npm - @skaile/workspaces - Versions diffs - 1.6.0 → 1.7.0 - Mend

@skaile/workspaces 1.6.0 → 1.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (156) hide show

package/dist/chunk-J5TI55E7.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../cli/src/store-auth.ts","../cli/src/store-client.ts"],"names":["readFileSync"],"mappings":";;;;;AAqBA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,MAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,gBAAA,IAAoB,IAAA,CAAK,MAAM,WAAW;AAAA,GAClE;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CAAY,MAAA,EAAyB,IAAA,GAAiB,EAAC,EAAwB;AACnG,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAE7B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB,EAAE,WAAW,MAAA,CAAO,QAAA,EAAU,KAAA,EAAO,gBAAA,EAAkB;AAAA,GAClF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO;AAAA,OACnB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,MAAM,CAAA,sBAAA,EAAyB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;AC5MO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAMA,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAC3E,MAAA,MAAM,IAAI,KAAA,CAAO,IAAA,CAAa,SAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IACzE;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-J5TI55E7.js","sourcesContent":["/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n keycloakUrl: string;\n realm: string;\n clientId: string;\n authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n const home = process.env.SKAILE_HOME ?? join(homedir(), \".skaile\");\n return {\n keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n authFile: process.env.SKAILE_AUTH_FILE ?? join(home, \"auth.json\"),\n };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n access_token: string;\n refresh_token?: string;\n /** Epoch ms when the access token expires (with a safety margin already applied). */\n expires_at: number;\n}\n\ninterface TokenResponse {\n access_token: string;\n refresh_token?: string;\n expires_in?: number;\n error?: string;\n error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n device_code: string;\n user_code: string;\n verification_uri: string;\n verification_uri_complete?: string;\n interval?: number;\n expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n fetchImpl?: typeof fetch;\n sleep?: (ms: number) => Promise<void>;\n /** Called once with the verification URL + user code (default: write to stderr). */\n onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n try {\n const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n // Reject a corrupt / hand-edited file rather than treat it as a session.\n if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n return null;\n } catch {\n return null;\n }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n mkdirSync(dirname(config.authFile), { recursive: true });\n writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n try {\n rmSync(config.authFile);\n } catch {\n // already absent — nothing to do\n }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n return {\n access_token: token.access_token,\n refresh_token: token.refresh_token,\n expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n process.stderr.write(\n `\\nTo sign in, open:\\n\\n ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(config: StoreAuthConfig, deps: AuthDeps = {}): Promise<StoredAuth> {\n const fetchImpl = deps.fetchImpl ?? fetch;\n const sleep = deps.sleep ?? defaultSleep;\n const onPrompt = deps.onPrompt ?? defaultPrompt;\n const endpoints = oidc(config);\n\n const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({ client_id: config.clientId, scope: \"openid profile\" }),\n });\n if (!deviceRes.ok) {\n throw new Error(\n `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n );\n }\n const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n const intervalMs = (device.interval ?? 5) * 1000;\n const deadline = Date.now() + device.expires_in * 1000;\n let waitMs = intervalMs;\n\n while (Date.now() < deadline) {\n await sleep(waitMs);\n const tokenRes = await fetchImpl(endpoints.token, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n device_code: device.device_code,\n client_id: config.clientId,\n }),\n });\n const token = (await tokenRes.json()) as TokenResponse;\n if (tokenRes.ok) {\n const stored = tokenToStored(token);\n writeAuth(config, stored);\n return stored;\n }\n // RFC 8628 §3.5 pending / slow-down handling.\n if (token.error === \"authorization_pending\") continue;\n if (token.error === \"slow_down\") {\n waitMs += 5_000;\n continue;\n }\n throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n }\n throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n config: StoreAuthConfig,\n refreshToken: string,\n fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n const res = await fetchImpl(oidc(config).token, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n client_id: config.clientId,\n }),\n });\n const token = (await res.json()) as TokenResponse;\n if (!res.ok) {\n throw new Error(`Token refresh failed: ${token.error_description ?? token.error ?? res.status}`);\n }\n const stored = tokenToStored(token);\n writeAuth(config, stored);\n return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n config: StoreAuthConfig,\n deps: AuthDeps = {},\n): Promise<string> {\n const fetchImpl = deps.fetchImpl ?? fetch;\n const auth = readAuth(config);\n if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n if (Date.now() < auth.expires_at) return auth.access_token;\n if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n try {\n return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n } catch {\n throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n url: string;\n jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n const settingsPath = globalSettingsPath();\n let settings: Record<string, any> = {};\n if (existsSync(settingsPath)) {\n try {\n settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n } catch {\n settings = {};\n }\n }\n return {\n url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n jwt: null,\n };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n * `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n * they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n config: StoreConfig,\n path: string,\n opts?: {\n method?: string;\n body?: unknown;\n params?: Record<string, string>;\n headers?: Record<string, string>;\n timeoutMs?: number;\n },\n): Promise<T> {\n let url = `${config.url}${path}`;\n if (opts?.params) {\n const sp = new URLSearchParams(opts.params);\n url += `?${sp}`;\n }\n\n const headers: Record<string, string> = {\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n ...(opts?.headers ?? {}),\n };\n if (config.jwt) {\n headers.Authorization = `Bearer ${config.jwt}`;\n }\n\n const fetchOpts: RequestInit = {\n method: opts?.method ?? \"GET\",\n headers,\n };\n if (opts?.body) {\n fetchOpts.body = JSON.stringify(opts.body);\n }\n\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n try {\n const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n if (!res.ok) {\n const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n throw new Error((body as any).error ?? `Store API error: ${res.status}`);\n }\n return res.json() as Promise<T>;\n } finally {\n clearTimeout(timeout);\n }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}

package/dist/chunk-JIDKX7GC.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../cli/src/store-publisher.ts","../cli/src/commands/publish-core.ts"],"names":[],"mappings":";;;;AAyEO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI;AAAA,GAC7F;AACF;;;AC1EO,SAAS,yBAAA,CACd,YACA,QAAA,EACK;AACL,EAAA,MAAM,SAAS,IAAI,GAAA,CAAA,CAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,IAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AAChF,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AACnE;AAGO,SAAS,MAAA,CAAO,IAAA,EAAc,SAAA,EAAmB,IAAA,EAAc,OAAA,EAA0B;AAC9F,EAAA,MAAM,OAAO,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,SAAS,IAAI,IAAI,CAAA,CAAA;AAC1C,EAAA,OAAO,OAAA,GAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,IAAA;AAC1C;AAGO,SAAS,SAAS,GAAA,EAAqB;AAC5C,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAAI,GAAA;AACxE,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GAAI,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAAI,SAAA;AAC3F,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA;AAChC;AAOA,eAAsB,QACpB,MAAA,EACA,KAAA,EACA,UAAA,GAAa,IAAA,EACb,YAAY,GAAA,EACmF;AAC/F,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAC9B,EAAA,IAAI,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,OAAO,IAAI,MAAA,KAAW,SAAA,IAAa,IAAA,CAAK,GAAA,KAAQ,QAAA,EAAU;AACxD,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,UAAU,CAAC,CAAA;AAClD,IAAA,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,iBAAiB,GAAA,EAAuB;AACtD,EAAA,MAAM,GAAA,GAAA,CAAO,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,GAAG,WAAA,EAAY;AAC3E,EAAA,OAAO,qEAAA,CAAsE,KAAK,GAAG,CAAA;AACvF;AAcA,eAAsB,eAAe,IAAA,EAOA;AACnC,EAAA,MAAM,EAAE,WAAW,GAAA,EAAK,OAAA,EAAS,UAAU,SAAA,EAAW,MAAA,EAAQ,KAAI,GAAI,IAAA;AAEtE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW;AAAA,MACjC,GAAA,EAAK,SAAA;AAAA,MACL,GAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,UAAA,EAAY,OAAA,CAAQ,KAAK,UAAA,EAAY,OAAA,CAAQ,GAAA,EAAI,GAAI;AAAC,KACvE,CAAA;AACD,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI,CAAC,gBAAA,CAAiB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,SAAS,CAAA;AAClD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,OAAA,EAAU,SAAS,CAAA,qDAAA,EACd,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OACvD;AAAA,IACF;AACA,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,GAAA,CAAI,WAAW,QAAQ,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AACpC,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,WAAA,EAAa;AACzD,IAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,KAAA,IAAS,EAAC,EAAG,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,QAAQ,CAAA;AACpE,IAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,MAAA,CAAO,CAAA,MAAA,EAAS,CAAA,CAAE,KAAK,CAAA,EAAA,EAAK,CAAA,CAAE,KAAA,IAAS,QAAQ,CAAA,CAAE,CAAA;AACzE,IAAA,MAAA,CAAO,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACnC,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,IAAA,MAAA,CAAO,sFAAiF,CAAA;AACxF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,aAAa,yBAAA,CAA0B,MAAM,IAAI,gBAAA,CAAiB,QAAQ,GAAG,QAAQ,CAAA;AACzF,EAAA,IAAI,SAAA,eAAwB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,SAAS,CAAA;AACzE,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,wEAAmE,CAAA;AAC3E,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,YAAA,CAAa,EAAE,EAAE,CAAA;AAC3C,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,YAAA,CAAa,CAAA,CAAE,EAAA,EAAI,EAAE,GAAA,EAAK,KAAA,EAAO,OAAA,CAAQ,eAAA,EAAiB,CAAA;AAGhF,MAAA,IAAI,IAAI,KAAA,EAAO;AACb,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,EAAK,IAAI,KAAK,CAAA;AAC3C,QAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,UAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAC,EAC5B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA,CACnC,IAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA,CAClB,OAAO,OAAO,CAAA;AACjB,UAAA,OAAA;AAAA,YACE,cAAc,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,kBAAA,EAAqB,MAAA,CAAO,MAAM,CAAA,CAAA,CAAA,IAC7D,KAAK,MAAA,GAAS,CAAA,EAAA,EAAK,KAAK,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AAAA,WAC5C;AACA,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,SAAA,CAAU,IAAA,CAAK,MAAA,CAAO,CAAA,CAAE,IAAA,EAAM,OAAA,CAAQ,SAAA,CAAU,kBAAA,EAAoB,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAC,CAAA;AAAA,IACxF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA;AAAA,QACE,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OAC5F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,CAAA,UAAA,EAAa,SAAA,CAAU,MAAM,CAAA,UAAA,CAAY,CAAA;AAC/C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAA,EAAW,OAAA,CAAQ,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAC3C,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB","file":"chunk-JIDKX7GC.