@skaile/workspaces 0.8.5

package/dist/connectors/src/connector-types.d.ts

@@ -0,0 +1,220 @@
+/**
+ * Connector adapter infrastructure types.
+ *
+ * Connectors are external data backends (databases, KV stores, object stores,
+ * in-process state, etc.) that agents access through injected tools. Adapters
+ * bridge the gap between the backend's native API and the uniform interface
+ * agents consume. Connectors do not mount to the filesystem — for filesystem
+ * projection use mounts instead.
+ *
+ * @docLink packages/connectors/concepts#connector-types
+ */
+import type { ConnectorContent, ConnectorEntry, ListOptions, OperationDescriptor, SearchOptions, SearchResult, WatchHandle, WatchOptions } from "./shared-types.js";
+export type { OperationDescriptor } from "./shared-types.js";
+import type { SecretProvider } from "./secrets.js";
+/**
+ * Parsed connector configuration from `skaile.yaml`, passed to `ConnectorAdapter.connect()` and held by `ConnectorManager`.
+ * @docLink packages/connectors/concepts#connector-declaration
+ */
+export interface ConnectorDeclaration {
+    /** Unique identifier for this connector instance. */
+    id: string;
+    /** Driver type: "postgres", "redis", "memory", "xstate", "yjs", etc. */
+    driver: string;
+    /** Access level enforced by the manager. */
+    access: "read-only" | "read-write";
+    /** Credential reference: "env:VAR_NAME" or inline value. */
+    auth?: string;
+    /** Driver-specific configuration. */
+    options?: Record<string, unknown>;
+}
+/**
+ * Live state of a connected backend, returned by `ConnectorAdapter.connect()` and held by `ConnectorManager`.
+ * @docLink packages/connectors/concepts#connector-handle
+ */
+export interface ConnectorHandle {
+    /** Connector declaration ID. */
+    readonly id: string;
+    /** Driver name. */
+    readonly driver: string;
+    /** Effective access level. */
+    readonly access: "read-only" | "read-write";
+    /** Whether the adapter is connected. */
+    connected: boolean;
+    /** Adapter-specific state (connection pool, client, etc.). Opaque to callers. */
+    state: unknown;
+}
+/**
+ * Change event emitted by a connector adapter's `watch()` implementation.
+ * @docLink packages/connectors/concepts#connector-change-event
+ */
+export interface ConnectorChangeEvent {
+    /** Relative path, key, table name, node ID, etc. */
+    path: string;
+    /** What happened. */
+    action: "create" | "edit" | "delete";
+    /** What caused the change. */
+    source: "operation" | "remote" | "filesystem";
+}
+/**
+ * Summary of a connected connector returned by `ConnectorManager.listConnectors()`.
+ * @docLink packages/connectors/concepts#connector-info
+ */
+export interface ConnectorInfo {
+    id: string;
+    driver: string;
+    access: "read-only" | "read-write";
+    /** Operation names this connector exposes as agent tools (via describeOperations). */
+    operations: string[];
+}
+/**
+ * Bulk connect/disconnect result returned by `ConnectorManager.connectAll()` and `disconnectAll()`.
+ * @docLink packages/connectors/concepts#connector-report
+ */
+export interface ConnectorReport {
+    results: Array<{
+        id: string;
+        connected: boolean;
+        error?: string;
+    }>;
+}
+/**
+ * Input types for `ConnectorFieldSpec`. Controls validation rules and the Forge UI affordance.
+ * @docLink packages/connectors/concepts#field-type
+ */
+export type FieldType = "text" | "password" | "api-key" | "url" | "oauth" | "select" | "boolean" | "number";
+/**
+ * Declares one credential or configuration field that a connector adapter requires.
+ * Used by `ConnectorManager.resolveFields()` and the Forge settings UI.
