@skaile/workspaces 0.35.0 → 0.36.0

package/dist/chunk-52HINMW4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;AAUA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAGT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,GAAA,CAAI,IAAA,EAA6B,EAAA,EAAY,IAAA,EAAiC;AAC5E,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAA6B,EAAA,EAAqB;AACtD,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAA6B,EAAA,EAA6C;AAChF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,IAAI,UAAA,CAAW,QAAQ,KAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,CAAA,EAAI,OAAO,MAAA;AACxE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,QAAA,EAAU,OAAO,KAAA,EAAO,QAAA,EAAU,UAAU,YAAY,CAAA;AAExF,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AC5ZO,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,UAAA,IAAc,MAAA,CAAO,WAAW,MAAA,KAAW,CAAA,SAAU,EAAC;AAClE,EAAA,OAAO,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA;AAC9D;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AAWO,SAAS,WAAA,CACd,MACA,OAAA,EACoB;AACpB,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI,OAAA,EAAS,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AACxC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC3B,IAAA,OAAO,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,IAAA;AACT;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD;AAYO,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACxC,IAAA;AAAA,EACA,WAAA;AAAA,EACT,WAAA,CACE,OAAA,EACA,IAAA,EACA,WAAA,EACA;AACA,IAAA,KAAA,CAAM,oBAAoB,WAAW,CAAA,oBAAA,EAAuB,IAAI,CAAA,QAAA,EAAM,OAAO,CAAA,CAAE,CAAA;AAC/E,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACrB;AACF;AA8BA,eAAsB,4BAAA,CACpB,WAAA,EACA,OAAA,EACA,aAAA,EAC6B;AAC7B,EAAA,OAAA,CAAQ,MAAM,sBAAA,CAAuB,WAAA,EAAa,OAAA,EAAS,aAAA,EAAe,SAAS,CAAA,EAAG,KAAA;AACxF;AA4BA,eAAsB,sBAAA,CACpB,WAAA,EACA,OAAA,EACA,aAAA,EACA,SAA8C,SAAA,EACZ;AAClC,EAAA,IAAI,WAAA,CAAY,SAAS,SAAA,EAAW;AAClC,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,WAAA,EAAc,YAAY,EAAE,CAAA,gHAAA;AAAA,OAE9B;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,EAAE,aAAa,WAAA,CAAY,EAAA,EAAI,QAAQ,CAAA;AAC1E,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,MAAM,IAAI,uBAAA,CAAwB,MAAA,CAAO,SAAS,MAAA,CAAO,IAAA,EAAM,YAAY,EAAE,CAAA;AAAA,IAC/E;AAGA,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,IAAI,uBAAA;AAAA,QACR,kCAAA;AAAA,QACA,eAAA;AAAA,QACA,WAAA,CAAY;AAAA,OACd;AAAA,IACF;AACA,IAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,OAAO,SAAA,EAAU;AAAA,EAC5D;AAEA,EAAA,OAAO,EAAE,OAAO,WAAA,CAAY,WAAA,CAAY,MAAM,OAAO,CAAA,EAAG,WAAW,IAAA,EAAK;AAC1E","file":"chunk-52HINMW4.js","sourcesContent":["/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>` and `connector:<id>`. Returns\n * `undefined` for any other ref so the chain falls through to the next\n * provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n * capabilities stay strictly in-process — no round trip to the platform to\n * mint while the mount is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n   * capability handlers when the platform delivers new credentials\n   * mid-session.\n   */\n  set(kind: \"mount\" | \"connector\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\"))) return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\"env:\", \"forge:\", \"op:\", \"kp:\", \"oauth:\", \"mount:\", \"connector:\"] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport type {\n  ConnectorDeclaration,\n  TokenMediator,\n  TokenMediatorResult,\n} from \"./connector-types.js\";\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Array of connector declarations, or an empty array if none are declared.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  if (!config.connectors || config.connectors.length === 0) return [];\n  return config.connectors.map(workspaceConnectorToDeclaration);\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  }\n\n  return decl;\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n/**\n * Resolve a credential reference using a `SecretProvider`, or fall back to `env:NAME` lookup.\n * @param auth - Credential reference (e.g. `\"env:GIT_TOKEN\"`).\n * @param secrets - Optional provider; falls back to `process.env` if omitted.\n * @returns Resolved secret value or `undefined`.\n * @deprecated Use `SecretProviderChain.resolve()` instead.\n * @docLink packages/connectors/api-reference#resolve-auth\n */\n// @TODO: Code-Review: deprecated shim kept for backward compat — remove once all callers migrate to SecretProviderChain.resolve()\nexport function resolveAuth(\n  auth: string | undefined,\n  secrets?: import(\"./secrets.js\").SecretProvider,\n): string | undefined {\n  if (!auth) return undefined;\n  if (secrets) return secrets.resolve(auth);\n  if (auth.startsWith(\"env:\")) {\n    const envVar = auth.slice(4);\n    return process.env[envVar];\n  }\n  return auth;\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n\n// ── rclone mount credential bridge (auth: backend) ───────────────────────────\n\n/**\n * Thrown when the backend credential mediator refuses or cannot deliver a\n * mount credential for an `auth: backend` rclone connector. Carries the\n * wire-format error code so callers can branch on it. Mirrors the git driver's\n * `TokenMediatorError`, but lives here so all three rclone drivers share it.