@skaile/workspaces 0.36.0 → 0.38.0

package/dist/chunk-MCQ4TJ3P.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;AAUA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAIT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,GAAA,IAAO,EAAE,CAAA,EAAG;AAC9D,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,EAAO,EAAE,IAAI,IAAI,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,GAAA,CAAI,IAAA,EAAqC,EAAA,EAAY,IAAA,EAAiC;AACpF,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAAqC,EAAA,EAAqB;AAC9D,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAAqC,EAAA,EAA6C;AACxF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,CAAA;AACrF,MAAA,OAAO,MAAA;AACT,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB;AAAA,EACrB,MAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;ACzaO,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,UAAA,IAAc,MAAA,CAAO,WAAW,MAAA,KAAW,CAAA,SAAU,EAAC;AAClE,EAAA,OAAO,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA;AAC9D;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AAWO,SAAS,WAAA,CACd,MACA,OAAA,EACoB;AACpB,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI,OAAA,EAAS,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AACxC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC3B,IAAA,OAAO,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,IAAA;AACT;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD;AAYO,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACxC,IAAA;AAAA,EACA,WAAA;AAAA,EACT,WAAA,CACE,OAAA,EACA,IAAA,EACA,WAAA,EACA;AACA,IAAA,KAAA,CAAM,oBAAoB,WAAW,CAAA,oBAAA,EAAuB,IAAI,CAAA,QAAA,EAAM,OAAO,CAAA,CAAE,CAAA;AAC/E,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACrB;AACF;AA8BA,eAAsB,4BAAA,CACpB,WAAA,EACA,OAAA,EACA,aAAA,EAC6B;AAC7B,EAAA,OAAA,CAAQ,MAAM,sBAAA,CAAuB,WAAA,EAAa,OAAA,EAAS,aAAA,EAAe,SAAS,CAAA,EAAG,KAAA;AACxF;AA4BA,eAAsB,sBAAA,CACpB,WAAA,EACA,OAAA,EACA,aAAA,EACA,SAA8C,SAAA,EACZ;AAClC,EAAA,IAAI,WAAA,CAAY,SAAS,SAAA,EAAW;AAClC,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,WAAA,EAAc,YAAY,EAAE,CAAA,gHAAA;AAAA,OAE9B;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,EAAE,aAAa,WAAA,CAAY,EAAA,EAAI,QAAQ,CAAA;AAC1E,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,MAAM,IAAI,uBAAA,CAAwB,MAAA,CAAO,SAAS,MAAA,CAAO,IAAA,EAAM,YAAY,EAAE,CAAA;AAAA,IAC/E;AAGA,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,IAAI,uBAAA;AAAA,QACR,kCAAA;AAAA,QACA,eAAA;AAAA,QACA,WAAA,CAAY;AAAA,OACd;AAAA,IACF;AACA,IAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,OAAO,SAAA,EAAU;AAAA,EAC5D;AAEA,EAAA,OAAO,EAAE,OAAO,WAAA,CAAY,WAAA,CAAY,MAAM,OAAO,CAAA,EAAG,WAAW,IAAA,EAAK;AAC1E","file":"chunk-MCQ4TJ3P.js","sourcesContent":["/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>`, `connector:<id>`, and `mcp:<id>`.\n * Returns `undefined` for any other ref so the chain falls through to the\n * next provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capabilities\n * stay strictly in-process — no round trip to the platform to mint while\n * the resource is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors, mcp }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n    mcp?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.mcp ?? {})) {\n      this.mints.set(`mcp:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capability\n   * handlers when the platform delivers new credentials mid-session.\n   */\n  set(kind: \"mount\" | \"connector\" | \"mcp\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\" | \"mcp\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` / `mcp:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\" | \"mcp\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\") || ref.startsWith(\"mcp:\")))\n      return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\n  \"env:\",\n  \"forge:\",\n  \"op:\",\n  \"kp:\",\n  \"oauth:\",\n  \"mount:\",\n  \"connector:\",\n  \"mcp:\",\n] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport type {\n  ConnectorDeclaration,\n  TokenMediator,\n  TokenMediatorResult,\n} from \"./connector-types.js\";\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Array of connector declarations, or an empty array if none are declared.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  if (!config.connectors || config.connectors.length === 0) return [];\n  return config.connectors.map(workspaceConnectorToDeclaration);\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  }\n\n  return decl;\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n/**\n * Resolve a credential reference using a `SecretProvider`, or fall back to `env:NAME` lookup.\n * @param auth - Credential reference (e.g. `\"env:GIT_TOKEN\"`).\n * @param secrets - Optional provider; falls back to `process.env` if omitted.\n * @returns Resolved secret value or `undefined`.\n * @deprecated Use `SecretProviderChain.resolve()` instead.\n * @docLink packages/connectors/api-reference#resolve-auth\n */\n// @TODO: Code-Review: deprecated shim kept for backward compat — remove once all callers migrate to SecretProviderChain.resolve()\nexport function resolveAuth(\n  auth: string | undefined,\n  secrets?: import(\"./secrets.js\").SecretProvider,\n): string | undefined {\n  if (!auth) return undefined;\n  if (secrets) return secrets.resolve(auth);\n  if (auth.startsWith(\"env:\")) {\n    const envVar = auth.slice(4);\n    return process.env[envVar];\n  }\n  return auth;\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n\n// ── rclone mount credential bridge (auth: backend) ───────────────────────────\n\n/**\n * Thrown when the backend credential mediator refuses or cannot deliver a\n * mount credential for an `auth: backend` rclone connector. Carries the\n * wire-format error code so callers can branch on it. Mirrors the git driver's\n * `TokenMediatorError`, but lives here so all three rclone drivers share it.\n *\n * @docLink packages/connectors/api-reference#mount-token-mediator-error\n */\nexport class MountTokenMediatorError extends Error {\n  readonly code: Extract<TokenMediatorResult, { ok: false }>[\"code\"];\n  readonly connectorId: string;\n  constructor(\n    message: string,\n    code: Extract<TokenMediatorResult, { ok: false }>[\"code\"],\n    connectorId: string,\n  ) {\n    super(`Mount connector '${connectorId}': backend mediator ${code} — ${message}`);\n    this.name = \"MountTokenMediatorError\";\n    this.code = code;\n    this.connectorId = connectorId;\n  }\n}\n\n/**\n * Resolve the credential *string* an rclone mount driver feeds into its\n * `parseAuthBlob` / `parseAuth` helper.\n *\n * Two cases, branched on `declaration.auth`:\n *   - `backend`  → the credential is minted by the platform mediator. Calls\n *                  `tokenMediator({connectorId, reason: 'initial'})` and returns\n *                  the result's `token` string verbatim (already a JSON blob for\n *                  sharepoint/googledrive, or a `user:pass`/bearer string for\n *                  webdav). Throws `MountTokenMediatorError` when the mediator\n *                  refuses, or a plain `Error` when no mediator is wired (the\n *                  standalone CLI has none — `env:`/inline auth is the path there).\n *   - anything else (`env:NAME`, inline, undefined) → resolves through the\n *                  legacy `resolveAuth` secrets/env path and NEVER touches the\n *                  mediator.\n *\n * For `auth: backend` the mediator also surfaces the access token's expiry,\n * which the rclone drivers use to arm a proactive refresh tick (the\n * client_secret is stripped from Skaile-managed Entra blobs, so rclone cannot\n * self-refresh) — see {@link resolveMountCredential}.\n *\n * @param declaration - The connector declaration (supplies `auth` + `id`).\n * @param secrets - Secrets chain for the legacy `env:`/inline path.\n * @param tokenMediator - Backend mediator, present only for platform sessions.\n * @returns The credential string, or `undefined` when no auth is declared.\n * @throws {MountTokenMediatorError} when the mediator refuses an `auth: backend` mint.\n * @docLink packages/connectors/api-reference#resolve-mount-credential-string\n */\nexport async function resolveMountCredentialString(\n  declaration: ConnectorDeclaration,\n  secrets: import(\"./secrets.js\").SecretProvider | undefined,\n  tokenMediator: TokenMediator | undefined,\n): Promise<string | undefined> {\n  return (await resolveMountCredential(declaration, secrets, tokenMediator, \"initial\")).token;\n}\n\n/**\n * The credential string an rclone mount driver feeds into `parseAuthBlob` /\n * `parseAuth`, paired with the access token's ISO expiry (`null` for static\n * credentials / the legacy env path).\n */\nexport interface ResolvedMountCredential {\n  /** The credential string, or `undefined` when no auth is declared. */\n  token: string | undefined;\n  /** ISO-8601 expiry of the access token, or `null` if unknown / static. */\n  expiresAt: string | null;\n}\n\n/**\n * Resolve a mount credential together with its expiry. The richer companion of\n * {@link resolveMountCredentialString}: rclone drivers use the returned\n * `expiresAt` to arm a proactive token-refresh tick, and re-call this with\n * `reason: 'refresh'` (or `'retry-401'` on the reactive path) to re-mint.\n *\n * Branches on `declaration.auth` exactly like `resolveMountCredentialString`:\n * `backend` mints through the mediator (and fails closed on refusal / empty\n * token); everything else resolves through the legacy `resolveAuth` secrets\n * path with a `null` expiry and never touches the mediator.\n *\n * @throws {MountTokenMediatorError} when the mediator refuses an `auth: backend` mint.\n * @docLink packages/connectors/api-reference#resolve-mount-credential\n */\nexport async function resolveMountCredential(\n  declaration: ConnectorDeclaration,\n  secrets: import(\"./secrets.js\").SecretProvider | undefined,\n  tokenMediator: TokenMediator | undefined,\n  reason: \"initial\" | \"refresh\" | \"retry-401\" = \"initial\",\n): Promise<ResolvedMountCredential> {\n  if (declaration.auth === \"backend\") {\n    if (!tokenMediator) {\n      throw new Error(\n        `Connector '${declaration.id}' uses 'auth: backend' but no token mediator is wired ` +\n          `(standalone has none — use env:/inline auth instead).`,\n      );\n    }\n    const result = await tokenMediator({ connectorId: declaration.id, reason });\n    if (!result.ok) {\n      throw new MountTokenMediatorError(result.message, result.code, declaration.id);\n    }\n    // Fail closed: an empty backend-minted token is a mediator bug. webdav would\n    // otherwise silently fall back to an anonymous mount instead of erroring.\n    if (!result.token) {\n      throw new MountTokenMediatorError(\n        \"mediator returned an empty token\",\n        \"backend-error\",\n        declaration.id,\n      );\n    }\n    return { token: result.token, expiresAt: result.expiresAt };\n  }\n\n  return { token: resolveAuth(declaration.auth, secrets), expiresAt: null };\n}\n"]}

