@skaile/workspaces 0.8.5

package/dist/chunk-O4JH3KUE.js

@@ -0,0 +1,56 @@
+// core/src/driver-targets.ts
+var DRIVER_TARGETS = {
+  "claude-code": {
+    local: {
+      skill: ".claude/skills",
+      agent: ".claude/agents",
+      prompt: ".claude/commands",
+      flow: ".skaile/flows",
+      contract: ".claude/contracts"
+    },
+    global: {
+      skill: "~/.claude/skills",
+      agent: "~/.claude/agents",
+      prompt: "~/.claude/commands",
+      flow: "~/.skaile/flows",
+      contract: "~/.claude/contracts"
+    }
+  },
+  omp: {
+    local: {
+      skill: ".omp/skills",
+      agent: ".omp/agents",
+      prompt: ".omp/prompts",
+      flow: ".skaile/flows",
+      contract: ".omp/contracts"
+    },
+    global: {
+      skill: "~/.omp/skills",
+      agent: "~/.omp/agents",
+      prompt: "~/.omp/prompts",
+      flow: "~/.skaile/flows",
+      contract: "~/.omp/contracts"
+    }
+  },
+  codex: {
+    local: {
+      skill: ".codex/skills",
+      agent: ".codex/agents",
+      prompt: ".codex/rules",
+      flow: ".skaile/flows",
+      contract: ".codex/contracts"
+    },
+    global: {
+      skill: "~/.codex/skills",
+      agent: "~/.codex/agents",
+      prompt: "~/.codex/rules",
+      flow: "~/.skaile/flows",
+      contract: "~/.codex/contracts"
+    }
+  }
+};
+var SUPPORTED_DRIVER_TARGETS = Object.keys(DRIVER_TARGETS);
+
+export { DRIVER_TARGETS, SUPPORTED_DRIVER_TARGETS };
+//# sourceMappingURL=chunk-O4JH3KUE.js.map
+//# sourceMappingURL=chunk-O4JH3KUE.js.map

package/dist/chunk-O4JH3KUE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/src/driver-targets.ts"],"names":[],"mappings":";AAkDO,IAAM,cAAA,GAAoD;AAAA,EAC/D,aAAA,EAAe;AAAA,IACb,KAAA,EAAO;AAAA,MACL,KAAA,EAAO,gBAAA;AAAA,MACP,KAAA,EAAO,gBAAA;AAAA,MACP,MAAA,EAAQ,kBAAA;AAAA,MACR,IAAA,EAAM,eAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,KAAA,EAAO,kBAAA;AAAA,MACP,KAAA,EAAO,kBAAA;AAAA,MACP,MAAA,EAAQ,oBAAA;AAAA,MACR,IAAA,EAAM,iBAAA;AAAA,MACN,QAAA,EAAU;AAAA;AACZ,GACF;AAAA,EACA,GAAA,EAAK;AAAA,IACH,KAAA,EAAO;AAAA,MACL,KAAA,EAAO,aAAA;AAAA,MACP,KAAA,EAAO,aAAA;AAAA,MACP,MAAA,EAAQ,cAAA;AAAA,MACR,IAAA,EAAM,eAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,KAAA,EAAO,eAAA;AAAA,MACP,KAAA,EAAO,eAAA;AAAA,MACP,MAAA,EAAQ,gBAAA;AAAA,MACR,IAAA,EAAM,iBAAA;AAAA,MACN,QAAA,EAAU;AAAA;AACZ,GACF;AAAA,EACA,KAAA,EAAO;AAAA,IACL,KAAA,EAAO;AAAA,MACL,KAAA,EAAO,eAAA;AAAA,MACP,KAAA,EAAO,eAAA;AAAA,MACP,MAAA,EAAQ,cAAA;AAAA,MACR,IAAA,EAAM,eAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,KAAA,EAAO,iBAAA;AAAA,MACP,KAAA,EAAO,iBAAA;AAAA,MACP,MAAA,EAAQ,gBAAA;AAAA,MACR,IAAA,EAAM,iBAAA;AAAA,MACN,QAAA,EAAU;AAAA;AACZ;AAEJ;AAOO,IAAM,wBAAA,GAA2B,MAAA,CAAO,IAAA,CAAK,cAAc","file":"chunk-O4JH3KUE.js","sourcesContent":["/**\n * Driver targets — maps agent tool identifiers to their install paths.\n *\n * Only backends with a full bridge driver (runtime execution) are included.\n * Render-only targets (cursor, roo, github-copilot, gemini, amp) were removed —\n * add them back when a bridge driver is implemented.\n */\n\n/**\n * All supported coding-agent driver target identifiers.\n * Only backends with a full bridge driver (runtime execution) are included.\n * @docLink packages/core/concepts#driver-target\n */\nexport type DriverTarget = \"claude-code\" | \"omp\" | \"codex\";\n\n/**\n * Filesystem install path configuration for a single driver target.\n * Paths are relative to the project root (`local`) or the home directory (`global`).\n * `~` in global paths is expanded to `$HOME` by `deployedBase`.\n * @docLink packages/core/concepts#agent-target\n */\nexport interface AgentTarget {\n  /** Project-relative install paths for each AI component type. */\n  local: Record<AiComponent, string>;\n  /** Home-relative install paths for each AI component type (`~` = `$HOME`). */\n  global: Record<AiComponent, string>;\n}\n\n/**\n * The distinct asset types that can be installed into a driver target directory.\n * Used as keys in `AgentTarget.local` and `AgentTarget.global`.\n * @docLink packages/core/concepts#ai-component\n */\nexport type AiComponent = \"skill\" | \"agent\" | \"prompt\" | \"flow\" | \"contract\";\n\n/**\n * Filesystem install path configuration for every supported driver target.\n * `local` paths are relative to the project root; `global` paths are home-relative (`~` = `$HOME`).\n *\n * Only targets with a full bridge driver are included. Removed targets:\n *   cursor         — no bridge driver\n *   roo            — no bridge driver\n *   github-copilot — no bridge driver\n *   gemini         — no bridge driver\n *   amp            — no bridge driver\n *   windsurf       — no file-based agent support\n *   cline          — no file-based agent support\n *   continue       — no file-based agent support\n * @docLink packages/core/concepts#driver-targets\n */\nexport const DRIVER_TARGETS: Record<DriverTarget, AgentTarget> = {\n  \"claude-code\": {\n    local: {\n      skill: \".claude/skills\",\n      agent: \".claude/agents\",\n      prompt: \".claude/commands\",\n      flow: \".skaile/flows\",\n      contract: \".claude/contracts\",\n    },\n    global: {\n      skill: \"~/.claude/skills\",\n      agent: \"~/.claude/agents\",\n      prompt: \"~/.claude/commands\",\n      flow: \"~/.skaile/flows\",\n      contract: \"~/.claude/contracts\",\n    },\n  },\n  omp: {\n    local: {\n      skill: \".omp/skills\",\n      agent: \".omp/agents\",\n      prompt: \".omp/prompts\",\n      flow: \".skaile/flows\",\n      contract: \".omp/contracts\",\n    },\n    global: {\n      skill: \"~/.omp/skills\",\n      agent: \"~/.omp/agents\",\n      prompt: \"~/.omp/prompts\",\n      flow: \"~/.skaile/flows\",\n      contract: \"~/.omp/contracts\",\n    },\n  },\n  codex: {\n    local: {\n      skill: \".codex/skills\",\n      agent: \".codex/agents\",\n      prompt: \".codex/rules\",\n      flow: \".skaile/flows\",\n      contract: \".codex/contracts\",\n    },\n    global: {\n      skill: \"~/.codex/skills\",\n      agent: \"~/.codex/agents\",\n      prompt: \"~/.codex/rules\",\n      flow: \"~/.skaile/flows\",\n      contract: \"~/.codex/contracts\",\n    },\n  },\n};\n\n/**\n * Array of all `DriverTarget` values that support file-based asset installation\n * (skills, agents, prompts, flows, contracts).\n * @docLink packages/core/concepts#supported-driver-targets\n */\nexport const SUPPORTED_DRIVER_TARGETS = Object.keys(DRIVER_TARGETS) as DriverTarget[];\n"]}

package/dist/chunk-O5AE4QDX.js

@@ -0,0 +1,67 @@
+// types/src/mentions.ts
+var MENTION_GROUPS = ["agent", "humans", "humans_here", "here", "all"];
+
+// types/src/reactions.ts
+var QUICK_REACTIONS = [
+  "\u{1F44D}",
+  "\u{1F440}",
+  "\u2705",
+  "\u2764\uFE0F",
+  "\u{1F914}",
+  "\u{1FAE1}",
+  "\u{1F44F}",
+  "\u{1F389}"
+];
+
+// types/src/capabilities.ts
+function isRenderCapability(cap) {
+  return cap.render !== void 0;
+}
+function isUserInvokable(cap) {
+  if (cap.audience !== void 0) {
+    return cap.audience.includes("user");
+  }
+  if (cap.userInvokable !== void 0) {
+    return cap.userInvokable;
+  }
+  switch (cap.origin.kind) {
+    case "framework":
+    case "client":
+    case "agent":
+    case "flow":
+    case "connector":
+    case "mount":
+      return false;
+    case "mcp":
+      return cap.kind === "effect";
+    case "skill":
+      return cap.kind === "effect" || cap.kind === "render";
+    default:
+      return false;
+  }
+}
+
+// types/src/version.ts
+var PROTOCOL_VERSION = { major: 3, minor: 1, patch: 0 };
+var PROTOCOL_VERSION_STRING = "3.1.0";
+function parseVersion(s) {
+  const parts = s.split(".");
+  if (parts.length !== 3) {