\n *\n * @docLink packages/connectors/api-reference#mount-token-mediator-error\n */\nexport class MountTokenMediatorError extends Error {\n  readonly code: Extract<TokenMediatorResult, { ok: false }>[\"code\"];\n  readonly connectorId: string;\n  constructor(\n    message: string,\n    code: Extract<TokenMediatorResult, { ok: false }>[\"code\"],\n    connectorId: string,\n  ) {\n    super(`Mount connector '${connectorId}': backend mediator ${code} — ${message}`);\n    this.name = \"MountTokenMediatorError\";\n    this.code = code;\n    this.connectorId = connectorId;\n  }\n}\n\n/**\n * Resolve the credential *string* an rclone mount driver feeds into its\n * `parseAuthBlob` / `parseAuth` helper.\n *\n * Two cases, branched on `declaration.auth`:\n *   - `backend`  → the credential is minted by the platform mediator. Calls\n *                  `tokenMediator({connectorId, reason: 'initial'})` and returns\n *                  the result's `token` string verbatim (already a JSON blob for\n *                  sharepoint/googledrive, or a `user:pass`/bearer string for\n *                  webdav). Throws `MountTokenMediatorError` when the mediator\n *                  refuses, or a plain `Error` when no mediator is wired (the\n *                  standalone CLI has none — `env:`/inline auth is the path there).\n *   - anything else (`env:NAME`, inline, undefined) → resolves through the\n *                  legacy `resolveAuth` secrets/env path and NEVER touches the\n *                  mediator.\n *\n * For `auth: backend` the mediator also surfaces the access token's expiry,\n * which the rclone drivers use to arm a proactive refresh tick (the\n * client_secret is stripped from Skaile-managed Entra blobs, so rclone cannot\n * self-refresh) — see {@link resolveMountCredential}.\n *\n * @param declaration - The connector declaration (supplies `auth` + `id`).\n * @param secrets - Secrets chain for the legacy `env:`/inline path.\n * @param tokenMediator - Backend mediator, present only for platform sessions.\n * @returns The credential string, or `undefined` when no auth is declared.\n * @throws {MountTokenMediatorError} when the mediator refuses an `auth: backend` mint.\n * @docLink packages/connectors/api-reference#resolve-mount-credential-string\n */\nexport async function resolveMountCredentialString(\n  declaration: ConnectorDeclaration,\n  secrets: import(\"./secrets.js\").SecretProvider | undefined,\n  tokenMediator: TokenMediator | undefined,\n): Promise<string | undefined> {\n  return (await resolveMountCredential(declaration, secrets, tokenMediator, \"initial\")).token;\n}\n\n/**\n * The credential string an rclone mount driver feeds into `parseAuthBlob` /\n * `parseAuth`, paired with the access token's ISO expiry (`null` for static\n * credentials / the legacy env path).\n */\nexport interface ResolvedMountCredential {\n  /** The credential string, or `undefined` when no auth is declared. */\n  token: string | undefined;\n  /** ISO-8601 expiry of the access token, or `null` if unknown / static. */\n  expiresAt: string | null;\n}\n\n/**\n * Resolve a mount credential together with its expiry. The richer companion of\n * {@link resolveMountCredentialString}: rclone drivers use the returned\n * `expiresAt` to arm a proactive token-refresh tick, and re-call this with\n * `reason: 'refresh'` (or `'retry-401'` on the reactive path) to re-mint.\n *\n * Branches on `declaration.auth` exactly like `resolveMountCredentialString`:\n * `backend` mints through the mediator (and fails closed on refusal / empty\n * token); everything else resolves through the legacy `resolveAuth` secrets\n * path with a `null` expiry and never touches the mediator.\n *\n * @throws {MountTokenMediatorError} when the mediator refuses an `auth: backend` mint.\n * @docLink packages/connectors/api-reference#resolve-mount-credential\n */\nexport async function resolveMountCredential(\n  declaration: ConnectorDeclaration,\n  secrets: import(\"./secrets.js\").SecretProvider | undefined,\n  tokenMediator: TokenMediator | undefined,\n  reason: \"initial\" | \"refresh\" | \"retry-401\" = \"initial\",\n): Promise<ResolvedMountCredential> {\n  if (declaration.auth === \"backend\") {\n    if (!tokenMediator) {\n      throw new Error(\n        `Connector '${declaration.id}' uses 'auth: backend' but no token mediator is wired ` +\n          `(standalone has none — use env:/inline auth instead).