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n /** Identity of the caller; `username` is the publisher namespace. */\n me(): Promise<{ username: string }>;\n /** Register (or re-register) a source; returns the created/existing row id. */\n sourcesAdd(body: {\n url: string;\n ref: string;\n sidecarUrl?: string;\n sidecarRef?: string;\n }): Promise<{ id: string }>;\n /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n sourcesList(): Promise<Array<{ id: string; url: string }>>;\n /** Kick off a source sync; returns the async job id to poll. */\n sourceSync(id: string): Promise<{ jobId: string }>;\n /** Poll a job's terminal status + per-item results. */\n jobGet(\n jobId: string,\n ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n /** Discovered publishable candidates for a synced source. */\n sourceCandidates(id: string): Promise<\n Array<{\n id: string;\n name: string;\n version: string;\n kind: string;\n published: boolean;\n assetRoot: string;\n }>\n >;\n /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n assetPreview(id: string): Promise<{\n discoveredFiles: string[];\n candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n }>;\n /**\n * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n * launching a job; the normal path returns `{ jobId }`.\n */\n assetPublish(\n id: string,\n body: { ref: string; files: string[] },\n dryRun?: boolean,\n ): Promise<{ jobId?: string; manifest?: unknown }>;\n /** Retract a published asset. Response body is ignored. */\n assetUnpublish(id: string): Promise<unknown>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n config: StoreConfig = getStoreConfig(),\n timeoutMs = 20_000,\n): PublisherClient {\n // Acquire a fresh Keycloak token per call (device-flow session in\n // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n const call = async <T>(\n path: string,\n opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n ): Promise<T> => {\n const jwt = await getStoreToken();\n return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n };\n return {\n me: () => call(\"/api/v1/me\"),\n sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n sourcesList: () => call(\"/api/v1/sources\"),\n sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n assetPublish: (id, body, dryRun) =>\n call(`/api/v1/assets/${id}/publish`, {\n method: \"POST\",\n body,\n ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n }),\n assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n };\n}\n","/**\n * Shared store-interaction core for the two publish front-ends — the curator\n * sidecar flow (`source manifest publish`) and the first-party library flow\n * (`library publish`). Both differ only in their git side-effects + how they\n * resolve the source repo; the store orchestration below (register → sync →\n * candidates → per-asset preview+publish) is identical.\n *\n * The store REST surface is reached through the injectable {@link PublisherClient}\n * so the orchestration stays unit/integration-testable without a live store.\n *\n * @docLink cli/commands/source#manifest-publish\n */\n\nimport type { SkPublishManifest } from \"@skaile/workspaces/core\";\nimport { logErr, logInfo, logOk, logWarn } from \"../helpers.ts\";\nimport type { PublisherClient } from \"../store-publisher.ts\";\n\n/** One candidate row shape the matcher operates on (kind + name are the key). */\ninterface CandidateLike {\n kind: string;\n name: string;\n}\n\n/**\n * Keep only candidates whose `(kind, name)` pair is declared in the manifest.\n * The backend may merge extra assets from the base repo into the candidate\n * list; a publish only touches what the manifest curated/declared.\n */\nexport function matchCandidatesToManifest<T extends CandidateLike>(\n candidates: T[],\n manifest: SkPublishManifest,\n): T[] {\n const wanted = new Set((manifest.assets ?? []).map((a) => `${a.kind}:${a.name}`));\n return candidates.filter((c) => wanted.has(`${c.kind}:${c.name}`));\n}\n\n/** A canonical ref string `kind:@publisher/name[#version]` for reporting. */\nexport function refFor(kind: string, publisher: string, name: string, version?: string): string {\n const base = `${kind}:@${publisher}/${name}`;\n return version ? `${base}#${version}` : base;\n}\n\n/** The bare asset name from a `kind:@publisher/name#version` ref or a plain name. */\nexport function bareName(ref: string): string {\n const afterKind = ref.includes(\":\") ? ref.slice(ref.indexOf(\":\") + 1) : ref;\n const afterScope = afterKind.includes(\"/\") ? afterKind.slice(afterKind.indexOf(\"/\") + 1) : afterKind;\n return afterScope.split(\"#\")[0];\n}\n\n/**\n * Poll a job until it leaves `running` or the deadline passes. Returns the last\n * observed state — the caller MUST treat a still-`running` result as a timeout\n * (not success), since it means the deadline was hit before the job finished.\n */\nexport async function pollJob(\n client: PublisherClient,\n jobId: string,\n intervalMs = 1_500,\n timeoutMs = 60_000,\n): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }> {\n const deadline = Date.now() + timeoutMs;\n let job = await client.jobGet(jobId);\n while (job.status === \"running\" && Date.now() < deadline) {\n await new Promise((r) => setTimeout(r, intervalMs));\n job = await client.jobGet(jobId);\n }\n return job;\n}\n\n/**\n * True when a `sourcesAdd` rejection is a duplicate-URL conflict (the source is\n * already registered) — the only error the publish flow recovers from by looking\n * the existing row up. Every other failure (auth, 5xx, network) must propagate.\n */\nexport function isDupSourceError(err: unknown): boolean {\n const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();\n return /\\b409\\b|conflict|duplicate|already exists|already registered|unique/.test(msg);\n}\n\n/**\n * Register + sync the source, then publish its curated/declared candidates —\n * the store-side steps shared by both publish front-ends. Git side-effects (the\n * sidecar push, or the library commit+push) happen in the caller *before* this;\n * this function is purely store interaction.\n *\n * The sidecar front-end passes `sidecar` (so `sourcesAdd` carries the sidecar\n * pin); the library front-end omits it (the source repo IS the manifest host).\n * `assetName`, when set, narrows publication to the single candidate of that\n * name. Fatal store states (`sourcesAdd` non-dup failure) surface; sync failures\n * and empty candidate sets `process.exit(1)` with the same messages as before.\n */\nexport async function publishToStore(opts: {\n sourceUrl: string;\n ref: string;\n sidecar?: { url: string; ref: string };\n manifest: SkPublishManifest;\n assetName?: string;\n client: PublisherClient;\n}): Promise<{ published: string[] }> {\n const { sourceUrl, ref, sidecar, manifest, assetName, client: pub } = opts;\n\n let sourceId: string;\n try {\n const added = await pub.sourcesAdd({\n url: sourceUrl,\n ref,\n ...(sidecar ? { sidecarUrl: sidecar.url, sidecarRef: sidecar.ref } : {}),\n });\n sourceId = added.id;\n } catch (err) {\n // Only a duplicate-url conflict is recoverable (source already registered);\n // auth/5xx/network failures must surface, not silently reuse a stale row.\n if (!isDupSourceError(err)) throw err;\n const rows = await pub.sourcesList();\n const found = rows.find((r) => r.url === sourceUrl);\n if (!found) {\n throw new Error(\n `Source ${sourceUrl} looked already-registered but no owned row matched: ` +\n `${err instanceof Error ? err.message : String(err)}`,\n );\n }\n sourceId = found.id;\n }\n\n const { jobId } = await pub.sourceSync(sourceId);\n const job = await pollJob(pub, jobId);\n if (job.status === \"failed\" || job.status === \"cancelled\") {\n const failed = (job.items ?? []).filter((i) => i.status === \"failed\");\n for (const i of failed) logErr(`sync: ${i.label}: ${i.error ?? \"failed\"}`);\n logErr(`Source sync ${job.status}.`);\n process.exit(1);\n }\n // A still-`running` job means the poll deadline was hit — do NOT proceed on an\n // unfinished sync (it would read incomplete candidates).\n if (job.status === \"running\") {\n logErr(\"Source sync timed out before completing — re-run `publish`, or check the store.\");\n process.exit(1);\n }\n\n let candidates = matchCandidatesToManifest(await pub.sourceCandidates(sourceId), manifest);\n if (assetName) candidates = candidates.filter((c) => c.name === assetName);\n if (candidates.length === 0) {\n logWarn(\"No candidates discovered — check the manifest and the source ref.\");\n process.exit(1);\n }\n\n const published: string[] = [];\n for (const c of candidates) {\n try {\n const preview = await pub.assetPreview(c.id);\n const res = await pub.assetPublish(c.id, { ref, files: preview.discoveredFiles });\n // Publish is async — wait for the job so we only report refs that actually\n // landed, not ones whose import is still in flight or about to fail.\n if (res.jobId) {\n const pubJob = await pollJob(pub, res.jobId);\n if (pubJob.status !== \"succeeded\") {\n const errs = (pubJob.items ?? [])\n .filter((i) => i.status === \"failed\")\n .map((i) => i.error)\n .filter(Boolean);\n logWarn(\n `Publish of ${c.kind}:${c.name} did not succeed (${pubJob.status})` +\n (errs.length ? `: ${errs.join(\"; \")}` : \"\"),\n );\n continue;\n }\n }\n published.push(refFor(c.kind, preview.candidate.publisherNamespace, c.name, c.version));\n } catch (err) {\n logWarn(\n `Failed to publish ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`,\n );\n }\n }\n\n logOk(`Published ${published.length} asset(s):`);\n for (const r of published) logInfo(` ${r}`);\n return { published };\n}\n"]}

