@skaile/workspaces 0.8.5 → 0.9.1

package/dist/chunk-R7FOF242.js

@@ -0,0 +1,59 @@
+import { Octokit } from '@octokit/rest';
+
+// library/src/install/source-fetch-github.ts
+var GITHUB_PAT_ENV = "SKAILE_GITHUB_PAT";
+function parseRepo(url) {
+  const m = url.match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?(?:[/#?].*)?$/i);
+  if (!m) throw new Error(`unsupported source URL: ${url}`);
+  return { owner: m[1], repo: m[2] };
+}
+async function fetchAssetFilesFromGitHub(opts) {
+  if (!/^[0-9a-f]{40}$/i.test(opts.commitSha)) {
+    throw new Error(
+      `pinned commit must be a 40-character hex SHA, got '${opts.commitSha}' \u2014 a branch or tag would make the install mutable`
+    );
+  }
+  const octo = opts.octokit ?? new Octokit({ auth: process.env[GITHUB_PAT_ENV] });
+  const { owner, repo } = parseRepo(opts.url);
+  let tree;
+  try {
+    tree = await octo.rest.git.getTree({
+      owner,
+      repo,
+      tree_sha: opts.commitSha,
+      recursive: "true"
+    });
+  } catch (e) {
+    throw new Error(`unreachable: cannot read tree at ${opts.commitSha}: ${e.message}`);
+  }
+  const byPath = /* @__PURE__ */ new Map();
+  for (const node of tree.data.tree) {
+    if (node.type === "blob" && node.path && node.sha) {
+      byPath.set(node.path, node.sha);
+    }
+  }
+  const result = {};
+  for (const path of opts.paths) {
+    const blobSha = byPath.get(path);
+    if (!blobSha) {
+      if (tree.data.truncated) {
+        throw new Error(
+          `tree truncated \u2014 repo too large for recursive listing at ${opts.commitSha}`
+        );
+      }
+      throw new Error(`unreachable: path not in tree: ${path}`);
+    }
+    const blob = await octo.rest.git.getBlob({ owner, repo, file_sha: blobSha });
+    if (blob.data.encoding !== "base64") {
+      throw new Error(
+        `unreachable: blob ${path} has unsupported encoding '${blob.data.encoding}' (likely too large)`
+      );
+    }
+    result[path] = Buffer.from(blob.data.content, "base64");
+  }
+  return result;
+}
+
+export { GITHUB_PAT_ENV, fetchAssetFilesFromGitHub };
+//# sourceMappingURL=chunk-R7FOF242.js.map
+//# sourceMappingURL=chunk-R7FOF242.js.map

package/dist/chunk-R7FOF242.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../library/src/install/source-fetch-github.ts"],"names":[],"mappings":";;;AAmBO,IAAM,cAAA,GAAiB;AAsB9B,SAAS,UAAU,GAAA,EAA8C;AAI/D,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,0DAA0D,CAAA;AAC9E,EAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AACxD,EAAA,OAAO,EAAE,OAAO,CAAA,CAAE,CAAC,GAAI,IAAA,EAAM,CAAA,CAAE,CAAC,CAAA,EAAG;AACrC;AAYA,eAAsB,0BAA0B,IAAA,EAAkD;AAMhG,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mDAAA,EAAsD,KAAK,SAAS,CAAA,uDAAA;AAAA,KAEtE;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,IAAW,IAAI,OAAA,CAAQ,EAAE,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAAG,CAAA;AAC9E,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,SAAA,CAAU,KAAK,GAAG,CAAA;AAE1C,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ;AAAA,MACjC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAU,IAAA,CAAK,SAAA;AAAA,MACf,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,MAAM,CAAA,iCAAA,EAAoC,IAAA,CAAK,SAAS,CAAA,EAAA,EAAM,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,EAC/F;AAGA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM;AACjC,IAAA,IAAI,KAAK,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,IAAA,IAAQ,KAAK,GAAA,EAAK;AACjD,MAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,GAAG,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,OAAA,EAAS;AAKZ,MAAA,IAAI,IAAA,CAAK,KAAK,SAAA,EAAW;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,8DAAA,EAA4D,KAAK,SAAS,CAAA;AAAA,SAC5E;AAAA,MACF;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+BAAA,EAAkC,IAAI,CAAA,CAAE,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,EAAE,KAAA,EAAO,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,CAAA;AAG3E,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,QAAA,KAAa,QAAA,EAAU;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kBAAA,EAAqB,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAK,QAAQ,CAAA,oBAAA;AAAA,OAC3E;AAAA,IACF;AACA,IAAA,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA,CAAO,KAAK,IAAA,CAAK,IAAA,CAAK,SAAS,QAAQ,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,MAAA;AACT","file":"chunk-R7FOF242.js","sourcesContent":["/**\n * GitHub asset-byte fetcher for the pointer-only install path.\n *\n * Given an upstream repo URL and a pinned commit SHA, walks the recursive\n * git tree at that commit and fetches the blob bytes for each requested path.\n * The Catalog never serves asset bytes — it only hands clients the Pointer\n * Triple (`source.url` + `source.commitSha` + per-file `{path, sha256}`),\n * and `installFromManifest` verifies every byte against those hashes.\n *\n * Authentication: an optional GitHub PAT is read from the `SKAILE_GITHUB_PAT`\n * environment variable when no `octokit` instance is injected. Public repos\n * work unauthenticated (subject to GitHub's anonymous rate limit).\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { Octokit } from \"@octokit/rest\";\n\n/** GitHub PAT environment variable used when no Octokit is injected. */\nexport const GITHUB_PAT_ENV = \"SKAILE_GITHUB_PAT\";\n\n/**\n * Options for {@link fetchAssetFilesFromGitHub}.\n */\nexport interface FetchOpts {\n  /** Upstream repo URL (e.g. `https://github.com/skaile-ai/skaile-ai-assets`). */\n  url: string;\n  /** Immutable 40-char git commit SHA the asset version was pinned at. */\n  commitSha: string;\n  /** Repo-relative paths to fetch. */\n  paths: string[];\n  /** Optional Octokit instance — injectable for tests. */\n  octokit?: Octokit;\n}\n\n/**\n * Parse `{ owner, repo }` out of a GitHub repo URL.\n *\n * Accepts both HTTPS (`https://github.com/owner/repo[.git]`) and SCP-style\n * SSH (`git@github.com:owner/repo[.git]`) forms.\n */\nfunction parseRepo(url: string): { owner: string; repo: string } {\n  // Repo names may contain dots (e.g. `skaile-ai/www.skaile.ai`). Capture the\n  // full repo segment up to a path separator / end-of-string, and strip an\n  // optional trailing `.git` suffix only.\n  const m = url.match(/github\\.com[/:]([^/]+)\\/([^/]+?)(?:\\.git)?(?:[/#?].*)?$/i);\n  if (!m) throw new Error(`unsupported source URL: ${url}`);\n  return { owner: m[1]!, repo: m[2]! };\n}\n\n/**\n * Fetch the bytes of each requested path from a GitHub repo at a pinned commit.\n *\n * Reads the recursive git tree at `commitSha`, maps each blob path to its blob\n * SHA, then fetches each requested path's blob and base64-decodes it.\n *\n * @returns A `{ path → Buffer }` map covering every requested path.\n * @throws An error whose message matches `/unreachable/i` if the tree cannot\n *   be read or any requested path is absent from the tree.\n */\nexport async function fetchAssetFilesFromGitHub(opts: FetchOpts): Promise<Record<string, Buffer>> {\n  // The pointer-only integrity model depends on `commitSha` being an immutable\n  // git commit SHA. GitHub's tree API also accepts branch/tag names, which\n  // would produce a mutable fetch and a non-pinned `Instance.sourceCommitSha` —\n  // silently breaking the auditable/re-verifiable guarantee. Reject anything\n  // that is not exactly 40 hex characters.\n  if (!/^[0-9a-f]{40}$/i.test(opts.commitSha)) {\n    throw new Error(\n      `pinned commit must be a 40-character hex SHA, got '${opts.commitSha}' — ` +\n        \"a branch or tag would make the install mutable\",\n    );\n  }\n  const octo = opts.octokit ?? new Octokit({ auth: process.env[GITHUB_PAT_ENV] });\n  const { owner, repo } = parseRepo(opts.url);\n\n  let tree: Awaited<ReturnType<typeof octo.rest.git.getTree>>;\n  try {\n    tree = await octo.rest.git.getTree({\n      owner,\n      repo,\n      tree_sha: opts.commitSha,\n      recursive: \"true\",\n    });\n  } catch (e) {\n    throw new Error(`unreachable: cannot read tree at ${opts.commitSha}: ${(e as Error).message}`);\n  }\n\n  // path → blob SHA\n  const byPath = new Map<string, string>();\n  for (const node of tree.data.tree) {\n    if (node.type === \"blob\" && node.path && node.sha) {\n      byPath.set(node.path, node.sha);\n    }\n  }\n\n  const result: Record<string, Buffer> = {};\n  for (const path of opts.paths) {\n    const blobSha = byPath.get(path);\n    if (!blobSha) {\n      // [H1] A recursive tree listing is truncated for large repos\n      // (`data.truncated: true`). A path missing from a truncated listing is\n      // not necessarily absent from the repo — surface a distinct, accurate\n      // error rather than the misleading \"path not in tree\".\n      if (tree.data.truncated) {\n        throw new Error(\n          `tree truncated — repo too large for recursive listing at ${opts.commitSha}`,\n        );\n      }\n      throw new Error(`unreachable: path not in tree: ${path}`);\n    }\n    const blob = await octo.rest.git.getBlob({ owner, repo, file_sha: blobSha });\n    // [L2] GitHub returns `encoding: \"none\"` (with empty content) for blobs\n    // larger than ~1MB. Only base64 is decodable here — fail loudly otherwise.\n    if (blob.data.encoding !== \"base64\") {\n      throw new Error(\n        `unreachable: blob ${path} has unsupported encoding '${blob.data.encoding}' (likely too large)`,\n      );\n    }\n    result[path] = Buffer.from(blob.data.content, \"base64\");\n  }\n  return result;\n}\n"]}

package/dist/{chunk-XEGHWFAX.js → chunk-SVNFQSU3.js}

@@ -1,5 +1,5 @@
-import { resolveSkWorkspaceConfig, readLinks } from './chunk-CSUBFKAN.js';
-import { scanDirectory } from './chunk-BVHFSUFM.js';
+import { resolveSkWorkspaceConfig, readLinks } from './chunk-GAZINYCS.js';
+import { scanDirectory } from './chunk-ZHLRRT5D.js';
 import { existsSync, readFileSync, lstatSync } from 'fs';
 import { resolve, join, dirname } from 'path';
 import { fileURLToPath } from 'url';
@@ -78,9 +78,7 @@ async function populate(projectDir, target) {
       continue;
     }
     try {
-      const entries = scanDirectory(repoDir, name).filter(
-        (e) => e.kind === "mount" || e.kind === "connector"
-      );
+      const entries = scanDirectory(repoDir, name).filter((e) => e.kind === "connector");
       target.catalogEntries.push(...entries);
     } catch (err) {
       target.warnings.push({
@@ -90,9 +88,6 @@ async function populate(projectDir, target) {
       });
     }
   }
-  for (const m of config.mounts ?? []) {
-    target.implicitRefs.push({ kind: "mount", name: m.driver, declarationId: m.id });
-  }
   for (const c of config.connectors ?? []) {
     target.implicitRefs.push({ kind: "connector", name: c.driver, declarationId: c.id });
   }
@@ -170,5 +165,5 @@ function findCatalogEntry(entries, query) {
 }
 
 export { BASE_ASSETS_REPO_NAME, resolveBaseAssetsRoot, resolveRuntimeAssets };
-//# sourceMappingURL=chunk-XEGHWFAX.js.map
-//# sourceMappingURL=chunk-XEGHWFAX.js.map
+//# sourceMappingURL=chunk-SVNFQSU3.js.map
+//# sourceMappingURL=chunk-SVNFQSU3.js.map

