager = class {
     const mdName = MD_BY_KIND[c.kind];
     const mdRel = c.files.find((f) => mdName ? f.path.endsWith(mdName) : false)?.path;
     const source = mdRel ? join(cloneDir, mdRel) : cloneDir;
-    return {
+    const entry = {
       name: c.name,
       kind: c.kind,
-      description: "",
+      description: c.description ?? "",
       source,
       publisher: slug,
       version: c.version,
       requires: [],
-      dependencies: [],
+      // Manifest-declared deps are authoritative for the candidate's deps.
+      dependencies: c.deps ?? [],
       metadata: c.metadata
     };
+    if (c.category != null) entry.category = c.category;
+    if (c.keywords && c.keywords.length > 0) entry.keywords = c.keywords;
+    if (c.license != null) entry.license = c.license;
+    if (c.homepage != null) entry.homepage = c.homepage;
+    return entry;
   }
   // ── Install / resolve ──────────────────────────────────────────────────
   /**
@@ -434,9 +478,10 @@ var AssetManager = class {
     for (const [name, decl] of Object.entries(repositories)) {
       const repoDir = this.resolveRepoDir(decl, name);
       if (!repoDir) continue;
-      if (parsed.publisher && parsed.publisher !== name) continue;
       const entries = scanRepo(repoDir, name);
-      const match = entries.find((e) => e.kind === parsed.kind && e.name === parsed.name);
+      const match = entries.find(
+        (e) => e.kind === parsed.kind && e.name === parsed.name && (!parsed.publisher || e.publisher === parsed.publisher)
+      );
       if (match) return match;
     }
     return null;
@@ -729,7 +774,8 @@ var AssetManager = class {
     const { repositories } = this.loadConfig();
     const decl = repositories[entry.publisher];
     if (!decl?.url) throw new Error("Can only submit patches for remote sources.");
-    const repoDir = join(this.reposDir, entry.publisher);
+    const repoDir = this.resolveRepoDir(decl, entry.publisher);
+    if (!repoDir) throw new Error(`Repository clone not found for ${entry.publisher}.`);
     const branchName = `patch/${parsed.kind}-${parsed.name}`;
     const patchFile = join(this.patchDir, `${parsed.kind}-${parsed.name}.patch`);
     if (!existsSync(patchFile)) throw new Error("No patch file. Run `skaile patch-commit` first.");
@@ -944,5 +990,5 @@ var AssetManager = class {
 };
 
 export { AssetManager, parseCanonicalLockKey };
-//# sourceMappingURL=chunk-B4ZXBH57.js.map
-//# sourceMappingURL=chunk-B4ZXBH57.js.map
+//# sourceMappingURL=chunk-A4ASAIKK.js.map
+//# sourceMappingURL=chunk-A4ASAIKK.js.map