@skaile/workspaces 3.27.1 → 4.0.0

package/dist/{chunk-SIREWRZE.js.map → chunk-KW7YIRYL.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../connectors/src/materialized-connectors.ts","../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;;;AAiBO,SAAS,2BAAA,CAA4B,UAAkB,IAAA,EAAoC;AAChG,EAAA,MAAM,EAAE,MAAM,IAAA,EAAM,IAAA,KAAS,gBAAA,CAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAC5E,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,IAAI,CAAA;AACnC,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,EAAA;AAAA,IACA,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,MAAA,KAAW,YAAA,GAAe,YAAA,GAAe;AAAA,GACxD;AACA,EAAA,IAAI,OAAO,KAAK,KAAA,KAAU,QAAA,IAAY,KAAK,KAAA,EAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AACpE,EAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpD,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,QAAA,IAAY,KAAK,cAAA,EAAgB;AAClE,IAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,cAAA;AAAA,EAC7B;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,OAAA,IAAW,IAAA,CAAK,SAAS,MAAA,EAAQ,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpE,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACpF,IAAA,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AAAA,EACtB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,IAAA,CAAK,KAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA;AAAA,MAC7B,GAAI,CAAA,CAAE,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA,EAAE,GAAI,EAAC;AAAA,MAC7D,GAAI,OAAO,CAAA,CAAE,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,MACzD,GAAI,OAAO,CAAA,CAAE,iBAAA,KAAsB,SAAA,GAC/B,EAAE,iBAAA,EAAmB,CAAA,CAAE,iBAAA,EAAkB,GACzC,EAAC;AAAA,MACL,GAAI,OAAO,CAAA,CAAE,cAAA,KAAmB,QAAA,GAAW,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI;AAAC,KACrF;AAAA,EACF;AACA,EAAA,MAAM,WAAA,GAAc,KAAK,IAAA,EAAK;AAC9B,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,YAAA,GAAe,WAAA;AAChD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,kBAAA,CAAmB,MAA4B,YAAA,EAA4B;AAClF,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,YAAA,EAAc,MAAM,CAAC,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACpE,EAAA,IAAA,CAAK,OAAA,GAAU,EAAE,GAAI,MAAA,EAAoC,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACnF;AAGO,SAAS,4CAAA,CACd,oBACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,kBAAA,EAAoB,IAAI,CAAA;AACzC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACnC,EAAA,IAAI,CAAC,UAAA,CAAW,EAAE,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,2BAAA,CAA4B,EAAA,EAAI,IAAI,CAAA;AACjD,EAAA,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,gBAAgB,CAAC,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,sCAAsC,UAAA,EAA4C;AAChG,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,0BAA0B,CAAA;AACxD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAC/B,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAC3B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,CAAE,aAAY,EAAG;AAClC,MAAA,MAAM,IAAA,GAAO,4CAAA,CAA6C,IAAA,EAAM,IAAI,CAAA;AACpE,MAAA,IAAI,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;;;ACpFA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAIT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,GAAA,IAAO,EAAE,CAAA,EAAG;AAC9D,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,EAAO,EAAE,IAAI,IAAI,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,GAAA,CAAI,IAAA,EAAqC,EAAA,EAAY,IAAA,EAAiC;AACpF,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAAqC,EAAA,EAAqB;AAC9D,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAAqC,EAAA,EAA6C;AACxF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,CAAA;AACrF,MAAA,OAAO,MAAA;AACT,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB;AAAA,EACrB,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,SAAS,iBAAiB,KAAA,EAAwB;AACvD,EAAA,OAAO,SAAA,CAAU,KAAK,CAAA,KAAM,MAAA;AAC9B;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AC/bA,IAAM,YAAY,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,UAAU,CAAA;AAahE,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GACJ,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,UAAA,CAAW,MAAA,GAAS,CAAA,GAC5C,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA,GACrD,EAAC;AAKP,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,KAAA,MAAW,KAAK,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAC3C,EAAA,KAAA,MAAW,CAAA,IAAK,qCAAA,CAAsC,UAAU,CAAA,EAAG;AACjE,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AAClB,MAAA,SAAA,CAAU,IAAA;AAAA,QACR,CAAA,wBAAA,EAA2B,EAAE,EAAE,CAAA,+CAAA;AAAA,OACjC;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAA,EAAI,CAAC,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAG9C,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAqBO,SAAS,6BACd,QAAA,EACwB;AAGxB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,EAA6B,IAAA,KAAqC;AAC7F,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG;AACrB,MAAA,SAAA,CAAU,IAAA,CAAK,CAAA,kCAAA,EAAqC,IAAI,CAAA,sBAAA,CAAA,EAA0B;AAAA,QAChF,IAAI,IAAA,CAAK;AAAA,OACV,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAA,EAAI,IAAI,CAAA;AAAA,EACxB,CAAA;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AAErC,IAAA,IACE,OAAO,CAAA,EAAG,EAAA,KAAO,QAAA,IACjB,OAAO,CAAA,EAAG,MAAA,KAAW,QAAA,IACrB,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EACpB;AACA,MAAA,SAAA,CAAU,KAAK,oEAAA,EAAsE;AAAA,QACnF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,MACpB,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,KAAA,EAAO;AAAA,QACL,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,OAAO,CAAA,CAAE,KAAA;AAAA,QACT,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE;AAAA;AACpB,KACF;AAEA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,SAAS,IAAI,CAAA;AAAA,EACnC;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,UAAA,IAAc,EAAC,EAAG;AACzC,IAAA,IAAI,OAAO,CAAA,EAAG,EAAA,KAAO,YAAY,OAAO,CAAA,EAAG,WAAW,QAAA,EAAU;AAC9D,MAAA,SAAA,CAAU,KAAK,iEAAA,EAAmE;AAAA,QAChF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,MACpB,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE;AAAA,KACb;AACA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,aAAa,IAAI,CAAA;AAAA,EACvC;AAEA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD","file":"chunk-SIREWRZE.js","sourcesContent":["/**\n * Derive runtime connector declarations from the platform-materialized\n * `.skaile/assets/connector/<name>/CONNECTOR.md` projection.\n *\n * Connector mirror of MCP's `loadMaterializedMcpDeclarations` /\n * `deriveSingleMaterializedMcpDeclaration`. The generated `CONNECTOR.md` carries\n * a RUNTIME declaration (driver/access/auth/mode/options/mount) — distinct from\n * the catalog `CONNECTOR.md` parsed by `core/manifest.ts:fromConnectorMd`\n * (entry/fields). Driver is referenced by name (first-party; resolved via the\n * connector registry — no code-loading).\n */\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { parseFrontmatter } from \"@skaile/workspaces/core\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/** Parse a generated CONNECTOR.md (runtime projection) into a ConnectorDeclaration. */\nexport function fromMaterializedConnectorMd(filePath: string, name: string): ConnectorDeclaration {\n  const { data: meta, body } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n  const id = String(meta.name ?? name);\n  const decl: ConnectorDeclaration = {\n    id,\n    driver: String(meta.driver ?? \"\"),\n    access: meta.access === \"read-write\" ? \"read-write\" : \"read-only\",\n  };\n  if (typeof meta.label === \"string\" && meta.label) decl.label = meta.label;\n  if (typeof meta.auth === \"string\") decl.auth = meta.auth;\n  if (typeof meta.providerLinkId === \"string\" && meta.providerLinkId) {\n    decl.providerLinkId = meta.providerLinkId;\n  }\n  if (meta.mode === \"agent\" || meta.mode === \"sync\") decl.mode = meta.mode;\n  if (meta.options && typeof meta.options === \"object\" && !Array.isArray(meta.options)) {\n    decl.options = meta.options as Record<string, unknown>;\n  }\n  if (meta.mount && typeof meta.mount === \"object\" && !Array.isArray(meta.mount)) {\n    const m = meta.mount as Record<string, unknown>;\n    decl.mount = {\n      source: String(m.source ?? \"\"),\n      ...(m.target !== undefined ? { target: String(m.target) } : {}),\n      ...(typeof m.watch === \"boolean\" ? { watch: m.watch } : {}),\n      ...(typeof m.exposeAccessToken === \"boolean\"\n        ? { exposeAccessToken: m.exposeAccessToken }\n        : {}),\n      ...(typeof m.accessTokenTTL === \"number\" ? { accessTokenTTL: m.accessTokenTTL } : {}),\n    };\n  }\n  const trimmedBody = body.trim();\n  if (trimmedBody.length > 0) decl.instructions = trimmedBody;\n  return decl;\n}\n\n/** Provide `.instance.json` config entries as defaults under the declaration's options (the CONNECTOR.md declaration wins on key collision). */\nfunction foldInstanceConfig(decl: ConnectorDeclaration, instancePath: string): void {\n  if (!existsSync(instancePath)) return;\n  let parsed: { config?: Record<string, unknown> };\n  try {\n    parsed = JSON.parse(readFileSync(instancePath, \"utf8\"));\n  } catch {\n    return;\n  }\n  const config = parsed.config;\n  if (!config || typeof config !== \"object\" || Array.isArray(config)) return;\n  decl.options = { ...(config as Record<string, unknown>), ...(decl.options ?? {}) };\n}\n\n/** Derive a single materialized connector declaration; null when no CONNECTOR.md. */\nexport function deriveSingleMaterializedConnectorDeclaration(\n  connectorAssetsDir: string,\n  name: string,\n): ConnectorDeclaration | null {\n  const sub = join(connectorAssetsDir, name);\n  const md = join(sub, \"CONNECTOR.md\");\n  if (!existsSync(md)) return null;\n  const decl = fromMaterializedConnectorMd(md, name);\n  foldInstanceConfig(decl, join(sub, \".instance.json\"));\n  return decl;\n}\n\n/** Scan `<projectDir>/.skaile/assets/connector/*` for materialized connectors. */\nexport function loadMaterializedConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const root = join(projectDir, \".skaile/assets/connector\");\n  if (!existsSync(root)) return [];\n  const out: ConnectorDeclaration[] = [];\n  for (const name of readdirSync(root)) {\n    try {\n      const sub = join(root, name);\n      if (!statSync(sub).isDirectory()) continue;\n      const decl = deriveSingleMaterializedConnectorDeclaration(root, name);\n      if (decl) out.push(decl);\n    } catch {\n      // Per-directory failure is isolated — one bad asset never aborts the scan.\n    }\n  }\n  return out;\n}\n","/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>`, `connector:<id>`, and `mcp:<id>`.\n * Returns `undefined` for any other ref so the chain falls through to the\n * next provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capabilities\n * stay strictly in-process — no round trip to the platform to mint while\n * the resource is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors, mcp }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n    mcp?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.mcp ?? {})) {\n      this.mints.set(`mcp:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capability\n   * handlers when the platform delivers new credentials mid-session.\n   */\n  set(kind: \"mount\" | \"connector\" | \"mcp\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\" | \"mcp\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` / `mcp:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\" | \"mcp\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\") || ref.startsWith(\"mcp:\")))\n      return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\n  \"env:\",\n  \"vault:\",\n  \"forge:\",\n  \"op:\",\n  \"kp:\",\n  \"oauth:\",\n  \"mount:\",\n  \"connector:\",\n  \"mcp:\",\n] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * True when `value` starts with a known secret-ref prefix (`env:`, `oauth:`,\n * `mcp:`, ...). Lets callers distinguish an intended-but-unresolved ref from a\n * plain literal — e.g. the runner refuses to forward an unresolved ref into\n * MCP transport headers/env, where the literal would otherwise leak onto the\n * wire and produce a misleading upstream error.\n */\nexport function isKnownSecretRef(value: string): boolean {\n  return getPrefix(value) !== undefined;\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\nimport type { ResolvedSkaileConfig } from \"@skaile/workspaces/types\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\nimport { loadMaterializedConnectorDeclarations } from \"./materialized-connectors.js\";\n\nconst configLog = createLogger({ kind: \"connector\", subkind: \"config\" });\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Merged array of connector declarations from `skaile.yaml` and the materialized\n *   `.skaile/assets/connector/*` disk projection (Phase 2.5); empty array if neither source\n *   contributes any entries. `skaile.yaml` wins on id collision.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  const yamlDecls =\n    config.connectors && config.connectors.length > 0\n      ? config.connectors.map(workspaceConnectorToDeclaration)\n      : [];\n\n  // Library-assigned connectors reach the runner via the materialized disk\n  // projection (Phase 2.5). skaile.yaml is explicit user config — it wins on id\n  // collision; the shadowed materialized connector is logged, not silently dropped.\n  const byId = new Map<string, ConnectorDeclaration>();\n  for (const d of yamlDecls) byId.set(d.id, d);\n  for (const d of loadMaterializedConnectorDeclarations(projectDir)) {\n    if (byId.has(d.id)) {\n      configLog.warn(\n        `materialized connector '${d.id}' shadowed by an explicit skaile.yaml connector`,\n      );\n      continue;\n    }\n    byId.set(d.id, d);\n  }\n  return [...byId.values()];\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n\n  // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n  if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  }\n\n  return decl;\n}\n\n/**\n * Map a Protocol v3 `session_init` `resolvedConfig` to `ConnectorDeclaration[]`.