package/dist/chunk-SVNFQSU3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/src/runtime-assets.ts"],"names":["resolvePath","require"],"mappings":";;;;;;;AAuFO,IAAM,qBAAA,GAAwB;AAsCrC,eAAsB,qBAAqB,UAAA,EAAkD;AAC3F,EAAA,MAAM,MAAA,GAA8B;AAAA,IAClC,gBAAgB,EAAC;AAAA,IACjB,cAAc,EAAC;AAAA,IACf,iBAAiB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,IAC9C,UAAU,EAAC;AAAA,IACX,SAAS,YAAY;AACnB,MAAA,MAAM,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,WAAW,CAAC,KAAA,KAAU,gBAAA,CAAiB,MAAA,CAAO,gBAAgB,KAAK;AAAA,GACrE;AAEA,EAAA,MAAM,QAAA,CAAS,YAAY,MAAM,CAAA;AACjC,EAAA,OAAO,MAAA;AACT;AAeO,SAAS,qBAAA,GAAgC;AAC9C,EAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,sBAAA;AAC3B,EAAA,IAAI,UAAU,UAAA,CAAW,MAAM,CAAA,EAAG,OAAOA,QAAY,MAAM,CAAA;AAE3D,EAAA,IAAI;AACF,IAAA,MAAMC,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAC7C,IAAA,MAAM,OAAA,GAAUA,QAAAA,CAAQ,OAAA,CAAQ,iCAAiC,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,aAAa,CAAA;AACtD,IAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,SAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,YAAA,GAAe,eAAA,CAAgB,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACpD,EAAA,IAAI,cAAc,OAAO,YAAA;AAEzB,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,yLAAA;AAAA,GAIF;AACF;AAOA,SAAS,gBAAgB,QAAA,EAAiC;AACxD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,OAAA,CAAQ,aAAA,CAAc,QAAQ,CAAC,CAAA;AAAA,EACvC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACxC,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAK,aAAa,CAAA;AAC1C,IAAA,IAAI,UAAA,CAAW,OAAO,CAAA,IAAK,UAAA,CAAW,UAAU,CAAA,EAAG;AACjD,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,OAAA,EAAS,OAAO,CAAC,CAAA;AACrD,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,oBAAA,EAAsB,OAAO,UAAA;AAAA,MAChD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,QAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAIA,eAAe,QAAA,CAAS,YAAoB,MAAA,EAA4C;AACtF,EAAA,MAAA,CAAO,iBAAiB,EAAC;AACzB,EAAA,MAAA,CAAO,eAAe,EAAC;AACvB,EAAA,MAAA,CAAO,kBAAkB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AACtD,EAAA,MAAA,CAAO,WAAW,EAAC;AAEnB,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAClD,EAAA,MAAM,YAAA,GAAe,0BAAA,CAA2B,MAAA,CAAO,YAAY,CAAA;AACnE,EAAA,MAAM,KAAA,GAAQ,UAAU,UAAU,CAAA;AAGlC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,IAAA,MAAM,OAAA,GAAU,cAAA,CAAe,IAAA,EAAM,IAAA,EAAM,YAAY,KAAK,CAAA;AAC5D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,sBAAA,CAAuB,IAAA,EAAM,IAAI;AAAA,OAC3C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,aAAA,CAAc,OAAA,EAAS,IAAI,CAAA,CAAE,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,WAAW,CAAA;AACjF,MAAA,MAAA,CAAO,cAAA,CAAe,IAAA,CAAK,GAAG,OAAO,CAAA;AAAA,IACvC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,CAAA,2BAAA,EAA8B,IAAI,CAAA,KAAA,EAAQ,OAAO,CAAA,EAAA,EACxD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,UAAA,IAAc,EAAC,EAAG;AACvC,IAAA,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,CAAA,CAAE,MAAA,EAAQ,aAAA,EAAe,CAAA,CAAE,EAAA,EAAI,CAAA;AAAA,EACrF;AAGA,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,KAAA,MAAW,GAAA,IAAO,OAAO,YAAA,EAAc;AACrC,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,MAAA,CAAO,cAAA,EAAgB,GAAG,CAAA;AACzD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,gBAAA;AAAA,QACN,eAAe,GAAA,CAAI,aAAA;AAAA,QACnB,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,OAAA,EACE,CAAA,QAAA,EAAW,GAAA,CAAI,IAAI,YAAY,GAAA,CAAI,IAAI,CAAA,gBAAA,EAAmB,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,aAAa,CAAA,gBAAA,EACxE,IAAI,IAAI,CAAA,sGAAA;AAAA,OAE3B,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAO,KAAA,CAAM,QAAA,EAAU,QAAA,IAAY,EAAC;AAC1C,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AACrD,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EACvD;AACA,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACjD,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACnD;AAOA,SAAS,2BACP,QAAA,EACuC;AACvC,EAAA,MAAM,MAAA,GAAgD,EAAE,GAAI,QAAA,IAAY,EAAC,EAAG;AAC5E,EAAA,IAAI,CAAC,MAAA,CAAO,qBAAqB,CAAA,EAAG;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,UAAU,qBAAA,EAAsB;AACtC,MAAA,MAAA,CAAO,qBAAqB,CAAA,GAAI,EAAE,IAAA,EAAM,OAAA,EAAQ;AAAA,IAClD,SAAS,GAAA,EAAK;AAIZ,MAAA,MAAA,CAAO,qBAAqB,CAAA,GAAI,EAAE,IAAA,EAAM,EAAA,EAAG;AAAA,IAC7C;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,cAAA,CACP,IAAA,EACA,IAAA,EACA,UAAA,EACA,KAAA,EACe;AAEf,EAAA,MAAM,MAAA,GAAS,MAAM,IAAI,CAAA;AACzB,EAAA,IAAI,MAAA,IAAU,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,MAAA;AAGzC,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,MAAM,QAAA,GAAWD,OAAA,CAAY,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAClD,IAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,IAAA;AAAA,EAC3C;AAGA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,UAAA,EAAY,SAAA,EAAW,SAAS,IAAI,CAAA;AAC7D,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,IAAI;AACF,QAAA,OAAO,SAAA,CAAU,WAAW,CAAA,CAAE,cAAA,KAAmB,WAAA,GAAc,WAAA;AAAA,MACjE,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,sBAAA,CAAuB,MAAc,IAAA,EAAqC;AACjF,EAAA,IAAI,SAAS,qBAAA,IAAyB,CAAC,KAAK,IAAA,IAAQ,CAAC,KAAK,GAAA,EAAK;AAC7D,IAAA,OACE,CAAA,kGAAA,CAAA;AAAA,EAGJ;AACA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,GAAA,EAAM,IAAA,CAAK,GAAG,CAAA,8EAAA,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,kBAAA,EAAqB,IAAA,CAAK,IAAI,CAAA,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,eAAe,IAAI,CAAA,2BAAA,CAAA;AAC5B;AAEA,SAAS,gBAAA,CACP,SACA,KAAA,EACiC;AACjC,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAI,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,MAAM,IAAI,CAAA;AAC3D,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,QAAQ,CAAC,CAAA;AAE1C,EAAA,OAAO,MAAA;AACT","file":"chunk-SVNFQSU3.js","sourcesContent":["/**\n * Runtime asset resolution — read `skaile.yaml`, scan all declared repositories\n * (including the built-in `base-assets/` directory as an implicit default), and\n * produce a unified view of connector catalog entries plus the implicit refs\n * that the `skaile.yaml` `connectors:` section adds to the dependency graph.\n *\n * This module is the single source of truth for \"which connectors does this\n * project see at runtime, and where do their implementations live on disk\".\n * Both the runner (serve, REPL, flow) and the platform's mid-session\n * `add_resource` flow consume `RuntimeAssetsResult.catalogEntries` and pass\n * it into `ConnectorManager` for catalog-based resolution.\n *\n * `base-assets/` is a subdirectory of the single published `@skaile/workspaces`\n * package — not a standalone package. Its on-disk path is resolved with this\n * precedence:\n *   1. `process.env.SKAILE_BASE_ASSETS_DIR` — set by the agent container at\n *      runtime to point at `/app/base-assets/`.\n *   2. `require.resolve('@skaile/workspaces/package.json')` + `base-assets/` —\n *      works when `@skaile/workspaces` is installed as a dependency.\n *   3. Walk upward from this module's location for the `@skaile/workspaces`\n *      package root (a `package.json` whose `name` is `@skaile/workspaces`)\n *      that contains a `base-assets/` subdirectory. This is the dev-workspace\n *      fallback — it is bounded and works regardless of where the consumer\n *      lives in the tree.\n */\n\nimport { existsSync, lstatSync, readFileSync } from \"node:fs\";\nimport { dirname, join, resolve as resolvePath } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { createRequire } from \"node:module\";\nimport type { CatalogEntry } from \"./models.js\";\nimport { scanDirectory } from \"./manifest.js\";\nimport type { RepositoryDeclaration } from \"./workspace-config.js\";\nimport { resolveSkWorkspaceConfig } from \"./workspace-config.js\";\nimport { readLinks } from \"./repo-manager.js\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\n/**\n * Catalog entry filtered to mount/connector kinds. Same shape as `CatalogEntry`.\n * @docLink packages/core/concepts#runtime-catalog-entry\n */\nexport type RuntimeCatalogEntry = CatalogEntry;\n\n/**\n * Implicit catalog reference derived from a `connectors:` declaration in `skaile.yaml`.\n * Each connector driver becomes an implicit ref that must be resolved in the catalog.\n * @docLink packages/core/concepts#runtime-asset-ref\n */\nexport interface RuntimeAssetRef {\n  kind: \"connector\";\n  /** Driver name — matches `RuntimeCatalogEntry.name`. */\n  name: string;\n  /** Source declaration id from `skaile.yaml`. */\n  declarationId: string;\n}\n\n/**\n * Aggregated npm packages required by all resolved mount/connector adapters.\n * Populated from `metadata.npm_deps` in each matched catalog entry.\n * @docLink packages/core/concepts#runtime-npm-deps\n */\nexport interface RuntimeNpmDeps {\n  required: string[];\n  optional: string[];\n}\n\n/**\n * Non-fatal warning emitted during `resolveRuntimeAssets` when a repo is unavailable\n * or a driver is not found in any catalog.\n * @docLink packages/core/concepts#runtime-asset-warning\n */\nexport interface RuntimeAssetWarning {\n  /** Stable code for filtering / structured logging. */\n  code: \"missing_driver\" | \"repo_unavailable\" | \"invalid_repo_decl\";\n  message: string;\n  /** Declaration id when applicable. */\n  declarationId?: string;\n  /** Driver / repository name when applicable. */\n  name?: string;\n}\n\n/**\n * Repository name used for the implicit `@skaile/base-assets` catalog entry.\n * Callers can override this repo by declaring `repositories: { base-assets: ... }` in `skaile.yaml`.\n * @docLink packages/core/concepts#base-assets-repo-name\n */\nexport const BASE_ASSETS_REPO_NAME = \"base-assets\";\n\n/**\n * Result of `resolveRuntimeAssets`.\n * The same object is mutated in place by `refresh()`, allowing callers to hold\n * a stable reference and observe updates after a new repository is cloned or\n * a driver is installed mid-session.\n * @docLink packages/core/concepts#runtime-assets-result\n */\nexport interface RuntimeAssetsResult {\n  catalogEntries: RuntimeCatalogEntry[];\n  implicitRefs: RuntimeAssetRef[];\n  requiredNpmDeps: RuntimeNpmDeps;\n  warnings: RuntimeAssetWarning[];\n  /** Re-scan repositories and re-derive implicit refs. Mutates in place. */\n  refresh(): Promise<void>;\n  /**\n   * Catalog lookup. When `kind` is omitted and multiple entries share the\n   * `name`, returns `undefined` (caller must disambiguate).\n   */\n  findEntry(query: { kind?: \"connector\"; name: string }): RuntimeCatalogEntry | undefined;\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/**\n * Resolve all runtime assets visible to a project by scanning declared repositories.\n *\n * Reads `skaile.yaml`, scans every declared repository (plus the implicit\n * `@skaile/base-assets` repo), and derives implicit refs from `mounts:` /\n * `connectors:` declarations. Does not clone or install anything — purely a\n * read-only scan of what is already on disk. URL-only repositories that have\n * not been cloned yet are reported as `repo_unavailable` warnings.\n *\n * @param projectDir - Absolute path to the project workspace root\n * @returns `RuntimeAssetsResult` with catalog entries, implicit refs, npm deps, and warnings\n * @docLink packages/core/concepts#resolve-runtime-assets\n */\nexport async function resolveRuntimeAssets(projectDir: string): Promise<RuntimeAssetsResult> {\n  const result: RuntimeAssetsResult = {\n    catalogEntries: [],\n    implicitRefs: [],\n    requiredNpmDeps: { required: [], optional: [] },\n    warnings: [],\n    refresh: async () => {\n      await populate(projectDir, result);\n    },\n    findEntry: (query) => findCatalogEntry(result.catalogEntries, query),\n  };\n\n  await populate(projectDir, result);\n  return result;\n}\n\n/**\n * Resolve the on-disk root of `@skaile/base-assets`.\n *\n * Resolution tiers:\n * 1. `SKAILE_BASE_ASSETS_DIR` env var\n * 2. `require.resolve('@skaile/workspaces/base-assets/package.json')` (npm install / hoisted)\n * 3. Walk upward from this module looking for `base-assets/package.json` or\n *    `ai-assets-skaile/package.json` (legacy shell-repo layout)\n *\n * @returns Absolute path to the `@skaile/base-assets` package directory\n * @throws When none of the three tiers can locate the package\n * @docLink packages/core/concepts#resolve-base-assets-root\n */\nexport function resolveBaseAssetsRoot(): string {\n  const envDir = process.env.SKAILE_BASE_ASSETS_DIR;\n  if (envDir && existsSync(envDir)) return resolvePath(envDir);\n\n  try {\n    const require = createRequire(import.meta.url);\n    const pkgJson = require.resolve(\"@skaile/workspaces/package.json\");\n    const candidate = join(dirname(pkgJson), \"base-assets\");\n    if (existsSync(candidate)) return candidate;\n  } catch {\n    // Fall through to workspace walk.\n  }\n\n  const workspaceHit = findInWorkspace(import.meta.url);\n  if (workspaceHit) return workspaceHit;\n\n  throw new Error(\n    `Cannot resolve the base-assets directory. ` +\n      `Set SKAILE_BASE_ASSETS_DIR to the on-disk path, ` +\n      `ensure @skaile/workspaces is installed, ` +\n      `or run from within the @skaile/workspaces package tree.`,\n  );\n}\n\n/**\n * Walk upward from `startUrl` looking for the `@skaile/workspaces` package\n * root — a directory whose `package.json` `name` is `@skaile/workspaces` and\n * which contains a `base-assets/` subdirectory. Bounded to 8 levels.\n */\nfunction findInWorkspace(startUrl: string): string | null {\n  let dir: string;\n  try {\n    dir = dirname(fileURLToPath(startUrl));\n  } catch {\n    return null;\n  }\n  for (let i = 0; i < 8; i++) {\n    const pkgPath = join(dir, \"package.json\");\n    const baseAssets = join(dir, \"base-assets\");\n    if (existsSync(pkgPath) && existsSync(baseAssets)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, \"utf-8\")) as { name?: string };\n        if (pkg.name === \"@skaile/workspaces\") return baseAssets;\n      } catch {\n        // Ignore malformed package.json and keep walking.\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n// ─── Internals ────────────────────────────────────────────────────────────────\n\nasync function populate(projectDir: string, target: RuntimeAssetsResult): Promise<void> {\n  target.catalogEntries = [];\n  target.implicitRefs = [];\n  target.requiredNpmDeps = { required: [], optional: [] };\n  target.warnings = [];\n\n  const config = resolveSkWorkspaceConfig(projectDir);\n  const repositories = buildEffectiveRepositories(config.repositories);\n  const links = readLinks(projectDir);\n\n  // Scan each repository for connector entries.\n  for (const [name, decl] of Object.entries(repositories)) {\n    const repoDir = resolveRepoDir(name, decl, projectDir, links);\n    if (!repoDir) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: repoUnavailableMessage(name, decl),\n      });\n      continue;\n    }\n    try {\n      const entries = scanDirectory(repoDir, name).filter((e) => e.kind === \"connector\");\n      target.catalogEntries.push(...entries);\n    } catch (err) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: `Failed to scan repository \"${name}\" at ${repoDir}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      });\n    }\n  }\n\n  // Derive implicit refs from skaile.yaml connectors.\n  for (const c of config.connectors ?? []) {\n    target.implicitRefs.push({ kind: \"connector\", name: c.driver, declarationId: c.id });\n  }\n\n  // Validate refs and aggregate npm deps.\n  const requiredSet = new Set<string>();\n  const optionalSet = new Set<string>();\n  for (const ref of target.implicitRefs) {\n    const entry = findCatalogEntry(target.catalogEntries, ref);\n    if (!entry) {\n      target.warnings.push({\n        code: \"missing_driver\",\n        declarationId: ref.declarationId,\n        name: ref.name,\n        message:\n          `Unknown ${ref.kind} driver \"${ref.name}\" referenced by ${ref.kind} \"${ref.declarationId}\". ` +\n          `Run \\`skaile ${ref.kind} catalog\\` to see available drivers, ` +\n          `or declare a repository in skaile.yaml that provides this driver.`,\n      });\n      continue;\n    }\n    const npm = (entry.metadata?.npm_deps ?? {}) as { required?: string[]; optional?: string[] };\n    for (const p of npm.required ?? []) requiredSet.add(p);\n    for (const p of npm.optional ?? []) optionalSet.add(p);\n  }\n  target.requiredNpmDeps.required = [...requiredSet];\n  target.requiredNpmDeps.optional = [...optionalSet];\n}\n\n/**\n * Build the effective `repositories` map: caller's declarations first, then\n * the implicit `base-assets` repo if absent. Caller's entries always win — an\n * org can override the default by declaring `repositories: { base-assets: {...} }`.\n */\nfunction buildEffectiveRepositories(\n  declared: Record<string, RepositoryDeclaration> | undefined,\n): Record<string, RepositoryDeclaration> {\n  const result: Record<string, RepositoryDeclaration> = { ...(declared ?? {}) };\n  if (!result[BASE_ASSETS_REPO_NAME]) {\n    try {\n      const baseDir = resolveBaseAssetsRoot();\n      result[BASE_ASSETS_REPO_NAME] = { path: baseDir };\n    } catch (err) {\n      // Surface as a warning during scan rather than throwing here — let the\n      // caller decide whether base-assets is required for this project.\n      // We re-discover the failure in resolveRepoDir() and emit there.\n      result[BASE_ASSETS_REPO_NAME] = { path: \"\" };\n    }\n  }\n  return result;\n}\n\n/**\n * Resolve a repository declaration to an on-disk directory. Order:\n *   1. Linked override (`.skaile/links.yaml`).\n *   2. Local `path` — relative to `projectDir`.\n *   3. Cloned URL repo at `.skaile/repos/<name>/` (must already exist).\n *\n * Returns `null` when none of these resolve. Does not clone.\n */\nfunction resolveRepoDir(\n  name: string,\n  decl: RepositoryDeclaration,\n  projectDir: string,\n  links: Record<string, string>,\n): string | null {\n  // 1. Linked override\n  const linked = links[name];\n  if (linked && existsSync(linked)) return linked;\n\n  // 2. Local path\n  if (decl.path) {\n    const resolved = resolvePath(projectDir, decl.path);\n    return existsSync(resolved) ? resolved : null;\n  }\n\n  // 3. URL repo cloned to project's .skaile/repos/<name>\n  if (decl.url) {\n    const projectDest = join(projectDir, \".skaile\", \"repos\", name);\n    if (existsSync(projectDest)) {\n      // Either a real directory or a symlink to the global cache.\n      try {\n        return lstatSync(projectDest).isSymbolicLink() ? projectDest : projectDest;\n      } catch {\n        return null;\n      }\n    }\n    return null;\n  }\n\n  return null;\n}\n\nfunction repoUnavailableMessage(name: string, decl: RepositoryDeclaration): string {\n  if (name === BASE_ASSETS_REPO_NAME && !decl.path && !decl.url) {\n    return (\n      `Cannot resolve @skaile/base-assets. ` +\n      `Set SKAILE_BASE_ASSETS_DIR or ensure the package is installed.`\n    );\n  }\n  if (decl.url) {\n    return `Repository \"${name}\" (${decl.url}) is not available. Register it as a Library Source via \\`skaile source add\\`.`;\n  }\n  if (decl.path) {\n    return `Repository \"${name}\" path not found: ${decl.path}`;\n  }\n  return `Repository \"${name}\" has neither url nor path.`;\n}\n\nfunction findCatalogEntry(\n  entries: RuntimeCatalogEntry[],\n  query: { kind?: \"connector\"; name: string },\n): RuntimeCatalogEntry | undefined {\n  if (query.kind) {\n    return entries.find((e) => e.kind === query.kind && e.name === query.name);\n  }\n  const matches = entries.filter((e) => e.name === query.name);\n  if (matches.length === 1) return matches[0];\n  // 0 or >1 with no kind — caller must disambiguate.\n  return undefined;\n}\n"]}

