@skaile/workspaces 1.3.0 → 1.5.0

package/dist/app-sdk/src/app.d.ts

@@ -0,0 +1,152 @@
+/**
+ * `createSkaileApp` — the thin app SDK that makes an embedded app
+ * agent-controllable.
+ *
+ * An app becomes a *capability peer*, mirroring how the runner behaves toward
+ * the platform:
+ *
+ *  1. Opens an authenticated back-connection (via an {@link AppTransport}).
+ *  2. Performs the app handshake — sends `app_hello`, awaits `app_hello_ack`
+ *     (binding the connection to `session + appId`) or `app_hello_nack` (refusal).
+ *  3. Registers its `app.*` capabilities via `capability_register`, stamping
+ *     each with `origin:{kind:'app', appId}` and `side:'app'`. Register /
+ *     deregister mid-session is supported.
+ *  4. Answers inbound `capability_invoked` events by running the local handler
+ *     and replying with `capability_result` (a thrown handler rides back as
+ *     `{ error }`).
+ *
+ * The approval round-trip for `requiresApproval` capabilities is handled
+ * entirely platform-side: the gateway parks the invocation for user approval
+ * and only forwards `capability_invoked` to the app *after* approval, so the
+ * app just marks the capability and answers when asked.
+ *
+ * The peer reconnects and replays its registrations on a dropped socket, and on
+ * a *retryable* refusal — the app boots independently of the session's agent
+ * container and can win that race. See {@link ReconnectOptions}.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+import type { Capability } from "@skaile/workspaces/types";
+import type { DefinedAppCapability } from "./define-app-capability.js";
+import { type AppLogger } from "./logger.js";
+import type { AppTransport } from "./transport.js";
+/** Default timeout waiting for the gateway's `app_hello_ack`. */
+export declare const DEFAULT_HELLO_TIMEOUT_MS = 10000;
+/**
+ * Reconnect / retry policy. Set `reconnect: false` on {@link SkaileAppOptions}
+ * to disable entirely (one attempt, no replay).
+ *
+ * @category App SDK
+ * @since 3.5.0
+ */
+export interface ReconnectOptions {
+    /** Attempts before giving up. Default 5. */
+    maxAttempts?: number;
+    /** First backoff delay in ms; doubles each attempt. Default 1000. */
+    baseMs?: number;
+    /** Backoff ceiling in ms. Default 30000. */
+    maxMs?: number;
+}
+/**
+ * The gateway refused the handshake. `retryable` mirrors the wire field: `true`
+ * for a transient refusal (the agent container is not up yet), `false` for a
+ * permanent one (bad token, `appId` not permitted).
+ *
+ * @category App SDK
+ * @since 3.5.0
+ */
+export declare class AppHandshakeRefusedError extends Error {
+    readonly retryable: boolean;
+    constructor(reason: string, retryable: boolean);
+}
+/**
+ * Options for {@link createSkaileApp}.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export interface SkaileAppOptions {
+    /** The embedded app's stable id. Every registered capability is bound to it. */
+    appId: string;
+    /**
+     * The app back-connection. Inject {@link createWebSocketAppTransport} in
+     * production or a fake in tests. The transport carries the injected session
+     * identity as its connection credential.
+     *
+     * With `reconnect` enabled the transport must be able to produce a **fresh**
+     * token per attempt — the gateway consumes it at `app_hello`. Pass a
+     * `SessionTokenProvider` rather than a bare string.
+     */
+    transport: AppTransport;
+    /** Protocol version the SDK announces in `app_hello`. Defaults to the SDK's. */
+    protocolVersion?: string;
+    /** Timeout waiting for `app_hello_ack`. Defaults to {@link DEFAULT_HELLO_TIMEOUT_MS}. */
+    helloTimeoutMs?: number;
+    /** Logger for the SDK and (by default) capability handlers. Defaults to {@link noopLogger}. */
+    logger?: AppLogger;
+    /**
+     * Reconnect policy, or `false` to disable. Defaults to
+     * `{maxAttempts:5, baseMs:1000, maxMs:30000}`.