package/dist/chunk-XT6AZWK3.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../connectors/src/fs-utils.ts","../connectors/src/port-pool.ts","../connectors/src/watcher.ts","../connectors/src/rclone-process-manager.ts"],"names":[],"mappings":";;;;;;;;;;AAkCA,eAAsB,aAAA,CAAc,KAAa,GAAA,EAA6B;AAC5E,EAAA,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,CAAM,KAAK,GAAK,CAAA;AAAA,EACxB,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,EAAK,MAAM,4DAAA,EAAyD;AAAA,MAClE,IAAA,EAAM,GAAA;AAAA,MACN,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AAAA,EACH;AACF;ACjCO,IAAM,QAAA,GAAN,MAAM,SAAA,CAAS;AAAA,EACH,GAAA;AAAA,EACA,GAAA;AAAA,EACA,KAAA,uBAAY,GAAA,EAAY;AAAA,EAEzC,YAAY,KAAA,EAAyB;AACnC,IAAA,IAAA,CAAK,GAAA,GAAM,MAAM,CAAC,CAAA;AAClB,IAAA,IAAA,CAAK,GAAA,GAAM,MAAM,CAAC,CAAA;AAAA,EACpB;AAAA;AAAA,EAGA,MAAM,QAAA,GAA4B;AAChC,IAAA,KAAA,IAAS,OAAO,IAAA,CAAK,GAAA,EAAK,IAAA,IAAQ,IAAA,CAAK,KAAK,IAAA,EAAA,EAAQ;AAClD,MAAA,IAAI,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA,EAAG;AAC1B,MAAA,IAAI,CAAE,MAAM,SAAA,CAAS,UAAA,CAAW,IAAI,CAAA,EAAI;AACtC,QAAA,IAAA,CAAK,KAAA,CAAM,IAAI,IAAI,CAAA;AACnB,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CAAK,KAAA,CAAM,IAAI,IAAI,CAAA;AACnB,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,sBAAA,EAAyB,IAAA,CAAK,GAAG,CAAA,CAAA,EAAI,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,QAAQ,IAAA,EAAoB;AAC1B,IAAA,IAAA,CAAK,KAAA,CAAM,IAAI,IAAI,CAAA;AAAA,EACrB;AAAA;AAAA,EAGA,QAAQ,IAAA,EAAoB;AAC1B,IAAA,IAAA,CAAK,KAAA,CAAM,OAAO,IAAI,CAAA;AAAA,EACxB;AAAA;AAAA,EAGA,QAAQ,IAAA,EAAuB;AAC7B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAAA,EAC5B;AAAA;AAAA,EAGA,OAAO,UAAA,CAAW,IAAA,EAAc,IAAA,GAAO,WAAA,EAA+B;AACpE,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,MAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,EAAE,IAAA,EAAM,MAAM,CAAA;AAC9C,MAAA,MAAA,CAAO,IAAA,CAAK,WAAW,MAAM;AAC3B,QAAA,MAAA,CAAO,OAAA,EAAQ;AACf,QAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,MACf,CAAC,CAAA;AACD,MAAA,MAAA,CAAO,IAAA,CAAK,SAAS,MAAM;AACzB,QAAA,MAAA,CAAO,OAAA,EAAQ;AACf,QAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,MACd,CAAC,CAAA;AACD,MAAA,MAAA,CAAO,UAAA,CAAW,KAAK,MAAM;AAC3B,QAAA,MAAA,CAAO,OAAA,EAAQ;AACf,QAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,MACd,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AACF;ACxCA,SAAS,cAAc,OAAA,EAA4C;AAGjE,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,KAAA,CAAM,yBAAyB,CAAA;AAC5D,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAM,IAAA,GAAO,aAAa,CAAC,CAAA;AAC3B,IAAA,OAAO,CAAC,CAAA,KAAc,CAAA,CAAE,QAAA,CAAS,IAAI,IAAI,CAAA,CAAA,CAAG,CAAA,IAAK,CAAA,CAAE,QAAA,CAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,KAAK,CAAA,KAAM,IAAA;AAAA,EACnF;AAGA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,KAAA,CAAM,+BAA+B,CAAA;AAChE,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,IAAA,GAAO,WAAW,CAAC,CAAA;AACzB,IAAA,OAAO,CAAC,CAAA,KAAc,CAAA,CAAE,QAAA,CAAS,IAAI,IAAI,CAAA,CAAA,CAAG,CAAA,IAAK,CAAA,CAAE,QAAA,CAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,KAAK,CAAA,KAAM,IAAA;AAAA,EACnF;AAGA,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAA,CAAM,2BAA2B,CAAA;AAC1D,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,MAAA,GAAS,SAAS,CAAC,CAAA;AACzB,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAEzB,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,MAAA,OAAO,CAAC,CAAA,KAAc,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA;AAAA,IACvC;AACA,IAAA,OAAO,CAAC,CAAA,KAAc,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA;AAAA,EACzC;AAGA,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,KAAA,CAAM,gBAAgB,CAAA;AAClD,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,GAAA,GAAM,YAAY,CAAC,CAAA;AACzB,IAAA,OAAO,CAAC,CAAA,KAAc,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA;AAAA,EACtC;AAGA,EAAA,MAAM,OAAA,GAAU,QACb,OAAA,CAAQ,mBAAA,EAAqB,MAAM,CAAA,CACnC,OAAA,CAAQ,SAAS,cAAc,CAAA,CAC/B,QAAQ,KAAA,EAAO,OAAO,EACtB,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CACrB,OAAA,CAAQ,qBAAqB,IAAI,CAAA;AACpC,EAAA,MAAM,EAAA,GAAK,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACpC,EAAA,OAAO,CAAC,CAAA,KAAc,EAAA,CAAG,IAAA,CAAK,CAAC,CAAA;AACjC;AAEA,IAAM,eAAA,GAA+D;AAAA,EACnE,CAAC,MAAc,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,IAAK,CAAA,CAAE,SAAS,OAAO,CAAA;AAAA,EACzD,CAAC,MAAc,CAAA,CAAE,QAAA,CAAS,gBAAgB,CAAA,IAAK,CAAA,CAAE,SAAS,eAAe,CAAA;AAAA,EACzE,CAAC,MAAc,CAAA,CAAE,QAAA,CAAS,eAAe,CAAA,IAAK,CAAA,CAAE,SAAS,cAAc,CAAA;AAAA;AAAA;AAAA,EAGvE,CAAC,CAAA,KAAc,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA;AAAA;AAAA,EAEjC,CAAC,CAAA,KAAc,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA;AAAA,EAChC,CAAC,CAAA,KAAc,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA;AAAA,EAChC,CAAC,CAAA,KAAc,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,EAC/B,CAAC,CAAA,KAAc,CAAA,CAAE,QAAA,CAAS,GAAG;AAC/B,CAAA;AAMO,IAAM,mBAAA,GAAsB,GAAA;AAOnC,SAAS,eAAe,OAAA,EAAmD;AACzE,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAChD,EAAA,IAAI,CAAC,UAAA,CAAW,aAAa,CAAA,SAAU,EAAC;AAExC,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,YAAA,CAAa,aAAA,EAAe,OAAO,CAAA;AACnD,IAAA,MAAM,WAA6C,EAAC;AAEpD,IAAA,KAAA,MAAW,GAAA,IAAO,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA,EAAG;AACrC,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,EAAK;AACtB,MAAA,IAAI,CAAC,QAAQ,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AAE3D,MAAA,IAAI,OAAA,GAAU,IAAA;AAGd,MAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,QAAA,OAAA,GAAU,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,MAC3B,CAAA,MAAA,IAAW,CAAC,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AAEjC,QAAA,OAAA,GAAU,MAAM,OAAO,CAAA,CAAA;AAAA,MACzB;AAGA,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACzB,QAAA,QAAA,CAAS,IAAA,CAAK,aAAA,CAAc,CAAA,EAAG,OAAO,IAAI,CAAC,CAAA;AAAA,MAC7C,CAAA,MAAO;AACL,QAAA,QAAA,CAAS,IAAA,CAAK,aAAA,CAAc,OAAO,CAAC,CAAA;AAEpC,QAAA,IAAI,CAAC,QAAQ,QAAA,CAAS,GAAG,KAAK,CAAC,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACpD,UAAA,QAAA,CAAS,IAAA,CAAK,aAAA,CAAc,CAAA,EAAG,OAAO,KAAK,CAAC,CAAA;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAIA,IAAM,kBAAA,GAAqD;AAAA,EACzD,GAAA,EAAK,QAAA;AAAA,EACL,MAAA,EAAQ,MAAA;AAAA,EACR,MAAA,EAAQ,QAAA;AAAA,EACR,MAAA,EAAQ,QAAA;AAAA,EACR,SAAA,EAAW;AACb,CAAA;AAWA,eAAsB,eAAA,CACpB,OAAA,EACA,QAAA,EACA,OAAA,EACsB;AACtB,EAAA,MAAM,GAAA,GAAM,aAAa,EAAE,IAAA,EAAM,aAAa,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,CAAA;AACrF,EAAA,MAAM,iBAAA,GAAoB,eAAe,OAAO,CAAA;AAGhD,EAAA,MAAM,cAAA,GAAA,CAAkB,OAAA,EAAS,OAAA,IAAW,EAAC,EAAG,GAAA;AAAA,IAAI,CAAC,KAAA,KACnD,OAAO,UAAU,QAAA,GAAW,aAAA,CAAc,KAAK,CAAA,GAAI;AAAA,GACrD;AACA,EAAA,MAAM,UAAU,CAAC,GAAG,iBAAiB,GAAG,iBAAA,EAAmB,GAAG,cAAc,CAAA;AAC5E,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,mBAAA;AAE1C,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,OAAA,EAAS;AAAA,IACtC,aAAA,EAAe,IAAA;AAAA,IACf,OAAA;AAAA,IACA,gBAAA,EAAkB,EAAE,kBAAA,EAAoB,UAAA,EAAY,cAAc,EAAA,EAAG;AAAA,IACrE,UAAA,EAAY;AAAA,GACb,CAAA;AAKD,EAAA,OAAA,CAAQ,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AAC3B,IAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,IAAA,GAAA,CAAI,IAAA,CAAK,2BAAA,EAA6B,EAAE,OAAA,EAAS,CAAA;AAAA,EACnD,CAAC,CAAA;AAED,EAAA,KAAA,MAAW,CAAC,aAAA,EAAe,MAAM,KAAK,MAAA,CAAO,OAAA,CAAQ,kBAAkB,CAAA,EAAG;AACxE,IAAC,OAAA,CAAwE,EAAA;AAAA,MACvE,aAAA;AAAA,MACA,CAAC,QAAA,KAAqB;AACpB,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,OAAA,EAAS,QAAQ,CAAA;AACtC,QAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AAElC,QAAA,MAAM,iBAAiB,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,CAAE,KAAK,GAAG,CAAA;AAC/C,QAAA,QAAA,CAAS,EAAE,IAAA,EAAM,cAAA,EAAgB,MAAA,EAAQ,MAAA,EAAQ,cAAc,CAAA;AAAA,MACjE;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAM,OAAA,CAAQ,KAAA;AAAM,GAC7B;AACF;;;AC/KA,IAAM,kBAAkB,IAAI,QAAA,CAAS,CAAC,IAAA,EAAO,IAAK,CAAC,CAAA;AAG5C,IAAM,sBAAA,GAAyB;AAG/B,IAAM,8BAAA,GAAiC;AAQ9C,IAAM,sBAAA,GAAyB,IAAA;AAC/B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,iBAAA,GAAoB,mBAAA;AA8G1B,IAAM,OAAA,uBAAc,GAAA,EAA2B;AAQxC,IAAM,uBAAN,MAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhC,MAAM,MAAM,MAAA,EAAkD;AAC5D,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,UAAU,CAAA,EAAG;AACvC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,MAAA,CAAO,UAAU,CAAA,CAAE,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,QAAQ,CAAA,EAAG;AACrC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,MAAA,CAAO,QAAQ,CAAA,CAAE,CAAA;AAAA,IACjE;AAKA,IAAA,MAAM,aAAA,CAAc,MAAA,CAAO,UAAA,EAAY,MAAA,CAAO,GAAG,CAAA;AACjD,IAAA,MAAM,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,GAAG,CAAA;AAE/C,IAAA,MAAM,aAAa,IAAA,CAAK,IAAA;AAAA,MACtB,MAAA,EAAO;AAAA,MACP,CAAA,OAAA,EAAU,OAAO,OAAO,CAAA,CAAA,EAAI,YAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,KAAA;AAAA,KAC5D;AACA,IAAA,MAAM,UAAU,UAAA,EAAY,MAAA,CAAO,cAAc,EAAE,IAAA,EAAM,KAAO,CAAA;AAEhE,IAAA,MAAM,IAAA,GAAO,MAAM,eAAA,CAAgB,QAAA,EAAS;AAC5C,IAAA,MAAM,MAAA,GAAS,aAAa,IAAI,CAAA,CAAA;AAChC,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,CAAI,KAAA,CAAM,EAAE,SAAS,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,OAAA,CAAA,EAAW,CAAA;AAE7E,IAAA,MAAA,CAAO,GAAA,CAAI,KAAK,uBAAA,EAAyB;AAAA,MACvC,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,cAAc,MAAA,CAAO;AAAA,KACtB,CAAA;AAED,IAAA,MAAM,OAAO,gBAAA,CAAiB,MAAA,EAAQ,EAAE,UAAA,EAAY,QAAQ,CAAA;AAE5D,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,QAAA,EAAU,IAAA,EAAM,EAAE,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA,EAAG,CAAA;AAKxE,IAAA,MAAM,QAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,OAAO,oBAAA,IAAwB,8BAAA;AAAA,MAC/C,cAAA,sBAAoB,GAAA,EAAY;AAAA,MAChC,aAAA,EAAe,CAAC,MAAA,EAAQ,KAAA,KAAU;AAChC,QAAA,SAAA,CAAU,KAAA;AAAA,UACR,sFAAA;AAAA,UACA,MAAA;AAAA,UACA,EAAE,MAAA,EAAQ,KAAA,EAAO,KAAA,EAAO,aAAA,EAAe,OAAO,OAAA;AAAQ,SACxD;AACA,QAAA,MAAA,CAAO,aAAA,GAAgB,QAAQ,KAAK,CAAA;AAAA,MACtC,CAAA;AAAA,MACA,aAAa,MAAA,CAAO;AAAA,KACtB;AAEA,IAAA,MAAM,eAAyB,EAAC;AAChC,IAAA,MAAM,UAAA,GAAa,CAAC,IAAA,KAAiB;AACnC,MAAA,YAAA,CAAa,KAAK,IAAI,CAAA;AACtB,MAAA,IAAI,YAAA,CAAa,MAAA,GAAS,EAAA,EAAI,YAAA,CAAa,KAAA,EAAM;AAAA,IACnD,CAAA;AAEA,IAAA,MAAM,aAAA,GAAgB,CAAC,IAAA,KAAiB;AACtC,MAAA,mBAAA,CAAoB,IAAA,EAAM,WAAW,QAAQ,CAAA;AAAA,IAC/C,CAAA;AACA,IAAA,MAAM,aAAA,GAAgB,CAAC,IAAA,KAAiB;AACtC,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,mBAAA,CAAoB,IAAA,EAAM,WAAW,QAAQ,CAAA;AAAA,IAC/C,CAAA;AAEA,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,kBAAA,CAAmB,IAAA,CAAK,QAAQ,aAAa,CAAA;AAC9D,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,kBAAA,CAAmB,IAAA,CAAK,QAAQ,aAAa,CAAA;AAE9D,IAAA,IAAI,aAAA,GAA+B,IAAA;AACnC,IAAA,IAAI,eAAA,GAAyC,IAAA;AAC7C,IAAA,MAAM,SAAA,GAAY,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AAC/C,MAAA,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,CAAC,IAAA,EAAM,MAAA,KAAW;AAClC,QAAA,aAAA,GAAgB,IAAA;AAChB,QAAA,eAAA,GAAkB,MAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,OAAA;AAAA,MACjB,YAAY;AACV,QAAA,IAAI,aAAA,KAAkB,IAAA,IAAQ,eAAA,KAAoB,IAAA,EAAM,OAAO,KAAA;AAC/D,QAAA,OAAO,MAAM,YAAA,CAAa,MAAA,CAAO,UAAU,CAAA;AAAA,MAC7C,CAAA;AAAA,MACA,EAAE,SAAA,EAAW,IAAA,EAAQ,UAAA,EAAY,GAAA;AAAI,KACvC;AAEA,IAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,UAAA,EAAY,SAAA,CAAU,IAAA,CAAK,MAAM,KAAK,CAAC,CAAC,CAAA;AAE1E,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,IAAI;AACF,QAAA,IAAI,IAAA,CAAK,QAAA,KAAa,IAAA,IAAQ,IAAA,CAAK,eAAe,IAAA,EAAM;AACtD,UAAA,IAAA,CAAK,KAAK,SAAS,CAAA;AAAA,QACrB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,MAAM,MAAA,CAAO,UAAU,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACvC,MAAA,eAAA,CAAgB,QAAQ,IAAI,CAAA;AAC5B,MAAA,MAAM,IAAA,GACJ,YAAA,CAAa,MAAA,GAAS,CAAA,GAAI;AAAA;AAAA,EAAmB,aAAa,KAAA,CAAM,EAAE,EAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AACrF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,MAAA,CAAO,MAAM,OAAO,MAAA,CAAO,UAAU,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AAAA,IAC1F;AAEA,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AACjB,IAAA,IAAI,QAAQ,MAAA,EAAW;AAErB,MAAA,IAAA,CAAK,KAAK,SAAS,CAAA;AACnB,MAAA,MAAM,MAAA,CAAO,UAAU,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACvC,MAAA,eAAA,CAAgB,QAAQ,IAAI,CAAA;AAC5B,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACpE;AAEA,IAAA,MAAM,KAAA,GAAuB;AAAA,MAC3B,IAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAA;AAAA,MACA,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,WAAA,EAAa,MAAA;AAAA,MACb,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,KAAK,CAAA;AAEtB,IAAA,IAAA,CAAK,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,KAAS;AAExB,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,EAAG;AACpB,QAAA,MAAA,CAAO,IAAI,IAAA,CAAK,4BAAA,EAA8B,EAAE,IAAA,EAAM,KAAK,CAAA;AAAA,MAC7D;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,6BAAA,EAA+B,EAAE,KAAK,CAAA;AAEtD,IAAA,OAAO,EAAE,KAAK,UAAA,EAAY,MAAA,CAAO,YAAY,QAAA,EAAU,MAAA,CAAO,UAAU,MAAA,EAAO;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,IAAA,CAAK,MAAA,EAAsB,IAAA,EAA4C;AAC3E,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,IAAW,GAAA;AACjC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA;AACpC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA;AAAA,IACF;AAEA,IAAA,IAAI;AAGF,MAAA,MAAM,KAAK,KAAA,CAAM,MAAA,EAAQ,EAAE,kBAAA,EAAoB,SAAS,CAAA;AAAA,IAC1D,SAAS,GAAA,EAAK;AACZ,MAAA,KAAA,CAAM,GAAA,CAAI,KAAK,iCAAA,EAAmC;AAAA,QAChD,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,OACvD,CAAA;AAAA,IACH;AAEA,IAAA,KAAA,CAAM,IAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA;AAG3D,IAAA,OAAA,CAAQ,MAAA,CAAO,OAAO,GAAG,CAAA;AAEzB,IAAA,IAAI;AACF,MAAA,KAAA,CAAM,IAAA,CAAK,KAAK,SAAS,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,YAAY,CAAE,MAAM,YAAA,CAAa,KAAA,CAAM,UAAU,CAAA,EAAI;AAAA,MACnF,SAAA,EAAW,OAAA;AAAA,MACX,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,IAAI;AACF,QAAA,KAAA,CAAM,IAAA,CAAK,KAAK,SAAS,CAAA;AAAA,MAC3B,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACnC,QAAA,MAAM,IAAA,GAAO,KAAA,CAAM,aAAA,EAAe,CAAC,IAAA,EAAM,KAAA,CAAM,UAAU,CAAA,EAAG,EAAE,KAAA,EAAO,QAAA,EAAU,CAAA;AAC/E,QAAA,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,MAAM,OAAA,EAAS,CAAA;AACjC,QAAA,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,MAAM,OAAA,EAAS,CAAA;AAAA,MACpC,CAAC,CAAA;AACD,MAAA,KAAA,CAAM,IAAI,IAAA,CAAK,oBAAA,EAAsB,EAAE,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA;AAAA,IAC1D;AAEA,IAAA,eAAA,CAAgB,OAAA,CAAQ,MAAM,IAAI,CAAA;AAClC,IAAA,MAAM,MAAA,CAAO,KAAA,CAAM,UAAU,CAAA,CAAE,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,WAAA,CAAY,MAAA,EAAsB,YAAA,EAA6C;AACnF,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA;AACpC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,MAAA,CAAO,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,IAC/D;AACA,IAAA,MAAM,UAAA,GAAgC,EAAE,GAAG,KAAA,CAAM,aAAa,YAAA,EAAa;AAC3E,IAAA,KAAA,CAAM,GAAA,CAAI,KAAK,2EAAA,EAAwE;AAAA,MACrF,KAAK,MAAA,CAAO;AAAA,KACb,CAAA;AACD,IAAA,MAAM,KAAK,IAAA,CAAK,MAAA,EAAQ,EAAE,OAAA,EAAS,KAAQ,CAAA;AAC3C,IAAA,OAAO,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,KAAA,CACJ,MAAA,EACA,IAAA,EACe;AACf,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA;AACpC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,MAAA,CAAO,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,IAC/D;AAEA,IAAA,IAAI,IAAA,EAAM,cAAc,KAAA,EAAO;AAC7B,MAAA,MAAM,WAAA,GAAc,MAAM,oBAAA,IAAwB,sBAAA;AAClD,MAAA,MAAM,SAAA,GAAY,MAAM,kBAAA,IAAsB,oBAAA;AAG9C,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,KAAA,CAAM,QAAQ,CAAA;AAClD,MAAA,MAAM,SAAA,GAAY,MAAM,cAAA,CAAe,OAAA,EAAS;AAAA,QAC9C,WAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,KAAA,CAAM,GAAA,CAAI,KAAK,sEAAA,EAAmE;AAAA,UAChF,KAAK,MAAA,CAAO,GAAA;AAAA,UACZ,WAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,MAAM,aAAa,MAAM,KAAA,CAAM,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,2BAAA,CAAA,EAA+B;AAAA,MACnF,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,MAAA,MAAM,OAAO,MAAM,UAAA,CAAW,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACnD,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,WAAW,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,KAAK,MAAM,OAAA;AAAA,MACf,YAAY;AACV,QAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,KAAA,EAAO,CAAA;AAC5E,QAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,OAAO,KAAA;AAClB,QAAA,MAAM,IAAA,GAAQ,MAAM,CAAA,CAAE,IAAA,EAAK;AAC3B,QAAA,OAAO,KAAK,KAAA,KAAU,CAAA;AAAA,MACxB,CAAA;AAAA,MACA,EAAE,SAAA,EAAW,GAAA,EAAQ,UAAA,EAAY,GAAA;AAAI,KACvC;AACA,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,MAAA,CAAO,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,IAC7E;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAO,MAAA,EAAuE;AAClF,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA;AACpC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,CAAA,EAAE;AAAA,IACvC;AACA,IAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,CAAK,aAAa,IAAA,IAAQ,KAAA,CAAM,KAAK,UAAA,KAAe,IAAA;AACxE,IAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AAC/C,IAAA,OAAO,EAAE,OAAO,UAAA,EAAW;AAAA,EAC7B;AACF;AA6BA,IAAM,cAAA,GAAiB,gCAAA;AAEvB,IAAM,YAAA,GAAe,mBAAA;AAUrB,IAAM,YAAA,GACJ,gFAAA;AASK,SAAS,mBAAA,CAAoB,IAAA,EAAc,GAAA,EAAa,GAAA,EAAmC;AAChG,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAE1B,EAAA,IAAI,MAAA,GAAgC,IAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACpC,IAAA,IAAI,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU,MAAA,GAAS,SAAA;AAAA,EAC3D,CAAA,CAAA,MAAQ;AACN,IAAA,MAAA,GAAS,IAAA;AAAA,EACX;AAEA,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,mBAAA,CAAoB,OAAA,EAAS,QAAW,GAAG,CAAA;AAC3C,MAAA,IAAI,YAAA,CAAa,IAAA,CAAK,OAAO,CAAA,MAAO,WAAA,IAAc;AAAA,IACpD;AACA,IAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAChB,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAA,CAAS,MAAA,CAAO,KAAA,IAAS,MAAA,EAAQ,WAAA,EAAY;AACnD,EAAA,MAAM,GAAA,GAAM,OAAO,GAAA,IAAO,EAAA;AAC1B,EAAA,MAAM,OAAgC,EAAC;AACvC,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACtD,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AAEtD,EAAA,IAAI,GAAA,EAAK;AACP,IAAA,mBAAA,