+    throw new Error(`Invalid ProtocolVersion: "${s}" (expected "major.minor.patch")`);
+  }
+  const [maj, min, pat] = parts;
+  const major = Number(maj);
+  const minor = Number(min);
+  const patch = Number(pat);
+  if (!Number.isInteger(major) || !Number.isInteger(minor) || !Number.isInteger(patch) || major < 0 || minor < 0 || patch < 0) {
+    throw new Error(`Invalid ProtocolVersion: "${s}" (each part must be a non-negative integer)`);
+  }
+  return { major, minor, patch };
+}
+function formatVersion(v) {
+  return `${v.major}.${v.minor}.${v.patch}`;
+}
+
+export { MENTION_GROUPS, PROTOCOL_VERSION, PROTOCOL_VERSION_STRING, QUICK_REACTIONS, formatVersion, isRenderCapability, isUserInvokable, parseVersion };
+//# sourceMappingURL=chunk-O5AE4QDX.js.map
+//# sourceMappingURL=chunk-O5AE4QDX.js.map

package/dist/chunk-O5AE4QDX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../types/src/mentions.ts","../types/src/reactions.ts","../types/src/capabilities.ts","../types/src/version.ts"],"names":[],"mappings":";AAmBO,IAAM,iBAAiB,CAAC,OAAA,EAAS,QAAA,EAAU,aAAA,EAAe,QAAQ,KAAK;;;ACevE,IAAM,eAAA,GAAkB;AAAA,EAC7B,WAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF;;;AC8KO,SAAS,mBAAmB,GAAA,EAA0C;AAC3E,EAAA,OAAO,IAAI,MAAA,KAAW,MAAA;AACxB;AAqCO,SAAS,gBAAgB,GAAA,EAA0B;AACxD,EAAA,IAAI,GAAA,CAAI,aAAa,MAAA,EAAW;AAC9B,IAAA,OAAO,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA;AAAA,EACrC;AACA,EAAA,IAAI,GAAA,CAAI,kBAAkB,MAAA,EAAW;AACnC,IAAA,OAAO,GAAA,CAAI,aAAA;AAAA,EACb;AACA,EAAA,QAAQ,GAAA,CAAI,OAAO,IAAA;AAAM,IACvB,KAAK,WAAA;AAAA,IACL,KAAK,QAAA;AAAA,IACL,KAAK,OAAA;AAAA,IACL,KAAK,MAAA;AAAA,IACL,KAAK,WAAA;AAAA,IACL,KAAK,OAAA;AACH,MAAA,OAAO,KAAA;AAAA,IACT,KAAK,KAAA;AACH,MAAA,OAAO,IAAI,IAAA,KAAS,QAAA;AAAA,IACtB,KAAK,OAAA;AACH,MAAA,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,IAAY,GAAA,CAAI,IAAA,KAAS,QAAA;AAAA,IAC/C;AACE,MAAA,OAAO,KAAA;AAAA;AAEb;;;AChMO,IAAM,mBAAoC,EAAE,KAAA,EAAO,GAAG,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA;AAUvE,IAAM,uBAAA,GAA0B;AAmBhC,SAAS,aAAa,CAAA,EAA4B;AACvD,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA;AACzB,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,CAAC,CAAA,gCAAA,CAAkC,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,CAAC,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA,GAAI,KAAA;AACxB,EAAA,MAAM,KAAA,GAAQ,OAAO,GAAG,CAAA;AACxB,EAAA,MAAM,KAAA,GAAQ,OAAO,GAAG,CAAA;AACxB,EAAA,MAAM,KAAA,GAAQ,OAAO,GAAG,CAAA;AACxB,EAAA,IACE,CAAC,OAAO,SAAA,CAAU,KAAK,KACvB,CAAC,MAAA,CAAO,UAAU,KAAK,CAAA,IACvB,CAAC,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,IACvB,KAAA,GAAQ,KACR,KAAA,GAAQ,CAAA,IACR,QAAQ,CAAA,EACR;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,CAAC,CAAA,4CAAA,CAA8C,CAAA;AAAA,EAC9F;AACA,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAM;AAC/B;AAiBO,SAAS,cAAc,CAAA,EAA4B;AACxD,EAAA,OAAO,CAAA,EAAG,EAAE,KAAK,CAAA,CAAA,EAAI,EAAE,KAAK,CAAA,CAAA,EAAI,EAAE,KAAK,CAAA,CAAA;AACzC","file":"chunk-O5AE4QDX.js","sourcesContent":["/**\n * Mentions — types for @-mention support in session messages.\n *\n * A Mention records who was addressed in a message, whether a specific user\n * or a well-known group. Group mentions carry a resolved array of user IDs\n * so consumers can perform membership checks without the resolver.\n */\n\n// ---------------------------------------------------------------------------\n// Groups\n// ---------------------------------------------------------------------------\n\n/**\n * Well-known group mention targets as a `const` array.\n *\n * Use this for validation or exhaustive checks against `MentionGroup`.\n *\n * @docLink packages/types/messages#mention\n */\nexport const MENTION_GROUPS = [\"agent\", \"humans\", \"humans_here\", \"here\", \"all\"] as const;\n\n/**\n * A well-known group that can be `@`-mentioned: `'agent' | 'humans' | 'humans_here' | 'here' | 'all'`.\n *\n * @docLink packages/types/messages#mention\n */\nexport type MentionGroup = (typeof MENTION_GROUPS)[number];\n\n// ---------------------------------------------------------------------------\n// Mention discriminated union\n// ---------------------------------------------------------------------------\n\n/**\n * A parsed `@`-mention in a session message. Records who was addressed — either a\n * specific user or a well-known group — along with the source text position.\n *\n * Group mentions carry a resolved array of user IDs so consumers can perform\n * membership checks without needing the resolver.\n *\n * @docLink packages/types/messages#mention\n */\nexport type Mention =\n  | {\n      type: \"user\";\n      userId: string;\n      name: string;\n      /** Position of the `@` character in the source text. */\n      offset: number;\n      /** Length of the full `@token` string including the `@`. */\n      length: number;\n    }\n  | {\n      type: \"group\";\n      group: MentionGroup;\n      /** User IDs resolved at parse time (e.g. all online users for `@here`). */\n      resolved: string[];\n      /** Position of the `@` character in the source text. */\n      offset: number;\n      /** Length of the full `@token` string including the `@`. */\n      length: number;\n    };\n","/**\n * Reactions -- emoji reactions on session messages.\n *\n * Any session participant (user or agent) can react to any message.\n * Reactions are persisted in a dedicated DB model and broadcast as\n * transient events for real-time updates.\n */\n\n/**\n * A single emoji reaction on a message, set by any session participant (user or agent).\n *\n * Reactions are persisted in a dedicated DB model and broadcast as transient events\n * for real-time updates.\n *\n * @docLink packages/types/messages#reaction\n */\nexport type Reaction = {\n  /** Unicode emoji character (e.g. \"thumbs up\", not \":thumbsup:\"). */\n  emoji: string;\n  /** ID of the user (or \"agent\" for agent reactions). */\n  userId: string;\n  /** Display name at reaction time (avoids extra lookups for tooltip rendering). */\n  userName: string;\n  /** Unix epoch milliseconds. */\n  timestamp: number;\n};\n\n/**\n * Quick-access emojis shown in the reaction bar picker.\n *\n * An `as const` array of eight Unicode emoji characters in display order.\n *\n * @docLink packages/types/messages#reaction\n */\nexport const QUICK_REACTIONS = [\n  \"\\u{1F44D}\",\n  \"\\u{1F440}\",\n  \"\\u2705\",\n  \"\\u2764\\uFE0F\",\n  \"\\u{1F914}\",\n  \"\\u{1FAE1}\",\n  \"\\u{1F44F}\",\n  \"\\u{1F389}\",\n] as const;\n","/**\n * Capability layer — Protocol v2's unified registry of LLM-invokable entry points.\n *\n * A {@link Capability} is a named, schema-typed entry point that the LLM can call\n * during a session. Capabilities are registered into a per-session\n * registry by either side (host platform via `side: 'client'` or runtime via\n * `side: 'agent'`) and routed by the bridge at invocation time.\n *\n * This module defines the wire types only; the runtime registry, the\n * `defineCapability` helper, and the per-handler logger live in\n * `@skaile/workspaces/runner`.\n *\n * @see {@link MessageV2} envelope that carries capability commands and events\n * @see {@link ProtocolVersion} for the version contract\n *\n * @category Capabilities\n * @since 2.0.0\n */\n\n// ---------------------------------------------------------------------------\n// Capability shape\n// ---------------------------------------------------------------------------\n\n/**\n * Visibility scope for a capability. Determines which surfaces the capability\n * appears on and which callers can invoke it.\n *\n * - `'llm'`: registered as an LLM tool, surfaced in the `<CAPABILITIES>` system\n *   prompt section. The agent driver can invoke it.