package/dist/{chunk-44ZICIN4.js → chunk-TODD4VNR.js}

@@ -126,7 +126,10 @@ var SessionDispatcher = class {
    * @param command - The command to dispatch to the agent (a prompt or tool result).
    * @param senderId - ID of the user sending the command, if known.
    * @param mentions - Resolved mention objects extracted from the prompt text.
-   * @param visibility - Optional platform visibility envelope (F-23).
+   * @param visibility - Optional platform visibility envelope (F-23). When
+   *   `visibilityMode` is `HumansOnly`, or `Private` without the `"__agent__"`
+   *   sentinel in `privateRecipientIds` (B-30), the message is persisted and
+   *   broadcast to subscribers but NOT forwarded to the agent.
    * @param outgoingPrefix - Optional text prepended to the outgoing command's
    *   user-text field ({@link command.prompt} / `command.answer` /
    *   `command.content`) AFTER persistence but BEFORE history enrichment and
@@ -168,6 +171,9 @@ var SessionDispatcher = class {
     if (visibility?.visibilityMode === "HumansOnly") {
       return message;
     }
+    if (visibility?.visibilityMode === "Private" && !visibility.privateRecipientIds?.includes("__agent__")) {
+      return message;
+    }
     this.client.send(outgoing);
     return message;
   }
@@ -414,5 +420,5 @@ function isAgentAddressed(mentions) {
 }
 
 export { SessionDispatcher, isAgentAddressed, isMentioned, parseMentions };
-//# sourceMappingURL=chunk-44ZICIN4.js.map
-//# sourceMappingURL=chunk-44ZICIN4.js.map
+//# sourceMappingURL=chunk-TODD4VNR.js.map
+//# sourceMappingURL=chunk-TODD4VNR.js.map