+     *
+     * @since 3.5.0
+     */
+    reconnect?: ReconnectOptions | false;
+}
+/** Result of a successful handshake — the bound session context. */
+export interface AppSession {
+    sessionId: string;
+    userId?: string;
+}
+/**
+ * A connected (or connectable) Skaile app. Register capabilities before or
+ * after {@link connect}; post-connect changes are pushed to the gateway
+ * immediately.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export interface SkaileApp {
+    /**
+     * Add (or replace, by name) an app capability. Registering the same name
+     * again replaces it — mirrors the registry's replace-by-name semantics. When
+     * already connected, a `capability_register` is sent immediately.
+     */
+    registerCapability(cap: DefinedAppCapability): void;
+    /**
+     * Remove a capability by name. No-op when unknown. When connected, a
+     * `capability_deregister` is sent immediately so the tool disappears from the
+     * agent's catalog.
+     */
+    deregisterCapability(name: string): void;
+    /** Wire-format snapshot of the currently registered capabilities (origin stamped). */
+    readonly capabilities: readonly Capability[];
+    /** The bound session once connected; `null` before the handshake and while reconnecting. */
+    readonly session: AppSession | null;
+    /**
+     * Open the connection, perform the handshake, and register the current
+     * capabilities. Resolves with the bound {@link AppSession}. Rejects if the
+     * gateway refuses permanently, the handshake times out, or the transport
+     * disconnects mid-handshake. A *retryable* refusal is retried per the
+     * reconnect policy before rejecting.
+     */
+    connect(): Promise<AppSession>;
+    /**
+     * Subscribe to session binding changes. Fires on **every** bind — including
+     * the initial `connect()` — with the new {@link AppSession}, and with `null`
+     * whenever the connection drops. Returns an unsubscribe function.
+     *
+     * @since 3.5.0
+     */
+    onSessionChange(handler: (session: AppSession | null) => void): () => void;
+    /** Disconnect and tear down. Idempotent. Cancels any pending reconnect. */
+    close(): Promise<void>;
+}
+/**
+ * Create a {@link SkaileApp}. See the module doc for the peer lifecycle.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export declare function createSkaileApp(options: SkaileAppOptions): SkaileApp;
+//# sourceMappingURL=app.d.ts.map

package/dist/app-sdk/src/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../app-sdk/src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,KAAK,SAAS,EAAc,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAoB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAErE,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAS/C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAChB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO;CAK/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,SAAS,EAAE,YAAY,CAAC;IACxB,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;CACtC;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,GAAG,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpD;;;;OAIG;IACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,sFAAsF;IACtF,QAAQ,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7C,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC;;;;;;OAMG;IACH,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/B;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC3E,2EAA2E;IAC3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CA+RpE"}

package/dist/app-sdk/src/connection-params.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Connection-param handshake between the embedding host and the app frame.
+ *
+ * An embedded app needs three things to open its back-connection: the gateway
+ * URL, its own `appId`, and a session identity token. The token is a **secret**,
+ * so it must not ride in the iframe `src` — the preview surface that serves the
+ * app is unauthenticated, and a URL lands in access logs, `Referer` headers, and
+ * browser history. Instead the host posts it over `postMessage`, and the app
+ * asks for it with a ready ping once its script is running.
+ *
+ * The host cannot simply post on iframe `load`: it has no way to know when the
+ * app's script is listening. So the app speaks first.
+ *
+ * ```text
+ * app  → host   { type: 'skaile_app_ready',  appId }        targetOrigin = parentOrigin
+ * host → app    { type: 'skaile_app_params', appId, url, token }   targetOrigin = appOrigin
+ * ```
+ *
+ * Both sides pin the peer: the app checks `event.origin === parentOrigin` and
+ * that the message came from its own parent; the host checks the origin and that
+ * `event.source` is the very iframe it rendered. The app learns the expected
+ * parent origin from a **non-secret** query param on its `src`
+ * ({@link PARENT_ORIGIN_QUERY_PARAM}), which is safe to leak precisely because it
+ * is not a credential.
