@skaile/workspaces 0.31.0 → 0.33.0

package/dist/{chunk-VO7QQ76S.js → chunk-LRFZNLB2.js}

@@ -1,4 +1,4 @@
-import { resolveSkWorkspaceConfig } from './chunk-DKAV43NI.js';
+import { resolveSkWorkspaceConfig } from './chunk-AZODLVKH.js';
 import { createLogger } from './chunk-JB35MVBN.js';
 
 // connectors/src/secrets.ts
@@ -311,13 +311,16 @@ var MountTokenMediatorError = class extends Error {
   }
 };
 async function resolveMountCredentialString(declaration, secrets, tokenMediator) {
+  return (await resolveMountCredential(declaration, secrets, tokenMediator, "initial")).token;
+}
+async function resolveMountCredential(declaration, secrets, tokenMediator, reason = "initial") {
   if (declaration.auth === "backend") {
     if (!tokenMediator) {
       throw new Error(
         `Connector '${declaration.id}' uses 'auth: backend' but no token mediator is wired (standalone has none \u2014 use env:/inline auth instead).`
       );
     }
-    const result = await tokenMediator({ connectorId: declaration.id, reason: "initial" });
+    const result = await tokenMediator({ connectorId: declaration.id, reason });
     if (!result.ok) {
       throw new MountTokenMediatorError(result.message, result.code, declaration.id);
     }
@@ -328,11 +331,11 @@ async function resolveMountCredentialString(declaration, secrets, tokenMediator)
         declaration.id
       );
     }
-    return result.token;
+    return { token: result.token, expiresAt: result.expiresAt };
   }
-  return resolveAuth(declaration.auth, secrets);
+  return { token: resolveAuth(declaration.auth, secrets), expiresAt: null };
 }
 
-export { EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, MountTokenMediatorError, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, loadConnectorDeclarations, resolveAuth, resolveAuthRef, resolveBackendAuthFor, resolveMountCredentialString };
-//# sourceMappingURL=chunk-VO7QQ76S.js.map
-//# sourceMappingURL=chunk-VO7QQ76S.js.map
+export { EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, MountTokenMediatorError, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, loadConnectorDeclarations, resolveAuth, resolveAuthRef, resolveBackendAuthFor, resolveMountCredential, resolveMountCredentialString };
+//# sourceMappingURL=chunk-LRFZNLB2.js.map
+//# sourceMappingURL=chunk-LRFZNLB2.js.map

package/dist/chunk-LRFZNLB2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;AAUA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAGT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,GAAA,CAAI,IAAA,EAA6B,EAAA,EAAY,IAAA,EAAiC;AAC5E,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAA6B,EAAA,EAAqB;AACtD,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAA6B,EAAA,EAA6C;AAChF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,IAAI,UAAA,CAAW,QAAQ,KAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,CAAA,EAAI,OAAO,MAAA;AACxE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,QAAA,EAAU,OAAO,KAAA,EAAO,QAAA,EAAU,UAAU,YAAY,CAAA;AAExF,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AC5ZO,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,UAAA,IAAc,MAAA,CAAO,WAAW,MAAA,KAAW,CAAA,SAAU,EAAC;AAClE,EAAA,OAAO,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA;AAC9D;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AAWO,SAAS,WAAA,CACd,MACA,OAAA,EACoB;AACpB,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI,OAAA,EAAS,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AACxC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC3B,IAAA,OAAO,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,IAAA;AACT;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD;AAYO,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACxC,IAAA;AAAA,EACA,WAAA;AAAA,EACT,WAAA,CACE,OAAA,EACA,IAAA,EACA,WAAA,EACA;AACA,IAAA,KAAA,CAAM,oBAAoB,WAAW,CAAA,oBAAA,EAAuB,IAAI,CAAA,QAAA,EAAM,OAAO,CAAA,CAAE,CAAA;AAC/E,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACrB;AACF;AA8BA,eAAsB,4BAAA,CACpB,WAAA,EACA,OAAA,EACA,aAAA,EAC6B;AAC7B,EAAA,OAAA,CAAQ,MAAM,sBAAA,CAAuB,WAAA,EAAa,OAAA,EAAS,aAAA,EAAe,SAAS,CAAA,EAAG,KAAA;AACxF;AA4BA,eAAsB,sBAAA,CACpB,WAAA,EACA,OAAA,EACA,aAAA,EACA,SAA8C,SAAA,EACZ;AAClC,EAAA,IAAI,WAAA,CAAY,SAAS,SAAA,EAAW;AAClC,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,WAAA,EAAc,YAAY,EAAE,CAAA,gHAAA;AAAA,OAE9B;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,EAAE,aAAa,WAAA,CAAY,EAAA,EAAI,QAAQ,CAAA;AAC1E,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,MAAM,IAAI,uBAAA,CAAwB,MAAA,CAAO,SAAS,MAAA,CAAO,IAAA,EAAM,YAAY,EAAE,CAAA;AAAA,IAC/E;AAGA,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,IAAI,uBAAA;AAAA,QACR,kCAAA;AAAA,QACA,eAAA;AAAA,QACA,WAAA,CAAY;AAAA,OACd;AAAA,IACF;AACA,IAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,OAAO,SAAA,EAAU;AAAA,EAC5D;AAEA,EAAA,OAAO,EAAE,OAAO,WAAA,CAAY,WAAA,CAAY,MAAM,OAAO,CAAA,EAAG,WAAW,IAAA,EAAK;AAC1E","file":"chunk-LRFZNLB2.js","sourcesContent":["/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>` and `connector:<id>`. Returns\n * `undefined` for any other ref so the chain falls through to the next\n * provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n * capabilities stay strictly in-process — no round trip to the platform to\n * mint while the mount is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n   * capability handlers when the platform delivers new credentials\n   * mid-session.\n   */\n  set(kind: \"mount\" | \"connector\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\"))) return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\"env:\", \"forge:\", \"op:\", \"kp:\", \"oauth:\", \"mount:\", \"connector:\"] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport type {\n  ConnectorDeclaration,\n  TokenMediator,\n  TokenMediatorResult,\n} from \"./connector-types.js\";\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Array of connector declarations, or an empty array if none are declared.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  if (!config.connectors || config.connectors.length === 0) return [];\n  return config.connectors.map(workspaceConnectorToDeclaration);\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  }\n\n  return decl;\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n/**\n * Resolve a credential reference using a `SecretProvider`, or fall back to `env:NAME` lookup.\n * @param auth - Credential reference (e.g. `\"env:GIT_TOKEN\"`).\n * @param secrets - Optional provider; falls back to `process.env` if omitted.\n * @returns Resolved secret value or `undefined`.\n * @deprecated Use `SecretProviderChain.resolve()` instead.\n * @docLink packages/connectors/api-reference#resolve-auth\n */\n// @TODO: Code-Review: deprecated shim kept for backward compat — remove once all callers migrate to SecretProviderChain.resolve()\nexport function resolveAuth(\n  auth: string | undefined,\n  secrets?: import(\"./secrets.js\").SecretProvider,\n): string | undefined {\n  if (!auth) return undefined;\n  if (secrets) return secrets.resolve(auth);\n  if (auth.startsWith(\"env:\")) {\n    const envVar = auth.slice(4);\n    return process.env[envVar];\n  }\n  return auth;\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n\n// ── rclone mount credential bridge (auth: backend) ───────────────────────────\n\n/**\n * Thrown when the backend credential mediator refuses or cannot deliver a\n * mount credential for an `auth: backend` rclone connector. Carries the\n * wire-format error code so callers can branch on it. Mirrors the git driver's\n * `TokenMediatorError`, but lives here so all three rclone drivers share it.\n *\n * @docLink packages/connectors/api-reference#mount-token-mediator-error\n */\nexport class MountTokenMediatorError extends Error {\n  readonly code: Extract<TokenMediatorResult, { ok: false }>[\"code\"];\n  readonly connectorId: string;\n  constructor(\n    message: string,\n    code: Extract<TokenMediatorResult, { ok: false }>[\"code\"],\n    connectorId: string,\n  ) {\n    super(`Mount connector '${connectorId}': backend mediator ${code} — ${message}`);\n    this.name = \"MountTokenMediatorError\";\n    this.code = code;\n    this.connectorId = connectorId;\n  }\n}\n\n/**\n * Resolve the credential *string* an rclone mount driver feeds into its\n * `parseAuthBlob` / `parseAuth` helper.\n *\n * Two cases, branched on `declaration.auth`:\n *   - `backend`  → the credential is minted by the platform mediator. Calls\n *                  `tokenMediator({connectorId, reason: 'initial'})` and returns\n *                  the result's `token` string verbatim (already a JSON blob for\n *                  sharepoint/googledrive, or a `user:pass`/bearer string for\n *                  webdav). Throws `MountTokenMediatorError` when the mediator\n *                  refuses, or a plain `Error` when no mediator is wired (the\n *                  standalone CLI has none — `env:`/inline auth is the path there).\n *   - anything else (`env:NAME`, inline, undefined) → resolves through the\n *                  legacy `resolveAuth` secrets/env path and NEVER touches the\n *                  mediator.\n *\n * For `auth: backend` the mediator also surfaces the access token's expiry,\n * which the rclone drivers use to arm a proactive refresh tick (the\n * client_secret is stripped from Skaile-managed Entra blobs, so rclone cannot\n * self-refresh) — see {@link resolveMountCredential}.\n *\n * @param declaration - The connector declaration (supplies `auth` + `id`).\n * @param secrets - Secrets chain for the legacy `env:`/inline path.\n * @param tokenMediator - Backend mediator, present only for platform sessions.\n * @returns The credential string, or `undefined` when no auth is declared.\n * @throws {MountTokenMediatorError} when the mediator refuses an `auth: backend` mint.\n * @docLink packages/connectors/api-reference#resolve-mount-credential-string\n */\nexport async function resolveMountCredentialString(\n  declaration: ConnectorDeclaration,\n  secrets: import(\"./secrets.js\").SecretProvider | undefined,\n  tokenMediator: TokenMediator | undefined,\n): Promise<string | undefined> {\n  return (await resolveMountCredential(declaration, secrets, tokenMediator, \"initial\")).token;\n}\n\n/**\n * The credential string an rclone mount driver feeds into `parseAuthBlob` /\n * `parseAuth`, paired with the access token's ISO expiry (`null` for static\n * credentials / the legacy env path).\n */\nexport interface ResolvedMountCredential {\n  /** The credential string, or `undefined` when no auth is declared. */\n  token: string | undefined;\n  /** ISO-8601 expiry of the access token, or `null` if unknown / static. */\n  expiresAt: string | null;\n}\n\n/**\n * Resolve a mount credential together with its expiry. The richer companion of\n * {@link resolveMountCredentialString}: rclone drivers use the returned\n * `expiresAt` to arm a proactive token-refresh tick, and re-call this with\n * `reason: 'refresh'` (or `'retry-401'` on the reactive path) to re-mint.\n *\n * Branches on `declaration.auth` exactly like `resolveMountCredentialString`:\n * `backend` mints through the mediator (and fails closed on refusal / empty\n * token); everything else resolves through the legacy `resolveAuth` secrets\n * path with a `null` expiry and never touches the mediator.\n *\n * @throws {MountTokenMediatorError} when the mediator refuses an `auth: backend` mint.\n * @docLink packages/connectors/api-reference#resolve-mount-credential\n */\nexport async function resolveMountCredential(\n  declaration: ConnectorDeclaration,\n  secrets: import(\"./secrets.js\").SecretProvider | undefined,\n  tokenMediator: TokenMediator | undefined,\n  reason: \"initial\" | \"refresh\" | \"retry-401\" = \"initial\",\n): Promise<ResolvedMountCredential> {\n  if (declaration.auth === \"backend\") {\n    if (!tokenMediator) {\n      throw new Error(\n        `Connector '${declaration.id}' uses 'auth: backend' but no token mediator is wired ` +\n          `(standalone has none — use env:/inline auth instead).`,\n      );\n    }\n    const result = await tokenMediator({ connectorId: declaration.id, reason });\n    if (!result.ok) {\n      throw new MountTokenMediatorError(result.message, result.code, declaration.id);\n    }\n    // Fail closed: an empty backend-minted token is a mediator bug. webdav would\n    // otherwise silently fall back to an anonymous mount instead of erroring.\n    if (!result.token) {\n      throw new MountTokenMediatorError(\n        \"mediator returned an empty token\",\n        \"backend-error\",\n        declaration.id,\n      );\n    }\n    return { token: result.token, expiresAt: result.expiresAt };\n  }\n\n  return { token: resolveAuth(declaration.auth, secrets), expiresAt: null };\n}\n"]}

package/dist/{chunk-WDMH4UMD.js → chunk-N74UQJPN.js}

@@ -20,9 +20,24 @@ function assertSafeRefComponent(kind, value) {
     throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);
   }
 }
+function longestCommonDirPrefix(paths) {
+  if (paths.length === 0) return "";
+  const dirSegments = paths.map((p) => p.split("/").slice(0, -1));
+  let common = dirSegments[0];
+  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {
+    const segs = dirSegments[i];
+    let n = 0;
+    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;
+    common = common.slice(0, n);
+  }
+  return common.join("/");
+}
 async function installFromManifest(opts) {
   const { manifest, libraryRoot } = opts;
   const fetcher = opts.fetcher ?? (await import('./source-fetch-github-QN4LLTL5.js')).fetchAssetFilesFromGitHub;
+  if (opts.targetDir !== void 0) {
+    return installFlat(manifest, opts.targetDir, fetcher);
+  }
   let parsed;
   try {
     parsed = parseAssetRef(manifest.ref);
@@ -80,7 +95,34 @@ async function installFromManifest(opts) {
   }
   return { installPath };
 }
+async function installFlat(manifest, targetDir, fetcher) {
+  const target = resolve(targetDir);
+  for (const f of manifest.files) {
+    assertSafeManifestPath(target, f.path);
+  }
+  const paths = manifest.files.map((f) => f.path);
+  const bytes = await fetcher({
+    url: manifest.source.url,
+    commitSha: manifest.source.commitSha,
+    paths
+  });
+  const assetRoot = longestCommonDirPrefix(paths);
+  for (const f of manifest.files) {
+    const buf = bytes[f.path];
+    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);
+    const actual = createHash("sha256").update(buf).digest("hex");
+    if (actual !== f.sha256) {
+      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);
+    }
+    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;
+    assertSafeManifestPath(target, relPath);
+    const dest = join(target, relPath);
+    await mkdir(dirname(dest), { recursive: true });
+    await writeFile(dest, buf);
+  }
+  return { installPath: target };
+}
 