package/dist/chunk-TODD4VNR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../session/src/dispatcher.ts","../session/src/mentions.ts"],"names":[],"mappings":";;;AAsDA,IAAM,eAAA,uBAAsB,GAAA,CAAI;AAAA,EAC9B,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA,eAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAiCM,IAAM,oBAAN,MAAwB;AAAA;AAAA,EAEpB,SAAA;AAAA,EACD,MAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA,uBAA+B,GAAA,EAAI;AAAA,EACnC,cAAA,uBAAkD,GAAA,EAAI;AAAA,EACtD,GAAA,GAAc,CAAA;AAAA,EACd,mBAAA,GAAoE;AAAA,IAC1E,QAAQ,EAAC;AAAA,IACT,YAAY;AAAC,GACf;AAAA;AAAA,EAGiB,yBAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EAET,gBAAA;AAAA;AAAA,EAMA,WAAA,GAAc,KAAA;AAAA;AAAA,EAEd,eAAA,GAAkB,EAAA;AAAA;AAAA;AAAA;AAAA,EAK1B,YAAY,IAAA,EAAgC;AAC1C,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACtB,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AAClB,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACtB,IAAA,IAAA,CAAK,yBAAA,GAA4B,KAAK,yBAAA,IAA6B,KAAA;AACnE,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,YAAA,IAAgB,EAAA;AACzC,IAAA,IAAA,CAAK,mBAAmB,IAAA,CAAK,eAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,gBAAgB,EAAA,EAEJ;AACd,IAAA,IAAA,CAAK,gBAAA,GAAmB,EAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,IAAA,GAAsB;AAC1B,IAAA,IAAA,CAAK,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,KAAK,SAAS,CAAA;AACvD,IAAA,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,CAAC,KAAA,KAAsB;AACzC,MAAA,KAAK,IAAA,CAAK,iBAAiB,KAAK,CAAA;AAAA,IAClC,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,SAAA,CACJ,YAAA,EACA,IAAA,EACoB;AACpB,IAAA,IAAA,CAAK,WAAA,CAAY,IAAI,YAAY,CAAA;AACjC,IAAA,IAAI,IAAA,EAAM,MAAA,KAAW,MAAA,IAAa,IAAA,EAAM,UAAU,MAAA,EAAW;AAC3D,MAAA,IAAA,CAAK,cAAA,CAAe,IAAI,YAAA,EAAc;AAAA,QACpC,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,IAAA,CAAK,SAAA,EAAW;AAAA,MAC5C,KAAA,EAAO,MAAM,KAAA,IAAS;AAAA,KACvB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,YAAA,EAA4B;AACtC,IAAA,IAAA,CAAK,WAAA,CAAY,OAAO,YAAY,CAAA;AACpC,IAAA,IAAA,CAAK,cAAA,CAAe,OAAO,YAAY,CAAA;AACvC,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,YAAY,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6BA,MAAM,WAAA,CACJ,OAAA,EACA,QAAA,EACA,QAAA,EACA,YACA,cAAA,EACyB;AACzB,IAAA,IAAI,CAAC,IAAA,CAAK,aAAA,CAAc,OAAO,CAAA,EAAG;AAChC,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,OAAO,CAAA;AACxB,MAAA,OAAO,IAAA;AAAA,IACT;AAIA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,OAAA,EAAS,QAAQ,CAAA;AAEpD,IAAA,IAAI,QAAA,EAAU,MAAA,EAAQ,OAAA,CAAQ,QAAA,GAAW,QAAA;AAMzC,IAAA,IAAI,UAAA,UAAoB,UAAA,GAAa,UAAA;AACrC,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA;AAI/B,IAAA,IAAI,QAAA,GAAyB,OAAA;AAC7B,IAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAC7B,MAAA,IAAI,SAAS,OAAA,CAAQ,MAAA;AAIrB,MAAA,IAAI,cAAA,EAAgB;AAClB,QAAA,MAAA,GAAS,CAAA,EAAG,cAAc,CAAA,EAAG,MAAM,CAAA,CAAA;AAAA,MACrC;AACA,MAAA,IAAI,KAAK,yBAAA,EAA2B;AAClC,QAAA,MAAA,GAAS,MAAM,IAAA,CAAK,uBAAA,CAAwB,MAAM,CAAA;AAAA,MACpD;AACA,MAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,QAAA,MAAA,GAAS,IAAA,CAAK,gBAAA,CAAiB,MAAA,EAAQ,QAAA,EAAU,QAAQ,OAAO,CAAA;AAAA,MAClE;AACA,MAAA,IAAI,MAAA,KAAW,QAAQ,MAAA,EAAQ;AAC7B,QAAA,QAAA,GAAW,EAAE,GAAG,OAAA,EAAS,MAAA,EAAO;AAAA,MAClC;AAAA,IACF,CAAA,MAAA,IAAW,cAAA,IAAkB,OAAA,CAAQ,IAAA,KAAS,OAAA,EAAS;AAIrD,MAAA,QAAA,GAAW,EAAE,GAAG,OAAA,EAAS,MAAA,EAAQ,GAAG,cAAc,CAAA,EAAG,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAG;AAAA,IACxE,CAAA,MAAA,IAAW,cAAA,IAAkB,OAAA,CAAQ,IAAA,KAAS,gBAAA,EAAkB;AAG9D,MAAA,QAAA,GAAW,EAAE,GAAG,OAAA,EAAS,OAAA,EAAS,GAAG,cAAc,CAAA,EAAG,OAAA,CAAQ,OAAO,CAAA,CAAA,EAAG;AAAA,IAC1E;AAYA,IAAA,IAAI,UAAA,EAAY,mBAAmB,YAAA,EAAc;AAC/C,MAAA,OAAO,OAAA;AAAA,IACT;AASA,IAAA,IACE,UAAA,EAAY,mBAAmB,SAAA,IAC/B,CAAC,WAAW,mBAAA,EAAqB,QAAA,CAAS,WAAW,CAAA,EACrD;AACA,MAAA,OAAO,OAAA;AAAA,IACT;AAEA,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,QAAQ,CAAA;AACzB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,YAAA,CAAa,KAAA,EAAmB,QAAA,EAA+C;AACnF,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,KAAA,EAAO,QAAQ,CAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAY,IAAA,EAAgE;AAChF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,IAAA,CAAK,WAAW,IAAI,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,kBAAA,GAAmE;AACrE,IAAA,OAAO,IAAA,CAAK,mBAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,cAAc,SAAA,EAA+D;AAC3E,IAAA,MAAM,KAAA,GACJ,KAAK,mBAAA,CAAoB,MAAA,CAAO,WAAW,CAAA,IAC3C,IAAA,CAAK,mBAAA,CAAoB,UAAA,CAAW,MAAA,KAAW,CAAA;AACjD,IAAA,IAAI,KAAA,KAAU,UAAU,MAAA,CAAO,MAAA,GAAS,KAAK,SAAA,CAAU,UAAA,CAAW,SAAS,CAAA,CAAA,EAAI;AAC7E,MAAA,IAAA,CAAK,mBAAA,GAAsB,SAAA;AAAA,IAC7B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,eAAA,CACJ,OAAA,EACA,SAAA,GAAY,GAAA,EACqB;AACjC,IAAA,OAAO,IAAI,OAAA,CAAgC,CAAC,OAAA,EAAS,MAAA,KAAW;AAC9D,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,IAAA,CAAK,MAAA,CAAO,SAAS,OAAO,CAAA;AAC5B,QAAA,MAAA;AAAA,UACE,IAAI,KAAA;AAAA,YACF,oCAAoC,SAAS,CAAA,IAAA,EAAO,QAAQ,SAAS,CAAA,CAAA,EAAI,QAAQ,WAAW,CAAA;AAAA;AAC9F,SACF;AAAA,MACF,GAAG,SAAS,CAAA;AAEZ,MAAA,MAAM,OAAA,GAAU,CAAC,KAAA,KAAsB;AACrC,QAAA,IAAI,MAAM,IAAA,KAAS,mBAAA,IAAuB,KAAA,CAAM,SAAA,KAAc,QAAQ,SAAA,EAAW;AAC/E,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,IAAA,CAAK,MAAA,CAAO,SAAS,OAAO,CAAA;AAC5B,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf;AAAA,MACF,CAAA;AAEA,MAAA,IAAA,CAAK,MAAA,CAAO,QAAQ,OAAO,CAAA;AAC3B,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,IAC1B,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,KAAA,EAAyB;AACjC,IAAA,KAAA,MAAW,YAAA,IAAgB,KAAK,WAAA,EAAa;AAC3C,MAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AAAA,IACzC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,UAAA,GAA4B;AAChC,IAAA,KAAA,MAAW,EAAA,IAAM,KAAK,WAAA,EAAa;AACjC,MAAA,IAAA,CAAK,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AACvB,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAC1B,IAAA,MAAM,IAAA,CAAK,OAAO,OAAA,EAAQ;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAA,GAAwB;AACtB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,eAAA,GAAkB,EAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,GAAwB;AACtB,IAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,IAAA,MAAM,OAAO,IAAA,CAAK,eAAA;AAClB,IAAA,IAAA,CAAK,eAAA,GAAkB,EAAA;AACvB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,YAAA,GAAwB;AAC1B,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAc,wBAAwB,aAAA,EAAwC;AAC5E,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,KAAK,SAAA,EAAW;AAAA,MAC5D,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAGD,IAAA,MAAM,OAAA,GAAU,QAAA,CACb,MAAA,CAAO,CAAC,CAAA,KAAM;AACb,MAAA,MAAM,IAAA,GAAO,EAAE,OAAA,CAAQ,IAAA;AACvB,MAAA,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,UAAA,IAAc,IAAA,KAAS,UAAA;AAAA,IAC9D,CAAC,CAAA,CACA,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAEd,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,OAAO,aAAA;AAAA,IACT;AAEA,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM;AAC/B,MAAA,MAAM,IAAI,CAAA,CAAE,OAAA;AACZ,MAAA,IAAI,CAAA,CAAE,SAAS,QAAA,EAAU;AACvB,QAAA,OAAO,CAAA,QAAA,EAAW,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAC,CAAA,CAAA;AAAA,MAC1C;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,YAAY,EAAE,CAAA;AACpD,MAAA,OAAO,gBAAgB,OAAO,CAAA,CAAA;AAAA,IAChC,CAAC,CAAA;AAED,IAAA,OAAO,CAAA;AAAA,EAA2B,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA;;AAAA,EAAgC,aAAa,CAAA,CAAA;AAAA,EACjG;AAAA,EAEA,MAAc,gBAAA,CAAiB,KAAA,EAAmB,QAAA,EAA+C;AAE/F,IAAA,IAAI,KAAK,WAAA,EAAa;AACpB,MAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,QAAA,IAAA,CAAK,mBAAoB,KAAA,CAA8B,OAAA;AAAA,MACzD;AAEA,MAAA,KAAA,MAAW,YAAA,IAAgB,KAAK,WAAA,EAAa;AAC3C,QAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AAAA,MACzC;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,IAAI,KAAA,CAAM,SAAS,qBAAA,EAAuB;AACxC,MAAA,MAAM,OAAA,GAAU,KAAA;AAChB,MAAA,IAAA,CAAK,mBAAA,GAAsB;AAAA,QACzB,MAAA,EAAQ,OAAA,CAAQ,MAAA,IAAU,EAAC;AAAA,QAC3B,UAAA,EAAY,OAAA,CAAQ,UAAA,IAAc;AAAC,OACrC;AAAA,IACF;AAEA,IAAA,IAAI,OAAA,GAA0B,IAAA;AAC9B,IAAA,IAAI,IAAA,CAAK,aAAA,CAAc,KAAK,CAAA,EAAG;AAC7B,MAAA,OAAA,GAAU,IAAA,CAAK,cAAc,KAAK,CAAA;AAClC,MAAA,IAAI,QAAA,EAAU,MAAA,EAAQ,OAAA,CAAQ,QAAA,GAAW,QAAA;AACzC,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA;AAAA,IACjC;AAEA,IAAA,KAAA,MAAW,YAAA,IAAgB,KAAK,WAAA,EAAa;AAC3C,MAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AAAA,IACzC;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEQ,cAAc,OAAA,EAA6C;AACjE,IAAA,OAAO,CAAC,eAAA,CAAgB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA;AAAA,EAC1C;AAAA,EAEQ,aAAA,CAAc,SAAoC,QAAA,EAA4B;AACpF,IAAA,IAAA,CAAK,GAAA,EAAA;AACL,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,OAAO,UAAA,EAAW;AAAA,MACtB,KAAK,IAAA,CAAK,GAAA;AAAA,MACV,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,MAClC,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa,EAAC;AAAA,MAC/B;AAAA,KACF;AAAA,EACF;AACF;;;ACrfA,IAAM,UAAA,GAAa,SAAA;AACnB,IAAM,iBAAA,GAAyC,IAAI,GAAA,CAAI,cAAc,CAAA;AAgB9D,SAAS,aAAA,CAAc,MAAc,QAAA,EAAsC;AAChF,EAAA,MAAM,WAAsB,EAAC;AAE7B,EAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,QAAA,CAAS,UAAU,CAAA,EAAG;AAC7C,IAAA,MAAM,KAAA,GAAQ,MAAM,CAAC,CAAA;AACrB,IAAA,MAAM,SAAS,KAAA,CAAM,KAAA;AACrB,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA;AAExB,IAAA,IAAI,iBAAA,CAAkB,GAAA,CAAI,KAAK,CAAA,EAAG;AAChC,MAAA,MAAM,KAAA,GAAQ,KAAA;AACd,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,IAAA,EAAM,OAAA;AAAA,QACN,KAAA;AAAA,QACA,QAAA,EAAU,QAAA,CAAS,YAAA,CAAa,KAAK,CAAA;AAAA,QACrC,MAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH,CAAA,MAAO;AACL,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,WAAA,CAAY,KAAK,CAAA;AACvC,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,QAAA,CAAS,IAAA,CAAK;AAAA,UACZ,IAAA,EAAM,MAAA;AAAA,UACN,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,MAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAIA,EAAA,OAAO,QAAA,CAAS,KAAK,CAAC,CAAA,EAAG,MAAM,CAAA,CAAE,MAAA,GAAS,EAAE,MAAM,CAAA;AACpD;AAcO,SAAS,WAAA,CAAY,QAAgB,QAAA,EAA8B;AACxE,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAI,EAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,MAAA,KAAW,QAAQ,OAAO,IAAA;AACrD,IAAA,IAAI,CAAA,CAAE,SAAS,OAAA,IAAW,CAAA,CAAE,SAAS,QAAA,CAAS,MAAM,GAAG,OAAO,IAAA;AAAA,EAChE;AACA,EAAA,OAAO,KAAA;AACT;AAOA,IAAM,+BAA0C,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAC,CAAA;AAYzE,SAAS,iBAAiB,QAAA,EAA8B;AAC7D,EAAA,OAAO,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,OAAA,IAAW,YAAA,CAAa,GAAA,CAAI,CAAA,CAAE,KAAK,CAAC,CAAA;AAC7E","file":"chunk-TODD4VNR.js","sourcesContent":["import type { AgentClient } from \"@skaile/workspaces/client\";\nimport type {\n  AgentCommand,\n  AgentEvent,\n  ConnectorRequestCommand,\n  ConnectorResponseEvent,\n  Mention,\n  ReplyRef,\n} from \"@skaile/workspaces/types\";\nimport type { Message, MessageStore, SubscriberInfo, SubscriberTransport } from \"./types.js\";\n\n/**\n * Construction options for {@link SessionDispatcher}.\n *\n * All three infrastructure objects (`client`, `store`, `transport`) are\n * injected by the caller so the dispatcher remains testable and framework-agnostic.\n *\n * @docLink packages/session/api-reference#session-dispatcher\n */\nexport interface SessionDispatcherOptions {\n  /** Unique identifier for the session this dispatcher manages. */\n  sessionId: string;\n  /** Connected agent client used to send commands and receive events. */\n  client: AgentClient;\n  /** Persistence layer for all non-transient messages. */\n  store: MessageStore;\n  /** Fan-out transport for broadcasting events to connected frontends. */\n  transport: SubscriberTransport;\n  /**\n   * When true, the dispatcher prepends conversation history to every prompt\n   * command sent to the agent. Enable for agents without native session\n   * continuity (e.g. mock mode). Agents with native multi-turn support\n   * (Claude SDK, OMP) should set this to false to avoid duplicate context.\n   * Default: false.\n   */\n  injectConversationHistory?: boolean;\n  /** Max conversation history messages to include in enriched prompts (default: 50). */\n  historyLimit?: number;\n  /**\n   * Optional callback to transform prompt text before forwarding to the agent.\n   * The original (untransformed) prompt is persisted and broadcast to subscribers.\n   * Applied after conversation history enrichment. Use this to inject context\n   * (e.g. UI state) that the agent should see but subscribers should not.\n   */\n  transformPrompt?: (prompt: string, senderId: string | undefined, replyTo?: ReplyRef) => string;\n}\n\n/**\n * Command and event types classified as transient RPC — high-frequency,\n * ephemeral, and not part of the conversation history.