+ *
+ * @category App SDK
+ * @since 3.5.0
+ */
+/**
+ * Query param on the app's iframe `src` carrying the embedder's origin. Not a
+ * secret — it is the value the app pins its `postMessage` peer to.
+ */
+export declare const PARENT_ORIGIN_QUERY_PARAM = "skaileParentOrigin";
+/** Default timeout waiting for the host's params reply. */
+export declare const DEFAULT_PARAMS_TIMEOUT_MS = 10000;
+/** App → host. Announces the app frame is listening and wants its params. */
+export type SkaileAppReadyMessage = {
+    type: "skaile_app_ready";
+    /** The app asking. The host answers only for an app it actually embedded. */
+    appId: string;
+};
+/** Host → app. Carries the gateway URL and the single-use session identity token. */
+export type SkaileAppParamsMessage = {
+    type: "skaile_app_params";
+    /** Echoed back so a frame embedding several apps can disambiguate. */
+    appId: string;
+    /** The gateway app-channel URL, e.g. `wss://platform/app-connect`. */
+    url: string;
+    /** Single-use session identity token. Consumed by the gateway at `app_hello`. */
+    token: string;
+};
+/** Resolved params, ready to hand to `createWebSocketAppTransport` + `createSkaileApp`. */
+export type AppConnectionParams = {
+    url: string;
+    appId: string;
+    token: string;
+};
+/** The subset of `postMessage` targets this module needs. */
+export type PostMessageTarget = {
+    postMessage(message: unknown, targetOrigin: string): void;
+};
+/** Structural view of a `MessageEvent`, so tests need no DOM. */
+export type MessageEventLike = {
+    readonly origin: string;
+    readonly source: unknown;
+    readonly data: unknown;
+};
+/** Structural view of the `window` bits this module needs. Injectable for tests. */
+export type AppWindowLike = {
+    readonly parent: PostMessageTarget | null;
+    readonly location: {
+        readonly search: string;
+    };
+    addEventListener(type: "message", handler: (event: MessageEventLike) => void): void;
+    removeEventListener(type: "message", handler: (event: MessageEventLike) => void): void;
+};
+/**
+ * Options for {@link resolveAppConnectionParams}.
+ *
+ * @category App SDK
+ * @since 3.5.0
+ */
+export interface ResolveAppConnectionParamsOptions {
+    /** The embedded app's stable id. Must match the params the host replies with. */
+    appId: string;
+    /**
+     * Expected origin of the embedding host. Defaults to the
+     * {@link PARENT_ORIGIN_QUERY_PARAM} query param on the current URL. Never `"*"`
+     * or `"null"` — an unpinned peer defeats the point of not putting the token in
+     * the URL.
+     */
+    parentOrigin?: string;
+    /** How long to wait for the host's reply. Defaults to {@link DEFAULT_PARAMS_TIMEOUT_MS}. */
+    timeoutMs?: number;
+    /** Window to listen and post on. Defaults to the global. Injectable for tests. */
+    windowRef?: AppWindowLike;
+}
+/**
+ * Ask the embedding host for this app's connection params.
+ *
+ * Posts a {@link SkaileAppReadyMessage} to the parent and resolves with the
+ * matching {@link SkaileAppParamsMessage}. Messages from any other origin, from
+ * any window other than the parent, or for another `appId` are ignored — not
+ * rejected — because a page may legitimately receive unrelated `postMessage`
+ * traffic.
+ *
+ * Call it again to re-request a fresh token: the token is single-use, so a
+ * reconnecting transport needs a new one (see `createSkaileApp`'s `reconnect`).