+ * @docLink packages/connectors/concepts#connector-field-spec
+ */
+export interface ConnectorFieldSpec {
+    /** Machine name used as the options key in skaile.yaml. */
+    key: string;
+    /** Human-readable label for the forge settings UI. */
+    label: string;
+    /** Tooltip / help text. */
+    description?: string;
+    /** Input type. Controls validation rules and UI affordance in the forge settings panel. */
+    type: FieldType;
+    /** Whether the adapter refuses to connect when this field is missing. */
+    required: boolean;
+    /** String fallback used when not provided and not required. */
+    default?: string;
+    /** Forge UI masks the value; value is never logged. */
+    sensitive: boolean;
+    /** UI grouping: "Authentication", "Connection", "Options". */
+    group?: string;
+    /**
+     * Required when type === "select"; must be non-empty.
+     */
+    choices?: string[];
+    /**
+     * Required when type === "oauth".
+     * Identifies the OAuth service, e.g. "google".
+     * Used to call OAuthSecretProvider.initiateFlow(oauthService, account).
+     * oauth fields must be declared AFTER any field they reference (e.g., "account").
+     */
+    oauthService?: string;
+    /** Example value shown as placeholder text in the forge settings UI. */
+    example?: string;
+}
+/**
+ * Thrown by `ConnectorManager.connectAll()` and `resolveFields()` when a required
+ * adapter field cannot be resolved through the `SecretProviderChain`. Carries the
+ * connector ID, the missing field spec, the ref that was tried, and the available
+ * providers for actionable error messages.
+ * @docLink packages/connectors/concepts#connector-field-missing-error
+ */
+export declare class ConnectorFieldMissingError extends Error {
+    readonly connectorId: string;
+    readonly field: ConnectorFieldSpec;
+    readonly triedRef: string;
+    readonly availableProviders: string[];
+    constructor(opts: {
+        connectorId: string;
+        field: ConnectorFieldSpec;
+        triedRef: string;
+        availableProviders: string[];
+    });
+}
+/**
+ * Instance-specific skill descriptor returned by `ConnectorAdapter.describeSkill()`.
+ * Returned by `ConnectorManager.listSkills()` to surface connector capabilities to the agent.
+ * @docLink packages/connectors/concepts#runtime-skill-descriptor
+ */
+export interface RuntimeSkillDescriptor {
+    /** Connector instance id, e.g. "gmail-work". */
+    id: string;
+    /** Short label: "Gmail — work@company.com". */
+    name: string;
+    /** Instance-specific description: "Read and write email for work@company.com". */
+    description: string;
+    /** Category for grouping in the forge UI. */
+    category: string;
+    access: "read-only" | "read-write";
+    /** Operation names (without loading full defs) for agent planning. */
+    toolNames: string[];
+}
+/**
+ * Contract all connector adapters must implement. Each adapter bridges one
+ * backend type (postgres, redis, memory, etc.) to the uniform interface consumed
+ * by `ConnectorManager` and agent tools.
+ *
+ * The interface follows an optional-hook pattern: only `connect`, `disconnect`,
+ * `describeOperations`, and `executeOp` are required. Base CRUD methods
+ * (`read`, `write`, `delete`, `list`, `search`) are optional and default to
+ * throwing "not supported". Lifecycle hooks (`describeFields`, `describeSkill`,
+ * `watch`, `onHibernate`, `onSessionClose`) are fully optional.
+ * @docLink packages/connectors/concepts#connector-adapter
+ */
+export interface ConnectorAdapter {
+    readonly name: string;
+    /**
+     * Establish a connection to the backend. Receives resolvedFields when the
+     * adapter implements describeFields() and ConnectorManager.resolveFields()
+     * has been called.
