@skaile/workspaces 0.39.0 → 0.40.0

package/dist/plugins/src/catalog-source.d.ts

@@ -53,6 +53,47 @@ export interface CatalogAssetFilter {
     /** Prefix match on the full `<publisher>/<name>` ref. */
     prefix?: string;
 }
+/**
+ * How the members of a navigational domain relate. Display-only hint — never an
+ * install-all bundle. Mirrors the discovery library's `DomainRelation`.
+ */
+export type DomainRelation = "additions" | "alternatives" | "sequence";
+/**
+ * Display-only metadata for a navigational domain (from a sidecar `DOMAIN.md`,
+ * surfaced by the store's `catalog.listDomains`). Joined to assets via
+ * {@link CatalogAsset.domainSlug}. A domain groups assets for co-discovery; it
+ * is never part of asset identity and never bulk-installs.
+ *
+ * Defined inline (structurally compatible with `core`'s `CatalogDomain`) to keep
+ * `plugins` a zero-dependency leaf package.
+ */
+export interface CatalogDomain {
+    /** Stable slug — the join key to {@link CatalogAsset.domainSlug}. */
+    slug: string;
+    /** Human-readable title (may change without breaking the slug join). */
+    title: string;
+    /** Free-text description from the `DOMAIN.md` body. */
+    description?: string;
+    /** How members relate — drives sort + per-asset glyph, not installs. */
+    relation?: DomainRelation;
+    /** Display order among a publisher's domains (ascending). */
+    order?: number;
+    /** `kind:name` ref of the recommended member (alternatives domains). */
+    recommendedRef?: string;
+    /** Sidecar provenance — `"<org>/<repo>"` the `DOMAIN.md` was authored in. */
+    sidecarSource?: string;
+}
+/**
+ * Optional filter passed to {@link ICatalogSource.listDomains}.
+ *
+ * @docLink packages/workspace-plugin/index#plugin-interfaces
+ */
+export interface CatalogDomainFilter {
+    /** Restrict to domains whose Source has a published asset under this publisher. */
+    publisher?: string;
+    /** Restrict to a single Source id. */
+    source?: string;
+}
 /**
  * Descriptor returned by {@link ICatalogSource.listSources}.
  *
@@ -106,5 +147,16 @@ export interface ICatalogSource {
     fetchTarball(ref: string, sha256: string): Promise<Uint8Array>;
     /** List registered sources. */
     listSources(): Promise<CatalogSourceInfo[]>;
+    /**
+     * List navigational domains (display-only groupings from sidecar `DOMAIN.md`),
+     * optionally narrowed by publisher and/or source id.
+     *
+     * **Optional** — sources that don't model domains (local libraries, older
+     * stores, REST framings without the endpoint) omit it; consumers treat its
+     * absence (or `[]`) identically as "no domains". Display-only, so an
+     * implementation should degrade to `[]` on transport error rather than throw,
+     * to never jeopardize the asset feed it accompanies.
+     */
+    listDomains?(filter?: CatalogDomainFilter): Promise<CatalogDomain[]>;
 }
 //# sourceMappingURL=catalog-source.d.ts.map

package/dist/plugins/src/catalog-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-source.d.ts","sourceRoot":"","sources":["../../../plugins/src/catalog-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,gFAAgF;IAChF,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEnD,+CAA+C;IAC/C,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;;OAOG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE/D,+BAA+B;IAC/B,WAAW,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CAC7C"}
+{"version":3,"file":"catalog-source.d.ts","sourceRoot":"","sources":["../../../plugins/src/catalog-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,cAAc,GAAG,UAAU,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,gFAAgF;IAChF,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEnD,+CAA+C;IAC/C,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;;OAOG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE/D,+BAA+B;IAC/B,WAAW,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAE5C;;;;;;;;;OASG;IACH,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CACtE"}

package/dist/plugins/src/index.d.ts

@@ -2,7 +2,7 @@ export declare const VERSION = "0.0.0";
 export type { AssetKindFileFilter, AssetKindRequiresEdge, IAssetKindProvider, } from "./asset-kind-provider.js";
 export type { IAssetKindRegistry } from "./asset-kind-registry.js";
 export { AssetKindConflictError, AssetKindPathAmbiguityError, AssetKindPatternConflictError, AssetKindRegistryFrozenError, } from "./asset-kind-registry.js";
-export type { CatalogAsset, CatalogAssetFilter, CatalogSourceInfo, ICatalogSource, } from "./catalog-source.js";
+export type { CatalogAsset, CatalogAssetFilter, CatalogDomain, CatalogDomainFilter, CatalogSourceInfo, DomainRelation, ICatalogSource, } from "./catalog-source.js";
 export type { ISecretsProvider, ListFilter, ProviderCapabilities, SecretMetadata, SetSecretOptions, } from "./secrets-provider.js";
 export { ProviderUnavailableError, SecretAccessDeniedError, SecretExpiredError, SecretNotFoundError, SecretsError, } from "./secrets-provider.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/plugins/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../plugins/src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACb,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../plugins/src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACb,MAAM,uBAAuB,CAAC"}