\n * - `'user'`: appears in user-facing surfaces — the command palette (cmdK),\n *   debug menus, capability lists.\n * - `'runtime'`: invocable only by trusted runner / platform code paths. Never\n *   reaches the LLM tool list. Never reaches the command palette. Used for\n *   host RPCs (`host.refresh_credential`, `host.audit`, `host.notify_user`,\n *   `host.persist_compaction_attempt`) and runner RPCs (`runner.add_mount`,\n *   `runner.set_log_level`, `runner.lifecycle`, ...).\n *\n * Multiple audiences are allowed (e.g. `['llm', 'user']`). The default when\n * {@link Capability.audience} is omitted is `['llm', 'user']`, preserving the\n * v2.x default visibility for capabilities that haven't migrated yet.\n *\n * @category Capabilities\n * @since 3.0.0\n * @docLink packages/types/capabilities#capability-audience\n */\nexport type CapabilityAudience = \"llm\" | \"user\" | \"runtime\";\n\n/**\n * Source of truth for who registered a capability. Used for trust enforcement\n * (the bridge rejects mismatches between registering side and origin kind)\n * and for the `capability:<origin>:<name>` log taxonomy.\n *\n * Variants:\n * - `framework`: built-in (e.g. `__capabilities.list`)\n * - `client`: host platform (e.g. `platform.react`)\n * - `agent`: self-registered by the agent runtime\n * - `flow`: injected by an active flow execution\n * - `skill`: from a skill's MCP surface\n * - `mcp`: from a generic MCP server\n * - `connector`: from a connector (e.g. `postgres.query`)\n * - `mount`: surfaced by a filesystem mount\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#capability-origin\n */\nexport type CapabilityOrigin =\n  | { kind: \"framework\" }\n  | { kind: \"client\" }\n  | { kind: \"agent\" }\n  | { kind: \"flow\"; flowId: string }\n  | { kind: \"skill\"; skillId: string }\n  | { kind: \"mcp\"; serverId: string }\n  | { kind: \"connector\"; connectorId: string }\n  | { kind: \"mount\"; mountId: string };\n\n/**\n * Render contract for a capability that produces a UI surface when invoked.\n *\n * When the LLM invokes a capability whose `render` is set, the bridge emits\n * a {@link RenderInvokedEvent} carrying the capability name and props. The\n * client renders the configured `source` at the chosen `target`. Clients\n * without a render layer can fall back to the markdown `fallback` template.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#render-spec\n */\nexport type RenderSpec = {\n  /** Where the rendered component lives. */\n  source: { kind: \"web-component\"; url: string; tagName: string } | { kind: \"iframe\"; url: string };\n  /** Render placements supported by the component. */\n  targets: (\"chat\" | \"preview\" | \"modal\" | \"input-extension\")[];\n  /** Markdown template with `{{prop}}` placeholders for clients without a render layer. */\n  fallback?: string;\n  /** True when props may be partial during streaming. */\n  streaming?: boolean;\n  /** Interaction names the rendered component may fire back as state events. */\n  interactions?: string[];\n};\n\n/**\n * A named, schema-typed entry point that the LLM can invoke during a session.\n *\n * Capabilities can be declared statically (via `ConfigureCommand.capabilities`)\n * or dynamically (via {@link CapabilityRegisterCommand} /\n * {@link CapabilityRegisterEvent}). They are cached for replay across\n * subscriber reconnects and session hibernation.\n *\n * @example Defining a client-side fire-and-forget tool (uses the runner's\n * `defineCapability` helper, which serializes a {@link Capability} to the wire):\n * ```ts\n * const reactTool = defineCapability({\n *   name: 'platform.react',\n *   description: 'Acknowledge a user message with a Unicode emoji.',\n *   side: 'client',\n *   origin: { kind: 'client' },\n *   fireAndForget: true,\n *   input: z.object({ emoji: z.string(), targetSeq: z.number().optional() }),\n *   handler: async ({ emoji, targetSeq }, ctx) => { ... },\n * });\n * ```\n *\n * @see {@link RenderCapability} for capabilities that render UI components\n * @see {@link CapabilityOrigin} for who-registered-it metadata\n * @see {@link isRenderCapability} for the type-guard\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#capability\n */\nexport type Capability = {\n  /** Unique within a session. Convention: namespaced as `<origin>.<name>` (e.g. `platform.react`, `ui.gif`). */\n  name: string;\n  /**\n   * Human-readable label for user-facing surfaces (cmdK action palette,\n   * capability menus, debug panels). Falls back to {@link Capability.name}\n   * when omitted. Pure presentation — the LLM sees `name`, not `displayName`.\n   */\n  displayName?: string;\n  /** Human/LLM-readable summary. Shown to the LLM as part of tool registration. */\n  description: string;\n  /** JSON Schema validating the invocation arguments. Authored as Zod, converted at register time. */\n  inputSchema: Record<string, unknown>;\n  /** Optional return shape. Omit for fire-and-forget effects. */\n  outputSchema?: Record<string, unknown>;\n  /** Where the handler runs. `client` = host platform, `agent` = runtime/skill/connector. */\n  side: \"client\" | \"agent\";\n  /** Discriminated tag identifying who registered the capability. Used for trust enforcement and audit. */\n  origin: CapabilityOrigin;\n  /** Lifetime: `session` survives the whole session, `turn` is dropped at end-of-turn. */\n  scope?: \"session\" | \"turn\";\n  /** When true, the bridge auto-resolves with `{}` immediately and runs the handler in the background. */\n  fireAndForget?: boolean;\n  /** When true, the platform shows a confirm UI before dispatch and waits for {@link CapabilityApproveCommand}. */\n  requiresApproval?: boolean;\n  /** Documentation hint (not enforced) describing whether this is a side-effect, render, or pure query. */\n  kind?: \"effect\" | \"render\" | \"query\";\n  /**\n   * Whether this capability should be exposed in user-facing surfaces (cmdK\n   * action palette, capability menus). When omitted, the consumer applies a\n   * default per-origin via {@link isUserInvokable}.\n   *\n   * - `true`: surface in cmdK and capability menus.\n   * - `false`: hide from user surfaces (LLM-only or low-level).\n   * - `undefined`: defer to {@link isUserInvokable}'s inference rules.\n   *\n   * @deprecated Set {@link Capability.audience} instead. `userInvokable` is\n   * kept as a read-only shim for v2.x consumers and is honoured by\n   * {@link isUserInvokable} when {@link Capability.audience} is absent.\n   */\n  userInvokable?: boolean;\n  /**\n   * Audience scoping for this capability. See {@link CapabilityAudience} for\n   * the meaning of each value and combinations.\n   *\n   * When omitted, consumers treat the capability as `['llm', 'user']` (the\n   * v2.x default). Host RPCs and runner RPCs MUST set this to `['runtime']`\n   * so they never leak to the LLM tool list or the user-facing surfaces.\n   *\n   * @category Capabilities\n   * @since 3.0.0\n   */\n  audience?: CapabilityAudience[];\n  /** Appended to the system prompt's `<CAPABILITIES>` section. Use for usage hints the LLM should always see. */\n  promptFragment?: string;\n  /** Present iff this is a render capability — see {@link RenderCapability}. */\n  render?: RenderSpec;\n};\n\n/**\n * A {@link Capability} that produces a UI surface when invoked. The narrowed\n * type guarantees `render` is set, which simplifies frontend lookup.