`,\n      );\n    }\n    const result = await tokenMediator({ connectorId: declaration.id, reason });\n    if (!result.ok) {\n      throw new MountTokenMediatorError(result.message, result.code, declaration.id);\n    }\n    // Fail closed: an empty backend-minted token is a mediator bug. webdav would\n    // otherwise silently fall back to an anonymous mount instead of erroring.\n    if (!result.token) {\n      throw new MountTokenMediatorError(\n        \"mediator returned an empty token\",\n        \"backend-error\",\n        declaration.id,\n      );\n    }\n    return { token: result.token, expiresAt: result.expiresAt };\n  }\n\n  return { token: resolveAuth(declaration.auth, secrets), expiresAt: null };\n}\n"]}

package/dist/chunk-NGJ6E344.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../bridge/src/error-classifier.ts"],"names":[],"mappings":";AAkDO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EAC1B,MAAA;AAAA,EACT,YAAY,MAAA,EAAoB;AAC9B,IAAA,KAAA,CAAM,OAAO,OAAO,CAAA;AACpB,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF;AAMA,IAAM,8CAA8B,IAAI,GAAA,CAAY,CAAC,gBAAA,EAAkB,sBAAsB,CAAC,CAAA;AAM9F,IAAM,yCAAyB,IAAI,GAAA,CAAY,CAAC,aAAA,EAAe,aAAa,CAAC,CAAA;AAuCtE,SAAS,uBAAuB,KAAA,EAAuD;AAC5F,EAAA,MAAM,IAAA,GAAkC,OAAO,KAAA,KAAU,QAAA,GAAW,EAAE,MAAA,EAAQ,CAAC,KAAK,CAAA,EAAE,GAAI,KAAA;AAE1F,EAAA,MAAM,WAAW,IAAA,CAAK,MAAA,IAAU,EAAC,EAAG,IAAA,CAAK,IAAI,CAAA,IAAK,qBAAA;AAGlD,EAAA,MAAM,gBAAA,GAAmB,wBAAA,CAAyB,OAAA,EAAS,IAAI,CAAA;AAC/D,EAAA,IAAI,gBAAA,EAAkB;AACpB,IAAA,OAAO,gBAAA;AAAA,EACT;AAGA,EAAA,MAAM,UAAA,GAAa,+BAA+B,OAAO,CAAA;AACzD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,YAAA,GAAe,yBAAA,CAA0B,OAAA,EAAS,UAAA,EAAY,IAAI,CAAA;AACxE,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,OAAO,YAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,MAAM,KAAA,GAAQ,QAAQ,WAAA,EAAY;AAElC,EAAA,MAAM,SAAA,GAAY,iBAAA,CAAkB,OAAA,EAAS,KAAA,EAAO,IAAI,CAAA;AACxD,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,SAAA;AAAA,EACT;AAGA,EAAA,MAAM,SAAA,GAAY,iBAAA,CAAkB,OAAA,EAAS,IAAI,CAAA;AACjD,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,SAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,QAAA,EAAU,SAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AACF;AAMA,SAAS,wBAAA,CACP,SACA,IAAA,EACmB;AACnB,EAAA,IAAI,KAAK,cAAA,IAAkB,2BAAA,CAA4B,GAAA,CAAI,IAAA,CAAK,cAAc,CAAA,EAAG;AAC/E,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,cAAA,CAAe,IAAA,CAAK,eAAe;AAAA,KAC3C;AAAA,EACF;AACA,EAAA,IAAI,IAAA,CAAK,mBAAmB,iBAAA,EAAmB;AAC7C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,IAAI,KAAK,cAAA,IAAkB,sBAAA,CAAuB,GAAA,CAAI,IAAA,CAAK,cAAc,CAAA,EAAG;AAC1E,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,yBAAA,CACP,OAAA,EACA,UAAA,EACA,IAAA,EACmB;AACnB,EAAA,IAAI,UAAA,CAAW,cAAc,kBAAA,EAAoB;AAC/C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,cAAA,CAAe,IAAA,CAAK,eAAe;AAAA,KAC3C;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,cAAc,kBAAA,EAAoB;AAC/C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,cAAc,sBAAA,EAAwB;AAMnD,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM,IAAA,CAAK,eAAA,GACP,kTAAA,GACA;AAAA,KACN;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,cAAc,kBAAA,EAAoB;AAC/C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,cAAc,uBAAA,EAAyB;AACpD,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,iBAAA,CACP,OAAA,EACA,KAAA,EACA,IAAA,EACmB;AACnB,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,IAC3B,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,IAC3B,KAAA,CAAM,QAAA,CAAS,mBAAmB,CAAA,IAClC,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,IACpB,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,IACtB,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,IAC/B,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,EAC7B;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,cAAA,CAAe,IAAA,CAAK,eAAe;AAAA,KAC3C;AAAA,EACF;AAEA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,IAC/B,KAAA,CAAM,QAAA,CAAS,qBAAqB,CAAA,IACpC,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,EAC/B;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,iDAAiD,CAAA,EAAG;AACrE,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,UAAA,EAAY,GAAA;AAAA,MACZ,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAWA,EAAA,IAAI,MAAM,QAAA,CAAS,eAAe,KAAK,KAAA,CAAM,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC1E,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,UAAA,EAAY,GAAA;AAAA,MACZ,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM,IAAA,CAAK,eAAA,GACP,wOAAA,GACA;AAAA,KACN;AAAA,EACF;AAEA,EAAA,IACE,KAAA,CAAM,SAAS,SAAS,CAAA,IACxB,MAAM,QAAA,CAAS,gBAAgB,CAAA,IAC/B,KAAA,CAAM,QAAA,CAAS,wBAAwB,KACvC,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,IACpB,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,EACpB;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM,IAAA,CAAK,eAAA,GACP