+     */
+    connect(declaration: ConnectorDeclaration, secrets?: SecretProvider, resolvedFields?: Record<string, string>): Promise<ConnectorHandle>;
+    /** Close the connection and release resources. */
+    disconnect(handle: ConnectorHandle): Promise<void>;
+    /** Fetch content at a path/key. */
+    read(handle: ConnectorHandle, path: string): Promise<ConnectorContent | null>;
+    /** Store content at a path/key. */
+    write(handle: ConnectorHandle, path: string, content: ConnectorContent): Promise<void>;
+    /** Remove a path/key. Returns true if deleted, false if not found. */
+    delete(handle: ConnectorHandle, path: string): Promise<boolean>;
+    /** Enumerate entries at a path/prefix. */
+    list(handle: ConnectorHandle, path?: string, options?: ListOptions): Promise<ConnectorEntry[]>;
+    /** Full-text or semantic search across entries. */
+    search(handle: ConnectorHandle, query: string, options?: SearchOptions): Promise<SearchResult[]>;
+    /** Return the custom operations this adapter exposes beyond base CRUD. */
+    describeOperations(handle: ConnectorHandle): OperationDescriptor[];
+    /** Execute a custom operation by name. */
+    executeOp(handle: ConnectorHandle, operation: string, args: Record<string, unknown>): Promise<string>;
+    /**
+     * Declare the credentials and config fields this adapter requires.
+     * ConnectorManager calls this before connect() and resolves the values
+     * via the SecretProviderChain, passing the result as resolvedFields.
+     * oauth fields must be declared after any fields they depend on.
+     */
+    describeFields?(): ConnectorFieldSpec[];
+    /**
+     * Return an instance-specific skill descriptor for the skill catalog.
+     * May access declaration.options (non-sensitive config only).
+     * Must NOT access secret values.
+     * ConnectorManager provides a default descriptor from id + driver if absent.
+     */
+    describeSkill?(handle: ConnectorHandle, declaration: ConnectorDeclaration): RuntimeSkillDescriptor;
+    watch?(handle: ConnectorHandle, callback: (event: ConnectorChangeEvent) => void, options?: WatchOptions): WatchHandle;
+    /** Called before container hibernation. Adapters should persist unsaved state. */
+    onHibernate?(handle: ConnectorHandle): Promise<string | undefined>;
+    /** Called when the session is closing. Adapters should finalize work. */
+    onSessionClose?(handle: ConnectorHandle): Promise<string | undefined>;
+}
+/**
+ * Factory function signature used by the connector registry.
+ * @docLink packages/connectors/api-reference#connector-adapter-factory
+ */
+export type ConnectorAdapterFactory = () => ConnectorAdapter;
+//# sourceMappingURL=connector-types.d.ts.map

package/dist/connectors/src/connector-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-types.d.ts","sourceRoot":"","sources":["../../../connectors/src/connector-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,MAAM,EAAE,WAAW,GAAG,YAAY,CAAC;IACnC,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mBAAmB;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,CAAC;IAC5C,wCAAwC;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC;CAChB;AAID;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrC,8BAA8B;IAC9B,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC/C;AAID;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,GAAG,YAAY,CAAC;IACnC,sFAAsF;IACtF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE;AAID;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,UAAU,GACV,SAAS,GACT,KAAK,GACL,OAAO,GACP,QAAQ,GACR,SAAS,GACT,QAAQ,CAAC;AAEb;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,IAAI,EAAE,SAAS,CAAC;IAChB,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;gBAE1B,IAAI,EAAE;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,kBAAkB,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,kBAAkB,EAAE,MAAM,EAAE,CAAC;KAC9B;CAYF;AAID;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,YAAY,CAAC;IACnC,sEAAsE;IACtE,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAID;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAItB;;;;OAIG;IACH,OAAO,CACL,WAAW,EAAE,oBAAoB,EACjC,OAAO,CAAC,EAAE,cAAc,EACxB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,kDAAkD;IAClD,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnD,mCAAmC;IACnC,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9E,mCAAmC;IACnC,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,sEAAsE;IACtE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,0CAA0C;IAC1C,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/F,mDAAmD;IACnD,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAGjG,0EAA0E;IAC1E,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,mBAAmB,EAAE,CAAC;IACnE,0CAA0C;IAC1C,SAAS,CACP,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CAAC;IAInB;;;;;OAKG;IACH,cAAc,CAAC,IAAI,kBAAkB,EAAE,CAAC;IAExC;;;;;OAKG;IACH,aAAa,CAAC,CACZ,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,oBAAoB,GAChC,sBAAsB,CAAC;IAG1B,KAAK,CAAC,CACJ,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,EAC/C,OAAO,CAAC,EAAE,YAAY,GACrB,WAAW,CAAC;IAGf,kFAAkF;IAClF,WAAW,CAAC,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACnE,yEAAyE;IACzE,cAAc,CAAC,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACvE;AAID;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,gBAAgB,CAAC"}

package/dist/connectors/src/credential-helper-script.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Credential helper script renderer — generates a POSIX `sh` script that git
+ * invokes via `credential.<urlPrefix>.helper = !sh <path>` to fetch credentials
+ * for a Tier-2 git mount.