package/dist/runner/index.js

@@ -1,5 +1,5 @@
-export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, stripStaleHtmlTail, touchSession, writeClaudeCodeCredentialsFile } from '../chunk-W23HDR6W.js';
-import '../chunk-LJIE3PGF.js';
+export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, stripStaleHtmlTail, touchSession, writeClaudeCodeCredentialsFile } from '../chunk-RM2KAMGD.js';
+import '../chunk-22Q5R7SM.js';
 import '../chunk-X5YPJV4N.js';
 import '../chunk-O7SG5PC2.js';
 import '../chunk-7QBNJTTQ.js';
@@ -14,10 +14,10 @@ import '../chunk-BMQKMOQY.js';
 import '../chunk-GAH4YRCI.js';
 import '../chunk-KM6DCR7A.js';
 import '../chunk-LV2HPH3C.js';
-import '../chunk-CMZWYMGD.js';
+import '../chunk-3P7HBSSD.js';
 import '../chunk-OVRSNIKJ.js';
 import '../chunk-WLWHOA3S.js';
-import '../chunk-P7CIT445.js';
+import '../chunk-C5UK3JK7.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-X46FY45B.js';
 import '../chunk-DEYYRFQU.js';

package/dist/runner/src/ai-credential-refresh.d.ts

@@ -1,20 +1,10 @@
 /**
- * Proactive AI-credential refresh scheduler.
- *
- * Holds a single `setTimeout` that fires `PROACTIVE_AI_REFRESH_MARGIN_MS`
- * before the current access token expires, asks the platform mediator for
- * a fresh credential via the caller-supplied `refresh` callback, and
- * re-arms itself against the new expiry. Pure logic — does not invoke
- * `host.refresh_credential` itself; the caller threads that side-effect
- * through `refresh`.
- *
- * Pairs with the bridge-side `failTurn` deferral that suppresses
- * downstream auth-error events when a self-heal is about to run: the
- * proactive timer is the primary prevention of in-container 401s, the
- * reactive 401 path is the safety net.
- *
- * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md`
- * § "Proactive refresh" (added 2026-05-20).
+ * Proactive AI-credential refresh scheduler. Holds a single timer that fires
+ * `PROACTIVE_AI_REFRESH_MARGIN_MS` before the token expires and re-arms against
+ * the new expiry via the caller-supplied `refresh`. Pure logic — the caller
+ * threads the `host.refresh_credential` side-effect. Resilience model
+ * (transient bounded-retry, terminal stop, stale-guard, non-amplification on a
+ * shared seat) is documented in `runner/CLAUDE.md` § AI Credential Mediation.
  *
  * @docLink packages/runner/dev-guide#ai-credential-mediation
  */
@@ -25,21 +15,52 @@
  * skew of a few seconds does not push the fire-time past expiry.
  */
 export declare const PROACTIVE_AI_REFRESH_MARGIN_MS: number;
+/**
+ * Stale-schedule guard window. After the bounded transient retries are
+ * exhausted the scheduler arms a single long timer this far out so a blip
+ * during a proactive fire cannot leave refresh idle indefinitely — the
+ * worst case becomes one degraded window, after which a fresh refresh is
+ * attempted. Also the threshold {@link AiCredentialRefreshScheduler.ensureArmed}
+ * uses to decide a previously-armed scheduler has gone stale.
+ */
+export declare const STALE_REARM_MS: number;
+/**
+ * Outcome of a proactive refresh attempt, returned by the caller-supplied
+ * {@link AiCredentialRefreshDeps.refresh}:
+ *
+ * - `ok` — a fresh credential was minted; `expiresAt` is its ISO expiry, or
+ *   `null` for a static token (no further refresh needed).
+ * - `transient` — a mediator/transport blip; the scheduler re-arms a bounded
+ *   retry and ultimately a stale-schedule guard.
+ * - `terminal` — the credential/account is genuinely unusable; the scheduler
+ *   stops re-arming and leaves the reactive 401 path as the safety net.
+ */
+export type AiRefreshOutcome = {
+    status: "ok";
+    expiresAt: string | null;
+} | {
+    status: "transient";
+} | {
+    status: "terminal";
+};
 /**
  * Caller-supplied side effects the scheduler invokes.
  *
- * - `refresh()` runs the actual mint round-trip; returns the new ISO
- *   expiry on success (or `null` for static tokens) and `undefined` on
- *   failure (the scheduler stays idle until the next external arming).
- * - `log()` receives operator-facing single-line strings.
+ * - `refresh()` runs the actual mint round-trip and classifies the result
+ *   into an {@link AiRefreshOutcome}.
+ * - `log()` receives operator-facing single-line strings (info level).
+ * - `logError()` receives failure strings that MUST surface at error level
+ *   (visible in `skaile session logs` and the debug panel). Defaults to
+ *   `log` when omitted.
  * - `now()` is dependency-injected for deterministic timer tests; defaults
  *   to `Date.now`.
  * - `setTimeoutImpl` / `clearTimeoutImpl` are injected for fake-timer
  *   tests; default to the host's `setTimeout` / `clearTimeout`.
  */
 export interface AiCredentialRefreshDeps {
-    refresh: () => Promise<string | null | undefined>;
+    refresh: () => Promise<AiRefreshOutcome>;
     log: (line: string) => void;
+    logError?: (line: string) => void;
     now?: () => number;
     setTimeoutImpl?: (handler: () => void, ms: number) => {
         unref?: () => void;
@@ -53,10 +74,21 @@ export interface AiCredentialRefreshScheduler {
     /**
      * Arm the timer for `expiresAtIso - marginMs`. Cancels any prior pending
      * fire. `null` / `undefined` cancels without re-arming (static PAT
-     * semantics). If the fire-time has already passed, runs `refresh()` on
-     * the next tick.
+     * semantics) and marks the credential static. If the fire-time has
+     * already passed, runs `refresh()` on the next tick. Records the
+     * credential as healthy (resets the transient-retry counter and the
+     * stale clock).
      */
     schedule(expiresAtIso: string | null | undefined): void;
+    /**
+     * Re-arm hook for the configure/wake path. Kicks a fresh refresh on the next
+     * tick when the scheduler is idle (prior terminal failure), stale (no
+     * successful fire in {@link STALE_REARM_MS}), or currently parked on the long
+     * stale-schedule guard — so a container waking during a degraded window
+     * recovers eagerly instead of waiting out the guard. No-op when a healthy
+     * refresh timer is already pending or the credential is a static PAT.
+     */
+    ensureArmed(): void;
     /** Cancel any pending fire. Idempotent. */
     cancel(): void;
     /**