\n *\n * Matching payloads are forwarded and broadcast but never persisted\n * or assigned a sequence number, preventing bloat in the message log.\n */\nconst TRANSIENT_TYPES = new Set([\n  \"resource_request\",\n  \"resource_response\",\n  \"resources_available\",\n  \"commands_available\",\n  \"state_changed\",\n  \"typing\",\n  \"user_message\",\n  // OMP session tracking — forwarded to subscribers but not persisted\n  \"session_info\",\n  // Structured log forwarding — high-volume; persisted in per-session SQLite, not the message store\n  \"log_entry\",\n  // Generic connector dispatch — system RPC, not chat messages.\n  // Replaces the 6 typed flow commands removed in Protocol 2.2 (Phase 4 of the\n  // flow-connector extraction). `connector_mutate` against the `flow` connector\n  // is now how hosts drive flow execution between turns.\n  \"connector_mutate\",\n  \"connector_query\",\n  \"connector_query_response\",\n]);\n\n/**\n * Bridges a single agent session between an {@link AgentClient} and one or more\n * frontend subscribers.\n *\n * Responsibilities:\n * - Persists every non-transient command and event as a {@link Message} with a\n *   monotonic sequence number via the injected {@link MessageStore}.\n * - Fans agent events out to all connected frontends via the injected\n *   {@link SubscriberTransport}.\n * - Optionally enriches prompt commands with conversation history so agents\n *   without native multi-turn support maintain context across turns.\n *\n * **Lifecycle:** call {@link init} before any other method, and {@link disconnect}\n * when the session ends.\n *\n * @example\n * ```ts\n * const dispatcher = new SessionDispatcher({\n *   sessionId: 'sess-123',\n *   client: agentClient,\n *   store: prismaMessageStore,\n *   transport: trpcTransport,\n * })\n * await dispatcher.init()\n * const history = await dispatcher.subscribe('ws-conn-abc', { limit: 50 })\n * const msg = await dispatcher.sendCommand({ type: 'prompt', prompt: 'Hello' }, 'user-42')\n * await dispatcher.disconnect()\n * ```\n *\n * @docLink packages/session/api-reference#session-dispatcher\n */\nexport class SessionDispatcher {\n  /** The session identifier this dispatcher is bound to. */\n  readonly sessionId: string;\n  private client: AgentClient;\n  private store: MessageStore;\n  private transport: SubscriberTransport;\n  private subscribers: Set<string> = new Set();\n  private subscriberMeta: Map<string, SubscriberInfo> = new Map();\n  private seq: number = 0;\n  private _availableResources: { mounts: unknown[]; connectors: unknown[] } = {\n    mounts: [],\n    connectors: [],\n  };\n\n  /** Whether to inject conversation history into prompt commands. */\n  private readonly injectConversationHistory: boolean;\n  /** Maximum number of history messages to include in enriched prompts. */\n  private readonly historyLimit: number;\n  /** Optional prompt transformer applied before forwarding (after persistence). */\n  private _transformPrompt?: (\n    prompt: string,\n    senderId: string | undefined,\n    replyTo?: ReplyRef,\n  ) => string;\n  /** Whether the dispatcher is currently in compaction mode. */\n  private _compacting = false;\n  /** Accumulated text content during compaction. */\n  private _compactionText = \"\";\n\n  /**\n   * @param opts - Dispatcher configuration — see {@link SessionDispatcherOptions}.\n   */\n  constructor(opts: SessionDispatcherOptions) {\n    this.sessionId = opts.sessionId;\n    this.client = opts.client;\n    this.store = opts.store;\n    this.transport = opts.transport;\n    this.injectConversationHistory = opts.injectConversationHistory ?? false;\n    this.historyLimit = opts.historyLimit ?? 50;\n    this._transformPrompt = opts.transformPrompt;\n  }\n\n  /**\n   * Replace the prompt transformer at runtime.\n   *\n   * Useful when additional context (e.g. a UI state cache) becomes available\n   * after the dispatcher is constructed but before the first prompt is sent.\n   */\n  set transformPrompt(fn:\n    | ((prompt: string, senderId: string | undefined, replyTo?: ReplyRef) => string)\n    | undefined,) {\n    this._transformPrompt = fn;\n  }\n\n  /**\n   * Initialize the dispatcher for this session.\n   *\n   * Restores the monotonic sequence counter from the store and wires up the\n   * agent event listener. Must be called once before any other method.\n   *\n   * @throws If {@link MessageStore.getLatestSeq} rejects.\n   */\n  async init(): Promise<void> {\n    this.seq = await this.store.getLatestSeq(this.sessionId);\n    this.client.onEvent((event: AgentEvent) => {\n      void this.handleAgentEvent(event);\n    });\n  }\n\n  /**\n   * Register a frontend subscriber and return recent message history.\n   *\n   * Subsequent agent events are pushed to this subscriber via the\n   * {@link SubscriberTransport} until {@link unsubscribe} is called.\n   *\n   * @param subscriberId - Opaque connection ID (e.g. WebSocket session ID).\n   * @param opts - Optional subscription options.\n   * @param opts.limit - Number of recent messages to return (default: 50).\n   * @returns Recent messages ordered by seq ascending.\n   */\n  async subscribe(\n    subscriberId: string,\n    opts?: { limit?: number; userId?: string; roles?: string[] },\n  ): Promise<Message[]> {\n    this.subscribers.add(subscriberId);\n    if (opts?.userId !== undefined || opts?.roles !== undefined) {\n      this.subscriberMeta.set(subscriberId, {\n        userId: opts.userId,\n        roles: opts.roles,\n      });\n    }\n    return this.store.getMessages(this.sessionId, {\n      limit: opts?.limit ?? 50,\n    });\n  }\n\n  /**\n   * Remove a frontend subscriber and release transport resources.\n   *\n   * @param subscriberId - The ID passed to {@link subscribe}.\n   */\n  unsubscribe(subscriberId: string): void {\n    this.subscribers.delete(subscriberId);\n    this.subscriberMeta.delete(subscriberId);\n    this.transport.remove(subscriberId);\n  }\n\n  /**\n   * Send a command from a frontend to the agent.\n   *\n   * Persistent commands are wrapped in a Message envelope and stored before\n   * forwarding. Transient commands (resource RPC) are forwarded directly\n   * without persistence — returns null in that case.\n   *\n   * For `prompt` commands, the original message is persisted, but an enriched\n   * version (with conversation history prepended) is sent to the agent so it\n   * maintains context across turns.\n   *\n   * @param command - The command to dispatch to the agent (a prompt or tool result).\n   * @param senderId - ID of the user sending the command, if known.\n   * @param mentions - Resolved mention objects extracted from the prompt text.\n   * @param visibility - Optional platform visibility envelope (F-23). When\n   *   `visibilityMode` is `HumansOnly`, or `Private` without the `\"__agent__\"`\n   *   sentinel in `privateRecipientIds` (B-30), the message is persisted and\n   *   broadcast to subscribers but NOT forwarded to the agent.\n   * @param outgoingPrefix - Optional text prepended to the outgoing command's\n   *   user-text field ({@link command.prompt} / `command.answer` /\n   *   `command.content`) AFTER persistence but BEFORE history enrichment and\n   *   {@link transformPrompt}. The persisted {@link Message} envelope is built\n   *   from the original `command` and never sees the prefix. Use this to\n   *   inject one-shot wake-time context (Option B1 pending restoration\n   *   prompt) that the agent must see but UI subscribers must not.\n   * @returns The persisted Message envelope, or null for transient command types.\n   */\n  async sendCommand(\n    command: AgentCommand,\n    senderId?: string,\n    mentions?: Mention[],\n    visibility?: NonNullable<Message[\"visibility\"]>,\n    outgoingPrefix?: string,\n  ): Promise<Message | null> {\n    if (!this.shouldPersist(command)) {\n      this.client.send(command);\n      return null;\n    }\n    // Persist the original command (unenriched/untransformed/un-prefixed).\n    // `outgoingPrefix` is intentionally NOT applied here — it must only\n    // reach the agent client, never the MessageStore.\n    const message = this.createMessage(command, senderId);\n    // @TODO: Code-Review: v1 back-compat — mentions field no longer used by Protocol v2+ persistence layers; remove once platform PrismaMessageStore is migrated\n    if (mentions?.length) message.mentions = mentions;\n    // F-23: platform-extension visibility metadata (3.2.0). The platform\n    // MessageStore reads this off the envelope and writes the\n    // Message.visibilityMode column + recipient rows atomically with\n    // the message itself — no post-send patch, no race window where a\n    // concurrent send could mis-tag the wrong message id.\n    if (visibility) message.visibility = visibility;\n    await this.store.append(message);\n\n    // Build the outgoing command — enrich and transform prompt commands\n    // while leaving the persisted message untouched.\n    let outgoing: AgentCommand = command;\n    if (command.type === \"prompt\") {\n      let prompt = command.prompt;\n      // Restoration prefix lands FIRST (innermost) so the user's typed\n      // text remains adjacent to its own framing, with history and reply\n      // preambles wrapping the combined block from the outside in.\n      if (outgoingPrefix) {\n        prompt = `${outgoingPrefix}${prompt}`;\n      }\n      if (this.injectConversationHistory) {\n        prompt = await this.enrichPromptWithHistory(prompt);\n      }\n      if (this._transformPrompt) {\n        prompt = this._transformPrompt(prompt, senderId, command.replyTo);\n      }\n      if (prompt !== command.prompt) {\n        outgoing = { ...command, prompt };\n      }\n    } else if (outgoingPrefix && command.type === \"reply\") {\n      // `reply` carries user text in `answer`. Prefix is invisible to\n      // subscribers (who see the persisted Message.payload.answer) but\n      // visible to the agent driver.\n      outgoing = { ...command, answer: `${outgoingPrefix}${command.answer}` };\n    } else if (outgoingPrefix && command.type === \"custom_message\") {\n      // `custom_message` carries user text in `content`. Same persist/send\n      // split as the `reply` branch above.\n      outgoing = { ...command, content: `${outgoingPrefix}${command.content}` };\n    }\n\n    // F-23 P3 review (B1) — HumansOnly visibility means the message is\n    // intended for human recipients only; the agent must NOT see the\n    // prompt content. Persist + broadcast (humans read it via\n    // SubscriberTransport) but skip the agent forward. This closes a\n    // critical privacy hole where `@user: secret` was persisted with\n    // visibilityMode='HumansOnly' yet still reached the LLM. Threads\n    // starting HumansOnly stay agent-invisible even on Public follow-ups\n    // (parent-thread visibility threading is intentionally out of scope\n    // for v1; only the immediate message is gated). See\n    // platform/_concept/plans/f-23-p3-review-blockers.md.\n    if (visibility?.visibilityMode === \"HumansOnly\") {\n      return message;\n    }\n\n    // B-30 — Private visibility (F-23 `@mention_` underscore suffix) means the\n    // message is addressed to an explicit recipient set. The agent is only a\n    // recipient when the sender wrote `@agent_`, which the platform encodes as\n    // the `\"__agent__\"` sentinel in `privateRecipientIds`. When the sentinel is\n    // absent the message is a private human-to-human exchange: persist +\n    // broadcast (the named human recipients read it via SubscriberTransport)\n    // but skip the agent forward so the LLM never sees private content.\n    if (\n      visibility?.visibilityMode === \"Private\" &&\n      !visibility.privateRecipientIds?.includes(\"__agent__\")\n    ) {\n      return message;\n    }\n\n    this.client.send(outgoing);\n    return message;\n  }\n\n  /**\n   * Persist a synthetic event (not received from the agent) and broadcast it.\n   *\n   * Used by the platform to inject events like a partial-text `finished` record\n   * before a cancel command.\n   *\n   * @param event - The agent event to persist.\n   * @param mentions - Resolved mentions from the originating command.\n   */\n  async persistEvent(event: AgentEvent, mentions?: Mention[]): Promise<Message | null> {\n    return this.handleAgentEvent(event, mentions);\n  }\n\n  /**\n   * Load paginated message history for this session.\n   *\n   * @param opts.before - Return messages with seq strictly less than this value.\n   * @param opts.limit - Maximum number of messages to return.