@skaile/workspaces 0.53.0 → 1.1.0

package/dist/chunk-VE2UIJ7Y.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../connectors/src/materialized-connectors.ts","../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;;;AAiBO,SAAS,2BAAA,CAA4B,UAAkB,IAAA,EAAoC;AAChG,EAAA,MAAM,EAAE,MAAM,IAAA,EAAM,IAAA,KAAS,gBAAA,CAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAC5E,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,IAAI,CAAA;AACnC,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,EAAA;AAAA,IACA,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,MAAA,KAAW,YAAA,GAAe,YAAA,GAAe;AAAA,GACxD;AACA,EAAA,IAAI,OAAO,KAAK,KAAA,KAAU,QAAA,IAAY,KAAK,KAAA,EAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AACpE,EAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpD,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,QAAA,IAAY,KAAK,cAAA,EAAgB;AAClE,IAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,cAAA;AAAA,EAC7B;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,OAAA,IAAW,IAAA,CAAK,SAAS,MAAA,EAAQ,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpE,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACpF,IAAA,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AAAA,EACtB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,IAAA,CAAK,KAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA;AAAA,MAC7B,GAAI,CAAA,CAAE,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA,EAAE,GAAI,EAAC;AAAA,MAC7D,GAAI,OAAO,CAAA,CAAE,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,MACzD,GAAI,OAAO,CAAA,CAAE,iBAAA,KAAsB,SAAA,GAC/B,EAAE,iBAAA,EAAmB,CAAA,CAAE,iBAAA,EAAkB,GACzC,EAAC;AAAA,MACL,GAAI,OAAO,CAAA,CAAE,cAAA,KAAmB,QAAA,GAAW,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI;AAAC,KACrF;AAAA,EACF;AACA,EAAA,MAAM,WAAA,GAAc,KAAK,IAAA,EAAK;AAC9B,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,YAAA,GAAe,WAAA;AAChD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,kBAAA,CAAmB,MAA4B,YAAA,EAA4B;AAClF,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,YAAA,EAAc,MAAM,CAAC,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACpE,EAAA,IAAA,CAAK,OAAA,GAAU,EAAE,GAAI,MAAA,EAAoC,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACnF;AAGO,SAAS,4CAAA,CACd,oBACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,kBAAA,EAAoB,IAAI,CAAA;AACzC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACnC,EAAA,IAAI,CAAC,UAAA,CAAW,EAAE,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,2BAAA,CAA4B,EAAA,EAAI,IAAI,CAAA;AACjD,EAAA,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,gBAAgB,CAAC,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,sCAAsC,UAAA,EAA4C;AAChG,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,0BAA0B,CAAA;AACxD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAC/B,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAC3B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,CAAE,aAAY,EAAG;AAClC,MAAA,MAAM,IAAA,GAAO,4CAAA,CAA6C,IAAA,EAAM,IAAI,CAAA;AACpE,MAAA,IAAI,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;;;ACpFA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAIT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,GAAA,IAAO,EAAE,CAAA,EAAG;AAC9D,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,EAAO,EAAE,IAAI,IAAI,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,GAAA,CAAI,IAAA,EAAqC,EAAA,EAAY,IAAA,EAAiC;AACpF,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAAqC,EAAA,EAAqB;AAC9D,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAAqC,EAAA,EAA6C;AACxF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,CAAA;AACrF,MAAA,OAAO,MAAA;AACT,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB;AAAA,EACrB,MAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AChbA,IAAM,YAAY,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,UAAU,CAAA;AAahE,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GACJ,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,UAAA,CAAW,MAAA,GAAS,CAAA,GAC5C,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA,GACrD,EAAC;AAKP,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,KAAA,MAAW,KAAK,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAC3C,EAAA,KAAA,MAAW,CAAA,IAAK,qCAAA,CAAsC,UAAU,CAAA,EAAG;AACjE,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AAClB,MAAA,SAAA,CAAU,IAAA;AAAA,QACR,CAAA,wBAAA,EAA2B,EAAE,EAAE,CAAA,+CAAA;AAAA,OACjC;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAA,EAAI,CAAC,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAG9C,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD;AAYO,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACxC,IAAA;AAAA,EACA,WAAA;AAAA,EACT,WAAA,CACE,OAAA,EACA,IAAA,EACA,WAAA,EACA;AACA,IAAA,KAAA,CAAM,oBAAoB,WAAW,CAAA,oBAAA,EAAuB,IAAI,CAAA,QAAA,EAAM,OAAO,CAAA,CAAE,CAAA;AAC/E,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACrB;AACF;AA8BA,eAAsB,4BAAA,CACpB,WAAA,EACA,OAAA,EACA,aAAA,EAC6B;AAC7B,EAAA,OAAA,CAAQ,MAAM,sBAAA,CAAuB,WAAA,EAAa,OAAA,EAAS,aAAA,EAAe,SAAS,CAAA,EAAG,KAAA;AACxF;AA6BA,eAAsB,sBAAA,CACpB,WAAA,EACA,OAAA,EACA,aAAA,EACA,SAA8C,SAAA,EACZ;AAClC,EAAA,IAAI,WAAA,CAAY,SAAS,SAAA,EAAW;AAClC,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,WAAA,EAAc,YAAY,EAAE,CAAA,gHAAA;AAAA,OAE9B;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,EAAE,aAAa,WAAA,CAAY,EAAA,EAAI,QAAQ,CAAA;AAC1E,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,MAAM,IAAI,uBAAA,CAAwB,MAAA,CAAO,SAAS,MAAA,CAAO,IAAA,EAAM,YAAY,EAAE,CAAA;AAAA,IAC/E;AAGA,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,IAAI,uBAAA;AAAA,QACR,kCAAA;AAAA,QACA,eAAA;AAAA,QACA,WAAA,CAAY;AAAA,OACd;AAAA,IACF;AACA,IAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,OAAO,SAAA,EAAU;AAAA,EAC5D;AAIA,EAAA,MAAM,MAAM,WAAA,CAAY,IAAA;AACxB,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,GAAA,IAAO,OAAA,EAAS,KAAA,GAAQ,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,OAAA,IACtC,GAAA,EAAK,UAAA,CAAW,MAAM,CAAA,EAAG,KAAA,GAAQ,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,OAC7D,KAAA,GAAQ,GAAA;AACb,EAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,IAAA,EAAK;AAClC","file":"chunk-VE2UIJ7Y.js","sourcesContent":["/**\n * Derive runtime connector declarations from the platform-materialized\n * `.skaile/assets/connector/<name>/CONNECTOR.md` projection.\n *\n * Connector mirror of MCP's `loadMaterializedMcpDeclarations` /\n * `deriveSingleMaterializedMcpDeclaration`. The generated `CONNECTOR.md` carries\n * a RUNTIME declaration (driver/access/auth/mode/options/mount) — distinct from\n * the catalog `CONNECTOR.md` parsed by `core/manifest.ts:fromConnectorMd`\n * (entry/fields). Driver is referenced by name (first-party; resolved via the\n * connector registry — no code-loading).