package/dist/runner/src/ai-credential-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-credential-refresh.d.ts","sourceRoot":"","sources":["../../../runner/src/ai-credential-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAgB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IAC7E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC;IACxD,2CAA2C;IAC3C,MAAM,IAAI,IAAI,CAAC;IACf;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,uBAAuB,GAC5B,4BAA4B,CA8E9B"}
+{"version":3,"file":"ai-credential-refresh.d.ts","sourceRoot":"","sources":["../../../runner/src/ai-credential-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAgB,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAqB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IAC7E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC;IACxD;;;;;;;OAOG;IACH,WAAW,IAAI,IAAI,CAAC;IACpB,2CAA2C;IAC3C,MAAM,IAAI,IAAI,CAAC;IACf;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,uBAAuB,GAC5B,4BAA4B,CAgJ9B"}

package/dist/runner/src/ai-credential-retry.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared classification + bounded-retry policy for AI-credential mint failures.
+ * The single place that decides transient (`backend-error`) vs terminal
+ * (`revoked` / `not-configured` / `provider-error`), consumed by both the
+ * reactive 401 path and the proactive scheduler so they never drift. Rationale
+ * (shared-seat non-amplification) in `runner/CLAUDE.md` § AI Credential Mediation.
+ *
+ * @docLink packages/runner/dev-guide#ai-credential-mediation
+ */
+import type { CredentialMint } from "@skaile/workspaces/types";
+/** The discriminated failure codes a {@link CredentialMint} can carry. */
+export type MintFailureCode = Extract<CredentialMint, {
+    ok: false;
+}>["code"];
+/**
+ * Maximum total mint attempts (initial try + retries) on the transient path.
+ * Three attempts spanning the backoff below ride out a ~7s backend redeploy.
+ */
+export declare const MINT_RETRY_MAX_ATTEMPTS = 3;
+/**
+ * Whether a failed mint should be retried. Only `backend-error` (internal
+ * mediator outage) is transient; `not-configured`, `revoked`, and
+ * `provider-error` are terminal credential/account states where a retry
+ * cannot help.
+ */
+export declare function isTransientMintFailure(code: MintFailureCode): boolean;
+/**
+ * Backoff before the Nth retry (`retryNumber = 1` is the delay before the 2nd
+ * attempt). Exponential from a 2s base, capped at 5s, so three attempts span
+ * roughly 6s — enough to ride a backend redeploy without unbounded waiting.
+ */
+export declare function mintRetryDelayMs(retryNumber: number): number;
+/**
+ * Run `attempt` up to {@link MINT_RETRY_MAX_ATTEMPTS} times, sleeping
+ * {@link mintRetryDelayMs} between tries, stopping early on success or a
+ * terminal failure. Returns the final mint: ok, a terminal failure, or the
+ * last transient failure once the cap is reached. `sleep` is injected so tests
+ * stay deterministic.
+ */
+export declare function retryTransientMint(attempt: () => Promise<CredentialMint>, deps: {
+    sleep: (ms: number) => Promise<void>;
+    maxAttempts?: number;
+    onRetry?: (info: {
+        attempt: number;
+        nextDelayMs: number;
+        code: MintFailureCode;
+    }) => void;
+}): Promise<CredentialMint>;
+/**
+ * Truncated SHA-256 of the just-rejected access token. Sent as the OPTIONAL
+ * `rejectedFingerprint` on a retry-401 `host.refresh_credential` so the platform
+ * can coalesce concurrent rotations of the same dead token (single-flight). It
+ * is non-reversible and carries no secret material (16 hex chars = 64 bits,
+ * collision-safe for coalescing). Returns `undefined` for an empty/missing
+ * token so the field is simply omitted.
+ */
+export declare function computeRejectedFingerprint(accessToken: string | null | undefined): string | undefined;
+/** The wire input for a `host.refresh_credential` invocation (ai-credentials). */