\n   */\n  async getMessages(opts?: { before?: number; limit?: number }): Promise<Message[]> {\n    return this.store.getMessages(this.sessionId, opts);\n  }\n\n  /**\n   * Available mounts and connectors captured from the most recent\n   * `resources_available` event emitted by the agent on connect.\n   *\n   * Empty until the agent emits the event or {@link seedResources} is called.\n   */\n  get availableResources(): { mounts: unknown[]; connectors: unknown[] } {\n    return this._availableResources;\n  }\n\n  /**\n   * Seed the available resources from an external cache.\n   *\n   * This is needed when the dispatcher is created after the agent has already\n   * emitted `resources_available` on WebSocket connect. Without seeding, the\n   * dispatcher would report an empty resource list until the next reconnect.\n   *\n   * @param resources - Resource handles to register before the session starts.\n   */\n  seedResources(resources: { mounts: unknown[]; connectors: unknown[] }): void {\n    const empty =\n      this._availableResources.mounts.length === 0 &&\n      this._availableResources.connectors.length === 0;\n    if (empty && (resources.mounts.length > 0 || resources.connectors.length > 0)) {\n      this._availableResources = resources;\n    }\n  }\n\n  /**\n   * Send a resource request and await the correlated response.\n   *\n   * This is a convenience method for request/response resource RPC.\n   * The request is transient (not persisted). A one-shot event listener\n   * waits for the matching `resource_response` by `requestId`.\n   *\n   * @param command - A ConnectorRequestCommand (caller must set requestId).\n   * @param timeoutMs - How long to wait before rejecting (default: 30s).\n   */\n  async requestResource(\n    command: ConnectorRequestCommand,\n    timeoutMs = 30_000,\n  ): Promise<ConnectorResponseEvent> {\n    return new Promise<ConnectorResponseEvent>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.client.offEvent(handler);\n        reject(\n          new Error(\n            `Resource request timed out after ${timeoutMs}ms: ${command.operation} ${command.connectorId}`,\n          ),\n        );\n      }, timeoutMs);\n\n      const handler = (event: AgentEvent) => {\n        if (event.type === \"resource_response\" && event.requestId === command.requestId) {\n          clearTimeout(timer);\n          this.client.offEvent(handler);\n          resolve(event);\n        }\n      };\n\n      this.client.onEvent(handler);\n      this.client.send(command);\n    });\n  }\n\n  /**\n   * Broadcast a transient event to all subscribers without persisting it.\n   *\n   * Used for ephemeral signals like typing indicators or user-command\n   * echoes that other subscribers need to see in real time.\n   */\n  broadcast(event: AgentEvent): void {\n    for (const subscriberId of this.subscribers) {\n      this.transport.send(subscriberId, event);\n    }\n  }\n\n  /** Disconnect the agent client and clean up all subscribers. */\n  async disconnect(): Promise<void> {\n    for (const id of this.subscribers) {\n      this.transport.remove(id);\n    }\n    this.subscribers.clear();\n    this.subscriberMeta.clear();\n    await this.client.dispose();\n  }\n\n  /**\n   * Enter compaction mode. While active, events from the agent are captured\n   * but NOT persisted. Text content is accumulated for the snapshot.\n   */\n  beginCompaction(): void {\n    this._compacting = true;\n    this._compactionText = \"\";\n  }\n\n  /**\n   * Exit compaction mode and return the accumulated text.\n   * The caller is responsible for creating and emitting the snapshot event.\n   */\n  endCompaction(): string {\n    this._compacting = false;\n    const text = this._compactionText;\n    this._compactionText = \"\";\n    return text;\n  }\n\n  /** Whether the dispatcher is currently in compaction mode. */\n  get isCompacting(): boolean {\n    return this._compacting;\n  }\n\n  // -- Private ----------------------------------------------------------------\n\n  /**\n   * Build an enriched prompt by prepending conversation history.\n   *\n   * Loads recent persisted messages, formats user/assistant turns, and\n   * wraps them in a `<conversation_history>` block. The current user\n   * message (just persisted) is excluded since it is already the prompt.\n   *\n   * Returns the original prompt unchanged if there is no prior history.\n   */\n  private async enrichPromptWithHistory(currentPrompt: string): Promise<string> {\n    const messages = await this.store.getMessages(this.sessionId, {\n      limit: this.historyLimit,\n    });\n\n    // Filter to conversation-relevant types and exclude the message we just appended\n    const history = messages\n      .filter((m) => {\n        const type = m.payload.type;\n        return type === \"prompt\" || type === \"finished\" || type === \"question\";\n      })\n      .slice(0, -1); // Exclude the current message (last by seq)\n\n    if (history.length === 0) {\n      return currentPrompt;\n    }\n\n    const lines = history.map((m) => {\n      const p = m.payload as Record<string, unknown>;\n      if (p.type === \"prompt\") {\n        return `[User]: ${String(p.prompt ?? \"\")}`;\n      }\n      // finished (assistant response) or question\n      const content = String(p.summary ?? p.question ?? \"\");\n      return `[Assistant]: ${content}`;\n    });\n\n    return `<conversation_history>\\n${lines.join(\"\\n\")}\\n</conversation_history>\\n\\n${currentPrompt}`;\n  }\n\n  private async handleAgentEvent(event: AgentEvent, mentions?: Mention[]): Promise<Message | null> {\n    // ── Compaction mode: capture text but don't persist ─────────────────\n    if (this._compacting) {\n      if (event.type === \"text\") {\n        this._compactionText += (event as { content: string }).content;\n      }\n      // Still broadcast to subscribers (UI shows compaction progress)\n      for (const subscriberId of this.subscribers) {\n        this.transport.send(subscriberId, event);\n      }\n      return null;\n    }\n\n    // Capture resource metadata when the server announces available resources\n    if (event.type === \"resources_available\") {\n      const payload = event as { mounts?: unknown[]; connectors?: unknown[] };\n      this._availableResources = {\n        mounts: payload.mounts ?? [],\n        connectors: payload.connectors ?? [],\n      };\n    }\n\n    let message: Message | null = null;\n    if (this.shouldPersist(event)) {\n      message = this.createMessage(event);\n      if (mentions?.length) message.mentions = mentions;\n      await this.store.append(message);\n    }\n\n    for (const subscriberId of this.subscribers) {\n      this.transport.send(subscriberId, event);\n    }\n    return message;\n  }\n\n  private shouldPersist(payload: AgentCommand | AgentEvent): boolean {\n    return !TRANSIENT_TYPES.has(payload.type);\n  }\n\n  private createMessage(payload: AgentCommand | AgentEvent, senderId?: string): Message {\n    this.seq++;\n    return {\n      id: crypto.randomUUID(),\n      seq: this.seq,\n      timestamp: new Date().toISOString(),\n      sessionId: this.sessionId,\n      ...(senderId ? { senderId } : {}),\n      payload,\n    };\n  }\n}\n","import { MENTION_GROUPS } from \"@skaile/workspaces/types\";\nimport type { Mention, MentionGroup } from \"@skaile/workspaces/types\";\n\n/**\n * Re-exported from `@skaile/workspaces/types` so consumers can import mention\n * types directly from `@skaile/workspaces/session` without a separate dependency.\n */\nexport type { Mention, MentionGroup };\n\n// ---------------------------------------------------------------------------\n// MentionResolver\n// ---------------------------------------------------------------------------\n\n/**\n * Consumer-provided resolver that maps @mention tokens to users and groups.\n *\n * The platform provides an implementation backed by Prisma and the live\n * presence service. Tests use lightweight mocks.\n *\n * @example\n * ```ts\n * const resolver: MentionResolver = {\n *   resolveUser: (name) => db.users.findByName(name),\n *   resolveGroup: (group) => presence.getMemberIds(group),\n *   getOnlineUserIds: () => presence.getOnlineIds(),\n * }\n * ```\n *\n * @docLink packages/session/api-reference#mention-resolver\n */\nexport interface MentionResolver {\n  /**\n   * Resolve a `@name` token to a user record.\n   *\n   * @param name - The token after the `@` symbol (case-insensitive lookup).\n   * @returns User record, or null if the name is not found.\n   */\n  resolveUser(name: string): { userId: string; name: string } | null;\n  /**\n   * Resolve a group mention token to the list of member user IDs.\n   *\n   * @param group - The well-known group name (e.g. `\"agent\"`, `\"all\"`).\n   * @returns Array of member user IDs belonging to the group.\n   */\n  resolveGroup(group: MentionGroup): string[];\n  /** Return the IDs of users currently online (used by the `here` and `humans_here` groups). */\n  getOnlineUserIds(): string[];\n}\n\n// ---------------------------------------------------------------------------\n// parseMentions\n// ---------------------------------------------------------------------------\n\nconst MENTION_RE = /@(\\w+)/g;\nconst MENTION_GROUP_SET: ReadonlySet<string> = new Set(MENTION_GROUPS);\n\n/**\n * Scan `text` for @token patterns and return resolved {@link Mention} objects.\n *\n * - Well-known group tokens (`agent`, `humans`, `humans_here`, `here`, `all`)\n *   are resolved via {@link MentionResolver.resolveGroup}.\n * - All other tokens are resolved via {@link MentionResolver.resolveUser}.\n * - Tokens that cannot be resolved are silently ignored.\n * - Results are sorted by character offset ascending.\n *\n * @param text - Raw message text to scan for `@token` patterns.\n * @param resolver - Resolver that maps tokens to users and groups.\n * @returns Resolved mentions ordered by position in text.\n * @docLink packages/session/api-reference#mention-resolver\n */\nexport function parseMentions(text: string, resolver: MentionResolver): Mention[] {\n  const mentions: Mention[] = [];\n\n  for (const match of text.matchAll(MENTION_RE)) {\n    const token = match[1]!;\n    const offset = match.index!;\n    const length = match[0].length; // includes the @\n\n    if (MENTION_GROUP_SET.has(token)) {\n      const group = token as MentionGroup;\n      mentions.push({\n        type: \"group\",\n        group,\n        resolved: resolver.resolveGroup(group),\n        offset,\n        length,\n      });\n    } else {\n      const user = resolver.resolveUser(token);\n      if (user) {\n        mentions.push({\n          type: \"user\",\n          userId: user.userId,\n          name: user.name,\n          offset,\n          length,\n        });\n      }\n    }\n  }\n\n  // matchAll iterates left-to-right so results are already sorted by offset,\n  // but sort explicitly in case the implementation changes.\n  return mentions.sort((a, b) => a.offset - b.offset);\n}\n\n// ---------------------------------------------------------------------------\n// isMentioned\n// ---------------------------------------------------------------------------\n\n/**\n * Returns true if `userId` is directly mentioned or is a member of any\n * group mention's resolved list.\n *\n * @param userId - The user ID to check (e.g. from the auth context).\n * @param mentions - Parsed mentions from {@link parseMentions}.\n * @docLink packages/session/api-reference#mention-resolver\n */\nexport function isMentioned(userId: string, mentions: Mention[]): boolean {\n  for (const m of mentions) {\n    if (m.type === \"user\" && m.userId === userId) return true;\n    if (m.type === \"group\" && m.resolved.includes(userId)) return true;\n  }\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// isAgentAddressed\n// ---------------------------------------------------------------------------\n\n/** Groups that include the agent in their resolved membership. */\nconst AGENT_GROUPS: ReadonlySet<MentionGroup> = new Set([\"agent\", \"here\", \"all\"]);\n\n/**\n * Returns true if the agent is addressed by any mention in the list.\n *\n * The groups `@agent`, `@here`, and `@all` address the agent. `@humans`\n * and `@humans_here` do not. Individual user mentions are also not matched\n * here — agent addressing is group-based.\n *\n * @param mentions - Parsed mentions from {@link parseMentions}.\n * @docLink packages/session/api-reference#mention-resolver\n */\nexport function isAgentAddressed(mentions: Mention[]): boolean {\n  return mentions.some((m) => m.type === \"group\" && AGENT_GROUPS.has(m.group));\n}\n"]}