\n *\n * @see {@link isRenderCapability}\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#render-capability\n */\nexport type RenderCapability = Capability & { render: NonNullable<Capability[\"render\"]> };\n\n/**\n * Type-guard for {@link RenderCapability}. Use after {@link Capability}\n * lookup to narrow the type before reading `render`.\n *\n * @example\n * ```ts\n * for (const cap of registry.list()) {\n *   if (isRenderCapability(cap)) console.log(cap.render.targets);\n * }\n * ```\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#is-render-capability\n */\nexport function isRenderCapability(cap: Capability): cap is RenderCapability {\n  return cap.render !== undefined;\n}\n\n/**\n * Decide whether a capability should be surfaced in user-facing actions\n * (cmdK action palette, capability menus).\n *\n * Resolution order (first match wins):\n *\n * 1. {@link Capability.audience} is set — return `audience.includes('user')`.\n *    Capabilities scoped to `'runtime'` only never appear in user surfaces.\n * 2. {@link Capability.userInvokable} is set (v2.x shim) — return that value.\n * 3. Default per-origin inference table below.\n *\n * Default-inference rules (when both `audience` and `userInvokable` are\n * omitted):\n * | Origin       | Default                                                                |\n * | ------------ | ---------------------------------------------------------------------- |\n * | `framework`  | `false` (LLM discovery surfaces, e.g. `__capabilities.list`)           |\n * | `client`     | `false` (platform ack tools — `platform.react`, `platform.pass`)       |\n * | `agent`      | `false` (agent-defined; assume internal unless flagged)                |\n * | `flow`       | `false` (per-cap opt-in)                                               |\n * | `connector`  | `false` (low-level FS / data ops)                                      |\n * | `mount`      | `false` (low-level FS ops)                                             |\n * | `mcp`        | `true` if `kind === 'effect'`, else `false`                            |\n * | `skill`      | `true` if `kind` ∈ {`effect`, `render`}, else `false`                  |\n *\n * @example\n * ```ts\n * for (const cap of capabilities.values()) {\n *   if (isUserInvokable(cap)) registerCommandPaletteAction(cap);\n * }\n * ```\n *\n * @category Capabilities\n * @since 2.1.0\n * @docLink packages/types/capabilities#is-user-invokable\n */\nexport function isUserInvokable(cap: Capability): boolean {\n  if (cap.audience !== undefined) {\n    return cap.audience.includes(\"user\");\n  }\n  if (cap.userInvokable !== undefined) {\n    return cap.userInvokable;\n  }\n  switch (cap.origin.kind) {\n    case \"framework\":\n    case \"client\":\n    case \"agent\":\n    case \"flow\":\n    case \"connector\":\n    case \"mount\":\n      return false;\n    case \"mcp\":\n      return cap.kind === \"effect\";\n    case \"skill\":\n      return cap.kind === \"effect\" || cap.kind === \"render\";\n    default:\n      return false;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Capability commands (client → agent)\n// ---------------------------------------------------------------------------\n\n/**\n * Register one or more capabilities mid-session (client → agent).\n *\n * The platform sends this when a new client-side tool becomes available\n * after `configure` has already returned (e.g. a user installs a new\n * extension during the session).\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#capability-register-command\n */\nexport type CapabilityRegisterCommand = {\n  type: \"capability_register\";\n  capabilities: Capability[];\n};\n\n/**\n * Deregister capabilities by name (client → agent). Names that are not\n * currently registered are ignored silently.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#capability-deregister-command\n */\nexport type CapabilityDeregisterCommand = {\n  type: \"capability_deregister\";\n  names: string[];\n};\n\n/**\n * Return the result of a previously {@link CapabilityInvokedEvent | invoked} client-side\n * capability (client → agent). Bridges that registered the capability with\n * `fireAndForget: true` MAY skip this command; the bridge auto-resolves with `{}`.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#capability-result-command\n */\nexport type CapabilityResultCommand = {\n  type: \"capability_result\";\n  /** Correlation token matching the {@link CapabilityInvokedEvent.callId}. */\n  callId: string;\n  /** Successful result payload, or an error envelope. */\n  result: unknown | { error: string };\n};\n\n/**\n * Approve or reject a capability call that was invoked with\n * `requiresApproval: true` (client → agent). The platform shows a confirm\n * UI and forwards the user's decision via this command.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#capability-approve-command\n */\nexport type CapabilityApproveCommand = {\n  type: \"capability_approve\";\n  /** Correlation token matching the {@link CapabilityInvokedEvent.callId}. */\n  callId: string;\n  /** User's decision. */\n  decision: \"approved\" | \"rejected\";\n  /** Optional rationale stored alongside the decision for audit. */\n  feedback?: string;\n  /** User ID of the decider (informational — framework enforces no policy). */\n  decidedBy: string;\n};\n\n// ---------------------------------------------------------------------------\n// Capability events (agent → client)\n// ---------------------------------------------------------------------------\n\n/**\n * Register one or more capabilities mid-session (agent → client). Mirrors\n * {@link CapabilityRegisterCommand} for the agent-initiated direction; used\n * when the runtime adds a capability after `configure` (e.g. when a flow\n * starts and injects flow-scoped tools).\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#capability-register-event\n */\nexport type CapabilityRegisterEvent = {\n  type: \"capability_register\";\n  capabilities: Capability[];\n};\n\n/**\n * Deregister capabilities by name (agent → client).\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#capability-deregister-event\n */\nexport type CapabilityDeregisterEvent = {\n  type: \"capability_deregister\";\n  names: string[];\n};\n\n/**\n * Notify the client that a capability has been invoked by the LLM (agent →\n * client). For client-side capabilities the platform's handler runs in\n * response to this event and replies with {@link CapabilityResultCommand}.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#capability-invoked-event\n */\nexport type CapabilityInvokedEvent = {\n  type: \"capability_invoked\";\n  /** Correlation token for the eventual {@link CapabilityResultCommand}. */\n  callId: string;\n  /** Name of the invoked {@link Capability}. */\n  name: string;\n  /** Validated input payload (already conforms to the capability's `inputSchema`). */\n  input: unknown;\n  /** In v2.0.0 the LLM is the only invoker. */\n  invokedBy: \"agent\";\n};\n\n/**\n * Notify the client that a render capability should be drawn (agent →\n * client). Emitted alongside {@link CapabilityInvokedEvent} when the\n * invoked capability's `render` block is populated.\n *\n * Clients without a render layer can fall back to the capability's\n * `render.fallback` markdown template.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/types/capabilities#render-invoked-event\n */\nexport type RenderInvokedEvent = {\n  type: \"render_invoked\";\n  /** Name of the invoked render capability. */\n  capabilityName: string;\n  /** Props passed to the rendered component (already conforms to `inputSchema`). */\n  props: unknown;\n  /** Correlation token shared with the matching {@link CapabilityInvokedEvent}. */\n  callId: string;\n};\n","/**\n * Protocol versioning primitives for Skaile Agent Protocol v2.