CAAoB,GAAA,EAAK,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAA;AAC3C,IAAA,MAAM,UAAU,OAAO,MAAA,CAAO,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,EAAA;AAClE,IAAA,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAA,IAAM,OAAA,IAAW,aAAa,IAAA,CAAK,OAAO,CAAA,EAAI,GAAA,CAAI,WAAA,IAAc;AAAA,EAC3F;AAEA,EAAA,QAAQ,KAAA;AAAO,IACb,KAAK,OAAA;AACH,MAAA,GAAA,CAAI,KAAA,CAAM,KAAK,IAAI,CAAA;AACnB,MAAA;AAAA,IACF,KAAK,MAAA;AAAA,IACL,KAAK,QAAA;AACH,MAAA,GAAA,CAAI,IAAA,CAAK,KAAK,IAAI,CAAA;AAClB,MAAA;AAAA,IACF,KAAK,SAAA;AACH,MAAA,GAAA,CAAI,IAAA,CAAK,KAAK,IAAI,CAAA;AAClB,MAAA;AAAA,IACF,KAAK,OAAA;AAAA,IACL,KAAK,UAAA;AAAA,IACL,KAAK,WAAA;AAAA,IACL,KAAK,OAAA;AACH,MAAA,GAAA,CAAI,KAAA,CAAM,GAAA,EAAK,MAAA,CAAO,KAAA,EAAO,IAAI,CAAA;AACjC,MAAA;AAAA,IACF;AACE,MAAA,GAAA,CAAI,IAAA,CAAK,KAAK,IAAI,CAAA;AAClB,MAAA;AAAA;AAEN;AASA,SAAS,mBAAA,CACP,GAAA,EACA,MAAA,EACA,GAAA,EACM;AACN,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,IAAA,CAAK,GAAG,CAAA;AACzC,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,SAAA,CAAU,CAAC,CAAC,CAAA;AACjC,IAAA,MAAM,GAAA,GAAM,MAAA,IAAU,oBAAA,CAAqB,GAAG,CAAA,IAAK,WAAA;AACnD,IAAA,MAAM,SAAA,GAAY,IAAI,cAAA,IAAkB,8BAAA;AACxC,IAAA,IAAI,CAAC,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,cAAA,uBAAqB,GAAA,EAAY;AAC9D,IAAA,MAAM,UAAU,GAAA,CAAI,cAAA;AACpB,IAAA,IAAI,SAAS,SAAA,IAAa,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,EAAG;AAC3C,MAAA,OAAA,CAAQ,IAAI,GAAG,CAAA;AACf,MAAA,GAAA,CAAI,aAAA,GAAgB,KAAK,KAAK,CAAA;AAAA,IAChC;AACA,IAAA;AAAA,EACF;AACA,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAA,EAAG;AAC1B,IAAA,MAAM,GAAA,GAAM,MAAA,IAAU,oBAAA,CAAqB,GAAG,CAAA;AAC9C,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,cAAA,EAAgB,MAAA,CAAO,GAAG,CAAA;AAAA,EACzC;AACF;AAGA,SAAS,qBAAqB,GAAA,EAAiC;AAC7D,EAAA,MAAM,CAAA,GAAI,6BAAA,CAA8B,IAAA,CAAK,GAAG,CAAA;AAChD,EAAA,OAAO,IAAI,CAAC,CAAA;AACd;AASO,SAAS,gBAAA,CACd,QACA,EAAA,EACU;AACV,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,OAAA;AAAA,IACA,MAAA,CAAO,MAAA;AAAA,IACP,MAAA,CAAO,UAAA;AAAA,IACP,UAAA;AAAA,IACA,EAAA,CAAG,UAAA;AAAA,IACH,aAAA;AAAA,IACA,MAAA,CAAO,QAAA;AAAA,IACP,kBAAA;AAAA,IACA,MAAA,CAAO,YAAA;AAAA,IACP,sBAAA;AAAA,IACA,OAAO,YAAA,IAAgB,IAAA;AAAA,IACvB,qBAAA;AAAA,IACA,OAAO,WAAA,IAAe,MAAA;AAAA,IACtB,kBAAA;AAAA,IACA,OAAO,YAAA,IAAgB,sBAAA;AAAA,IACvB,2BAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA;AAAA,IACA,EAAA,CAAG,MAAA;AAAA,IACH,aAAA;AAAA,IACA,MAAA;AAAA,IACA,gBAAA;AAAA,IACA;AAAA,GACF;AAKA,EAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,IAAA,IAAA,CAAK,IAAA,CAAK,iBAAiB,mBAAmB,CAAA;AAAA,EAChD;AAEA,EAAA,OAAO,IAAA;AACT;AAOA,eAAsB,cAAA,CACpB,KACA,IAAA,EACkB;AAClB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA;AACnC,EAAA,WAAS;AACP,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,KAAW,QAAQ,IAAA,CAAK,GAAA,KAAQ,MAAA,IAAU,IAAA,CAAK,aAAa,OAAO,IAAA;AACvE,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,QAAA,EAAU,OAAO,KAAA;AACnC,IAAA,MAAM,KAAA,CAAM,KAAK,MAAM,CAAA;AAAA,EACzB;AACF;AAQA,eAAe,cAAc,QAAA,EAAmC;AAC9D,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AACrC,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,GAAG,CAAA,EAAG,WAAA,KAAgB,GAAA,GAAM,QAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AACF;AAOA,eAAe,cAAc,GAAA,EAAqC;AAChE,EAAA,IAAI,MAAA,GAAwB,IAAA;AAC5B,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,MAAM,OAAA,CAAQ,KAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAC1D,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA,CAAK,KAAK,MAAA,CAAO,CAAA,CAAE,IAAI,CAAC,CAAA;AAC1C,MAAA,IAAI,CAAA,CAAE,aAAY,EAAG;AACnB,QAAA,MAAM,GAAA,GAAM,MAAM,aAAA,CAAc,IAAI,CAAA;AACpC,QAAA,IAAI,QAAQ,IAAA,KAAS,MAAA,KAAW,IAAA,IAAQ,GAAA,GAAM,SAAS,MAAA,GAAS,GAAA;AAAA,MAClE,CAAA,MAAA,IAAW,CAAA,CAAE,MAAA,EAAO,EAAG;AACrB,QAAA,IAAI;AACF,UAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,IAAI,CAAA;AACzB,UAAA,IAAI,WAAW,IAAA,IAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,WAAiB,CAAA,CAAE,OAAA;AAAA,QACxD,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA;AACT;AAGA,eAAe,aAAa,UAAA,EAAsC;AAChE,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,UAAU,CAAA;AACxC,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,mBAAA,EAAqB,MAAM,CAAA;AACvD,IAAA,KAAA,MAAW,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG;AAClC,MAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACtB,MAAA,MAAM,MAAA,GAAS,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC9B,MAAA,MAAM,EAAA,GAAK,OAAO,CAAC,CAAA;AACnB,MAAA,IAAI,CAAC,EAAA,EAAI;AAET,MAAA,MAAM,OAAA,GAAU,EAAA,CAAG,OAAA,CAAQ,QAAA,EAAU,GAAG,CAAA;AACxC,MAAA,IAAI,OAAA,KAAY,UAAU,OAAO,IAAA;AAAA,IACnC;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAMA,eAAe,OAAA,CACb,OACA,IAAA,EACkB;AAClB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA;AACnC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,MAAM,KAAA,EAAM,EAAG,OAAO,IAAA;AAC1B,IAAA,MAAM,KAAA,CAAM,KAAK,UAAU,CAAA;AAAA,EAC7B;AACA,EAAA,OAAO,MAAM,KAAA,EAAM;AACrB;AAEA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,UAAA,CAAW,SAAS,EAAE,CAAA;AAAA,EACxB,CAAC,CAAA;AACH;AAGA,SAAS,kBAAA,CAAmB,QAAkB,MAAA,EAAsC;AAClF,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,MAAA,CAAO,YAAY,MAAM,CAAA;AACzB,EAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACnC,IAAA,MAAA,IAAU,KAAA;AACV,IAAA,IAAI,GAAA,GAAM,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,OAAO,OAAO,CAAA,EAAG;AACf,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAChC,MAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC7B,MAAA,IAAI,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,IAAI,CAAA;AAChC,MAAA,GAAA,GAAM,MAAA,CAAO,QAAQ,IAAI,CAAA;AAAA,IAC3B;AAAA,EACF,CAAC,CAAA;AACD,EAAA,MAAA,CAAO,EAAA,CAAG,OAAO,MAAM;AACrB,IAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,MAAA,MAAA,CAAO,MAAM,CAAA;AACb,MAAA,MAAA,GAAS,EAAA;AAAA,IACX;AAAA,EACF,CAAC,CAAA;AACH;AAGA,eAAe,QAAQ,GAAA,EAA8B;AACnD,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,MAAM,OAAA,CAAQ,KAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAC1D,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA,CAAK,KAAK,MAAA,CAAO,CAAA,CAAE,IAAI,CAAC,CAAA;AAC1C,MAAA,IAAI,CAAA,CAAE,aAAY,EAAG;AACnB,QAAA,KAAA,IAAS,MAAM,QAAQ,IAAI,CAAA;AAAA,MAC7B,CAAA,MAAA,IAAW,CAAA,CAAE,MAAA,EAAO,EAAG;AACrB,QAAA,IAAI;AACF,UAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,IAAI,CAAA;AACzB,UAAA,KAAA,IAAS,CAAA,CAAE,IAAA;AAAA,QACb,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT","file":"chunk-XT6AZWK3.js","sourcesContent":["/**\n * Shared filesystem helpers for connector infrastructure.\n *\n * @docLink packages/connectors/api-reference#fs-utils\n */\n\nimport { chmod, mkdir } from \"node:fs/promises\";\nimport type { Logger } from \"@skaile/workspaces/types\";\n\n/**\n * mkdir(recursive) + chmod 0o770 in one call. The post-mkdir `chmod` is the\n * load-bearing piece: `mkdir(mode:)` is ANDed with the process umask\n * (typically 022 → effective mode 0o750), which strips the group-write bit\n * that `fusermount3` requires on the rclone mountpoint and rclone needs on\n * its vfs cache directory. Explicit `chmod` is umask-immune.\n *\n * EPERM on `chmod` is swallowed: when a foreign uid pre-created the\n * directory (a stray uid-1000 process inside the container or a host-side\n * platform process writing through the project bind-mount), the runner\n * cannot chmod it. The platform's agent container entrypoint runs as root\n * and heals the subtree on the next restart — see\n * `platform/docker/agent/entrypoint.sh` `_skaile_heal_ownership`. A debug\n * line is emitted when a logger is supplied so the rare-but-real heal\n * trigger is observable in session logs without adding noise on the happy\n * path.\n *\n * The chmod is *idempotent* (the syscall always fires, but a no-op when\n * the mode is already 0o770), not a no-op — kernel behaviour for chmod is\n * \"set\", not \"set-if-different\".\n *\n * @param dir Absolute or relative path to ensure exists at mode 0o770.\n * @param log Optional logger. When provided, EPERM-on-chmod emits a\n *   `debug`-level entry under whatever taxonomy the caller's logger uses.\n */\nexport async function ensureDirMode(dir: string, log?: Logger): Promise<void> {\n  await mkdir(dir, { recursive: true });\n  try {\n    await chmod(dir, 0o770);\n  } catch (err) {\n    log?.debug(\"chmod 0770 skipped (EPERM — entrypoint heal expected)\", {\n      path: dir,\n      error: err instanceof Error ? err.message : String(err),\n    });\n  }\n}\n","/**\n * PortPool — allocates ports from a [min, max] range, checks OS for collisions.\n */\n\nimport { createConnection } from \"node:net\";\n\n/**\n * Allocates TCP ports from a `[min, max]` range with OS-level collision detection.\n * Used by service connector adapters (devserver, static-server) to assign local ports.\n * @docLink packages/connectors/api-reference#port-pool\n */\nexport class PortPool {\n  private readonly min: number;\n  private readonly max: number;\n  private readonly inUse = new Set<number>();\n\n  constructor(range: [number, number]) {\n    this.min = range[0];\n    this.max = range[1];\n  }\n\n  /** Allocate the next free port from the range. Checks OS for collisions. */\n  async allocate(): Promise<number> {\n    for (let port = this.min; port <= this.max; port++) {\n      if (this.inUse.has(port)) continue;\n      if (!