+ *
+ * @throws when not embedded, when the parent origin cannot be determined or is
+ *   unpinnable, or when the host does not reply within `timeoutMs`.
+ *
+ * @category App SDK
+ * @since 3.5.0
+ */
+export declare function resolveAppConnectionParams(options: ResolveAppConnectionParamsOptions): Promise<AppConnectionParams>;
+//# sourceMappingURL=connection-params.d.ts.map

package/dist/app-sdk/src/connection-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-params.d.ts","sourceRoot":"","sources":["../../../app-sdk/src/connection-params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;GAGG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D,2DAA2D;AAC3D,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,6EAA6E;AAC7E,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,kBAAkB,CAAC;IACzB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3D,CAAC;AAEF,iEAAiE;AACjE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI,CAAC;IACpF,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI,CAAC;CACxF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IAChD,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAsBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,mBAAmB,CAAC,CAyE9B"}

package/dist/app-sdk/src/define-app-capability.d.ts

@@ -0,0 +1,139 @@
+/**
+ * `defineAppCapability` — author-friendly factory for an embedded app's
+ * agent-controllable capabilities.
+ *
+ * It mirrors the runner's `defineCapability` (`@skaile/workspaces/runner`) but
+ * is scoped to the app side: the handler always runs *in the app*, so `side` is
+ * fixed to `'app'` and the author never passes it. The originating `appId` is
+ * known to the SDK, not the individual capability, so `origin` is stamped by
+ * {@link createSkaileApp} at registration time — not here.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+import type { CapabilityAudience, CapabilityOrigin, RenderSpec } from "@skaile/workspaces/types";
+import * as z from "zod";
+import type { AppLogger } from "./logger.js";
+/**
+ * Per-invocation context passed to an app capability handler. Analogous to the
+ * runner's `HandlerContext`, but carries the `appId` and the SDK's
+ * {@link AppLogger} (there is no server-side `capability:<origin>:<name>` log
+ * slice inside the app process).
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export type AppHandlerContext = {
+    /** The session this app connection is bound to (from the hello ack). */
+    sessionId: string;
+    /** The embedded app's id. */
+    appId: string;
+    /** Logger to emit through; defaults to the SDK's configured logger. */
+    log: AppLogger;
+};
+/**
+ * Author-facing arguments to {@link defineAppCapability}. Mirrors the wire
+ * {@link import("@skaile/workspaces/types").Capability} fields an app may set,
+ * minus `side` / `origin` (fixed / stamped by the SDK) and the runtime-only
+ * fields that only make sense platform-side.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export type DefineAppCapabilityArgs<T extends z.ZodTypeAny, R extends z.ZodTypeAny | undefined = undefined> = {
+    /**
+     * Stable, session-unique name. Convention: `app.<sector>.<verb>` — e.g.
+     * `app.ui.switch_contract` (UI sector) or `app.backend.insert_contract`
+     * (backend sector). v1 distinguishes sectors by this naming convention.
+     */
+    name: string;
+    /** Human-readable label for user-facing surfaces; falls back to `name`. */
+    displayName?: string;
+    /** Human/LLM-readable summary; shown to the agent at tool registration. */
+    description: string;
+    /** Zod schema validating the invocation arguments. Converted to JSON Schema. */
+    input: T;
+    /** Optional Zod schema for the return value. */
+    output?: R;
+    /** Lifetime: `session` survives the whole session, `turn` is dropped at end-of-turn. */
+    scope?: "session" | "turn";
+    /**
+     * When true, the platform shows a confirm UI and waits for user approval
+     * before the invocation is forwarded to the app. Mark every mutation
+     * (backend writes, destructive UI actions) with this.
+     */
+    requiresApproval?: boolean;
+    /** Documentation hint: side-effect, render, or pure query. */
+    kind?: "effect" | "render" | "query";
+    /**
+     * Audience scoping. Omit for the default (`['llm','user']`). App capabilities
+     * default to LLM-only in the command palette (`isUserInvokable`); set
+     * `['llm','user']` on the user-facing actions you want to appear in cmdK.