,sNAAA,GACA;AAAA,KACN;AAAA,EACF;AAEA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,KACrB,MAAM,QAAA,CAAS,WAAW,CAAA,IACzB,KAAA,CAAM,SAAS,eAAe,CAAA,IAC9B,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,CAAA,EACjC;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAEA,EAAA,IACE,MAAM,QAAA,CAAS,gBAAgB,KAC/B,KAAA,CAAM,QAAA,CAAS,aAAa,CAAA,IAC5B,KAAA,CAAM,SAAS,YAAY,CAAA,IAC3B,MAAM,QAAA,CAAS,oBAAoB,KACnC,KAAA,CAAM,QAAA,CAAS,iBAAiB,CAAA,EAChC;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAEA,EAAA,IACE,MAAM,QAAA,CAAS,SAAS,KACxB,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,SAAS,WAAW,CAAA,IAC1B,MAAM,QAAA,CAAS,cAAc,KAC7B,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA,EACxB;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,iBAAA,CAAkB,SAAiB,IAAA,EAAoD;AAC9F,EAAA,IAAI,IAAA,CAAK,YAAY,iBAAA,EAAmB;AACtC,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,IAAI,IAAA,CAAK,YAAY,sBAAA,EAAwB;AAC3C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAgBO,SAAS,4BACd,GAAA,EAC+D;AAC/D,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY;AAC9B,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA,IACxB,MAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,SAAS,gBAAgB,CAAA,IAC/B,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,EACpB;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAM;AAAA,EAC9C;AACA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,IAC3B,MAAM,QAAA,CAAS,KAAK,CAAA,IACpB,KAAA,CAAM,SAAS,mBAAmB,CAAA,IAClC,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,EACtB;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,SAAA,EAAW,IAAA,EAAK;AAAA,EACnD;AACA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,KACrB,MAAM,QAAA,CAAS,WAAW,CAAA,IACzB,KAAA,CAAM,SAAS,eAAe,CAAA,IAC9B,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,CAAA,EACjC;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AAAA,EAC/C;AACA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,IAC/B,MAAM,QAAA,CAAS,UAAU,CAAA,IACzB,KAAA,CAAM,SAAS,aAAa,CAAA,IAC5B,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,EAC3B;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AAAA,EAC/C;AACA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA,IACxB,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,QAAA,CAAS,WAAW,CAAA,IAC1B,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA,IACxB,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,IACtB,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,EAC3B;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,SAAA,EAAW,IAAA,EAAK;AAAA,EAChD;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,eAAe,eAAA,EAAmC;AACzD,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,uNAAA;AAAA,EACT;AACA,EAAA,OAAO,sEAAA;AACT;AAeA,SAAS,+BACP,IAAA,EACmD;AACnD,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACnC,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAA,GAAW,sBAAA,CAAuB,IAAA,EAAM,UAAU,CAAA;AACxD,EAAA,IAAI,WAAW,CAAA,EAAG;AAChB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAK,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,QAAQ,CAAC,CAAA;AAAA,EACtD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAA,GAAY,QAAQ,KAAA,EAAO,IAAA;AACjC,EAAA,IAAI,OAAO,cAAc,QAAA,EAAU;AACjC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,uBAAuB,CAAA;AACtD,EAAA,MAAM,aAAa,WAAA,GAAc,MAAA,CAAO,WAAA,CAAY,CAAC,CAAC,CAAA,GAAI,MAAA;AAC1D,EAAA,OAAO,EAAE,WAAW,UAAA,EAAW;AACjC;AAOA,SAAS,sBAAA,CAAuB,MAAc,UAAA,EAA4B;AACxE,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,UAAA,EAAY,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AAC7C,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA;AAC5B,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,GAAU,KAAA;AAAA,MACZ,CAAA,MAAA,IAAW,OAAO,EAAA,EAAY;AAC5B,QAAA,OAAA,GAAU,IAAA;AAAA,MACZ,CAAA,MAAA,IAAW,OAAO,EAAA,EAAY;AAC5B,QAAA,QAAA,GAAW,KAAA;AAAA,MACb;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,EAAA,EAAY;AACrB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb,CAAA,MAAA,IAAW,OAAO,GAAA,EAAa;AAC7B,MAAA,KAAA,EAAA;AAAA,IACF,CAAA,MAAA,IAAW,OAAO,GAAA,EAAa;AAC7B,MAAA,KAAA,EAAA;AACA,MAAA,IAAI,UAAU,CAAA,EAAG;AACf,QAAA,OAAO,CAAA,GAAI,CAAA;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAA;AACT","file":"chunk-NGJ6E344.js","sourcesContent":["/**\n * Error classification for the Claude Agent SDK driver.\n *\n * Wraps the Anthropic API error patterns surfaced through the bundled\n * `claude-cli.js`. The CLI flattens upstream HTTP errors into terse strings\n * like:\n *\n *   `Claude Code returned an error result: Failed to authenticate. API Error:\n *    401 {\"type\":\"error\",\"error\":{\"type\":\"authentication_error\",\"message\":\n *    \"Invalid authentication credentials\"}}`\n *\n * Word-for-word that reads as an auth failure, but in practice it also\n * fires when a Claude Max OAuth subscription has exhausted its current\n * quota window — Anthropic returns a non-200 that the CLI relabels as\n * \"Failed to authenticate\" without preserving the original error type.