(await PortPool.isPortFree(port))) {\n        this.inUse.add(port);\n        continue;\n      }\n      this.inUse.add(port);\n      return port;\n    }\n    throw new Error(`No free port in range ${this.min}-${this.max}`);\n  }\n\n  /** Mark a port as in-use (for explicit port args or registered instances). */\n  reserve(port: number): void {\n    this.inUse.add(port);\n  }\n\n  /** Return a port to the pool. */\n  release(port: number): void {\n    this.inUse.delete(port);\n  }\n\n  /** Check if a port is currently tracked as in-use. */\n  isInUse(port: number): boolean {\n    return this.inUse.has(port);\n  }\n\n  /** Quick TCP connect test — returns true if nothing is listening. */\n  static isPortFree(port: number, host = \"127.0.0.1\"): Promise<boolean> {\n    return new Promise((resolve) => {\n      const socket = createConnection({ port, host });\n      socket.once(\"connect\", () => {\n        socket.destroy();\n        resolve(false);\n      });\n      socket.once(\"error\", () => {\n        socket.destroy();\n        resolve(true);\n      });\n      socket.setTimeout(500, () => {\n        socket.destroy();\n        resolve(true);\n      });\n    });\n  }\n}\n","/**\n * Shared filesystem watcher factory for mountable adapters.\n *\n * Uses chokidar for cross-platform, debounced file watching.\n *\n * Automatically reads .gitignore from the watched directory and merges\n * those patterns into chokidar's ignore list. This prevents scanning\n * large generated directories (node_modules, dist, .next, etc.) that\n * most projects already declare as ignored.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, relative } from \"node:path\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n// Static import so bun --compile bundles chokidar into the binary. A dynamic\n// `await import(\"chokidar\")` is not seen by the compiler's static analyzer\n// and fails at runtime inside the /$bunfs/ virtual filesystem.\nimport chokidar from \"chokidar\";\nimport type { ConnectorChangeEvent } from \"./connector-types.js\";\nimport type { WatchHandle, WatchOptions } from \"./shared-types.js\";\n\n/**\n * Convert a glob pattern to a matcher function.\n *\n * Chokidar 5 changed string matchers to exact equality (`===`) instead of\n * glob matching. We convert our patterns to functions so chokidar can still\n * filter correctly.\n */\nfunction globToMatcher(pattern: string): (path: string) => boolean {\n  // Simple segment-name patterns: **/NAME/** or **/NAME\n  // Match any path that contains /NAME/ or ends with /NAME\n  const segmentMatch = pattern.match(/^\\*\\*\\/([^*/?]+)\\/\\*\\*$/);\n  if (segmentMatch) {\n    const name = segmentMatch[1];\n    return (p: string) => p.includes(`/${name}/`) || p.endsWith(`/${name}`) || p === name;\n  }\n\n  // Dot-prefixed segment: **/.NAME or **/.NAME/**\n  const dotSegment = pattern.match(/^\\*\\*\\/(\\.[\\w#]+)(?:\\/\\*\\*)?$/);\n  if (dotSegment) {\n    const name = dotSegment[1];\n    return (p: string) => p.includes(`/${name}/`) || p.endsWith(`/${name}`) || p === name;\n  }\n\n  // Extension wildcard: **/*.EXT.* or **/*.EXT\n  const extMatch = pattern.match(/^\\*\\*\\/\\*(\\.\\w+(?:\\.\\*)?)/);\n  if (extMatch) {\n    const suffix = extMatch[1];\n    if (suffix.endsWith(\".*\")) {\n      // e.g. **/*.tmp.* -> match any file with .tmp. in it\n      const base = suffix.slice(0, -2);\n      return (p: string) => p.includes(base);\n    }\n    return (p: string) => p.endsWith(suffix);\n  }\n\n  // Suffix wildcard: **/*SUFFIX (e.g. **/*~)\n  const suffixMatch = pattern.match(/^\\*\\*\\/\\*(.+)$/);\n  if (suffixMatch) {\n    const sfx = suffixMatch[1];\n    return (p: string) => p.endsWith(sfx);\n  }\n\n  // Fallback: convert simple globs to regex\n  const escaped = pattern\n    .replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\")\n    .replace(/\\*\\*/g, \"{{GLOBSTAR}}\")\n    .replace(/\\*/g, \"[^/]*\")\n    .replace(/\\?/g, \"[^/]\")\n    .replace(/\\{\\{GLOBSTAR\\}\\}/g, \".*\");\n  const re = new RegExp(`^${escaped}$`);\n  return (p: string) => re.test(p);\n}\n\nconst DEFAULT_IGNORED: Array<string | ((path: string) => boolean)> = [\n  (p: string) => p.includes(\"/.git/\") || p.endsWith(\"/.git\"),\n  (p: string) => p.includes(\"/node_modules/\") || p.endsWith(\"/node_modules\"),\n  (p: string) => p.includes(\"/.connectors/\") || p.endsWith(\"/.connectors\"),\n  // Atomic-write tempfiles (Bun.write creates `<name>.tmp.<pid>.<ts>` then renames).\n  // These vanish between readdir and fs.watch, causing EINVAL that crashes the process.\n  (p: string) => /\\.tmp\\.\\d/.test(p),\n  // Editor swap/backup files that also race with save operations.\n  (p: string) => p.endsWith(\".swp\"),\n  (p: string) => p.endsWith(\".swx\"),\n  (p: string) => p.includes(\"/.#\"),\n  (p: string) => p.endsWith(\"~\"),\n];\n/**\n * Default chokidar `awaitWriteFinish` stability threshold (ms). Exported so the\n * rclone process manager can reuse the same write-stabilization concept when\n * gating a flush on a quiescent mount.\n */\nexport const DEFAULT_DEBOUNCE_MS = 150;\n\n/**\n * Parse a .gitignore file into glob patterns suitable for chokidar's `ignored` option.\n * Handles comments, blank lines, directory patterns, and root-relative patterns.\n * Negation patterns (!) are skipped - chokidar cannot un-ignore.\n */\nfunction parseGitignore(rootDir: string): Array<(path: string) => boolean> {\n  const gitignorePath = join(rootDir, \".gitignore\");\n  if (!existsSync(gitignorePath)) return [];\n\n  try {\n    const content = readFileSync(gitignorePath, \"utf-8\");\n    const matchers: Array<(path: string) => boolean> = [];\n\n    for (const raw of content.split(\"\\n\")) {\n      const line = raw.trim();\n      if (!line || line.startsWith(\"#\") || line.startsWith(\"!\")) continue;\n\n      let pattern = line;\n\n      // Strip leading / (root-relative -> convert to rootDir-relative)\n      if (pattern.startsWith(\"/\")) {\n        pattern = pattern.slice(1);\n      } else if (!pattern.includes(\"/\")) {\n        // Bare name like \"node_modules\" or \"*.log\" -> match anywhere\n        pattern = `**/${pattern}`;\n      }\n\n      // Directory pattern (trailing /) -> ensure it matches contents too\n      if (pattern.endsWith(\"/\")) {\n        matchers.push(globToMatcher(`${pattern}**`));\n      } else {\n        matchers.push(globToMatcher(pattern));\n        // Also match as directory (e.g. \"dist\" should match \"dist/\" and \"dist/**\")\n        if (!pattern.includes(\"*\") && !pattern.includes(\".\")) {\n          matchers.push(globToMatcher(`${pattern}/**`));\n        }\n      }\n    }\n\n    return matchers;\n  } catch {\n    return [];\n  }\n}\n\ntype ChokidarAction = \"create\" | \"edit\" | \"delete\";\n\nconst CHOKIDAR_EVENT_MAP: Record<string, ChokidarAction> = {\n  add: \"create\",\n  change: \"edit\",\n  unlink: \"delete\",\n  addDir: \"create\",\n  unlinkDir: \"delete\",\n};\n\n/**\n * Create a cross-platform filesystem watcher on `rootDir` using chokidar.\n * Auto-reads `.gitignore` from `rootDir` and merges those patterns into the ignore list.\n * @param rootDir - Absolute path to the directory to watch.\n * @param callback - Called with each `ConnectorChangeEvent` (create / edit / delete).\n * @param options - Debounce interval and additional ignore patterns.\n * @returns A `WatchHandle` — call `.close()` to stop watching.\n * @docLink packages/connectors/api-reference#create-fs-watcher\n */\nexport async function createFsWatcher(\n  rootDir: string,\n  callback: (event: ConnectorChangeEvent) => void,\n  options?: WatchOptions,\n): Promise<WatchHandle> {\n  const log = createLogger({ kind: \"connector\", subkind: \"watcher\", instance: rootDir });\n  const gitignorePatterns = parseGitignore(rootDir);\n  // Convert any remaining string patterns from options to matcher functions\n  // (chokidar 5 treats strings as exact equality, not globs)\n  const optionsIgnored = (options?.ignored ?? []).map((entry) =>\n    typeof entry === \"string\" ? globToMatcher(entry) : entry,\n  );\n  const ignored = [...DEFAULT_IGNORED, ...gitignorePatterns, ...optionsIgnored];\n  const debounceMs = options?.debounceMs ?? DEFAULT_DEBOUNCE_MS;\n\n  const watcher = chokidar.watch(rootDir, {\n    ignoreInitial: true,\n    ignored,\n    awaitWriteFinish: { stabilityThreshold: debounceMs, pollInterval: 50 },\n    usePolling: false,\n  });\n\n  // Swallow transient watch errors (EINVAL/ENOENT when a file vanishes between\n  // readdir and fs.watch). Without this handler, chokidar rethrows and the\n  // agent process dies.\n  watcher.on(\"error\", (err) => {\n    const message = err instanceof Error ? err.message : String(err);\n    log.warn(\"watcher error (non-fatal)\", { message });\n  });\n\n  for (const [chokidarEvent, action] of Object.entries(CHOKIDAR_EVENT_MAP)) {\n    (watcher as { on(event: string, fn: (fullPath: string) => void): void }).on(\n      chokidarEvent,\n      (fullPath: string) => {\n        const rel = relative(rootDir, fullPath);\n        if (!rel || rel.startsWith(\"..\")) return;\n        // Normalize to forward slashes\n        const normalizedPath = rel.split(\"\\\\\").join(\"/\");\n        callback({ path: normalizedPath, action, source: \"filesystem\" });\n      },\n    );\n  }\n\n  return {\n    close: () => watcher.close(),\n  };\n}\n","/**\n * RcloneProcessManager — supervises an rclone FUSE subprocess per mount.\n *\n * Responsibilities:\n *   - Spawn rclone with a per-mount config + cache dir, wait for the FUSE\n *     mountpoint to appear, then return a handle.\n *   - Pipe rclone's JSON-formatted log lines into the parent driver's\n *     {@link Logger} via a child source `${driverName}+rclone`.\n *   - Coordinate graceful stop (flush → SIGTERM → fusermount fallback).\n *   - Expose `flush` (POST /vfs/refresh + poll /vfs/stats) and `status`\n *     (process liveness + cache-dir size).