+     */
+    audience?: CapabilityAudience[];
+    /** Appended to the system prompt's `<CAPABILITIES>` section. */
+    promptFragment?: string;
+    /** Per-capability override for the platform's result round-trip timeout. */
+    callTimeoutMs?: number;
+    /** Render contract for capabilities that produce a UI surface. */
+    render?: RenderSpec;
+    /** The handler — runs in the app. Receives validated input + {@link AppHandlerContext}. */
+    handler: (args: z.infer<T>, ctx: AppHandlerContext) => Promise<R extends z.ZodTypeAny ? z.infer<R> : unknown>;
+};
+/**
+ * A defined app capability: the wire-format fields the SDK registers (minus the
+ * SDK-stamped `origin`), plus the Zod schemas and type-erased handler used for
+ * runtime input validation and inbound dispatch.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export type DefinedAppCapability = {
+    name: string;
+    displayName?: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    outputSchema?: Record<string, unknown>;
+    /** Always `'app'` — the handler runs in the embedded app. */
+    side: "app";
+    scope?: "session" | "turn";
+    requiresApproval?: boolean;
+    kind?: "effect" | "render" | "query";
+    audience?: CapabilityAudience[];
+    promptFragment?: string;
+    callTimeoutMs?: number;
+    render?: RenderSpec;
+    /** Original Zod schema for runtime input validation. Not serialized to the wire. */
+    readonly inputZod: z.ZodTypeAny;
+    /** Original Zod schema for the optional output, if declared. Not serialized. */
+    readonly outputZod?: z.ZodTypeAny;
+    /** Type-erased handler dispatched on an inbound `capability_invoked`. */
+    handler: (args: unknown, ctx: AppHandlerContext) => Promise<unknown>;
+};
+/** Origin kind an app capability always carries once stamped by the SDK. */
+export type AppCapabilityOrigin = Extract<CapabilityOrigin, {
+    kind: "app";
+}>;
+/**
+ * Build a {@link DefinedAppCapability} from author-friendly Zod-typed args.
+ * `side` is fixed to `'app'`; `origin` is added by the SDK at registration
+ * time (it needs the SDK's `appId`).
+ *
+ * @example
+ * ```ts
+ * const switchContract = defineAppCapability({
+ *   name: 'app.ui.switch_contract',
+ *   description: 'Switch the visible contract in the app UI.',
+ *   input: z.object({ contractId: z.string() }),
+ *   handler: async ({ contractId }, ctx) => {
+ *     ctx.log.info('switching contract', { contractId });
+ *     ui.select(contractId);
+ *   },
+ * });
+ * ```
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export declare function defineAppCapability<T extends z.ZodTypeAny, R extends z.ZodTypeAny | undefined = undefined>(args: DefineAppCapabilityArgs<T, R>): DefinedAppCapability;
+//# sourceMappingURL=define-app-capability.d.ts.map

package/dist/app-sdk/src/define-app-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-app-capability.d.ts","sourceRoot":"","sources":["../../../app-sdk/src/define-app-capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACjG,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,GAAG,EAAE,SAAS,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,uBAAuB,CACjC,CAAC,SAAS,CAAC,CAAC,UAAU,EACtB,CAAC,SAAS,CAAC,CAAC,UAAU,GAAG,SAAS,GAAG,SAAS,IAC5C;IACF;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,KAAK,EAAE,CAAC,CAAC;IACT,gDAAgD;IAChD,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,wFAAwF;IACxF,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAChC,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,2FAA2F;IAC3F,OAAO,EAAE,CACP,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAChB,GAAG,EAAE,iBAAiB,KACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACrC,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC;IAClC,yEAAyE;IACzE,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACtE,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,SAAS,CAAC,CAAC,UAAU,EACtB,CAAC,SAAS,CAAC,CAAC,UAAU,GAAG,SAAS,GAAG,SAAS,EAC9C,IAAI,EAAE,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,oBAAoB,CA8B3D"}

package/dist/app-sdk/src/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `@skaile/workspaces/app-sdk` — the thin SDK an embedded app uses to become
+ * agent-controllable inside a Skaile session.