\n *\n * Wire mounts are flat (`source` / `target` / `watch` top-level per\n * `ResolvedSkaileConfig`); declarations carry them in the `mount:` sub-block.\n * Wire `connectors` (tool-face) map without a mount block. Malformed entries\n * (missing `id`, `driver`, or — for mounts — `source`) are logged and dropped,\n * never thrown: one bad wire entry must not kill session boot. Duplicate ids\n * (within or across the two arrays) keep the FIRST occurrence — mounts precede\n * connectors — and the shadowed entry is logged and dropped the same way.\n *\n * Pure function, no I/O. Used by the runner as the disk-first fallback when\n * `skaile.yaml` declares no connectors (e.g. broker mode, where only the\n * workspace subdirectory is bound and no yaml file exists).\n *\n * @param resolved - `mounts` / `connectors` arrays from the platform-resolved config.\n * @returns Declarations in wire order — mounts first, then connectors.\n * @docLink packages/connectors/api-reference#resolved-config-to-declarations\n */\nexport function resolvedConfigToDeclarations(\n  resolved: Pick<ResolvedSkaileConfig, \"mounts\" | \"connectors\">,\n): ConnectorDeclaration[] {\n  // Keyed by id: the wire carries no well-formedness guarantee, and a duplicate\n  // id downstream would collide on mount paths / tool namespaces. First wins.\n  const byId = new Map<string, ConnectorDeclaration>();\n  const pushUnlessDuplicate = (kind: \"mount\" | \"connector\", decl: ConnectorDeclaration): void => {\n    if (byId.has(decl.id)) {\n      configLog.warn(`dropping duplicate resolvedConfig ${kind} (id already declared)`, {\n        id: decl.id,\n      });\n      return;\n    }\n    byId.set(decl.id, decl);\n  };\n\n  for (const m of resolved.mounts ?? []) {\n    // A mount without a source cannot connect — drop it with the malformed ones.\n    if (\n      typeof m?.id !== \"string\" ||\n      typeof m?.driver !== \"string\" ||\n      typeof m.source !== \"string\"\n    ) {\n      configLog.warn(\"dropping malformed resolvedConfig mount (missing id/driver/source)\", {\n        id: (m as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: m.id,\n      driver: m.driver,\n      access: m.access ?? \"read-only\",\n      auth: m.auth,\n      options: m.options,\n      mount: {\n        source: m.source,\n        target: m.target,\n        watch: m.watch,\n        exposeAccessToken: m.exposeAccessToken,\n        accessTokenTTL: m.accessTokenTTL,\n      },\n    };\n    // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n    if (m.providerLinkId) decl.providerLinkId = m.providerLinkId;\n    pushUnlessDuplicate(\"mount\", decl);\n  }\n\n  for (const c of resolved.connectors ?? []) {\n    if (typeof c?.id !== \"string\" || typeof c?.driver !== \"string\") {\n      configLog.warn(\"dropping malformed resolvedConfig connector (missing id/driver)\", {\n        id: (c as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: c.id,\n      driver: c.driver,\n      access: c.access ?? \"read-only\",\n      auth: c.auth,\n      options: c.options,\n    };\n    if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n    pushUnlessDuplicate(\"connector\", decl);\n  }\n\n  return [...byId.values()];\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n"]}
+{"version":3,"sources":["../connectors/src/materialized-connectors.ts","../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;;;AAiBO,SAAS,2BAAA,CAA4B,UAAkB,IAAA,EAAoC;AAChG,EAAA,MAAM,EAAE,MAAM,IAAA,EAAM,IAAA,KAAS,gBAAA,CAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAC5E,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,IAAI,CAAA;AACnC,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,EAAA;AAAA,IACA,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,MAAA,KAAW,YAAA,GAAe,YAAA,GAAe;AAAA,GACxD;AACA,EAAA,IAAI,OAAO,KAAK,KAAA,KAAU,QAAA,IAAY,KAAK,KAAA,EAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AACpE,EAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpD,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,QAAA,IAAY,KAAK,cAAA,EAAgB;AAClE,IAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,cAAA;AAAA,EAC7B;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,OAAA,IAAW,IAAA,CAAK,SAAS,MAAA,EAAQ,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpE,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACpF,IAAA,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AAAA,EACtB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,IAAA,CAAK,KAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA;AAAA,MAC7B,GAAI,CAAA,CAAE,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA,EAAE,GAAI,EAAC;AAAA,MAC7D,GAAI,OAAO,CAAA,CAAE,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,MACzD,GAAI,OAAO,CAAA,CAAE,iBAAA,KAAsB,SAAA,GAC/B,EAAE,iBAAA,EAAmB,CAAA,CAAE,iBAAA,EAAkB,GACzC,EAAC;AAAA,MACL,GAAI,OAAO,CAAA,CAAE,cAAA,KAAmB,QAAA,GAAW,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI;AAAC,KACrF;AAAA,EACF;AACA,EAAA,MAAM,WAAA,GAAc,KAAK,IAAA,EAAK;AAC9B,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,YAAA,GAAe,WAAA;AAChD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,kBAAA,CAAmB,MAA4B,YAAA,EAA4B;AAClF,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,YAAA,EAAc,MAAM,CAAC,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACpE,EAAA,IAAA,CAAK,OAAA,GAAU,EAAE,GAAI,MAAA,EAAoC,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACnF;AAGO,SAAS,4CAAA,CACd,oBACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,kBAAA,EAAoB,IAAI,CAAA;AACzC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACnC,EAAA,IAAI,CAAC,UAAA,CAAW,EAAE,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,2BAAA,CAA4B,EAAA,EAAI,IAAI,CAAA;AACjD,EAAA,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,gBAAgB,CAAC,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,sCAAsC,UAAA,EAA4C;AAChG,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,0BAA0B,CAAA;AACxD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAC/B,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAC3B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,CAAE,aAAY,EAAG;AAClC,MAAA,MAAM,IAAA,GAAO,4CAAA,CAA6C,IAAA,EAAM,IAAI,CAAA;AACpE,MAAA,IAAI,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;;;ACpFA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAIT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,GAAA,IAAO,EAAE,CAAA,EAAG;AAC9D,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,EAAO,EAAE,IAAI,IAAI,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,GAAA,CAAI,IAAA,EAAqC,EAAA,EAAY,IAAA,EAAiC;AACpF,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAAqC,EAAA,EAAqB;AAC9D,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAAqC,EAAA,EAA6C;AACxF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,CAAA;AACrF,MAAA,OAAO,MAAA;AACT,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB;AAAA,EACrB,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,SAAS,iBAAiB,KAAA,EAAwB;AACvD,EAAA,OAAO,SAAA,CAAU,KAAK,CAAA,KAAM,MAAA;AAC9B;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AC/bA,IAAM,YAAY,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,UAAU,CAAA;AAahE,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GACJ,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,UAAA,CAAW,MAAA,GAAS,CAAA,GAC5C,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,+BAA+B,CAAA,GACrD,EAAC;AAKP,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,KAAA,MAAW,KAAK,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAC3C,EAAA,KAAA,MAAW,CAAA,IAAK,qCAAA,CAAsC,UAAU,CAAA,EAAG;AACjE,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AAClB,MAAA,SAAA,CAAU,IAAA;AAAA,QACR,CAAA,wBAAA,EAA2B,EAAE,EAAE,CAAA,+CAAA;AAAA,OACjC;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAA,EAAI,CAAC,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAEA,SAAS,gCAAgC,CAAA,EAA6C;AACpF,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AAGA,EAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAG9C,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAqBO,SAAS,6BACd,QAAA,EACwB;AAGxB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,EAA6B,IAAA,KAAqC;AAC7F,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG;AACrB,MAAA,SAAA,CAAU,IAAA,CAAK,CAAA,kCAAA,EAAqC,IAAI,CAAA,sBAAA,CAAA,EAA0B;AAAA,QAChF,IAAI,IAAA,CAAK;AAAA,OACV,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAA,EAAI,IAAI,CAAA;AAAA,EACxB,CAAA;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AAErC,IAAA,IACE,OAAO,CAAA,EAAG,EAAA,KAAO,QAAA,IACjB,OAAO,CAAA,EAAG,MAAA,KAAW,QAAA,IACrB,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EACpB;AACA,MAAA,SAAA,CAAU,KAAK,oEAAA,EAAsE;AAAA,QACnF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,MACpB,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,KAAA,EAAO;AAAA,QACL,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,OAAO,CAAA,CAAE,KAAA;AAAA,QACT,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE;AAAA;AACpB,KACF;AAEA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,SAAS,IAAI,CAAA;AAAA,EACnC;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,UAAA,IAAc,EAAC,EAAG;AACzC,IAAA,IAAI,OAAO,CAAA,EAAG,EAAA,KAAO,YAAY,OAAO,CAAA,EAAG,WAAW,QAAA,EAAU;AAC9D,MAAA,SAAA,CAAU,KAAK,iEAAA,EAAmE;AAAA,QAChF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,MACpB,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE;AAAA,KACb;AACA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,aAAa,IAAI,CAAA;AAAA,EACvC;AAEA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD","file":"chunk-KW7YIRYL.js","sourcesContent":["/**\n * Derive runtime connector declarations from the platform-materialized\n * `.skaile/assets/connector/<name>/CONNECTOR.md` projection.\n *\n * Connector mirror of MCP's `loadMaterializedMcpDeclarations` /\n * `deriveSingleMaterializedMcpDeclaration`. The generated `CONNECTOR.md` carries\n * a RUNTIME declaration (driver/access/auth/mode/options/mount) — distinct from\n * the catalog `CONNECTOR.md` parsed by `core/manifest.ts:fromConnectorMd`\n * (entry/fields). Driver is referenced by name (first-party; resolved via the\n * connector registry — no code-loading).\n */\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { parseFrontmatter } from \"@skaile/workspaces/core\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/** Parse a generated CONNECTOR.md (runtime projection) into a ConnectorDeclaration. */\nexport function fromMaterializedConnectorMd(filePath: string, name: string): ConnectorDeclaration {\n  const { data: meta, body } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n  const id = String(meta.name ?? name);\n  const decl: ConnectorDeclaration = {\n    id,\n    driver: String(meta.driver ?? \"\"),\n    access: meta.access === \"read-write\" ? \"read-write\" : \"read-only\",\n  };\n  if (typeof meta.label === \"string\" && meta.label) decl.label = meta.label;\n  if (typeof meta.auth === \"string\") decl.auth = meta.auth;\n  if (typeof meta.providerLinkId === \"string\" && meta.providerLinkId) {\n    decl.providerLinkId = meta.providerLinkId;\n  }\n  if (meta.mode === \"agent\" || meta.mode === \"sync\") decl.mode = meta.mode;\n  if (meta.options && typeof meta.options === \"object\" && !Array.isArray(meta.options)) {\n    decl.options = meta.options as Record<string, unknown>;\n  }\n  if (meta.mount && typeof meta.mount === \"object\" && !Array.isArray(meta.mount)) {\n    const m = meta.mount as Record<string, unknown>;\n    decl.mount = {\n      source: String(m.source ?? \"\"),\n      ...(m.target !== undefined ? { target: String(m.target) } : {}),\n      ...(typeof m.watch === \"boolean\" ? { watch: m.watch } : {}),\n      ...(typeof m.exposeAccessToken === \"boolean\"\n        ? { exposeAccessToken: m.exposeAccessToken }\n        : {}),\n      ...(typeof m.accessTokenTTL === \"number\" ? { accessTokenTTL: m.accessTokenTTL } : {}),\n    };\n  }\n  const trimmedBody = body.trim();\n  if (trimmedBody.length > 0) decl.instructions = trimmedBody;\n  return decl;\n}\n\n/** Provide `.instance.json` config entries as defaults under the declaration's options (the CONNECTOR.md declaration wins on key collision). */\nfunction foldInstanceConfig(decl: ConnectorDeclaration, instancePath: string): void {\n  if (!existsSync(instancePath)) return;\n  let parsed: { config?: Record<string, unknown> };\n  try {\n    parsed = JSON.parse(readFileSync(instancePath, \"utf8\"));\n  } catch {\n    return;\n  }\n  const config = parsed.config;\n  if (!config || typeof config !== \"object\" || Array.isArray(config)) return;\n  decl.options = { ...(config as Record<string, unknown>), ...(decl.options ?? {}) };\n}\n\n/** Derive a single materialized connector declaration; null when no CONNECTOR.md. */\nexport function deriveSingleMaterializedConnectorDeclaration(\n  connectorAssetsDir: string,\n  name: string,\n): ConnectorDeclaration | null {\n  const sub = join(connectorAssetsDir, name);\n  const md = join(sub, \"CONNECTOR.md\");\n  if (!existsSync(md)) return null;\n  const decl = fromMaterializedConnectorMd(md, name);\n  foldInstanceConfig(decl, join(sub, \".instance.json\"));\n  return decl;\n}\n\n/** Scan `<projectDir>/.skaile/assets/connector/*` for materialized connectors. */\nexport function loadMaterializedConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const root = join(projectDir, \".skaile/assets/connector\");\n  if (!existsSync(root)) return [];\n  const out: ConnectorDeclaration[] = [];\n  for (const name of readdirSync(root)) {\n    try {\n      const sub = join(root, name);\n      if (!statSync(sub).isDirectory()) continue;\n      const decl = deriveSingleMaterializedConnectorDeclaration(root, name);\n      if (decl) out.push(decl);\n    } catch {\n      // Per-directory failure is isolated — one bad asset never aborts the scan.