+export interface RefreshCredentialInput {
+    kind: "ai-credentials";
+    id: string;
+    reason: "refresh" | "retry-401";
+    /** Truncated fingerprint of the just-rejected token; only on retry-401. */
+    rejectedFingerprint?: string;
+}
+/**
+ * Build the `host.refresh_credential` input. The optional
+ * `rejectedFingerprint` is attached ONLY on a `retry-401` (where a token was
+ * just rejected) and ONLY when a current token is on disk to fingerprint — on a
+ * proactive `refresh` there is no rejected token, so the field is omitted.
+ * Today's platform ignores the unknown field; the single-flight mediator uses
+ * it to coalesce concurrent rotations of the same dead token.
+ */
+export declare function buildRefreshCredentialInput(args: {
+    configId: string;
+    reason: "refresh" | "retry-401";
+    rejectedToken?: string | null;
+}): RefreshCredentialInput;
+//# sourceMappingURL=ai-credential-retry.d.ts.map

package/dist/runner/src/ai-credential-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-credential-retry.d.ts","sourceRoot":"","sources":["../../../runner/src/ai-credential-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAKzC;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAErE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,EACtC,IAAI,EAAE;IACJ,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,eAAe,CAAA;KAAE,KAAK,IAAI,CAAC;CAC3F,GACA,OAAO,CAAC,cAAc,CAAC,CAWzB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC,MAAM,GAAG,SAAS,CAGpB;AAED,kFAAkF;AAClF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,gBAAgB,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,sBAAsB,CASzB"}

package/dist/runner/src/credential-rotated.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Inbound `credentialRotated` broadcast handler — the runner's receive side of
+ * the platform single-flight mediator's rotation broadcast (re-pull instead of
+ * each container force-refreshing). Dormant until the platform ships it. Wire
+ * shape + delivery-channel contract in root `MIGRATION.md`.
+ * @docLink packages/runner/dev-guide#ai-credential-mediation
+ */
+import type { CredentialMint } from "@skaile/workspaces/types";
+/** `LogSource.subkind` the platform tags its credential-rotation broadcast with. */
+export declare const AI_PROVIDER_CREDENTIAL_SUBKIND = "ai-provider-credential";
+/**
+ * Whether an inbound message is the platform's credential-rotation broadcast.
+ * Pure predicate — tolerant of unknown shapes so a malformed message is simply
+ * not matched rather than throwing on the command ingress path.
+ */
+export declare function isCredentialRotatedSignal(msg: unknown): boolean;
+/**
+ * Handle a credential-rotation broadcast: re-pull the fresh token through the
+ * supplied `repull` (a `host.refresh_credential { reason: 'refresh' }` round
+ * trip that rewrites `.credentials.json`). Idempotent and best-effort — a
+ * failed re-pull is logged at error level and the reactive 401 path remains the
+ * safety net; it never throws to the caller.
+ *
+ * The serve.ts wiring passes `mintAndPersistAiCredential` as `repull`, whose
+ * success path also re-arms the proactive refresh scheduler against the fresh
+ * expiry — so a re-pull both rewrites the file and re-schedules in one step.
+ */
+export declare function handleCredentialRotatedSignal(deps: {
+    repull: () => Promise<CredentialMint>;
+    log: (line: string) => void;
+    logError: (line: string) => void;
+}): Promise<void>;
+//# sourceMappingURL=credential-rotated.d.ts.map

package/dist/runner/src/credential-rotated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-rotated.d.ts","sourceRoot":"","sources":["../../../runner/src/credential-rotated.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,2BAA2B,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAa/D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,MAAM,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB"}