\n */\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { parseFrontmatter } from \"@skaile/workspaces/core\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/** Parse a generated CONNECTOR.md (runtime projection) into a ConnectorDeclaration. */\nexport function fromMaterializedConnectorMd(filePath: string, name: string): ConnectorDeclaration {\n  const { data: meta, body } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n  const id = String(meta.name ?? name);\n  const decl: ConnectorDeclaration = {\n    id,\n    driver: String(meta.driver ?? \"\"),\n    access: meta.access === \"read-write\" ? \"read-write\" : \"read-only\",\n  };\n  if (typeof meta.label === \"string\" && meta.label) decl.label = meta.label;\n  if (typeof meta.auth === \"string\") decl.auth = meta.auth;\n  if (typeof meta.providerLinkId === \"string\" && meta.providerLinkId) {\n    decl.providerLinkId = meta.providerLinkId;\n  }\n  if (meta.mode === \"agent\" || meta.mode === \"sync\") decl.mode = meta.mode;\n  if (meta.options && typeof meta.options === \"object\" && !Array.isArray(meta.options)) {\n    decl.options = meta.options as Record<string, unknown>;\n  }\n  if (meta.mount && typeof meta.mount === \"object\" && !Array.isArray(meta.mount)) {\n    const m = meta.mount as Record<string, unknown>;\n    decl.mount = {\n      source: String(m.source ?? \"\"),\n      ...(m.target !== undefined ? { target: String(m.target) } : {}),\n      ...(typeof m.watch === \"boolean\" ? { watch: m.watch } : {}),\n      ...(typeof m.exposeAccessToken === \"boolean\"\n        ? { exposeAccessToken: m.exposeAccessToken }\n        : {}),\n      ...(typeof m.accessTokenTTL === \"number\" ? { accessTokenTTL: m.accessTokenTTL } : {}),\n    };\n  }\n  const trimmedBody = body.trim();\n  if (trimmedBody.length > 0) decl.instructions = trimmedBody;\n  return decl;\n}\n\n/** Provide `.instance.json` config entries as defaults under the declaration's options (the CONNECTOR.md declaration wins on key collision). */\nfunction foldInstanceConfig(decl: ConnectorDeclaration, instancePath: string): void {\n  if (!existsSync(instancePath)) return;\n  let parsed: { config?: Record<string, unknown> };\n  try {\n    parsed = JSON.parse(readFileSync(instancePath, \"utf8\"));\n  } catch {\n    return;\n  }\n  const config = parsed.config;\n  if (!config || typeof config !== \"object\" || Array.isArray(config)) return;\n  decl.options = { ...(config as Record<string, unknown>), ...(decl.options ?? {}) };\n}\n\n/** Derive a single materialized connector declaration; null when no CONNECTOR.md. */\nexport function deriveSingleMaterializedConnectorDeclaration(\n  connectorAssetsDir: string,\n  name: string,\n): ConnectorDeclaration | null {\n  const sub = join(connectorAssetsDir, name);\n  const md = join(sub, \"CONNECTOR.md\");\n  if (!existsSync(md)) return null;\n  const decl = fromMaterializedConnectorMd(md, name);\n  foldInstanceConfig(decl, join(sub, \".instance.json\"));\n  return decl;\n}\n\n/** Scan `<projectDir>/.skaile/assets/connector/*` for materialized connectors. */\nexport function loadMaterializedConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const root = join(projectDir, \".skaile/assets/connector\");\n  if (!existsSync(root)) return [];\n  const out: ConnectorDeclaration[] = [];\n  for (const name of readdirSync(root)) {\n    try {\n      const sub = join(root, name);\n      if (!statSync(sub).isDirectory()) continue;\n      const decl = deriveSingleMaterializedConnectorDeclaration(root, name);\n      if (decl) out.push(decl);\n    } catch {\n      // Per-directory failure is isolated — one bad asset never aborts the scan.\n    }\n  }\n  return out;\n}\n","/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>`, `connector:<id>`, and `mcp:<id>`.\n * Returns `undefined` for any other ref so the chain falls through to the\n * next provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capabilities\n * stay strictly in-process — no round trip to the platform to mint while\n * the resource is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors, mcp }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n    mcp?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.mcp ?? {})) {\n      this.mints.set(`mcp:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capability\n   * handlers when the platform delivers new credentials mid-session.\n   */\n  set(kind: \"mount\" | \"connector\" | \"mcp\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\" | \"mcp\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` / `mcp:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\" | \"mcp\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\") || ref.startsWith(\"mcp:\")))\n      return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\n  \"env:\",\n  \"forge:\",\n  \"op:\",\n  \"kp:\",\n  \"oauth:\",\n  \"mount:\",\n  \"connector:\",\n  \"mcp:\",\n] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\nimport type {\n  ConnectorDeclaration,\n  TokenMediator,\n  TokenMediatorResult,\n} from \"./connector-types.js\";\nimport { loadMaterializedConnectorDeclarations } from \"./materialized-connectors.js\";\n\nconst configLog = createLogger({ kind: \"connector\", subkind: \"config\" });\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Merged array of connector declarations from `skaile.yaml` and the materialized\n *   `.skaile/assets/connector/*` disk projection (Phase 2.5); empty array if neither source\n *   contributes any entries. `skaile.yaml` wins on id collision.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  const yamlDecls =\n    config.connectors && config.connectors.length > 0\n      ? config.connectors.map(workspaceConnectorToDeclaration)\n      : [];\n\n  // Library-assigned connectors reach the runner via the materialized disk\n  // projection (Phase 2.5). skaile.yaml is explicit user config — it wins on id\n  // collision; the shadowed materialized connector is logged, not silently dropped.