\n    }\n  }\n  return out;\n}\n","/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>`, `connector:<id>`, and `mcp:<id>`.\n * Returns `undefined` for any other ref so the chain falls through to the\n * next provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capabilities\n * stay strictly in-process — no round trip to the platform to mint while\n * the resource is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors, mcp }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n    mcp?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.mcp ?? {})) {\n      this.mints.set(`mcp:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capability\n   * handlers when the platform delivers new credentials mid-session.\n   */\n  set(kind: \"mount\" | \"connector\" | \"mcp\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\" | \"mcp\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` / `mcp:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\" | \"mcp\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\") || ref.startsWith(\"mcp:\")))\n      return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\n  \"env:\",\n  \"vault:\",\n  \"forge:\",\n  \"op:\",\n  \"kp:\",\n  \"oauth:\",\n  \"mount:\",\n  \"connector:\",\n  \"mcp:\",\n] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * True when `value` starts with a known secret-ref prefix (`env:`, `oauth:`,\n * `mcp:`, ...). Lets callers distinguish an intended-but-unresolved ref from a\n * plain literal — e.g. the runner refuses to forward an unresolved ref into\n * MCP transport headers/env, where the literal would otherwise leak onto the\n * wire and produce a misleading upstream error.\n */\nexport function isKnownSecretRef(value: string): boolean {\n  return getPrefix(value) !== undefined;\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ConnectorDeclaration as WorkspaceConnector } from \"@skaile/workspaces/core\";\nimport { resolveSkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\nimport type { ResolvedSkaileConfig } from \"@skaile/workspaces/types\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\nimport { loadMaterializedConnectorDeclarations } from \"./materialized-connectors.js\";\n\nconst configLog = createLogger({ kind: \"connector\", subkind: \"config\" });\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Merged array of connector declarations from `skaile.yaml` and the materialized\n *   `.skaile/assets/connector/*` disk projection (Phase 2.5); empty array if neither source\n *   contributes any entries. `skaile.yaml` wins on id collision.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  const yamlDecls =\n    config.connectors && config.connectors.length > 0\n      ? config.connectors.map(workspaceConnectorToDeclaration)\n      : [];\n\n  // Library-assigned connectors reach the runner via the materialized disk\n  // projection (Phase 2.5). skaile.yaml is explicit user config — it wins on id\n  // collision; the shadowed materialized connector is logged, not silently dropped.\n  const byId = new Map<string, ConnectorDeclaration>();\n  for (const d of yamlDecls) byId.set(d.id, d);\n  for (const d of loadMaterializedConnectorDeclarations(projectDir)) {\n    if (byId.has(d.id)) {\n      configLog.warn(\n        `materialized connector '${d.id}' shadowed by an explicit skaile.yaml connector`,\n      );\n      continue;\n    }\n    byId.set(d.id, d);\n  }\n  return [...byId.values()];\n}\n\nfunction workspaceConnectorToDeclaration(c: WorkspaceConnector): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n\n  // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n  if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  }\n\n  return decl;\n}\n\n/**\n * Map a Protocol v3 `session_init` `resolvedConfig` to `ConnectorDeclaration[]`.\n *\n * Wire mounts are flat (`source` / `target` / `watch` top-level per\n * `ResolvedSkaileConfig`); declarations carry them in the `mount:` sub-block.\n * Wire `connectors` (tool-face) map without a mount block. Malformed entries\n * (missing `id`, `driver`, or — for mounts — `source`) are logged and dropped,\n * never thrown: one bad wire entry must not kill session boot. Duplicate ids\n * (within or across the two arrays) keep the FIRST occurrence — mounts precede\n * connectors — and the shadowed entry is logged and dropped the same way.\n *\n * Pure function, no I/O. Used by the runner as the disk-first fallback when\n * `skaile.yaml` declares no connectors (e.g. broker mode, where only the\n * workspace subdirectory is bound and no yaml file exists).\n *\n * @param resolved - `mounts` / `connectors` arrays from the platform-resolved config.\n * @returns Declarations in wire order — mounts first, then connectors.\n * @docLink packages/connectors/api-reference#resolved-config-to-declarations\n */\nexport function resolvedConfigToDeclarations(\n  resolved: Pick<ResolvedSkaileConfig, \"mounts\" | \"connectors\">,\n): ConnectorDeclaration[] {\n  // Keyed by id: the wire carries no well-formedness guarantee, and a duplicate\n  // id downstream would collide on mount paths / tool namespaces. First wins.\n  const byId = new Map<string, ConnectorDeclaration>();\n  const pushUnlessDuplicate = (kind: \"mount\" | \"connector\", decl: ConnectorDeclaration): void => {\n    if (byId.has(decl.id)) {\n      configLog.warn(`dropping duplicate resolvedConfig ${kind} (id already declared)`, {\n        id: decl.id,\n      });\n      return;\n    }\n    byId.set(decl.id, decl);\n  };\n\n  for (const m of resolved.mounts ?? []) {\n    // A mount without a source cannot connect — drop it with the malformed ones.\n    if (\n      typeof m?.id !== \"string\" ||\n      typeof m?.driver !== \"string\" ||\n      typeof m.source !== \"string\"\n    ) {\n      configLog.warn(\"dropping malformed resolvedConfig mount (missing id/driver/source)\", {\n        id: (m as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: m.id,\n      driver: m.driver,\n      access: m.access ?? \"read-only\",\n      auth: m.auth,\n      options: m.options,\n      mount: {\n        source: m.source,\n        target: m.target,\n        watch: m.watch,\n        exposeAccessToken: m.exposeAccessToken,\n        accessTokenTTL: m.accessTokenTTL,\n      },\n    };\n    // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n    if (m.providerLinkId) decl.providerLinkId = m.providerLinkId;\n    pushUnlessDuplicate(\"mount\", decl);\n  }\n\n  for (const c of resolved.connectors ?? []) {\n    if (typeof c?.id !== \"string\" || typeof c?.driver !== \"string\") {\n      configLog.warn(\"dropping malformed resolvedConfig connector (missing id/driver)\", {\n        id: (c as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: c.id,\n      driver: c.driver,\n      access: c.access ?? \"read-only\",\n      auth: c.auth,\n      options: c.options,\n    };\n    if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n    pushUnlessDuplicate(\"connector\", decl);\n  }\n\n  return [...byId.values()];\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n"]}

package/dist/{chunk-3U3ZKYR7.js → chunk-LN2BQVRB.js}

@@ -1,8 +1,133 @@
 import { classifyGenericErrorMessage } from './chunk-GAH4YRCI.js';
-import { AgentDriver } from './chunk-AQW4BWNR.js';
+import { getProviderPreset, registryCredentialEnv, providerCredentialEnvName, AgentDriver, BUILTIN_DRIVER_CATALOG } from './chunk-SG4D2UOK.js';
+import { mergeRegistries, resolveEntryBaseUrl, registryEntries, isEntryEnabled, parseModelRef } from './chunk-ILG4BXYE.js';
 import { spawn } from 'child_process';
 import { createInterface } from 'readline';
 
+// bridge/src/provider-materialize/env-drivers.ts
+function resolveEnvDriverSession(config, processEnv = process.env) {
+  return {
+    registry: config.registry ?? mergeRegistries([]),
+    lookupEnv: { ...processEnv, ...config.env },
+    ...config.modelRef ? { modelRef: config.modelRef } : {},
+    ...config.roles ? { roles: config.roles } : {}
+  };
+}
+function entrySurface(entry) {
+  if (entry.surface) return entry.surface;
+  return entry.preset ? getProviderPreset(entry.preset)?.surface : void 0;
+}
+function entryBaseUrl(entry) {
+  const resolved = resolveEntryBaseUrl(entry);
+  if (resolved) return resolved;
+  return entry.preset ? getProviderPreset(entry.preset)?.base_url : void 0;
+}
+function isStockCatalogEndpoint(entry) {
+  const preset = entry.preset ? getProviderPreset(entry.preset) : void 0;
+  return preset !== void 0 && entryBaseUrl(entry) === preset.base_url;
+}
+function backendProviderName(providerId, entry) {
+  const preset = entry.preset ? getProviderPreset(entry.preset) : void 0;
+  if (!preset || !isStockCatalogEndpoint(entry)) return providerId;
+  return preset.id;
+}
+function selectableEntries(registry) {
+  return registryEntries(registry).filter(
+    (pair) => (pair[1].kind === "llm" || pair[1].kind === "embed") && isEntryEnabled(pair[1])
+  );
+}
+function entryModelIds(entry) {
+  const logicalIds = [
+    ...Object.keys(entry.model_map ?? {}),
+    ...Object.keys(entry.capabilities ?? {}).filter((id) => !(id in (entry.model_map ?? {})))
+  ];
+  return logicalIds.map((id) => [id, entry.model_map?.[id] ?? id]);
+}
+function describeBinding(providerId, entry, modelId, providerModelId, warnings) {
+  const surface = entrySurface(entry);
+  const baseUrl = entryBaseUrl(entry);
+  return {
+    providerId,
+    entry,
+    ...modelId === void 0 ? {} : { modelId },
+    ...providerModelId === void 0 ? {} : { providerModelId },
+    ...surface ? { surface } : {},
+    ...baseUrl ? { baseUrl } : {},
+    backendProviderId: backendProviderName(providerId, entry),
+    warnings
+  };
+}
+function resolveRegistryBinding(session) {
+  const entries = selectableEntries(session.registry);
+  if (entries.length === 0) return void 0;
+  const selector = session.modelRef?.trim();
+  if (!selector) {
+    const [providerId, entry] = entries[0];
+    return describeBinding(providerId, entry, void 0, void 0, []);
+  }
+  const named = entries.find(([id]) => id === selector);
+  if (named) return describeBinding(named[0], named[1], void 0, void 0, []);
+  const resolved = parseModelRef(selector, session.registry, session.roles);
+  if (!resolved) return void 0;
+  const match = entries.find(([id]) => id === resolved.providerId);
+  if (!match) return void 0;
+  return describeBinding(
+    match[0],
+    match[1],
+    resolved.modelId,
+    resolved.providerModelId,
+    resolved.warnings
+  );
+}
+function credentialsForEveryProvider(session) {
+  return registryCredentialEnv(session.registry, { env: session.lookupEnv });
+}
+function assertDriverSpeaksSurface(driverId, productName, binding) {
+  const supported = BUILTIN_DRIVER_CATALOG[driverId]?.surfaces;
+  if (!supported || supported.length === 0) return;
+  const surface = binding.surface;
+  if (!surface || supported.includes(surface)) return;
+  throw new Error(
+    `${productName} cannot speak the '${surface}' surface of AI provider entry '${binding.providerId}'. ${productName} speaks: ${supported.join(", ")}. Point this session's model at an entry with one of those surfaces, or run it on a driver that speaks '${surface}'.`
+  );
+}
+function registryModelEntries(session) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [providerId, entry] of selectableEntries(session.registry)) {
+    const backendId = backendProviderName(providerId, entry);
+    const label = entry.label ?? providerId;
+    for (const [logicalId, providerModelId] of entryModelIds(entry)) {
+      const id = `${backendId}/${providerModelId}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      out.push({ id, name: `${label} ${logicalId}` });
+    }
+  }
+  return out;
+}
+function bindSingleProviderEntry(driverId, productName, session) {
+  const binding = resolveRegistryBinding(session);
+  if (!binding) return void 0;
+  assertDriverSpeaksSurface(driverId, productName, binding);
+  return binding;
+}
+function backendModelSelector(binding) {
+  if (!binding.providerModelId) return void 0;
+  return `${binding.backendProviderId}/${binding.providerModelId}`;
+}
+function continueRoleBinding(session) {
+  const binding = resolveRegistryBinding(session);
+  if (!binding) return void 0;
+  return {
+    role: "chat",
+    providerId: binding.providerId,
+    provider: binding.backendProviderId,
+    ...binding.providerModelId ? { model: binding.providerModelId } : {},
+    ...binding.baseUrl ? { apiBase: binding.baseUrl } : {},
+    apiKeyEnv: providerCredentialEnvName(binding.providerId)
+  };
+}
 var SubprocessCliDriver = class extends AgentDriver {
   /** `"jsonl"` streams events line-by-line; `"buffered"` parses all stdout once on exit. */
   mode = "jsonl";
@@ -267,11 +392,17 @@ ${message}` : message;
   /**
    * Explicit env whitelist forwarded to the child. Omits anything provisioned
    * by `provision_secrets` so user credentials stay out of the subprocess
-   * environment. `config.env`, when supplied, fully overrides the whitelist.
-   * Always passes through the driver's test-seam vars and `FAKE_CLI_*`.
+   * environment. Always passes through the driver's test-seam vars and
+   * `FAKE_CLI_*`.
+   *
+   * `config.env` is merged **over** the whitelist, not in place of it. It used
+   * to replace it wholesale, which meant any caller that set a single variable
+   * silently dropped `PATH` and `HOME` and the spawn failed with ENOENT —
+   * unusable as the delivery channel for registry-derived endpoint variables
+   * (plan §2.3, "Delivery rule"). Widening keeps both: the caller's variables
+   * win per key, the process still has a `PATH`.