-export { installFromManifest };
-//# sourceMappingURL=chunk-WDMH4UMD.js.map
-//# sourceMappingURL=chunk-WDMH4UMD.js.map
+export { installFromManifest, longestCommonDirPrefix };
+//# sourceMappingURL=chunk-N74UQJPN.js.map
+//# sourceMappingURL=chunk-N74UQJPN.js.map

package/dist/chunk-N74UQJPN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;AA6CA,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AACpE,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,KAAA,CAC1B,KAAA,EAAM,CACN,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,EAAE,IAAI,CAAC,CAAA,CAC3C,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,MAAM;AAAA,CAAI,CAAA,CACpC,KAAK,EAAE,CAAA;AACV,EAAA,MAAM,eAAA,GAAkB,WAAW,QAAQ,CAAA,CAAE,OAAO,WAAA,EAAa,OAAO,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACtF,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AAAA,IACxC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-N74UQJPN.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport { parseAssetRef } from \"@skaile/workspaces/core\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nfunction assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const sortedLines = manifest.files\n    .slice()\n    .sort((a, b) => a.path.localeCompare(b.path))\n    .map((e) => `${e.path}:${e.sha256}\\n`)\n    .join(\"\");\n  const actualComposite = createHash(\"sha256\").update(sortedLines, \"utf-8\").digest(\"hex\");\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n  }\n\n  return { installPath: target };\n}\n"]}

package/dist/{chunk-7FLLPKX3.js → chunk-NSVAJWWQ.js}

@@ -1,6 +1,6 @@
 import { PROVIDER_ENDPOINTS } from './chunk-BMQKMOQY.js';
 import { classifyClaudeSdkError } from './chunk-NGJ6E344.js';
-import { createDriver } from './chunk-OEXA7BBK.js';
+import { createDriver } from './chunk-CIFTUSBV.js';
 
 // bridge/src/normalizer.ts
 var EventNormalizer = class {
@@ -458,5 +458,5 @@ async function validateApiKey(provider, key) {
 }
 
 export { BridgeRuntime, EventNormalizer, createRuntime, detectFileChange, detectFileChanges, summarizeToolCall, summarizeToolResult, validateApiKey };
-//# sourceMappingURL=chunk-7FLLPKX3.js.map
-//# sourceMappingURL=chunk-7FLLPKX3.js.map
+//# sourceMappingURL=chunk-NSVAJWWQ.js.map
+//# sourceMappingURL=chunk-NSVAJWWQ.js.map