\n *\n * The classifier here:\n *   1. Parses an embedded JSON body when the upstream included one\n *      (e.g. `{\"type\":\"error\",\"error\":{\"type\":\"rate_limit_error\",...}}`)\n *      so we believe the structured `error.type` over the surrounding\n *      free-text wrapper.\n *   2. Honours the SDK's `terminal_reason` when it explicitly indicates\n *      a blocking-limit / rapid-refill / model-error condition — those\n *      are authoritative even if the textual error reads as auth.\n *   3. Falls back to keyword heuristics on the message text.\n *   4. For OAuth-style credentials (Claude Code subscriptions), adds a\n *      hint that bounces user attention to quota rather than credentials,\n *      because that's overwhelmingly the cause when a CredentialsFile\n *      provider that worked yesterday now returns \"Invalid authentication\n *      credentials\" without anyone touching the file.\n */\n\nimport type { AgentError } from \"./types.js\";\n\n/**\n * Error thrown by drivers when the upstream provider rejects the credential\n * with an authentication-shaped failure (HTTP 401 / `authentication_error`\n * structured body). Carries the structured {@link AgentError} produced by\n * {@link classifyClaudeSdkError} so the runner can mediate without\n * re-classifying string text.\n *\n * The runner's 401-mediation handler `instanceof`-discriminates on this\n * subclass so the auth-vs-rate_limit fork stays in one place.\n *\n * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md`\n * § \"Runner-side handling on 401\".\n *\n * @category Errors\n * @since 3.3.0\n */\nexport class AuthError extends Error {\n  readonly detail: AgentError;\n  constructor(detail: AgentError) {\n    super(detail.message);\n    this.name = \"AuthError\";\n    this.detail = detail;\n  }\n}\n\n/**\n * `terminal_reason` values from the Claude Agent SDK that imply the failure\n * is a rate / quota / blocking condition rather than a credential problem.\n */\nconst RATE_LIMIT_TERMINAL_REASONS = new Set<string>([\"blocking_limit\", \"rapid_refill_breaker\"]);\n\n/**\n * `terminal_reason` values that indicate a generic, retryable model failure.\n * `prompt_too_long` is handled separately (not retryable, different hint).\n */\nconst MODEL_TERMINAL_REASONS = new Set<string>([\"model_error\", \"image_error\"]);\n\n/**\n * Input shape for {@link classifyClaudeSdkError} when decoding an `SDKResultError`.\n *\n * All fields are optional; `classifyClaudeSdkError` also accepts a plain `string`\n * (a thrown exception message) for the common non-SDK code paths.\n *\n * @docLink packages/bridge/api-reference#error-classifier\n */\nexport interface ClaudeSdkResultErrorInput {\n  /** `errors` array from `SDKResultError`. Empty when not provided. */\n  errors?: string[];\n  /**\n   * `terminal_reason` from `SDKResultError`. Authoritative when set to a\n   * blocking/rapid-refill value, regardless of message text.\n   */\n  terminalReason?: string;\n  /** `subtype` from `SDKResultError` — `error_max_turns` etc. */\n  subtype?: string;\n  /**\n   * `true` when the configured Anthropic credential is a Claude Code\n   * subscription (`CredentialsFile` provider) rather than a raw API key.\n   * Changes the hint copy because `Invalid authentication credentials`\n   * on an OAuth subscription almost always means quota.\n   */\n  oauthCredential?: boolean;\n}\n\n/**\n * Classify a Claude SDK result-error or thrown error into a structured\n * {@link AgentError}. Pure function — safe to call from any layer.\n *\n * @param input - Either a free-text error message (from a thrown exception)\n *   or a partially-decoded `SDKResultError` shape with `errors[]`,\n *   `terminal_reason`, and `subtype`.\n * @returns A category, retryable flag, and human-readable hint.\n * @docLink packages/bridge/api-reference#error-classifier\n */\nexport function classifyClaudeSdkError(input: string | ClaudeSdkResultErrorInput): AgentError {\n  const opts: ClaudeSdkResultErrorInput = typeof input === \"string\" ? { errors: [input] } : input;\n\n  const message = (opts.errors ?? []).join(\"; \") || \"Unknown agent error\";\n\n  // ── 1. Honour authoritative `terminal_reason` ──────────────────────────\n  const byTerminalReason = classifyByTerminalReason(message, opts);\n  if (byTerminalReason) {\n    return byTerminalReason;\n  }\n\n  // ── 2. Inspect embedded JSON body for a structured error.type ──────────\n  const structured = tryParseEmbeddedAnthropicError(message);\n  if (structured) {\n    const byStructured = classifyByStructuredError(message, structured, opts);\n    if (byStructured) {\n      return byStructured;\n    }\n  }\n\n  // ── 3. Heuristic keyword classification on the wrapper text ────────────\n  const lower = message.toLowerCase();\n\n  const byKeyword = classifyByKeyword(message, lower, opts);\n  if (byKeyword) {\n    return byKeyword;\n  }\n\n  // ── 4. SDK result subtypes ─────────────────────────────────────────────\n  const bySubtype = classifyBySubtype(message, opts);\n  if (bySubtype) {\n    return bySubtype;\n  }\n\n  return {\n    message,\n    category: \"unknown\",\n    retryable: true,\n  };\n}\n\n/**\n * Phase 1: classify on the SDK's authoritative `terminal_reason`. Returns\n * `null` when the reason is unset or not one of the recognised values.