+ *
+ * The script implements the wake-mid-401 hardening described in
+ * `_devlog/specs/2026-05-07-unified-credential-mediation.md` § Step 9a:
+ *
+ *   1. On `op = get`, stat the credentials file and compute its age (mtime).
+ *   2. If age > triggerAgeSec, touch the refresh-flag file. The runner watches
+ *      this path via `fs.watch` and mints a fresh access token + rewrites the
+ *      credentials file when it sees the change.
+ *   3. Poll the credentials file's mtime in 200ms increments until the mtime
+ *      advances OR waitTimeoutMs elapses.
+ *   4. Translate the credentials file (`scheme://user:pass@host <tag>` lines —
+ *      git's `store --file=` format) into the helper-output format git
+ *      expects (`username=<value>\npassword=<value>\n`). Filters lines by the
+ *      mount's url-prefix tag so multi-mount workspaces stay isolated.
+ *
+ * **Cross-platform**: targets POSIX `sh` (Linux + macOS). Avoids bashisms so
+ * `dash`, `ash`, and `busybox sh` all work. The two GNU/BSD divergence points
+ * are handled inline:
+ *
+ *   - `stat -c %Y <file>` (GNU/Linux) vs `stat -f %m <file>` (BSD/macOS) —
+ *     try GNU first, fall back to BSD, default to 0.
+ *   - `sleep 0.2` is non-portable — use `usleep 200000` when present, else
+ *     fall back to `sleep 1`.
+ *
+ * The credentials file format is unchanged (Option B in the Step 9a plan):
+ * `scheme://user:pass@host <tag>` per mount, written by `writeMountBlock`.
+ * The helper script does the translation to `username=<>\npassword=<>\n`
+ * inline so we don't have to change the on-disk format and break Step 1A
+ * back-compat.
+ *
+ * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md`.
+ */
+/** Required arguments for {@link renderCredentialHelperScript}. */
+export interface RenderHelperOpts {
+    /** Absolute path to the per-mount credentials file. */
+    credentialsPath: string;
+    /**
+     * Absolute path to the workspace-level refresh-request flag file. The
+     * runner watches this file via `fs.watch` and triggers a token refresh on
+     * `change`.
+     */
+    refreshFlagPath: string;
+    /**
+     * Tag emitted by `writeMountBlock` on the credential line for this mount
+     * (e.g. `# skaile-mount: workspace`). The helper greps for lines ending in
+     * this tag so concurrent mounts in the same credentials file stay isolated.
+     */
+    credentialTag: string;
+    /**
+     * Touch the refresh-flag if the credentials file is older than this (in
+     * seconds). Default: 300 (5 minutes — comfortably shorter than the typical
+     * 1-hour Anthropic OAuth lifetime, well clear of the 5-minute pre-expiry
+     * refresh window scheduled by the driver).
+     */
+    triggerAgeSec?: number;
+    /**
+     * Maximum time to wait for the credentials file mtime to advance after
+     * touching the refresh-flag (in milliseconds). Default: 5000 (5 seconds —
+     * long enough for the runner's debounced watcher + token mediator round-
+     * trip; short enough that a stuck backend doesn't block git for minutes).
+     */
+    waitTimeoutMs?: number;
+}
+/**
+ * Render the credential-helper script body. The returned string should be
+ * written to disk with mode `0755` (owner rwx, group/other rx) so git can
+ * execute it.
+ *
+ * `git` invokes credential helpers with one of three operations as `$1`:
+ *   - `get`   — read credentials. We respond with the helper-output format.