package/dist/{chunk-77CUYYO3.js → chunk-VAJB2UJ5.js}

@@ -1,7 +1,7 @@
 import { logErr } from './chunk-4NDWKA64.js';
-import { knowledgeKindProvider } from './chunk-DOMCYP7D.js';
-import { createDefaultRegistry } from './chunk-46T37EBP.js';
-import { flowKindProvider } from './chunk-ZUQIXLRJ.js';
+import { knowledgeKindProvider } from './chunk-42OQF7UU.js';
+import { createDefaultRegistry } from './chunk-GKIA2PU5.js';
+import { flowKindProvider } from './chunk-ICS76R4T.js';
 
 // cli/src/open-registry.ts
 function createFullRegistry() {
@@ -97,5 +97,5 @@ async function openUserLibraryManager() {
 }
 
 export { createFullRegistry, openCatalogSource, openLibrary, openUserLibraryManager, resolveCatalogSource };
-//# sourceMappingURL=chunk-77CUYYO3.js.map
-//# sourceMappingURL=chunk-77CUYYO3.js.map
+//# sourceMappingURL=chunk-VAJB2UJ5.js.map
+//# sourceMappingURL=chunk-VAJB2UJ5.js.map

package/dist/{chunk-77CUYYO3.js.map → chunk-VAJB2UJ5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/open-registry.ts","../cli/src/open-library.ts"],"names":["source"],"mappings":";;;;;;AA2BO,SAAS,kBAAA,GAAwC;AACtD,EAAA,MAAM,WAAW,qBAAA,EAAsB;AACvC,EAAA,QAAA,CAAS,SAAS,gBAAgB,CAAA;AAClC,EAAA,QAAA,CAAS,SAAS,qBAAqB,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;;;ACTA,eAAsB,WAAA,GAAc;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAClE,IAAA,OAAO,IAAI,YAAA,CAAa,EAAE,YAAA,EAAc,kBAAA,IAAsB,CAAA;AAAA,EAChE,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,6BAAA,EAAgC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACzF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAqBA,eAAsB,kBAAkB,IAAA,EAQtC;AACA,EAAA,MAAM,EAAE,eAAe,mBAAA,EAAqB,iBAAA,EAAmB,mBAAkB,GAAI,MAAM,OACzF,oBACF,CAAA;AACA,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,YAAY,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACxD;AAwCA,eAAsB,qBAAqB,IAAA,EAKR;AACjC,EAAA,MAAM;AAAA,IACJ,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AAErD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,EAAA,GAAK,MAAM,OAAO,IAAS,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,WAAA,EAAY;AAG1C,MAAA,MAAM,SAAS,OAAA,CACZ,MAAA;AAAA,QACC,CAAC,CAAA,KACC,CAAA,CAAE,IAAA,KAAS,OAAA,IAAW,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAA,GAAS;AAAA,OACxE,CACC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,OAAA,EAAQ,GAAI,CAAA,CAAE,SAAA,CAAU,OAAA,EAAS,CAAA;AAE/D,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAEF;AAAA,MACF;AAGA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAC,MAAM,EAAA,CAAG,UAAA,CAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,yGAAA,EACkB,IAAA,CAAK,IAAI,CAAA,SAAA,EAAY,KAAK,EAAE,CAAA,mGAAA;AAAA,SAEhD;AAAA,MACF;AAEA,MAAA,MAAMA,UAAS,IAAI,kBAAA;AAAA,QACjB,OAAA;AAAA,QACA,OAAA,CAAQ,EAAA;AAAA,QACR,OAAA,CAAQ,IAAA;AAAA,QACR,kBAAA;AAAmB,OACrB;AACA,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAAA,IAChD,SAAS,GAAA,EAAK;AAGZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,MAAM,SACJ,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,GACpB,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,UAAA,EAAY,CAAA,GAC7C,IAAI,oBAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACrD,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACnC;AASA,eAAsB,sBAAA,GAInB;AACD,EAAA,MAAM,EAAE,kBAAA,EAAmB,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACxE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,kBAAA,CAAmB,OAAO,CAAA;AAC9C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAC1D","file":"chunk-77CUYYO3.js","sourcesContent":["/**\n * open-registry.ts — shared helper to create a full AssetKindRegistry.\n *\n * Bootstraps the registry with all built-in providers (9 core + preset)\n * from @skaile/discovery, plus the extension kind providers (flow from\n * @skaile/workspaces/base-assets/connectors/flow/engine, knowledge from @skaile/library).\n *\n * This is the single registration point for the CLI. All code paths\n * that need a registry (source sync, lib-status, etc.) should use this.\n */\n\nimport { flowKindProvider } from \"@skaile/workspaces/base-assets/connectors/flow/engine\";\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultRegistry } from \"@skaile/workspaces/discovery\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\n/**\n * Create a fully-configured AssetKindRegistry with all known providers.\n *\n * Registers:\n * - 9 core kinds (skill, agent, connector, mount, mcp-server, contract, prompt, persona, ruleset)\n * - preset (composition entity)\n * - flow (extension, from @skaile/workspaces/base-assets/connectors/flow/engine)\n * - knowledge (extension, from @skaile/library)\n *\n * @returns An unfrozen registry (auto-freezes on first read)\n */\nexport function createFullRegistry(): AssetKindRegistry {\n  const registry = createDefaultRegistry();\n  registry.register(flowKindProvider);\n  registry.register(knowledgeKindProvider);\n  return registry;\n}\n","/**\n * open-library.ts — shared helpers to open the LocalLibrary and the configured\n * Catalog source.\n *\n * Lazy-loads the `@skaile/workspaces/library` subpath and returns the\n * LocalLibrary instance (backed by `@libsql/client`; runs on Node and Bun).\n * The catalog-source helper reads\n * `~/.skaile/config.yaml` (and project-level overlay if `projectDir` is given)\n * to decide between {@link RemoteCatalogSource} (default — points at\n * `https://skaile.store`) and a {@link LocalCatalogSource} bound to the most\n * recent local source registered via `skaile source add`.\n */\n\nimport { logErr } from \"./helpers.ts\";\nimport { createFullRegistry } from \"./open-registry.ts\";\n\n/**\n * Open the LocalLibrary with the full kind registry. Exits with code 1\n * if the library directory cannot be created.\n *\n * @returns A `LocalLibrary` instance ready for use.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibrary() {\n  try {\n    const { LocalLibrary } = await import(\"@skaile/workspaces/library\");\n    return new LocalLibrary({ kindRegistry: createFullRegistry() });\n  } catch (err) {\n    logErr(`Could not open LocalLibrary: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Resolve the configured **remote** Catalog source for the CLI.\n *\n * Reads `~/.skaile/config.yaml` (plus the optional project-level overlay) and\n * returns a {@link RemoteCatalogSource} pointing at `catalog.url` (default:\n * `https://skaile.store`). The `cache_ttl: 0` config flag flips the source\n * into air-gapped mode: network reads are disabled, only `skaile update`\n * performs refreshes.\n *\n * **Local-mode rejection.** If the resolved config has `catalog.url: local`\n * this helper throws — callers wanting the dispatched local-or-remote source\n * must use {@link resolveCatalogSource}. Remote-only consumers like\n * `skaile update --catalog-only` rely on this strict behaviour.\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A configured {@link RemoteCatalogSource}.\n * @throws When `catalog.url` is the `local` sentinel.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<\n  | import(\"@skaile/workspaces/library\").RemoteCatalogSource\n  | import(\"@skaile/workspaces/library\").RestCatalogSource\n> {\n  const { resolveConfig, RemoteCatalogSource, RestCatalogSource, isLocalCatalogUrl } = await import(\n    \"@skaile/workspaces/library\"\n  );\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n  if (isLocalCatalogUrl(baseUrl)) {\n    throw new Error(\n      \"catalog.url is set to 'local' — remote catalog is disabled. \" +\n        \"Use `skaile source add <path>` + `skaile source sync` for local sources, \" +\n        \"or set `catalog.url: https://skaile.store` in ~/.skaile/config.yaml.\",\n    );\n  }\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  if (cfg.catalog.framing === \"rest\") {\n    return new RestCatalogSource({ baseUrl, cacheTtlMs });\n  }\n  return new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n}\n\n/**\n * Resolved catalog source plus a close handle for releasing any underlying\n * resources (e.g. the `LocalLibrary` SQLite connection in local mode).\n *\n * Callers MUST invoke `close()` when done — typically in a `finally` block.\n * For remote-mode sources `close()` is a no-op, but the contract is uniform\n * so consumers don't have to branch.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport interface ResolvedCatalogSource {\n  /** The {@link ICatalogSource} ready for use. */\n  source: import(\"@skaile/workspaces/library\").ICatalogSource;\n  /** Release any underlying resources (SQLite handle in local mode). */\n  close(): void;\n}\n\n/**\n * Resolve the configured Catalog source — local or remote — based on\n * `~/.skaile/config.yaml`.\n *\n * Dispatch:\n * - `catalog.url: local` → opens {@link LocalLibrary}, picks the most recently\n *   registered local source whose `path` still exists on disk, and returns a\n *   {@link LocalCatalogSource} bound to that source. Throws if no usable local\n *   source is registered.\n * - any URL → returns {@link RemoteCatalogSource} (same as\n *   {@link openCatalogSource}).\n *\n * The returned `close()` releases the underlying `LocalLibrary` SQLite handle\n * in local mode (no-op in remote mode). Callers MUST invoke it — typically in\n * a `finally` block — to satisfy `library/CLAUDE.md` § \"Notes for Consumers\".\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A `ResolvedCatalogSource` carrying the source and a close handle.\n * @throws When `local` is configured but no usable local source is registered.\n * @docLink cli/dev-guide#open-library\n */\nexport async function resolveCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<ResolvedCatalogSource> {\n  const {\n    resolveConfig,\n    RemoteCatalogSource,\n    RestCatalogSource,\n    LocalCatalogSource,\n    isLocalCatalogUrl,\n  } = await import(\"@skaile/workspaces/library\");\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n\n  if (isLocalCatalogUrl(baseUrl)) {\n    const fs = await import(\"node:fs\");\n    const library = await openLibrary();\n    try {\n      const sources = await library.listSources();\n      type SourceRow = (typeof sources)[number];\n      // Type-narrow: `path` is required for local sources after the filter.\n      const usable = sources\n        .filter(\n          (s): s is SourceRow & { path: string } =>\n            s.type === \"local\" && typeof s.path === \"string\" && s.path.length > 0,\n        )\n        .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n      if (usable.length === 0) {\n        throw new Error(\n          \"catalog.url is set to 'local' but no local source is registered. \" +\n            \"Run `skaile source add <path>` first, then `skaile source sync`.\",\n        );\n      }\n\n      // Prefer the most recently added source whose path still exists.\n      const present = usable.find((s) => fs.existsSync(s.path));\n      if (!present) {\n        const head = usable[0];\n        throw new Error(\n          `catalog.url is set to 'local' but every registered local source has a missing path on disk. ` +\n            `Most recent: ${head.path} (source ${head.id}). ` +\n            `Re-register with \\`skaile source add <existing-path>\\` or run \\`skaile source list\\` to inspect.`,\n        );\n      }\n\n      const source = new LocalCatalogSource(\n        library,\n        present.id,\n        present.path,\n        createFullRegistry(),\n      );\n      return { source, close: () => library.close() };\n    } catch (err) {\n      // Release the handle on any failure during dispatch — otherwise the\n      // SQLite WAL state leaks for the lifetime of the process.\n      library.close();\n      throw err;\n    }\n  }\n\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  const source =\n    cfg.catalog.framing === \"rest\"\n      ? new RestCatalogSource({ baseUrl, cacheTtlMs })\n      : new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n  return { source, close: () => {} };\n}\n\n/**\n * Open the UserLibraryManager bound to the active LocalLibrary.\n * Caller owns lifetime — must call `close()` (returned helper closes the\n * underlying LocalLibrary).\n *\n * @docLink cli/dev-guide#open-library\n */\nexport async function openUserLibraryManager(): Promise<{\n  manager: import(\"@skaile/workspaces/library\").UserLibraryManager;\n  library: import(\"@skaile/workspaces/library\").LocalLibrary;\n  close: () => void;\n}> {\n  const { UserLibraryManager } = await import(\"@skaile/workspaces/library\");\n  const library = await openLibrary();\n  const manager = new UserLibraryManager(library);\n  return { manager, library, close: () => library.close() };\n}\n"]}
+{"version":3,"sources":["../cli/src/open-registry.ts","../cli/src/open-library.ts"],"names":["source"],"mappings":";;;;;;AA2BO,SAAS,kBAAA,GAAwC;AACtD,EAAA,MAAM,WAAW,qBAAA,EAAsB;AACvC,EAAA,QAAA,CAAS,SAAS,gBAAgB,CAAA;AAClC,EAAA,QAAA,CAAS,SAAS,qBAAqB,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;;;ACTA,eAAsB,WAAA,GAAc;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAClE,IAAA,OAAO,IAAI,YAAA,CAAa,EAAE,YAAA,EAAc,kBAAA,IAAsB,CAAA;AAAA,EAChE,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,6BAAA,EAAgC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACzF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAqBA,eAAsB,kBAAkB,IAAA,EAQtC;AACA,EAAA,MAAM,EAAE,eAAe,mBAAA,EAAqB,iBAAA,EAAmB,mBAAkB,GAAI,MAAM,OACzF,oBACF,CAAA;AACA,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,YAAY,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACxD;AAwCA,eAAsB,qBAAqB,IAAA,EAKR;AACjC,EAAA,MAAM;AAAA,IACJ,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AAErD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,EAAA,GAAK,MAAM,OAAO,IAAS,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,WAAA,EAAY;AAG1C,MAAA,MAAM,SAAS,OAAA,CACZ,MAAA;AAAA,QACC,CAAC,CAAA,KACC,CAAA,CAAE,IAAA,KAAS,OAAA,IAAW,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAA,GAAS;AAAA,OACxE,CACC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,OAAA,EAAQ,GAAI,CAAA,CAAE,SAAA,CAAU,OAAA,EAAS,CAAA;AAE/D,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAEF;AAAA,MACF;AAGA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAC,MAAM,EAAA,CAAG,UAAA,CAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,yGAAA,EACkB,IAAA,CAAK,IAAI,CAAA,SAAA,EAAY,KAAK,EAAE,CAAA,mGAAA;AAAA,SAEhD;AAAA,MACF;AAEA,MAAA,MAAMA,UAAS,IAAI,kBAAA;AAAA,QACjB,OAAA;AAAA,QACA,OAAA,CAAQ,EAAA;AAAA,QACR,OAAA,CAAQ,IAAA;AAAA,QACR,kBAAA;AAAmB,OACrB;AACA,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAAA,IAChD,SAAS,GAAA,EAAK;AAGZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,MAAM,SACJ,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,GACpB,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,UAAA,EAAY,CAAA,GAC7C,IAAI,oBAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACrD,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACnC;AASA,eAAsB,sBAAA,GAInB;AACD,EAAA,MAAM,EAAE,kBAAA,EAAmB,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACxE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,kBAAA,CAAmB,OAAO,CAAA;AAC9C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAC1D","file":"chunk-VAJB2UJ5.js","sourcesContent":["/**\n * open-registry.ts — shared helper to create a full AssetKindRegistry.\n *\n * Bootstraps the registry with all built-in providers (9 core + preset)\n * from @skaile/discovery, plus the extension kind providers (flow from\n * @skaile/workspaces/base-assets/connectors/flow/engine, knowledge from @skaile/library).\n *\n * This is the single registration point for the CLI. All code paths\n * that need a registry (source sync, lib-status, etc.) should use this.\n */\n\nimport { flowKindProvider } from \"@skaile/workspaces/base-assets/connectors/flow/engine\";\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultRegistry } from \"@skaile/workspaces/discovery\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\n/**\n * Create a fully-configured AssetKindRegistry with all known providers.\n *\n * Registers:\n * - 9 core kinds (skill, agent, connector, mount, mcp-server, contract, prompt, persona, ruleset)\n * - preset (composition entity)\n * - flow (extension, from @skaile/workspaces/base-assets/connectors/flow/engine)\n * - knowledge (extension, from @skaile/library)\n *\n * @returns An unfrozen registry (auto-freezes on first read)\n */\nexport function createFullRegistry(): AssetKindRegistry {\n  const registry = createDefaultRegistry();\n  registry.register(flowKindProvider);\n  registry.register(knowledgeKindProvider);\n  return registry;\n}\n","/**\n * open-library.ts — shared helpers to open the LocalLibrary and the configured\n * Catalog source.\n *\n * Lazy-loads the `@skaile/workspaces/library` subpath and returns the\n * LocalLibrary instance (backed by `@libsql/client`; runs on Node and Bun).\n * The catalog-source helper reads\n * `~/.skaile/config.yaml` (and project-level overlay if `projectDir` is given)\n * to decide between {@link RemoteCatalogSource} (default — points at\n * `https://skaile.store`) and a {@link LocalCatalogSource} bound to the most\n * recent local source registered via `skaile source add`.\n */\n\nimport { logErr } from \"./helpers.ts\";\nimport { createFullRegistry } from \"./open-registry.ts\";\n\n/**\n * Open the LocalLibrary with the full kind registry. Exits with code 1\n * if the library directory cannot be created.\n *\n * @returns A `LocalLibrary` instance ready for use.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibrary() {\n  try {\n    const { LocalLibrary } = await import(\"@skaile/workspaces/library\");\n    return new LocalLibrary({ kindRegistry: createFullRegistry() });\n  } catch (err) {\n    logErr(`Could not open LocalLibrary: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Resolve the configured **remote** Catalog source for the CLI.\n *\n * Reads `~/.skaile/config.yaml` (plus the optional project-level overlay) and\n * returns a {@link RemoteCatalogSource} pointing at `catalog.url` (default:\n * `https://skaile.store`). The `cache_ttl: 0` config flag flips the source\n * into air-gapped mode: network reads are disabled, only `skaile update`\n * performs refreshes.\n *\n * **Local-mode rejection.** If the resolved config has `catalog.url: local`\n * this helper throws — callers wanting the dispatched local-or-remote source\n * must use {@link resolveCatalogSource}. Remote-only consumers like\n * `skaile update --catalog-only` rely on this strict behaviour.\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A configured {@link RemoteCatalogSource}.\n * @throws When `catalog.url` is the `local` sentinel.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<\n  | import(\"@skaile/workspaces/library\").RemoteCatalogSource\n  | import(\"@skaile/workspaces/library\").RestCatalogSource\n> {\n  const { resolveConfig, RemoteCatalogSource, RestCatalogSource, isLocalCatalogUrl } = await import(\n    \"@skaile/workspaces/library\"\n  );\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n  if (isLocalCatalogUrl(baseUrl)) {\n    throw new Error(\n      \"catalog.url is set to 'local' — remote catalog is disabled. \" +\n        \"Use `skaile source add <path>` + `skaile source sync` for local sources, \" +\n        \"or set `catalog.url: https://skaile.store` in ~/.skaile/config.yaml.\",\n    );\n  }\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  if (cfg.catalog.framing === \"rest\") {\n    return new RestCatalogSource({ baseUrl, cacheTtlMs });\n  }\n  return new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n}\n\n/**\n * Resolved catalog source plus a close handle for releasing any underlying\n * resources (e.g. the `LocalLibrary` SQLite connection in local mode).\n *\n * Callers MUST invoke `close()` when done — typically in a `finally` block.\n * For remote-mode sources `close()` is a no-op, but the contract is uniform\n * so consumers don't have to branch.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport interface ResolvedCatalogSource {\n  /** The {@link ICatalogSource} ready for use. */\n  source: import(\"@skaile/workspaces/library\").ICatalogSource;\n  /** Release any underlying resources (SQLite handle in local mode). */\n  close(): void;\n}\n\n/**\n * Resolve the configured Catalog source — local or remote — based on\n * `~/.skaile/config.yaml`.\n *\n * Dispatch:\n * - `catalog.url: local` → opens {@link LocalLibrary}, picks the most recently\n *   registered local source whose `path` still exists on disk, and returns a\n *   {@link LocalCatalogSource} bound to that source. Throws if no usable local\n *   source is registered.\n * - any URL → returns {@link RemoteCatalogSource} (same as\n *   {@link openCatalogSource}).\n *\n * The returned `close()` releases the underlying `LocalLibrary` SQLite handle\n * in local mode (no-op in remote mode). Callers MUST invoke it — typically in\n * a `finally` block — to satisfy `library/CLAUDE.md` § \"Notes for Consumers\".\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A `ResolvedCatalogSource` carrying the source and a close handle.\n * @throws When `local` is configured but no usable local source is registered.\n * @docLink cli/dev-guide#open-library\n */\nexport async function resolveCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<ResolvedCatalogSource> {\n  const {\n    resolveConfig,\n    RemoteCatalogSource,\n    RestCatalogSource,\n    LocalCatalogSource,\n    isLocalCatalogUrl,\n  } = await import(\"@skaile/workspaces/library\");\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n\n  if (isLocalCatalogUrl(baseUrl)) {\n    const fs = await import(\"node:fs\");\n    const library = await openLibrary();\n    try {\n      const sources = await library.listSources();\n      type SourceRow = (typeof sources)[number];\n      // Type-narrow: `path` is required for local sources after the filter.\n      const usable = sources\n        .filter(\n          (s): s is SourceRow & { path: string } =>\n            s.type === \"local\" && typeof s.path === \"string\" && s.path.length > 0,\n        )\n        .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n      if (usable.length === 0) {\n        throw new Error(\n          \"catalog.url is set to 'local' but no local source is registered. \" +\n            \"Run `skaile source add <path>` first, then `skaile source sync`.\",\n        );\n      }\n\n      // Prefer the most recently added source whose path still exists.\n      const present = usable.find((s) => fs.existsSync(s.path));\n      if (!present) {\n        const head = usable[0];\n        throw new Error(\n          `catalog.url is set to 'local' but every registered local source has a missing path on disk. ` +\n            `Most recent: ${head.path} (source ${head.id}). ` +\n            `Re-register with \\`skaile source add <existing-path>\\` or run \\`skaile source list\\` to inspect.`,\n        );\n      }\n\n      const source = new LocalCatalogSource(\n        library,\n        present.id,\n        present.path,\n        createFullRegistry(),\n      );\n      return { source, close: () => library.close() };\n    } catch (err) {\n      // Release the handle on any failure during dispatch — otherwise the\n      // SQLite WAL state leaks for the lifetime of the process.\n      library.close();\n      throw err;\n    }\n  }\n\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  const source =\n    cfg.catalog.framing === \"rest\"\n      ? new RestCatalogSource({ baseUrl, cacheTtlMs })\n      : new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n  return { source, close: () => {} };\n}\n\n/**\n * Open the UserLibraryManager bound to the active LocalLibrary.\n * Caller owns lifetime — must call `close()` (returned helper closes the\n * underlying LocalLibrary).\n *\n * @docLink cli/dev-guide#open-library\n */\nexport async function openUserLibraryManager(): Promise<{\n  manager: import(\"@skaile/workspaces/library\").UserLibraryManager;\n  library: import(\"@skaile/workspaces/library\").LocalLibrary;\n  close: () => void;\n}> {\n  const { UserLibraryManager } = await import(\"@skaile/workspaces/library\");\n  const library = await openLibrary();\n  const manager = new UserLibraryManager(library);\n  return { manager, library, close: () => library.close() };\n}\n"]}