\n  const byId = new Map<string, ConnectorDeclaration>();\n  for (const d of yamlDecls) byId.set(d.id, d);\n  for (const d of loadMaterializedConnectorDeclarations(projectDir)) {\n    if (byId.has(d.id)) {\n      configLog.warn(\n        `materialized connector '${d.id}' shadowed by an explicit skaile.yaml connector`,\n      );\n      continue;\n    }\n    byId.set(d.id, d);\n  }\n  return [...byId.values()];\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n\n  // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n  if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  }\n\n  return decl;\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n\n// ── rclone mount credential bridge (auth: backend) ───────────────────────────\n\n/**\n * Thrown when the backend credential mediator refuses or cannot deliver a\n * mount credential for an `auth: backend` rclone connector. Carries the\n * wire-format error code so callers can branch on it. Mirrors the git driver's\n * `TokenMediatorError`, but lives here so all three rclone drivers share it.\n *\n * @docLink packages/connectors/api-reference#mount-token-mediator-error\n */\nexport class MountTokenMediatorError extends Error {\n  readonly code: Extract<TokenMediatorResult, { ok: false }>[\"code\"];\n  readonly connectorId: string;\n  constructor(\n    message: string,\n    code: Extract<TokenMediatorResult, { ok: false }>[\"code\"],\n    connectorId: string,\n  ) {\n    super(`Mount connector '${connectorId}': backend mediator ${code} — ${message}`);\n    this.name = \"MountTokenMediatorError\";\n    this.code = code;\n    this.connectorId = connectorId;\n  }\n}\n\n/**\n * Resolve the credential *string* an rclone mount driver feeds into its\n * `parseAuthBlob` / `parseAuth` helper.\n *\n * Two cases, branched on `declaration.auth`:\n *   - `backend`  → the credential is minted by the platform mediator. Calls\n *                  `tokenMediator({connectorId, reason: 'initial'})` and returns\n *                  the result's `token` string verbatim (already a JSON blob for\n *                  sharepoint/googledrive, or a `user:pass`/bearer string for\n *                  webdav). Throws `MountTokenMediatorError` when the mediator\n *                  refuses, or a plain `Error` when no mediator is wired (the\n *                  standalone CLI has none — `env:`/inline auth is the path there).\n *   - anything else (`env:NAME`, inline, undefined) → resolves through the\n *                  secrets chain (or a direct `env:`/literal lookup when no chain\n *                  is wired) and NEVER touches the mediator.\n *\n * For `auth: backend` the mediator also surfaces the access token's expiry,\n * which the rclone drivers use to arm a proactive refresh tick (the\n * client_secret is stripped from Skaile-managed Entra blobs, so rclone cannot\n * self-refresh) — see {@link resolveMountCredential}.\n *\n * @param declaration - The connector declaration (supplies `auth` + `id`).\n * @param secrets - Secrets chain for the legacy `env:`/inline path.\n * @param tokenMediator - Backend mediator, present only for platform sessions.\n * @returns The credential string, or `undefined` when no auth is declared.\n * @throws {MountTokenMediatorError} when the mediator refuses an `auth: backend` mint.\n * @docLink packages/connectors/api-reference#resolve-mount-credential-string\n */\nexport async function resolveMountCredentialString(\n  declaration: ConnectorDeclaration,\n  secrets: import(\"./secrets.js\").SecretProvider | undefined,\n  tokenMediator: TokenMediator | undefined,\n): Promise<string | undefined> {\n  return (await resolveMountCredential(declaration, secrets, tokenMediator, \"initial\")).token;\n}\n\n/**\n * The credential string an rclone mount driver feeds into `parseAuthBlob` /\n * `parseAuth`, paired with the access token's ISO expiry (`null` for static\n * credentials / the legacy env path).\n */\nexport interface ResolvedMountCredential {\n  /** The credential string, or `undefined` when no auth is declared. */\n  token: string | undefined;\n  /** ISO-8601 expiry of the access token, or `null` if unknown / static. */\n  expiresAt: string | null;\n}\n\n/**\n * Resolve a mount credential together with its expiry. The richer companion of\n * {@link resolveMountCredentialString}: rclone drivers use the returned\n * `expiresAt` to arm a proactive token-refresh tick, and re-call this with\n * `reason: 'refresh'` (or `'retry-401'` on the reactive path) to re-mint.\n *\n * Branches on `declaration.auth` exactly like `resolveMountCredentialString`:\n * `backend` mints through the mediator (and fails closed on refusal / empty\n * token); everything else resolves through the secrets chain (or a direct\n * `env:`/literal lookup when no chain is wired) with a `null` expiry and never\n * touches the mediator.\n *\n * @throws {MountTokenMediatorError} when the mediator refuses an `auth: backend` mint.\n * @docLink packages/connectors/api-reference#resolve-mount-credential\n */\nexport async function resolveMountCredential(\n  declaration: ConnectorDeclaration,\n  secrets: import(\"./secrets.js\").SecretProvider | undefined,\n  tokenMediator: TokenMediator | undefined,\n  reason: \"initial\" | \"refresh\" | \"retry-401\" = \"initial\",\n): Promise<ResolvedMountCredential> {\n  if (declaration.auth === \"backend\") {\n    if (!tokenMediator) {\n      throw new Error(\n        `Connector '${declaration.id}' uses 'auth: backend' but no token mediator is wired ` +\n          `(standalone has none — use env:/inline auth instead).`,\n      );\n    }\n    const result = await tokenMediator({ connectorId: declaration.id, reason });\n    if (!result.ok) {\n      throw new MountTokenMediatorError(result.message, result.code, declaration.id);\n    }\n    // Fail closed: an empty backend-minted token is a mediator bug. webdav would\n    // otherwise silently fall back to an anonymous mount instead of erroring.\n    if (!result.token) {\n      throw new MountTokenMediatorError(\n        \"mediator returned an empty token\",\n        \"backend-error\",\n        declaration.id,\n      );\n    }\n    return { token: result.token, expiresAt: result.expiresAt };\n  }\n\n  // Non-backend auth resolves through the chain; with no chain wired (standalone)\n  // fall back to a direct env:/literal lookup so inline + env: refs still resolve.\n  const ref = declaration.auth;\n  let token: string | undefined;\n  if (ref && secrets) token = secrets.resolve(ref);\n  else if (ref?.startsWith(\"env:\")) token = process.env[ref.slice(4)];\n  else token = ref;\n  return { token, expiresAt: null };\n}\n"]}