    */
   baseEnv(extraKeys = []) {
-    if (this.config.env) return { ...this.config.env };
     const out = {};
     const explicit = ["PATH", "HOME", "USER", "HOSTNAME", "SKAILE_SESSION_ID", ...extraKeys];
     for (const key of explicit) {
@@ -287,6 +418,7 @@ ${message}` : message;
     if (this.config.sshKeyPath) {
       out.GIT_SSH_COMMAND = `ssh -i "${this.config.sshKeyPath}" -o StrictHostKeyChecking=accept-new`;
     }
+    if (this.config.env) Object.assign(out, this.config.env);
     return out;
   }
   // ── Internals ────────────────────────────────────────────────────────────
@@ -417,29 +549,7 @@ function extractCost(json) {
   const c = json?.cost ?? json?.costUsd ?? json?.total_cost_usd ?? json?.stats?.cost ?? json?.usage?.cost;
   return typeof c === "number" ? c : void 0;
 }
-function mapApiKeysToEnv(apiKeys) {
-  if (!apiKeys) return {};
-  const map = {
-    anthropic: "ANTHROPIC_API_KEY",
-    openai: "OPENAI_API_KEY",
-    google: "GEMINI_API_KEY",
-    gemini: "GEMINI_API_KEY",
-    openrouter: "OPENROUTER_API_KEY",
-    groq: "GROQ_API_KEY",
-    mistral: "MISTRAL_API_KEY",
-    deepseek: "DEEPSEEK_API_KEY",
-    xai: "XAI_API_KEY",
-    together: "TOGETHER_API_KEY",
-    fireworks: "FIREWORKS_API_KEY"
-  };
-  const out = {};
-  for (const [provider, key] of Object.entries(apiKeys)) {
-    const envName = map[provider];
-    if (envName && key) out[envName] = key;
-  }
-  return out;
-}
 
-export { SubprocessCliDriver, extractCost, extractText, extractTokens, mapApiKeysToEnv };
-//# sourceMappingURL=chunk-3U3ZKYR7.js.map
-//# sourceMappingURL=chunk-3U3ZKYR7.js.map
+export { SubprocessCliDriver, backendModelSelector, backendProviderName, bindSingleProviderEntry, continueRoleBinding, credentialsForEveryProvider, entryBaseUrl, entryModelIds, entrySurface, extractCost, extractText, extractTokens, isStockCatalogEndpoint, registryModelEntries, resolveEnvDriverSession, resolveRegistryBinding, selectableEntries };
+//# sourceMappingURL=chunk-LN2BQVRB.js.map
+//# sourceMappingURL=chunk-LN2BQVRB.js.map

package/dist/chunk-LN2BQVRB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/provider-materialize/env-drivers.ts","../bridge/src/drivers/_subprocess-cli.ts"],"names":[],"mappings":";;;;;;;AAwEO,SAAS,uBAAA,CACd,MAAA,EACA,UAAA,GAAiD,OAAA,CAAQ,GAAA,EACvC;AAClB,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,MAAA,CAAO,QAAA,IAAY,eAAA,CAAgB,EAAE,CAAA;AAAA,IAC/C,WAAW,EAAE,GAAG,UAAA,EAAY,GAAG,OAAO,GAAA,EAAI;AAAA,IAC1C,GAAI,OAAO,QAAA,GAAW,EAAE,UAAU,MAAA,CAAO,QAAA,KAAa,EAAC;AAAA,IACvD,GAAI,OAAO,KAAA,GAAQ,EAAE,OAAO,MAAA,CAAO,KAAA,KAAU;AAAC,GAChD;AACF;AA2BO,SAAS,aAAa,KAAA,EAA0D;AACrF,EAAA,IAAI,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA,CAAM,OAAA;AAChC,EAAA,OAAO,MAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,GAAG,OAAA,GAAU,MAAA;AACnE;AAQO,SAAS,aAAa,KAAA,EAA+C;AAC1E,EAAA,MAAM,QAAA,GAAW,oBAAoB,KAAK,CAAA;AAC1C,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,OAAO,MAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,GAAG,QAAA,GAAW,MAAA;AACpE;AAaO,SAAS,uBAAuB,KAAA,EAAoC;AACzE,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,CAAA,GAAI,MAAA;AAChE,EAAA,OAAO,MAAA,KAAW,MAAA,IAAa,YAAA,CAAa,KAAK,MAAM,MAAA,CAAO,QAAA;AAChE;AAaO,SAAS,mBAAA,CAAoB,YAAoB,KAAA,EAAmC;AACzF,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,CAAA,GAAI,MAAA;AAChE,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,sBAAA,CAAuB,KAAK,GAAG,OAAO,UAAA;AACtD,EAAA,OAAO,MAAA,CAAO,EAAA;AAChB;AAQO,SAAS,kBACd,QAAA,EACqC;AACrC,EAAA,OAAO,eAAA,CAAgB,QAAQ,CAAA,CAAE,MAAA;AAAA,IAC/B,CAAC,IAAA,KAAA,CACE,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,KAAA,IAAS,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,OAAA,KAAY,cAAA,CAAe,IAAA,CAAK,CAAC,CAAC;AAAA,GAClF;AACF;AAOO,SAAS,cAAc,KAAA,EAAoD;AAChF,EAAA,MAAM,UAAA,GAAa;AAAA,IACjB,GAAG,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,SAAA,IAAa,EAAE,CAAA;AAAA,IACpC,GAAG,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,YAAA,IAAgB,EAAE,CAAA,CAAE,MAAA,CAAO,CAAC,OAAO,EAAE,EAAA,KAAO,KAAA,CAAM,SAAA,IAAa,EAAC,CAAA,CAAG;AAAA,GAC1F;AACA,EAAA,OAAO,UAAA,CAAW,GAAA,CAAI,CAAC,EAAA,KAAO,CAAC,EAAA,EAAI,KAAA,CAAM,SAAA,GAAY,EAAE,CAAA,IAAK,EAAE,CAAC,CAAA;AACjE;AAEA,SAAS,eAAA,CACP,UAAA,EACA,KAAA,EACA,OAAA,EACA,iBACA,QAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,aAAa,KAAK,CAAA;AAClC,EAAA,MAAM,OAAA,GAAU,aAAa,KAAK,CAAA;AAClC,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,KAAA;AAAA,IACA,GAAI,OAAA,KAAY,MAAA,GAAY,EAAC,GAAI,EAAE,OAAA,EAAQ;AAAA,IAC3C,GAAI,eAAA,KAAoB,MAAA,GAAY,EAAC,GAAI,EAAE,eAAA,EAAgB;AAAA,IAC3D,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,IAC7B,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,IAC7B,iBAAA,EAAmB,mBAAA,CAAoB,UAAA,EAAY,KAAK,CAAA;AAAA,IACxD;AAAA,GACF;AACF;AAUO,SAAS,uBACd,OAAA,EACkC;AAClC,EAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,OAAA,CAAQ,QAAQ,CAAA;AAClD,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAEjC,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,EAAU,IAAA,EAAK;AACxC,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,CAAC,UAAA,EAAY,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AACrC,IAAA,OAAO,gBAAgB,UAAA,EAAY,KAAA,EAAO,MAAA,EAAW,MAAA,EAAW,EAAE,CAAA;AAAA,EACpE;AAKA,EAAA,MAAM,KAAA,GAAQ,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,QAAQ,CAAA;AACpD,EAAA,IAAI,KAAA,EAAO,OAAO,eAAA,CAAgB,KAAA,CAAM,CAAC,CAAA,EAAG,KAAA,CAAM,CAAC,CAAA,EAAG,MAAA,EAAW,MAAA,EAAW,EAAE,CAAA;AAE9E,EAAA,MAAM,WAAW,aAAA,CAAc,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAU,QAAQ,KAAK,CAAA;AACxE,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,KAAA,GAAQ,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,EAAA,KAAO,QAAA,CAAS,UAAU,CAAA;AAC/D,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,eAAA;AAAA,IACL,MAAM,CAAC,CAAA;AAAA,IACP,MAAM,CAAC,CAAA;AAAA,IACP,QAAA,CAAS,OAAA;AAAA,IACT,QAAA,CAAS,eAAA;AAAA,IACT,QAAA,CAAS;AAAA,GACX;AACF;AAQO,SAAS,4BAA4B,OAAA,EAAmD;AAC7F,EAAA,OAAO,sBAAsB,OAAA,CAAQ,QAAA,EAAU,EAAE,GAAA,EAAK,OAAA,CAAQ,WAAW,CAAA;AAC3E;AASO,SAAS,yBAAA,CACd,QAAA,EACA,WAAA,EACA,OAAA,EACM;AACN,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,QAAQ,CAAA,EAAG,QAAA;AACpD,EAAA,IAAI,CAAC,SAAA,IAAa,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG;AAC1C,EAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AACxB,EAAA,IAAI,CAAC,OAAA,IAAW,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA,EAAG;AAC7C,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,EAAG,WAAW,CAAA,mBAAA,EAAsB,OAAO,mCACrC,OAAA,CAAQ,UAAU,CAAA,GAAA,EAAM,WAAW,YAAY,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,2GAEjC,OAAO,CAAA,EAAA;AAAA,GACjD;AACF;AAYO,SAAS,qBAAqB,OAAA,EAAyC;AAC5E,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,CAAC,UAAA,EAAY,KAAK,KAAK,iBAAA,CAAkB,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACrE,IAAA,MAAM,SAAA,GAAY,mBAAA,CAAoB,UAAA,EAAY,KAAK,CAAA;AACvD,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,UAAA;AAC7B,IAAA,KAAA,MAAW,CAAC,SAAA,EAAW,eAAe,CAAA,IAAK,aAAA,CAAc,KAAK,CAAA,EAAG;AAC/D,MAAA,MAAM,EAAA,GAAK,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,eAAe,CAAA,CAAA;AAC1C,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA,EAAG;AAClB,MAAA,IAAA,CAAK,IAAI,EAAE,CAAA;AACX,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,GAAG,KAAK,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,EAAI,CAAA;AAAA,IAChD;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,uBAAA,CACd,QAAA,EACA,WAAA,EACA,OAAA,EACkC;AAClC,EAAA,MAAM,OAAA,GAAU,uBAAuB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,yBAAA,CAA0B,QAAA,EAAU,aAAa,OAAO,CAAA;AACxD,EAAA,OAAO,OAAA;AACT;AAOO,SAAS,qBAAqB,OAAA,EAAmD;AACtF,EAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,EAAiB,OAAO,MAAA;AACrC,EAAA,OAAO,CAAA,EAAG,OAAA,CAAQ,iBAAiB,CAAA,CAAA,EAAI,QAAQ,eAAe,CAAA,CAAA;AAChE;AAgCO,SAAS,oBAAoB,OAAA,EAA4D;AAC9F,EAAA,MAAM,OAAA,GAAU,uBAAuB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,YAAY,OAAA,CAAQ,UAAA;AAAA,IACpB,UAAU,OAAA,CAAQ,iBAAA;AAAA,IAClB,GAAI,QAAQ,eAAA,GAAkB,EAAE,OAAO,OAAA,CAAQ,eAAA,KAAoB,EAAC;AAAA,IACpE,GAAI,QAAQ,OAAA,GAAU,EAAE,SAAS,OAAA,CAAQ,OAAA,KAAY,EAAC;AAAA,IACtD,SAAA,EAAW,yBAAA,CAA0B,OAAA,CAAQ,UAAU;AAAA,GACzD;AACF;ACrVO,IAAe,mBAAA,GAAf,cAA2C,WAAA,CAAY;AAAA;AAAA,EAezC,IAAA,GAA6B,OAAA;AAAA,EAEtC,MAAA;AAAA,EAEF,IAAA,GAA4B,IAAA;AAAA,EAC5B,EAAA,GAAuB,IAAA;AAAA,EACvB,eAAyB,EAAC;AAAA,EAC1B,YAAA,GAAe,EAAA;AAAA,EACf,OAAA,GAAU,KAAA;AAAA;AAAA,EAGV,QAAA,GAAW,EAAA;AAAA,EACX,eAAA,GAAkB,KAAA;AAAA,EAClB,qBAAqC,EAAC;AAAA,EACtC,SAAA,GAAY,KAAA;AAAA,EACZ,QAAA,GAAW,KAAA;AAAA,EACX,WAAA,GAAmC,IAAA;AAAA,EACnC,UAAA,GAA4C,IAAA;AAAA,EAE1C,UAAA;AAAA,EACA,WAAA,GAAiC,IAAA;AAAA,EAE3C,YAAY,MAAA,EAAqB;AAC/B,IAAA,KAAA,EAAM;AACN,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,IAAa,gBAAA,GAAuC;AAClD,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACd;AAAA,EAES,QAAA,GAA+B;AACtC,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAES,aAAA,GAAmC;AAC1C,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA,EAES,YAAY,KAAA,EAA0E;AAC7F,IAAA,IAAI,MAAM,KAAA,KAAU,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,QAAQ,KAAA,CAAM,KAAA;AACzD,IAAA,IAAI,MAAM,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,WAAW,KAAA,CAAM,QAAA;AAC/D,IAAA,IAAI,MAAM,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,SAAS,KAAA,CAAM,MAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,EACjB;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,IAAA,KAAS,IAAA,IAAQ,CAAC,KAAK,IAAA,CAAK,MAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,IAAA,CAAK,MAAM,MAAM,IAAI,MAAM,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,yBAAA,CAA2B,CAAA;AAC7E,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,MAAM,KAAK,KAAA,EAAM;AAEpC,IAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAChB,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,qBAAqB,EAAC;AAC3B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,KAAA;AAChB,IAAA,IAAA,CAAK,eAAe,EAAC;AACrB,IAAA,IAAA,CAAK,YAAA,GAAe,EAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAEnB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,aAAA,CAAc,OAAO,CAAA;AAC3C,IAAA,MAAM,cAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,WAAA,CAAa,CAAA;AAC9D,IAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,CAAA,EAAG,KAAK,SAAS,CAAA,eAAA,CAAiB,IACzD,OAAA,CAAQ,GAAA,CAAI,GAAG,IAAA,CAAK,SAAS,iBAAiB,CAAA,CAAa,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,GACvF,EAAC;AACL,IAAA,MAAM,GAAA,GAAM,eAAe,IAAA,CAAK,UAAA;AAChC,IAAA,MAAM,IAAA,GAAO,CAAC,GAAG,OAAA,EAAS,GAAG,KAAK,SAAA,CAAU,QAAA,EAAU,IAAA,CAAK,UAAU,CAAC,CAAA;AACtE,IAAA,MAAM,GAAA,GAAM,KAAK,QAAA,EAAS;AAE1B,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,MAAA,IAAA,CAAK,WAAA,GAAc,OAAA;AACnB,MAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,cAAA,EAAgB;AAAA,QAC5B,GAAA;AAAA,QACA,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,QACjB,MAAA,EAAQ,OAAA,CAAQ,IAAA,CAAK,UAAU;AAAA,OAChC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,GAAA,EAAK,IAAA,EAAM;AAAA,QAC5B,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,QACjB,GAAA;AAAA,QACA,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,OACjC,CAAA;AACD,MAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,MAAA,MAAM,WAAA,GAAc,IAAA;AAEpB,MAAA,WAAA,CAAY,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAe;AACtC,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,oBAAA,CAAqB,GAA4B,CAAA;AACrE,QAAA,IAAA,CAAK,IAAI,KAAA,CAAM,aAAA,EAAe,GAAA,EAAK,EAAE,QAAQ,CAAA;AAC7C,QAAA,IAAA,CAAK,UAAU,MAAM,CAAA;AACrB,QAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,QAAA,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG,EAAE,MAAA,EAAQ,CAAC,CAAA;AAAA,MACxE,CAAC,CAAA;AAED,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,IAAI,IAAA,CAAK,SAAS,OAAA,EAAS;AACzB,UAAA,MAAM,KAAK,eAAA,CAAgB,EAAE,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACjD,UAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AACV,UAAC,EAAA,CAA+B,GAAG,MAAA,EAAQ,CAAC,SAAiB,IAAA,CAAK,YAAA,CAAa,IAAI,CAAC,CAAA;AAAA,QACtF,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,MAAA,CAAO,YAAY,MAAM,CAAA;AAC9B,UAAA,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACxC,YAAA,IAAA,CAAK,YAAA,IAAgB,KAAA;AAAA,UACvB,CAAC,CAAA;AAAA,QACH;AAAA,MACF;AAEA,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,MAAM,WAAW,eAAA,CAAgB,EAAE,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACvD,QAAC,QAAA,CAAqC,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,KAAiB;AACjE,UAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,QAAA,EAAU,EAAE,MAAM,CAAA;AACjC,UAAA,IAAA,CAAK,YAAA,CAAa,KAAK,IAAI,CAAA;AAC3B,UAAA,IAAI,KAAK,YAAA,CAAa,MAAA,GAAS,EAAA,EAAI,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,QAC7D,CAAC,CAAA;AAAA,MACH;AAEA,MAAA,WAAA,CAAY,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,EAAqB,MAAA,KAAkC;AAC7E,QAAA,IAAA,CAAK,IAAI,IAAA,CAAK,YAAA,EAAc,EAAE,IAAA,EAAM,QAAQ,CAAA;AAC5C,QAAA,IAAA,CAAK,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC1B,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,IAAA,EAAM,KAAK,SAAS,CAAA;AAAA,EAC3B;AAAA,EAEA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,IAAA,EAAM,KAAK,SAAS,CAAA;AACzB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA,EAEA,MAAM,YAAA,GAA8B;AAClC,IAAA,IAAA,CAAK,IAAA,EAAK;AACV,IAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA,EAWU,WAAW,KAAA,EAAsB;AAAA,EAAC;AAAA;AAAA,EAGlC,eAAe,IAAA,EAAoB;AAAA,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUpC,YAAA,CAAa,MAAqB,MAAA,EAAkD;AAC5F,IAAA,IAAI,SAAS,CAAA,IAAM,IAAA,KAAS,IAAA,IAAQ,MAAA,KAAW,MAAO,OAAO,IAAA;AAC7D,IAAA,MAAM,OAAO,IAAA,CAAK,YAAA,CAAa,MAAM,GAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AACnD,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,kBAAA,EAAqB,IAAA,IAAQ,MAAM,CAAA,EAAG,IAAA,GAAO,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,MACzF,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,IAAA,IAAQ,CAAA,IAAA,EAAO,IAAA,CAAK,WAAW,CAAA,mDAAA;AAAA,KACvC;AAAA,EACF;AAAA;AAAA;AAAA,EAKU,cAAc,OAAA,EAAyB;AAC/C,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA,GAAe,CAAA,EAAG,IAAA,CAAK,OAAO,YAAY;;AAAA;;AAAA,EAAc,OAAO,CAAA,CAAA,GAAK,OAAA;AAAA,EACzF;AAAA,EAEU,mBAAmB,QAAA,EAAwB;AACnD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAChB,MAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,QACvB,IAAA,EAAM,eAAA;AAAA,QACN,OAAA,EAAS,YAAY,EAAE;AAAA,OACH,CAAA;AAAA,IACxB;AACA,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,UAAA,CAAW,IAAA,CAAK,QAAQ,CAAA,GAC3C,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,GACnC,QAAA;AACJ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,QACvB,IAAA,EAAM,gBAAA;AAAA,QACN,OAAA,EAAS,YAAY,QAAQ,CAAA;AAAA,QAC7B,UAAA,EAAY;AAAA,OACQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEU,iBAAiB,QAAA,EAAyB;AAClD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC3B,IAAA,MAAM,IAAA,GAAO,YAAY,IAAA,CAAK,QAAA;AAC9B,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,aAAA;AAAA,MACN,OAAA,EAAS,YAAY,IAAI;AAAA,KACL,CAAA;AACtB,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAAA,EAClB;AAAA,EAEU,YAAA,CAAa,MAAc,KAAA,EAAsB;AACzD,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,WAAA;AAAA,MACN,IAAA;AAAA,MACA,IAAA,EAAM,EAAE,IAAA,EAAK;AAAA,MACb;AAAA,KACoB,CAAA;AAAA,EACxB;AAAA,EAEU,cAAA,CAAe,IAAA,EAAc,IAAA,EAAe,OAAA,GAAU,KAAA,EAAa;AAC3E,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,OAAA,EAAS,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,CAAA;AACzF,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,oBAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACU,CAAA;AAAA,EACxB;AAAA,EAEQ,gBAAA,GAAyB;AAC/B,IAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,MAAA,KAAW,CAAA,EAAG;AAC1C,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,UAAA;AAAA,MACN,WAAA,EAAa,CAAC,GAAG,IAAA,CAAK,kBAAkB;AAAA,KACpB,CAAA;AACtB,IAAA,IAAA,CAAK,qBAAqB,EAAC;AAAA,EAC7B;AAAA,EAEU,WAAW,IAAA,EAKZ;AACP,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,MAAA;AACzC,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,QAAA;AAAA,MACN,OAAA,EAAS,KAAK,OAAA,IAAW,SAAA;AAAA,MACzB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,KAAK,OAAA,IAAW,CAAA;AAAA,MACzB,GAAI,KAAK,MAAA,GAAS,EAAE,QAAQ,IAAA,CAAK,MAAA,KAAW;AAAC,KACzB,CAAA;AAAA,EACxB;AAAA,EAEU,SAAA,CAAU,MAAA,EAAoB,KAAA,GAAQ,KAAA,EAAa;AAC3D,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,OAAA;AAAA,MACN,OAAO,MAAA,CAAO,OAAA;AAAA,MACd,MAAA;AAAA,MACA;AAAA,KACoB,CAAA;AAAA,EACxB;AAAA,EAEU,cAAA,CAAe,IAAa,IAAA,EAAqB;AACzD,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,KAAO,IAAA,CAAK,UAAA,EAAY;AACnC,IAAA,IAAA,CAAK,UAAA,GAAa,EAAA;AAClB,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,cAAA;AAAA,MACN,eAAA,EAAiB,EAAA;AAAA,MACjB,GAAI,IAAA,GAAO,EAAE,WAAA,EAAa,IAAA,KAAS;AAAC,KAChB,CAAA;AAAA,EACxB;AAAA;AAAA,EAGU,gBAAgB,OAAA,EAA6B;AACrD,IAAA,MAAM,OAAA,GAAU,4BAA4B,OAAO,CAAA;AACnD,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO;AAAA,QACL,OAAA;AAAA,QACA,QAAA,EAAU,SAAA;AAAA,QACV,SAAA,EAAW,IAAA;AAAA,QACX,IAAA,EAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,WAAW,CAAA,sCAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GACJ,QAAQ,QAAA,KAAa,MAAA,GACjB,4CAA4C,IAAA,CAAK,WAAW,MAC5D,OAAA,CAAQ,QAAA,KAAa,eACnB,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,wDAAA,CAAA,GACnB,OAAA,CAAQ,aAAa,OAAA,GACnB,wGAAA,GACA,CAAA,0CAAA,EAA6C,IAAA,CAAK,WAAW,CAAA,CAAA,CAAA;AACvE,IAAA,OAAO,EAAE,SAAS,QAAA,EAAU,OAAA,CAAQ,UAAU,SAAA,EAAW,OAAA,CAAQ,WAAW,IAAA,EAAK;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBU,OAAA,CAAQ,SAAA,GAAsB,EAAC,EAA2B;AAClE,IAAA,MAAM,MAA8B,EAAC;AACrC,IAAA,MAAM,QAAA,GAAW,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,UAAA,EAAY,mBAAA,EAAqB,GAAG,SAAS,CAAA;AACvF,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACzB,MAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA;AAAA,IAClC;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtD,MAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC/B,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,CAAA,EAAG,IAAA,CAAK,SAAS,UAAU,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC9E,QAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,MACb;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,UAAA,EAAY;AAC1B,MAAA,GAAA,CAAI,eAAA,GAAkB,CAAA,QAAA,EAAW,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA,qCAAA,CAAA;AAAA,IACzD;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,GAAA,EAAK,MAAA,CAAO,OAAO,GAAA,EAAK,IAAA,CAAK,OAAO,GAAG,CAAA;AACvD,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAIQ,aAAa,IAAA,EAAoB;AACvC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG;AAClB,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,sBAAA,EAAwB,EAAE,MAAM,CAAA;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,WAAW,IAAI,CAAA;AAAA,IACtB,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,kBAAA,EAAoB,EAAE,OAAO,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,IAC1D;AAAA,EACF;AAAA,EAEQ,MAAA,CAAO,MAAqB,MAAA,EAAqC;AACvE,IAAA,IAAA,CAAK,OAAA,EAAQ;AAEb,IAAA,IAAI,KAAK,QAAA,EAAU;AACjB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,MAAA,IAAA,CAAK,aAAA,EAAc;AACnB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAK,IAAA,KAAS,UAAA,KAAe,IAAA,KAAS,CAAA,IAAK,SAAS,IAAA,CAAA,EAAO;AAC7D,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,cAAA,CAAe,KAAK,YAAY,CAAA;AAAA,MACvC,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,sBAAA,EAAwB,EAAE,OAAO,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,MAC9D;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAC9C,IAAA,IAAI,OAAA,IAAW,CAAC,IAAA,CAAK,SAAA,EAAW;AAC9B,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,UAAU,OAAO,CAAA;AACtB,MAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,MAAA,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAC,CAAA;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW,IAAA,CAAK,WAAW,EAAE,OAAA,EAAS,kBAAkB,CAAA;AAAA,SAC7D;AACH,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,IACxB;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,IAAA,IAAA,CAAK,aAAA,EAAc;AAAA,EACrB;AAAA,EAEQ,aAAA,GAAsB;AAC5B,IAAA,MAAM,UAAU,IAAA,CAAK,WAAA;AACrB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,OAAA,IAAU;AAAA,EACZ;AAAA,EAEQ,aAAa,GAAA,EAAkB;AACrC,IAAA,MAAM,SAAS,IAAA,CAAK,UAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,MAAA,GAAS,GAAG,CAAA;AAAA,EACd;AAAA,EAEQ,OAAA,GAAgB;AACtB,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AACf,IAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AACV,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAEQ,qBAAqB,GAAA,EAAwC;AACnE,IAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,UAAU,CAAA,kBAAA,CAAA;AAAA,QAC3B,QAAA,EAAU,QAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM,KAAK,WAAA;AAAY,OACzB;AAAA,IACF;AACA,IAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAA,0BAAA,EAA6B,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,QACrD,QAAA,EAAU,QAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM,CAAA,+BAAA,EAAkC,IAAA,CAAK,UAAU,CAAA,QAAA;AAAA,OACzD;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,CAAA,6CAAA,EAAgD,IAAA,CAAK,WAAW,CAAA,YAAA;AAAA,KACxE;AAAA,EACF;AACF;AAOA,SAAS,YAAY,IAAA,EAA4B;AAC/C,EAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA,EAAE;AAChE;AAGO,SAAS,YAAY,IAAA,EAAmB;AAC7C,EAAA,IAAI,OAAO,IAAA,EAAM,IAAA,KAAS,QAAA,SAAiB,IAAA,CAAK,IAAA;AAChD,EAAA,IAAI,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,SAAiB,IAAA,CAAK,KAAA;AACjD,EAAA,IAAI,OAAO,IAAA,EAAM,OAAA,KAAY,QAAA,SAAiB,IAAA,CAAK,OAAA;AACnD,EAAA,IAAI,OAAO,IAAA,EAAM,QAAA,KAAa,QAAA,SAAiB,IAAA,CAAK,QAAA;AACpD,EAAA,MAAM,MAAM,IAAA,EAAM,OAAA;AAClB,EAAA,IAAI,OAAO,GAAA,EAAK,OAAA,KAAY,QAAA,SAAiB,GAAA,CAAI,OAAA;AACjD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAI,OAAA,CACR,MAAA;AAAA,MACC,CAAC,CAAA,KAAA,CAAY,CAAA,EAAG,IAAA,KAAS,MAAA,IAAU,GAAG,IAAA,KAAS,MAAA,KAAc,OAAO,CAAA,EAAG,IAAA,KAAS;AAAA,KAClF,CACC,IAAI,CAAC,CAAA,KAAW,EAAE,IAAI,CAAA,CACtB,KAAK,EAAE,CAAA;AAAA,EACZ;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAA,EAAG;AAC9B,IAAA,OAAO,KAAK,KAAA,CACT,MAAA,CAAO,CAAC,CAAA,KAAW,OAAO,CAAA,EAAG,IAAA,KAAS,QAAQ,CAAA,CAC9C,IAAI,CAAC,CAAA,KAAW,EAAE,IAAI,CAAA,CACtB,KAAK,EAAE,CAAA;AAAA,EACZ;AACA,EAAA,OAAO,EAAA;AACT;AAGO,SAAS,cAAc,IAAA,EAA8B;AAC1D,EAAA,MAAM,CAAA,GAAI,MAAM,KAAA,IAAS,IAAA,EAAM,OAAO,KAAA,IAAS,IAAA,EAAM,KAAA,IAAS,IAAA,EAAM,MAAA,IAAU,IAAA;AAC9E,EAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,UAAU,OAAO,IAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,EAAE,YAAA,IAAgB,CAAA,CAAE,eAAe,CAAA,CAAE,aAAA,IAAiB,CAAA,CAAE,gBAAA,IAAoB,CAAA,CAAE,KAAA;AAC5F,EAAA,MAAM,MAAA,GACJ,EAAE,aAAA,IAAiB,CAAA,CAAE,gBAAgB,CAAA,CAAE,iBAAA,IAAqB,CAAA,CAAE,oBAAA,IAAwB,CAAA,CAAE,MAAA;AAC1F,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,mBAAA,IAAuB,CAAA,CAAE,mBAAmB,CAAA,CAAE,uBAAA;AAClE,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW,OAAO,IAAA;AACxD,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,MAAA,CAAO,WAAA,GAAc,KAAA;AACpD,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,MAAA,CAAO,YAAA,GAAe,MAAA;AACtD,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,MAAA,CAAO,eAAA,GAAkB,SAAA;AAC5D,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,YAAY,IAAA,EAA+B;AACzD,EAAA,MAAM,CAAA,GACJ,IAAA,EAAM,IAAA,IAAQ,IAAA,EAAM,OAAA,IAAW,IAAA,EAAM,cAAA,IAAkB,IAAA,EAAM,KAAA,EAAO,IAAA,IAAQ,IAAA,EAAM,KAAA,EAAO,IAAA;AAC3F,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AACrC","file":"chunk-LN2BQVRB.js","sourcesContent":["/**\n * Registry adapter for the **env-shaped CLI drivers** — Gemini, Qwen, OpenCode,\n * Goose and Continue (§2.3).\n *\n * These backends take their endpoint from the environment rather than from a\n * config file, so the adapter's job is three things: resolve which registry\n * entry the session's model selector names, refuse at start when that entry\n * speaks a wire surface the backend cannot, and hand the driver the\n * provider-side model id it must put on the command line.\n *\n * Two pluralities meet here (`BUILTIN_DRIVER_CATALOG.providerPlurality`):\n *\n * - `single` — Gemini and Qwen address exactly one endpoint. The bound entry\n *   supplies the credential *and* the base URL, and a surface mismatch is\n *   fatal: a Gemini CLI pointed at an `openai-completions` endpoint cannot\n *   work, and failing at start names the surface instead of leaving the user\n *   with an opaque error mid-turn.\n * - `credentials-n` — OpenCode, Goose and Continue accept every enabled\n *   entry's credential at once and select one active model. The credential\n *   fan-out is `registryCredentialEnv`; the active model is this module's\n *   `<provider>/<model>` binding.\n *\n * Writing the per-endpoint config files those three need for *custom*\n * endpoints (`opencode.json`, Goose `custom_providers/*.json`, Continue\n * `config.yaml`) is the file half, and is deliberately not here.