\n *\n * The protocol is versioned by a structured {@link ProtocolVersion} record\n * (`major.minor.patch`). The compatibility rule applied at handshake is\n * **major-equality**: a runner emits {@link IncompatibleProtocolEvent} and\n * shuts down when its declared major does not match the platform's announced\n * major. Minor and patch differences ride through transparently because\n * unknown fields are preserved on round-trip (see `MessageMeta` round-trip\n * contract in `messaging.ts`).\n *\n * @category Protocol\n * @since 2.0.0\n */\n\n/**\n * Structured semantic version triple for the agent protocol.\n *\n * @example\n * ```ts\n * const v: ProtocolVersion = { major: 2, minor: 0, patch: 0 };\n * ```\n *\n * @category Protocol\n * @since 2.0.0\n * @docLink packages/types/protocol-v2#protocol-version\n */\nexport type ProtocolVersion = {\n  /** Incremented on breaking wire-format changes (field removed, semantics changed, required field added). */\n  major: number;\n  /** Incremented on additive wire-format changes (new optional fields, new event types). */\n  minor: number;\n  /** Incremented on bug-fix or doc-only changes that do not affect the wire. */\n  patch: number;\n};\n\n/**\n * The protocol version the framework currently speaks. Runners and platforms\n * compare this against the peer's announced version at session boot via\n * `SessionInitCommand.protocolVersion`.\n *\n * @example\n * ```ts\n * import { PROTOCOL_VERSION } from '@skaile/workspaces/types';\n * if (cmd.protocolVersion.major !== PROTOCOL_VERSION.major) {\n *   emit({ type: 'incompatible_protocol', agentVersion: PROTOCOL_VERSION, platformVersion: cmd.protocolVersion });\n * }\n * ```\n *\n * @category Protocol\n * @since 3.0.0\n *\n * Changed in 3.1.0:\n * Additive cost / token usage extension. `FinishedEvent` gains an optional\n * `tokens?: TokenUsage` field carrying per-turn input / output / cache-read /\n * cache-creation / reasoning token counts. `AgentDriver.getTokenUsage()` is\n * widened to return the same `TokenUsage` shape (existing consumers reading\n * `inputTokens` / `outputTokens` keep working unchanged). Drivers that do not\n * surface token usage continue to return `null` / omit the field.\n *\n * Changed in 3.0.0:\n * Major bump for the deterministic session bootstrap rewrite. `ConfigureCommandV2`,\n * `provision_secrets`, `request_access_token`, `add_resource`, `remove_resource`,\n * `set_log_level`, `state_action`, `lifecycle`, `remount_mount`, `compact`, and\n * `reconfigure_agent` are removed from the `AgentCommand` union. Their semantics\n * are reachable through:\n *   - `session_init` (one deterministic envelope at session start that delivers\n *     identity, resolved config, pre-minted credentials, secrets, capabilities,\n *     shared state, active flows, resume hints, and logging config),\n *   - `host.refresh_credential` (capability invocation that replaces the\n *     refresh-on-401 path of `request_access_token`), and\n *   - `runner.*` capabilities (`runner.add_mount`, `runner.add_connector`,\n *     `runner.remove_resource`, `runner.update_credential`, `runner.set_log_level`,\n *     `runner.set_state`, `runner.lifecycle`) invoked by the platform via the\n *     bidirectional capability registry.\n *\n * Capabilities gain an `audience: ('llm' | 'user' | 'runtime')[]` field that\n * scopes visibility: host RPCs (`host.*`) and runner RPCs (`runner.*`) are\n * `['runtime']` and never reach the LLM tool list or the user-facing command\n * palette. v2.x capabilities without an explicit `audience` default to\n * `['llm', 'user']`, preserving prior behaviour.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/types/protocol-v3#protocol-version\n */\nexport const PROTOCOL_VERSION: ProtocolVersion = { major: 3, minor: 1, patch: 0 };\n\n/**\n * String form of {@link PROTOCOL_VERSION}, kept in lock-step. Useful for\n * `package.json` version fields and HTTP `User-Agent` strings.\n *\n * @category Protocol\n * @since 3.0.0\n * @docLink packages/types/protocol-v3#protocol-version\n */\nexport const PROTOCOL_VERSION_STRING = \"3.1.0\";\n\n/**\n * Parse a `\"major.minor.patch\"` string into a {@link ProtocolVersion}.\n *\n * @param s - the version string to parse, exactly three dot-separated non-negative integers\n * @returns the parsed protocol version\n * @throws {Error} if the string is not exactly three dot-separated non-negative integers\n *\n * @example\n * ```ts\n * parseVersion('2.0.0'); // { major: 2, minor: 0, patch: 0 }\n * parseVersion('2.1');   // throws\n * ```\n *\n * @category Protocol\n * @since 2.0.0\n * @docLink packages/types/protocol-v2#parse-version\n */\nexport function parseVersion(s: string): ProtocolVersion {\n  const parts = s.split(\".\");\n  if (parts.length !== 3) {\n    throw new Error(`Invalid ProtocolVersion: \"${s}\" (expected \"major.minor.patch\")`);\n  }\n  const [maj, min, pat] = parts;\n  const major = Number(maj);\n  const minor = Number(min);\n  const patch = Number(pat);\n  if (\n    !Number.isInteger(major) ||\n    !Number.isInteger(minor) ||\n    !Number.isInteger(patch) ||\n    major < 0 ||\n    minor < 0 ||\n    patch < 0\n  ) {\n    throw new Error(`Invalid ProtocolVersion: \"${s}\" (each part must be a non-negative integer)`);\n  }\n  return { major, minor, patch };\n}\n\n/**\n * Format a {@link ProtocolVersion} record into its `\"major.minor.patch\"` string form.\n *\n * @param v - the protocol version to format\n * @returns the dot-joined string form\n *\n * @example\n * ```ts\n * formatVersion({ major: 2, minor: 0, patch: 0 }); // '2.0.0'\n * ```\n *\n * @category Protocol\n * @since 2.0.0\n * @docLink packages/types/protocol-v2#format-version\n */\nexport function formatVersion(v: ProtocolVersion): string {\n  return `${v.major}.${v.minor}.${v.patch}`;\n}\n"]}

package/dist/chunk-O7SG5PC2.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-O7SG5PC2.js.map
+//# sourceMappingURL=chunk-O7SG5PC2.js.map

package/dist/chunk-O7SG5PC2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-O7SG5PC2.js"}

package/dist/chunk-OKRUTSG7.js

@@ -0,0 +1,87 @@
+// plugins/src/asset-kind-registry.ts
+var AssetKindConflictError = class extends Error {
+  kind;
+  constructor(kind) {
+    super(`Asset kind "${kind}" is already registered. Each kind must have exactly one provider.`);
+    this.name = "AssetKindConflictError";
+    this.kind = kind;
+  }
+};
+var AssetKindPatternConflictError = class extends Error {
+  newKind;
+  existingKind;
+  conflictingPattern;
+  constructor(newKind, existingKind, conflictingPattern) {
+    super(
+      `Discovery pattern "${conflictingPattern}" from kind "${newKind}" conflicts with kind "${existingKind}". Patterns must not overlap across providers.`
+    );
+    this.name = "AssetKindPatternConflictError";
+    this.newKind = newKind;
+    this.existingKind = existingKind;
+    this.conflictingPattern = conflictingPattern;
+  }
+};
+var AssetKindPathAmbiguityError = class extends Error {
+  path;
+  matchingKinds;
+  constructor(path, matchingKinds) {
+    super(
+      `Path "${path}" matches multiple providers: [${matchingKinds.join(", ")}]. Only one provider may claim a path.`
+    );
+    this.name = "AssetKindPathAmbiguityError";
+    this.path = path;
+    this.matchingKinds = matchingKinds;
+  }
+};
+var AssetKindRegistryFrozenError = class extends Error {
+  constructor() {
+    super(
+      "Cannot register providers after the registry is frozen. All providers must be registered before the first read operation."