package/dist/chunk-KEQ4GLVM.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../connectors/src/materialized-connectors.ts","../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;;;AAiBO,SAAS,2BAAA,CAA4B,UAAkB,IAAA,EAAoC;AAChG,EAAA,MAAM,EAAE,MAAM,IAAA,EAAM,IAAA,KAAS,gBAAA,CAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAC5E,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,IAAI,CAAA;AACnC,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,EAAA;AAAA,IACA,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,MAAA,KAAW,YAAA,GAAe,YAAA,GAAe;AAAA,GACxD;AACA,EAAA,IAAI,OAAO,KAAK,KAAA,KAAU,QAAA,IAAY,KAAK,KAAA,EAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AACpE,EAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpD,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,QAAA,IAAY,KAAK,cAAA,EAAgB;AAClE,IAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,cAAA;AAAA,EAC7B;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,OAAA,IAAW,IAAA,CAAK,SAAS,MAAA,EAAQ,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpE,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACpF,IAAA,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AAAA,EACtB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,IAAA,CAAK,KAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA;AAAA,MAC7B,GAAI,CAAA,CAAE,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA,EAAE,GAAI,EAAC;AAAA,MAC7D,GAAI,OAAO,CAAA,CAAE,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,MACzD,GAAI,OAAO,CAAA,CAAE,iBAAA,KAAsB,SAAA,GAC/B,EAAE,iBAAA,EAAmB,CAAA,CAAE,iBAAA,EAAkB,GACzC,EAAC;AAAA,MACL,GAAI,OAAO,CAAA,CAAE,cAAA,KAAmB,QAAA,GAAW,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI;AAAC,KACrF;AAAA,EACF;AACA,EAAA,MAAM,WAAA,GAAc,KAAK,IAAA,EAAK;AAC9B,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,YAAA,GAAe,WAAA;AAChD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,kBAAA,CAAmB,MAA4B,YAAA,EAA4B;AAClF,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,YAAA,EAAc,MAAM,CAAC,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACpE,EAAA,IAAA,CAAK,OAAA,GAAU,EAAE,GAAI,MAAA,EAAoC,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACnF;AAGO,SAAS,4CAAA,CACd,oBACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,kBAAA,EAAoB,IAAI,CAAA;AACzC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACnC,EAAA,IAAI,CAAC,UAAA,CAAW,EAAE,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,2BAAA,CAA4B,EAAA,EAAI,IAAI,CAAA;AACjD,EAAA,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,gBAAgB,CAAC,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,sCAAsC,UAAA,EAA4C;AAChG,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,0BAA0B,CAAA;AACxD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAC/B,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAC3B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,CAAE,aAAY,EAAG;AAClC,MAAA,MAAM,IAAA,GAAO,4CAAA,CAA6C,IAAA,EAAM,IAAI,CAAA;AACpE,MAAA,IAAI,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;;;ACpFA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAIT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,GAAA,IAAO,EAAE,CAAA,EAAG;AAC9D,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,EAAO,EAAE,IAAI,IAAI,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,GAAA,CAAI,IAAA,EAAqC,EAAA,EAAY,IAAA,EAAiC;AACpF,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAAqC,EAAA,EAAqB;AAC9D,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAAqC,EAAA,EAA6C;AACxF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,CAAA;AACrF,MAAA,OAAO,MAAA;AACT,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB;AAAA,EACrB,MAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;ACpbA,IAAM,YAAY,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,UAAU,CAAA;AAahE,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GACJ,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,UAAA,CAAW,MAAA,GAAS,CAAA,GAC5C,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA,GACrD,EAAC;AAKP,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,KAAA,MAAW,KAAK,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAC3C,EAAA,KAAA,MAAW,CAAA,IAAK,qCAAA,CAAsC,UAAU,CAAA,EAAG;AACjE,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AAClB,MAAA,SAAA,CAAU,IAAA;AAAA,QACR,CAAA,wBAAA,EAA2B,EAAE,EAAE,CAAA,+CAAA;AAAA,OACjC;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAA,EAAI,CAAC,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAG9C,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD","file":"chunk-KEQ4GLVM.js","sourcesContent":["/**\n * Derive runtime connector declarations from the platform-materialized\n * `.skaile/assets/connector/<name>/CONNECTOR.md` projection.\n *\n * Connector mirror of MCP's `loadMaterializedMcpDeclarations` /\n * `deriveSingleMaterializedMcpDeclaration`. The generated `CONNECTOR.md` carries\n * a RUNTIME declaration (driver/access/auth/mode/options/mount) — distinct from\n * the catalog `CONNECTOR.md` parsed by `core/manifest.ts:fromConnectorMd`\n * (entry/fields). Driver is referenced by name (first-party; resolved via the\n * connector registry — no code-loading).\n */\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { parseFrontmatter } from \"@skaile/workspaces/core\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/** Parse a generated CONNECTOR.md (runtime projection) into a ConnectorDeclaration. */\nexport function fromMaterializedConnectorMd(filePath: string, name: string): ConnectorDeclaration {\n const { data: meta, body } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n const id = String(meta.name ?? name);\n const decl: ConnectorDeclaration = {\n id,\n driver: String(meta.driver ?? \"\"),\n access: meta.access === \"read-write\" ? \"read-write\" : \"read-only\",\n };\n if (typeof meta.label === \"string\" && meta.label) decl.label = meta.label;\n if (typeof meta.auth === \"string\") decl.auth = meta.auth;\n if (typeof meta.providerLinkId === \"string\" && meta.providerLinkId) {\n decl.providerLinkId = meta.providerLinkId;\n }\n if (meta.mode === \"agent\" || meta.mode === \"sync\") decl.mode = meta.mode;\n if (meta.options && typeof meta.options === \"object\" && !Array.isArray(meta.options)) {\n decl.options = meta.options as Record<string, unknown>;\n }\n if (meta.mount && typeof meta.mount === \"object\" && !Array.isArray(meta.mount)) {\n const m = meta.mount as Record<string, unknown>;\n decl.mount = {\n source: String(m.source ?? \"\"),\n ...(m.target !== undefined ? { target: String(m.target) } : {}),\n ...(typeof m.watch === \"boolean\" ? { watch: m.watch } : {}),\n ...(typeof m.exposeAccessToken === \"boolean\"\n ? { exposeAccessToken: m.exposeAccessToken }\n : {}),\n ...(typeof m.accessTokenTTL === \"number\" ? { accessTokenTTL: m.accessTokenTTL } : {}),\n };\n }\n const trimmedBody = body.trim();\n if (trimmedBody.length > 0) decl.instructions = trimmedBody;\n return decl;\n}\n\n/** Provide `.instance.json` config entries as defaults under the declaration's options (the CONNECTOR.md declaration wins on key collision). */\nfunction foldInstanceConfig(decl: ConnectorDeclaration, instancePath: string): void {\n if (!existsSync(instancePath)) return;\n let parsed: { config?: Record<string, unknown> };\n try {\n parsed = JSON.parse(readFileSync(instancePath, \"utf8\"));\n } catch {\n return;\n }\n const config = parsed.config;\n if (!config || typeof config !== \"object\" || Array.isArray(config)) return;\n decl.options = { ...(config as Record<string, unknown>), ...(decl.options ?? {}) };\n}\n\n/** Derive a single materialized connector declaration; null when no CONNECTOR.md. */\nexport function deriveSingleMaterializedConnectorDeclaration(\n connectorAssetsDir: string,\n name: string,\n): ConnectorDeclaration | null {\n const sub = join(connectorAssetsDir, name);\n const md = join(sub, \"CONNECTOR.md\");\n if (!existsSync(md)) return null;\n const decl = fromMaterializedConnectorMd(md, name);\n foldInstanceConfig(decl, join(sub, \".instance.json\"));\n return decl;\n}\n\n/** Scan `<projectDir>/.skaile/assets/connector/*` for materialized connectors. */\nexport function loadMaterializedConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n const root = join(projectDir, \".skaile/assets/connector\");\n if (!existsSync(root)) return [];\n const out: ConnectorDeclaration[] = [];\n for (const name of readdirSync(root)) {\n try {\n const sub = join(root, name);\n if (!statSync(sub).isDirectory()) continue;\n const decl = deriveSingleMaterializedConnectorDeclaration(root, name);\n if (decl) out.push(decl);\n } catch {\n // Per-directory failure is isolated — one bad asset never aborts the scan.\n }\n }\n return out;\n}\n","/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n /**\n * Resolve a credential reference.\n *\n * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n * \"oauth:google:user@example.com\", or an inline literal.\n * @returns The resolved secret value or undefined if not found.\n */\n resolve(ref: string): string | undefined;\n /**\n * Check whether a reference can be resolved.\n *\n * @param ref - Reference to check.\n * @returns True if resolve(ref) would return a non-undefined value.\n */\n has(ref: string): boolean;\n /**\n * Return all ref strings this provider can currently resolve.\n *\n * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n */\n capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n * `\"env:KEY\"` — looks up KEY in the store\n * `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n * (no prefix) — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n private readonly store = new Map<string, string>();\n\n /**\n * Store a batch of key-value secrets.\n *\n * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n */\n provision(secrets: Record<string, string>): void {\n for (const [key, value] of Object.entries(secrets)) {\n this.store.set(key, value);\n }\n }\n\n resolve(ref: string): string | undefined {\n if (!ref) return undefined;\n if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n // Bare key: check store first, then fall back to inline literal\n const stored = this.store.get(ref);\n if (stored !== undefined) return stored;\n return ref;\n }\n\n has(ref: string): boolean {\n return this.resolve(ref) !== undefined;\n }\n\n capabilities(): string[] {\n return [...this.store.keys()].map((k) => `env:${k}`);\n }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n resolve(ref: string): string | undefined {\n if (!ref) return undefined;\n if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n return undefined; // no inline passthrough\n }\n\n has(ref: string): boolean {\n return this.resolve(ref) !== undefined;\n }\n\n capabilities(): string[] {\n return Object.keys(process.env).map((k) => `env:${k}`);\n }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n | {\n ok: false;\n code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n message?: string;\n };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>`, `connector:<id>`, and `mcp:<id>`.\n * Returns `undefined` for any other ref so the chain falls through to the\n * next provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capabilities\n * stay strictly in-process — no round trip to the platform to mint while\n * the resource is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n private readonly mints = new Map<string, PreMintedCredential>();\n\n /**\n * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n *\n * Failed mints (`ok: false`) are stored too so callers can distinguish\n * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n * both as `undefined`.