\n */\nfunction classifyByTerminalReason(\n  message: string,\n  opts: ClaudeSdkResultErrorInput,\n): AgentError | null {\n  if (opts.terminalReason && RATE_LIMIT_TERMINAL_REASONS.has(opts.terminalReason)) {\n    return {\n      message,\n      category: \"rate_limit\",\n      retryable: true,\n      hint: oauthQuotaHint(opts.oauthCredential),\n    };\n  }\n  if (opts.terminalReason === \"prompt_too_long\") {\n    return {\n      message,\n      category: \"model\",\n      retryable: false,\n      hint: \"The conversation is too long for the configured model. Start a new session or compact the existing one.\",\n    };\n  }\n  if (opts.terminalReason && MODEL_TERMINAL_REASONS.has(opts.terminalReason)) {\n    return {\n      message,\n      category: \"model\",\n      retryable: true,\n      hint: \"The model rejected this turn. Try again or switch models.\",\n    };\n  }\n  return null;\n}\n\n/**\n * Phase 2: classify on the structured `error.type` parsed from an embedded\n * Anthropic JSON body. Returns `null` for an unrecognised `errorType`.\n */\nfunction classifyByStructuredError(\n  message: string,\n  structured: { errorType: string; statusCode?: number },\n  opts: ClaudeSdkResultErrorInput,\n): AgentError | null {\n  if (structured.errorType === \"rate_limit_error\") {\n    return {\n      message,\n      category: \"rate_limit\",\n      statusCode: structured.statusCode ?? 429,\n      retryable: true,\n      hint: oauthQuotaHint(opts.oauthCredential),\n    };\n  }\n  if (structured.errorType === \"overloaded_error\") {\n    return {\n      message,\n      category: \"rate_limit\",\n      statusCode: structured.statusCode ?? 529,\n      retryable: true,\n      hint: \"Anthropic is overloaded. Try again in a moment.\",\n    };\n  }\n  if (structured.errorType === \"authentication_error\") {\n    // Anthropic genuinely says it's an auth failure. But for OAuth\n    // credentials with the `oauth-2025-04-20` beta flow, this still\n    // overwhelmingly correlates with quota. Surface both possibilities\n    // in the hint so the user does not first re-upload a perfectly\n    // good credentials file.\n    return {\n      message,\n      category: \"auth\",\n      statusCode: structured.statusCode ?? 401,\n      retryable: false,\n      hint: opts.oauthCredential\n        ? \"Anthropic rejected the OAuth credential. With Claude Code subscriptions this is usually a quota or rate-limit issue rather than an invalid token — wait a few minutes before re-uploading the credentials file. If it persists, re-export `~/.claude/.credentials.json` from a working Claude Code install.\"\n        : \"Anthropic rejected the API key. Check it in Settings -> AI Providers.\",\n    };\n  }\n  if (structured.errorType === \"permission_error\") {\n    return {\n      message,\n      category: \"auth\",\n      statusCode: structured.statusCode ?? 403,\n      retryable: false,\n      hint: \"The configured credential does not have access to the requested model.\",\n    };\n  }\n  if (structured.errorType === \"invalid_request_error\") {\n    return {\n      message,\n      category: \"validation\",\n      statusCode: structured.statusCode ?? 400,\n      retryable: false,\n      hint: \"Anthropic rejected the request shape. This is likely a bug — please report it.\",\n    };\n  }\n  return null;\n}\n\n/**\n * Phase 3: heuristic keyword classification on the lowercased wrapper text.\n * `lower` is the pre-lowercased `message`. Returns `null` when no bucket hits.\n */\nfunction classifyByKeyword(\n  message: string,\n  lower: string,\n  opts: ClaudeSdkResultErrorInput,\n): AgentError | null {\n  if (\n    lower.includes(\"rate limit\") ||\n    lower.includes(\"rate_limit\") ||\n    lower.includes(\"too many requests\") ||\n    lower.includes(\"429\") ||\n    lower.includes(\"quota\") ||\n    lower.includes(\"blocking_limit\") ||\n    lower.includes(\"rapid_refill\")\n  ) {\n    return {\n      message,\n      category: \"rate_limit\",\n      retryable: true,\n      hint: oauthQuotaHint(opts.oauthCredential),\n    };\n  }\n\n  if (\n    lower.includes(\"credit balance\") ||\n    lower.includes(\"insufficient credit\") ||\n    lower.includes(\"out of credits\")\n  ) {\n    return {\n      message,\n      category: \"rate_limit\",\n      retryable: false,\n      hint: \"The configured Anthropic account is out of credits. Top up at https://console.anthropic.com/ or switch providers.