+    );
+    this.name = "AssetKindRegistryFrozenError";
+  }
+};
+
+// plugins/src/secrets-provider.ts
+var SecretsError = class extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.name = "SecretsError";
+    this.code = code;
+  }
+};
+var SecretNotFoundError = class extends SecretsError {
+  constructor(ref) {
+    super(`Secret not found: ${ref}`, "SECRET_NOT_FOUND");
+    this.name = "SecretNotFoundError";
+  }
+};
+var SecretAccessDeniedError = class extends SecretsError {
+  constructor(message = "Access denied") {
+    super(message, "SECRET_ACCESS_DENIED");
+    this.name = "SecretAccessDeniedError";
+  }
+};
+var SecretExpiredError = class extends SecretsError {
+  constructor(ref) {
+    super(`Secret expired: ${ref}`, "SECRET_EXPIRED");
+    this.name = "SecretExpiredError";
+  }
+};
+var ProviderUnavailableError = class extends SecretsError {
+  constructor(providerId, cause) {
+    super(
+      `Provider unavailable: ${providerId}${cause ? ` (${cause})` : ""}`,
+      "PROVIDER_UNAVAILABLE"
+    );
+    this.name = "ProviderUnavailableError";
+  }
+};
+
+// plugins/src/index.ts
+var VERSION = "0.0.0";
+
+export { AssetKindConflictError, AssetKindPathAmbiguityError, AssetKindPatternConflictError, AssetKindRegistryFrozenError, ProviderUnavailableError, SecretAccessDeniedError, SecretExpiredError, SecretNotFoundError, SecretsError, VERSION };
+//# sourceMappingURL=chunk-OKRUTSG7.js.map
+//# sourceMappingURL=chunk-OKRUTSG7.js.map

package/dist/chunk-OKRUTSG7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../plugins/src/asset-kind-registry.ts","../plugins/src/secrets-provider.ts","../plugins/src/index.ts"],"names":[],"mappings":";AA8BO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EAET,YAAY,IAAA,EAAc;AACxB,IAAA,KAAA,CAAM,CAAA,YAAA,EAAe,IAAI,CAAA,kEAAA,CAAoE,CAAA;AAC7F,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAMO,IAAM,6BAAA,GAAN,cAA4C,KAAA,CAAM;AAAA,EAC9C,OAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,YAAA,EAAsB,kBAAA,EAA4B;AAC7E,IAAA,KAAA;AAAA,MACE,CAAA,mBAAA,EAAsB,kBAAkB,CAAA,aAAA,EAAgB,OAAO,0BAA0B,YAAY,CAAA,8CAAA;AAAA,KACvG;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,+BAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAAA,EAC5B;AACF;AAOO,IAAM,2BAAA,GAAN,cAA0C,KAAA,CAAM;AAAA,EAC5C,IAAA;AAAA,EACA,aAAA;AAAA,EAET,WAAA,CAAY,MAAc,aAAA,EAAyB;AACjD,IAAA,KAAA;AAAA,MACE,SAAS,IAAI,CAAA,+BAAA,EAAkC,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA,sCAAA;AAAA,KACzE;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,6BAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AACF;AAKO,IAAM,4BAAA,GAAN,cAA2C,KAAA,CAAM;AAAA,EACtD,WAAA,GAAc;AACZ,IAAA,KAAA;AAAA,MACE;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,8BAAA;AAAA,EACd;AACF;;;ACRO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,IAAA;AAAA,EAEA,WAAA,CAAY,SAAiB,IAAA,EAAc;AACzC,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAQO,IAAM,mBAAA,GAAN,cAAkC,YAAA,CAAa;AAAA,EACpD,YAAY,GAAA,EAAa;AACvB,IAAA,KAAA,CAAM,CAAA,kBAAA,EAAqB,GAAG,CAAA,CAAA,EAAI,kBAAkB,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOO,IAAM,uBAAA,GAAN,cAAsC,YAAA,CAAa;AAAA,EACxD,WAAA,CAAY,UAAU,eAAA,EAAiB;AACrC,IAAA,KAAA,CAAM,SAAS,sBAAsB,CAAA;AACrC,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAQO,IAAM,kBAAA,GAAN,cAAiC,YAAA,CAAa;AAAA,EACnD,YAAY,GAAA,EAAa;AACvB,IAAA,KAAA,CAAM,CAAA,gBAAA,EAAmB,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA;AAChD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF;AASO,IAAM,wBAAA,GAAN,cAAuC,YAAA,CAAa;AAAA,EACzD,WAAA,CAAY,YAAoB,KAAA,EAAgB;AAC9C,IAAA,KAAA;AAAA,MACE,yBAAyB,UAAU,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,KAAK,MAAM,EAAE,CAAA,CAAA;AAAA,MAChE;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AAAA,EACd;AACF;;;AChJO,IAAM,OAAA,GAAU","file":"chunk-OKRUTSG7.js","sourcesContent":["/**\n * IAssetKindRegistry — contract for the frozen-state asset kind registry.\n *\n * Library-bound, not process-global. Follows a frozen-state machine:\n * - register() is valid only in the \"open\" state\n * - First read operation auto-freezes the registry\n * - freeze() is idempotent\n *\n * Conflicts on registration are hard errors (A4):\n * - Same kind registered twice → AssetKindConflictError\n * - Overlapping glob patterns → AssetKindPatternConflictError\n * - Multiple providers match a path → AssetKindPathAmbiguityError\n *\n * Design decisions A3, A4: locked in Phase 1.7 planning.\n */\n\nimport type {\n  IAssetKindProvider,\n  AssetKindFileFilter,\n  AssetKindRequiresEdge,\n} from \"./asset-kind-provider.js\";\nimport type { ManifestValidationResult } from \"@skaile/workspaces/types/manifests\";\n\n// ---------------------------------------------------------------------------\n// Error classes (A4)\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a kind is registered that already exists in the registry.\n */\nexport class AssetKindConflictError extends Error {\n  readonly kind: string;\n\n  constructor(kind: string) {\n    super(`Asset kind \"${kind}\" is already registered. Each kind must have exactly one provider.`);\n    this.name = \"AssetKindConflictError\";\n    this.kind = kind;\n  }\n}\n\n/**\n * Thrown when a provider's discovery patterns overlap with an\n * already-registered provider's patterns.\n */\nexport class AssetKindPatternConflictError extends Error {\n  readonly newKind: string;\n  readonly existingKind: string;\n  readonly conflictingPattern: string;\n\n  constructor(newKind: string, existingKind: string, conflictingPattern: string) {\n    super(\n      `Discovery pattern \"${conflictingPattern}\" from kind \"${newKind}\" conflicts with kind \"${existingKind}\". Patterns must not overlap across providers.`,\n    );\n    this.name = \"AssetKindPatternConflictError\";\n    this.newKind = newKind;\n    this.existingKind = existingKind;\n    this.conflictingPattern = conflictingPattern;\n  }\n}\n\n/**\n * Thrown at discovery time when multiple providers claim the same path.\n * This indicates a bug in matchesPath implementations — should be caught\n * earlier by pattern conflict detection, but serves as a runtime safety net.\n */\nexport class AssetKindPathAmbiguityError extends Error {\n  readonly path: string;\n  readonly matchingKinds: string[];\n\n  constructor(path: string, matchingKinds: string[]) {\n    super(\n      `Path \"${path}\" matches multiple providers: [${matchingKinds.join(\", \")}]. Only one provider may claim a path.`,\n    );\n    this.name = \"AssetKindPathAmbiguityError\";\n    this.path = path;\n    this.matchingKinds = matchingKinds;\n  }\n}\n\n/**\n * Thrown when register() is called on a frozen registry.\n */\nexport class AssetKindRegistryFrozenError extends Error {\n  constructor() {\n    super(\n      \"Cannot register providers after the registry is frozen. All providers must be registered before the first read operation.\",\n    );\n    this.name = \"AssetKindRegistryFrozenError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Interface\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen-state asset kind registry.\n *\n * Lifecycle:\n * 1. Created in \"open\" state\n * 2. Providers registered via register()\n * 3. First read operation (getProvider, getAllProviders, resolveKind,\n *    validateManifest, defaultFileFilter, extractRequires) auto-freezes\n * 4. No further registrations allowed\n *\n * Implementations: AssetKindRegistry in @skaile/discovery.\n */\nexport interface IAssetKindRegistry {\n  /** Whether the registry is frozen (no further registrations allowed). */\n  readonly frozen: boolean;\n\n  /**\n   * Register a provider. Must be called before the registry is frozen.\n   * @throws AssetKindConflictError if kind already registered\n   * @throws AssetKindPatternConflictError if patterns overlap\n   * @throws AssetKindRegistryFrozenError if registry is frozen\n   */\n  register(provider: IAssetKindProvider): void;\n\n  /**\n   * Explicitly freeze the registry. Idempotent — calling on an already-frozen\n   * registry is a no-op.\n   */\n  freeze(): void;\n\n  // -- Read operations (auto-freeze on first call) --\n\n  /** Get a provider by kind name. Returns undefined for unregistered kinds. */\n  getProvider(kind: string): IAssetKindProvider | undefined;\n\n  /** Get all registered providers (snapshot, not live). */\n  getAllProviders(): IAssetKindProvider[];\n\n  /** Get all registered kind names. */\n  getAllKinds(): string[];\n\n  /**\n   * Resolve a relative path to an asset kind.\n   * @throws AssetKindPathAmbiguityError if multiple providers match\n   * @returns The kind string, or undefined if no provider matches\n   */\n  resolveKind(relativePath: string): string | undefined;\n\n  // -- Convenience delegates (auto-freeze on first call) --\n\n  /**\n   * Validate a manifest for a given kind.\n   * @returns Validation result, or a failure if the kind is unregistered\n   */\n  validateManifest(kind: string, data: unknown): ManifestValidationResult<unknown>;\n\n  /**\n   * Compute the default file filter for an asset.