\n *\n * Cross-link: see `workspaces/core/CLAUDE.md` § Logging for the\n * `createLogger` / `LogStore` contract, and\n * `_devlog/specs/2026-05-01-debug-logging-design.md` for the source taxonomy.\n */\n\nimport { type ChildProcess, spawn } from \"node:child_process\";\nimport { randomBytes } from \"node:crypto\";\nimport { readdir, readFile, stat, unlink, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\nimport type { Readable } from \"node:stream\";\nimport type { Logger } from \"@skaile/workspaces/types\";\nimport { ensureDirMode } from \"./fs-utils.js\";\nimport { PortPool } from \"./port-pool.js\";\nimport { DEFAULT_DEBOUNCE_MS } from \"./watcher.js\";\n\n/** Module-level pool for rclone remote-control (rc) ports. */\nconst RCLONE_RC_PORTS = new PortPool([55000, 56000]);\n\n/** Default rclone `--vfs-write-back` delay; raised from 5s so a rapidly-rewritten file settles before upload (avoids mid-write \"sizes differ\" aborts). */\nexport const DEFAULT_VFS_WRITE_BACK = \"30s\";\n\n/** Consecutive failed upload retries for one object before a stuck-upload error is surfaced. */\nexport const DEFAULT_UPLOAD_STUCK_THRESHOLD = 3;\n\n/**\n * Stabilization gate defaults for {@link RcloneProcessManager.flush}. Before\n * forcing an upload we wait until the vfs cache dir has had no write for\n * `thresholdMs`, bounded by `timeoutMs` so close/hibernate never blocks\n * forever. `pollMs` reuses the watcher's write-stabilization debounce.\n */\nconst STABILIZE_THRESHOLD_MS = 1_500;\nconst STABILIZE_TIMEOUT_MS = 30_000;\nconst STABILIZE_POLL_MS = DEFAULT_DEBOUNCE_MS;\n\n/**\n * Spawn-time configuration for a single rclone FUSE mount.\n * @docLink packages/connectors/api-reference#rclone-spawn-config\n */\nexport interface RcloneSpawnConfig {\n  /** Logical mount id; used as `instance` and as part of the rclone config filename. */\n  mountId: string;\n  /**\n   * Driver name (e.g. \"sharepoint\", \"webdav\"); used to derive the rclone\n   * subprocess child logger subkind: `${driverName}+rclone`.\n   */\n  driverName: string;\n  /** Absolute path inside the container where rclone will FUSE-mount. Created if missing. */\n  mountPoint: string;\n  /** Absolute path inside the container for the vfs cache. Created if missing. */\n  cacheDir: string;\n  /** Full INI text for rclone.conf (one [remote] section, named `skaile-<mountId>`). */\n  rcloneConfig: string;\n  /** Remote spec, e.g. `skaile-foo:/Clients/KADK`. */\n  remote: string;\n  /** rclone --vfs-cache-mode value. */\n  vfsCacheMode: \"minimal\" | \"writes\" | \"full\";\n  /** Per-mount cache size cap. Default: '5G'. */\n  cacheMaxSize?: string;\n  /** Per-mount cache age cap. Default: '168h'. */\n  cacheMaxAge?: string;\n  /**\n   * Skip rclone's post-transfer size + checksum verification by appending\n   * `--ignore-size --ignore-checksum`. Default: false (verification on).\n   *\n   * Escape hatch for remotes that mutate uploaded bytes server-side (notably\n   * SharePoint Online normalising LF→CRLF on text/html), which makes the\n   * remote object a different size/hash than the local source. rclone reads\n   * that as `corrupted on transfer`, deletes the upload, and retries forever,\n   * so the file never durably lands. Enabling this trades integrity\n   * verification for sync-ability and must only be set by drivers that have\n   * confirmed the mutation is benign. Off-by-default; wired per-driver, never\n   * globally.\n   */\n  ignoreSizeCheck?: boolean;\n  /**\n   * rclone `--vfs-write-back` delay (e.g. '30s', '1m'). Controls how long a\n   * dirty file sits before rclone starts uploading it. Default:\n   * {@link DEFAULT_VFS_WRITE_BACK}. Raise it when the agent rewrites files\n   * faster than they upload, to avoid mid-write \"sizes differ\" aborts.\n   */\n  vfsWriteBack?: string;\n  /**\n   * Consecutive upload retries for one object before {@link onUploadStuck}\n   * fires. Default: {@link DEFAULT_UPLOAD_STUCK_THRESHOLD}.\n   */\n  uploadStuckThreshold?: number;\n  /**\n   * Optional hook invoked once per object when its upload has failed\n   * `uploadStuckThreshold` times in a row. spawn() always also logs an\n   * error-level entry through the `${driverName}+rclone` child logger; this\n   * hook lets callers surface the stranded file elsewhere (e.g. a sync event).\n   */\n  onUploadStuck?: (object: string, tries: number) => void;\n  /**\n   * Optional hook invoked when rclone reports an OAuth auth failure (notably\n   * `invalid_client` / `couldn't fetch token`, the symptom of an expired\n   * access token that rclone cannot self-refresh). Wired by the mount driver\n   * to the reactive arm of its token-refresh controller. Fires per matching\n   * log line; the controller dedupes via its in-flight guard + cooldown.\n   */\n  onAuthError?: () => void;\n  /**\n   * Parent driver Logger — already tagged\n   * `{kind:\"mount\", subkind:<driver>, instance:<mountId>}` by ConnectorManager.\n   * Used for manager-level events; rclone subprocess events go through the\n   * derived `child({subkind: \\`${driverName}+rclone\\`})` logger.\n   */\n  log: Logger;\n}\n\n/**\n * Handle returned by `RcloneProcessManager.spawn()` once the FUSE mountpoint is confirmed.\n * @docLink packages/connectors/api-reference#rclone-handle\n */\nexport interface RcloneHandle {\n  /** OS process id of the rclone subprocess. */\n  pid: number;\n  /** Confirmed FUSE mountpoint (echo of input). */\n  mountPoint: string;\n  /** Cache directory (echo of input). */\n  cacheDir: string;\n  /** The local rc API address rclone is bound to, e.g. '127.0.0.1:54321'. */\n  rcAddr: string;\n}\n\ninterface InternalEntry {\n  proc: ChildProcess;\n  configPath: string;\n  port: number;\n  mountPoint: string;\n  cacheDir: string;\n  /** The full spawn config, retained so `reconfigure` can recycle the process. */\n  spawnConfig: RcloneSpawnConfig;\n  log: Logger;\n  rcloneLog: Logger;\n  /**\n   * Last few stderr lines for diagnostic purposes (used in spawn-failure\n   * messages).\n   */\n  recentStderr: string[];\n}\n\nconst HANDLES = new Map<number, InternalEntry>();\n\n/**\n * Manages rclone FUSE subprocesses for mount drivers. Stateless across instances —\n * the internal handle registry is module-scoped so a fresh `RcloneProcessManager`\n * can still find handles created by a previous instance.\n * @docLink packages/connectors/api-reference#rclone-process-manager\n */\nexport class RcloneProcessManager {\n  /**\n   * Spawn an rclone FUSE mount. Resolves once the mountpoint is confirmed\n   * present in `/proc/self/mounts`. Throws on timeout, on early exit, or\n   * if invariants are violated.\n   */\n  async spawn(config: RcloneSpawnConfig): Promise<RcloneHandle> {\n    if (!path.isAbsolute(config.mountPoint)) {\n      throw new Error(`mountPoint must be absolute: ${config.mountPoint}`);\n    }\n    if (!path.isAbsolute(config.cacheDir)) {\n      throw new Error(`cacheDir must be absolute: ${config.cacheDir}`);\n    }\n\n    // Defence-in-depth: the per-connector driver already chmods these via\n    // ensureDirMode, but direct callers that bypass the driver still need\n    // mountPoint and cacheDir to be group-writable for fusermount3 / vfs.\n    await ensureDirMode(config.mountPoint, config.log);\n    await ensureDirMode(config.cacheDir, config.log);\n\n    const configPath = path.join(\n      tmpdir(),\n      `rclone-${config.mountId}-${randomBytes(6).toString(\"hex\")}.conf`,\n    );\n    await writeFile(configPath, config.rcloneConfig, { mode: 0o600 });\n\n    const port = await RCLONE_RC_PORTS.allocate();\n    const rcAddr = `127.0.0.1:${port}`;\n    const rcloneLog = config.log.child({ subkind: `${config.driverName}+rclone` });\n\n    config.log.info(\"rclone spawn starting\", {\n      mountPoint: config.mountPoint,\n      remote: config.remote,\n      vfsCacheMode: config.vfsCacheMode,\n    });\n\n    const args = _buildRcloneArgs(config, { configPath, rcAddr });\n\n    const proc = spawn(\"rclone\", args, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n\n    // Per-process tracker for the upload-stuck observability gate. When an\n    // object's upload retry count crosses the threshold we log once at error\n    // level (the stream otherwise stays at INFO and the failure is silent).\n    const routeCtx: RcloneLogRouteContext = {\n      stuckThreshold: config.uploadStuckThreshold ?? DEFAULT_UPLOAD_STUCK_THRESHOLD,\n      alertedObjects: new Set<string>(),\n      onUploadStuck: (object, tries) => {\n        rcloneLog.error(\n          \"rclone upload repeatedly failing — file may be stranded in this session's cache\",\n          undefined,\n          { object, tries, event: \"sync_status\", phase: \"error\" },\n        );\n        config.onUploadStuck?.(object, tries);\n      },\n      onAuthError: config.onAuthError,\n    };\n\n    const recentStderr: string[] = [];\n    const stderrTail = (line: string) => {\n      recentStderr.push(line);\n      if (recentStderr.length > 20) recentStderr.shift();\n    };\n\n    const stdoutHandler = (line: string) => {\n      _routeRcloneLogLine(line, rcloneLog, routeCtx);\n    };\n    const stderrHandler = (line: string) => {\n      stderrTail(line);\n      _routeRcloneLogLine(line, rcloneLog, routeCtx);\n    };\n\n    if (proc.stdout) attachLineSplitter(proc.stdout, stdoutHandler);\n    if (proc.stderr) attachLineSplitter(proc.stderr, stderrHandler);\n\n    let earlyExitCode: number | null = null;\n    let earlyExitSignal: NodeJS.Signals | null = null;\n    const earlyExit = new Promise<void>((resolve) => {\n      proc.once(\"exit\", (code, signal) => {\n        earlyExitCode = code;\n        earlyExitSignal = signal;\n        resolve();\n      });\n    });\n\n    const mountReady = waitFor(\n      async () => {\n        if (earlyExitCode !