package/dist/runner/src/resource-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-handler.d.ts","sourceRoot":"","sources":["../../../runner/src/resource-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAcH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EACV,UAAU,EAEV,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAOlC;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,OAAO,CAAC,IAAI,CAAC,CAyCf;AAcD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAI/E;AAuBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,IAAI,CAiGN"}
+{"version":3,"file":"resource-handler.d.ts","sourceRoot":"","sources":["../../../runner/src/resource-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EACV,UAAU,EAEV,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAOlC;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,OAAO,CAAC,IAAI,CAAC,CAyCf;AAcD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAI/E;AAuBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,IAAI,CAiHN"}

package/dist/runner/src/serve-credentials.d.ts

@@ -68,4 +68,18 @@ export declare function mergeAndRewriteCredentialsFile(home: string, accessToken
  * @docLink packages/runner/dev-guide#ai-credential-mediation
  */
 export declare function extractClaudeAiOauthExpiresAt(json: string): string | null;
+/**
+ * Read the current access token from the on-disk credentials file at
+ * `<home>/.claude/.credentials.json`. Supports both the nested
+ * `claudeAiOauth.accessToken` shape the platform writes and the flat
+ * top-level `accessToken` some SDK builds use.
+ *
+ * Used by the 401-mediation path to fingerprint the just-rejected token (the
+ * one currently on disk) before asking the platform to rotate it, so the
+ * platform can coalesce concurrent rotations of the same dead token. Returns
+ * `null` when the file is absent, unreadable, or carries no token.
+ *
+ * @docLink packages/runner/dev-guide#ai-credential-mediation
+ */
+export declare function readCurrentClaudeAccessToken(home: string): string | null;
 //# sourceMappingURL=serve-credentials.d.ts.map

package/dist/runner/src/serve-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-credentials.d.ts","sourceRoot":"","sources":["../../../runner/src/serve-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iCAAiC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqBzE"}
+{"version":3,"file":"serve-credentials.d.ts","sourceRoot":"","sources":["../../../runner/src/serve-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iCAAiC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqBzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAaxE"}

package/dist/runner/src/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../runner/src/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAkBH,OAAO,EAGL,gBAAgB,EAKjB,MAAM,+BAA+B,CAAC;AAkBvC,OAAO,KAAK,EAEV,UAAU,EAEV,wBAAwB,EAGxB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AA4BlC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAE7B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,sBAAsB,CAAC;AAkB9B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,GACjC,IAAI,CAMN;AAkFD,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,UAAU,EAAE,eAAe,GAAG,IAAI,EAClC,UAAU,EAAE,OAAO,GAClB,wBAAwB,CAI1B;AAaD;;;;;;;;;GASG;AACH,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,GAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAoCzE;AA0CD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA06ExE"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../runner/src/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAkBH,OAAO,EAGL,gBAAgB,EAKjB,MAAM,+BAA+B,CAAC;AAkBvC,OAAO,KAAK,EAEV,UAAU,EAEV,wBAAwB,EAGxB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAkClC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAG7B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,sBAAsB,CAAC;AAkB9B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,GACjC,IAAI,CAMN;AAkFD,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,UAAU,EAAE,eAAe,GAAG,IAAI,EAClC,UAAU,EAAE,OAAO,GAClB,wBAAwB,CAI1B;AAaD;;;;;;;;;GASG;AACH,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,GAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAoCzE;AA0CD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAs8ExE"}

package/dist/sdk/asset-manager.js

@@ -1,4 +1,4 @@
-export { AssetManager, parseCanonicalLockKey } from '../chunk-WVWX76IB.js';
+export { AssetManager, parseCanonicalLockKey } from '../chunk-B5LHVPE2.js';
 export { createScaffold, deployAll, installAgent, removeAsset } from '../chunk-4A2LAEX6.js';
 import '../chunk-FBIQ4QPF.js';
 import '../chunk-CFCSDZYF.js';

package/dist/sdk/index.js

@@ -1,6 +1,6 @@
 import { AgentClient } from '../chunk-SZ3SIVZQ.js';
-import { startAgentServer } from '../chunk-W23HDR6W.js';
-import '../chunk-LJIE3PGF.js';
+import { startAgentServer } from '../chunk-RM2KAMGD.js';
+import '../chunk-22Q5R7SM.js';
 import '../chunk-X5YPJV4N.js';
 import '../chunk-O7SG5PC2.js';
 import '../chunk-7QBNJTTQ.js';
@@ -15,10 +15,10 @@ import '../chunk-BMQKMOQY.js';
 import '../chunk-GAH4YRCI.js';
 import '../chunk-KM6DCR7A.js';
 import '../chunk-LV2HPH3C.js';
-import '../chunk-CMZWYMGD.js';
+import '../chunk-3P7HBSSD.js';
 import '../chunk-OVRSNIKJ.js';
 import '../chunk-WLWHOA3S.js';
-import '../chunk-P7CIT445.js';
+import '../chunk-C5UK3JK7.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-X46FY45B.js';
 import '../chunk-DEYYRFQU.js';