\",\n    };\n  }\n\n  if (lower.includes(\"oauth authentication is currently not supported\")) {\n    return {\n      message,\n      category: \"auth\",\n      statusCode: 401,\n      retryable: false,\n      hint: \"The Claude Code CLI did not send the OAuth beta header. The bundled CLI in this image is too old — rebuild the agent image.\",\n    };\n  }\n\n  // The Claude Code CLI emits this terse, JSON-less string when it finds no\n  // usable credential — most commonly because the OAuth access token in\n  // `~/.claude/.credentials.json` expired and the file carries no refresh token\n  // (the platform provisions access-token-only files by design). It MUST be\n  // classified as `auth` so the driver promotes it to `AuthError` and the\n  // `onAuthError` self-heal re-mints the credential. Without this branch the\n  // message falls through to `unknown`, the self-heal never fires, and every\n  // subsequent turn dead-ends on \"please /login\". The check sits ahead of the\n  // generic auth keywords because the string contains none of them.\n  if (lower.includes(\"not logged in\") || lower.includes(\"please run /login\")) {\n    return {\n      message,\n      category: \"auth\",\n      statusCode: 401,\n      retryable: false,\n      hint: opts.oauthCredential\n        ? \"The Claude Code OAuth credential expired and could not be auto-refreshed in-container. The runner will re-mint it — retry the prompt. If it persists, re-export `~/.claude/.credentials.json` from a working Claude Code install.\"\n        : \"No Anthropic credential is configured for this provider. Add one in Settings -> AI Providers.\",\n    };\n  }\n\n  if (\n    lower.includes(\"api key\") ||\n    lower.includes(\"authentication\") ||\n    lower.includes(\"invalid authentication\") ||\n    lower.includes(\"unauthorized\") ||\n    lower.includes(\"401\") ||\n    lower.includes(\"403\")\n  ) {\n    return {\n      message,\n      category: \"auth\",\n      retryable: false,\n      hint: opts.oauthCredential\n        ? \"Anthropic rejected the OAuth credential. With Claude Code subscriptions this is usually a quota or rate-limit issue rather than an invalid token — wait a few minutes before re-uploading the credentials file.\"\n        : \"Check the API key configured for this AI provider in Settings.\",\n    };\n  }\n\n  if (\n    lower.includes(\"model\") &&\n    (lower.includes(\"not found\") ||\n      lower.includes(\"not available\") ||\n      lower.includes(\"does not exist\"))\n  ) {\n    return {\n      message,\n      category: \"model\",\n      retryable: false,\n      hint: \"The selected model is not available for this credential. Change the model in the AI provider config.\",\n    };\n  }\n\n  if (\n    lower.includes(\"context length\") ||\n    lower.includes(\"token limit\") ||\n    lower.includes(\"max_tokens\") ||\n    lower.includes(\"prompt is too long\") ||\n    lower.includes(\"prompt_too_long\")\n  ) {\n    return {\n      message,\n      category: \"model\",\n      retryable: false,\n      hint: \"The conversation is too long for the model. Start a new session or compact this one.\",\n    };\n  }\n\n  if (\n    lower.includes(\"timeout\") ||\n    lower.includes(\"econnrefused\") ||\n    lower.includes(\"enotfound\") ||\n    lower.includes(\"fetch failed\") ||\n    lower.includes(\"network\")\n  ) {\n    return {\n      message,\n      category: \"network\",\n      retryable: true,\n      hint: \"Network error reaching Anthropic. The runner will retry — try again if it persists.\",\n    };\n  }\n\n  return null;\n}\n\n/**\n * Phase 4: classify on the SDK result `subtype` (`error_max_turns` etc).\n * Returns `null` when the subtype is unset or unrecognised.\n */\nfunction classifyBySubtype(message: string, opts: ClaudeSdkResultErrorInput): AgentError | null {\n  if (opts.subtype === \"error_max_turns\") {\n    return {\n      message,\n      category: \"unknown\",\n      retryable: true,\n      hint: \"The agent stopped after reaching `max_turns`. Resume the session or raise `max_turns` in the agent config.\",\n    };\n  }\n  if (opts.subtype === \"error_max_budget_usd\") {\n    return {\n      message,\n      category: \"rate_limit\",\n      retryable: false,\n      hint: \"The agent stopped because it hit the configured per-turn budget. Raise the budget or split the work.\",\n    };\n  }\n  return null;\n}\n\n/**\n * The shared keyword buckets matched by {@link classifyGenericErrorMessage}.\n * Drivers layer a provider-specific `hint` on top of the returned category.