\n *\n * @param credentials Optional initial `{ mounts, connectors, mcp }` map.\n */\n constructor(credentials?: {\n mounts?: Record<string, PreMintedCredential>;\n connectors?: Record<string, PreMintedCredential>;\n mcp?: Record<string, PreMintedCredential>;\n }) {\n if (!credentials) return;\n for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n this.mints.set(`mount:${id}`, mint);\n }\n for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n this.mints.set(`connector:${id}`, mint);\n }\n for (const [id, mint] of Object.entries(credentials.mcp ?? {})) {\n this.mints.set(`mcp:${id}`, mint);\n }\n }\n\n /**\n * Insert (or replace) a pre-minted credential. Used by\n * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capability\n * handlers when the platform delivers new credentials mid-session.\n */\n set(kind: \"mount\" | \"connector\" | \"mcp\", id: string, mint: PreMintedCredential): void {\n this.mints.set(`${kind}:${id}`, mint);\n }\n\n /**\n * Remove a stored pre-minted credential. Used by the\n * `runner.remove_resource` capability handler.\n */\n unset(kind: \"mount\" | \"connector\" | \"mcp\", id: string): boolean {\n return this.mints.delete(`${kind}:${id}`);\n }\n\n /**\n * Look up the full {@link PreMintedCredential} for a `mount:` /\n * `connector:` / `mcp:` keyed entry. Callers that only need the token use\n * {@link resolve} via the chain; callers that need expiry / audit\n * metadata (e.g. ConnectorManager) use this entry point.\n */\n mintFor(kind: \"mount\" | \"connector\" | \"mcp\", id: string): PreMintedCredential | undefined {\n return this.mints.get(`${kind}:${id}`);\n }\n\n resolve(ref: string): string | undefined {\n if (!ref) return undefined;\n if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\") || ref.startsWith(\"mcp:\")))\n return undefined;\n const mint = this.mints.get(ref);\n return mint?.ok ? mint.token : undefined;\n }\n\n has(ref: string): boolean {\n return this.resolve(ref) !== undefined;\n }\n\n capabilities(): string[] {\n return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n private readonly store = new Map<string, string>();\n\n provision(secrets: Record<string, string>): void {\n for (const [key, value] of Object.entries(secrets)) {\n this.store.set(key, value);\n }\n }\n\n resolve(ref: string): string | undefined {\n if (!ref) return undefined;\n if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n return undefined;\n }\n\n has(ref: string): boolean {\n return this.resolve(ref) !== undefined;\n }\n\n capabilities(): string[] {\n return [...this.store.keys()].map((k) => `forge:${k}`);\n }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n readonly oauthRef: string;\n readonly authUrl: string;\n readonly state: string;\n\n /**\n * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n * @param authUrl - Browser URL to open for OAuth authorization\n * @param state - OAuth state token for CSRF protection and callback correlation\n */\n constructor(oauthRef: string, authUrl: string, state: string) {\n super(`OAuth authorization required for ${oauthRef}`);\n this.name = \"OAuthRequiredError\";\n this.oauthRef = oauthRef;\n this.authUrl = authUrl;\n this.state = state;\n }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n accessToken: string;\n refreshToken?: string;\n /** Unix timestamp in ms */\n expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n authUrl: string;\n state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n /**\n * Ensure the token for this ref is fresh.\n * Refreshes if expired.\n * Throws OAuthRequiredError if no token exists and user authorization is needed.\n */\n ensureFresh(ref: string): Promise<void>;\n\n /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n /** Exchange authorization code for tokens and store the bundle. */\n completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n locked = true;\n protected readonly store = new Map<string, string>();\n abstract readonly prefix: string;\n\n async unlock(credential: string): Promise<void> {\n await this.loadKeys(credential);\n this.locked = false;\n }\n\n protected abstract loadKeys(credential: string): Promise<void>;\n\n resolve(ref: string): string | undefined {\n if (this.locked) return undefined;\n if (!ref.startsWith(this.prefix)) return undefined;\n return this.store.get(ref.slice(this.prefix.length));\n }\n\n has(ref: string): boolean {\n return this.resolve(ref) !== undefined;\n }\n\n capabilities(): string[] {\n if (this.locked) return [];\n return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\n \"env:\",\n \"forge:\",\n \"op:\",\n \"kp:\",\n \"oauth:\",\n \"mount:\",\n \"connector:\",\n \"mcp:\",\n] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n /**\n * @param providers - Ordered list of providers. For prefixed refs, the first\n * provider that can resolve wins. For bare refs, waterfall through all in order.\n */\n constructor(private readonly providers: SecretProvider[]) {}\n\n resolve(ref: string): string | undefined {\n if (!ref) return undefined;\n const prefix = getPrefix(ref);\n log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n if (prefix) {\n for (const p of this.providers) {\n const val = p.resolve(ref);\n if (val !== undefined) return val;\n }\n log.warn(\"secret not resolvable\", { ref });\n return undefined;\n }\n // Waterfall for bare refs\n for (const p of this.providers) {\n const val = p.resolve(ref);\n if (val !== undefined) return val;\n }\n log.warn(\"secret not resolvable\", { ref });\n return undefined;\n }\n\n has(ref: string): boolean {\n return this.resolve(ref) !== undefined;\n }\n\n capabilities(): string[] {\n const all = this.providers.flatMap((p) => p.capabilities());\n return [...new Set(all)];\n }\n\n /** Returns the first provider that can resolve this ref. */\n providerFor(ref: string): SecretProvider | undefined {\n for (const p of this.providers) {\n if (p.resolve(ref) !== undefined) return p;\n }\n return undefined;\n }\n\n /**\n * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n * No-op for providers that don't have ensureFresh().\n *\n * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n * Calls ensureFresh() on the owning OAuthSecretProvider.\n */\n async prepareRef(ref: string): Promise<void> {\n const owner = this.providerFor(ref);\n if (\n owner &&\n \"ensureFresh\" in owner &&\n typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n ) {\n try {\n await (owner as OAuthSecretProvider).ensureFresh(ref);\n } catch (err) {\n log.error(\"secret provider ensureFresh failed\", err, { ref });\n throw err;\n }\n }\n }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\nimport { loadMaterializedConnectorDeclarations } from \"./materialized-connectors.js\";\n\nconst configLog = createLogger({ kind: \"connector\", subkind: \"config\" });\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Merged array of connector declarations from `skaile.yaml` and the materialized\n * `.skaile/assets/connector/*` disk projection (Phase 2.5); empty array if neither source\n * contributes any entries. `skaile.yaml` wins on id collision.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n const config = resolveSkWorkspaceConfig(projectDir);\n\n // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n if (config.mounts && config.mounts.length > 0) {\n throw new Error(\n \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n );\n }\n\n const yamlDecls =\n config.connectors && config.connectors.length > 0\n ? config.connectors.map(workspaceConnectorToDeclaration)\n : [];\n\n // Library-assigned connectors reach the runner via the materialized disk\n // projection (Phase 2.5). skaile.yaml is explicit user config — it wins on id\n // collision; the shadowed materialized connector is logged, not silently dropped.\n const byId = new Map<string, ConnectorDeclaration>();\n for (const d of yamlDecls) byId.set(d.id, d);\n for (const d of loadMaterializedConnectorDeclarations(projectDir)) {\n if (byId.has(d.id)) {\n configLog.warn(\n `materialized connector '${d.id}' shadowed by an explicit skaile.yaml connector`,\n );\n continue;\n }\n byId.set(d.id, d);\n }\n return [...byId.values()];\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n const decl: ConnectorDeclaration = {\n id: c.id,\n driver: c.driver,\n access: c.access ?? \"read-only\",\n auth: c.auth,\n options: c.options,\n };\n\n // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n\n // Map the optional mount sub-block when present.\n if (c.mount) {\n decl.mount = {\n source: c.mount.source,\n target: c.mount.target,\n watch: c.mount.watch,\n exposeAccessToken: c.mount.exposeAccessToken,\n accessTokenTTL: c.mount.accessTokenTTL,\n };\n }\n\n return decl;\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n forgeProvider: ForgeSecretProvider,\n extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n const mem = new InMemorySecretProvider();\n if (Object.keys(extraSecrets).length > 0) {\n mem.provision(extraSecrets);\n }\n return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n * - `pat` — static personal access token resolved via the secrets chain\n * (standalone CLI / non-platform contexts).\n * - `backend` — token minted by the platform's credential mediator over the\n * transport (`request_access_token` round-trip). Provider\n * dispatch (OAuth, GitHub App, ...) lives backend-side; the\n * runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n * - `pat` → `value` is the inner secret ref (e.g. `env:NAME`).\n * - `backend` → `value` is empty (sentinel only); the runner asks the\n * backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n kind: MountAuthKind;\n /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n value: string;\n /** Original auth string from the declaration, kept for diagnostics. */\n raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n readonly auth: string;\n constructor(auth: string, mountId?: string) {\n const where = mountId ? ` on mount '${mountId}'` : \"\";\n super(\n `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n `Replace with one of:\\n` +\n ` - backend (platform-mediated, recommended)\\n` +\n ` - pat:env:NAME (standalone CLI / static token)\\n` +\n `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n );\n this.name = \"LegacyAuthGrammarError\";\n this.auth = auth;\n }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n kind: \"mount\" | \"connector\",\n id: string,\n chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n if (!chain) return undefined;\n return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n * - `backend` — platform-mediated mint via `request_access_token`.\n * - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n auth: string | undefined,\n mountId?: string,\n): MountAuthRef | undefined {\n if (!auth) return undefined;\n\n if (auth === \"backend\") {\n return { kind: \"backend\", value: \"\", raw: auth };\n }\n if (auth.startsWith(\"pat:\")) {\n return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n }\n\n // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n // (`oauth:`, `github-app:`) all land here.\n throw new LegacyAuthGrammarError(auth, mountId);\n}\n"]}