\n *\n * @see PROVIDER-CONFIG-PLAN.md §2.3\n */\n\nimport {\n  type AIProviderLlmEntry,\n  type AIProviderSurface,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  mergeRegistries,\n  parseModelRef,\n  registryEntries,\n  resolveEntryBaseUrl,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type { ModelEntry } from \"../models.js\";\nimport { getProviderPreset } from \"../provider-catalog.js\";\nimport { BUILTIN_DRIVER_CATALOG } from \"../registry.js\";\nimport type { AgentConfig } from \"../types.js\";\nimport { providerCredentialEnvName, registryCredentialEnv } from \"./credential-env.js\";\n\n/**\n * Everything a CLI driver needs to know about this session's AI providers,\n * resolved once from its {@link AgentConfig}.\n */\nexport interface EnvDriverSession {\n  /** The merged registry this session may address. Empty when none was configured. */\n  registry: MergedAIProviderRegistry;\n  /**\n   * Environment `credential.ref` lookups resolve against — the process\n   * environment widened with `config.env`, which is where the session\n   * boundary delivered every resolved `SKAILE_AIP_<ID>_KEY`.\n   */\n  lookupEnv: Record<string, string | undefined>;\n  /** Model selector: `<providerId>/<modelId>`, a bare id, or `@role`. */\n  modelRef?: string;\n  /** Roles table an `@role` selector resolves through. */\n  roles?: Record<string, string>;\n}\n\n/**\n * Resolve the session's providers once, from its {@link AgentConfig}.\n *\n * `config.env` is folded into `lookupEnv` rather than kept apart: it is part\n * of the session's environment, not an extra, and a credential or\n * `*_BASE_URL` delivered there must be visible exactly as the child will see\n * it.\n */\nexport function resolveEnvDriverSession(\n  config: AgentConfig,\n  processEnv: Record<string, string | undefined> = process.env,\n): EnvDriverSession {\n  return {\n    registry: config.registry ?? mergeRegistries([]),\n    lookupEnv: { ...processEnv, ...config.env },\n    ...(config.modelRef ? { modelRef: config.modelRef } : {}),\n    ...(config.roles ? { roles: config.roles } : {}),\n  };\n}\n\n/** One resolved endpoint + model — everything a driver needs to spawn. */\nexport interface RegistryModelBinding {\n  /** Registry id of the selected entry. */\n  providerId: string;\n  /** The selected entry itself. */\n  entry: AIProviderLlmEntry;\n  /** Logical model id, after `@role` expansion and before `model_map`. */\n  modelId?: string;\n  /** Provider-side model id — what goes on the wire / command line. */\n  providerModelId?: string;\n  /** Wire protocol, from the entry or its preset. */\n  surface?: AIProviderSurface;\n  /** Resolved endpoint, from the entry, its transport params, or its preset. */\n  baseUrl?: string;\n  /**\n   * The provider name the *backend* knows this endpoint by — a catalog preset\n   * id for a stock endpoint, the registry id for anything custom. See\n   * {@link backendProviderName}.\n   */\n  backendProviderId: string;\n  /** Non-fatal notes from `parseModelRef` (dangling role, disabled provider). */\n  warnings: string[];\n}\n\n/** The entry's wire surface: its own, else its preset's. */\nexport function entrySurface(entry: AIProviderLlmEntry): AIProviderSurface | undefined {\n  if (entry.surface) return entry.surface;\n  return entry.preset ? getProviderPreset(entry.preset)?.surface : undefined;\n}\n\n/**\n * The entry's endpoint: its literal or transport-derived URL, else its\n * preset's literal. Transport templates that still carry `{param}`\n * placeholders never come back — `resolveEntryBaseUrl` withholds those, and a\n * preset's template is not a URL.\n */\nexport function entryBaseUrl(entry: AIProviderLlmEntry): string | undefined {\n  const resolved = resolveEntryBaseUrl(entry);\n  if (resolved) return resolved;\n  return entry.preset ? getProviderPreset(entry.preset)?.base_url : undefined;\n}\n\n/**\n * True when a `credentials-n` backend already knows this endpoint under its\n * own catalog name — the entry names a preset and did not move it somewhere\n * else.\n *\n * The one rule both halves of §2.3 read: it decides the name the env half\n * puts on the command line ({@link backendProviderName}) *and* whether the\n * file half has to describe the endpoint at all. Reading it twice is what\n * keeps `-m <name>/<model>` and the generated provider file talking about the\n * same thing.\n */\nexport function isStockCatalogEndpoint(entry: AIProviderLlmEntry): boolean {\n  const preset = entry.preset ? getProviderPreset(entry.preset) : undefined;\n  return preset !== undefined && entryBaseUrl(entry) === preset.base_url;\n}\n\n/**\n * The provider name to give a `credentials-n` backend (`-m <name>/<model>`,\n * `GOOSE_PROVIDER`).\n *\n * A stock catalog endpoint is named by its preset, because that is the name\n * OpenCode's models.dev list and Goose's built-in provider table already use —\n * `prod-claude: {preset: anthropic}` is still Anthropic to them. An entry with\n * an endpoint of its own is named by its registry id: no built-in table knows\n * it, so the id is what its generated provider file is keyed by (the file half\n * of §2.3).\n */\nexport function backendProviderName(providerId: string, entry: AIProviderLlmEntry): string {\n  const preset = entry.preset ? getProviderPreset(entry.preset) : undefined;\n  if (!preset || !isStockCatalogEndpoint(entry)) return providerId;\n  return preset.id;\n}\n\n/**\n * Enabled `llm`/`embed` entries, in registry order. Also the set the file\n * adapters render (`opencode-config.ts`, `goose-custom-providers.ts`,\n * `continue-config-yaml.ts`): the env half and the file half must agree on\n * which entries exist before they can agree on what to call them.\n */\nexport function selectableEntries(\n  registry: MergedAIProviderRegistry,\n): Array<[string, AIProviderLlmEntry]> {\n  return registryEntries(registry).filter(\n    (pair): pair is [string, AIProviderLlmEntry] =>\n      (pair[1].kind === \"llm\" || pair[1].kind === \"embed\") && isEntryEnabled(pair[1]),\n  );\n}\n\n/**\n * The provider-side model ids an entry declares, as `[logicalId, providerId]`\n * pairs in declaration order: every `model_map` entry, plus every\n * `capabilities` key the map does not rename.\n */\nexport function entryModelIds(entry: AIProviderLlmEntry): Array<[string, string]> {\n  const logicalIds = [\n    ...Object.keys(entry.model_map ?? {}),\n    ...Object.keys(entry.capabilities ?? {}).filter((id) => !(id in (entry.model_map ?? {}))),\n  ];\n  return logicalIds.map((id) => [id, entry.model_map?.[id] ?? id]);\n}\n\nfunction describeBinding(\n  providerId: string,\n  entry: AIProviderLlmEntry,\n  modelId: string | undefined,\n  providerModelId: string | undefined,\n  warnings: string[],\n): RegistryModelBinding {\n  const surface = entrySurface(entry);\n  const baseUrl = entryBaseUrl(entry);\n  return {\n    providerId,\n    entry,\n    ...(modelId === undefined ? {} : { modelId }),\n    ...(providerModelId === undefined ? {} : { providerModelId }),\n    ...(surface ? { surface } : {}),\n    ...(baseUrl ? { baseUrl } : {}),\n    backendProviderId: backendProviderName(providerId, entry),\n    warnings,\n  };\n}\n\n/**\n * Resolve the session's endpoint + model.\n *\n * With no selector the first entry in registry order wins and the backend\n * keeps its own default model — exactly what an absent `model` meant before\n * the registry existed. Returns `undefined` when no entry can serve a model\n * (an empty, fully-disabled or voice-only registry).\n */\nexport function resolveRegistryBinding(\n  session: EnvDriverSession,\n): RegistryModelBinding | undefined {\n  const entries = selectableEntries(session.registry);\n  if (entries.length === 0) return undefined;\n\n  const selector = session.modelRef?.trim();\n  if (!selector) {\n    const [providerId, entry] = entries[0];\n    return describeBinding(providerId, entry, undefined, undefined, []);\n  }\n\n  // A selector that is exactly an entry id names the endpoint and nothing\n  // else: the backend keeps its own default model. `parseModelRef` would read\n  // it as a bare *model* id and fall back to registry order.\n  const named = entries.find(([id]) => id === selector);\n  if (named) return describeBinding(named[0], named[1], undefined, undefined, []);\n\n  const resolved = parseModelRef(selector, session.registry, session.roles);\n  if (!resolved) return undefined;\n  const match = entries.find(([id]) => id === resolved.providerId);\n  if (!match) return undefined;\n  return describeBinding(\n    match[0],\n    match[1],\n    resolved.modelId,\n    resolved.providerModelId,\n    resolved.warnings,\n  );\n}\n\n/**\n * Every credential a `credentials-n` backend may use: one variable per\n * enabled registry entry. OpenCode, Goose and Continue have always received\n * *all* of them, not just the selected endpoint's, because they route across\n * providers inside a single session.\n */\nexport function credentialsForEveryProvider(session: EnvDriverSession): Record<string, string> {\n  return registryCredentialEnv(session.registry, { env: session.lookupEnv });\n}\n\n/**\n * Throw when the bound entry speaks a wire surface this driver cannot.\n *\n * The message names the offending surface and lists the ones the backend does\n * speak (`BUILTIN_DRIVER_CATALOG[driverId].surfaces`). An entry that declares\n * no surface and names no preset is not judged — there is nothing to compare.\n */\nexport function assertDriverSpeaksSurface(\n  driverId: string,\n  productName: string,\n  binding: RegistryModelBinding,\n): void {\n  const supported = BUILTIN_DRIVER_CATALOG[driverId]?.surfaces;\n  if (!supported || supported.length === 0) return;\n  const surface = binding.surface;\n  if (!surface || supported.includes(surface)) return;\n  throw new Error(\n    `${productName} cannot speak the '${surface}' surface of AI provider entry ` +\n      `'${binding.providerId}'. ${productName} speaks: ${supported.join(\", \")}. ` +\n      `Point this session's model at an entry with one of those surfaces, ` +\n      `or run it on a driver that speaks '${surface}'.`,\n  );\n}\n\n/**\n * The models a `credentials-n` backend can be pointed at, straight from the\n * registry: every enabled entry's mapped ids, namespaced the way the backend\n * takes them (`-m <provider>/<model>`).\n *\n * These backends have no model-list endpoint of their own — OpenCode reads\n * models.dev, Goose and Continue read their config — so the registry is the\n * only list that describes *this* session's reachable models, and it needs no\n * network call to produce.\n */\nexport function registryModelEntries(session: EnvDriverSession): ModelEntry[] {\n  const out: ModelEntry[] = [];\n  const seen = new Set<string>();\n  for (const [providerId, entry] of selectableEntries(session.registry)) {\n    const backendId = backendProviderName(providerId, entry);\n    const label = entry.label ?? providerId;\n    for (const [logicalId, providerModelId] of entryModelIds(entry)) {\n      const id = `${backendId}/${providerModelId}`;\n      if (seen.has(id)) continue;\n      seen.add(id);\n      out.push({ id, name: `${label} ${logicalId}` });\n    }\n  }\n  return out;\n}\n\n/**\n * Resolve the binding and enforce the surface — what a `single`-plurality\n * driver does at start.\n *\n * The registry is authoritative: pointing the driver at an entry it cannot\n * speak throws rather than silently running somewhere else. `undefined` when\n * the session configured no endpoint at all, which leaves the driver on its\n * own native auth.\n */\nexport function bindSingleProviderEntry(\n  driverId: string,\n  productName: string,\n  session: EnvDriverSession,\n): RegistryModelBinding | undefined {\n  const binding = resolveRegistryBinding(session);\n  if (!binding) return undefined;\n  assertDriverSpeaksSurface(driverId, productName, binding);\n  return binding;\n}\n\n/**\n * The `<provider>/<model>` selector a `credentials-n` backend takes on its\n * command line (`opencode -m`). `undefined` when no model was selected — the\n * backend then uses its own default rather than being handed a bare provider.\n */\nexport function backendModelSelector(binding: RegistryModelBinding): string | undefined {\n  if (!binding.providerModelId) return undefined;\n  return `${binding.backendProviderId}/${binding.providerModelId}`;\n}\n\n/**\n * Continue's model selection is a **role binding**, not a flag: `cn` has no\n * `--model` option (only `--config <slug>`), and its `config.yaml` binds each\n * model to roles (`chat`, `edit`, `apply`, …). This is the binding for the\n * role a headless `cn -p` turn runs as, and the shape its generated\n * `config.yaml` is rendered from.