package/dist/{chunk-7FLLPKX3.js.map → chunk-NSVAJWWQ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/normalizer.ts","../bridge/src/runtime.ts","../bridge/src/validation.ts"],"names":[],"mappings":";;;;;AAqBO,IAAM,kBAAN,MAAsB;AAAA,EACnB,eAAA,uBAAsB,GAAA,EAAoB;AAAA,EAC1C,wBAAA,GAA2B,KAAA;AAAA,EAC3B,qBAAA,GAAwB,KAAA;AAAA;AAAA,EAExB,eAAA,GAAkB,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1B,UAAU,KAAA,EAAuC;AAC/C,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,eAAA;AACH,QAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,CAAM,OAAO,CAAA;AAAA,MAE9C,KAAK,gBAAA;AACH,QAAA,OAAO,IAAA,CAAK,oBAAoB,KAAK,CAAA;AAAA,MAEvC,KAAK,aAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,UAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,KAAA,CAAM,WAAW,CAAA;AAAA,MAE7C,KAAK,QAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAa,KAAK,CAAA;AAAA,MAEhC,KAAK,OAAA;AACH,QAAA,OAAO;AAAA,UACL;AAAA,YACE,IAAA,EAAM,OAAA;AAAA,YACN,SAAS,KAAA,CAAM,KAAA;AAAA,YACf,KAAA,EAAO,MAAM,KAAA,IAAS,IAAA;AAAA,YACtB,QAAA,EAAU,MAAM,MAAA,EAAQ,QAAA;AAAA,YACxB,GAAI,KAAA,CAAM,MAAA,EAAQ,IAAA,GAAO,EAAE,MAAM,KAAA,CAAM,MAAA,CAAO,IAAA,EAAK,GAAI;AAAC;AAC1D,SACF;AAAA,MAEF,KAAK,WAAA;AAEH,QAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAAA,MAE9C,KAAK,oBAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,WAAA;AACH,QAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,QAAQ,CAAA;AAAA,MAE3C,KAAK,oBAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,cAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,WAAA;AAAA,MACL,KAAK,kBAAA;AAAA,MACL,KAAK,UAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C;AACE,QAAA,OAAO,EAAC;AAAA;AACZ,EACF;AAAA;AAAA,EAGA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,gBAAgB,KAAA,EAAM;AAC3B,IAAA,IAAA,CAAK,wBAAA,GAA2B,KAAA;AAChC,IAAA,IAAA,CAAK,qBAAA,GAAwB,KAAA;AAC7B,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmB,OAAA,EAA0C;AAKnE,IAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa,OAAO,EAAC;AAE1C,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,gBAAA,CAAiB,OAAO,CAAA;AAE5C,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,IAAU,KAAA,CAAM,IAAA,EAAM;AAEvC,QAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,UAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAQ,OAAA,EAAS,KAAA,CAAM,MAAM,CAAA;AAAA,QACnD;AAAA,MACF,CAAA,MAAA,IAAW,KAAA,CAAM,IAAA,KAAS,UAAA,IAAc,MAAM,IAAA,EAAM;AAClD,QAAA,MAAA,CAAO,IAAA,CAAK,GAAG,IAAA,CAAK,aAAA,CAAc,KAAK,CAAC,CAAA;AAAA,MAC1C;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,cAAc,KAAA,EAAwC;AAC5D,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,MAAM,KAAA,GAAS,KAAA,CAAM,KAAA,IAAS,EAAC;AAE/B,IAAA,IAAI,SAAS,iBAAA,EAAmB;AAC9B,MAAA,OAAO,IAAA,CAAK,sBAAsB,KAAK,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,SAAS,OAAA,EAAS;AACpB,MAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,IAC7C;AACA,IAAA,OAAO,IAAA,CAAK,oBAAA,CAAqB,IAAA,EAAM,KAAK,CAAA;AAAA,EAC9C;AAAA,EAEQ,sBAAsB,KAAA,EAAmD;AAC/E,IAAA,MAAM,SAA4B,EAAC;AAGnC,IAAA,MAAM,YAAY,KAAA,CAAM,SAAA;AACxB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC5B,MAAA,KAAA,MAAW,KAAK,SAAA,EAAW;AACzB,QAAA,MAAM,IAAA,GAAO,CAAA;AACb,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,QAAA,IAAY,EAAE,CAAA;AAC3C,QAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,QAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GACjC,OAAA,CAAQ,IAAI,CAAC,CAAA,KAAY,OAAO,CAAA,KAAM,WAAW,CAAA,GAAI,MAAA,CAAO,EAAE,KAAA,IAAS,CAAC,CAAE,CAAA,GAC1E,MAAA;AACJ,QAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,UAAA,EAAY,QAAA,EAAU,SAAS,CAAA;AAAA,MACrD;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,WAAW,MAAA,CAAO,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAQ,EAAE,CAAA;AAC1D,MAAA,MAAM,aAAa,KAAA,CAAM,OAAA;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAU,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,GAAI,MAAA;AACrE,MAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,UAAA,EAAY,QAAA,EAAU,SAAS,CAAA;AAAA,IACrD;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,kBAAA,CACN,OACA,KAAA,EACmB;AACnB,IAAA,MAAM,YAAY,MAAA,CAAO,KAAA,CAAM,aAAA,IAAiB,KAAA,CAAM,eAAe,SAAS,CAAA;AAC9E,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,WAAA,IAAe,KAAA,CAAM,UAAU,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAChF,IAAA,IAAI,MAAM,EAAA,EAAI;AACZ,MAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,SAAS,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO;AAAA,MACL,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,WAAW,WAAA,EAAY;AAAA,MACpE,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,SAAA;AAAU,KACrC;AAAA,EACF;AAAA,EAEQ,oBAAA,CAAqB,MAAc,KAAA,EAAmD;AAC5F,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,WAAA;AAAA,MACN,IAAA,EAAM,IAAA;AAAA,MACN,KAAA;AAAA,MACA,OAAA,EAAS,iBAAA,CAAkB,IAAA,EAAM,KAAK;AAAA,KACvC,CAAA;AACD,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAEhD,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACxD,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,uBAAA,CAAwB,KAAA,CAAM,OAAO,CAAA;AAC3D,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,KAAA,EAAuC;AACjE,IAAA,MAAM,QAAS,KAAA,CAAc,UAAA;AAC7B,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,OAAO,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAMQ,cAAc,WAAA,EAAiD;AACrE,IAAA,IAAI,CAAC,WAAA,EAAa,MAAA,EAAQ,OAAO,EAAC;AAElC,IAAA,MAAM,SAA4B,EAAC;AAEnC,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AAChC,MAAA,MAAM,QAAA,GAAW,OAAO,QAAA,IAAY,SAAA;AACpC,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,OAAA;AACzC,MAAA,MAAM,SAAS,OAAO,UAAA,KAAe,WAAW,UAAA,GAAa,IAAA,CAAK,UAAU,UAAU,CAAA;AAGtF,MAAA,IAAI,QAAA,KAAa,OAAA,IAAW,IAAA,CAAK,gBAAA,CAAiB,MAAM,CAAA,EAAG;AACzD,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,oBAAA,CAAqB,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,MAC1D,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,iBAAiB,QAAA,EAAU,UAAA,EAAY,MAAM,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,oBAAA,CAAqB,QAAsB,MAAA,EAAmC;AACpF,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,mBAAA,CAAoB,MAAM,CAAA;AACjD,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AACvC,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAY,WAAA,EAAa,CAAA;AAElF,IAAA,IAAI,cAAc,YAAA,EAAc;AAC9B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,gBAAA,CACN,QAAA,EACA,UAAA,EACA,MAAA,EACmB;AACnB,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,aAAA;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,UAAA;AAAA,MACR,OAAA,EAAS,mBAAA,CAAoB,QAAA,EAAU,UAAU;AAAA,KAClD,CAAA;AAGD,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,QAAA,EAAU,UAAU,CAAA;AACzD,IAAA,IAAI,WAAW,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,IAAA,CAAK,GAAG,UAAU,CAAA;AAGpD,IAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,iBAAiB,MAAA,EAA+B;AAEtD,IAAA,IAAI,MAAA,CAAO,YAAY,IAAA,CAAK,eAAA,CAAgB,IAAI,MAAA,CAAO,QAAQ,GAAG,OAAO,IAAA;AACzE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEQ,oBAAoB,MAAA,EAA8B;AAExD,IAAA,MAAM,IAAA,GAAO,OAAO,QAAA,GAAW,IAAA,CAAK,gBAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,GAAI,MAAA;AAC3E,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,MAAA,CAAO,QAAS,CAAA;AAC5C,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAO,QAAA,IAAY,SAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,KAAA,EAA4D;AAC/E,IAAA,IAAI,KAAA,CAAM,YAAY,SAAA,EAAW;AAC/B,MAAA,OAAO;AAAA,QACL;AAAA,UACE,IAAA,EAAM,UAAA;AAAA,UACN,OAAA,EAAS,MAAM,OAAA,IAAW,gBAAA;AAAA,UAC1B,OAAA,EAAS,MAAM,OAAA,IAAW,CAAA;AAAA,UAC1B,GAAI,MAAM,MAAA,GAAS,EAAE,QAAQ,KAAA,CAAM,MAAA,KAAW;AAAC;AACjD,OACF;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,IAAU,EAAC;AAKhC,IAAA,MAAM,SAAS,sBAAA,CAAuB,EAAE,QAAQ,OAAA,EAAS,KAAA,CAAM,SAAS,CAAA;AACxE,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,OAAA,EAAS,CAAA,eAAA,EAAkB,KAAA,CAAM,OAAO,CAAA,EAAG,MAAA,CAAO,MAAA,GAAS,CAAA,QAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,KAAK,EAAE,CAAA,CAAA;AAAA,QACzF,KAAA,EAAO,MAAM,OAAA,KAAY,wBAAA;AAAA,QACzB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,GAAI,OAAO,IAAA,GAAO,EAAE,MAAM,MAAA,CAAO,IAAA,KAAS;AAAC;AAC7C,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMQ,wBAAwB,OAAA,EAAyC;AACvE,IAAA,IAAI,IAAA,CAAK,0BAA0B,OAAO,IAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,IAAA,MAAM,mBACH,GAAA,CAAI,QAAA,CAAS,cAAc,CAAA,IAAK,GAAA,CAAI,SAAS,UAAU,CAAA,IAAK,IAAI,QAAA,CAAS,MAAM,OAC/E,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA,IAAK,GAAA,CAAI,SAAS,aAAa,CAAA,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,IAAA,CAAK,wBAAA,GAA2B,IAAA;AAChC,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,UAAA,EAAW;AAAA,IAChF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,qBAAqB,IAAA,EAAsC;AACjE,IAAA,IAAI,IAAA,CAAK,uBAAuB,OAAO,IAAA;AAEvC,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,wCAAwC,CAAA;AACzE,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,cAAc,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACvE;AAEA,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,qCAAqC,CAAA;AAClE,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,UAAU,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACnE;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,gBAAgB,CAAA,EAAG;AACnC,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,OAAA,EAAQ;AAAA,IAC7E;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAiB,OAAA,EAAuC;AAC9D,IAAA,IAAI,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,SAAU,OAAA,CAAQ,OAAA;AACnD,IAAA,IAAI,OAAO,OAAA,CAAQ,OAAA,KAAY,QAAA,IAAY,QAAQ,OAAA,EAAS;AAC1D,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,OAAA,CAAQ,SAAS,CAAA;AAAA,IACjD;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAiBO,SAAS,iBAAA,CAAkB,MAAc,KAAA,EAAwC;AACtF,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,EAAA,EAAK,OAAO,KAAA,CAAM,OAAA,IAAW,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAAA,IACvD,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,MAAA,CAAO,KAAA,CAAM,SAAS,CAAC,CAAA,CAAA;AAAA,IAC1C,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,SAAS,CAAC,CAAA,CAAA;AAAA,IACxC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,SAAS,CAAC,CAAA,CAAA;AAAA,IACxC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAA;AAAA,IACtC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,WAAA,EAAc,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAA;AAAA,IAC5C;AACE,MAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA;AAE3D;AAGA,SAAS,wBAAwB,MAAA,EAAkC;AACjE,EAAA,MAAM,aAAa,MAAA,CAAO,MAAA;AAAA,IACxB,CAAC,CAAA,KACC,OAAO,CAAA,KAAM,QAAA,IACb,CAAA,KAAM,IAAA,IACL,CAAA,CAA8B,IAAA,KAAS,MAAA,IACxC,OAAQ,CAAA,CAA8B,IAAA,KAAS;AAAA,GACnD;AACA,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,UAAA,CAAW,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA,CAAE,KAAK,IAAI,CAAA;AAChD;AAaO,SAAS,mBAAA,CAAoB,MAAc,MAAA,EAAyB;AAEzE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,IAAA,MAAM,IAAA,GAAO,wBAAwB,MAAM,CAAA;AAC3C,IAAA,OAAA,CAAQ,QAAQ,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,EAAQ;AACzC,IAAA,OAAO,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACpC;AACA,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA,EAAQ;AACX,MAAA,MAAM,SAAS,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,EAAE,IAAA,EAAK;AAC3C,MAAA,IAAI,QAAQ,OAAO,CAAA,QAAA,EAAW,OAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAClD,MAAA,OACE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA,CAClB,MAAK,CACL,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,aAAA;AAAA,IAExB;AAAA,IACA,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,EAAG,OAAO,CAAA,CAAE,IAAI,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACjD,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACrC,KAAK,YAAA;AACH,MAAA,OAAO,CAAA,EAAG,MAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,aAAA,CAAA;AAAA,IAC3D;AACE,MAAA,OAAO,KAAK,SAAA,CAAU,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA;AAEhD;AAaO,SAAS,iBAAA,CAAkB,UAAkB,MAAA,EAAoC;AACtF,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,SAAe,EAAC;AACnD,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,QAAA,KAAa,OAAA,IAAW,CAAA,CAAE,QAAA,EAAU;AACtC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAAA,QACvB,MAAA,EAAQ,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,QAAA,GAAW;AAAA;AAC3C,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAA,KAAa,MAAA,IAAU,CAAA,CAAE,QAAA,EAAU;AACrC,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,cAAA,EAAgB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA,EAAG,MAAA,EAAQ,MAAA,EAAQ,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,aAAa,YAAA,IAAgB,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,EAAG;AACzD,IAAA,OAAO,EAAE,OAAA,CACN,MAAA;AAAA,MACC,CAAC,MAAA,KACC,OAAO,MAAA,KAAW,QAAA,IAClB,MAAA,KAAW,IAAA,IACX,OAAQ,MAAA,CAAmC,IAAA,KAAS,QAAA,IACpD,OAAQ,OAAmC,IAAA,KAAS;AAAA,KACxD,CACC,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,MAChB,IAAA,EAAM,cAAA;AAAA,MACN,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAA,EAAQ,OAAO,IAAA,KAAS,KAAA,GAAQ,WAAW,MAAA,CAAO,IAAA,KAAS,WAAW,QAAA,GAAW;AAAA,KACnF,CAAE,CAAA;AAAA,EACN;AAEA,EAAA,OAAO,EAAC;AACV;AAYO,SAAS,gBAAA,CAAiB,UAAkB,MAAA,EAAyC;AAC1F,EAAA,OAAO,iBAAA,CAAkB,QAAA,EAAU,MAAM,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AACnD;;;AC/eO,IAAM,gBAAN,MAA6C;AAAA,EAC1C,MAAA,GAA6B,IAAA;AAAA,EAC7B,UAAA,GAAa,IAAI,eAAA,EAAgB;AAAA,EACjC,QAAA,uBAAe,GAAA,EAAiC;AAAA,EAChD,iBAAA,GAAmD,IAAA;AAAA,EACnD,QAAA;AAAA,EAER,WAAA,CAAY,WAAmB,YAAA,EAAc;AAC3C,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,MAAM,MAAM,MAAA,EAA2C;AAErD,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,KAAK,OAAA,EAAQ;AAAA,IACrB;AAEA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAEtB,IAAA,MAAM,YAAA,GAA4B;AAAA,MAChC,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,iBAAiB,MAAA,CAAO,eAAA;AAAA,MACxB,UAAU,MAAA,CAAO;AAAA,KACnB;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,YAAY,CAAA;AAG5D,IAAA,IAAA,CAAK,iBAAA,GAAoB,CAAC,WAAA,KAAqB;AAC7C,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU,WAAW,CAAA;AACxD,MAAA,KAAA,MAAW,SAAS,UAAA,EAAY;AAC9B,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACnC,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf;AAAA,MACF;AAAA,IACF,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AAEpD,IAAA,MAAM,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EAC1B;AAAA,EAEA,MAAM,UAAU,OAAA,EAAiD;AAAA,EAGjE;AAAA,EAEA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAC5E,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,MAAM,MAAA,EAA+B;AAEzC,IAAA,MAAM,IAAA,CAAK,OAAO,MAAM,CAAA;AAAA,EAC1B;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,QAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AACrD,QAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AAAA,MAC3B;AACA,MAAA,IAAA,CAAK,OAAO,IAAA,EAAK;AACjB,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAAA,EACxB;AAAA,EAEA,QAAQ,OAAA,EAA4C;AAClD,IAAA,IAAA,CAAK,QAAA,CAAS,IAAI,OAAO,CAAA;AAAA,EAC3B;AAAA,EAEA,SAAS,OAAA,EAA4C;AACnD,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,IAAa,KAAA;AAAA,EACnC;AACF;AASO,SAAS,aAAA,CAAc,WAAmB,YAAA,EAA6B;AAC5E,EAAA,OAAO,IAAI,cAAc,QAAQ,CAAA;AACnC;;;ACrGA,eAAsB,cAAA,CAAe,UAAkB,GAAA,EAAwC;AAC7F,EAAA,MAAM,QAAA,GAAW,mBAAmB,QAAQ,CAAA;AAC5C,EAAA,IAAI,CAAC,UAAU,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,QAAQ,CAAA,CAAA,EAAG;AAE1E,EAAA,IAAI,MAAM,QAAA,CAAS,GAAA;AACnB,EAAA,IAAI,QAAA,CAAS,YAAY,GAAA,IAAO,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA,EAAI,kBAAA,CAAmB,GAAG,CAAC,CAAA,CAAA;AAElF,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,UAAU,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,GAAI,CAAA;AAEzD,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,MAC7B,QAAQ,UAAA,CAAW;AAAA,KACpB,CAAA;AAED,IAAA,YAAA,CAAa,OAAO,CAAA;AAEpB,IAAA,IAAI,QAAA,CAAS,EAAA,EAAI,OAAO,EAAE,IAAI,IAAA,EAAK;AAEnC,IAAA,MAAM,SAAS,QAAA,CAAS,MAAA;AACxB,IAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK;AACpC,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,yCAAA,EAA0C;AAAA,IACvE;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,CAAA,EAAG;AAAA,EAC3D,SAAS,GAAA,EAAU;AACjB,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,wBAAA,EAAyB;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,WAAW,eAAA,EAAgB;AAAA,EAC5D;AACF","file":"chunk-7FLLPKX3.js","sourcesContent":["/**\n * EventNormalizer — converts bridge-level AgentEvent (raw driver events) to\n * skaile-agent-types AgentEvent (normalized, human-readable events).\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call reset() between sessions.\n */\n\nimport type { AgentEvent as NormalizedEvent } from \"@skaile/workspaces/types\";\nimport { classifyClaudeSdkError } from \"./error-classifier.js\";\nimport type { AgentMessage, AgentEvent as BridgeEvent, ContentBlock } from \"./types.js\";\n\n/**\n * Converts raw bridge-level {@link BridgeEvent} payloads into normalized\n * `@skaile/workspaces/types` `AgentEvent` payloads consumed by the runner and transport.