package/dist/sdk/runner.js

@@ -1,5 +1,5 @@
-export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, stripStaleHtmlTail, touchSession, writeClaudeCodeCredentialsFile } from '../chunk-W23HDR6W.js';
-import '../chunk-LJIE3PGF.js';
+export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, stripStaleHtmlTail, touchSession, writeClaudeCodeCredentialsFile } from '../chunk-RM2KAMGD.js';
+import '../chunk-22Q5R7SM.js';
 import '../chunk-X5YPJV4N.js';
 import '../chunk-O7SG5PC2.js';
 import '../chunk-7QBNJTTQ.js';
@@ -14,10 +14,10 @@ import '../chunk-BMQKMOQY.js';
 import '../chunk-GAH4YRCI.js';
 import '../chunk-KM6DCR7A.js';
 import '../chunk-LV2HPH3C.js';
-import '../chunk-CMZWYMGD.js';
+import '../chunk-3P7HBSSD.js';
 import '../chunk-OVRSNIKJ.js';
 import '../chunk-WLWHOA3S.js';
-import '../chunk-P7CIT445.js';
+import '../chunk-C5UK3JK7.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-X46FY45B.js';
 import '../chunk-DEYYRFQU.js';

package/dist/secrets/index.js

@@ -1,5 +1,5 @@
-export { CredentialLifecycleService, EnvSecretsProvider, LocalSecretsProvider, SecretsRouter, VERSION } from '../chunk-6LW7Q53Z.js';
-export { ProviderUnavailableError, SecretAccessDeniedError, SecretExpiredError, SecretNotFoundError, SecretsError } from '../chunk-ZDKJHQY2.js';
+export { CredentialLifecycleService, EnvSecretsProvider, LocalSecretsProvider, SecretsRouter, VERSION } from '../chunk-6BEGKO2Q.js';
+export { ProviderUnavailableError, SecretAccessDeniedError, SecretExpiredError, SecretNotFoundError, SecretsError } from '../chunk-JXT46QFC.js';
 import '../chunk-NSBPE2FW.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/tui/index.js

@@ -1,5 +1,5 @@
-import { createAgentSession } from '../chunk-W23HDR6W.js';
-import '../chunk-LJIE3PGF.js';
+import { createAgentSession } from '../chunk-RM2KAMGD.js';
+import '../chunk-22Q5R7SM.js';
 import '../chunk-X5YPJV4N.js';
 import '../chunk-O7SG5PC2.js';
 import '../chunk-7QBNJTTQ.js';
@@ -14,10 +14,10 @@ import '../chunk-BMQKMOQY.js';
 import '../chunk-GAH4YRCI.js';
 import '../chunk-KM6DCR7A.js';
 import '../chunk-LV2HPH3C.js';
-import '../chunk-CMZWYMGD.js';
+import '../chunk-3P7HBSSD.js';
 import '../chunk-OVRSNIKJ.js';
 import { loadConnectorDeclarations } from '../chunk-WLWHOA3S.js';
-import '../chunk-P7CIT445.js';
+import '../chunk-C5UK3JK7.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-X46FY45B.js';
 import '../chunk-DEYYRFQU.js';

package/dist/workspace-plugin/index.js

@@ -1,4 +1,4 @@
-export { PluginStore, WorkspacePlugin, buildClaudePluginFiles, resolveProjectDir } from '../chunk-LJIE3PGF.js';
+export { PluginStore, WorkspacePlugin, buildClaudePluginFiles, resolveProjectDir } from '../chunk-22Q5R7SM.js';
 export { err, ok, okJson } from '../chunk-X5YPJV4N.js';
 import '../chunk-JB35MVBN.js';
 import '../chunk-NSBPE2FW.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaile/workspaces",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "description": "Skaile workspaces runtime — types, core, bridge, runner, store, connectors, and supporting layers as one publishable package",
   "type": "module",
   "packageManager": "bun@1.3.9",