\n   * @returns The file filter, or undefined if the kind is unregistered\n   */\n  defaultFileFilter(kind: string, manifestPath: string): AssetKindFileFilter | undefined;\n\n  /**\n   * Extract requires edges from a manifest.\n   * @returns The edges, or an empty array if the kind has no extractRequires\n   */\n  extractRequires(\n    kind: string,\n    assetRef: string,\n    manifest: Record<string, unknown>,\n  ): AssetKindRequiresEdge[];\n}\n","/**\n * ISecretsProvider — pluggable secret storage/retrieval interface.\n *\n * Lives in workspaces/plugins (all pluggable interface contracts centralized here).\n * Built-in implementations live in workspaces/secrets.\n *\n * Signature locked per Phase 1 plan decision E5.\n */\n\n// ---------------------------------------------------------------------------\n// Helper types\n// ---------------------------------------------------------------------------\n\n/**\n * Metadata record returned by {@link ISecretsProvider.getMetadata}.\n *\n * Carries audit timestamps and optional ownership information without\n * exposing the secret value itself.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface SecretMetadata {\n  ref: string;\n  createdAt: Date;\n  updatedAt: Date;\n  lastAccessedAt?: Date;\n  owner?: string;\n  scopeSummary?: string;\n}\n\n/**\n * Feature flags advertised by a secrets provider via\n * {@link ISecretsProvider.getCapabilities}.\n *\n * Consumers use this to determine whether rotation, TTL, or batch operations\n * are available before calling the corresponding methods.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface ProviderCapabilities {\n  supportsRotation: boolean;\n  supportsExpiry: boolean;\n  supportsBatch: boolean;\n  scopeModel: \"flat\" | \"hierarchical\";\n}\n\n/**\n * Options accepted by {@link ISecretsProvider.setSecret}.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface SetSecretOptions {\n  ttlSeconds?: number;\n  metadata?: Record<string, string>;\n}\n\n/**\n * Filter parameters accepted by {@link ISecretsProvider.listSecrets}.\n *\n * All fields are optional — an empty filter returns all accessible secrets.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface ListFilter {\n  prefix?: string;\n  owner?: string;\n  limit?: number;\n}\n\n// ---------------------------------------------------------------------------\n// Error hierarchy\n// ---------------------------------------------------------------------------\n\n/**\n * Base error class for all secrets-layer failures.\n *\n * Carries a machine-readable `code` string alongside the human-readable\n * message so callers can switch on error type without instanceof chains.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretsError extends Error {\n  code: string;\n\n  constructor(message: string, code: string) {\n    super(message);\n    this.name = \"SecretsError\";\n    this.code = code;\n  }\n}\n\n/**\n * Thrown by {@link ISecretsProvider.getSecret} when the requested `ref` does\n * not exist in the provider's backing store.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretNotFoundError extends SecretsError {\n  constructor(ref: string) {\n    super(`Secret not found: ${ref}`, \"SECRET_NOT_FOUND\");\n    this.name = \"SecretNotFoundError\";\n  }\n}\n\n/**\n * Thrown when the caller does not have permission to access a secret.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretAccessDeniedError extends SecretsError {\n  constructor(message = \"Access denied\") {\n    super(message, \"SECRET_ACCESS_DENIED\");\n    this.name = \"SecretAccessDeniedError\";\n  }\n}\n\n/**\n * Thrown by {@link ISecretsProvider.getSecret} when the secret exists but its\n * TTL has elapsed.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretExpiredError extends SecretsError {\n  constructor(ref: string) {\n    super(`Secret expired: ${ref}`, \"SECRET_EXPIRED\");\n    this.name = \"SecretExpiredError\";\n  }\n}\n\n/**\n * Thrown when the backing secrets provider cannot be reached.\n *\n * Carries an optional `cause` string with provider-specific diagnostics.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class ProviderUnavailableError extends SecretsError {\n  constructor(providerId: string, cause?: string) {\n    super(\n      `Provider unavailable: ${providerId}${cause ? ` (${cause})` : \"\"}`,\n      \"PROVIDER_UNAVAILABLE\",\n    );\n    this.name = \"ProviderUnavailableError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Interface\n// ---------------------------------------------------------------------------\n\n/**\n * Pluggable interface for secret storage and retrieval.\n *\n * Built-in implementations (Phase 1): `LocalSecretsProvider`, `EnvSecretsProvider`\n * (in `workspaces/secrets`).  Future implementations include Vault, AWS SM,\n * GCP SM, Azure Key Vault, Infisical, Doppler, and Bitwarden Secrets.\n *\n * Registration is explicit and programmatic: `pluginRegistry.register(impl)`.\n * Third-party providers are loaded via dynamic import driven by config.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface ISecretsProvider {\n  /** Unique provider identifier used for registration and diagnostics. */\n  readonly id: string;\n  /** Retrieve a secret by ref, returning the raw bytes. */\n  getSecret(ref: string): Promise<Uint8Array>;\n  /** Store or update a secret. Optional TTL and metadata can be attached. */\n  setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void>;\n  /** Permanently remove a secret. */\n  deleteSecret(ref: string): Promise<void>;\n  /** List secret refs accessible to the caller, with optional filtering. */\n  listSecrets(filter?: ListFilter): Promise<string[]>;\n  /** Verify the provider is reachable and measure round-trip latency. */\n  testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }>;\n  /** Return audit metadata for a secret without revealing its value. */\n  getMetadata(ref: string): Promise<SecretMetadata>;\n  /** Advertise which optional capabilities this provider supports. */\n  getCapabilities(): ProviderCapabilities;\n}\n","export const VERSION = \"0.0.0\";\n\n// Pluggable interface contracts — Asset Kind Provider\nexport type {\n  IAssetKindProvider,\n  AssetKindFileFilter,\n  AssetKindRequiresEdge,\n} from \"./asset-kind-provider.js\";\n\n// Pluggable interface contracts — Asset Kind Registry\nexport {\n  AssetKindConflictError,\n  AssetKindPatternConflictError,\n  AssetKindPathAmbiguityError,\n  AssetKindRegistryFrozenError,\n} from \"./asset-kind-registry.js\";\n\nexport type { IAssetKindRegistry } from \"./asset-kind-registry.js\";\n\n// Pluggable interface contracts — Secrets\nexport {\n  SecretsError,\n  SecretNotFoundError,\n  SecretAccessDeniedError,\n  SecretExpiredError,\n  ProviderUnavailableError,\n} from \"./secrets-provider.js\";\n\nexport type {\n  ISecretsProvider,\n  SecretMetadata,\n  ProviderCapabilities,\n  SetSecretOptions,\n  ListFilter,\n} from \"./secrets-provider.js\";\n\n// Pluggable interface contracts — Catalog Source\nexport type {\n  ICatalogSource,\n  CatalogAsset,\n  CatalogAssetFilter,\n  CatalogSourceInfo,\n} from \"./catalog-source.js\";\n"]}

package/dist/chunk-Q5URN24L.js

@@ -0,0 +1,310 @@
+import { resolveSkWorkspaceConfig } from './chunk-CSUBFKAN.js';
+import { createLogger } from './chunk-V37HONL7.js';
+
+// connectors/src/secrets.ts
+var log = createLogger({ kind: "connector", subkind: "secrets" });
+var InMemorySecretProvider = class {
+  store = /* @__PURE__ */ new Map();
+  /**
+   * Store a batch of key-value secrets.
+   *
+   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).
+   */
+  provision(secrets) {
+    for (const [key, value] of Object.entries(secrets)) {
+      this.store.set(key, value);
+    }
+  }
+  resolve(ref) {
+    if (!ref) return void 0;
+    if (ref.startsWith("env:")) return this.store.get(ref.slice(4));
+    if (ref.startsWith("vault:")) return this.store.get(ref.slice(6));
+    const stored = this.store.get(ref);
+    if (stored !== void 0) return stored;
+    return ref;
+  }
+  has(ref) {
+    return this.resolve(ref) !== void 0;
+  }
+  capabilities() {
+    return [...this.store.keys()].map((k) => `env:${k}`);
+  }
+};
+var EnvSecretProvider = class {
+  resolve(ref) {
+    if (!ref) return void 0;
+    if (ref.startsWith("env:")) return process.env[ref.slice(4)];
+    return void 0;
+  }
+  has(ref) {
+    return this.resolve(ref) !== void 0;
+  }
+  capabilities() {
+    return Object.keys(process.env).map((k) => `env:${k}`);
+  }
+};
+var PreMintedSecretProvider = class {
+  mints = /* @__PURE__ */ new Map();
+  /**
+   * Seed pre-minted credentials from the v3 `session_init.credentials` map.
+   *
+   * Failed mints (`ok: false`) are stored too so callers can distinguish
+   * "not pre-minted" from "pre-minted but failed"; {@link resolve} treats
+   * both as `undefined`.
+   *
+   * @param credentials Optional initial `{ mounts, connectors }` map.