+ *
+ * See {@link createSkaileApp} for the entry point and the package README /
+ * the app-capability-source spec for the design.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export { AppHandshakeRefusedError, type AppSession, createSkaileApp, DEFAULT_HELLO_TIMEOUT_MS, type ReconnectOptions, type SkaileApp, type SkaileAppOptions, } from "./app.js";
+export { type AppConnectionParams, type AppWindowLike, DEFAULT_PARAMS_TIMEOUT_MS, type MessageEventLike, PARENT_ORIGIN_QUERY_PARAM, type PostMessageTarget, resolveAppConnectionParams, type ResolveAppConnectionParamsOptions, type SkaileAppParamsMessage, type SkaileAppReadyMessage, } from "./connection-params.js";
+export { type AppCapabilityOrigin, type AppHandlerContext, defineAppCapability, type DefineAppCapabilityArgs, type DefinedAppCapability, } from "./define-app-capability.js";
+export { type AppLogger, consoleLogger, noopLogger } from "./logger.js";
+export type { AppClientMessage, AppHelloAckMessage, AppHelloMessage, AppHelloNackMessage, AppServerMessage, AppTransport, } from "./transport.js";
+export { createWebSocketAppTransport, type SessionTokenProvider, type WebSocketAppTransportOptions, type WebSocketFactory, } from "./ws-transport.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/app-sdk/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../app-sdk/src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,wBAAwB,EACxB,KAAK,UAAU,EACf,eAAe,EACf,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,0BAA0B,EAC1B,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxE,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/app-sdk/src/logger.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Minimal logger for the app SDK.
+ *
+ * The SDK is meant to run inside an embedded app (browser or a lightweight
+ * Node service), so it deliberately does not pull in the framework's
+ * `LogStore` / SQLite logging stack. Authors can pass their own {@link AppLogger}
+ * (e.g. a bridge to their app's telemetry) or accept the console-backed default.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+/** Structured leveled logger the SDK and capability handlers emit through. */
+export interface AppLogger {
+    debug(message: string, data?: unknown): void;
+    info(message: string, data?: unknown): void;
+    warn(message: string, data?: unknown): void;
+    error(message: string, data?: unknown): void;
+}
+/** A logger that discards everything. The default when none is supplied. */
+export declare const noopLogger: AppLogger;
+/**
+ * Console-backed logger, prefixing every line with `[skaile-app]`. Opt in by
+ * passing `logger: consoleLogger` to {@link createSkaileApp} during development.
+ */
+export declare const consoleLogger: AppLogger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/app-sdk/src/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../app-sdk/src/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C;AAED,4EAA4E;AAC5E,eAAO,MAAM,UAAU,EAAE,SAKxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAa3B,CAAC"}

package/dist/app-sdk/src/transport.d.ts

@@ -0,0 +1,93 @@
+/**
+ * App-channel transport contract.
+ *
+ * An embedded, agent-controllable app talks to the Skaile platform gateway over
+ * a dedicated back-connection — a *different* surface from the agent protocol
+ * (`ClientTransport` / `ServerTransport` in `@skaile/workspaces/types`, which are
+ * typed to `AgentCommand` / `AgentEvent`). This channel carries only the app
+ * handshake plus the capability messages, so it gets its own small, decoupled
+ * transport interface. The SDK depends on {@link AppTransport}, never on a
+ * concrete socket, so tests inject a fake and the SDK stays browser-safe.
+ *
+ * The capability message *shapes* are reused verbatim from
+ * `@skaile/workspaces/types` — no new capability wire types are introduced.