package/dist/asset-feeds-W6JNAGNQ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../cli/src/asset-feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA+DA,eAAe,aAAA,GAAyE;AACtF,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,EAAE,kBAAA,EAAmB,EAAG,EAAE,eAAe,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI;AAAA,MACpE,OAAO,4BAAmB,CAAA;AAAA,MAC1B,OAAO,oBAA4B;AAAA,KACpC,CAAA;AACD,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,aAAA,EAAc,EAAG,SAAS,CAAA;AACvD,MAAA,MAAM,IAAA,GAAA,CAAQ,MAAM,OAAA,CAAQ,aAAA,EAAc,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,UAAU,CAAC,CAAA;AACzF,MAAA,MAAM,UAA0B,EAAC;AACjC,MAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,QAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3B,QAAA,KAAA,MAAW,CAAA,IAAK,SAAS,GAAA,CAAI,IAAA,EAAM,WAAW,GAAA,CAAI,IAAI,EAAE,CAAA,EAAG;AACzD,UAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,QAChB;AAAA,MACF;AACA,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAYA,eAAe,YAAY,UAAA,EAIxB;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACjE,IAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,MAAM,oBAAA,CAAqB,EAAE,YAAY,CAAA;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,MAAA,MAAM,OAAA,GAA0B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,IAAA,EAAO,EAAE,IAAA,IAAsB,OAAA;AAAA,QAC/B,WAAA,EAAa,EAAE,WAAA,IAAe,EAAA;AAAA,QAC9B,MAAA,EAAQ,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,CAAA;AAAA,QACvB,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,YAAY,CAAA,CAAE,UAAA;AAAA,QACd,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OACjB,CAAE,CAAA;AAIF,MAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,MAAM,CAAA;AACxC,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,IACnC,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG3D,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAK,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,IAAI,OAAA,EAAS,IAAI,KAAA,EAAM;AAAA,EAC3C;AACF;AAGA,eAAe,YAAY,MAAA,EAA2C;AACpE,EAAA,MAAM,KAAM,MAAA,CAA4D,WAAA;AACxE,EAAA,IAAI,OAAO,EAAA,KAAO,UAAA,EAAY,OAAO,EAAC;AACtC,EAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,IAAA,CAAK,MAAM,CAAA;AACpC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,UAAU,EAAC;AAC7C;AAQA,SAAS,aAAa,EAAA,EAAsD;AAC1E,EAAA,OAAO,GAAG,MAAA,EAAO;AACnB;AAGA,SAAS,GAAA,CAAI,QAAqB,OAAA,EAAwC;AACxE,EAAA,OAAO,QAAQ,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAM,CAAE,CAAA;AACnD;AAQA,eAAsB,gBAAA,CACpB,IACA,UAAA,EAC0B;AAC1B,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,aAAA,EAAc,EAAG,WAAA,CAAY,UAAU,CAAC,CAAC,CAAA;AAClF,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP,GAAG,GAAA,CAAI,QAAA,EAAU,YAAA,CAAa,EAAE,CAAC,CAAA;AAAA,MACjC,GAAG,GAAA,CAAI,SAAA,EAAW,IAAA,CAAK,OAAO,CAAA;AAAA,MAC9B,GAAG,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,OAAO;AAAA,KAC/B;AAAA,IACA,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAO,CAAC,GAAG,KAAK,KAAA,EAAO,GAAG,MAAM,KAAK;AAAA,GACvC;AACF","file":"asset-feeds-W6JNAGNQ.js","sourcesContent":["/**\n * asset-feeds.ts — gather installable assets from every feed the manage TUI\n * surfaces.\n *\n * Three feeds, normalized into `CatalogEntry`:\n * - **Project sources** — `skaile.yaml` `sources:` entries (scanned via\n *   `AssetManager.search()`; the new `sources:` field is merged into the\n *   legacy repositories map in `AssetManager.loadConfig`).\n * - **Local libraries** — user authoring places from `LocalIndex` (filesystem\n *   scan of each library's `path`).\n * - **Remote store** — the configured catalog source when `catalog.url` is\n *   not `local`. Failures are non-fatal — they surface as notes.\n */\n\nimport { existsSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  type AssetKind,\n  type CatalogDomain,\n  type CatalogEntry,\n  scanRepo,\n} from \"@skaile/workspaces/core\";\n\n/** One non-fatal note returned to the caller for surfacing in the UI. */\nexport interface FeedNote {\n  feed: \"sources\" | \"libraries\" | \"store\";\n  message: string;\n}\n\n/**\n * Which feed an asset came from. This is the top-level grouping axis in the\n * manage TUI (\"where is this skill coming from?\") and is intentionally distinct\n * from `publisher` (asset-intrinsic identity): the same publisher can legitimately\n * appear under more than one origin (e.g. a github repo you added as a `source`\n * that is also listed in the remote `store`).\n */\nexport type AssetOrigin = \"source\" | \"library\" | \"store\";\n\n/** A catalog entry tagged with the feed it was gathered from. */\nexport interface OriginEntry {\n  origin: AssetOrigin;\n  entry: CatalogEntry;\n}\n\nexport interface AssetFeedResult {\n  entries: OriginEntry[];\n  /**\n   * Display-only domain metadata, keyed (by the consumer) on `slug`. Populated\n   * from the store's `catalog.listDomains` when the connected catalog source\n   * exposes it; empty otherwise. The manage TUI joins `entry.domainSlug` → a\n   * domain for grouping headers, descriptions, and relation badges.