@skaile/workspaces 3.27.1 → 4.0.0

package/dist/core/src/provider-registry-credentials.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Credential resolution for registry entries (§1.4).
+ *
+ * Split from `provider-registry.ts` deliberately: resolving a `cmd:` reference
+ * spawns a process and `env:` reads `process.env`, so this module depends on
+ * Node. The schema module must stay dependency-free because browser bundles
+ * (`@skaile/workspace-bridge-react`) reach the registry *types* through
+ * `@skaile/workspaces/types`, and a `node:child_process` import in that graph
+ * breaks their typecheck.
+ *
+ * @see PROVIDER-CONFIG-PLAN.md §1.4
+ */
+import type { AIProviderCredentialKind, AIProviderEntry } from "./provider-registry.js";
+/** Options for {@link resolveCredential}. */
+export interface ResolveCredentialOptions {
+    /** Environment `env:` refs read from; defaults to `process.env`. */
+    env?: Record<string, string | undefined>;
+    /**
+     * Control-plane secrets, keyed by config id (a `platform:<configId>` ref) —
+     * the `secrets` map that rides alongside `session_init`.
+     */
+    secrets?: Record<string, string>;
+    /** Run `cmd:` references. Default `true`; the platform sets it `false`. */
+    allowCommand?: boolean;
+}
+/** Outcome of {@link resolveCredential}. Never carries the secret in `error`. */
+export interface ResolvedAIProviderCredential {
+    kind: AIProviderCredentialKind;
+    /** The secret, when one was produced. */
+    value?: string;
+    /** Where the value came from; `ambient` means the transport's own chain signs. */
+    source: "env" | "cmd" | "platform" | "keyring" | "ambient" | "none";
+    /** Why there is no value. Secret-free. */
+    error?: string;
+}
+/** Test seam — drops the memoized `cmd:` results. */
+export declare function __resetCredentialCommandCache(): void;
+/**
+ * Resolve an entry's credential to a value (§1.4).
+ *
+ * `env:` reads the environment, `cmd:` runs a shell (10 s, trimmed stdout,
+ * cached per process), `platform:` reads the injected secrets map. `keyring:`
+ * is a reserved grammar slot: it validates but does not resolve, and says so.
+ *
+ * `sigv4`, `google_adc` and `azure_entra` entries without a ref resolve to
+ * `source: "ambient"` with no value — the AWS/Google/Azure SDK chain signs the
+ * request, there is nothing for this function to hand over.
+ */
+export declare function resolveCredential(entry: AIProviderEntry, options?: ResolveCredentialOptions): ResolvedAIProviderCredential;
+//# sourceMappingURL=provider-registry-credentials.d.ts.map

package/dist/core/src/provider-registry-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry-credentials.d.ts","sourceRoot":"","sources":["../../../core/src/provider-registry-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIxF,6CAA6C;AAC7C,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IACpE,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD,qDAAqD;AACrD,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,wBAA6B,GACrC,4BAA4B,CAqE9B"}