\n */\nexport type GenericErrorCategory = \"auth\" | \"rate_limit\" | \"model\" | \"network\";\n\n/**\n * Classify a free-text driver error against the keyword buckets common to the\n * subprocess/SDK drivers (omp, codex). Returns the matched `category` +\n * `retryable` flag, or `null` when no shared bucket matches so the caller can\n * fall through to its own provider-specific buckets (e.g. codex sandbox) and\n * `unknown` default. The driver supplies the user-facing `hint` — only the\n * bucketing logic is shared, not the copy.\n */\nexport function classifyGenericErrorMessage(\n  msg: string,\n): { category: GenericErrorCategory; retryable: boolean } | null {\n  const lower = msg.toLowerCase();\n  if (\n    lower.includes(\"api key\") ||\n    lower.includes(\"unauthorized\") ||\n    lower.includes(\"authentication\") ||\n    lower.includes(\"401\")\n  ) {\n    return { category: \"auth\", retryable: false };\n  }\n  if (\n    lower.includes(\"rate limit\") ||\n    lower.includes(\"429\") ||\n    lower.includes(\"too many requests\") ||\n    lower.includes(\"quota\")\n  ) {\n    return { category: \"rate_limit\", retryable: true };\n  }\n  if (\n    lower.includes(\"model\") &&\n    (lower.includes(\"not found\") ||\n      lower.includes(\"not available\") ||\n      lower.includes(\"does not exist\"))\n  ) {\n    return { category: \"model\", retryable: false };\n  }\n  if (\n    lower.includes(\"context length\") ||\n    lower.includes(\"too long\") ||\n    lower.includes(\"token limit\") ||\n    lower.includes(\"max_tokens\")\n  ) {\n    return { category: \"model\", retryable: false };\n  }\n  if (\n    lower.includes(\"timeout\") ||\n    lower.includes(\"econnrefused\") ||\n    lower.includes(\"enotfound\") ||\n    lower.includes(\"network\") ||\n    lower.includes(\"fetch failed\") ||\n    lower.includes(\"fetch\") ||\n    lower.includes(\"connection\")\n  ) {\n    return { category: \"network\", retryable: true };\n  }\n  return null;\n}\n\n/**\n * Returns the rate-limit hint copy, branched on whether the active\n * credential is a Claude Code OAuth subscription.\n */\nfunction oauthQuotaHint(oauthCredential?: boolean): string {\n  if (oauthCredential) {\n    return \"Quota exhausted on this Claude Code subscription. Wait for the rate-limit window to reset (typically a few minutes for short windows, longer for daily/weekly limits) before retrying. The credential itself is fine.\";\n  }\n  return \"The Anthropic account hit a rate limit. Wait a moment and try again.\";\n}\n\n/**\n * Try to extract a structured Anthropic error body from a free-text wrapper.\n * The bundled `claude-cli.js` typically formats failures as\n * `... API Error: <status> {\"type\":\"error\",\"error\":{\"type\":\"<errorType>\",...}}`\n * with optional trailing garbage after the JSON.\n *\n * Strategy: find the first `{`, then forward-scan tracking brace depth (with\n * string-literal awareness so braces inside quoted values do not throw the\n * count). The substring from `braceStart` to the matching `}` is the JSON\n * candidate; one `JSON.parse` does the rest. O(n) in the input length.\n *\n * Returns `null` when nothing parseable is found.\n */\nfunction tryParseEmbeddedAnthropicError(\n  text: string,\n): { errorType: string; statusCode?: number } | null {\n  const braceStart = text.indexOf(\"{\");\n  if (braceStart < 0) {\n    return null;\n  }\n\n  const braceEnd = findMatchingCloseBrace(text, braceStart);\n  if (braceEnd < 0) {\n    return null;\n  }\n\n  let parsed: { type?: string; error?: { type?: string; message?: string } };\n  try {\n    parsed = JSON.parse(text.slice(braceStart, braceEnd));\n  } catch {\n    return null;\n  }\n  const errorType = parsed?.error?.type;\n  if (typeof errorType !== \"string\") {\n    return null;\n  }\n  const statusMatch = text.match(/API Error:\\s*(\\d{3})/i);\n  const statusCode = statusMatch ? Number(statusMatch[1]) : undefined;\n  return { errorType, statusCode };\n}\n\n/**\n * Forward-scan `text` from `braceStart` (a `{`) with brace counting, returning\n * the index just past the matching close brace, or `-1` if unbalanced.\n * String-literal awareness: skip braces between unescaped double quotes.\n */\nfunction findMatchingCloseBrace(text: string, braceStart: number): number {\n  let depth = 0;\n  let inString = false;\n  let escaped = false;\n  for (let i = braceStart; i < text.length; i++) {\n    const ch = text.charCodeAt(i);\n    if (inString) {\n      if (escaped) {\n        escaped = false;\n      } else if (ch === 92 /* \\ */) {\n        escaped = true;\n      } else if (ch === 34 /* \" */) {\n        inString = false;\n      }\n      continue;\n    }\n    if (ch === 34 /* \" */) {\n      inString = true;\n    } else if (ch === 123 /* { */) {\n      depth++;\n    } else if (ch === 125 /* } */) {\n      depth--;\n      if (depth === 0) {\n        return i + 1;\n      }\n    }\n  }\n  return -1;\n}\n"]}