+ *   - `store` — git wants us to remember a credential. We're a one-way
+ *               read-only helper; ignore.
+ *   - `erase` — git wants us to forget a credential. Same — ignore.
+ *
+ * Only `get` triggers the refresh-flag dance. Other ops exit silently with 0
+ * so git falls back to the next helper in the chain (or its own prompt).
+ *
+ * The script also drains stdin on `get` because git always pipes the request
+ * envelope (host, protocol, path, etc.) into the helper's stdin. Leaving it
+ * unread can wedge git's helper FD.
+ */
+export declare function renderCredentialHelperScript(opts: RenderHelperOpts): string;
+//# sourceMappingURL=credential-helper-script.d.ts.map

package/dist/connectors/src/credential-helper-script.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-helper-script.d.ts","sourceRoot":"","sources":["../../../connectors/src/credential-helper-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAgG3E"}

package/dist/connectors/src/drivers/base.d.ts

@@ -0,0 +1,44 @@
+/**
+ * AbstractMountDriver — base class for mount drivers.
+ *
+ * Extend this class to register with MountManager via registerMountDriver().
+ * Provides a default no-op watch() implementation — override to emit filesystem
+ * change events when the driver supports them.
+ *
+ * Subclasses MUST implement: mount, unmount, sync.
+ * Lifecycle hooks (onHibernate, onSessionClose) have no-op defaults.
+ */
+import type { Logger } from "@skaile/workspaces/types";
+import type { MountDeclaration, MountDriver, MountHandle, TokenMediator } from "../mount-types.js";
+import type { SecretProvider } from "../secrets.js";
+import type { SyncOptions, SyncResult } from "../shared-types.js";
+export declare abstract class AbstractMountDriver implements MountDriver {
+    abstract readonly name: string;
+    /**
+     * Per-instance logger. Initialised to a placeholder; replaced by MountManager
+     * via setLogger() with `{ kind:"mount", subkind:<driver>, instance:<id> }`
+     * once the declaration is known. Use `this.log.info/warn/error/debug` from
+     * any driver method.
+     */
+    protected log: Logger;
+    setLogger(logger: Logger): void;
+    /**
+     * Mount the source content into targetDir and return a handle.
+     * Implementations should create targetDir if it doesn't exist.
+     *
+     * @param declaration - Mount configuration from skaile.yaml
+     * @param targetDir - Absolute path to the directory where content will be mounted
+     * @param secrets - Secret provider for resolving credential references
+     * @param tokenMediator - Optional callback for `auth: backend` mounts to
+     *   request short-lived tokens from the platform's credential mediator.
+     */
+    abstract mount(declaration: MountDeclaration, targetDir: string, secrets?: SecretProvider, tokenMediator?: TokenMediator): Promise<MountHandle>;
+    /** Unmount and release all resources held by this mount. */
+    abstract unmount(handle: MountHandle): Promise<void>;
+    /** Pull the latest remote state into the mounted directory. */
+    abstract sync(handle: MountHandle, options?: SyncOptions): Promise<SyncResult>;
+    onHibernate(_handle: MountHandle): Promise<string | undefined>;
+    onSessionClose(_handle: MountHandle): Promise<string | undefined>;
+    protected makeHandle(declaration: MountDeclaration, mountPath: string, state: unknown): MountHandle;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/connectors/src/drivers/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../connectors/src/drivers/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAElE,8BAAsB,mBAAoB,YAAW,WAAW;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,CAAuD;IAE5E,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CACZ,WAAW,EAAE,gBAAgB,EAC7B,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,cAAc,EACxB,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,WAAW,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IACpD,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAExE,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAG9D,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIvE,SAAS,CAAC,UAAU,CAClB,WAAW,EAAE,gBAAgB,EAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,GACb,WAAW;CAUf"}

package/dist/connectors/src/index.d.ts

@@ -0,0 +1,51 @@
+/**
+ * skaile-agent-connectors — unified connector adapter infrastructure.