package/dist/connectors/rclone-config.js

@@ -1,4 +0,0 @@
-export { renderGoogleDriveConfig, renderOneDriveConfig, renderWebDAVConfig } from '../chunk-OVRSNIKJ.js';
-import '../chunk-NSBPE2FW.js';
-//# sourceMappingURL=rclone-config.js.map
-//# sourceMappingURL=rclone-config.js.map

package/dist/connectors/rclone-config.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"rclone-config.js"}

package/dist/connectors/rclone.d.ts

@@ -1,2 +0,0 @@
-// Auto-generated by _scripts/emit-dts-sidecars.ts — do not edit by hand.
-export * from "./src/rclone-process-manager.js";

package/dist/connectors/rclone.js

@@ -1,5 +0,0 @@
-export { CachePoisonedMountError, DEFAULT_UPLOAD_STUCK_THRESHOLD, DEFAULT_VFS_WRITE_BACK, RcloneProcessManager, _buildRcloneArgs, _fuseMountPresent, _isCachePoisonLine, _operationsStatTarget, _routeRcloneLogLine, awaitQuiescent, fetchAuthoritativeSize, quarantineCacheDir } from '../chunk-RAIRWFAN.js';
-import '../chunk-JB35MVBN.js';
-import '../chunk-NSBPE2FW.js';
-//# sourceMappingURL=rclone.js.map
-//# sourceMappingURL=rclone.js.map

package/dist/connectors/rclone.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"rclone.js"}