package/dist/library-publish-K5IBE44D.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../cli/src/commands/library-publish.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,IAAM,iBAAA,GAAoB,sBAAA;AAG1B,SAAS,YAAY,GAAA,EAAkC;AACrD,EAAA,IAAI,GAAA,CAAI,OAAA,KAAY,KAAA,EAAO,OAAO,MAAA;AAClC,EAAA,OAAQ,IAAI,aAAA,CAAmC,GAAA;AACjD;AAGA,SAAS,SAAS,GAAA,EAAsB;AACtC,EAAA,IAAI,GAAA,CAAI,OAAA,KAAY,KAAA,EAAO,OAAO,MAAA;AAClC,EAAA,OAAQ,GAAA,CAAI,cAAmC,MAAA,IAAU,MAAA;AAC3D;AAMA,SAAS,aAAa,OAAA,EAAoC;AACxD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,iBAAiB,GAAG,OAAO,CAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,MAAA;AAAA,MACE,CAAA,GAAA,EAAM,CAAA,CAAE,GAAA,CAAI,iBAAiB,CAAC,CAAA,+GAAA;AAAA,KAEhC;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,qBAAqB,IAAI,CAAA;AAC3D,EAAA,MAAM,SAAS,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,OAAO,CAAA;AAC/D,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,MAAA,CAAO,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACxD,IAAA,MAAA,CAAO,mFAA8E,CAAA;AACrF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,MAAA,CAAO,KAAA,EAAkB,GAAA,EAAa,IAAA,EAAgB;AAC7D,EAAA,OAAO,KAAA,CAAM,KAAA,EAAO,CAAC,IAAA,EAAM,GAAA,EAAK,GAAG,IAAI,CAAA,EAAG,EAAE,QAAA,EAAU,OAAA,EAAS,CAAA;AACjE;AAQA,SAAS,cAAc,IAAA,EAKd;AACP,EAAA,MAAM,EAAE,OAAA,EAAS,SAAA,EAAW,MAAA,EAAQ,OAAM,GAAI,IAAA;AAE9C,EAAA,MAAM,SAAS,MAAA,CAAO,KAAA,EAAO,SAAS,CAAC,WAAA,EAAa,WAAW,CAAC,CAAA;AAChE,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,OAAO,MAAA,CAAO,KAAA,EAAO,OAAA,EAAS,CAAC,MAAM,CAAC,CAAA;AAC5C,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,iBAAA,EAAA,CAAqB,IAAA,CAAK,MAAA,IAAU,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,OACpF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,MAAA,GAAS,OAAO,KAAA,EAAO,OAAA,EAAS,CAAC,QAAA,EAAU,SAAA,EAAW,QAAQ,CAAC,CAAA;AACrE,EAAA,MAAM,UAAA,GACJ,MAAA,CAAO,MAAA,KAAW,CAAA,GACd,CAAC,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,SAAS,CAAA,GACzC,CAAC,QAAA,EAAU,KAAA,EAAO,UAAU,SAAS,CAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,KAAA,EAAO,OAAA,EAAS,UAAU,CAAA;AACnD,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mBAAA,EAAA,CAAuB,SAAA,CAAU,MAAA,IAAU,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,CAAA,KAAA,EAAQ,SAAA,CAAU,MAAM,CAAA,CAAE,CAAA;AAAA,KAChG;AAAA,EACF;AAEA,EAAA,MAAM,MAAM,MAAA,CAAO,KAAA,EAAO,SAAS,CAAC,KAAA,EAAO,IAAI,CAAC,CAAA;AAChD,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,gBAAA,EAAA,CAAoB,GAAA,CAAI,MAAA,IAAU,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,KACjF;AAAA,EACF;AAIA,EAAA,MAAM,MAAA,GAAS,KAAA;AAAA,IACb,KAAA;AAAA,IACA;AAAA,MACE,IAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA;AAAA,MACA,iCAAA;AAAA,MACA,IAAA;AAAA,MACA,kBAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,EAAE,UAAU,OAAA;AAAQ,GACtB;AACA,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,GAAA,GAAM,GAAG,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA,EAAG,MAAA,CAAO,UAAU,EAAE,CAAA,CAAA;AACxD,IAAA,IAAI,CAAC,oBAAA,CAAqB,IAAA,CAAK,GAAG,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,GAAA,CAAI,IAAA,MAAU,CAAA,KAAA,EAAQ,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA,CAAE,CAAA;AAAA,IAC/E;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,EAAO,OAAA,EAAS,CAAC,QAAQ,QAAA,EAAU,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAE,CAAC,CAAA;AACxE,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,iBAAA,EAAA,CAAqB,IAAA,CAAK,MAAA,IAAU,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,KACpF;AAAA,EACF;AACF;AAMA,SAAS,eAAA,CAAgB,MAAc,KAAA,EAA0B;AAC/D,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,EAAM,CAAC,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,UAAU,CAAA,EAAG,EAAE,QAAA,EAAU,OAAA,EAAS,CAAA;AACnF,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,UAAU,GAAA,CAAI,MAAA,IAAU,EAAA,EAAI,QAAA,GAAW,IAAA,EAAK;AAClD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,IAAI,CAAA,SAAA,EAAY,UAAU,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA,CAAE,CAAA;AAAA,EACpF;AAIA,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,GAAA,CAAI,MAAA,IAAU,EAAE;AAAA,EAAK,GAAA,CAAI,UAAU,EAAE,CAAA,CAAA;AACpD,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,+BAA+B,CAAA;AACvD,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,IAAI,CAAA;AAAA,EAAwC,GAAA,CAAI,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,MAAM,CAAC,CAAA,CAAE,QAAQ,QAAA,EAAU,EAAE,EAAE,IAAA,EAAK;AAC7C;AAGA,eAAe,cAAA,CACb,IAAA,EACA,IAAA,EAOA,MAAA,EACA,QAAmB,SAAA,EACJ;AACf,EAAA,MAAM,WAAW,MAAA,KAAW,MAAA;AAC5B,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,cAAA,CAAe,IAAI,CAAA;AAC7C,IAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AAItC,IAAA,IAAI,SAAA,GAAY,YAAY,GAAG,CAAA;AAC/B,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,IAAI,KAAK,UAAA,EAAY;AACnB,QAAA,SAAA,GAAY,eAAA,CAAgB,GAAA,CAAI,IAAA,EAAM,KAAK,CAAA;AAC3C,QAAA,MAAM,OAAA,CAAQ,cAAc,IAAA,EAAM;AAAA,UAChC,OAAA,EAAS,KAAA;AAAA,UACT,eAAe,EAAE,GAAA,EAAK,WAAW,MAAA,EAAQ,MAAA,EAAQ,UAAU,KAAA;AAAM,SAClE,CAAA;AACD,QAAA,KAAA,CAAM,CAAA,iBAAA,EAAoB,CAAA,CAAE,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,MAC/C,CAAA,MAAO;AACL,QAAA,MAAA;AAAA,UACE,CAAA,SAAA,EAAY,IAAI,CAAA,2BAAA,EAAyB,CAAA,CAAE,IAAI,CAAA,oBAAA,EAAuB,IAAI,QAAQ,CAAC,CAAA,6DAAA;AAAA,SAErF;AACA,QAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,MAChB;AAAA,IACF;AAGA,IAAA,MAAM,SAAA,GAAY,SAAS,SAAA,IAAa,sBAAA;AACxC,IAAA,MAAM,aAAa,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,GAAI,KAAA,CAAA;AACvD,IAAA,MAAM,WAAA,GAAA,CAAe,QAAA,CAAS,MAAA,IAAU,EAAC,EACtC,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,UAAA,IAAc,CAAA,CAAE,IAAA,KAAS,UAAU,CAAA,CAClD,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAA,CAAE,IAAA,EAAM,SAAA,EAAW,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAA,IAAW,QAAA,CAAS,OAAO,CAAC,CAAA;AAE9E,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,IAAO,QAAA,CAAS,GAAG,CAAA;AAE1C,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,OAAA,CAAQ,CAAA,iBAAA,EAAoB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAC3C,MAAA,OAAA,CAAQ,CAAA,cAAA,EAAiB,SAAS,CAAA,CAAE,CAAA;AACpC,MAAA,OAAA,CAAQ,CAAA,cAAA,EAAiB,SAAS,CAAA,CAAE,CAAA;AACpC,MAAA,OAAA,CAAQ,CAAA,cAAA,EAAiB,SAAS,CAAA,CAAE,CAAA;AACpC,MAAA,OAAA,CAAQ,CAAA,gBAAA,EAAmB,WAAA,CAAY,MAAM,CAAA,UAAA,CAAY,CAAA;AACzD,MAAA,KAAA,MAAW,CAAA,IAAK,WAAA,EAAa,OAAA,CAAQ,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAC/C,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,oBAAA,EAAqB,EAAG;AACxC,MAAA,MAAA,CAAO,sDAAiD,CAAA;AACxD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAGA,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAGlB,MAAA,OAAA;AAAA,QACE,CAAA,wDAAA,EAA2D,CAAA,CAAE,GAAA,CAAI,SAAS,CAAC,CAAA,wEAAA;AAAA,OAE7E;AACA,MAAA,aAAA,CAAc,EAAE,OAAA,EAAS,GAAA,CAAI,IAAA,EAAM,SAAA,EAAW,QAAQ,QAAA,CAAS,GAAG,CAAA,EAAG,KAAA,EAAO,CAAA;AAC5E,MAAA,KAAA,CAAM,CAAA,OAAA,EAAU,CAAA,CAAE,GAAA,CAAI,IAAI,CAAC,OAAO,CAAA,CAAE,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,GAAA,GAAM,UAAU,uBAAA,EAAwB;AAC9C,IAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,cAAA,CAAe;AAAA,MACzC,SAAA,EAAW,SAAA;AAAA,MACX,GAAA,EAAK,SAAA;AAAA,MACL,QAAA;AAAA,MACA,SAAA,EAAW,UAAA;AAAA,MACX,MAAA,EAAQ;AAAA,KACT,CAAA;AAED,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,MAAA,OAAA,CAAQ,CAAA,+BAAA,EAAkC,SAAA,CAAU,CAAC,CAAC,CAAA,GAAA,CAAK,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACF;AAOA,eAAsB,iBAAA,CACpB,IAAA,EACA,IAAA,EACA,MAAA,EACA,QAAmB,SAAA,EACJ;AACf,EAAA,MAAM,cAAA,CAAe,MAAM,EAAE,GAAG,MAAM,QAAA,EAAU,KAAA,EAAM,EAAG,MAAA,EAAQ,KAAK,CAAA;AACxE;AAOA,eAAsB,kBAAA,CACpB,IAAA,EACA,IAAA,EACA,MAAA,EACA,QAAmB,SAAA,EACJ;AACf,EAAA,MAAM,cAAA,CAAe,MAAM,EAAE,GAAG,MAAM,QAAA,EAAU,IAAA,EAAK,EAAG,MAAA,EAAQ,KAAK,CAAA;AACvE;AAOA,eAAsB,cAAA,CACpB,IAAA,EACA,IAAA,EACA,MAAA,EACe;AACf,EAAA,MAAM,WAAW,MAAA,KAAW,MAAA;AAC5B,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,cAAA,CAAe,IAAI,CAAA;AAC7C,IAAA,MAAM,SAAA,GAAY,YAAY,GAAG,CAAA;AACjC,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAA,CAAO,CAAA,SAAA,EAAY,IAAI,CAAA,iDAAA,CAA8C,CAAA;AACrE,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAEA,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,oBAAA,EAAqB,EAAG;AACxC,MAAA,MAAA,CAAO,sDAAiD,CAAA;AACxD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAEA,IAAA,MAAM,GAAA,GAAM,UAAU,uBAAA,EAAwB;AAC9C,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,IAAA,MAAM,SAAS,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,SAAS,CAAA;AACnD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAA,CAAO,CAAA,SAAA,EAAY,IAAI,CAAA,wDAAA,CAAqD,CAAA;AAC5E,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAEA,IAAA,MAAM,aAAa,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,GAAI,KAAA,CAAA;AACvD,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,gBAAA,CAAiB,MAAA,CAAO,EAAE,CAAA,EAAG,MAAA;AAAA,MACzD,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAC,UAAA,IAAc,EAAE,IAAA,KAAS,UAAA;AAAA,KACnD;AACA,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,MAAA,OAAA,CAAQ,qDAAgD,CAAA;AACxD,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,CAAI,cAAA,CAAe,CAAA,CAAE,EAAE,CAAA;AAC7B,QAAA,MAAA,CAAO,KAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAAA,MACnC,SAAS,GAAA,EAAK;AACZ,QAAA,MAAA;AAAA,UACE,CAAA,eAAA,EAAkB,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SACzF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,UAAA,CAAY,CAAA;AACzC,IAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,OAAA,CAAQ,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC1C,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACF","file":"library-publish-K5IBE44D.js","sourcesContent":["/**\n * `skaile library publish / register / yank` — the first-party publish flow.\n * A git-backed library you own carries an in-repo `skaile.manifest.yaml`; this\n * commits + pushes the library repo (publish), or takes the current remote HEAD\n * as-is (register), then registers + syncs it as a store source and publishes\n * the manifest's assets under the manifest's own `publisher` (no namespace\n * remap — first-party authors intend their declared namespace).\n *\n * - `publish` = commit (if dirty) + push + register + sync + publish.\n * - `register` = same, but skip the commit/push (bytes already on GitHub).\n * - `yank` = unpublish the library's published assets (all, or one).\n *\n * The store REST surface is reached through the injectable {@link PublisherClient}\n * (default HTTP); git side-effects go through an injectable `spawn`. Both seams\n * keep the flow unit/integration-testable without a live store or a real remote.