\n   */\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}\n\n/**\n * Pull assets from local libraries (the authoring places under\n * `~/.skaile/libraries/<name>/`, not the `~/.skaile/sources/` cache). Each\n * library's `path` is scanned with `scanRepo` and tagged with\n * `repository = \"library:<name>\"` so the manage TUI groups them into their\n * own headers.\n */\nasync function libraryAssets(): Promise<{ entries: CatalogEntry[]; notes: FeedNote[] }> {\n  const notes: FeedNote[] = [];\n  try {\n    const [{ openLibraryManager }, { skaileHomeDir }] = await Promise.all([\n      import(\"./open-library.ts\"),\n      import(\"@skaile/workspaces/library\"),\n    ]);\n    const { manager, close } = await openLibraryManager();\n    try {\n      const sourcesDir = path.join(skaileHomeDir(), \"sources\");\n      const libs = (await manager.listLibraries()).filter((l) => !l.path.startsWith(sourcesDir));\n      const entries: CatalogEntry[] = [];\n      for (const lib of libs) {\n        if (!existsSync(lib.path)) continue;\n        for (const e of scanRepo(lib.path, `library:${lib.name}`)) {\n          entries.push(e);\n        }\n      }\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    notes.push({\n      feed: \"libraries\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], notes };\n  }\n}\n\n/**\n * Pull a (best-effort) snapshot of the connected remote store catalog.\n *\n * - Returns no entries when the resolved catalog is local-only or the host\n *   is unreachable (the failure becomes a note, not an exception).\n * - Maps `CatalogAsset` → `CatalogEntry`, carrying `publisher`, `repo`, and\n *   `category` straight through and using `source = \"store://<id>\"`; per-file\n *   `source` paths are not available for remote assets so the canonical ref is\n *   a stable placeholder.\n */\nasync function storeAssets(projectDir: string): Promise<{\n  entries: CatalogEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { resolveCatalogSource } = await import(\"./open-library.ts\");\n    const { source, close } = await resolveCatalogSource({ projectDir });\n    try {\n      const assets = await source.listAssets();\n      const entries: CatalogEntry[] = assets.map((a) => ({\n        name: a.name,\n        kind: (a.kind as AssetKind) ?? \"skill\",\n        description: a.description ?? \"\",\n        source: `store://${a.id}`,\n        publisher: a.publisher,\n        repo: a.repo,\n        domainSlug: a.domainSlug,\n        category: a.category,\n        version: a.version,\n        requires: [],\n        dependencies: [],\n      }));\n      // Domains are optional on the catalog source — only the store backend\n      // (post Part 4 `catalog.listDomains`) exposes them. Duck-type the call so\n      // older sources and the local catalog degrade to no domains, not an error.\n      const domains = await loadDomains(source);\n      return { entries, domains, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    // Local-only catalog throws a recognizable message — silence it; absence\n    // is the user's choice, not an error.\n    if (!/local/i.test(msg)) {\n      notes.push({ feed: \"store\", message: msg });\n    }\n    return { entries: [], domains: [], notes };\n  }\n}\n\n/** Optional `listDomains` capability — returns `[]` when the source lacks it. */\nasync function loadDomains(source: unknown): Promise<CatalogDomain[]> {\n  const fn = (source as { listDomains?: () => Promise<CatalogDomain[]> }).listDomains;\n  if (typeof fn !== \"function\") return [];\n  const domains = await fn.call(source);\n  return Array.isArray(domains) ? domains : [];\n}\n\n/**\n * Project-source feed: leans on `AssetManager.search()`, which now merges\n * `skaile.yaml`'s `sources:` field into the repositories map. Provided as a\n * function rather than an inline call so the caller can supply a fresh\n * `AssetManager` instance.\n */\nfunction sourceAssets(am: { search: () => CatalogEntry[] }): CatalogEntry[] {\n  return am.search();\n}\n\n/** Tag a flat entry list with a single origin. */\nfunction tag(origin: AssetOrigin, entries: CatalogEntry[]): OriginEntry[] {\n  return entries.map((entry) => ({ origin, entry }));\n}\n\n/**\n * Run all three feeds and return a single normalized result.\n *\n * Feeds run in parallel where possible — the store fetch is the slow one\n * (one HTTP call) and is fired alongside the local library walk.\n */\nexport async function gatherAssetFeeds(\n  am: { search: () => CatalogEntry[] },\n  projectDir: string,\n): Promise<AssetFeedResult> {\n  const [libs, store] = await Promise.all([libraryAssets(), storeAssets(projectDir)]);\n  return {\n    entries: [\n      ...tag(\"source\", sourceAssets(am)),\n      ...tag(\"library\", libs.entries),\n      ...tag(\"store\", store.entries),\n    ],\n    domains: store.domains,\n    notes: [...libs.notes, ...store.notes],\n  };\n}\n"]}