package/dist/connectors/src/fleet-health-gate.d.ts

@@ -1,105 +0,0 @@
-/**
- * FleetHealthGate — health-aware read-only gating for a single fleet-managed mount.
- *
- * Why this exists: a fleet-managed mount is bound live by the host fleet rclone,
- * so it is excluded from the boot-time no-phantom-workspace barrier (the host
- * already put real content at the target — a static barrier would shadow it).
- * That exclusion is only safe while the fleet rclone is healthy. When it wedges —
- * returning `EIO`, or degrading to an empty-but-writable view — the agent cannot
- * tell "empty because broken" from "empty workspace" and writes a phantom
- * workspace that diverges from the remote (the 2026-06-04 incident, except fleet
- * mounts sit outside the barrier).
- *
- * This gate closes that window. It dynamically drives a `MountPlaceholderBarrier`
- * over the *live* fleet target across THREE surfaces, because read availability
- * and write availability are independent:
- *   - open   = `remove(target)` — no barrier; live bind exposed read-write.
- *   - ro     = `exposeReadOnly(target)` — content visible, writes blocked. The
- *              mount is live and READABLE but uploads are degraded; masking the
- *              visible content would be wrong, so it is left read-only-readable.
- *   - masked = `establish(target)` — opaque read-only tmpfs. The mount is not
- *              live / unreadable; there is nothing trustworthy to show.
- *
- * Verdict → surface: `healthy` → open, `degraded` → ro, `error` → masked.
- *
- * Invariants:
- *   - FAIL-CLOSED: if a barrier op throws, the target is treated as gated read-
- *     only (masked). A known-unhealthy fleet mount is never left writable.
- *   - HYSTERESIS: a surface change applies only after a verdict repeats
- *     `threshold` times — moving toward writable uses `healthyThreshold`, moving
- *     away (ro/masked) uses `unhealthyThreshold` — so a single transient blip
- *     does not flap surfaces.
- *   - IDEMPOTENT: barrier ops fire only on an actual surface change, so steady-
- *     state polling does no mount work.
- */
-import type { Logger } from "@skaile/workspaces/types";
-import type { FleetHealthVerdict } from "./fleet-utils.js";
-import type { MountPlaceholderBarrier } from "./mount-placeholder.js";
-/** The barrier surface currently applied (or being transitioned to) over the target. */
-export type FleetGateSurface = "open" | "ro" | "masked";
-export interface FleetHealthGateOptions {
-    /** Consecutive unhealthy observations required to gate (default 2). */
-    unhealthyThreshold?: number;
-    /** Consecutive healthy observations required to ungate (default 2). */
-    healthyThreshold?: number;
-    /**
-     * The surface the barrier already holds when the gate is constructed. Defaults
-     * to `"open"` (no barrier — the normal fleet path). Set to `"masked"` when a
-     * gate is created lazily over a target that already carries a static boot-time
-     * barrier, so the first recovering verdict actually removes it.
-     */
-    initialSurface?: FleetGateSurface;
-}
-type Surface = FleetGateSurface;
-/**
- * Per-target health gate. Construct one per fleet-managed mount target; feed it
- * verdicts via `observe()`; tear it down with `dispose()` (removes the gate if
- * any barrier is established, so teardown leaves nothing un-writable that should
- * not be — caller controls ordering relative to connector disconnect).
- */
-export declare class FleetHealthGate {
-    private readonly target;
-    private readonly barrier;
-    private readonly log?;
-    private readonly unhealthyThreshold;
-    private readonly healthyThreshold;
-    /** The barrier surface actually applied to the target right now. */
-    private surface;
-    /**
-     * The surface the most recently *enqueued* transition will settle on.
-     * Hysteresis and re-enqueue de-duping are measured against this, not
-     * `surface`, so verdicts arriving while a (slow, async) barrier op is still in
-     * flight are counted toward the post-transition surface, not the stale one.
-     */
-    private pendingSurface;
-    /** The surface of the *current* same-verdict run, and its length. */
-    private runSurface;
-    private runLength;
-    /** Serialises barrier ops so overlapping observe() calls can't race. */
-    private transition;
-    constructor(target: string, barrier: MountPlaceholderBarrier, log?: Logger | undefined, opts?: FleetHealthGateOptions);
-    /** True while any read-only barrier (ro or masked) is established. */
-    get isGated(): boolean;
-    /** The currently-applied surface (test/observability hook). */
-    get currentSurface(): Surface;
-    /** The mount target this gate guards (recovery-probe lookup). */
-    get mountTarget(): string;
-    /**
-     * Feed one health verdict. Applies hysteresis, then drives the barrier toward
-     * the target surface on a change. Resolves once the (possibly no-op)
-     * transition is applied. Never throws — a failed barrier op stays gated
-     * (fail-closed).
-     */
-    observe(verdict: FleetHealthVerdict): Promise<void>;
-    /**
-     * Tear the gate down. If any barrier is established (or in flight), removes it
-     * so a leftover read-only surface is not leaked. Call only after the connector
-     * above the target is disconnected (top-down, no leaked mount).
-     */
-    dispose(): Promise<void>;
-    private enqueue;
-    /** Drive the barrier to `desired`, fail-closed to `masked` on any throw. */
-    private apply;
-}
-export {};
-//# sourceMappingURL=fleet-health-gate.d.ts.map

package/dist/connectors/src/fleet-health-gate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fleet-health-gate.d.ts","sourceRoot":"","sources":["../../../connectors/src/fleet-health-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEtE,wFAAwF;AACxF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;AAExD,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;CACnC;AAED,KAAK,OAAO,GAAG,gBAAgB,CAAC;AAQhC;;;;;GAKG;AACH,qBAAa,eAAe;IAoBxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;IArBvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAE1C,oEAAoE;IACpE,OAAO,CAAC,OAAO,CAAU;IACzB;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAAU;IAChC,qEAAqE;IACrE,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,SAAS,CAAK;IACtB,wEAAwE;IACxE,OAAO,CAAC,UAAU,CAAoC;gBAGnC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,uBAAuB,EAChC,GAAG,CAAC,EAAE,MAAM,YAAA,EAC7B,IAAI,CAAC,EAAE,sBAAsB;IAU/B,sEAAsE;IACtE,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,+DAA+D;IAC/D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,iEAAiE;IACjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBnD;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxB,OAAO,CAAC,OAAO;IAKf,4EAA4E;YAC9D,KAAK;CAmDpB"}