\n *\n * @docLink cli/commands/library\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { decodeSkaileManifest, type SkPublishManifest } from \"@skaile/workspaces/core\";\nimport type { GitBackendConfig, Library } from \"@skaile/workspaces/library\";\nimport { logErr, logInfo, logOk, S } from \"../helpers.ts\";\nimport { openLibraryManager } from \"../open-library.ts\";\nimport { isStoreAuthenticated } from \"../store-client.ts\";\nimport { makeHttpPublisherClient, type PublisherClient } from \"../store-publisher.ts\";\nimport { bareName, publishToStore, refFor } from \"./publish-core.ts\";\n\n/** Injectable spawn contract — the subset of `spawnSync` these helpers use. */\ntype SpawnLike = typeof spawnSync;\n\n/** The fixed filename a library carries at its root for publication. */\nconst MANIFEST_FILENAME = \"skaile.manifest.yaml\";\n\n/** The remote url of a git-backed library, or `undefined` for a local one. */\nfunction remoteUrlOf(lib: Library): string | undefined {\n if (lib.backend !== \"git\") return undefined;\n return (lib.backendConfig as GitBackendConfig).url;\n}\n\n/** The publish branch of a git-backed library (defaults to `main`). */\nfunction branchOf(lib: Library): string {\n if (lib.backend !== \"git\") return \"main\";\n return (lib.backendConfig as GitBackendConfig).branch ?? \"main\";\n}\n\n/**\n * Read + decode the in-repo `skaile.manifest.yaml`. Prints each error\n * diagnostic and exits (1) — mirroring the sidecar flow's validation gate.\n */\nfunction loadManifest(libPath: string): SkPublishManifest {\n let text: string;\n try {\n text = readFileSync(join(libPath, MANIFEST_FILENAME), \"utf-8\");\n } catch {\n logErr(\n `No ${S.dim(MANIFEST_FILENAME)} in the library — author it (see \\`skaile library create\\`) ` +\n \"and run `skaile validate` before publishing.\",\n );\n process.exit(1);\n }\n const { manifest, diagnostics } = decodeSkaileManifest(text);\n const errors = diagnostics.filter((d) => d.severity === \"error\");\n if (errors.length > 0) {\n for (const d of errors) logErr(`${d.code}: ${d.message}`);\n logErr(\"The manifest has errors — fix them with `skaile validate` before publishing.\");\n process.exit(1);\n }\n return manifest;\n}\n\n/** Run a git command in `cwd` via the injected spawn; returns the result. */\nfunction runGit(spawn: SpawnLike, cwd: string, args: string[]) {\n return spawn(\"git\", [\"-C\", cwd, ...args], { encoding: \"utf-8\" });\n}\n\n/**\n * Ensure `libPath` is a git repo whose `origin` points at `remoteUrl`, then\n * commit any changes and push to `branch`. Idempotent re-publish: an unchanged\n * tree makes `git commit` fail with \"nothing to commit\" — swallowed. Push (or\n * any other git) failures surface as thrown Errors carrying git's stderr.\n */\nfunction commitAndPush(opts: {\n libPath: string;\n remoteUrl: string;\n branch: string;\n spawn: SpawnLike;\n}): void {\n const { libPath, remoteUrl, branch, spawn } = opts;\n\n const gitDir = runGit(spawn, libPath, [\"rev-parse\", \"--git-dir\"]);\n if (gitDir.status !== 0) {\n const init = runGit(spawn, libPath, [\"init\"]);\n if (init.status !== 0) {\n throw new Error(\n `git init failed: ${(init.stderr ?? \"\").toString().trim() || `exit ${init.status}`}`,\n );\n }\n }\n\n // Point origin at the resolved remote (add if absent, else set-url).\n const getUrl = runGit(spawn, libPath, [\"remote\", \"get-url\", \"origin\"]);\n const originArgs =\n getUrl.status === 0\n ? [\"remote\", \"set-url\", \"origin\", remoteUrl]\n : [\"remote\", \"add\", \"origin\", remoteUrl];\n const setOrigin = runGit(spawn, libPath, originArgs);\n if (setOrigin.status !== 0) {\n throw new Error(\n `git remote failed: ${(setOrigin.stderr ?? \"\").toString().trim() || `exit ${setOrigin.status}`}`,\n );\n }\n\n const add = runGit(spawn, libPath, [\"add\", \"-A\"]);\n if (add.status !== 0) {\n throw new Error(\n `git add failed: ${(add.stderr ?? \"\").toString().trim() || `exit ${add.status}`}`,\n );\n }\n\n // Fixed bot identity via -c so the commit succeeds regardless of the author's\n // git config (the publish commit is a machine action).\n const commit = spawn(\n \"git\",\n [\n \"-C\",\n libPath,\n \"-c\",\n \"user.email=publish@skaile.store\",\n \"-c\",\n \"user.name=skaile\",\n \"commit\",\n \"-m\",\n \"chore: publish\",\n ],\n { encoding: \"utf-8\" },\n );\n if (commit.status !== 0) {\n const out = `${commit.stdout ?? \"\"}${commit.stderr ?? \"\"}`;\n if (!/nothing to commit/i.test(out)) {\n throw new Error(`git commit failed: ${out.trim() || `exit ${commit.status}`}`);\n }\n }\n\n const push = runGit(spawn, libPath, [\"push\", \"origin\", `HEAD:${branch}`]);\n if (push.status !== 0) {\n throw new Error(\n `git push failed: ${(push.stderr ?? \"\").toString().trim() || `exit ${push.status}`}`,\n );\n }\n}\n\n/**\n * Provision a public GitHub repo `github.com/<you>/<name>` via `gh` and return\n * its https url. Parses the url `gh` prints on success. Throws on failure.\n */\nfunction createRepoViaGh(name: string, spawn: SpawnLike): string {\n const res = spawn(\"gh\", [\"repo\", \"create\", name, \"--public\"], { encoding: \"utf-8\" });\n if (res.status !== 0) {\n const stderr = (res.stderr ?? \"\").toString().trim();\n throw new Error(`gh repo create ${name} failed: ${stderr || `exit ${res.status}`}`);\n }\n // `gh repo create` prints the repo url (e.g. `https://github.com/<owner>/<name>`);\n // scan combined output for the first github.com url so we capture whatever\n // owner gh resolved (the authed user).\n const out = `${res.stdout ?? \"\"}\\n${res.stderr ?? \"\"}`;\n const match = out.match(/https:\\/\\/github\\.com\\/[^\\s]+/);\n if (!match) {\n throw new Error(`gh repo create ${name} succeeded but printed no repo url:\\n${out.trim()}`);\n }\n return match[0].replace(/\\.git$/, \"\").trim();\n}\n\n/** Shared publish body for `publish` (pushes) and `register` (skips the push). */\nasync function publishLibrary(\n name: string,\n opts: {\n asset?: string;\n createRepo?: boolean;\n ref?: string;\n dryRun?: boolean;\n skipPush: boolean;\n },\n client?: PublisherClient,\n spawn: SpawnLike = spawnSync,\n): Promise<void> {\n const injected = client !== undefined;\n const { manager, close } = await openLibraryManager();\n try {\n const lib = await manager.requireLibrary(name);\n const manifest = loadManifest(lib.path);\n\n // Resolve the remote: git-backed → its url; local + --create-repo → provision\n // and link; else stop with a hint.\n let remoteUrl = remoteUrlOf(lib);\n if (!remoteUrl) {\n if (opts.createRepo) {\n remoteUrl = createRepoViaGh(lib.name, spawn);\n await manager.updateLibrary(name, {\n backend: \"git\",\n backendConfig: { url: remoteUrl, branch: \"main\", authHint: \"ssh\" },\n });\n logOk(`Created + linked ${S.dim(remoteUrl)}.`);\n } else {\n logErr(\n `Library \"${name}\" has no remote — run ${S.cmd(`skaile library link ${name} <url>`)} ` +\n \"first, or pass `--create-repo` to provision a public repo.\",\n );\n process.exit(1);\n }\n }\n\n // The manifest's own publisher is the namespace (first-party — no remap).\n const namespace = manifest.publisher ?? \"<manifest publisher>\";\n const targetName = opts.asset ? bareName(opts.asset) : undefined;\n const wouldBeRefs = (manifest.assets ?? [])\n .filter((a) => !targetName || a.name === targetName)\n .map((a) => refFor(a.kind, namespace, a.name, a.version ?? manifest.version));\n\n const sourceRef = opts.ref ?? branchOf(lib);\n\n if (opts.dryRun) {\n logInfo(`Publish plan for ${S.bold(name)}:`);\n logInfo(` remote: ${remoteUrl}`);\n logInfo(` publisher: ${namespace}`);\n logInfo(` source ref: ${sourceRef}`);\n logInfo(` would publish ${wouldBeRefs.length} asset(s):`);\n for (const r of wouldBeRefs) logInfo(` ${r}`);\n return;\n }\n\n // A real publish makes store calls, so it needs a token (injected fakes bypass).\n if (!injected && !isStoreAuthenticated()) {\n logErr(\"Not signed in — run `skaile store login` first.\");\n process.exit(1);\n }\n\n // publish commits + pushes the library repo; register takes the remote HEAD as-is.\n if (!opts.skipPush) {\n // `git add -A` stages every non-ignored file → a PUBLIC push. Surface it so\n // an unexpected file in the working tree is not silently published.\n logInfo(\n `Committing the library and pushing to the PUBLIC remote ${S.dim(remoteUrl)} ` +\n \"(.gitignore honored; anything else in the working tree becomes public).\",\n );\n commitAndPush({ libPath: lib.path, remoteUrl, branch: branchOf(lib), spawn });\n logOk(`Pushed ${S.dim(name)} to ${S.dim(remoteUrl)}.`);\n }\n\n const pub = client ?? makeHttpPublisherClient();\n const { published } = await publishToStore({\n sourceUrl: remoteUrl,\n ref: sourceRef,\n manifest,\n assetName: targetName,\n client: pub,\n });\n\n if (published.length > 0) {\n logInfo(`Consumers can now \\`skaile add ${published[0]}\\`.`);\n }\n } finally {\n close();\n }\n}\n\n/**\n * `skaile library publish <lib>` — commit + push the library repo, register +\n * sync it as a store source, and publish its manifest's assets under the\n * manifest publisher. See the module header for the full flow.\n */\nexport async function runLibraryPublish(\n name: string,\n opts: { asset?: string; createRepo?: boolean; ref?: string; dryRun?: boolean },\n client?: PublisherClient,\n spawn: SpawnLike = spawnSync,\n): Promise<void> {\n await publishLibrary(name, { ...opts, skipPush: false }, client, spawn);\n}\n\n/**\n * `skaile library register <lib>` — same as publish but skips the commit/push\n * (the bytes are already on GitHub at the current remote HEAD). Still requires a\n * git-backed remote.\n */\nexport async function runLibraryRegister(\n name: string,\n opts: { asset?: string; ref?: string; dryRun?: boolean },\n client?: PublisherClient,\n spawn: SpawnLike = spawnSync,\n): Promise<void> {\n await publishLibrary(name, { ...opts, skipPush: true }, client, spawn);\n}\n\n/**\n * `skaile library yank <lib>` — unpublish the library's published assets from\n * the store (all, or the single asset matching `opts.asset`'s name).\n * Auth-gated like publish.\n */\nexport async function runLibraryYank(\n name: string,\n opts: { asset?: string },\n client?: PublisherClient,\n): Promise<void> {\n const injected = client !== undefined;\n const { manager, close } = await openLibraryManager();\n try {\n const lib = await manager.requireLibrary(name);\n const remoteUrl = remoteUrlOf(lib);\n if (!remoteUrl) {\n logErr(`Library \"${name}\" has no remote — nothing published to yank.`);\n process.exit(1);\n }\n\n if (!injected && !isStoreAuthenticated()) {\n logErr(\"Not signed in — run `skaile store login` first.\");\n process.exit(1);\n }\n\n const pub = client ?? makeHttpPublisherClient();\n const rows = await pub.sourcesList();\n const source = rows.find((r) => r.url === remoteUrl);\n if (!source) {\n logErr(`Library \"${name}\" is not registered in the store — nothing to yank.`);\n process.exit(1);\n }\n\n const targetName = opts.asset ? bareName(opts.asset) : undefined;\n const candidates = (await pub.sourceCandidates(source.id)).filter(\n (c) => c.published && (!targetName || c.name === targetName),\n );\n if (candidates.length === 0) {\n logInfo(\"No published assets matched — nothing to yank.\");\n return;\n }\n\n const yanked: string[] = [];\n for (const c of candidates) {\n try {\n await pub.assetUnpublish(c.id);\n yanked.push(`${c.kind}:${c.name}`);\n } catch (err) {\n logErr(\n `Failed to yank ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`,\n );\n }\n }\n\n logOk(`Yanked ${yanked.length} asset(s):`);\n for (const r of yanked) logInfo(` ${r}`);\n } finally {\n close();\n }\n}\n"]}