\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call {@link EventNormalizer.reset} between sessions to clear accumulated state.\n *\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport class EventNormalizer {\n  private activeSubagents = new Map<string, string>();\n  private devServerStartingEmitted = false;\n  private devServerReadyEmitted = false;\n  /** True when message_update deltas have been emitted for the current message. */\n  private hasStreamedText = false;\n\n  /**\n   * Convert a single bridge event into zero or more normalized events.\n   * One bridge event can produce multiple normalized events (e.g., a message_start\n   * with text + tool_use blocks produces both text and tool_call events).\n   */\n  normalize(event: BridgeEvent): NormalizedEvent[] {\n    switch (event.type) {\n      case \"message_start\":\n        return this.handleMessageStart(event.message);\n\n      case \"message_update\":\n        return this.handleMessageUpdate(event);\n\n      case \"message_end\":\n        return [];\n\n      case \"turn_end\":\n        return this.handleTurnEnd(event.toolResults);\n\n      case \"result\":\n        return this.handleResult(event);\n\n      case \"error\":\n        return [\n          {\n            type: \"error\",\n            message: event.error,\n            fatal: event.fatal ?? true,\n            category: event.detail?.category,\n            ...(event.detail?.hint ? { hint: event.detail.hint } : {}),\n          },\n        ];\n\n      case \"tool_call\":\n        // Already handled in message_start — emit status only\n        return [{ type: \"status\", phase: \"working\" }];\n\n      case \"tool_execution_end\":\n        return [];\n\n      case \"agent_end\":\n        return [{ type: \"status\", phase: \"idle\" }];\n\n      case \"commands_available\":\n        // Pass through to transport — the gateway caches this event\n        return [event as unknown as NormalizedEvent];\n\n      case \"session_info\":\n        // Pass through to transport — the forge layer stores the OMP session ID\n        return [event as unknown as NormalizedEvent];\n\n      case \"ui_render\":\n      case \"ui_render_update\":\n      case \"ui_clear\":\n        // Pass through verbatim — drivers that implement the Agent UI Protocol emit these directly\n        return [event as unknown as NormalizedEvent];\n\n      default:\n        return [];\n    }\n  }\n\n  /** Clear all stateful tracking between sessions. */\n  reset(): void {\n    this.activeSubagents.clear();\n    this.devServerStartingEmitted = false;\n    this.devServerReadyEmitted = false;\n    this.hasStreamedText = false;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_start → text, tool_call, question, subagent\n  // ---------------------------------------------------------------------------\n\n  private handleMessageStart(message: AgentMessage): NormalizedEvent[] {\n    // Only process assistant messages. Drivers (e.g. omp) may echo the user's\n    // message as a message_start with role:\"user\" before streaming the response.\n    // Emitting a text event for that echo would prepend the user's input to the\n    // assistant bubble on the frontend.\n    if (message.role !== \"assistant\") return [];\n\n    const events: NormalizedEvent[] = [];\n    const blocks = this.getContentBlocks(message);\n\n    for (const block of blocks) {\n      if (block.type === \"text\" && block.text) {\n        // Skip full text if we already streamed it via message_update deltas\n        if (!this.hasStreamedText) {\n          events.push({ type: \"text\", content: block.text });\n        }\n      } else if (block.type === \"tool_use\" && block.name) {\n        events.push(...this.handleToolUse(block));\n      }\n    }\n\n    this.hasStreamedText = false;\n    return events;\n  }\n\n  private handleToolUse(block: ContentBlock): NormalizedEvent[] {\n    const name = block.name!;\n    const input = (block.input ?? {}) as Record<string, unknown>;\n\n    if (name === \"AskUserQuestion\") {\n      return this.handleAskUserQuestion(input);\n    }\n    if (name === \"Agent\") {\n      return this.handleAgentToolUse(block, input);\n    }\n    return this.handleGenericToolUse(name, input);\n  }\n\n  private handleAskUserQuestion(input: Record<string, unknown>): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    // Claude SDK sends { questions: [{ question, header, options: [{ label, description }] }] }\n    // Legacy/simple format sends { question: string, options?: string[] }\n    const questions = input.questions;\n    if (Array.isArray(questions)) {\n      for (const q of questions) {\n        const qObj = q as Record<string, unknown>;\n        const question = String(qObj.question ?? \"\");\n        const rawOpts = qObj.options;\n        const options = Array.isArray(rawOpts)\n          ? rawOpts.map((o: any) => (typeof o === \"string\" ? o : String(o.label ?? o)))\n          : undefined;\n        events.push({ type: \"question\", question, options });\n      }\n    } else {\n      const question = String(input.question ?? input.text ?? \"\");\n      const rawOptions = input.options;\n      const options = Array.isArray(rawOptions) ? rawOptions.map(String) : undefined;\n      events.push({ type: \"question\", question, options });\n    }\n    return events;\n  }\n\n  private handleAgentToolUse(\n    block: ContentBlock,\n    input: Record<string, unknown>,\n  ): NormalizedEvent[] {\n    const agentName = String(input.subagent_type ?? input.description ?? \"unknown\");\n    const description = String(input.description ?? input.prompt ?? \"\").slice(0, 200);\n    if (block.id) {\n      this.activeSubagents.set(block.id, agentName);\n    }\n    return [\n      { type: \"subagent\", name: agentName, status: \"started\", description },\n      { type: \"status\", phase: \"working\" },\n    ];\n  }\n\n  private handleGenericToolUse(name: string, input: Record<string, unknown>): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    events.push({\n      type: \"tool_call\",\n      tool: name,\n      input,\n      summary: summarizeToolCall(name, input),\n    });\n    events.push({ type: \"status\", phase: \"working\" });\n\n    if (name === \"Bash\" && typeof input.command === \"string\") {\n      const devEvent = this.detectDevServerStarting(input.command);\n      if (devEvent) events.push(devEvent);\n    }\n\n    return events;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_update → streaming text\n  // ---------------------------------------------------------------------------\n\n  private handleMessageUpdate(event: BridgeEvent): NormalizedEvent[] {\n    const delta = (event as any)._textDelta as string | undefined;\n    if (delta) {\n      this.hasStreamedText = true;\n      return [{ type: \"text\", content: delta }];\n    }\n    return [];\n  }\n\n  // ---------------------------------------------------------------------------\n  // turn_end → tool_result, subagent finished, file_changed, dev_server\n  // ---------------------------------------------------------------------------\n\n  private handleTurnEnd(toolResults?: AgentMessage[]): NormalizedEvent[] {\n    if (!toolResults?.length) return [];\n\n    const events: NormalizedEvent[] = [];\n\n    for (const result of toolResults) {\n      const toolName = result.toolName ?? \"unknown\";\n      const outputData = result.data ?? result.content;\n      const output = typeof outputData === \"string\" ? outputData : JSON.stringify(outputData);\n\n      // Check if this is a subagent result\n      if (toolName === \"Agent\" || this.isSubagentResult(result)) {\n        events.push(...this.handleSubagentResult(result, output));\n      } else {\n        events.push(...this.handleToolResult(toolName, outputData, output));\n      }\n    }\n\n    return events;\n  }\n\n  private handleSubagentResult(result: AgentMessage, output: string): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const agentName = this.resolveSubagentName(result);\n    const description = output.slice(0, 200);\n    events.push({ type: \"subagent\", name: agentName, status: \"finished\", description });\n\n    if (agentName === \"dev-server\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private handleToolResult(\n    toolName: string,\n    outputData: unknown,\n    output: string,\n  ): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    events.push({\n      type: \"tool_result\",\n      tool: toolName,\n      output: outputData,\n      summary: summarizeToolResult(toolName, outputData),\n    });\n\n    // Detect file changes from Write/Edit results\n    const fileEvents = detectFileChanges(toolName, outputData);\n    if (fileEvents.length > 0) events.push(...fileEvents);\n\n    // Detect dev server from Bash output\n    if (toolName === \"Bash\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private isSubagentResult(result: AgentMessage): boolean {\n    // Check if the tool result's id maps to a tracked subagent\n    if (result.toolName && this.activeSubagents.has(result.toolName)) return true;\n    return false;\n  }\n\n  private resolveSubagentName(result: AgentMessage): string {\n    // toolName on bridge AgentMessage is resolved from toolIdToName in the driver\n    const name = result.toolName ? this.activeSubagents.get(result.toolName) : undefined;\n    if (name) {\n      this.activeSubagents.delete(result.toolName!);\n      return name;\n    }\n    return result.toolName ?? \"unknown\";\n  }\n\n  // ---------------------------------------------------------------------------\n  // result → finished or error\n  // ---------------------------------------------------------------------------\n\n  private handleResult(event: BridgeEvent & { type: \"result\" }): NormalizedEvent[] {\n    if (event.subtype === \"success\") {\n      return [\n        {\n          type: \"finished\",\n          summary: event.summary ?? \"Task completed\",\n          costUsd: event.costUsd ?? 0,\n          ...(event.tokens ? { tokens: event.tokens } : {}),\n        },\n      ];\n    }\n\n    const errors = event.errors ?? [];\n    // Run the same classifier the claude-sdk driver uses on its `error`\n    // event so the result-error path also surfaces a category and hint\n    // (drivers other than claude-sdk emit `result` without a paired\n    // `error`, so this is the only place they get classified).\n    const detail = classifyClaudeSdkError({ errors, subtype: event.subtype });\n    return [\n      {\n        type: \"error\",\n        message: `Agent stopped: ${event.subtype}${errors.length ? ` — ${errors.join(\"; \")}` : \"\"}`,\n        fatal: event.subtype === \"error_during_execution\",\n        category: detail.category,\n        ...(detail.hint ? { hint: detail.hint } : {}),\n      },\n    ];\n  }\n\n  // ---------------------------------------------------------------------------\n  // Dev server detection\n  // ---------------------------------------------------------------------------\n\n  private detectDevServerStarting(command: string): NormalizedEvent | null {\n    if (this.devServerStartingEmitted) return null;\n    const cmd = command.toLowerCase();\n    const isFrontendStart =\n      (cmd.includes(\"pnpm run dev\") || cmd.includes(\"pnpm dev\") || cmd.includes(\"vite\")) &&\n      (cmd.includes(\"frontend\") || cmd.includes(\"dev:preview\"));\n    if (isFrontendStart) {\n      this.devServerStartingEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"starting\" };\n    }\n    return null;\n  }\n\n  private detectDevServerReady(text: string): NormalizedEvent | null {\n    if (this.devServerReadyEmitted) return null;\n\n    const explicitMatch = text.match(/DEVSERVER_READY:(https?:\\/\\/[^\\s\"\\\\]+)/);\n    if (explicitMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: explicitMatch[1]!, status: \"ready\" };\n    }\n\n    const viteMatch = text.match(/Local:\\s+(https?:\\/\\/localhost:\\d+)/);\n    if (viteMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: viteMatch[1]!, status: \"ready\" };\n    }\n\n    if (text.includes(\"FRONTEND_READY\")) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"ready\" };\n    }\n\n    return null;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Helpers\n  // ---------------------------------------------------------------------------\n\n  private getContentBlocks(message: AgentMessage): ContentBlock[] {\n    if (Array.isArray(message.content)) return message.content;\n    if (typeof message.content === \"string\" && message.content) {\n      return [{ type: \"text\", text: message.content }];\n    }\n    return [];\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Pure helper functions (exported for reuse)\n// ---------------------------------------------------------------------------\n\n/**\n * Produce a human-readable one-line summary of a tool call for the activity log.\n *\n * Returns a string like `$ git status` for Bash, `Read src/index.ts` for Read, etc.\n * Falls back to `ToolName({...input...})` for unrecognised tools.\n *\n * @param tool - Tool name (e.g. `\"Bash\"`, `\"Write\"`, `\"Grep\"`).\n * @param input - Tool input record passed to the call.\n * @returns A short display string suitable for the activity feed.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolCall(tool: string, input: Record<string, unknown>): string {\n  switch (tool) {\n    case \"Bash\":\n      return `$ ${String(input.command ?? \"\").slice(0, 200)}`;\n    case \"Write\":\n      return `Create ${String(input.file_path)}`;\n    case \"Edit\":\n      return `Edit ${String(input.file_path)}`;\n    case \"Read\":\n      return `Read ${String(input.file_path)}`;\n    case \"Glob\":\n      return `Find ${String(input.pattern)}`;\n    case \"Grep\":\n      return `Search for ${String(input.pattern)}`;\n    default:\n      return `${tool}(${JSON.stringify(input).slice(0, 100)})`;\n  }\n}\n\n/** Extract plain text from an Anthropic content-block array (e.g. tool results returned by Claude SDK). */\nfunction extractContentBlockText(blocks: unknown[]): string | null {\n  const textBlocks = blocks.filter(\n    (b): b is { type: \"text\"; text: string } =>\n      typeof b === \"object\" &&\n      b !== null &&\n      (b as Record<string, unknown>).type === \"text\" &&\n      typeof (b as Record<string, unknown>).text === \"string\",\n  );\n  if (textBlocks.length === 0) return null;\n  return textBlocks.map((b) => b.text).join(\"\\n\");\n}\n\n/**\n * Produce a human-readable one-line summary of a tool result for the activity log.\n *\n * Handles Bash stdout/stderr, Write/Edit file paths, ApplyPatch change counts, and\n * Anthropic content-block arrays. Falls back to `JSON.stringify` for unknown shapes.\n *\n * @param tool - Tool name.\n * @param result - Raw tool result payload.\n * @returns A short display string, truncated to 200 characters.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolResult(tool: string, result: unknown): string {\n  // Handle Anthropic content-block arrays: [{ type: \"text\", text: \"...\" }, ...]\n  if (Array.isArray(result)) {\n    const text = extractContentBlockText(result);\n    return (text ?? JSON.stringify(result)).slice(0, 200);\n  }\n  if (typeof result !== \"object\" || !result) {\n    return String(result).slice(0, 200);\n  }\n  const r = result as Record<string, unknown>;\n  switch (tool) {\n    case \"Bash\": {\n      const stderr = String(r.stderr ?? \"\").trim();\n      if (stderr) return `stderr: ${stderr.slice(0, 200)}`;\n      return (\n        String(r.stdout ?? \"\")\n          .trim()\n          .slice(0, 200) || \"(no output)\"\n      );\n    }\n    case \"Write\":\n      return `${String(r.type)}: ${String(r.filePath)}`;\n    case \"Edit\":\n      return `Edited ${String(r.filePath)}`;\n    case \"ApplyPatch\":\n      return `${Array.isArray(r.changes) ? r.changes.length : 0} file changes`;\n    default:\n      return JSON.stringify(result).slice(0, 200);\n  }\n}\n\n/**\n * Detect file-change events from a tool result, returning zero or more `file_changed` events.\n *\n * Handles `Write` (single create/edit), `Edit` (single edit), and `ApplyPatch` (multi-file\n * patch with per-change `kind` classification). Returns an empty array for all other tools.