package/dist/connectors/src/mount-placeholder.d.ts

@@ -1,131 +0,0 @@
-/**
- * MountPlaceholderBarrier — a read-only barrier at a deferred mount target.
- *
- * Why this exists: `connectAll({ deferMounts: true })` brings rclone-backed
- * filesystem mounts up in the background, after `session_init_ack`. Until the
- * real mount is live, the target would otherwise be a bare, writable local dir.
- * An agent that goes live in that window cannot tell "empty because unmounted"
- * from "empty workspace" and writes a phantom workspace that diverges from the
- * remote (confirmed in prod 2026-06-04 — see
- * `_devlog/entries/2026-06-04-readonly-deferred-mount-barrier.md`).
- *
- * The guarantee must hold at the filesystem layer, not just as an LLM notice:
- * a plain `chmod` is bypassable because the owning uid can chmod back, whereas
- * a read-only mount cannot. So the default barrier mounts a read-only tmpfs
- * over the target (the container already has CAP_SYS_ADMIN for FUSE). When that
- * is not available it degrades to a `chmod 0o555` — strictly better than a
- * writable dir, with a loud error so the degraded state is observable.
- *
- * Lifecycle, driven by `ConnectorManager`:
- *   1. `establish(target)` — synchronously in the eager phase, before ack.
- *   2. `prepareForStackedMount(target)` — immediately before the deferred
- *      connector's in-container rclone mount. Lifts the barrier to read-write
- *      (remount rw / chmod 0o755) so `fusermount3` can mount over the target —
- *      it requires WRITE access to the mountpoint and a `ro` tmpfs denies it for
- *      every uid. The tmpfs stays mounted and is shadowed by the real mount.
- *   3a. `onMountLive(target)` — the real rclone mount stacks on top and provides
- *      write access (it physically shadows the placeholder); no fs change is
- *      needed. In the degraded chmod mode the sentinel is cleaned up.
- *   3b. `restoreBarrier(target)` — instead of 3a, when the mount FAILED:
- *      re-assert read-only so a failed mount never leaves the target writable.
- *   4. `remove(target)` — on teardown, after the rclone mount above it is gone.
- *
- * `exposeReadOnly(target)` is an out-of-band downgrade (driven by the fleet
- * health gate): when the underlying mount is live and readable but writes are
- * degraded, it removes any opaque mask and read-only-binds the live target so
- * the real content stays visible while writes are blocked — read and write
- * availability are independent, so masking visible content would be wrong.
- */
-import type { Logger } from "@skaile/workspaces/types";
-/** Dropped into the placeholder so a peeking agent/operator sees why it is read-only. */
-export declare const NOT_READY_SENTINEL = ".skaile-workspace-not-ready";
-/**
- * A read-only barrier over a deferred mount target. Injected into
- * `ConnectorManager` so tests can substitute a hermetic implementation.
- */
-export interface MountPlaceholderBarrier {
-    /** Make `target` read-only and drop the sentinel. Idempotent per target. */
-    establish(target: string, log?: Logger): Promise<void>;
-    /**
-     * Make `target` writable to the mounting uid so an in-container FUSE mount
-     * (rclone) can stack on top. `fusermount3` requires WRITE access to the
-     * mountpoint and a `ro` tmpfs / `0o555` dir denies it for *every* uid — so the
-     * barrier must be lifted before the real mount spawns, not after. Called by
-     * `ConnectorManager` immediately before a deferred connector's mount. The
-     * tmpfs stays mounted (shadowed by the real mount once it lands), so the bare
-     * underlying dir is never exposed as a writable phantom target. Optional:
-     * absent on hermetic test fakes. Idempotent per target.
-     */
-    prepareForStackedMount?(target: string, log?: Logger): Promise<void>;
-    /**
-     * Re-assert the read-only barrier after a deferred mount attempt FAILED, so a
-     * failed mount never leaves the target writable. The inverse of
-     * `prepareForStackedMount`. Optional.
-     */
-    restoreBarrier?(target: string, log?: Logger): Promise<void>;
-    /**
-     * Signal that the real mount is now live on top of `target` and provides
-     * write access. The placeholder stays tracked so `remove()` still tears it
-     * down on teardown.
-     */
-    onMountLive(target: string, log?: Logger): Promise<void>;
-    /**
-     * Downgrade the barrier to a READ-ONLY surface that still exposes the live
-     * content underneath, instead of the opaque mask `establish` puts up. Used
-     * when the underlying mount is live and fully READABLE but writes are degraded
-     * (e.g. fleet upload errors): read and write availability are independent, so
-     * masking the readable content is wrong — the agent should still see it,
-     * read-only. Removes any opaque tmpfs first (revealing the propagated bind),
-     * then read-only-binds the live target onto itself so writes fail for every
-     * uid while reads succeed. Idempotent per target. Optional: absent on hermetic
-     * test fakes (callers fall back to `establish`).
-     */
-    exposeReadOnly?(target: string, log?: Logger): Promise<void>;
-    /** Tear the barrier down. Call only after any mount stacked above it is gone. */
-    remove(target: string, log?: Logger): Promise<void>;
-    /**
-     * True when the barrier currently OPAQUELY masks `target` (an `establish`-mode
-     * tmpfs shadows the real content). The recovery probe needs this: over an opaque
-     * mask a direct `stat`/`readdir` reads the mask (mode 0555, always "healthy") and
-     * cannot see a recovered host mount, so the manager falls back to the mount
-     * table; non-opaque surfaces (chmod / ro-bind) expose the live inode directly.
-     * Optional: absent on hermetic test fakes (the manager treats absent as
-     * not-opaque, so the live inode is read directly). Idempotent per target.
-     */
-    isOpaque?(target: string): boolean;
-}
-/** Runs an external command, rejecting on non-zero exit or spawn error. */
-export type CommandRunner = (cmd: string, args: string[]) => Promise<void>;
-/**
- * Creates the target directory. Injectable so tests can simulate a live/broken
- * FUSE mountpoint (EEXIST / ENOTCONN) deterministically; defaults to a recursive
- * `mkdir`.
- */
-export type MkdirFn = (target: string) => Promise<void>;
-/**
- * Default barrier: a read-only tmpfs over the target, with a `chmod 0o555`
- * fallback when mounting is unavailable. The tmpfs root is left mode 0o755
- * (owner-traversable, owned by the mounting uid so `fusermount3` can later
- * stack the real mount on top) and made unwritable by the `ro` mount flag, not
- * by stripping mode bits — a `ro` mount blocks writes for every uid.
- */
-export declare class RoMountPlaceholderBarrier implements MountPlaceholderBarrier {
-    private readonly run;
-    private readonly mkdirFn;
-    private readonly modes;
-    constructor(opts?: {
-        run?: CommandRunner;
-        mkdirFn?: MkdirFn;
-    });
-    establish(target: string, log?: Logger): Promise<void>;
-    prepareForStackedMount(target: string, log?: Logger): Promise<void>;
-    restoreBarrier(target: string, log?: Logger): Promise<void>;
-    onMountLive(target: string, log?: Logger): Promise<void>;
-    exposeReadOnly(target: string, log?: Logger): Promise<void>;
-    isOpaque(target: string): boolean;
-    remove(target: string, log?: Logger): Promise<void>;
-    private chmodFallback;
-}
-/** Shared default barrier instance used by `ConnectorManager` unless overridden. */
-export declare const defaultMountPlaceholderBarrier: MountPlaceholderBarrier;
-//# sourceMappingURL=mount-placeholder.d.ts.map