+ * Only the connection handshake (`app_hello` / `app_hello_ack` /
+ * `app_hello_nack`) is new, and it is specific to this app↔gateway channel.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+import type { CapabilityDeregisterCommand, CapabilityInvokedEvent, CapabilityRegisterCommand, CapabilityResultCommand } from "@skaile/workspaces/types";
+/**
+ * First message an app sends after the socket opens. Declares which app this
+ * connection is; the *who* (session identity) is carried out-of-band by the
+ * connection's bearer credential (see {@link WebSocketAppTransportOptions}).
+ * The gateway binds the authenticated session to `appId` and replies with an
+ * {@link AppHelloAckMessage} (or refuses via {@link AppHelloNackMessage}).
+ */
+export type AppHelloMessage = {
+    type: "app_hello";
+    /** The embedded app's stable id — bound to the authenticated session. */
+    appId: string;
+    /** Protocol version string the SDK speaks (see `PROTOCOL_VERSION_STRING`). */
+    protocolVersion: string;
+};
+/** Gateway acknowledgement that the app connection is bound and trusted. */
+export type AppHelloAckMessage = {
+    type: "app_hello_ack";
+    /** The session this app connection is bound to. */
+    sessionId: string;
+    /** The session's owning user, when the gateway chooses to surface it. */
+    userId?: string;
+};
+/** Gateway refusal — identity could not be verified or `appId` is not permitted. */
+export type AppHelloNackMessage = {
+    type: "app_hello_nack";
+    /** Human-readable reason (also surfaced to the app author). */
+    error: string;
+    /**
+     * Whether another attempt could succeed. `true` means the refusal is transient
+     * — the session's agent container is not up yet, and the app raced it on boot.
+     * Absent or `false` means permanent (bad token, `appId` not permitted): retrying
+     * only burns tokens.
+     *
+     * @since 3.5.0
+     */
+    retryable?: boolean;
+};
+/**
+ * Messages an app sends to the gateway. The three capability commands are the
+ * unchanged wire types from `@skaile/workspaces/types`; `app_hello` is the
+ * only channel-specific addition.
+ */
+export type AppClientMessage = AppHelloMessage | CapabilityRegisterCommand | CapabilityDeregisterCommand | CapabilityResultCommand;
+/**
+ * Messages the gateway sends to an app: the handshake outcome, then inbound
+ * `capability_invoked` events routed from the agent for this app's `side:'app'`
+ * capabilities.
+ */
+export type AppServerMessage = AppHelloAckMessage | AppHelloNackMessage | CapabilityInvokedEvent;
+/**
+ * The app back-connection transport. Mirrors the shape of the agent
+ * `ClientTransport` but is typed to the app channel's message unions. A
+ * concrete WebSocket implementation ships as {@link createWebSocketAppTransport};
+ * tests supply a fake.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export interface AppTransport {
+    /** Open the underlying connection. Resolves once the socket is ready. */
+    connect(): Promise<void>;
+    /** Close the connection and release resources. Idempotent. */
+    disconnect(): Promise<void>;
+    /** Send a message to the gateway. */
+    send(message: AppClientMessage): void;
+    /** Subscribe to messages from the gateway. Returns an unsubscribe function. */
+    onMessage(handler: (message: AppServerMessage) => void): () => void;
+    /** Subscribe to disconnects. Returns an unsubscribe function. */
+    onDisconnect(handler: () => void): () => void;
+    /** Whether the transport is currently connected. */
+    readonly connected: boolean;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/app-sdk/src/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../../app-sdk/src/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,eAAe,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,yBAAyB,GACzB,2BAA2B,GAC3B,uBAAuB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,sBAAsB,CAAC;AAEjG;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,qCAAqC;IACrC,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACtC,+EAA+E;IAC/E,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACpE,iEAAiE;IACjE,YAAY,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B"}

package/dist/app-sdk/src/ws-transport.d.ts

@@ -0,0 +1,79 @@
+/**
+ * WebSocket-backed {@link AppTransport}.