package/dist/core/src/provider-registry-files.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Reading and writing `providers.yml` — the two on-disk layers of the AI
+ * provider registry (§1.5).
+ *
+ * `~/.skaile/providers.yml` is the default home for endpoint definitions;
+ * `<workspace>/.skaile/providers.yml` overrides it per project and is
+ * gitignored by `skaile init`. Higher layers (CLI/runtime overrides and the
+ * control-plane session layer) never touch disk — callers pass them to
+ * {@link loadProviderRegistry} as extra layers.
+ *
+ * @see PROVIDER-CONFIG-PLAN.md §1.5, §2.1
+ */
+import { type AIProviderDiagnostic, type AIProviderRegistryDocument, type AIProviderRegistryLayer, type AIProviderRegistryPatch, type MergedAIProviderRegistry } from "./provider-registry.js";
+/** The registry filename in both layers. */
+export declare const PROVIDERS_FILENAME = "providers.yml";
+/** `~/.skaile/providers.yml` — honours `$SKAILE_HOME`. */
+export declare function userProviderRegistryPath(): string;
+/** `<projectDir>/.skaile/providers.yml`. */
+export declare function workspaceProviderRegistryPath(projectDir: string): string;
+/** One loaded registry file. */
+export interface ProviderRegistryFile {
+    /** Layer the file feeds. */
+    layer: "user" | "workspace";
+    path: string;
+    exists: boolean;
+    /**
+     * The layer this file contributes. Entries may be partial: a file that names
+     * `base_url` alone overrides that one field (§1.5). Empty when the file is
+     * absent or every entry was malformed.
+     */
+    document: AIProviderRegistryDocument;
+    diagnostics: AIProviderDiagnostic[];
+}
+/**
+ * Read one registry file as **one layer** of the §1.5 stack. A missing file is
+ * not an error — it is an empty layer. A malformed one yields diagnostics,
+ * never an exception.
+ *
+ * Only the checks that stand on their own run here (types, URLs, the
+ * credential grammar, literal secrets); whether an entry is *complete* is
+ * decided on the merged registry by {@link loadProviderRegistry}, because the
+ * layer below may be the one that names its `kind`.
+ */
+export declare function loadProviderRegistryFile(filePath: string, layer: "user" | "workspace"): ProviderRegistryFile;
+/**
+ * Write a registry document, creating `.skaile/` when needed.
+ *
+ * The document is serialized verbatim: the file holds references, never
+ * secrets, so there is nothing to redact — and {@link validateRegistry} is the
+ * gate that keeps it that way. Callers validate before writing.
+ *
+ * @returns the path written.
+ */
+export declare function saveProviderRegistryFile(filePath: string, document: AIProviderRegistryDocument): string;
+/** Options for {@link loadProviderRegistry}. */
+export interface LoadProviderRegistryOptions {
+    /** Workspace whose `.skaile/providers.yml` is layered on top of the user file. */
+    projectDir?: string;
+    /**
+     * Layers that do not come from these two files — the catalog layer from
+     * `bridge/src/provider-catalog.ts`, CLI/runtime overrides, and the
+     * control-plane session layer. Precedence follows each layer's id, not this
+     * array's order.
+     */
+    extraLayers?: AIProviderRegistryLayer[];
+}
+/** The merged registry plus the files it came from. */
+export interface LoadedProviderRegistry {
+    /** Merged and gated: every entry here is complete. */
+    registry: MergedAIProviderRegistry;
+    /**
+     * The same merge **before** the gate: every configured entry, complete or
+     * not, as the layers left it. This is what a caller that has to see the
+     * configured entries in order to build another layer reads — the catalog
+     * layer expands the presets these entries name, and an entry whose `kind`
+     * comes from its preset is still incomplete here, so it is absent from
+     * `registry`.
+     */
+    patches: AIProviderRegistryPatch;
+    files: ProviderRegistryFile[];
+    /**
+     * Every file's diagnostics in layer order, then the merge's own — an entry
+     * no layer completed is reported here, naming the files that fed it.
+     */
+    diagnostics: AIProviderDiagnostic[];
+}
+/**
+ * Load `~/.skaile/providers.yml` and, when a project directory is given,
+ * `<projectDir>/.skaile/providers.yml`, then merge them with any extra layers
+ * per §1.5 and gate the result.
+ *
+ * Merge *then* validate: each file is read as a patch, so a workspace entry
+ * that sets one field of an entry the user file defines is applied over it
+ * rather than dropped for being incomplete on its own.
+ */
+export declare function loadProviderRegistry(options?: LoadProviderRegistryOptions): LoadedProviderRegistry;
+//# sourceMappingURL=provider-registry-files.d.ts.map