package/dist/connectors/src/mount-placeholder.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mount-placeholder.d.ts","sourceRoot":"","sources":["../../../connectors/src/mount-placeholder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,gCAAgC,CAAC;AA2BhE;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;OAIG;IACH,cAAc,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,iFAAiF;IACjF,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAWD,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAkBxD;;;;;;GAMG;AACH,qBAAa,yBAA0B,YAAW,uBAAuB;IACvE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;gBAE5C,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,aAAa,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE;IAKvD,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDtD,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBnE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB3D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkEjE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAO3B,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YA4C3C,aAAa;CAwB5B;AAED,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,EAAE,uBACZ,CAAC"}

package/dist/connectors/src/rclone-config/googledrive.d.ts

@@ -1,59 +0,0 @@
-/**
- * Render an rclone INI config snippet for a single Google Drive remote.
- *
- * Pure helper — no IO, no logging — so it can be unit-tested by string compare.
- * The output is the full text for one `[<remoteName>]` section using rclone's
- * `drive` backend. The OAuth `token` field is a single-line JSON literal as
- * rclone expects, in the same shape used by the OneDrive renderer.
- *
- * Lives in `@skaile/workspaces/connectors/rclone-config` so both consumers can
- * reach it: the in-container `googledrive` mount driver
- * (`factory-assets/connectors/googledrive/driver.ts`) and the platform-side
- * `RcloneFleetService` (`platform/backend/libs/session/`) which renders the
- * same INI on the host before spawning a shared rclone process.
- */
-/**
- * Google Drive OAuth scope values accepted by rclone's `drive` backend.
- * `drive` = full read/write, `drive.readonly` = read-only, `drive.file` =
- * only files created/opened by the app, `drive.appfolder` = the app's hidden
- * data folder, `drive.metadata.readonly` = metadata only.
- * @docLink packages/connectors/api-reference#google-drive-scope
- */
-export type GoogleDriveScope = "drive" | "drive.readonly" | "drive.file" | "drive.appfolder" | "drive.metadata.readonly";
-/**
- * Options for `renderGoogleDriveConfig`. Carries OAuth token, optional client
- * credentials, optional scope and root/shared-drive restrictions.
- * @docLink packages/connectors/api-reference#render-google-drive-config-options
- */
-export interface RenderGoogleDriveConfigOptions {
-    /** The rclone remote section name (e.g. `skaile-gdrive`). */
-    remoteName: string;
-    /** Current OAuth access token. */
-    accessToken: string;
-    /** Long-lived refresh token (embedded in the rclone `token` JSON field). */
-    refreshToken?: string | null;
-    /** Expiry of the access token as a Unix timestamp in milliseconds. */
-    expiresAtMs?: number | null;
-    /** OAuth client (application) ID. */
-    clientId?: string | null;
-    /** OAuth client secret. */
-    clientSecret?: string | null;
-    /** OAuth scope. Defaults to `"drive"` (full access). */
-    scope?: GoogleDriveScope;
-    /** Optional Drive folder ID to mount as the remote root. */
-    rootFolderId?: string | null;
-    /** Optional Shared Drive (Team Drive) ID. */
-    teamDrive?: string | null;
-    /** Optional path to a service account JSON file (used instead of OAuth). */
-    serviceAccountFile?: string | null;
-}
-/**
- * Render an rclone INI config section for a Google Drive remote. Pure — no IO, no side effects.
- * The `token` field is serialised as a single-line JSON literal as rclone expects.
- * All interpolated values are stripped of CR/LF to prevent INI injection.
- * @param opts - Remote name, OAuth token, optional client credentials and scope/root restrictions.
- * @returns Full INI text for one `[<remoteName>]` rclone section.
- * @docLink packages/connectors/api-reference#render-google-drive-config
- */
-export declare function renderGoogleDriveConfig(opts: RenderGoogleDriveConfigOptions): string;
-//# sourceMappingURL=googledrive.d.ts.map

package/dist/connectors/src/rclone-config/googledrive.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"googledrive.d.ts","sourceRoot":"","sources":["../../../../connectors/src/rclone-config/googledrive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GACxB,OAAO,GACP,gBAAgB,GAChB,YAAY,GACZ,iBAAiB,GACjB,yBAAyB,CAAC;AAE9B;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2BAA2B;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,wDAAwD;IACxD,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAID;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,8BAA8B,GAAG,MAAM,CA0BpF"}

package/dist/connectors/src/rclone-config/index.d.ts

@@ -1,9 +0,0 @@
-/**
- * rclone INI rendering helpers — pure string-template functions for one
- * `[remote]` section per backend. Consumed by both the in-container mount
- * drivers and the platform-side fleet service.
- */
-export { type GoogleDriveScope, type RenderGoogleDriveConfigOptions, renderGoogleDriveConfig, } from "./googledrive.js";
-export { type RenderOneDriveConfigOptions, renderOneDriveConfig } from "./onedrive.js";
-export { type RenderWebDAVConfigOptions, renderWebDAVConfig, type WebDAVVendor, } from "./webdav.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/connectors/src/rclone-config/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../connectors/src/rclone-config/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,8BAA8B,EACnC,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,2BAA2B,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EACL,KAAK,yBAAyB,EAC9B,kBAAkB,EAClB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC"}