+ *
+ * Public API:
+ *   ConnectorManager         — lifecycle, dispatch, tool registry
+ *   buildSdkConnectorTools   — Claude SDK tool injection
+ *   buildConnectorPromptSection — system prompt generation
+ *   loadConnectorDeclarations — config from skaile.yaml connectors
+ *   registerConnectorAdapter  — add custom adapters
+ *   registerBuiltinConnectorAdapters — register builtin adapters
+ *
+ * Mount API:
+ *   MountManager            — mount lifecycle + hot-plug support
+ *   buildMountPromptSection — system prompt generation for mounts
+ *   loadMountDeclarations   — config from skaile.yaml mounts
+ *   registerMountDriver     — add custom mount drivers
+ */
+export { AbstractConnectorAdapter } from "./adapters/base.js";
+export type { FlowAdapterConnectOptions, FlowAdapterState, FlowAdapterStimulusBus, } from "@skaile/workspaces/base-assets/connectors/flow";
+export { FlowAdapter } from "@skaile/workspaces/base-assets/connectors/flow";
+export type { MountAuthKind, MountAuthRef } from "./config.js";
+export { createCliSecretProviderChain, createForgeSecretProviderChain, LegacyAuthGrammarError, loadConnectorDeclarations, loadMountDeclarations, resolveAuth, resolveAuthRef, resolveBackendAuthFor, } from "./config.js";
+export { ConnectorManager } from "./connector-manager.js";
+export { getConnectorAdapter, listConnectorAdapters, registerBuiltinConnectorAdapters, registerConnectorAdapter, tryGetConnectorAdapter, } from "./connector-registry.js";
+export { buildConnectorPromptSection, buildSdkConnectorTools, } from "./connector-tools.js";
+export type { ConnectorAdapter, ConnectorAdapterFactory, ConnectorChangeEvent, ConnectorDeclaration, ConnectorFieldSpec, ConnectorHandle, ConnectorInfo, ConnectorReport, FieldType, OperationDescriptor, RuntimeSkillDescriptor, } from "./connector-types.js";
+export { ConnectorFieldMissingError } from "./connector-types.js";
+export { AbstractMountDriver } from "./drivers/base.js";
+export { LogBuffer } from "./log-buffer.js";
+export type { RenderHelperOpts } from "./credential-helper-script.js";
+export { renderCredentialHelperScript } from "./credential-helper-script.js";
+export type { AtomicReplaceCredentialOptions, RemoveMountBlockOptions, WriteMountBlockOptions, } from "./managed-gitconfig.js";
+export { atomicReplaceCredential, ManagedGitconfigCollisionError, removeMountBlock, writeHelperScript, writeMountBlock, } from "./managed-gitconfig.js";
+export { MountManager } from "./mount-manager.js";
+export { buildMountPromptSection } from "./mount-prompt.js";
+export { getMountDriver, listMountDrivers, registerBuiltinMountDrivers, registerMountDriver, tryGetMountDriver, } from "./mount-registry.js";
+export type { MountChangeEvent, MountDeclaration, MountDriver, MountDriverFactory, MountHandle, MountInfo, MountReport, TokenMediator, TokenMediatorResult, } from "./mount-types.js";
+export { MountStartupError } from "./mount-types.js";
+export type { InstallOptions, InstallResult, SpawnFn, SpawnResult } from "./npm-installer.js";
+export { defaultSpawn, findMissingPackages, installNpmPackages, isPackageResolvable, } from "./npm-installer.js";
+export { PortPool } from "./port-pool.js";
+export { type RenderOneDriveConfigOptions, type RenderWebDAVConfigOptions, renderOneDriveConfig, renderWebDAVConfig, type WebDAVVendor, } from "./rclone-config/index.js";
+export type { RcloneHandle, RcloneSpawnConfig } from "./rclone-process-manager.js";
+export { RcloneProcessManager } from "./rclone-process-manager.js";
+export type { OAuthFlowRequest, OAuthSecretProvider, OAuthTokenBundle, PreMintedCredential, ProvisionableSecretProvider, SecretProvider, } from "./secrets.js";
+export { EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LockedSecretProvider, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, } from "./secrets.js";
+export type { ArgumentDescriptor, ConnectorContent, ConnectorEntry, ListOptions, SearchOptions, SearchResult, SyncOptions, SyncResult, SyncStatusPayload, WatchHandle, WatchOptions, WatchStrategy, } from "./shared-types.js";
+export { createFsWatcher } from "./watcher.js";
+export type { WorktreeInfo, WorktreeResult } from "./worktree.js";
+export { createWorktree, findGitRoot, listWorktrees, worktreeRegistry } from "./worktree.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/connectors/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../connectors/src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EACV,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,WAAW,EACX,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,2BAA2B,EAC3B,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,SAAS,EACT,WAAW,EACX,aAAa,EACb,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE9F,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,YAAY,GAClB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,EAC3B,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,aAAa,EACb,YAAY,EACZ,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/connectors/src/log-buffer.d.ts

@@ -0,0 +1,21 @@
+/**
+ * LogBuffer — fixed-capacity ring buffer for capturing process stdout/stderr lines.