package/dist/paths-P3DWFUPS.js DELETED Viewed

@@ -1,15 +0,0 @@
-export { AI_RESOURCES, MONOREPO_ROOT, aiResourceRoots } from './chunk-2ZMO4CFG.js';
-import './chunk-HY33RMEA.js';
-import './chunk-ZAP2BDHG.js';
-import './chunk-ZBZQC5R7.js';
-import './chunk-UQKYT4V6.js';
-import './chunk-P4VHQA4N.js';
-import './chunk-BQCGFPHW.js';
-import './chunk-GEEW6SY2.js';
-import './chunk-F3HNW354.js';
-import './chunk-MENCWIHW.js';
-import './chunk-K5GBV4SA.js';
-import './chunk-JB35MVBN.js';
-import './chunk-NSBPE2FW.js';
-//# sourceMappingURL=paths-P3DWFUPS.js.map
-//# sourceMappingURL=paths-P3DWFUPS.js.map

package/dist/source-manifest-publish-TGVZ6KMC.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"sources":["../cli/src/commands/source-manifest-publish.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,IAAM,yBAAA,GAA4B,sBAAA;AAW3B,SAAS,0BAAA,CACd,UACA,SAAA,EACmB;AACnB,EAAA,MAAM,UAAU,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM;AAChD,IAAA,MAAM,EAAE,SAAA,EAAW,KAAA,EAAO,GAAG,MAAK,GAAI,CAAA;AACtC,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AACD,EAAA,OAAO,EAAE,GAAG,QAAA,EAAU,SAAA,EAAW,WAAW,MAAA,EAAO;AACrD;AAWA,SAAS,YAAA,GAAuB;AAC9B,EAAA,MAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACjE,EAAA,OAAO,IAAA,CAAK,MAAM,eAAe,CAAA;AACnC;AAEA,SAAS,YAAA,GAAoC;AAC3C,EAAA,MAAM,OAAO,YAAA,EAAa;AAC1B,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAMO,SAAS,eAAe,IAAA,EAAkC;AAC/D,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,OAAO,QAAA,CAAS,YAAA,GAAe,IAAI,CAAA,EAAG,IAAA;AACxC;AAOO,SAAS,eAAA,CAAgB,MAAc,IAAA,EAAoB;AAChE,EAAA,MAAM,OAAO,YAAA,EAAa;AAC1B,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,eAAe,EAAE,GAAI,QAAA,CAAS,YAAA,IAAgB,EAAC,EAAG;AACxD,EAAA,YAAA,CAAa,IAAI,IAAI,EAAE,GAAI,aAAa,IAAI,CAAA,IAAK,EAAC,EAAI,IAAA,EAAK;AAC3D,EAAA,QAAA,CAAS,YAAA,GAAe,YAAA;AACxB,EAAA,aAAA,CAAc,MAAM,IAAA,CAAK,SAAA,CAAU,UAAU,IAAA,EAAM,CAAC,GAAG,OAAO,CAAA;AAChE;AAQA,SAAS,GAAA,CAAI,KAAA,EAAkB,GAAA,EAAa,IAAA,EAAwB;AAClE,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,KAAA,EAAO,CAAC,IAAA,EAAM,GAAA,EAAK,GAAG,IAAI,CAAA,EAAG,EAAE,QAAA,EAAU,OAAA,EAAS,CAAA;AACpE,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,UAAU,GAAA,CAAI,MAAA,IAAU,EAAA,EAAI,QAAA,GAAW,IAAA,EAAK;AAClD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,IAAA,EAAO,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,SAAA,EAAY,MAAA,IAAU,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,EAAE,CAAA,CAAE,CAAA;AAAA,EACnF;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,IAAU,EAAA,EAAI,QAAA,GAAW,IAAA,EAAK;AAC5C;AAWO,SAAS,oBAAoB,IAAA,EAIV;AACxB,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,SAAA;AAG5B,EAAA,MAAM,WAAW,CAAA,EAAG,eAAA,CAAgB,eAAe,IAAA,CAAK,cAAc,CAAC,CAAC,CAAA,aAAA,CAAA;AACxE,EAAA,MAAA,CAAO,UAAU,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACjD,EAAA,SAAA,CAAU,QAAQ,QAAQ,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAIhD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,EAAO,CAAC,OAAA,EAAS,WAAW,GAAA,EAAK,IAAA,CAAK,cAAA,EAAgB,QAAQ,CAAA,EAAG;AAAA,MACtF,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,UAAU,QAAA,CAAS,MAAA,IAAU,EAAA,EAAI,QAAA,GAAW,IAAA,EAAK;AACvD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,UAAA,EAAa,KAAK,cAAc,CAAA,SAAA,EAAY,UAAU,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,aAAA,CAAc,KAAK,QAAA,EAAU,yBAAyB,CAAA,EAAG,IAAA,CAAK,cAAc,OAAO,CAAA;AACnF,IAAA,GAAA,CAAI,KAAA,EAAO,QAAA,EAAU,CAAC,KAAA,EAAO,yBAAyB,CAAC,CAAA;AAIvD,IAAA,MAAM,SAAA,GAAY,KAAA;AAAA,MAChB,KAAA;AAAA,MACA;AAAA,QACE,IAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA;AAAA,QACA,iCAAA;AAAA,QACA,IAAA;AAAA,QACA,kBAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,EAAE,UAAU,OAAA;AAAQ,KACtB;AACA,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC1B,MAAA,MAAM,GAAA,GAAM,GAAG,SAAA,CAAU,MAAA,IAAU,EAAE,CAAA,EAAG,SAAA,CAAU,UAAU,EAAE,CAAA,CAAA;AAE9D,MAAA,IAAI,CAAC,oBAAA,CAAqB,IAAA,CAAK,GAAG,CAAA,EAAG;AACnC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,GAAA,CAAI,IAAA,MAAU,CAAA,KAAA,EAAQ,SAAA,CAAU,MAAM,CAAA,CAAE,CAAA,CAAE,CAAA;AAAA,MAClF;AAAA,IACF,CAAA,MAAO;AAGL,MAAA,GAAA,CAAI,OAAO,QAAA,EAAU,CAAC,MAAA,EAAQ,QAAA,EAAU,MAAM,CAAC,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,EAAE,WAAW,GAAA,CAAI,KAAA,EAAO,UAAU,CAAC,WAAA,EAAa,MAAM,CAAC,CAAA,EAAE;AAAA,EAClE,CAAA,SAAE;AACA,IAAA,MAAA,CAAO,UAAU,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,EACnD;AACF;AAWA,eAAsB,UAAA,CACpB,GAAA,EACA,IAAA,EAOA,MAAA,EACA,QAAmB,SAAA,EACJ;AACf,EAAA,MAAM,WAAW,MAAA,KAAW,MAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,UAAU,uBAAA,EAAwB;AAE9C,EAAA,MAAM,EAAE,KAAK,IAAA,EAAM,YAAA,KAAiB,gBAAA,CAAiB,GAAA,EAAK,KAAK,UAAU,CAAA;AAEzE,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG;AAC7B,IAAA,MAAA;AAAA,MACE,4BAA4B,IAAI,CAAA,KAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,YAAY,CAAC,CAAA,kDAAA;AAAA,KAE7D;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,EAAE,UAAU,WAAA,EAAY,GAAI,qBAAqB,YAAA,CAAa,YAAA,EAAc,OAAO,CAAC,CAAA;AAC1F,EAAA,IAAI,YAAY,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,QAAA,KAAa,OAAO,CAAA,EAAG;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,YAAY,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,QAAA,KAAa,OAAO,CAAA,EAAG;AACjE,MAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAAA,IAClC;AACA,IAAA,MAAA;AAAA,MACE;AAAA,KAEF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAIA,EAAA,MAAM,MAAA,GAAS,YAAY,oBAAA,EAAqB;AAChD,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,IAAU,CAAC,MAAA,EAAQ;AAC3B,IAAA,MAAA,CAAO,sDAAiD,CAAA;AACxD,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAIA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,IAAA,CAAK,EAAA,EAAI,SAAA,GAAY,IAAA,CAAK,EAAA;AAAA,OAAA,IACrB,MAAA,EAAQ,SAAA,GAAA,CAAa,MAAM,GAAA,CAAI,IAAG,EAAG,QAAA;AAAA,OACzC,SAAA,GAAY,uBAAA;AAEjB,EAAA,MAAM,UAAA,GAAa,0BAAA,CAA2B,QAAA,EAAU,SAAS,CAAA;AACjE,EAAA,MAAM,aAAA,GAAgB,qBAAqB,UAAU,CAAA;AAErD,EAAA,MAAM,WAAA,GAAA,CAAe,UAAA,CAAW,MAAA,IAAU,EAAC,EAAG,GAAA;AAAA,IAAI,CAAC,CAAA,KACjD,MAAA,CAAO,CAAA,CAAE,IAAA,EAAM,SAAA,EAAW,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAA,IAAW,UAAA,CAAW,OAAO;AAAA,GACnE;AAEA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,IAAe,cAAA,CAAe,IAAI,CAAA,IAAK,mCAAA;AAC5D,IAAA,OAAA,CAAQ,CAAA,iBAAA,EAAoB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAC3C,IAAA,OAAA,CAAQ,CAAA,gBAAA,EAAmB,SAAS,CAAA,CAAE,CAAA;AACtC,IAAA,OAAA,CAAQ,CAAA,gBAAA,EAAmB,OAAO,CAAA,CAAE,CAAA;AACpC,IAAA,OAAA,CAAQ,CAAA,gBAAA,EAAmB,IAAA,CAAK,GAAA,IAAO,MAAM,CAAA,CAAE,CAAA;AAC/C,IAAA,OAAA,CAAQ,CAAA,gBAAA,EAAmB,WAAA,CAAY,MAAM,CAAA,UAAA,CAAY,CAAA;AACzD,IAAA,KAAA,MAAW,CAAA,IAAK,WAAA,EAAa,OAAA,CAAQ,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAC/C,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,WAAA,IAAe,cAAA,CAAe,IAAI,CAAA;AAC9D,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,MAAA;AAAA,MACE,CAAA,kDAAA,EACK,CAAA,CAAE,GAAA,CAAI,gDAAgD,CAAC,CAAA,2HAAA;AAAA,KAG9D;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,IAAI,IAAA,CAAK,WAAA,EAAa,eAAA,CAAgB,IAAA,EAAM,cAAc,CAAA;AAE1D,EAAA,MAAM,EAAE,WAAU,GAAI,mBAAA,CAAoB,EAAE,cAAA,EAAgB,YAAA,EAAc,aAAA,EAAe,KAAA,EAAO,CAAA;AAChG,EAAA,KAAA,CAAM,CAAA,2BAAA,EAA8B,CAAA,CAAE,GAAA,CAAI,cAAc,CAAC,CAAA,GAAA,EAAM,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA,CAAG,CAAA;AAGxF,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,IAAO,MAAA;AAE9B,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,cAAA,CAAe;AAAA,IACzC,SAAA,EAAW,GAAA;AAAA,IACX,GAAA,EAAK,SAAA;AAAA,IACL,OAAA,EAAS,EAAE,GAAA,EAAK,cAAA,EAAgB,KAAK,SAAA,EAAU;AAAA,IAC/C,QAAA,EAAU,UAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,IAAA,OAAA,CAAQ,CAAA,iDAAA,EAAoD,SAAA,CAAU,CAAC,CAAC,CAAA,GAAA,CAAK,CAAA;AAAA,EAC/E;AACF;AAMA,eAAsB,OAAA,CACpB,GAAA,EACA,IAAA,EACA,MAAA,EACe;AACf,EAAA,MAAM,WAAW,MAAA,KAAW,MAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,UAAU,uBAAA,EAAwB;AAE9C,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,KAAS,gBAAA,CAAiB,GAAA,EAAK,KAAK,UAAU,CAAA;AAE3D,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,oBAAA,EAAqB,EAAG;AACxC,IAAA,MAAA,CAAO,sDAAiD,CAAA;AACxD,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,EAAA,MAAM,SAAS,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AAC7C,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,CAAO,CAAA,QAAA,EAAW,IAAI,CAAA,wDAAA,CAAqD,CAAA;AAC3E,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,GAAI,MAAA;AACvD,EAAA,MAAM,cAAc,MAAM,GAAA,CAAI,gBAAA,CAAiB,MAAA,CAAO,EAAE,CAAA,EAAG,MAAA;AAAA,IACzD,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAC,UAAA,IAAc,EAAE,IAAA,KAAS,UAAA;AAAA,GACnD;AACA,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,qDAAgD,CAAA;AACxD,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,CAAI,cAAA,CAAe,CAAA,CAAE,EAAE,CAAA;AAC7B,MAAA,MAAA,CAAO,KAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA;AAAA,QACE,CAAA,eAAA,EAAkB,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OACzF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,UAAA,CAAY,CAAA;AACzC,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,OAAA,CAAQ,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAC1C","file":"source-manifest-publish-TGVZ6KMC.js","sourcesContent":["/**\n * `skaile source manifest publish` / `yank` — the curator-publish flow. Takes a\n * locally-curated sidecar manifest (over a foreign public GitHub repo) and:\n *\n * 1. Pushes the curated `skaile.manifest.yaml` to the curator's OWN public\n * \"sidecar\" repo (bytes stay in the foreign source; the sidecar holds only\n * the manifest pointing at it).\n * 2. Registers the foreign source + the sidecar (url + pinned commit) with the\n * store, syncs it, and publishes each curated asset.\n *\n * `yank` is the inverse: unpublish each currently-published asset of the source.\n *\n * The store REST surface is reached through the injectable {@link PublisherClient}\n * (default HTTP client); git side-effects go through an injectable `spawn`. Both\n * seams keep the pure helpers + orchestration unit/integration-testable without a\n * live store or a real remote.\n *\n * @docLink cli/commands/source#manifest-publish\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport {\n decodeSkaileManifest,\n encodeSkaileManifest,\n type SkPublishManifest,\n sourceCacheKey,\n} from \"@skaile/workspaces/core\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport { makeHttpPublisherClient, type PublisherClient } from \"../store-publisher.ts\";\nimport { isStoreAuthenticated } from \"../store-client.ts\";\nimport { bareName, publishToStore, refFor } from \"./publish-core.ts\";\nimport { sourceClonePath } from \"./source.ts\";\nimport { resolveSourceArg } from \"./source-manifest.ts\";\n\n/** The fixed filename a sidecar repo carries at its root. */\nconst SIDECAR_MANIFEST_FILENAME = \"skaile.manifest.yaml\";\n\n/** Injectable spawn contract — the subset of `spawnSync` these helpers use. */\ntype SpawnLike = typeof spawnSync;\n\n/**\n * Return a copy of `manifest` normalized for publication under `namespace`:\n * the top-level `publisher` is set to `namespace` and every per-asset\n * `publisher` override is removed so all assets inherit the top-level one.