package/dist/connectors/src/rclone-config/onedrive.d.ts

@@ -1,48 +0,0 @@
-/**
- * Render an rclone INI config snippet for a single OneDrive/SharePoint remote.
- *
- * Pure helper — no IO, no logging — so it can be unit-tested by string compare.
- * The output is the full text for one `[<remoteName>]` section using rclone's
- * `onedrive` backend. The OAuth `token` field is a single-line JSON literal as
- * rclone expects.
- *
- * Lives in `@skaile/workspaces/connectors/rclone-config` so both consumers can
- * reach it: the in-container `sharepoint` mount driver
- * (`ai-assets-skaile/mounts/sharepoint/driver.ts`) and the platform-side
- * `RcloneFleetService` (`platform/backend/libs/session/`) which renders the
- * same INI on the host before spawning a shared rclone process.
- */
-/**
- * Options for `renderOneDriveConfig`. Carries OAuth token, drive ID, and optional tenant/client credentials.
- * @docLink packages/connectors/api-reference#render-one-drive-config-options
- */
-export interface RenderOneDriveConfigOptions {
-    /** The rclone remote section name (e.g. `skaile-sharepoint`). */
-    remoteName: string;
-    /** Current OAuth access token. */
-    accessToken: string;
-    /** Long-lived refresh token (embedded in the rclone `token` JSON field). */
-    refreshToken?: string | null;
-    /** Expiry of the access token as a Unix timestamp in milliseconds. */
-    expiresAtMs?: number | null;
-    /** Azure tenant ID for MSAL authentication. */
-    tenantId?: string | null;
-    /** OAuth client (application) ID. */
-    clientId?: string | null;
-    /** OAuth client secret. */
-    clientSecret?: string | null;
-    /** OneDrive drive ID (required by the rclone `onedrive` backend). */
-    driveId: string;
-    /** Drive type. Defaults to `"business"`. */
-    driveType?: "business" | "personal" | "documentLibrary";
-}
-/**
- * Render an rclone INI config section for a OneDrive / SharePoint remote. Pure — no IO, no side effects.
- * The `token` field is serialised as a single-line JSON literal as rclone expects.
- * All interpolated values are stripped of CR/LF to prevent INI injection.
- * @param opts - Remote name, OAuth token, drive ID, and optional tenant/client credentials.
- * @returns Full INI text for one `[<remoteName>]` rclone section.
- * @docLink packages/connectors/api-reference#render-one-drive-config
- */
-export declare function renderOneDriveConfig(opts: RenderOneDriveConfigOptions): string;
-//# sourceMappingURL=onedrive.d.ts.map

package/dist/connectors/src/rclone-config/onedrive.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"onedrive.d.ts","sourceRoot":"","sources":["../../../../connectors/src/rclone-config/onedrive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2BAA2B;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,iBAAiB,CAAC;CACzD;AAID;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,MAAM,CAqB9E"}

package/dist/connectors/src/rclone-config/sanitize.d.ts

@@ -1,9 +0,0 @@
-/**
- * Strip CR/LF from a value before interpolating it into an rclone INI line.
- * Without this, a value containing `\n` would smuggle an extra `key = ...`
- * pair — or even a new `[section]` — into the rendered config.
- *
- * Used by every renderer in `@skaile/workspaces/connectors/rclone-config`.
- */
-export declare function sanitizeIniValue(value: string): string;
-//# sourceMappingURL=sanitize.d.ts.map

package/dist/connectors/src/rclone-config/sanitize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../connectors/src/rclone-config/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/connectors/src/rclone-config/webdav.d.ts

@@ -1,50 +0,0 @@
-/**
- * Render an rclone INI config snippet for a single WebDAV remote.
- *
- * Pure helper -- no IO, no logging -- so it can be unit-tested by string compare.
- * The output is the full text for one `[<remoteName>]` section using rclone's
- * `webdav` backend.
- *
- * NOTE: rclone's `pass` field is not plaintext; it must already be passed
- * through `rclone obscure` by the caller. See the driver's `obscurePassword`
- * helper for the spawn that produces it.
- *
- * Lives in `@skaile/workspaces/connectors/rclone-config` so both consumers can
- * reach it: the in-container `webdav` mount driver
- * (`ai-assets-skaile/mounts/webdav/driver.ts`) and the platform-side
- * `RcloneFleetService` (`platform/backend/libs/session/`) which renders the
- * same INI on the host before spawning a shared rclone process.
- */
-/**
- * Supported WebDAV vendor identifiers for the rclone `webdav` backend.
- * @docLink packages/connectors/api-reference#web-dav-vendor
- */
-export type WebDAVVendor = "nextcloud" | "owncloud" | "sharepoint" | "fastmail" | "other";
-/**
- * Options for `renderWebDAVConfig`. Carries remote name, URL, vendor, and credentials.
- * @docLink packages/connectors/api-reference#render-web-dav-config-options
- */
-export interface RenderWebDAVConfigOptions {
-    /** The rclone remote section name (e.g. `skaile-docs`). */
-    remoteName: string;
-    /** Base URL of the WebDAV server. */
-    url: string;
-    /** WebDAV vendor; drives rclone's `vendor =` field. */
-    vendor: WebDAVVendor;
-    /** Basic-auth username. */
-    username?: string | null;
-    /** Already passed through `rclone obscure`. */
-    obscuredPassword?: string | null;
-    /** OAuth bearer token (used instead of basic-auth for SharePoint). */
-    bearerToken?: string | null;
-}
-/**
- * Render an rclone INI config section for a WebDAV remote. Pure — no IO, no side effects.
- * The `obscuredPassword` field must already have been processed through `rclone obscure`.
- * All interpolated values are stripped of CR/LF to prevent INI injection.
- * @param opts - Remote name, URL, vendor, and credentials.
- * @returns Full INI text for one `[<remoteName>]` rclone section.
- * @docLink packages/connectors/api-reference#render-web-dav-config
- */
-export declare function renderWebDAVConfig(opts: RenderWebDAVConfigOptions): string;
-//# sourceMappingURL=webdav.d.ts.map

package/dist/connectors/src/rclone-config/webdav.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"webdav.d.ts","sourceRoot":"","sources":["../../../../connectors/src/rclone-config/webdav.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;AAE1F;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,MAAM,EAAE,YAAY,CAAC;IACrB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAID;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAW1E"}