+ * When the buffer is full, the oldest lines are evicted (FIFO).
+ * @docLink packages/connectors/api-reference#log-buffer
+ */
+export declare class LogBuffer {
+    private readonly lines;
+    private readonly capacity;
+    constructor(capacity?: number);
+    /** Append a single line. */
+    push(line: string): void;
+    /** Split text on newlines and push each line (preserves empty lines). */
+    pushLines(text: string): void;
+    /** Return the last `n` lines. */
+    tail(n: number): string[];
+    /** Clear all stored lines. */
+    clear(): void;
+    /** Current number of stored lines. */
+    get size(): number;
+}
+//# sourceMappingURL=log-buffer.d.ts.map

package/dist/connectors/src/log-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-buffer.d.ts","sourceRoot":"","sources":["../../../connectors/src/log-buffer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,SAAM;IAI1B,4BAA4B;IAC5B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOxB,yEAAyE;IACzE,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAS7B,iCAAiC;IACjC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IAIzB,8BAA8B;IAC9B,KAAK,IAAI,IAAI;IAIb,sCAAsC;IACtC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/connectors/src/managed-gitconfig.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Managed gitconfig writer — runner-managed credential helper config for
+ * Tier-2 mount credentials.
+ *
+ * The runner exposes `<workspace>/.skaile/managed-gitconfig` to the agent
+ * process via `GIT_CONFIG_GLOBAL` (with a fallback `[include]` in
+ * `~/.gitconfig`). Each Tier-2 mount writes a tagged block into this file
+ * pointing `credential.<urlPrefix>.helper` at the shared `git-credentials`
+ * store, plus a single line into the credentials store carrying the actual
+ * token. Refresh = atomically rewrite the credential line; the helper picks
+ * up the new token on the next git network op.
+ *
+ * Keying is by **URL prefix**, not bare host: two mounts on `github.com`
+ * with disjoint org prefixes (`https://github.com/orgA/`,
+ * `https://github.com/orgB/`) coexist via narrower
+ * `credential.<prefix>.helper` entries. Same prefix declared by two mounts
+ * with different tokens is a true collision and throws
+ * {@link ManagedGitconfigCollisionError}.
+ *
+ * Spec: `_devlog/specs/2026-05-05-git-credential-tiers.md`.
+ */
+/**
+ * Thrown when two mounts try to register a credential helper for the same
+ * URL prefix with different tokens. The operator must either narrow the URL
+ * prefixes (per-org paths) or consolidate the mounts.
+ */
+export declare class ManagedGitconfigCollisionError extends Error {
+    readonly urlPrefix: string;
+    readonly existingMountId: string;
+    readonly newMountId: string;
+    constructor(urlPrefix: string, existingMountId: string, newMountId: string);
+}
+/** Required arguments for {@link writeMountBlock}. */
+export interface WriteMountBlockOptions {
+    /** Mount declaration id; used as the block tag. */
+    mountId: string;
+    /**
+     * URL prefix the credential should authenticate, e.g.
+     * `https://github.com` or `https://github.com/orgA/`. Trailing slashes are
+     * preserved verbatim (git treats them as different scopes).