== null || earlyExitSignal !== null) return false;\n        return await isMountpoint(config.mountPoint);\n      },\n      { timeoutMs: 15_000, intervalMs: 100 },\n    );\n\n    const ready = await Promise.race([mountReady, earlyExit.then(() => false)]);\n\n    if (!ready) {\n      try {\n        if (proc.exitCode === null && proc.signalCode === null) {\n          proc.kill(\"SIGKILL\");\n        }\n      } catch {\n        // ignore\n      }\n      await unlink(configPath).catch(() => {});\n      RCLONE_RC_PORTS.release(port);\n      const tail =\n        recentStderr.length > 0 ? `\\nstderr tail:\\n${recentStderr.slice(-5).join(\"\\n\")}` : \"\";\n      throw new Error(`rclone failed to mount ${config.remote} at ${config.mountPoint}${tail}`);\n    }\n\n    const pid = proc.pid;\n    if (pid === undefined) {\n      // Should never happen if mountReady resolved true, but defend anyway.\n      proc.kill(\"SIGKILL\");\n      await unlink(configPath).catch(() => {});\n      RCLONE_RC_PORTS.release(port);\n      throw new Error(\"rclone process has no pid after successful mount\");\n    }\n\n    const entry: InternalEntry = {\n      proc,\n      configPath,\n      port,\n      mountPoint: config.mountPoint,\n      cacheDir: config.cacheDir,\n      spawnConfig: config,\n      log: config.log,\n      rcloneLog,\n      recentStderr,\n    };\n    HANDLES.set(pid, entry);\n\n    proc.on(\"exit\", (code) => {\n      // If the entry is still in the registry, this was unplanned.\n      if (HANDLES.has(pid)) {\n        config.log.warn(\"rclone exited unexpectedly\", { code, pid });\n      }\n    });\n\n    config.log.info(\"rclone mountpoint confirmed\", { pid });\n\n    return { pid, mountPoint: config.mountPoint, cacheDir: config.cacheDir, rcAddr };\n  }\n\n  /**\n   * Stop an rclone subprocess. Attempts a flush first, then SIGTERM, then\n   * SIGKILL + fusermount3 if `graceMs` elapses without the mountpoint\n   * disappearing.\n   *\n   * `graceMs` bounds both the flush stabilization gate and the SIGTERM→SIGKILL\n   * window — it is *not* a single total wall-clock cap: the flush also waits on\n   * rclone's `/vfs/stats` drain (its own 60s ceiling) between the two.\n   */\n  async stop(handle: RcloneHandle, opts?: { graceMs?: number }): Promise<void> {\n    const graceMs = opts?.graceMs ?? 30_000;\n    const entry = HANDLES.get(handle.pid);\n    if (!entry) {\n      return;\n    }\n\n    try {\n      // Bound the stabilization gate by graceMs so stop() doesn't silently add\n      // the full default stabilize timeout on top of the caller's budget.\n      await this.flush(handle, { stabilizeTimeoutMs: graceMs });\n    } catch (err) {\n      entry.log.warn(\"rclone flush before stop failed\", {\n        pid: handle.pid,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n\n    entry.log.info(\"rclone stop initiated\", { pid: handle.pid });\n\n    // Remove FIRST so the exit handler doesn't fire the unplanned-exit warning.\n    HANDLES.delete(handle.pid);\n\n    try {\n      entry.proc.kill(\"SIGTERM\");\n    } catch {\n      // ignore — process may already be gone\n    }\n\n    const unmounted = await waitFor(async () => !(await isMountpoint(entry.mountPoint)), {\n      timeoutMs: graceMs,\n      intervalMs: 200,\n    });\n\n    if (!unmounted) {\n      try {\n        entry.proc.kill(\"SIGKILL\");\n      } catch {\n        // ignore\n      }\n      await new Promise<void>((resolve) => {\n        const fuse = spawn(\"fusermount3\", [\"-u\", entry.mountPoint], { stdio: \"ignore\" });\n        fuse.once(\"exit\", () => resolve());\n        fuse.once(\"error\", () => resolve());\n      });\n      entry.log.warn(\"rclone hard-killed\", { pid: handle.pid });\n    }\n\n    RCLONE_RC_PORTS.release(entry.port);\n    await unlink(entry.configPath).catch(() => {});\n  }\n\n  /**\n   * Apply a freshly-rendered rclone INI to a running mount by recycling the\n   * process: flush + stop the current rclone, then re-spawn at the same\n   * mountpoint/cacheDir with the new config. Returns the new handle.\n   *\n   * rclone holds the OAuth token in memory (baked into the config at spawn);\n   * there is no rc command to swap it on a live `onedrive` backend, so a\n   * recycle is the reliable way to apply a refreshed token. The vfs cache dir\n   * is reused, so the remount revalidates rather than re-downloads. During the\n   * brief unmount window the read-only mount-placeholder barrier underneath is\n   * exposed (writes fail with EROFS, not EIO) — see ConnectorManager's\n   * read-only-until-ready guarantee.\n   */\n  async reconfigure(handle: RcloneHandle, rcloneConfig: string): Promise<RcloneHandle> {\n    const entry = HANDLES.get(handle.pid);\n    if (!entry) {\n      throw new Error(`rclone handle not found (pid=${handle.pid})`);\n    }\n    const nextConfig: RcloneSpawnConfig = { ...entry.spawnConfig, rcloneConfig };\n    entry.log.info(\"rclone reconfigure — recycling process to apply refreshed credential\", {\n      pid: handle.pid,\n    });\n    await this.stop(handle, { graceMs: 30_000 });\n    return this.spawn(nextConfig);\n  }\n\n  /**\n   * Force rclone to upload pending writes, then wait until the in-use\n   * counter reaches zero.\n   *\n   * Before issuing the refresh it waits for the vfs cache dir to go quiescent\n   * (no write for `stabilityThresholdMs`, bounded by `stabilizeTimeoutMs`) so a\n   * close/hibernate-triggered flush doesn't snapshot a half-written file and\n   * trigger rclone's mid-write \"sizes differ\" abort. Pass `stabilize: false`\n   * to skip the gate.\n   */\n  async flush(\n    handle: RcloneHandle,\n    opts?: { stabilize?: boolean; stabilityThresholdMs?: number; stabilizeTimeoutMs?: number },\n  ): Promise<void> {\n    const entry = HANDLES.get(handle.pid);\n    if (!entry) {\n      throw new Error(`rclone handle not found (pid=${handle.pid})`);\n    }\n\n    if (opts?.stabilize !== false) {\n      const thresholdMs = opts?.stabilityThresholdMs ?? STABILIZE_THRESHOLD_MS;\n      const timeoutMs = opts?.stabilizeTimeoutMs ?? STABILIZE_TIMEOUT_MS;\n      // Scan only the vfs content subtree (agent writes land here). The sibling\n      // `vfsMeta/` tree is rclone housekeeping whose churn would never settle.\n      const scanDir = await vfsContentDir(entry.cacheDir);\n      const quiescent = await awaitQuiescent(scanDir, {\n        thresholdMs,\n        timeoutMs,\n        pollMs: STABILIZE_POLL_MS,\n      });\n      if (!quiescent) {\n        entry.log.warn(\"rclone cache did not stabilize before flush — proceeding anyway\", {\n          pid: handle.pid,\n          thresholdMs,\n          timeoutMs,\n        });\n      }\n    }\n\n    const refreshRes = await fetch(`http://${handle.rcAddr}/vfs/refresh?recursive=true`, {\n      method: \"POST\",\n    });\n    if (!refreshRes.ok) {\n      const body = await refreshRes.text().catch(() => \"\");\n      throw new Error(`rclone /vfs/refresh failed: ${refreshRes.status} ${body}`);\n    }\n\n    const ok = await waitFor(\n      async () => {\n        const r = await fetch(`http://${handle.rcAddr}/vfs/stats`, { method: \"GET\" });\n        if (!r.ok) return false;\n        const body = (await r.json()) as { inUse?: number; [k: string]: unknown };\n        return body.inUse === 0;\n      },\n      { timeoutMs: 60_000, intervalMs: 500 },\n    );\n    if (!ok) {\n      throw new Error(`rclone flush did not drain within 60s (pid=${handle.pid})`);\n    }\n  }\n\n  /** Liveness + cache-dir size. */\n  async status(handle: RcloneHandle): Promise<{ alive: boolean; cacheBytes: number }> {\n    const entry = HANDLES.get(handle.pid);\n    if (!entry) {\n      return { alive: false, cacheBytes: 0 };\n    }\n    const alive = entry.proc.exitCode === null && entry.proc.signalCode === null;\n    const cacheBytes = await dirSize(entry.cacheDir);\n    return { alive, cacheBytes };\n  }\n}\n\ninterface RcloneJsonLine {\n  level?: string;\n  msg?: string;\n  source?: string;\n  time?: string;\n  object?: string;\n  error?: unknown;\n}\n\n/**\n * Per-process state threaded through {@link _routeRcloneLogLine} so it can\n * detect a sustained upload failure (the same object failing to upload K times\n * in a row) and surface it exactly once, instead of letting rclone retry\n * silently at INFO level forever.\n */\nexport interface RcloneLogRouteContext {\n  /** Consecutive retries for one object before {@link onUploadStuck} fires. */\n  stuckThreshold?: number;\n  /** Objects already alerted on, to fire once and not on every later retry. */\n  alertedObjects?: Set<string>;\n  /** Called the first time an object crosses {@link stuckThreshold}. */\n  onUploadStuck?: (object: string, tries: number) => void;\n  /** Called when a line matches an OAuth auth-failure pattern. */\n  onAuthError?: () => void;\n}\n\n/** rclone's vfs write-back failure line: \"... failed to upload try #3, will retry ...\". */\nconst UPLOAD_FAIL_RE = /failed to upload.*?try #(\\d+)/i;\n/** rclone's vfs write-back success line, used to reset the per-object alert. */\nconst UPLOAD_OK_RE = /upload succeeded/i;\n/**\n * OAuth token-level failures rclone emits when the access token is expired and\n * it cannot self-refresh (the Skaile-managed-Entra `client_secret`-stripped\n * case). `invalid_client` / `couldn't fetch token` is the confirmed prod\n * symptom; the rest cover the equivalent MSAL/refresh-grant token failures.