\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns Array of `file_changed` normalized events.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChanges(toolName: string, result: unknown): NormalizedEvent[] {\n  if (typeof result !== \"object\" || !result) return [];\n  const r = result as Record<string, unknown>;\n\n  if (toolName === \"Write\" && r.filePath) {\n    return [\n      {\n        type: \"file_changed\",\n        path: String(r.filePath),\n        action: r.type === \"create\" ? \"create\" : \"edit\",\n      },\n    ];\n  }\n  if (toolName === \"Edit\" && r.filePath) {\n    return [{ type: \"file_changed\", path: String(r.filePath), action: \"edit\" }];\n  }\n  if (toolName === \"ApplyPatch\" && Array.isArray(r.changes)) {\n    return r.changes\n      .filter(\n        (change): change is { path: string; kind: \"add\" | \"delete\" | \"update\" } =>\n          typeof change === \"object\" &&\n          change !== null &&\n          typeof (change as Record<string, unknown>).path === \"string\" &&\n          typeof (change as Record<string, unknown>).kind === \"string\",\n      )\n      .map((change) => ({\n        type: \"file_changed\" as const,\n        path: change.path,\n        action: change.kind === \"add\" ? \"create\" : change.kind === \"delete\" ? \"delete\" : \"edit\",\n      }));\n  }\n\n  return [];\n}\n\n/**\n * Backward-compatible single-event helper; returns the first `file_changed` event or `null`.\n *\n * Prefer {@link detectFileChanges} for multi-file patches (e.g. `ApplyPatch`).\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns First detected `file_changed` event, or `null`.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChange(toolName: string, result: unknown): NormalizedEvent | null {\n  return detectFileChanges(toolName, result)[0] ?? null;\n}\n","/**\n * BridgeRuntime — implements IAgentRuntime from @skaile/workspaces/types by wrapping\n * an AgentDriver + EventNormalizer. This is the primary integration point for\n * consumers that want normalized events from any driver.\n */\n\nimport type {\n  AgentEvent,\n  AgentReconfigureOptions,\n  AgentRuntimeConfig,\n  IAgentRuntime,\n} from \"@skaile/workspaces/types\";\n\nimport { EventNormalizer } from \"./normalizer.js\";\nimport { createDriver } from \"./registry.js\";\nimport type { AgentConfig, AgentDriver } from \"./types.js\";\n\n/**\n * Implements `IAgentRuntime` from `@skaile/workspaces/types` by wrapping an {@link AgentDriver}\n * and an {@link EventNormalizer}.\n *\n * This is the primary integration point for consumers that want normalized `AgentEvent`\n * payloads from any driver without managing the driver lifecycle directly. Create via\n * {@link createRuntime} to avoid coupling to `BridgeRuntime` directly.\n *\n * @docLink packages/bridge/api-reference#runtime\n */\nexport class BridgeRuntime implements IAgentRuntime {\n  private driver: AgentDriver | null = null;\n  private normalizer = new EventNormalizer();\n  private handlers = new Set<(event: AgentEvent) => void>();\n  private boundEventHandler: ((event: any) => void) | null = null;\n  private driverId: string;\n\n  constructor(driverId: string = \"claude-sdk\") {\n    this.driverId = driverId;\n  }\n\n  async start(config: AgentRuntimeConfig): Promise<void> {\n    // Dispose previous driver if any\n    if (this.driver) {\n      await this.dispose();\n    }\n\n    this.normalizer.reset();\n\n    const bridgeConfig: AgentConfig = {\n      cwd: config.cwd,\n      provider: config.provider,\n      model: config.model,\n      systemPrompt: config.systemPrompt,\n      apiKeys: config.apiKeys,\n      env: config.env,\n      agentDir: config.agentDir,\n      sessionId: config.sessionId,\n      resumeSessionId: config.resumeSessionId,\n      maxTurns: config.maxTurns,\n    };\n\n    this.driver = await createDriver(this.driverId, bridgeConfig);\n\n    // Wire bridge events through normalizer to handlers\n    this.boundEventHandler = (bridgeEvent: any) => {\n      const normalized = this.normalizer.normalize(bridgeEvent);\n      for (const event of normalized) {\n        for (const handler of this.handlers) {\n          handler(event);\n        }\n      }\n    };\n    this.driver.on(\"agent-event\", this.boundEventHandler);\n\n    await this.driver.start();\n  }\n\n  async configure(_config: AgentReconfigureOptions): Promise<void> {\n    // Runtime reconfiguration for BridgeRuntime is a no-op for now.\n    // Future: reconnect connectors, reload ai-assets, update subagents.\n  }\n\n  async prompt(message: string): Promise<void> {\n    if (!this.driver) throw new Error(\"Runtime not started — call start() first\");\n    await this.driver.prompt(message);\n  }\n\n  async reply(answer: string): Promise<void> {\n    // Claude SDK treats replies the same as prompts (multi-turn via streamInput)\n    await this.prompt(answer);\n  }\n\n  async abort(): Promise<void> {\n    if (this.driver) {\n      await this.driver.abort();\n    }\n  }\n\n  async dispose(): Promise<void> {\n    if (this.driver) {\n      if (this.boundEventHandler) {\n        this.driver.off(\"agent-event\", this.boundEventHandler);\n        this.boundEventHandler = null;\n      }\n      this.driver.kill();\n      this.driver = null;\n    }\n    this.normalizer.reset();\n  }\n\n  onEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.add(handler);\n  }\n\n  offEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.delete(handler);\n  }\n\n  get isRunning(): boolean {\n    return this.driver?.isRunning ?? false;\n  }\n}\n\n/**\n * Factory function to create a {@link BridgeRuntime} with the specified driver.\n *\n * @param driverId - Registered driver id (default: `\"claude-sdk\"`).\n * @returns A new `IAgentRuntime` wrapping the selected driver with event normalization.\n * @docLink packages/bridge/api-reference#runtime\n */\nexport function createRuntime(driverId: string = \"claude-sdk\"): IAgentRuntime {\n  return new BridgeRuntime(driverId);\n}\n","/** Provider API key validation — hits each provider's models endpoint to verify the key works. */\n\nimport { PROVIDER_ENDPOINTS } from \"./provider-endpoints.js\";\n\n/**\n * Result of an API key validation check performed by {@link validateApiKey}.\n *\n * @docLink packages/bridge/api-reference#validation\n */\nexport interface ValidationResult {\n  /** `true` when the API key was accepted by the provider's models endpoint. */\n  ok: boolean;\n  /** Human-readable error description when `ok` is `false`. */\n  error?: string;\n}\n\n/**\n * Validate an API key by sending a lightweight GET request to the provider's models endpoint.\n *\n * Returns `{ ok: true }` when the provider accepts the key (HTTP 2xx). Returns\n * `{ ok: false, error }` on 401/403 (invalid key), other HTTP errors, network failures,\n * or unsupported providers. Requests time out after 8 seconds.\n *\n * @param provider - Provider name matching a key in the shared `PROVIDER_ENDPOINTS` map\n *   (e.g. `\"anthropic\"`, `\"openai\"`, `\"google\"`).\n * @param key - API key to validate.\n * @returns Validation result with optional error description.\n * @docLink packages/bridge/api-reference#validation\n */\nexport async function validateApiKey(provider: string, key: string): Promise<ValidationResult> {\n  const endpoint = PROVIDER_ENDPOINTS[provider];\n  if (!endpoint) return { ok: false, error: `Unknown provider: ${provider}` };\n\n  let url = endpoint.url;\n  if (endpoint.queryParam) url += `?${endpoint.queryParam}=${encodeURIComponent(key)}`;\n\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), 8000);\n\n    const response = await fetch(url, {\n      method: \"GET\",\n      headers: endpoint.headers(key),\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeout);\n\n    if (response.ok) return { ok: true };\n\n    const status = response.status;\n    if (status === 401 || status === 403) {\n      return { ok: false, error: \"Invalid API key (authentication failed)\" };\n    }\n    return { ok: false, error: `API returned HTTP ${status}` };\n  } catch (err: any) {\n    if (err.name === \"AbortError\") return { ok: false, error: \"Request timed out (8s)\" };\n    return { ok: false, error: err.message ?? \"Network error\" };\n  }\n}\n"]}
+{"version":3,"sources":["../bridge/src/normalizer.ts","../bridge/src/runtime.ts","../bridge/src/validation.ts"],"names":[],"mappings":";;;;;AAqBO,IAAM,kBAAN,MAAsB;AAAA,EACnB,eAAA,uBAAsB,GAAA,EAAoB;AAAA,EAC1C,wBAAA,GAA2B,KAAA;AAAA,EAC3B,qBAAA,GAAwB,KAAA;AAAA;AAAA,EAExB,eAAA,GAAkB,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1B,UAAU,KAAA,EAAuC;AAC/C,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,eAAA;AACH,QAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,CAAM,OAAO,CAAA;AAAA,MAE9C,KAAK,gBAAA;AACH,QAAA,OAAO,IAAA,CAAK,oBAAoB,KAAK,CAAA;AAAA,MAEvC,KAAK,aAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,UAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,KAAA,CAAM,WAAW,CAAA;AAAA,MAE7C,KAAK,QAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAa,KAAK,CAAA;AAAA,MAEhC,KAAK,OAAA;AACH,QAAA,OAAO;AAAA,UACL;AAAA,YACE,IAAA,EAAM,OAAA;AAAA,YACN,SAAS,KAAA,CAAM,KAAA;AAAA,YACf,KAAA,EAAO,MAAM,KAAA,IAAS,IAAA;AAAA,YACtB,QAAA,EAAU,MAAM,MAAA,EAAQ,QAAA;AAAA,YACxB,GAAI,KAAA,CAAM,MAAA,EAAQ,IAAA,GAAO,EAAE,MAAM,KAAA,CAAM,MAAA,CAAO,IAAA,EAAK,GAAI;AAAC;AAC1D,SACF;AAAA,MAEF,KAAK,WAAA;AAEH,QAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAAA,MAE9C,KAAK,oBAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,WAAA;AACH,QAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,QAAQ,CAAA;AAAA,MAE3C,KAAK,oBAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,cAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,WAAA;AAAA,MACL,KAAK,kBAAA;AAAA,MACL,KAAK,UAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C;AACE,QAAA,OAAO,EAAC;AAAA;AACZ,EACF;AAAA;AAAA,EAGA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,gBAAgB,KAAA,EAAM;AAC3B,IAAA,IAAA,CAAK,wBAAA,GAA2B,KAAA;AAChC,IAAA,IAAA,CAAK,qBAAA,GAAwB,KAAA;AAC7B,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmB,OAAA,EAA0C;AAKnE,IAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa,OAAO,EAAC;AAE1C,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,gBAAA,CAAiB,OAAO,CAAA;AAE5C,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,IAAU,KAAA,CAAM,IAAA,EAAM;AAEvC,QAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,UAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAQ,OAAA,EAAS,KAAA,CAAM,MAAM,CAAA;AAAA,QACnD;AAAA,MACF,CAAA,MAAA,IAAW,KAAA,CAAM,IAAA,KAAS,UAAA,IAAc,MAAM,IAAA,EAAM;AAClD,QAAA,MAAA,CAAO,IAAA,CAAK,GAAG,IAAA,CAAK,aAAA,CAAc,KAAK,CAAC,CAAA;AAAA,MAC1C;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,cAAc,KAAA,EAAwC;AAC5D,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,MAAM,KAAA,GAAS,KAAA,CAAM,KAAA,IAAS,EAAC;AAE/B,IAAA,IAAI,SAAS,iBAAA,EAAmB;AAC9B,MAAA,OAAO,IAAA,CAAK,sBAAsB,KAAK,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,SAAS,OAAA,EAAS;AACpB,MAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,IAC7C;AACA,IAAA,OAAO,IAAA,CAAK,oBAAA,CAAqB,IAAA,EAAM,KAAK,CAAA;AAAA,EAC9C;AAAA,EAEQ,sBAAsB,KAAA,EAAmD;AAC/E,IAAA,MAAM,SAA4B,EAAC;AAGnC,IAAA,MAAM,YAAY,KAAA,CAAM,SAAA;AACxB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC5B,MAAA,KAAA,MAAW,KAAK,SAAA,EAAW;AACzB,QAAA,MAAM,IAAA,GAAO,CAAA;AACb,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,QAAA,IAAY,EAAE,CAAA;AAC3C,QAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,QAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GACjC,OAAA,CAAQ,IAAI,CAAC,CAAA,KAAY,OAAO,CAAA,KAAM,WAAW,CAAA,GAAI,MAAA,CAAO,EAAE,KAAA,IAAS,CAAC,CAAE,CAAA,GAC1E,MAAA;AACJ,QAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,UAAA,EAAY,QAAA,EAAU,SAAS,CAAA;AAAA,MACrD;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,WAAW,MAAA,CAAO,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAQ,EAAE,CAAA;AAC1D,MAAA,MAAM,aAAa,KAAA,CAAM,OAAA;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAU,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,GAAI,MAAA;AACrE,MAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,UAAA,EAAY,QAAA,EAAU,SAAS,CAAA;AAAA,IACrD;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,kBAAA,CACN,OACA,KAAA,EACmB;AACnB,IAAA,MAAM,YAAY,MAAA,CAAO,KAAA,CAAM,aAAA,IAAiB,KAAA,CAAM,eAAe,SAAS,CAAA;AAC9E,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,WAAA,IAAe,KAAA,CAAM,UAAU,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAChF,IAAA,IAAI,MAAM,EAAA,EAAI;AACZ,MAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,SAAS,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO;AAAA,MACL,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,WAAW,WAAA,EAAY;AAAA,MACpE,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,SAAA;AAAU,KACrC;AAAA,EACF;AAAA,EAEQ,oBAAA,CAAqB,MAAc,KAAA,EAAmD;AAC5F,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,WAAA;AAAA,MACN,IAAA,EAAM,IAAA;AAAA,MACN,KAAA;AAAA,MACA,OAAA,EAAS,iBAAA,CAAkB,IAAA,EAAM,KAAK;AAAA,KACvC,CAAA;AACD,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAEhD,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACxD,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,uBAAA,CAAwB,KAAA,CAAM,OAAO,CAAA;AAC3D,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,KAAA,EAAuC;AACjE,IAAA,MAAM,QAAS,KAAA,CAAc,UAAA;AAC7B,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,OAAO,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAMQ,cAAc,WAAA,EAAiD;AACrE,IAAA,IAAI,CAAC,WAAA,EAAa,MAAA,EAAQ,OAAO,EAAC;AAElC,IAAA,MAAM,SAA4B,EAAC;AAEnC,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AAChC,MAAA,MAAM,QAAA,GAAW,OAAO,QAAA,IAAY,SAAA;AACpC,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,OAAA;AACzC,MAAA,MAAM,SAAS,OAAO,UAAA,KAAe,WAAW,UAAA,GAAa,IAAA,CAAK,UAAU,UAAU,CAAA;AAGtF,MAAA,IAAI,QAAA,KAAa,OAAA,IAAW,IAAA,CAAK,gBAAA,CAAiB,MAAM,CAAA,EAAG;AACzD,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,oBAAA,CAAqB,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,MAC1D,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,iBAAiB,QAAA,EAAU,UAAA,EAAY,MAAM,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,oBAAA,CAAqB,QAAsB,MAAA,EAAmC;AACpF,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,mBAAA,CAAoB,MAAM,CAAA;AACjD,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AACvC,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAY,WAAA,EAAa,CAAA;AAElF,IAAA,IAAI,cAAc,YAAA,EAAc;AAC9B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,gBAAA,CACN,QAAA,EACA,UAAA,EACA,MAAA,EACmB;AACnB,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,aAAA;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,UAAA;AAAA,MACR,OAAA,EAAS,mBAAA,CAAoB,QAAA,EAAU,UAAU;AAAA,KAClD,CAAA;AAGD,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,QAAA,EAAU,UAAU,CAAA;AACzD,IAAA,IAAI,WAAW,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,IAAA,CAAK,GAAG,UAAU,CAAA;AAGpD,IAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,iBAAiB,MAAA,EAA+B;AAEtD,IAAA,IAAI,MAAA,CAAO,YAAY,IAAA,CAAK,eAAA,CAAgB,IAAI,MAAA,CAAO,QAAQ,GAAG,OAAO,IAAA;AACzE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEQ,oBAAoB,MAAA,EAA8B;AAExD,IAAA,MAAM,IAAA,GAAO,OAAO,QAAA,GAAW,IAAA,CAAK,gBAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,GAAI,MAAA;AAC3E,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,MAAA,CAAO,QAAS,CAAA;AAC5C,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAO,QAAA,IAAY,SAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,KAAA,EAA4D;AAC/E,IAAA,IAAI,KAAA,CAAM,YAAY,SAAA,EAAW;AAC/B,MAAA,OAAO;AAAA,QACL;AAAA,UACE,IAAA,EAAM,UAAA;AAAA,UACN,OAAA,EAAS,MAAM,OAAA,IAAW,gBAAA;AAAA,UAC1B,OAAA,EAAS,MAAM,OAAA,IAAW,CAAA;AAAA,UAC1B,GAAI,MAAM,MAAA,GAAS,EAAE,QAAQ,KAAA,CAAM,MAAA,KAAW;AAAC;AACjD,OACF;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,IAAU,EAAC;AAKhC,IAAA,MAAM,SAAS,sBAAA,CAAuB,EAAE,QAAQ,OAAA,EAAS,KAAA,CAAM,SAAS,CAAA;AACxE,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,OAAA,EAAS,CAAA,eAAA,EAAkB,KAAA,CAAM,OAAO,CAAA,EAAG,MAAA,CAAO,MAAA,GAAS,CAAA,QAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,KAAK,EAAE,CAAA,CAAA;AAAA,QACzF,KAAA,EAAO,MAAM,OAAA,KAAY,wBAAA;AAAA,QACzB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,GAAI,OAAO,IAAA,GAAO,EAAE,MAAM,MAAA,CAAO,IAAA,KAAS;AAAC;AAC7C,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMQ,wBAAwB,OAAA,EAAyC;AACvE,IAAA,IAAI,IAAA,CAAK,0BAA0B,OAAO,IAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,IAAA,MAAM,mBACH,GAAA,CAAI,QAAA,CAAS,cAAc,CAAA,IAAK,GAAA,CAAI,SAAS,UAAU,CAAA,IAAK,IAAI,QAAA,CAAS,MAAM,OAC/E,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA,IAAK,GAAA,CAAI,SAAS,aAAa,CAAA,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,IAAA,CAAK,wBAAA,GAA2B,IAAA;AAChC,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,UAAA,EAAW;AAAA,IAChF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,qBAAqB,IAAA,EAAsC;AACjE,IAAA,IAAI,IAAA,CAAK,uBAAuB,OAAO,IAAA;AAEvC,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,wCAAwC,CAAA;AACzE,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,cAAc,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACvE;AAEA,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,qCAAqC,CAAA;AAClE,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,UAAU,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACnE;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,gBAAgB,CAAA,EAAG;AACnC,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,OAAA,EAAQ;AAAA,IAC7E;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAiB,OAAA,EAAuC;AAC9D,IAAA,IAAI,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,SAAU,OAAA,CAAQ,OAAA;AACnD,IAAA,IAAI,OAAO,OAAA,CAAQ,OAAA,KAAY,QAAA,IAAY,QAAQ,OAAA,EAAS;AAC1D,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,OAAA,CAAQ,SAAS,CAAA;AAAA,IACjD;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAiBO,SAAS,iBAAA,CAAkB,MAAc,KAAA,EAAwC;AACtF,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,EAAA,EAAK,OAAO,KAAA,CAAM,OAAA,IAAW,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAAA,IACvD,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,MAAA,CAAO,KAAA,CAAM,SAAS,CAAC,CAAA,CAAA;AAAA,IAC1C,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,SAAS,CAAC,CAAA,CAAA;AAAA,IACxC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,SAAS,CAAC,CAAA,CAAA;AAAA,IACxC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAA;AAAA,IACtC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,WAAA,EAAc,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAA;AAAA,IAC5C;AACE,MAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA;AAE3D;AAGA,SAAS,wBAAwB,MAAA,EAAkC;AACjE,EAAA,MAAM,aAAa,MAAA,CAAO,MAAA;AAAA,IACxB,CAAC,CAAA,KACC,OAAO,CAAA,KAAM,QAAA,IACb,CAAA,KAAM,IAAA,IACL,CAAA,CAA8B,IAAA,KAAS,MAAA,IACxC,OAAQ,CAAA,CAA8B,IAAA,KAAS;AAAA,GACnD;AACA,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,UAAA,CAAW,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA,CAAE,KAAK,IAAI,CAAA;AAChD;AAaO,SAAS,mBAAA,CAAoB,MAAc,MAAA,EAAyB;AAEzE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,IAAA,MAAM,IAAA,GAAO,wBAAwB,MAAM,CAAA;AAC3C,IAAA,OAAA,CAAQ,QAAQ,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,EAAQ;AACzC,IAAA,OAAO,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACpC;AACA,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA,EAAQ;AACX,MAAA,MAAM,SAAS,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,EAAE,IAAA,EAAK;AAC3C,MAAA,IAAI,QAAQ,OAAO,CAAA,QAAA,EAAW,OAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAClD,MAAA,OACE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA,CAClB,MAAK,CACL,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,aAAA;AAAA,IAExB;AAAA,IACA,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,EAAG,OAAO,CAAA,CAAE,IAAI,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACjD,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACrC,KAAK,YAAA;AACH,MAAA,OAAO,CAAA,EAAG,MAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,aAAA,CAAA;AAAA,IAC3D;AACE,MAAA,OAAO,KAAK,SAAA,CAAU,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA;AAEhD;AAaO,SAAS,iBAAA,CAAkB,UAAkB,MAAA,EAAoC;AACtF,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,SAAe,EAAC;AACnD,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,QAAA,KAAa,OAAA,IAAW,CAAA,CAAE,QAAA,EAAU;AACtC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAAA,QACvB,MAAA,EAAQ,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,QAAA,GAAW;AAAA;AAC3C,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAA,KAAa,MAAA,IAAU,CAAA,CAAE,QAAA,EAAU;AACrC,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,cAAA,EAAgB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA,EAAG,MAAA,EAAQ,MAAA,EAAQ,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,aAAa,YAAA,IAAgB,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,EAAG;AACzD,IAAA,OAAO,EAAE,OAAA,CACN,MAAA;AAAA,MACC,CAAC,MAAA,KACC,OAAO,MAAA,KAAW,QAAA,IAClB,MAAA,KAAW,IAAA,IACX,OAAQ,MAAA,CAAmC,IAAA,KAAS,QAAA,IACpD,OAAQ,OAAmC,IAAA,KAAS;AAAA,KACxD,CACC,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,MAChB,IAAA,EAAM,cAAA;AAAA,MACN,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAA,EAAQ,OAAO,IAAA,KAAS,KAAA,GAAQ,WAAW,MAAA,CAAO,IAAA,KAAS,WAAW,QAAA,GAAW;AAAA,KACnF,CAAE,CAAA;AAAA,EACN;AAEA,EAAA,OAAO,EAAC;AACV;AAYO,SAAS,gBAAA,CAAiB,UAAkB,MAAA,EAAyC;AAC1F,EAAA,OAAO,iBAAA,CAAkB,QAAA,EAAU,MAAM,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AACnD;;;AC/eO,IAAM,gBAAN,MAA6C;AAAA,EAC1C,MAAA,GAA6B,IAAA;AAAA,EAC7B,UAAA,GAAa,IAAI,eAAA,EAAgB;AAAA,EACjC,QAAA,uBAAe,GAAA,EAAiC;AAAA,EAChD,iBAAA,GAAmD,IAAA;AAAA,EACnD,QAAA;AAAA,EAER,WAAA,CAAY,WAAmB,YAAA,EAAc;AAC3C,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,MAAM,MAAM,MAAA,EAA2C;AAErD,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,KAAK,OAAA,EAAQ;AAAA,IACrB;AAEA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAEtB,IAAA,MAAM,YAAA,GAA4B;AAAA,MAChC,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,iBAAiB,MAAA,CAAO,eAAA;AAAA,MACxB,UAAU,MAAA,CAAO;AAAA,KACnB;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,YAAY,CAAA;AAG5D,IAAA,IAAA,CAAK,iBAAA,GAAoB,CAAC,WAAA,KAAqB;AAC7C,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU,WAAW,CAAA;AACxD,MAAA,KAAA,MAAW,SAAS,UAAA,EAAY;AAC9B,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACnC,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf;AAAA,MACF;AAAA,IACF,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AAEpD,IAAA,MAAM,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EAC1B;AAAA,EAEA,MAAM,UAAU,OAAA,EAAiD;AAAA,EAGjE;AAAA,EAEA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAC5E,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,MAAM,MAAA,EAA+B;AAEzC,IAAA,MAAM,IAAA,CAAK,OAAO,MAAM,CAAA;AAAA,EAC1B;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,QAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AACrD,QAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AAAA,MAC3B;AACA,MAAA,IAAA,CAAK,OAAO,IAAA,EAAK;AACjB,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAAA,EACxB;AAAA,EAEA,QAAQ,OAAA,EAA4C;AAClD,IAAA,IAAA,CAAK,QAAA,CAAS,IAAI,OAAO,CAAA;AAAA,EAC3B;AAAA,EAEA,SAAS,OAAA,EAA4C;AACnD,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,IAAa,KAAA;AAAA,EACnC;AACF;AASO,SAAS,aAAA,CAAc,WAAmB,YAAA,EAA6B;AAC5E,EAAA,OAAO,IAAI,cAAc,QAAQ,CAAA;AACnC;;;ACrGA,eAAsB,cAAA,CAAe,UAAkB,GAAA,EAAwC;AAC7F,EAAA,MAAM,QAAA,GAAW,mBAAmB,QAAQ,CAAA;AAC5C,EAAA,IAAI,CAAC,UAAU,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,QAAQ,CAAA,CAAA,EAAG;AAE1E,EAAA,IAAI,MAAM,QAAA,CAAS,GAAA;AACnB,EAAA,IAAI,QAAA,CAAS,YAAY,GAAA,IAAO,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA,EAAI,kBAAA,CAAmB,GAAG,CAAC,CAAA,CAAA;AAElF,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,UAAU,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,GAAI,CAAA;AAEzD,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,MAC7B,QAAQ,UAAA,CAAW;AAAA,KACpB,CAAA;AAED,IAAA,YAAA,CAAa,OAAO,CAAA;AAEpB,IAAA,IAAI,QAAA,CAAS,EAAA,EAAI,OAAO,EAAE,IAAI,IAAA,EAAK;AAEnC,IAAA,MAAM,SAAS,QAAA,CAAS,MAAA;AACxB,IAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK;AACpC,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,yCAAA,EAA0C;AAAA,IACvE;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,CAAA,EAAG;AAAA,EAC3D,SAAS,GAAA,EAAU;AACjB,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,wBAAA,EAAyB;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,WAAW,eAAA,EAAgB;AAAA,EAC5D;AACF","file":"chunk-NSVAJWWQ.js","sourcesContent":["/**\n * EventNormalizer — converts bridge-level AgentEvent (raw driver events) to\n * skaile-agent-types AgentEvent (normalized, human-readable events).\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call reset() between sessions.\n */\n\nimport type { AgentEvent as NormalizedEvent } from \"@skaile/workspaces/types\";\nimport { classifyClaudeSdkError } from \"./error-classifier.js\";\nimport type { AgentMessage, AgentEvent as BridgeEvent, ContentBlock } from \"./types.js\";\n\n/**\n * Converts raw bridge-level {@link BridgeEvent} payloads into normalized\n * `@skaile/workspaces/types` `AgentEvent` payloads consumed by the runner and transport.\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call {@link EventNormalizer.reset} between sessions to clear accumulated state.\n *\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport class EventNormalizer {\n  private activeSubagents = new Map<string, string>();\n  private devServerStartingEmitted = false;\n  private devServerReadyEmitted = false;\n  /** True when message_update deltas have been emitted for the current message. */\n  private hasStreamedText = false;\n\n  /**\n   * Convert a single bridge event into zero or more normalized events.\n   * One bridge event can produce multiple normalized events (e.g., a message_start\n   * with text + tool_use blocks produces both text and tool_call events).\n   */\n  normalize(event: BridgeEvent): NormalizedEvent[] {\n    switch (event.type) {\n      case \"message_start\":\n        return this.handleMessageStart(event.message);\n\n      case \"message_update\":\n        return this.handleMessageUpdate(event);\n\n      case \"message_end\":\n        return [];\n\n      case \"turn_end\":\n        return this.handleTurnEnd(event.toolResults);\n\n      case \"result\":\n        return this.handleResult(event);\n\n      case \"error\":\n        return [\n          {\n            type: \"error\",\n            message: event.error,\n            fatal: event.fatal ?? true,\n            category: event.detail?.category,\n            ...(event.detail?.hint ? { hint: event.detail.hint } : {}),\n          },\n        ];\n\n      case \"tool_call\":\n        // Already handled in message_start — emit status only\n        return [{ type: \"status\", phase: \"working\" }];\n\n      case \"tool_execution_end\":\n        return [];\n\n      case \"agent_end\":\n        return [{ type: \"status\", phase: \"idle\" }];\n\n      case \"commands_available\":\n        // Pass through to transport — the gateway caches this event\n        return [event as unknown as NormalizedEvent];\n\n      case \"session_info\":\n        // Pass through to transport — the forge layer stores the OMP session ID\n        return [event as unknown as NormalizedEvent];\n\n      case \"ui_render\":\n      case \"ui_render_update\":\n      case \"ui_clear\":\n        // Pass through verbatim — drivers that implement the Agent UI Protocol emit these directly\n        return [event as unknown as NormalizedEvent];\n\n      default:\n        return [];\n    }\n  }\n\n  /** Clear all stateful tracking between sessions. */\n  reset(): void {\n    this.activeSubagents.clear();\n    this.devServerStartingEmitted = false;\n    this.devServerReadyEmitted = false;\n    this.hasStreamedText = false;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_start → text, tool_call, question, subagent\n  // ---------------------------------------------------------------------------\n\n  private handleMessageStart(message: AgentMessage): NormalizedEvent[] {\n    // Only process assistant messages. Drivers (e.g. omp) may echo the user's\n    // message as a message_start with role:\"user\" before streaming the response.\n    // Emitting a text event for that echo would prepend the user's input to the\n    // assistant bubble on the frontend.\n    if (message.role !== \"assistant\") return [];\n\n    const events: NormalizedEvent[] = [];\n    const blocks = this.getContentBlocks(message);\n\n    for (const block of blocks) {\n      if (block.type === \"text\" && block.text) {\n        // Skip full text if we already streamed it via message_update deltas\n        if (!this.hasStreamedText) {\n          events.push({ type: \"text\", content: block.text });\n        }\n      } else if (block.type === \"tool_use\" && block.name) {\n        events.push(...this.handleToolUse(block));\n      }\n    }\n\n    this.hasStreamedText = false;\n    return events;\n  }\n\n  private handleToolUse(block: ContentBlock): NormalizedEvent[] {\n    const name = block.name!;\n    const input = (block.input ?? {}) as Record<string, unknown>;\n\n    if (name === \"AskUserQuestion\") {\n      return this.handleAskUserQuestion(input);\n    }\n    if (name === \"Agent\") {\n      return this.handleAgentToolUse(block, input);\n    }\n    return this.handleGenericToolUse(name, input);\n  }\n\n  private handleAskUserQuestion(input: Record<string, unknown>): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    // Claude SDK sends { questions: [{ question, header, options: [{ label, description }] }] }\n    // Legacy/simple format sends { question: string, options?: string[] }\n    const questions = input.questions;\n    if (Array.isArray(questions)) {\n      for (const q of questions) {\n        const qObj = q as Record<string, unknown>;\n        const question = String(qObj.question ?? \"\");\n        const rawOpts = qObj.options;\n        const options = Array.isArray(rawOpts)\n          ? rawOpts.map((o: any) => (typeof o === \"string\" ? o : String(o.label ?? o)))\n          : undefined;\n        events.push({ type: \"question\", question, options });\n      }\n    } else {\n      const question = String(input.question ?? input.text ?? \"\");\n      const rawOptions = input.options;\n      const options = Array.isArray(rawOptions) ? rawOptions.map(String) : undefined;\n      events.push({ type: \"question\", question, options });\n    }\n    return events;\n  }\n\n  private handleAgentToolUse(\n    block: ContentBlock,\n    input: Record<string, unknown>,\n  ): NormalizedEvent[] {\n    const agentName = String(input.subagent_type ?? input.description ?? \"unknown\");\n    const description = String(input.description ?? input.prompt ?? \"\").slice(0, 200);\n    if (block.id) {\n      this.activeSubagents.set(block.id, agentName);\n    }\n    return [\n      { type: \"subagent\", name: agentName, status: \"started\", description },\n      { type: \"status\", phase: \"working\" },\n    ];\n  }\n\n  private handleGenericToolUse(name: string, input: Record<string, unknown>): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    events.push({\n      type: \"tool_call\",\n      tool: name,\n      input,\n      summary: summarizeToolCall(name, input),\n    });\n    events.push({ type: \"status\", phase: \"working\" });\n\n    if (name === \"Bash\" && typeof input.command === \"string\") {\n      const devEvent = this.detectDevServerStarting(input.command);\n      if (devEvent) events.push(devEvent);\n    }\n\n    return events;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_update → streaming text\n  // ---------------------------------------------------------------------------\n\n  private handleMessageUpdate(event: BridgeEvent): NormalizedEvent[] {\n    const delta = (event as any)._textDelta as string | undefined;\n    if (delta) {\n      this.hasStreamedText = true;\n      return [{ type: \"text\", content: delta }];\n    }\n    return [];\n  }\n\n  // ---------------------------------------------------------------------------\n  // turn_end → tool_result, subagent finished, file_changed, dev_server\n  // ---------------------------------------------------------------------------\n\n  private handleTurnEnd(toolResults?: AgentMessage[]): NormalizedEvent[] {\n    if (!toolResults?.length) return [];\n\n    const events: NormalizedEvent[] = [];\n\n    for (const result of toolResults) {\n      const toolName = result.toolName ?? \"unknown\";\n      const outputData = result.data ?? result.content;\n      const output = typeof outputData === \"string\" ? outputData : JSON.stringify(outputData);\n\n      // Check if this is a subagent result\n      if (toolName === \"Agent\" || this.isSubagentResult(result)) {\n        events.push(...this.handleSubagentResult(result, output));\n      } else {\n        events.push(...this.handleToolResult(toolName, outputData, output));\n      }\n    }\n\n    return events;\n  }\n\n  private handleSubagentResult(result: AgentMessage, output: string): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const agentName = this.resolveSubagentName(result);\n    const description = output.slice(0, 200);\n    events.push({ type: \"subagent\", name: agentName, status: \"finished\", description });\n\n    if (agentName === \"dev-server\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private handleToolResult(\n    toolName: string,\n    outputData: unknown,\n    output: string,\n  ): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    events.push({\n      type: \"tool_result\",\n      tool: toolName,\n      output: outputData,\n      summary: summarizeToolResult(toolName, outputData),\n    });\n\n    // Detect file changes from Write/Edit results\n    const fileEvents = detectFileChanges(toolName, outputData);\n    if (fileEvents.length > 0) events.push(...fileEvents);\n\n    // Detect dev server from Bash output\n    if (toolName === \"Bash\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private isSubagentResult(result: AgentMessage): boolean {\n    // Check if the tool result's id maps to a tracked subagent\n    if (result.toolName && this.activeSubagents.has(result.toolName)) return true;\n    return false;\n  }\n\n  private resolveSubagentName(result: AgentMessage): string {\n    // toolName on bridge AgentMessage is resolved from toolIdToName in the driver\n    const name = result.toolName ? this.activeSubagents.get(result.toolName) : undefined;\n    if (name) {\n      this.activeSubagents.delete(result.toolName!);\n      return name;\n    }\n    return result.toolName ?? \"unknown\";\n  }\n\n  // ---------------------------------------------------------------------------\n  // result → finished or error\n  // ---------------------------------------------------------------------------\n\n  private handleResult(event: BridgeEvent & { type: \"result\" }): NormalizedEvent[] {\n    if (event.subtype === \"success\") {\n      return [\n        {\n          type: \"finished\",\n          summary: event.summary ?? \"Task completed\",\n          costUsd: event.costUsd ?? 