+ *
+ * Browser-safe: uses the standard `WebSocket` global (no `ws` dependency, no
+ * `node:*` imports), so it runs unchanged in an embedded app's iframe and in a
+ * lightweight Node 22+ service. The injected session identity is presented as a
+ * bearer **subprotocol** — the same `skaile-bearer.<base64url>` scheme the
+ * platform gateway already decodes for runner connections — so the gateway
+ * verifies identity at the WS upgrade, before any `app_hello` is processed.
+ *
+ * Frames are bare JSON of the app-channel messages (no `MessageV2` envelope),
+ * matching the runner peer's on-the-wire convention.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+import type { AppTransport } from "./transport.js";
+/** Minimal structural view of the parts of the `WebSocket` API the transport uses. */
+type WebSocketLike = {
+    readonly readyState: number;
+    send(data: string): void;
+    close(code?: number, reason?: string): void;
+    addEventListener(type: "open", handler: () => void): void;
+    addEventListener(type: "close", handler: () => void): void;
+    addEventListener(type: "error", handler: () => void): void;
+    addEventListener(type: "message", handler: (ev: {
+        data: unknown;
+    }) => void): void;
+};
+/** Constructor shape for a `WebSocket` implementation (global or injected). */
+export type WebSocketFactory = new (url: string, protocols?: string | string[]) => WebSocketLike;
+/**
+ * Supplies a session identity token for one connection attempt.
+ *
+ * The gateway's token is **single-use** — it is consumed at `app_hello` — so a
+ * reconnecting transport cannot replay the one it opened with. Pass a provider
+ * (typically a call to `resolveAppConnectionParams`) and every `connect()` mints
+ * a fresh token.
+ *
+ * @category App SDK
+ * @since 3.5.0
+ */
+export type SessionTokenProvider = () => string | Promise<string>;
+/**
+ * Options for {@link createWebSocketAppTransport}.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export interface WebSocketAppTransportOptions {
+    /** The gateway app-channel URL (e.g. `wss://platform/app-connect`). */
+    url: string;
+    /**
+     * The injected session identity token, or a {@link SessionTokenProvider} that
+     * yields a fresh one per connection attempt. Presented as the WS bearer
+     * subprotocol; the gateway verifies it and resolves the session/user.
+     *
+     * A bare string cannot survive a reconnect (the gateway consumes the token at
+     * `app_hello`) — pass a provider whenever `reconnect` is enabled on the peer.
+     */
+    sessionToken: string | SessionTokenProvider;
+    /**
+     * WebSocket implementation. Defaults to the `WebSocket` global (browser /
+     * Node 22+). Injectable for tests or non-standard runtimes.
+     */
+    WebSocketImpl?: WebSocketFactory;
+    /** Connect timeout in ms. Default 10000. */
+    connectTimeoutMs?: number;
+}
+/**
+ * Create a WebSocket-backed {@link AppTransport}. The session token is sent as a
+ * bearer subprotocol at connect time; app-channel messages are JSON-framed.
+ *
+ * @category App SDK
+ * @since 3.4.0
+ */
+export declare function createWebSocketAppTransport(options: WebSocketAppTransportOptions): AppTransport;
+export {};
+//# sourceMappingURL=ws-transport.d.ts.map

package/dist/app-sdk/src/ws-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-transport.d.ts","sourceRoot":"","sources":["../../../app-sdk/src/ws-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAsC,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAcvF,sFAAsF;AACtF,KAAK,aAAa,GAAG;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC3D,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC3D,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAAG,IAAI,CAAC;CACnF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,aAAa,CAAC;AAEjG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,GAAG,oBAAoB,CAAC;IAC5C;;;OAGG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;IACjC,4CAA4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAID;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,4BAA4B,GAAG,YAAY,CA0F/F"}