\n * Pure — the input is not mutated.\n */\nexport function normalizePublishedManifest(\n manifest: SkPublishManifest,\n namespace: string,\n): SkPublishManifest {\n const assets = (manifest.assets ?? []).map((a) => {\n const { publisher: _drop, ...rest } = a;\n return rest;\n });\n return { ...manifest, publisher: namespace, assets };\n}\n\n// ── Sidecar-repo association (~/.skaile/settings.json) ────────────────────────\n\n/**\n * Path to the user settings file — the same `~/.skaile/settings.json` the store\n * client reads tokens from. Resolves the `.skaile` root exactly as `getStoreRoot`\n * does (`SKAILE_HOME` when set — it IS the `.skaile` dir — else `~/.skaile`), so\n * the sidecar association lives beside the store manifests under one convention\n * and tests isolate through the same `SKAILE_HOME` seam.\n */\nfunction settingsFile(): string {\n const root = process.env.SKAILE_HOME ?? join(homedir(), \".skaile\");\n return join(root, \"settings.json\");\n}\n\nfunction readSettings(): Record<string, any> {\n const file = settingsFile();\n if (!existsSync(file)) return {};\n try {\n return JSON.parse(readFileSync(file, \"utf-8\"));\n } catch {\n return {};\n }\n}\n\n/**\n * The sidecar repo URL previously associated with a source `slug`, if any.\n * Reads `settings.sidecarRepos?.[slug]?.repo`.\n */\nexport function getSidecarRepo(slug: string): string | undefined {\n const settings = readSettings();\n return settings.sidecarRepos?.[slug]?.repo;\n}\n\n/**\n * Persist the sidecar repo URL for a source `slug`, preserving every other\n * settings key. Stored as an object (`{ repo }`) so a `path` (or other fields)\n * can be added later without a schema migration.\n */\nexport function saveSidecarRepo(slug: string, repo: string): void {\n const file = settingsFile();\n mkdirSync(dirname(file), { recursive: true });\n const settings = readSettings();\n const sidecarRepos = { ...(settings.sidecarRepos ?? {}) };\n sidecarRepos[slug] = { ...(sidecarRepos[slug] ?? {}), repo };\n settings.sidecarRepos = sidecarRepos;\n writeFileSync(file, JSON.stringify(settings, null, 2), \"utf-8\");\n}\n\n// ── Sidecar push ──────────────────────────────────────────────────────────────\n\n/**\n * Run a git command in `cwd` via the injected spawn, throwing with the captured\n * stderr on failure. Returns trimmed stdout.\n */\nfunction git(spawn: SpawnLike, cwd: string, args: string[]): string {\n const res = spawn(\"git\", [\"-C\", cwd, ...args], { encoding: \"utf-8\" });\n if (res.status !== 0) {\n const stderr = (res.stderr ?? \"\").toString().trim();\n throw new Error(`git ${args.join(\" \")} failed: ${stderr || `exit ${res.status}`}`);\n }\n return (res.stdout ?? \"\").toString().trim();\n}\n\n/**\n * Clone the curator's sidecar repo, write the curated manifest at its root, and\n * commit + push. Returns the pushed commit sha (used to pin the store source).\n *\n * Idempotent re-publish: when the manifest is unchanged `git commit` fails with\n * \"nothing to commit\" — we swallow that and return the current HEAD so a no-op\n * re-run still yields a valid pin. Any push/auth failure surfaces as a thrown\n * Error carrying git's stderr.\n */\nexport function pushSidecarManifest(opts: {\n sidecarRepoUrl: string;\n manifestText: string;\n spawn?: SpawnLike;\n}): { commitSha: string } {\n const spawn = opts.spawn ?? spawnSync;\n // Dedicated dir next to the source clone cache; wipe any stale clone first so\n // a re-publish always starts from a clean shallow checkout of the remote.\n const cloneDir = `${sourceClonePath(sourceCacheKey(opts.sidecarRepoUrl))}-sidecar-push`;\n rmSync(cloneDir, { recursive: true, force: true });\n mkdirSync(dirname(cloneDir), { recursive: true });\n\n // The clone is scratch — always remove it afterwards (success or failure) so a\n // failed push never leaves a stale checkout in the cache dir.\n try {\n const cloneRes = spawn(\"git\", [\"clone\", \"--depth\", \"1\", opts.sidecarRepoUrl, cloneDir], {\n encoding: \"utf-8\",\n });\n if (cloneRes.status !== 0) {\n const stderr = (cloneRes.stderr ?? \"\").toString().trim();\n throw new Error(\n `git clone ${opts.sidecarRepoUrl} failed: ${stderr || `exit ${cloneRes.status}`}`,\n );\n }\n\n writeFileSync(join(cloneDir, SIDECAR_MANIFEST_FILENAME), opts.manifestText, \"utf-8\");\n git(spawn, cloneDir, [\"add\", SIDECAR_MANIFEST_FILENAME]);\n\n // Fixed bot identity via -c so the commit succeeds regardless of the curator's\n // git config (the sidecar push is a machine action, not authored work).\n const commitRes = spawn(\n \"git\",\n [\n \"-C\",\n cloneDir,\n \"-c\",\n \"user.email=publish@skaile.store\",\n \"-c\",\n \"user.name=skaile\",\n \"commit\",\n \"-m\",\n \"chore(sidecar): publish curated manifest\",\n ],\n { encoding: \"utf-8\" },\n );\n if (commitRes.status !== 0) {\n const out = `${commitRes.stdout ?? \"\"}${commitRes.stderr ?? \"\"}`;\n // Nothing changed → idempotent re-publish; keep the existing HEAD.\n if (!/nothing to commit/i.test(out)) {\n throw new Error(`git commit failed: ${out.trim() || `exit ${commitRes.status}`}`);\n }\n } else {\n // `push origin HEAD` (not a bare `push`) so a fresh sidecar repo with an\n // unborn/renamed default branch still gets its branch created on the remote.\n git(spawn, cloneDir, [\"push\", \"origin\", \"HEAD\"]);\n }\n\n return { commitSha: git(spawn, cloneDir, [\"rev-parse\", \"HEAD\"]) };\n } finally {\n rmSync(cloneDir, { recursive: true, force: true });\n }\n}\n\n// ── Orchestration ───────────────────────────────────────────────────────────\n\n/**\n * `source manifest publish <src>` — publish a curated sidecar manifest to the\n * store. See the module header for the full flow. Store calls go through\n * `client` (default HTTP); git side-effects through `spawn` (default\n * `spawnSync`). The auth gate is enforced only for the default HTTP client so\n * injected fakes bypass it.\n */\nexport async function runPublish(\n arg: string,\n opts: {\n projectDir: string;\n as?: string;\n sidecarRepo?: string;\n ref?: string;\n dryRun?: boolean;\n },\n client?: PublisherClient,\n spawn: SpawnLike = spawnSync,\n): Promise<void> {\n const injected = client !== undefined;\n const pub = client ?? makeHttpPublisherClient();\n\n const { url, slug, manifestFile } = resolveSourceArg(arg, opts.projectDir);\n\n if (!existsSync(manifestFile)) {\n logErr(\n `No curated manifest for \"${slug}\" at ${S.dim(manifestFile)} — ` +\n \"run `skaile source manifest init` first.\",\n );\n process.exit(1);\n }\n\n const { manifest, diagnostics } = decodeSkaileManifest(readFileSync(manifestFile, \"utf-8\"));\n if (diagnostics.some((d) => d.severity === \"error\")) {\n for (const d of diagnostics.filter((x) => x.severity === \"error\")) {\n logErr(`${d.code}: ${d.message}`);\n }\n logErr(\n \"The curated manifest has errors — fix them with `skaile source manifest edit` / \" +\n \"`verify` before publishing.\",\n );\n process.exit(1);\n }\n\n // A real publish makes store calls (+ `me()` when `--as` is omitted), so it\n // needs a token. `--dry-run` is an offline preview: never gate it on auth.\n const authed = injected || isStoreAuthenticated();\n if (!opts.dryRun && !authed) {\n logErr(\"Not signed in — run `skaile store login` first.\");\n process.exit(1);\n }\n\n // Namespace: `--as` wins; else the signed-in username. In an unauthenticated\n // dry-run we cannot call `me()`, so show a placeholder in the offline plan.\n let namespace: string;\n if (opts.as) namespace = opts.as;\n else if (authed) namespace = (await pub.me()).username;\n else namespace = \"<your store username>\";\n\n const normalized = normalizePublishedManifest(manifest, namespace);\n const publishedText = encodeSkaileManifest(normalized);\n\n const wouldBeRefs = (normalized.assets ?? []).map((a) =>\n refFor(a.kind, namespace, a.name, a.version ?? normalized.version),\n );\n\n if (opts.dryRun) {\n const sidecar = opts.sidecarRepo ?? getSidecarRepo(slug) ?? \"<none — pass --sidecar-repo>\";\n logInfo(`Publish plan for ${S.bold(slug)}:`);\n logInfo(` namespace: ${namespace}`);\n logInfo(` sidecar repo: ${sidecar}`);\n logInfo(` source ref: ${opts.ref ?? \"main\"}`);\n logInfo(` would publish ${wouldBeRefs.length} asset(s):`);\n for (const r of wouldBeRefs) logInfo(` ${r}`);\n return;\n }\n\n const sidecarRepoUrl = opts.sidecarRepo ?? getSidecarRepo(slug);\n if (!sidecarRepoUrl) {\n logErr(\n \"No sidecar repo associated with this source. Pass \" +\n `${S.cmd(\"--sidecar-repo https://github.com/<you>/<repo>\")} — it must be a ` +\n \"PUBLIC GitHub repo you own; the curated manifest is committed there and the \" +\n \"store pins to that commit.\",\n );\n process.exit(1);\n }\n if (opts.sidecarRepo) saveSidecarRepo(slug, sidecarRepoUrl);\n\n const { commitSha } = pushSidecarManifest({ sidecarRepoUrl, manifestText: publishedText, spawn });\n logOk(`Pushed curated manifest to ${S.dim(sidecarRepoUrl)} @ ${commitSha.slice(0, 10)}.`);\n\n // The FOREIGN repo's ref to ingest (branch/sha). Defaults to `main`.\n const sourceRef = opts.ref ?? \"main\";\n\n const { published } = await publishToStore({\n sourceUrl: url,\n ref: sourceRef,\n sidecar: { url: sidecarRepoUrl, ref: commitSha },\n manifest: normalized,\n client: pub,\n });\n\n if (published.length > 0) {\n logInfo(`Consumers can now install them with \\`skaile add ${published[0]}\\`.`);\n }\n}\n\n/**\n * `source manifest yank <src>` — unpublish the source's published assets (all,\n * or the single asset matching `opts.asset`'s name). Auth-gated like publish.\n */\nexport async function runYank(\n arg: string,\n opts: { projectDir: string; asset?: string },\n client?: PublisherClient,\n): Promise<void> {\n const injected = client !== undefined;\n const pub = client ?? makeHttpPublisherClient();\n\n const { url, slug } = resolveSourceArg(arg, opts.projectDir);\n\n if (!injected && !isStoreAuthenticated()) {\n logErr(\"Not signed in — run `skaile store login` first.\");\n process.exit(1);\n }\n\n const rows = await pub.sourcesList();\n const source = rows.find((r) => r.url === url);\n if (!source) {\n logErr(`Source \"${slug}\" is not registered in the store — nothing to yank.`);\n process.exit(1);\n }\n\n // Optionally narrow to a single asset by name (accept a bare name or a ref).\n const targetName = opts.asset ? bareName(opts.asset) : undefined;\n const candidates = (await pub.sourceCandidates(source.id)).filter(\n (c) => c.published && (!targetName || c.name === targetName),\n );\n if (candidates.length === 0) {\n logWarn(\"No published assets matched — nothing to yank.\");\n return;\n }\n\n const yanked: string[] = [];\n for (const c of candidates) {\n try {\n await pub.assetUnpublish(c.id);\n yanked.push(`${c.kind}:${c.name}`);\n } catch (err) {\n logWarn(\n `Failed to yank ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`,\n );\n }\n }\n\n logOk(`Yanked ${yanked.length} asset(s):`);\n for (const r of yanked) logInfo(` ${r}`);\n}\n"]}