0,\n          ...(event.tokens ? { tokens: event.tokens } : {}),\n        },\n      ];\n    }\n\n    const errors = event.errors ?? [];\n    // Run the same classifier the claude-sdk driver uses on its `error`\n    // event so the result-error path also surfaces a category and hint\n    // (drivers other than claude-sdk emit `result` without a paired\n    // `error`, so this is the only place they get classified).\n    const detail = classifyClaudeSdkError({ errors, subtype: event.subtype });\n    return [\n      {\n        type: \"error\",\n        message: `Agent stopped: ${event.subtype}${errors.length ? ` — ${errors.join(\"; \")}` : \"\"}`,\n        fatal: event.subtype === \"error_during_execution\",\n        category: detail.category,\n        ...(detail.hint ? { hint: detail.hint } : {}),\n      },\n    ];\n  }\n\n  // ---------------------------------------------------------------------------\n  // Dev server detection\n  // ---------------------------------------------------------------------------\n\n  private detectDevServerStarting(command: string): NormalizedEvent | null {\n    if (this.devServerStartingEmitted) return null;\n    const cmd = command.toLowerCase();\n    const isFrontendStart =\n      (cmd.includes(\"pnpm run dev\") || cmd.includes(\"pnpm dev\") || cmd.includes(\"vite\")) &&\n      (cmd.includes(\"frontend\") || cmd.includes(\"dev:preview\"));\n    if (isFrontendStart) {\n      this.devServerStartingEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"starting\" };\n    }\n    return null;\n  }\n\n  private detectDevServerReady(text: string): NormalizedEvent | null {\n    if (this.devServerReadyEmitted) return null;\n\n    const explicitMatch = text.match(/DEVSERVER_READY:(https?:\\/\\/[^\\s\"\\\\]+)/);\n    if (explicitMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: explicitMatch[1]!, status: \"ready\" };\n    }\n\n    const viteMatch = text.match(/Local:\\s+(https?:\\/\\/localhost:\\d+)/);\n    if (viteMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: viteMatch[1]!, status: \"ready\" };\n    }\n\n    if (text.includes(\"FRONTEND_READY\")) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"ready\" };\n    }\n\n    return null;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Helpers\n  // ---------------------------------------------------------------------------\n\n  private getContentBlocks(message: AgentMessage): ContentBlock[] {\n    if (Array.isArray(message.content)) return message.content;\n    if (typeof message.content === \"string\" && message.content) {\n      return [{ type: \"text\", text: message.content }];\n    }\n    return [];\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Pure helper functions (exported for reuse)\n// ---------------------------------------------------------------------------\n\n/**\n * Produce a human-readable one-line summary of a tool call for the activity log.\n *\n * Returns a string like `$ git status` for Bash, `Read src/index.ts` for Read, etc.\n * Falls back to `ToolName({...input...})` for unrecognised tools.\n *\n * @param tool - Tool name (e.g. `\"Bash\"`, `\"Write\"`, `\"Grep\"`).\n * @param input - Tool input record passed to the call.\n * @returns A short display string suitable for the activity feed.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolCall(tool: string, input: Record<string, unknown>): string {\n  switch (tool) {\n    case \"Bash\":\n      return `$ ${String(input.command ?? \"\").slice(0, 200)}`;\n    case \"Write\":\n      return `Create ${String(input.file_path)}`;\n    case \"Edit\":\n      return `Edit ${String(input.file_path)}`;\n    case \"Read\":\n      return `Read ${String(input.file_path)}`;\n    case \"Glob\":\n      return `Find ${String(input.pattern)}`;\n    case \"Grep\":\n      return `Search for ${String(input.pattern)}`;\n    default:\n      return `${tool}(${JSON.stringify(input).slice(0, 100)})`;\n  }\n}\n\n/** Extract plain text from an Anthropic content-block array (e.g. tool results returned by Claude SDK). */\nfunction extractContentBlockText(blocks: unknown[]): string | null {\n  const textBlocks = blocks.filter(\n    (b): b is { type: \"text\"; text: string } =>\n      typeof b === \"object\" &&\n      b !== null &&\n      (b as Record<string, unknown>).type === \"text\" &&\n      typeof (b as Record<string, unknown>).text === \"string\",\n  );\n  if (textBlocks.length === 0) return null;\n  return textBlocks.map((b) => b.text).join(\"\\n\");\n}\n\n/**\n * Produce a human-readable one-line summary of a tool result for the activity log.\n *\n * Handles Bash stdout/stderr, Write/Edit file paths, ApplyPatch change counts, and\n * Anthropic content-block arrays. Falls back to `JSON.stringify` for unknown shapes.\n *\n * @param tool - Tool name.\n * @param result - Raw tool result payload.\n * @returns A short display string, truncated to 200 characters.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolResult(tool: string, result: unknown): string {\n  // Handle Anthropic content-block arrays: [{ type: \"text\", text: \"...\" }, ...]\n  if (Array.isArray(result)) {\n    const text = extractContentBlockText(result);\n    return (text ?? JSON.stringify(result)).slice(0, 200);\n  }\n  if (typeof result !== \"object\" || !result) {\n    return String(result).slice(0, 200);\n  }\n  const r = result as Record<string, unknown>;\n  switch (tool) {\n    case \"Bash\": {\n      const stderr = String(r.stderr ?? \"\").trim();\n      if (stderr) return `stderr: ${stderr.slice(0, 200)}`;\n      return (\n        String(r.stdout ?? \"\")\n          .trim()\n          .slice(0, 200) || \"(no output)\"\n      );\n    }\n    case \"Write\":\n      return `${String(r.type)}: ${String(r.filePath)}`;\n    case \"Edit\":\n      return `Edited ${String(r.filePath)}`;\n    case \"ApplyPatch\":\n      return `${Array.isArray(r.changes) ? r.changes.length : 0} file changes`;\n    default:\n      return JSON.stringify(result).slice(0, 200);\n  }\n}\n\n/**\n * Detect file-change events from a tool result, returning zero or more `file_changed` events.\n *\n * Handles `Write` (single create/edit), `Edit` (single edit), and `ApplyPatch` (multi-file\n * patch with per-change `kind` classification). Returns an empty array for all other tools.\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns Array of `file_changed` normalized events.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChanges(toolName: string, result: unknown): NormalizedEvent[] {\n  if (typeof result !== \"object\" || !result) return [];\n  const r = result as Record<string, unknown>;\n\n  if (toolName === \"Write\" && r.filePath) {\n    return [\n      {\n        type: \"file_changed\",\n        path: String(r.filePath),\n        action: r.type === \"create\" ? \"create\" : \"edit\",\n      },\n    ];\n  }\n  if (toolName === \"Edit\" && r.filePath) {\n    return [{ type: \"file_changed\", path: String(r.filePath), action: \"edit\" }];\n  }\n  if (toolName === \"ApplyPatch\" && Array.isArray(r.changes)) {\n    return r.changes\n      .filter(\n        (change): change is { path: string; kind: \"add\" | \"delete\" | \"update\" } =>\n          typeof change === \"object\" &&\n          change !== null &&\n          typeof (change as Record<string, unknown>).path === \"string\" &&\n          typeof (change as Record<string, unknown>).kind === \"string\",\n      )\n      .map((change) => ({\n        type: \"file_changed\" as const,\n        path: change.path,\n        action: change.kind === \"add\" ? \"create\" : change.kind === \"delete\" ? \"delete\" : \"edit\",\n      }));\n  }\n\n  return [];\n}\n\n/**\n * Backward-compatible single-event helper; returns the first `file_changed` event or `null`.\n *\n * Prefer {@link detectFileChanges} for multi-file patches (e.g. `ApplyPatch`).\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns First detected `file_changed` event, or `null`.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChange(toolName: string, result: unknown): NormalizedEvent | null {\n  return detectFileChanges(toolName, result)[0] ?? null;\n}\n","/**\n * BridgeRuntime — implements IAgentRuntime from @skaile/workspaces/types by wrapping\n * an AgentDriver + EventNormalizer. This is the primary integration point for\n * consumers that want normalized events from any driver.\n */\n\nimport type {\n  AgentEvent,\n  AgentReconfigureOptions,\n  AgentRuntimeConfig,\n  IAgentRuntime,\n} from \"@skaile/workspaces/types\";\n\nimport { EventNormalizer } from \"./normalizer.js\";\nimport { createDriver } from \"./registry.js\";\nimport type { AgentConfig, AgentDriver } from \"./types.js\";\n\n/**\n * Implements `IAgentRuntime` from `@skaile/workspaces/types` by wrapping an {@link AgentDriver}\n * and an {@link EventNormalizer}.\n *\n * This is the primary integration point for consumers that want normalized `AgentEvent`\n * payloads from any driver without managing the driver lifecycle directly. Create via\n * {@link createRuntime} to avoid coupling to `BridgeRuntime` directly.\n *\n * @docLink packages/bridge/api-reference#runtime\n */\nexport class BridgeRuntime implements IAgentRuntime {\n  private driver: AgentDriver | null = null;\n  private normalizer = new EventNormalizer();\n  private handlers = new Set<(event: AgentEvent) => void>();\n  private boundEventHandler: ((event: any) => void) | null = null;\n  private driverId: string;\n\n  constructor(driverId: string = \"claude-sdk\") {\n    this.driverId = driverId;\n  }\n\n  async start(config: AgentRuntimeConfig): Promise<void> {\n    // Dispose previous driver if any\n    if (this.driver) {\n      await this.dispose();\n    }\n\n    this.normalizer.reset();\n\n    const bridgeConfig: AgentConfig = {\n      cwd: config.cwd,\n      provider: config.provider,\n      model: config.model,\n      systemPrompt: config.systemPrompt,\n      apiKeys: config.apiKeys,\n      env: config.env,\n      agentDir: config.agentDir,\n      sessionId: config.sessionId,\n      resumeSessionId: config.resumeSessionId,\n      maxTurns: config.maxTurns,\n    };\n\n    this.driver = await createDriver(this.driverId, bridgeConfig);\n\n    // Wire bridge events through normalizer to handlers\n    this.boundEventHandler = (bridgeEvent: any) => {\n      const normalized = this.normalizer.normalize(bridgeEvent);\n      for (const event of normalized) {\n        for (const handler of this.handlers) {\n          handler(event);\n        }\n      }\n    };\n    this.driver.on(\"agent-event\", this.boundEventHandler);\n\n    await this.driver.start();\n  }\n\n  async configure(_config: AgentReconfigureOptions): Promise<void> {\n    // Runtime reconfiguration for BridgeRuntime is a no-op for now.\n    // Future: reconnect connectors, reload ai-assets, update subagents.\n  }\n\n  async prompt(message: string): Promise<void> {\n    if (!this.driver) throw new Error(\"Runtime not started — call start() first\");\n    await this.driver.prompt(message);\n  }\n\n  async reply(answer: string): Promise<void> {\n    // Claude SDK treats replies the same as prompts (multi-turn via streamInput)\n    await this.prompt(answer);\n  }\n\n  async abort(): Promise<void> {\n    if (this.driver) {\n      await this.driver.abort();\n    }\n  }\n\n  async dispose(): Promise<void> {\n    if (this.driver) {\n      if (this.boundEventHandler) {\n        this.driver.off(\"agent-event\", this.boundEventHandler);\n        this.boundEventHandler = null;\n      }\n      this.driver.kill();\n      this.driver = null;\n    }\n    this.normalizer.reset();\n  }\n\n  onEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.add(handler);\n  }\n\n  offEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.delete(handler);\n  }\n\n  get isRunning(): boolean {\n    return this.driver?.isRunning ?? false;\n  }\n}\n\n/**\n * Factory function to create a {@link BridgeRuntime} with the specified driver.\n *\n * @param driverId - Registered driver id (default: `\"claude-sdk\"`).\n * @returns A new `IAgentRuntime` wrapping the selected driver with event normalization.\n * @docLink packages/bridge/api-reference#runtime\n */\nexport function createRuntime(driverId: string = \"claude-sdk\"): IAgentRuntime {\n  return new BridgeRuntime(driverId);\n}\n","/** Provider API key validation — hits each provider's models endpoint to verify the key works. */\n\nimport { PROVIDER_ENDPOINTS } from \"./provider-endpoints.js\";\n\n/**\n * Result of an API key validation check performed by {@link validateApiKey}.\n *\n * @docLink packages/bridge/api-reference#validation\n */\nexport interface ValidationResult {\n  /** `true` when the API key was accepted by the provider's models endpoint. */\n  ok: boolean;\n  /** Human-readable error description when `ok` is `false`. */\n  error?: string;\n}\n\n/**\n * Validate an API key by sending a lightweight GET request to the provider's models endpoint.\n *\n * Returns `{ ok: true }` when the provider accepts the key (HTTP 2xx). Returns\n * `{ ok: false, error }` on 401/403 (invalid key), other HTTP errors, network failures,\n * or unsupported providers. Requests time out after 8 seconds.\n *\n * @param provider - Provider name matching a key in the shared `PROVIDER_ENDPOINTS` map\n *   (e.g. `\"anthropic\"`, `\"openai\"`, `\"google\"`).\n * @param key - API key to validate.\n * @returns Validation result with optional error description.\n * @docLink packages/bridge/api-reference#validation\n */\nexport async function validateApiKey(provider: string, key: string): Promise<ValidationResult> {\n  const endpoint = PROVIDER_ENDPOINTS[provider];\n  if (!endpoint) return { ok: false, error: `Unknown provider: ${provider}` };\n\n  let url = endpoint.url;\n  if (endpoint.queryParam) url += `?${endpoint.queryParam}=${encodeURIComponent(key)}`;\n\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), 8000);\n\n    const response = await fetch(url, {\n      method: \"GET\",\n      headers: endpoint.headers(key),\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeout);\n\n    if (response.ok) return { ok: true };\n\n    const status = response.status;\n    if (status === 401 || status === 403) {\n      return { ok: false, error: \"Invalid API key (authentication failed)\" };\n    }\n    return { ok: false, error: `API returned HTTP ${status}` };\n  } catch (err: any) {\n    if (err.name === \"AbortError\") return { ok: false, error: \"Request timed out (8s)\" };\n    return { ok: false, error: err.message ?? \"Network error\" };\n  }\n}\n"]}