+   */
+  constructor(credentials) {
+    if (!credentials) return;
+    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {
+      this.mints.set(`mount:${id}`, mint);
+    }
+    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {
+      this.mints.set(`connector:${id}`, mint);
+    }
+  }
+  /**
+   * Insert (or replace) a pre-minted credential. Used by
+   * `runner.add_mount` / `runner.add_connector` / `runner.update_credential`
+   * capability handlers when the platform delivers new credentials
+   * mid-session.
+   */
+  set(kind, id, mint) {
+    this.mints.set(`${kind}:${id}`, mint);
+  }
+  /**
+   * Remove a stored pre-minted credential. Used by the
+   * `runner.remove_resource` capability handler.
+   */
+  unset(kind, id) {
+    return this.mints.delete(`${kind}:${id}`);
+  }
+  /**
+   * Look up the full {@link PreMintedCredential} for a `mount:` /
+   * `connector:` keyed entry. Callers that only need the token use
+   * {@link resolve} via the chain; callers that need expiry / audit
+   * metadata (e.g. MountManager) use this entry point.
+   */
+  mintFor(kind, id) {
+    return this.mints.get(`${kind}:${id}`);
+  }
+  resolve(ref) {
+    if (!ref) return void 0;
+    if (!(ref.startsWith("mount:") || ref.startsWith("connector:"))) return void 0;
+    const mint = this.mints.get(ref);
+    return mint && mint.ok ? mint.token : void 0;
+  }
+  has(ref) {
+    return this.resolve(ref) !== void 0;
+  }
+  capabilities() {
+    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);
+  }
+};
+var ForgeSecretProvider = class {
+  store = /* @__PURE__ */ new Map();
+  provision(secrets) {
+    for (const [key, value] of Object.entries(secrets)) {
+      this.store.set(key, value);
+    }
+  }
+  resolve(ref) {
+    if (!ref) return void 0;
+    if (ref.startsWith("forge:")) return this.store.get(ref.slice(6));
+    return void 0;
+  }
+  has(ref) {
+    return this.resolve(ref) !== void 0;
+  }
+  capabilities() {
+    return [...this.store.keys()].map((k) => `forge:${k}`);
+  }
+};
+var OAuthRequiredError = class extends Error {
+  oauthRef;
+  authUrl;
+  state;
+  /**
+   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error
+   * @param authUrl - Browser URL to open for OAuth authorization
+   * @param state - OAuth state token for CSRF protection and callback correlation
+   */
+  constructor(oauthRef, authUrl, state) {
+    super(`OAuth authorization required for ${oauthRef}`);
+    this.name = "OAuthRequiredError";
+    this.oauthRef = oauthRef;
+    this.authUrl = authUrl;
+    this.state = state;
+  }
+};
+var LockedSecretProvider = class {
+  locked = true;
+  store = /* @__PURE__ */ new Map();
+  async unlock(credential) {
+    await this.loadKeys(credential);
+    this.locked = false;
+  }
+  resolve(ref) {
+    if (this.locked) return void 0;
+    if (!ref.startsWith(this.prefix)) return void 0;
+    return this.store.get(ref.slice(this.prefix.length));
+  }
+  has(ref) {
+    return this.resolve(ref) !== void 0;
+  }
+  capabilities() {
+    if (this.locked) return [];
+    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);
+  }
+};
+var KNOWN_PREFIXES = ["env:", "forge:", "op:", "kp:", "oauth:", "mount:", "connector:"];
+function getPrefix(ref) {
+  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));
+}
+var SecretProviderChain = class {
+  /**
+   * @param providers - Ordered list of providers. For prefixed refs, the first
+   *   provider that can resolve wins. For bare refs, waterfall through all in order.
+   */
+  constructor(providers) {
+    this.providers = providers;
+  }
+  providers;
+  resolve(ref) {
+    if (!ref) return void 0;
+    const prefix = getPrefix(ref);
+    log.debug("resolve secret", { ref, prefix: prefix ?? "(bare)" });
+    if (prefix) {
+      for (const p of this.providers) {
+        const val = p.resolve(ref);
+        if (val !== void 0) return val;
+      }
+      log.warn("secret not resolvable", { ref });
+      return void 0;
+    }
+    for (const p of this.providers) {
+      const val = p.resolve(ref);
+      if (val !== void 0) return val;
+    }
+    log.warn("secret not resolvable", { ref });
+    return void 0;
+  }
+  has(ref) {
+    return this.resolve(ref) !== void 0;
+  }
+  capabilities() {
+    const all = this.providers.flatMap((p) => p.capabilities());
+    return [...new Set(all)];
+  }
+  /** Returns the first provider that can resolve this ref. */
+  providerFor(ref) {
+    for (const p of this.providers) {
+      if (p.resolve(ref) !== void 0) return p;
+    }
+    return void 0;
+  }
+  /**
+   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.
+   * No-op for providers that don't have ensureFresh().
+   *
+   * @param ref - Must be an "oauth:" prefixed ref for this to have any effect.
+   *   Calls ensureFresh() on the owning OAuthSecretProvider.
+   */
+  async prepareRef(ref) {
+    const owner = this.providerFor(ref);
+    if (owner && "ensureFresh" in owner && typeof owner.ensureFresh === "function") {
+      try {
+        await owner.ensureFresh(ref);
+      } catch (err) {
+        log.error("secret provider ensureFresh failed", err, { ref });
+        throw err;
+      }
+    }
+  }
+};
+
+// connectors/src/config.ts
+function loadMountDeclarations(projectDir) {
+  const config = resolveSkWorkspaceConfig(projectDir);
+  if (!config.mounts || config.mounts.length === 0) return [];
+  return config.mounts.map(workspaceMountToDeclaration);
+}
+function loadConnectorDeclarations(projectDir) {
+  const config = resolveSkWorkspaceConfig(projectDir);
+  if (!config.connectors || config.connectors.length === 0) return [];
+  return config.connectors.map(workspaceConnectorToDeclaration);
+}
+function workspaceMountToDeclaration(v) {
+  return {
+    id: v.id,
+    driver: v.driver,
+    source: v.source,
+    target: v.target,
+    access: v.access ?? "read-only",
+    auth: v.auth,
+    watch: v.watch,
+    exposeAccessToken: v.exposeAccessToken,
+    accessTokenTTL: v.accessTokenTTL,
+    options: v.options
+  };
+}
+function workspaceConnectorToDeclaration(c) {
+  return {
+    id: c.id,
+    driver: c.driver,
+    access: c.access ?? "read-only",
+    auth: c.auth,
+    options: c.options
+  };
+}
+function createForgeSecretProviderChain(forgeProvider, extraProviders = []) {
+  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);
+}
+function createCliSecretProviderChain(extraSecrets = {}) {
+  const mem = new InMemorySecretProvider();
+  if (Object.keys(extraSecrets).length > 0) {
+    mem.provision(extraSecrets);
+  }
+  return new SecretProviderChain([new EnvSecretProvider(), mem]);
+}
+function resolveAuth(auth, secrets) {
+  if (!auth) return void 0;
+  if (secrets) return secrets.resolve(auth);
+  if (auth.startsWith("env:")) {
+    const envVar = auth.slice(4);
+    return process.env[envVar];
+  }
+  return auth;
+}
+var LegacyAuthGrammarError = class extends Error {
+  auth;
+  constructor(auth, mountId) {
+    const where = mountId ? ` on mount '${mountId}'` : "";
+    super(
+      `Legacy or unrecognized auth grammar${where} ('${auth}'). Replace with one of:
+  - backend                  (platform-mediated, recommended)
+  - pat:env:NAME             (standalone CLI / static token)
+See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`
+    );
+    this.name = "LegacyAuthGrammarError";
+    this.auth = auth;
+  }
+};
+function resolveBackendAuthFor(kind, id, chain) {
+  if (!chain) return void 0;
+  return chain.resolve(`${kind}:${id}`);
+}
+function resolveAuthRef(auth, mountId) {
+  if (!auth) return void 0;
+  if (auth === "backend") {
+    return { kind: "backend", value: "", raw: auth };
+  }
+  if (auth.startsWith("pat:")) {
+    return { kind: "pat", value: auth.slice("pat:".length), raw: auth };
+  }
+  throw new LegacyAuthGrammarError(auth, mountId);
+}
+
+export { EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, loadConnectorDeclarations, loadMountDeclarations, resolveAuth, resolveAuthRef, resolveBackendAuthFor };
+//# sourceMappingURL=chunk-Q5URN24L.js.map
+//# sourceMappingURL=chunk-Q5URN24L.js.map