package/dist/{chunk-Q5URN24L.js → chunk-W75ASXH4.js}

@@ -1,5 +1,5 @@
-import { resolveSkWorkspaceConfig } from './chunk-CSUBFKAN.js';
-import { createLogger } from './chunk-V37HONL7.js';
+import { resolveSkWorkspaceConfig } from './chunk-GAZINYCS.js';
+import { createLogger } from './chunk-24UIWON4.js';
 
 // connectors/src/secrets.ts
 var log = createLogger({ kind: "connector", subkind: "secrets" });
@@ -83,7 +83,7 @@ var PreMintedSecretProvider = class {
    * Look up the full {@link PreMintedCredential} for a `mount:` /
    * `connector:` keyed entry. Callers that only need the token use
    * {@link resolve} via the chain; callers that need expiry / audit
-   * metadata (e.g. MountManager) use this entry point.
+   * metadata (e.g. ConnectorManager) use this entry point.
    */
   mintFor(kind, id) {
     return this.mints.get(`${kind}:${id}`);
@@ -92,7 +92,7 @@ var PreMintedSecretProvider = class {
     if (!ref) return void 0;
     if (!(ref.startsWith("mount:") || ref.startsWith("connector:"))) return void 0;
     const mint = this.mints.get(ref);
-    return mint && mint.ok ? mint.token : void 0;
+    return mint?.ok ? mint.token : void 0;
   }
   has(ref) {
     return this.resolve(ref) !== void 0;
@@ -224,38 +224,34 @@ var SecretProviderChain = class {
 };
 
 // connectors/src/config.ts
-function loadMountDeclarations(projectDir) {
-  const config = resolveSkWorkspaceConfig(projectDir);
-  if (!config.mounts || config.mounts.length === 0) return [];
-  return config.mounts.map(workspaceMountToDeclaration);
-}
 function loadConnectorDeclarations(projectDir) {
   const config = resolveSkWorkspaceConfig(projectDir);
+  if (config.mounts && config.mounts.length > 0) {
+    throw new Error(
+      "'mounts:' is no longer supported \u2014 move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md"
+    );
+  }
   if (!config.connectors || config.connectors.length === 0) return [];
   return config.connectors.map(workspaceConnectorToDeclaration);
 }
-function workspaceMountToDeclaration(v) {
-  return {
-    id: v.id,
-    driver: v.driver,
-    source: v.source,
-    target: v.target,
-    access: v.access ?? "read-only",
-    auth: v.auth,
-    watch: v.watch,
-    exposeAccessToken: v.exposeAccessToken,
-    accessTokenTTL: v.accessTokenTTL,
-    options: v.options
-  };
-}
 function workspaceConnectorToDeclaration(c) {
-  return {
+  const decl = {
     id: c.id,
     driver: c.driver,
     access: c.access ?? "read-only",
     auth: c.auth,
     options: c.options
   };
+  if (c.mount) {
+    decl.mount = {
+      source: c.mount.source,
+      target: c.mount.target,
+      watch: c.mount.watch,
+      exposeAccessToken: c.mount.exposeAccessToken,
+      accessTokenTTL: c.mount.accessTokenTTL
+    };
+  }
+  return decl;
 }
 function createForgeSecretProviderChain(forgeProvider, extraProviders = []) {
   return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);
@@ -305,6 +301,6 @@ function resolveAuthRef(auth, mountId) {
   throw new LegacyAuthGrammarError(auth, mountId);
 }
 
-export { EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, loadConnectorDeclarations, loadMountDeclarations, resolveAuth, resolveAuthRef, resolveBackendAuthFor };
-//# sourceMappingURL=chunk-Q5URN24L.js.map
-//# sourceMappingURL=chunk-Q5URN24L.js.map
+export { EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, loadConnectorDeclarations, resolveAuth, resolveAuthRef, resolveBackendAuthFor };
+//# sourceMappingURL=chunk-W75ASXH4.js.map
+//# sourceMappingURL=chunk-W75ASXH4.js.map

package/dist/chunk-W75ASXH4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;AAUA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAGT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,GAAA,CAAI,IAAA,EAA6B,EAAA,EAAY,IAAA,EAAiC;AAC5E,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAA6B,EAAA,EAAqB;AACtD,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAA6B,EAAA,EAA6C;AAChF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,IAAI,UAAA,CAAW,QAAQ,KAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,CAAA,EAAI,OAAO,MAAA;AACxE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,QAAA,EAAU,OAAO,KAAA,EAAO,QAAA,EAAU,UAAU,YAAY,CAAA;AAExF,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AChaO,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,UAAA,IAAc,MAAA,CAAO,WAAW,MAAA,KAAW,CAAA,SAAU,EAAC;AAClE,EAAA,OAAO,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA;AAC9D;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AAWO,SAAS,WAAA,CACd,MACA,OAAA,EACoB;AACpB,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI,OAAA,EAAS,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AACxC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC3B,IAAA,OAAO,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,IAAA;AACT;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD","file":"chunk-W75ASXH4.js","sourcesContent":["/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>` and `connector:<id>`. Returns\n * `undefined` for any other ref so the chain falls through to the next\n * provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n * capabilities stay strictly in-process — no round trip to the platform to\n * mint while the mount is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`\n   * capability handlers when the platform delivers new credentials\n   * mid-session.\n   */\n  set(kind: \"mount\" | \"connector\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\"))) return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\"env:\", \"forge:\", \"op:\", \"kp:\", \"oauth:\", \"mount:\", \"connector:\"] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Array of connector declarations, or an empty array if none are declared.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  if (!config.connectors || config.connectors.length === 0) return [];\n  return config.connectors.map(workspaceConnectorToDeclaration);\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  }\n\n  return decl;\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n/**\n * Resolve a credential reference using a `SecretProvider`, or fall back to `env:NAME` lookup.\n * @param auth - Credential reference (e.g. `\"env:GIT_TOKEN\"`).\n * @param secrets - Optional provider; falls back to `process.env` if omitted.\n * @returns Resolved secret value or `undefined`.\n * @deprecated Use `SecretProviderChain.resolve()` instead.\n * @docLink packages/connectors/api-reference#resolve-auth\n */\n// @TODO: Code-Review: deprecated shim kept for backward compat — remove once all callers migrate to SecretProviderChain.resolve()\nexport function resolveAuth(\n  auth: string | undefined,\n  secrets?: import(\"./secrets.js\").SecretProvider,\n): string | undefined {\n  if (!auth) return undefined;\n  if (secrets) return secrets.resolve(auth);\n  if (auth.startsWith(\"env:\")) {\n    const envVar = auth.slice(4);\n    return process.env[envVar];\n  }\n  return auth;\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n"]}

package/dist/{chunk-5CSE3QL2.js → chunk-XIVOEUAF.js}

@@ -1,7 +1,7 @@
-import { applyAgentsLayer } from './chunk-TS6VCR4W.js';
-import { WorkspaceYamlEditor } from './chunk-65CYXYUW.js';
+import { applyAgentsLayer } from './chunk-DIKFRNCS.js';
+import { WorkspaceYamlEditor } from './chunk-4RUVG5GX.js';
 import { DRIVER_TARGETS } from './chunk-O4JH3KUE.js';
-import { loadSkWorkspaceConfig } from './chunk-CSUBFKAN.js';
+import { loadSkWorkspaceConfig } from './chunk-GAZINYCS.js';
 import { __require } from './chunk-NSBPE2FW.js';
 import { existsSync, mkdirSync, writeFileSync, readFileSync, copyFileSync, statSync, readdirSync } from 'fs';
 import { join, basename, dirname, relative, resolve } from 'path';
@@ -542,5 +542,5 @@ async function scaffoldWorkspace(opts) {
 }
 
 export { applyBaseLayer, applyConnectorsLayer, applyContainerLayer, applyDriverTargetLayer, applyHooksLayer, applySkillsLayer, applyTemplateLayer, listTemplates, loadTemplate, resolveTemplatePath, scaffoldWorkspace, setTemplatesDir };
-//# sourceMappingURL=chunk-5CSE3QL2.js.map
-//# sourceMappingURL=chunk-5CSE3QL2.js.map
+//# sourceMappingURL=chunk-XIVOEUAF.js.map
+//# sourceMappingURL=chunk-XIVOEUAF.js.map