package/dist/{chunk-G247J4MC.js → chunk-PKPUVQJP.js}

@@ -1,4 +1,4 @@
-import { resolveSkWorkspaceConfig } from './chunk-DKAV43NI.js';
+import { resolveSkWorkspaceConfig } from './chunk-AZODLVKH.js';
 import { createHash } from 'crypto';
 import fs, { writeFileSync, existsSync, readFileSync, mkdirSync, cpSync, readdirSync } from 'fs';
 import path, { join, dirname, basename } from 'path';
@@ -818,5 +818,5 @@ var WorkspaceYamlEditor = class _WorkspaceYamlEditor {
 };
 
 export { ALL_PROVIDERS, ManifestYamlEditor, SETTINGS_DEFAULTS, WorkspaceYamlEditor, applyPatch, buildLockFile, computeHash, detectEnvApiKeys, extractForPatch, generatePatch, globalSettingsPath, listPatches, loadSettings, mapLegacyFields, maskApiKey, migrateSettings, portableSpawn, portableSpawnSync, projectSettingsPath, providerEnvKey, readLock, readPatch, readPluginsLockSlice, resolveAllKeys, resolveApiKey, resolveSettings, savePatch, saveSettings, verifyLock, walkForSettings, writeLock, writePluginsLockSlice };
-//# sourceMappingURL=chunk-G247J4MC.js.map
-//# sourceMappingURL=chunk-G247J4MC.js.map
+//# sourceMappingURL=chunk-PKPUVQJP.js.map
+//# sourceMappingURL=chunk-PKPUVQJP.js.map