+     */
+    urlPrefix: string;
+    /**
+     * The token to expose. Written to {@link credentialsPath} as
+     * `https://x-access-token:<token>@<host>` for the helper to read.
+     */
+    token: string;
+    /** Absolute path to the managed-gitconfig file. */
+    gitconfigPath: string;
+    /** Absolute path to the git-credentials store. */
+    credentialsPath: string;
+    /**
+     * Optional: when set, the credential block points `helper = !sh <path>` at
+     * this script instead of the static `store --file=` form. The script is
+     * the wake-mid-401 helper rendered by `renderCredentialHelperScript` —
+     * stats the credentials file's mtime, touches a refresh-flag if the cached
+     * token is stale, and translates the `store --file=` line format into the
+     * helper-output format git expects.
+     *
+     * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md` Step 9a.
+     */
+    helperScriptPath?: string;
+}
+/** Required arguments for {@link removeMountBlock}. */
+export interface RemoveMountBlockOptions {
+    /** Mount declaration id whose block should be removed. */
+    mountId: string;
+    /** Absolute path to the managed-gitconfig file. */
+    gitconfigPath: string;
+    /** Absolute path to the git-credentials store. */
+    credentialsPath: string;
+}
+/** Required arguments for {@link atomicReplaceCredential}. */
+export interface AtomicReplaceCredentialOptions {
+    /** Mount id (used to find the matching credential line). */
+    mountId: string;
+    /** URL prefix the credential is keyed by. Same value passed to writeMountBlock. */
+    urlPrefix: string;
+    /** New token to install. */
+    token: string;
+    /** Absolute path to the git-credentials store. */
+    credentialsPath: string;
+}
+/**
+ * Write a credential-helper block for `mountId` into the managed-gitconfig
+ * file, and (re)write the matching line in the git-credentials store.
+ * Idempotent: re-running with the same arguments is a no-op aside from
+ * refreshing the on-disk token. Detects collisions where another mount
+ * already owns the same `urlPrefix` and throws
+ * {@link ManagedGitconfigCollisionError}.
+ *
+ * Files are created with mode `0640` — owner (skaile-runner) read+write,
+ * group (skaile) read-only. See {@link writeCredentialLines} for the
+ * UID-separation rationale.
+ */
+export declare function writeMountBlock(opts: WriteMountBlockOptions): void;
+/**
+ * Remove the block tagged for `mountId` from the managed-gitconfig file and
+ * the matching credential line. Best-effort: missing files / missing block
+ * are not errors.
+ */
+export declare function removeMountBlock(opts: RemoveMountBlockOptions): void;
+/**
+ * Write (or refresh) the credential-helper script at `scriptPath` with mode
+ * `0755` so git can execute it via `helper = !sh <scriptPath>`. Idempotent —
+ * re-rendering with identical opts produces the same script body, so re-runs
+ * are safe. Atomic rename so a concurrent git invocation never sees a
+ * half-written file.
+ *
+ * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md` Step 9a.
+ */
+export declare function writeHelperScript(scriptPath: string, body: string): void;
+/**
+ * Replace just the credential line for `mountId` atomically — refresh path.
+ * The gitconfig block (which only points at the helper) does not need to
+ * change; the helper re-reads the credentials file on every git network op.
+ *
+ * Throws if no existing line is found for `mountId` — the caller is
+ * expected to have written the initial block via {@link writeMountBlock}.
+ */
+export declare function atomicReplaceCredential(opts: AtomicReplaceCredentialOptions): void;
+//# sourceMappingURL=managed-gitconfig.d.ts.map

package/dist/connectors/src/managed-gitconfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-gitconfig.d.ts","sourceRoot":"","sources":["../../../connectors/src/managed-gitconfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgBH;;;;GAIG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAW3E;AAED,sDAAsD;AACtD,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,8DAA8D;AAC9D,MAAM,WAAW,8BAA8B;IAC7C,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;CACzB;AAkKD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI,CAkClE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAiBpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,8BAA8B,GAAG,IAAI,CAYlF"}