\n *\n * `apiKeyEnv` is a variable *name*: the secret travels in the child\n * environment, never in a rendered config.\n */\nexport interface ContinueRoleBinding {\n  /** Continue role this model serves. A headless prompt is a `chat` turn. */\n  role: \"chat\";\n  /** Registry id of the entry. */\n  providerId: string;\n  /** Provider name Continue knows the endpoint by. */\n  provider: string;\n  /** Provider-side model id. */\n  model?: string;\n  /** Endpoint, when the entry states one. */\n  apiBase?: string;\n  /** Env var holding the credential — the name, never the value. */\n  apiKeyEnv: string;\n}\n\n/**\n * Map the session's chosen endpoint onto the Continue role a headless turn\n * runs as. `undefined` when the session configured no endpoint — `cn` then\n * runs against whatever its own `config.yaml` / Hub login provides.\n */\nexport function continueRoleBinding(session: EnvDriverSession): ContinueRoleBinding | undefined {\n  const binding = resolveRegistryBinding(session);\n  if (!binding) return undefined;\n  return {\n    role: \"chat\",\n    providerId: binding.providerId,\n    provider: binding.backendProviderId,\n    ...(binding.providerModelId ? { model: binding.providerModelId } : {}),\n    ...(binding.baseUrl ? { apiBase: binding.baseUrl } : {}),\n    apiKeyEnv: providerCredentialEnvName(binding.providerId),\n  };\n}\n","import { type ChildProcess, spawn } from \"node:child_process\";\nimport type { EventEmitter } from \"node:events\";\nimport { createInterface, type Interface } from \"node:readline\";\nimport type { Logger, TokenUsage } from \"@skaile/workspaces/types\";\nimport { classifyGenericErrorMessage } from \"../error-classifier.js\";\nimport {\n  type AgentConfig,\n  AgentDriver,\n  type AgentError,\n  type AgentEvent,\n  type AgentMessage,\n} from \"../types.js\";\n\n/**\n * Shared base for one-shot **subprocess CLI** agent backends (Gemini, Qwen,\n * OpenCode, Goose, Continue).\n *\n * These backends are neither persistent JSON-RPC subprocesses (`omp`) nor\n * in-process SDKs (`claude-sdk`, `codex`). In headless mode each is invoked\n * **once per turn** — `prompt()` spawns the CLI fresh, a `readline` loop maps\n * newline-delimited JSON on stdout to the unified {@link AgentEvent} stream, and\n * **process exit marks the end of the turn**. Multi-turn continuity comes from\n * capturing a backend session id (emitted as `session_info`) and replaying it\n * via a resume flag on the next spawn.\n *\n * Subclasses implement {@link buildArgs}, {@link buildEnv}, and either\n * {@link handleJson} (streaming JSONL, the default) or {@link handleBuffered}\n * (`mode = \"buffered\"`, for CLIs that print a single JSON blob at the end).\n *\n * **Terminal-sequence invariant.** Subclasses MUST NOT emit `agent_end`. The\n * base emits exactly one `result` (synthesizing a success result when the\n * stream produced none) followed by a single `agent_end` on clean exit, or an\n * `error` + `agent_end` on crash. This keeps the turn-completion contract\n * (`prompt()` resolves after `agent_end`) identical across every CLI driver.\n *\n * @docLink packages/bridge/drivers#subprocess-cli\n */\nexport abstract class SubprocessCliDriver extends AgentDriver {\n  /** Per-driver logger, constructed once by the subclass. */\n  protected abstract readonly log: Logger;\n  /** Default binary name spawned in production (e.g. `\"gemini\"`). */\n  protected abstract readonly defaultBin: string;\n  /** Human product name used in error messages / hints (e.g. `\"Gemini CLI\"`). */\n  protected abstract readonly productName: string;\n  /**\n   * Test-seam env prefix. `<PREFIX>_BRIDGE_BIN` overrides the spawn binary and\n   * `<PREFIX>_BRIDGE_PREARGS` (space-delimited) supplies leading argv — used by\n   * the fake-CLI harness to redirect spawn without monkey-patching\n   * `child_process`. Both are ignored in production.\n   */\n  protected abstract readonly envPrefix: string;\n  /** `\"jsonl\"` streams events line-by-line; `\"buffered\"` parses all stdout once on exit. */\n  protected readonly mode: \"jsonl\" | \"buffered\" = \"jsonl\";\n\n  protected config: AgentConfig;\n\n  private proc: ChildProcess | null = null;\n  private rl: Interface | null = null;\n  private stderrBuffer: string[] = [];\n  private stdoutBuffer = \"\";\n  private started = false;\n\n  // ── Per-turn state ──────────────────────────────────────────────────────\n  private prevText = \"\";\n  private activeAssistant = false;\n  private pendingToolResults: AgentMessage[] = [];\n  private sawResult = false;\n  private aborting = false;\n  private turnResolve: (() => void) | null = null;\n  private turnReject: ((err: Error) => void) | null = null;\n\n  protected _sessionId?: string;\n  protected _lastTokens: TokenUsage | null = null;\n\n  constructor(config: AgentConfig) {\n    super();\n    this.config = config;\n  }\n\n  override get runtimeSessionId(): string | undefined {\n    return this._sessionId;\n  }\n\n  override getModel(): string | undefined {\n    return this.config.model;\n  }\n\n  override getTokenUsage(): TokenUsage | null {\n    return this._lastTokens;\n  }\n\n  override reconfigure(patch: Partial<Pick<AgentConfig, \"model\" | \"thinking\" | \"effort\">>): void {\n    if (patch.model !== undefined) this.config.model = patch.model;\n    if (patch.thinking !== undefined) this.config.thinking = patch.thinking;\n    if (patch.effort !== undefined) this.config.effort = patch.effort;\n  }\n\n  /**\n   * No-op for one-shot CLIs — there is no long-lived process to spawn until the\n   * first prompt. Kept so the runner's `start()` → `prompt()` ordering works\n   * uniformly; binary-presence failures surface as a `config` error on the\n   * first spawn (see {@link classifyProcessError}).\n   */\n  async start(): Promise<void> {\n    this.started = true;\n  }\n\n  get isRunning(): boolean {\n    return this.proc !== null && !this.proc.killed;\n  }\n\n  /**\n   * Sends a user message to the CLI and resolves after the turn completes\n   * (`agent_end`). Spawns a fresh child per call; rejects if the child exits\n   * non-zero before emitting a result, so the caller never hangs.\n   */\n  async prompt(message: string): Promise<void> {\n    if (this.proc) throw new Error(`${this.productName} turn already in progress`);\n    if (!this.started) await this.start();\n\n    this.prevText = \"\";\n    this.activeAssistant = false;\n    this.pendingToolResults = [];\n    this.sawResult = false;\n    this.aborting = false;\n    this.stderrBuffer = [];\n    this.stdoutBuffer = \"\";\n    this._lastTokens = null;\n\n    const composed = this.composePrompt(message);\n    const overrideBin = process.env[`${this.envPrefix}_BRIDGE_BIN`];\n    const preArgs = process.env[`${this.envPrefix}_BRIDGE_PREARGS`]\n      ? (process.env[`${this.envPrefix}_BRIDGE_PREARGS`] as string).split(/\\s+/).filter(Boolean)\n      : [];\n    const bin = overrideBin || this.defaultBin;\n    const args = [...preArgs, ...this.buildArgs(composed, this._sessionId)];\n    const env = this.buildEnv();\n\n    return new Promise<void>((resolve, reject) => {\n      this.turnResolve = resolve;\n      this.turnReject = reject;\n      this.log.info(\"spawning CLI\", {\n        bin,\n        cwd: this.config.cwd,\n        resume: Boolean(this._sessionId),\n      });\n\n      const proc = spawn(bin, args, {\n        cwd: this.config.cwd,\n        env,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      }) as ChildProcess;\n      this.proc = proc;\n      const procEmitter = proc as unknown as EventEmitter;\n\n      procEmitter.on(\"error\", (err: Error) => {\n        const detail = this.classifyProcessError(err as NodeJS.ErrnoException);\n        this.log.error(\"spawn error\", err, { detail });\n        this.pushError(detail);\n        this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n        this.settleReject(Object.assign(new Error(detail.message), { detail }));\n      });\n\n      if (proc.stdout) {\n        if (this.mode === \"jsonl\") {\n          const rl = createInterface({ input: proc.stdout });\n          this.rl = rl;\n          (rl as unknown as EventEmitter).on(\"line\", (line: string) => this.onStdoutLine(line));\n        } else {\n          proc.stdout.setEncoding(\"utf8\");\n          proc.stdout.on(\"data\", (chunk: string) => {\n            this.stdoutBuffer += chunk;\n          });\n        }\n      }\n\n      if (proc.stderr) {\n        const stderrRl = createInterface({ input: proc.stderr });\n        (stderrRl as unknown as EventEmitter).on(\"line\", (line: string) => {\n          this.log.debug(\"stderr\", { line });\n          this.stderrBuffer.push(line);\n          if (this.stderrBuffer.length > 20) this.stderrBuffer.shift();\n        });\n      }\n\n      procEmitter.on(\"exit\", (code: number | null, signal: NodeJS.Signals | null) => {\n        this.log.info(\"CLI exited\", { code, signal });\n        this.onExit(code, signal);\n      });\n    });\n  }\n\n  /** Out-of-band abort: terminates the current child. Driver stays usable for the next prompt. */\n  async abort(): Promise<void> {\n    this.aborting = true;\n    this.proc?.kill(\"SIGTERM\");\n  }\n\n  kill(): void {\n    this.aborting = true;\n    this.proc?.kill(\"SIGTERM\");\n    this.cleanup();\n  }\n\n  async resetSession(): Promise<void> {\n    this.kill();\n    this._sessionId = undefined;\n    this._lastTokens = null;\n  }\n\n  // ── Subclass hooks ────────────────────────────────────────────────────────\n\n  /** Build the CLI argv (binary excluded) for one turn. `resumeId` is the captured session id, if any. */\n  protected abstract buildArgs(message: string, resumeId: string | undefined): string[];\n\n  /** Build the child-process env (explicit allowlist — see {@link baseEnv}). */\n  protected abstract buildEnv(): Record<string, string>;\n\n  /** Map one parsed stdout JSON object to events via the `push*` helpers. Streaming (`jsonl`) mode only. */\n  protected handleJson(_json: unknown): void {}\n\n  /** Parse the full stdout blob once on clean exit. `buffered` mode only. */\n  protected handleBuffered(_raw: string): void {}\n\n  /** Install-failure hint surfaced when the binary is missing. */\n  protected abstract installHint(): string;\n\n  /**\n   * Classify a non-zero exit into an {@link AgentError}, or `null` to treat the\n   * exit as success (e.g. a turn-limit code where a result was already\n   * emitted). Default: code `0` / clean signal → success; otherwise `process`.\n   */\n  protected classifyExit(code: number | null, signal: NodeJS.Signals | null): AgentError | null {\n    if (code === 0 || (code === null && signal === null)) return null;\n    const tail = this.stderrBuffer.slice(-10).join(\"\\n\");\n    return {\n      message: `${this.productName} exited with code ${code ?? \"null\"}${tail ? `: ${tail}` : \"\"}`,\n      category: \"process\",\n      retryable: true,\n      hint: tail || `The ${this.productName} process exited unexpectedly. Try the prompt again.