\n * Bare HTTP `401` is intentionally excluded — rclone retries many transient\n * 401s internally without needing a token refresh; only these token-level\n * failures mean rclone is stuck.\n */\nconst AUTH_FAIL_RE =\n  /invalid_client|couldn'?t fetch token|invalid_grant|InvalidAuthenticationToken/i;\n\n/**\n * @internal\n * Route a single rclone log line (JSON or raw) to the appropriate Logger\n * call. Exported for tests; not part of the public API. When `ctx` is\n * supplied, also tracks consecutive upload failures per object and invokes\n * `ctx.onUploadStuck` once the retry count for an object reaches the threshold.\n */\nexport function _routeRcloneLogLine(line: string, log: Logger, ctx?: RcloneLogRouteContext): void {\n  const trimmed = line.trim();\n  if (trimmed.length === 0) return;\n\n  let parsed: RcloneJsonLine | null = null;\n  try {\n    const candidate = JSON.parse(trimmed);\n    if (candidate && typeof candidate === \"object\") parsed = candidate as RcloneJsonLine;\n  } catch {\n    parsed = null;\n  }\n\n  if (!parsed) {\n    if (ctx) {\n      _trackUploadFailure(trimmed, undefined, ctx);\n      if (AUTH_FAIL_RE.test(trimmed)) ctx.onAuthError?.();\n    }\n    log.info(trimmed);\n    return;\n  }\n\n  const level = (parsed.level ?? \"INFO\").toUpperCase();\n  const msg = parsed.msg ?? \"\";\n  const data: Record<string, unknown> = {};\n  if (parsed.object !== undefined) data.object = parsed.object;\n  if (parsed.source !== undefined) data.source = parsed.source;\n\n  if (ctx) {\n    _trackUploadFailure(msg, parsed.object, ctx);\n    const errText = typeof parsed.error === \"string\" ? parsed.error : \"\";\n    if (AUTH_FAIL_RE.test(msg) || (errText && AUTH_FAIL_RE.test(errText))) ctx.onAuthError?.();\n  }\n\n  switch (level) {\n    case \"DEBUG\":\n      log.debug(msg, data);\n      break;\n    case \"INFO\":\n    case \"NOTICE\":\n      log.info(msg, data);\n      break;\n    case \"WARNING\":\n      log.warn(msg, data);\n      break;\n    case \"ERROR\":\n    case \"CRITICAL\":\n    case \"EMERGENCY\":\n    case \"ALERT\":\n      log.error(msg, parsed.error, data);\n      break;\n    default:\n      log.info(msg, data);\n      break;\n  }\n}\n\n/**\n * @internal\n * Inspect one rclone message for an upload retry / success and update the\n * per-object alert state in `ctx`. Fires `onUploadStuck` once when an object's\n * retry count first reaches the threshold; a later success clears the alert so\n * a fresh failure run can re-trigger.\n */\nfunction _trackUploadFailure(\n  msg: string,\n  object: string | undefined,\n  ctx: RcloneLogRouteContext,\n): void {\n  const failMatch = UPLOAD_FAIL_RE.exec(msg);\n  if (failMatch) {\n    const tries = Number(failMatch[1]);\n    const key = object ?? extractObjectFromMsg(msg) ?? \"(unknown)\";\n    const threshold = ctx.stuckThreshold ?? DEFAULT_UPLOAD_STUCK_THRESHOLD;\n    if (!ctx.alertedObjects) ctx.alertedObjects = new Set<string>();\n    const alerted = ctx.alertedObjects;\n    if (tries >= threshold && !alerted.has(key)) {\n      alerted.add(key);\n      ctx.onUploadStuck?.(key, tries);\n    }\n    return;\n  }\n  if (UPLOAD_OK_RE.test(msg)) {\n    const key = object ?? extractObjectFromMsg(msg);\n    if (key) ctx.alertedObjects?.delete(key);\n  }\n}\n\n/** Best-effort path extraction from a free-text rclone message. */\nfunction extractObjectFromMsg(msg: string): string | undefined {\n  const m = /(?:^|\\s)([^\\s:]+\\/[^\\s:]+):/.exec(msg);\n  return m?.[1];\n}\n\n/**\n * @internal\n * Build the `rclone mount` argv from a spawn config. Extracted from spawn() so\n * the flag wiring (notably `--vfs-write-back` and the conditional\n * `--ignore-size --ignore-checksum`) is unit-testable without actually\n * launching rclone. Exported for tests; not part of the public API.\n */\nexport function _buildRcloneArgs(\n  config: RcloneSpawnConfig,\n  io: { configPath: string; rcAddr: string },\n): string[] {\n  const args = [\n    \"mount\",\n    config.remote,\n    config.mountPoint,\n    \"--config\",\n    io.configPath,\n    \"--cache-dir\",\n    config.cacheDir,\n    \"--vfs-cache-mode\",\n    config.vfsCacheMode,\n    \"--vfs-cache-max-size\",\n    config.cacheMaxSize ?? \"5G\",\n    \"--vfs-cache-max-age\",\n    config.cacheMaxAge ?? \"168h\",\n    \"--vfs-write-back\",\n    config.vfsWriteBack ?? DEFAULT_VFS_WRITE_BACK,\n    \"--vfs-cache-poll-interval\",\n    \"60s\",\n    \"--rc\",\n    \"--rc-addr\",\n    io.rcAddr,\n    \"--log-level\",\n    \"INFO\",\n    \"--use-json-log\",\n    \"--allow-other\",\n  ];\n\n  // Remotes that rewrite bytes on upload (SharePoint LF→CRLF) make the\n  // post-transfer size/hash check fail and rclone rolls the upload back\n  // forever. Both flags are needed: a byte change shifts size AND checksum.\n  if (config.ignoreSizeCheck) {\n    args.push(\"--ignore-size\", \"--ignore-checksum\");\n  }\n\n  return args;\n}\n\n/**\n * Poll `dir` until its newest file mtime is at least `thresholdMs` in the past\n * (no write for that long), or `timeoutMs` elapses. Returns true if it went\n * quiescent, false on timeout. An empty/missing dir counts as quiescent.\n */\nexport async function awaitQuiescent(\n  dir: string,\n  opts: { thresholdMs: number; timeoutMs: number; pollMs: number },\n): Promise<boolean> {\n  const deadline = Date.now() + opts.timeoutMs;\n  for (;;) {\n    const newest = await newestMtimeMs(dir);\n    if (newest === null || Date.now() - newest >= opts.thresholdMs) return true;\n    if (Date.now() >= deadline) return false;\n    await sleep(opts.pollMs);\n  }\n}\n\n/**\n * Resolve the rclone vfs content subtree (`<cacheDir>/vfs`) where cached file\n * data — and therefore agent writes — land, falling back to `cacheDir` itself\n * if that subtree doesn't exist yet. Keeps the stabilization gate off rclone's\n * `vfsMeta/` housekeeping tree.\n */\nasync function vfsContentDir(cacheDir: string): Promise<string> {\n  const vfs = path.join(cacheDir, \"vfs\");\n  try {\n    return (await stat(vfs)).isDirectory() ? vfs : cacheDir;\n  } catch {\n    return cacheDir;\n  }\n}\n\n/**\n * Recursively find the most recent file mtime (ms) under `dir`. Returns null if\n * the dir is missing or contains no files. Symlinks are skipped — rclone's\n * cache holds only regular files and dirs.\n */\nasync function newestMtimeMs(dir: string): Promise<number | null> {\n  let newest: number | null = null;\n  try {\n    const entries = await readdir(dir, { withFileTypes: true });\n    for (const e of entries) {\n      const full = path.join(dir, String(e.name));\n      if (e.isDirectory()) {\n        const sub = await newestMtimeMs(full);\n        if (sub !== null && (newest === null || sub > newest)) newest = sub;\n      } else if (e.isFile()) {\n        try {\n          const s = await stat(full);\n          if (newest === null || s.mtimeMs > newest) newest = s.mtimeMs;\n        } catch {\n          // ignore — file vanished between readdir and stat\n        }\n      }\n    }\n  } catch {\n    return null;\n  }\n  return newest;\n}\n\n/** Returns true if `mountPoint` appears as a mount in /proc/self/mounts. */\nasync function isMountpoint(mountPoint: string): Promise<boolean> {\n  try {\n    const resolved = path.resolve(mountPoint);\n    const text = await readFile(\"/proc/self/mounts\", \"utf8\");\n    for (const raw of text.split(\"\\n\")) {\n      if (raw.length === 0) continue;\n      const fields = raw.split(/\\s+/);\n      const mp = fields[1];\n      if (!mp) continue;\n      // /proc/self/mounts encodes spaces as \\040; cheap decode.\n      const decoded = mp.replace(/\\\\040/g, \" \");\n      if (decoded === resolved) return true;\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Poll `check` every `intervalMs` until it returns true or `timeoutMs`\n * elapses. Returns true on success, false on timeout.\n */\nasync function waitFor(\n  check: () => Promise<boolean>,\n  opts: { timeoutMs: number; intervalMs: number },\n): Promise<boolean> {\n  const deadline = Date.now() + opts.timeoutMs;\n  while (Date.now() < deadline) {\n    if (await check()) return true;\n    await sleep(opts.intervalMs);\n  }\n  return await check();\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms);\n  });\n}\n\n/** Wire a Readable to a per-line callback, buffering partial chunks. */\nfunction attachLineSplitter(stream: Readable, onLine: (line: string) => void): void {\n  let buffer = \"\";\n  stream.setEncoding(\"utf8\");\n  stream.on(\"data\", (chunk: string) => {\n    buffer += chunk;\n    let idx = buffer.indexOf(\"\\n\");\n    while (idx >= 0) {\n      const line = buffer.slice(0, idx);\n      buffer = buffer.slice(idx + 1);\n      if (line.length > 0) onLine(line);\n      idx = buffer.indexOf(\"\\n\");\n    }\n  });\n  stream.on(\"end\", () => {\n    if (buffer.length > 0) {\n      onLine(buffer);\n      buffer = \"\";\n    }\n  });\n}\n\n/** Recursively sum file sizes under `dir`. Returns 0 if dir does not exist. */\nasync function dirSize(dir: string): Promise<number> {\n  let total = 0;\n  try {\n    const entries = await readdir(dir, { withFileTypes: true });\n    for (const e of entries) {\n      const full = path.join(dir, String(e.name));\n      if (e.isDirectory()) {\n        total += await dirSize(full);\n      } else if (e.isFile()) {\n        try {\n          const s = await stat(full);\n          total += s.size;\n        } catch {\n          // ignore\n        }\n      }\n    }\n  } catch {\n    return 0;\n  }\n  return total;\n}\n"]}