`,\n    };\n  }\n\n  // ── Protected emit helpers (used by handleJson / handleBuffered) ────────────\n\n  /** Prepend `systemPrompt` to the user message — uniform across CLIs lacking a reliable system flag. */\n  protected composePrompt(message: string): string {\n    return this.config.systemPrompt ? `${this.config.systemPrompt}\\n\\n---\\n\\n${message}` : message;\n  }\n\n  protected pushAssistantDelta(fullText: string): void {\n    if (!this.activeAssistant) {\n      this.activeAssistant = true;\n      this.prevText = \"\";\n      this.emit(\"agent-event\", {\n        type: \"message_start\",\n        message: asstMessage(\"\"),\n      } satisfies AgentEvent);\n    }\n    const delta = fullText.startsWith(this.prevText)\n      ? fullText.slice(this.prevText.length)\n      : fullText;\n    this.prevText = fullText;\n    if (delta) {\n      this.emit(\"agent-event\", {\n        type: \"message_update\",\n        message: asstMessage(fullText),\n        _textDelta: delta,\n      } satisfies AgentEvent);\n    }\n  }\n\n  protected pushAssistantEnd(fullText?: string): void {\n    if (!this.activeAssistant) return;\n    const text = fullText ?? this.prevText;\n    this.emit(\"agent-event\", {\n      type: \"message_end\",\n      message: asstMessage(text),\n    } satisfies AgentEvent);\n    this.activeAssistant = false;\n    this.prevText = \"\";\n  }\n\n  protected pushToolCall(name: string, input: unknown): void {\n    this.emit(\"agent-event\", {\n      type: \"tool_call\",\n      name,\n      tool: { name },\n      input,\n    } satisfies AgentEvent);\n  }\n\n  protected pushToolResult(name: string, data: unknown, isError = false): void {\n    this.pendingToolResults.push({ role: \"tool\", toolName: name, content: \"\", data, isError });\n    this.emit(\"agent-event\", {\n      type: \"tool_execution_end\",\n      toolName: name,\n    } satisfies AgentEvent);\n  }\n\n  private flushToolResults(): void {\n    if (this.pendingToolResults.length === 0) return;\n    this.emit(\"agent-event\", {\n      type: \"turn_end\",\n      toolResults: [...this.pendingToolResults],\n    } satisfies AgentEvent);\n    this.pendingToolResults = [];\n  }\n\n  protected pushResult(opts: {\n    tokens?: TokenUsage | null;\n    costUsd?: number;\n    summary?: string;\n    subtype?: string;\n  }): void {\n    this.pushAssistantEnd();\n    this.flushToolResults();\n    if (opts.tokens) this._lastTokens = opts.tokens;\n    this.sawResult = true;\n    this.emit(\"agent-event\", {\n      type: \"result\",\n      subtype: opts.subtype ?? \"success\",\n      summary: opts.summary,\n      costUsd: opts.costUsd ?? 0,\n      ...(opts.tokens ? { tokens: opts.tokens } : {}),\n    } satisfies AgentEvent);\n  }\n\n  protected pushError(detail: AgentError, fatal = false): void {\n    this.emit(\"agent-event\", {\n      type: \"error\",\n      error: detail.message,\n      detail,\n      fatal,\n    } satisfies AgentEvent);\n  }\n\n  protected captureSession(id?: string, file?: string): void {\n    if (!id || id === this._sessionId) return;\n    this._sessionId = id;\n    this.emit(\"agent-event\", {\n      type: \"session_info\",\n      driverSessionId: id,\n      ...(file ? { sessionFile: file } : {}),\n    } satisfies AgentEvent);\n  }\n\n  /** Shared keyword classification + per-driver hint copy (mirrors omp/codex). */\n  protected classifyMessage(message: string): AgentError {\n    const generic = classifyGenericErrorMessage(message);\n    if (!generic) {\n      return {\n        message,\n        category: \"unknown\",\n        retryable: true,\n        hint: `An unexpected ${this.productName} error occurred. Try the prompt again.`,\n      };\n    }\n    const hint =\n      generic.category === \"auth\"\n        ? `Check the API key / login configured for ${this.productName}.`\n        : generic.category === \"rate_limit\"\n          ? `${this.productName} hit a provider rate limit. Wait a moment and try again.`\n          : generic.category === \"model\"\n            ? \"The selected model is unavailable or the context is too long. Change the model or start a new session.\"\n            : `A network error occurred while talking to ${this.productName}.`;\n    return { message, category: generic.category, retryable: generic.retryable, hint };\n  }\n\n  // ── Env allowlist ──────────────────────────────────────────────────────────\n\n  /**\n   * Explicit env whitelist forwarded to the child. Omits anything provisioned\n   * by `provision_secrets` so user credentials stay out of the subprocess\n   * environment. Always passes through the driver's test-seam vars and\n   * `FAKE_CLI_*`.\n   *\n   * `config.env` is merged **over** the whitelist, not in place of it. It used\n   * to replace it wholesale, which meant any caller that set a single variable\n   * silently dropped `PATH` and `HOME` and the spawn failed with ENOENT —\n   * unusable as the delivery channel for registry-derived endpoint variables\n   * (plan §2.3, \"Delivery rule\"). Widening keeps both: the caller's variables\n   * win per key, the process still has a `PATH`.\n   */\n  protected baseEnv(extraKeys: string[] = []): Record<string, string> {\n    const out: Record<string, string> = {};\n    const explicit = [\"PATH\", \"HOME\", \"USER\", \"HOSTNAME\", \"SKAILE_SESSION_ID\", ...extraKeys];\n    for (const key of explicit) {\n      const v = process.env[key];\n      if (v !== undefined) out[key] = v;\n    }\n    for (const [key, value] of Object.entries(process.env)) {\n      if (typeof value !== \"string\") continue;\n      if (key.startsWith(`${this.envPrefix}_BRIDGE_`) || key.startsWith(\"FAKE_CLI_\")) {\n        out[key] = value;\n      }\n    }\n    if (this.config.sshKeyPath) {\n      out.GIT_SSH_COMMAND = `ssh -i \"${this.config.sshKeyPath}\" -o StrictHostKeyChecking=accept-new`;\n    }\n    if (this.config.env) Object.assign(out, this.config.env);\n    return out;\n  }\n\n  // ── Internals ────────────────────────────────────────────────────────────\n\n  private onStdoutLine(line: string): void {\n    if (!line.trim()) return;\n    let json: unknown;\n    try {\n      json = JSON.parse(line);\n    } catch {\n      this.log.debug(\"non-JSON stdout line\", { line });\n      return;\n    }\n    try {\n      this.handleJson(json);\n    } catch (err) {\n      this.log.warn(\"handleJson threw\", { error: String(err) });\n    }\n  }\n\n  private onExit(code: number | null, signal: NodeJS.Signals | null): void {\n    this.cleanup();\n\n    if (this.aborting) {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n      this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n      this.settleResolve();\n      return;\n    }\n\n    if (this.mode === \"buffered\" && (code === 0 || code === null)) {\n      try {\n        this.handleBuffered(this.stdoutBuffer);\n      } catch (err) {\n        this.log.warn(\"handleBuffered threw\", { error: String(err) });\n      }\n    }\n\n    const exitErr = this.classifyExit(code, signal);\n    if (exitErr && !this.sawResult) {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n      this.pushError(exitErr);\n      this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n      this.settleReject(Object.assign(new Error(exitErr.message), { detail: exitErr }));\n      return;\n    }\n\n    // Clean exit (or non-zero exit after a result already streamed): close any\n    // open assistant message, synthesize a success result if none arrived, end.\n    if (!this.sawResult) this.pushResult({ summary: \"Task completed\" });\n    else {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n    }\n    this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n    this.settleResolve();\n  }\n\n  private settleResolve(): void {\n    const resolve = this.turnResolve;\n    this.turnResolve = null;\n    this.turnReject = null;\n    resolve?.();\n  }\n\n  private settleReject(err: Error): void {\n    const reject = this.turnReject;\n    this.turnResolve = null;\n    this.turnReject = null;\n    reject?.(err);\n  }\n\n  private cleanup(): void {\n    this.rl?.close();\n    this.rl = null;\n    this.proc = null;\n  }\n\n  private classifyProcessError(err: NodeJS.ErrnoException): AgentError {\n    if (err.code === \"ENOENT\") {\n      return {\n        message: `${this.defaultBin} command not found`,\n        category: \"config\",\n        retryable: false,\n        hint: this.installHint(),\n      };\n    }\n    if (err.code === \"EACCES\") {\n      return {\n        message: `Permission denied running ${this.defaultBin}`,\n        category: \"config\",\n        retryable: false,\n        hint: `Check file permissions for the ${this.defaultBin} binary.`,\n      };\n    }\n    return {\n      message: err.message,\n      category: \"process\",\n      retryable: true,\n      hint: `An unexpected process error occurred running ${this.productName}. Try again.`,\n    };\n  }\n}\n\n// ───────────────────────────────────────────────────────────────────────────\n// Tolerant JSON extractors — shared because the upstream stream-json schemas\n// are not fully pinned; read the common field-name variants defensively.\n// ───────────────────────────────────────────────────────────────────────────\n\nfunction asstMessage(text: string): AgentMessage {\n  return { role: \"assistant\", content: [{ type: \"text\", text }] };\n}\n\n/** Pull assistant text out of a CLI event, trying the common field names. */\nexport function extractText(json: any): string {\n  if (typeof json?.text === \"string\") return json.text;\n  if (typeof json?.delta === \"string\") return json.delta;\n  if (typeof json?.content === \"string\") return json.content;\n  if (typeof json?.response === \"string\") return json.response;\n  const msg = json?.message;\n  if (typeof msg?.content === \"string\") return msg.content;\n  if (Array.isArray(msg?.content)) {\n    return msg.content\n      .filter(\n        (b: any) => (b?.type === \"text\" || b?.type === undefined) && typeof b?.text === \"string\",\n      )\n      .map((b: any) => b.text)\n      .join(\"\");\n  }\n  if (Array.isArray(json?.parts)) {\n    return json.parts\n      .filter((p: any) => typeof p?.text === \"string\")\n      .map((p: any) => p.text)\n      .join(\"\");\n  }\n  return \"\";\n}\n\n/** Map a CLI usage/stats object onto {@link TokenUsage}, trying common field names. */\nexport function extractTokens(json: any): TokenUsage | null {\n  const u = json?.usage ?? json?.stats?.usage ?? json?.stats ?? json?.tokens ?? json;\n  if (!u || typeof u !== \"object\") return null;\n  const input = u.input_tokens ?? u.inputTokens ?? u.prompt_tokens ?? u.promptTokenCount ?? u.input;\n  const output =\n    u.output_tokens ?? u.outputTokens ?? u.completion_tokens ?? u.candidatesTokenCount ?? u.output;\n  const cacheRead = u.cached_input_tokens ?? u.cacheReadTokens ?? u.cachedContentTokenCount;\n  if (input === undefined && output === undefined) return null;\n  const tokens: TokenUsage = {};\n  if (typeof input === \"number\") tokens.inputTokens = input;\n  if (typeof output === \"number\") tokens.outputTokens = output;\n  if (typeof cacheRead === \"number\") tokens.cacheReadTokens = cacheRead;\n  return tokens;\n}\n\n/** Pull a per-turn USD cost from a CLI result object, or `undefined`. */\nexport function extractCost(json: any): number | undefined {\n  const c =\n    json?.cost ?? json?.costUsd ?? json?.total_cost_usd ?? json?.stats?.cost ?? json?.usage?.cost;\n  return typeof c === \"number\" ? c : undefined;\n}\n"]}

package/dist/{chunk-DZ4UZOFB.js → chunk-M5H4DWIA.js}

@@ -2,7 +2,7 @@ import { AssetKindRegistryFrozenError, AssetKindConflictError, AssetKindPatternC
 import { decodeSkaileManifest, SKAILE_MANIFEST_FILENAME } from './chunk-P4VHQA4N.js';
 import { parseFrontmatter } from './chunk-MKZOK4JU.js';
 import { isValidAssetName } from './chunk-GEEW6SY2.js';
-import { validatePersona, validateRuleset, validateSkill, validateAgent, validateConnector, validateMcpServer, validateContract, validatePrompt, validatePreset } from './chunk-AN6NAFRT.js';
+import { validatePersona, validateRuleset, validateSkill, validateAgent, validateConnector, validateMcpServer, validateContract, validatePrompt, validatePreset } from './chunk-N7B3LZ7V.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
@@ -2437,5 +2437,5 @@ function validateRequiresSyntax2(requires) {
 var VERSION = "0.0.0";
 
 export { AGENT_COMPANION_DIRS, AssetKindRegistry, BUILTIN_PROVIDERS, DEFAULT_ATOMIZATION_POLICY, DOMAIN_MD_FILENAME, SEMVER_RE, SKILL_COMPANION_DIRS, SourceConfigSchema, VERSION, agentProvider, assignDomain, barePublisher, buildDomainIndex, buildRequiresGraph, closeOverReferences, computeDeterministicHash, computeDeterministicHashDetailed, connectorProvider, contractProvider, createDefaultRegistry, createNodeAssetFs, decodeManifestSourceConfig, detectCycles, discoverAssetsInTree, discoverAssetsInTreeEntries, discoverFromManifest, extractPathCandidates, extractRequires, extractSlashCommands, isDomainMdPath, isExcludedDevPath, isManifestMode, lintUncoveredReferences, loadMergedSourceConfig, loadMergedSourceConfigFromFile, loadSourceConfig, manifestToSourceConfig, mcpServerProvider, mergeSourceConfigs, parseDomainMd, parseSourceConfig, personaProvider, presetProvider, promptProvider, readManifestSourceConfig, rulesetProvider, scanAssetReferences, scanSlashCommandNames, skillProvider, validateDomains, validateSourceConfig };
-//# sourceMappingURL=chunk-DZ4UZOFB.js.map
-//# sourceMappingURL=chunk-DZ4UZOFB.js.map
+//# sourceMappingURL=chunk-M5H4DWIA.js.map
+//# sourceMappingURL=chunk-M5H4DWIA.js.map