package/dist/core/src/provider-registry-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry-files.d.ts","sourceRoot":"","sources":["../../../core/src/provider-registry-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAE5B,KAAK,wBAAwB,EAI9B,MAAM,wBAAwB,CAAC;AAEhC,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAIlD,0DAA0D;AAC1D,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,4CAA4C;AAC5C,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,gCAAgC;AAChC,MAAM,WAAW,oBAAoB;IACnC,4BAA4B;IAC5B,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,QAAQ,EAAE,0BAA0B,CAAC;IACrC,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,WAAW,GAC1B,oBAAoB,CA2BtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,0BAA0B,GACnC,MAAM,CAKR;AAED,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACzC;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,sDAAsD;IACtD,QAAQ,EAAE,wBAAwB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,uBAAuB,CAAC;IACjC,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B;;;OAGG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,2BAAgC,GACxC,sBAAsB,CA4BxB"}

package/dist/core/src/provider-registry.d.ts

@@ -0,0 +1,450 @@
+/**
+ * The AI provider registry — one keyed definition of every LLM / voice endpoint
+ * the runtime may talk to.
+ *
+ * This module is the **single canonical home** of the registry record: its
+ * types, its validation, the layered merge (§1.5), the `base_url` derivation
+ * (§1.3), the credential-reference grammar (§1.4) and the model-reference
+ * parser. Nothing here is duplicated in `bridge`, `runner` or `platform` — the
+ * structurally-identical-copy pattern that `CloudConfig` fell into is exactly
+ * what this module exists to avoid.
+ *
+ * Vocabulary: this is the **AI provider** registry. It is unrelated to the
+ * platform's connector `ProviderType` / `ProviderLink` (git, SharePoint,
+ * Drive…). Types are named `AIProvider*` throughout, never bare `Provider*`.
+ *
+ * The `surface` enum is omp's `api` vocabulary verbatim, so the omp adapter is
+ * a serializer rather than a translator.
+ *
+ * @see PROVIDER-CONFIG-PLAN.md §1
+ */
+/**
+ * What an entry produces. `llm` and `embed` carry a wire `surface`; `stt` and
+ * `tts` use the reduced voice record (§1.7).
+ */
+export declare const AI_PROVIDER_KINDS: readonly ["llm", "stt", "tts", "embed"];
+/** Union of {@link AI_PROVIDER_KINDS}. */
+export type AIProviderKind = (typeof AI_PROVIDER_KINDS)[number];
+/** Kinds that use the voice subset of the record (§1.7). */
+export declare const AI_PROVIDER_VOICE_KINDS: readonly ["stt", "tts"];
+/** Union of {@link AI_PROVIDER_VOICE_KINDS}. */
+export type AIProviderVoiceKind = (typeof AI_PROVIDER_VOICE_KINDS)[number];
+/**
+ * Wire protocol — the discriminator a driver adapter switches on. These are
+ * omp's `api` values verbatim (Codex CLI calls the same concept `wire_api`).
+ */
+export declare const AI_PROVIDER_SURFACES: readonly ["anthropic-messages", "openai-completions", "openai-responses", "openai-codex-responses", "azure-openai-responses", "bedrock-converse-stream", "google-generative-ai", "google-vertex"];
+/** Union of {@link AI_PROVIDER_SURFACES}. */
+export type AIProviderSurface = (typeof AI_PROVIDER_SURFACES)[number];
+/** How the request reaches the surface — selects the `params` shape (§1.3). */
+export declare const AI_PROVIDER_TRANSPORTS: readonly ["direct", "bedrock", "vertex", "foundry", "azure-openai"];
+/** Union of {@link AI_PROVIDER_TRANSPORTS}. */
+export type AIProviderTransport = (typeof AI_PROVIDER_TRANSPORTS)[number];
+/**
+ * How the credential is presented (§1.4). `command` is a reserved grammar slot:
+ * the schema accepts it, no refresh loop ships yet.
+ */
+export declare const AI_PROVIDER_CREDENTIAL_KINDS: readonly ["api_key_header", "bearer", "sigv4", "google_adc", "azure_entra", "oauth", "none", "command"];
+/** Union of {@link AI_PROVIDER_CREDENTIAL_KINDS}. */
+export type AIProviderCredentialKind = (typeof AI_PROVIDER_CREDENTIAL_KINDS)[number];
+/** omp-compatible model-discovery probes. Unknown values are tolerated with a warning. */
+export declare const AI_PROVIDER_DISCOVERY_TYPES: readonly ["openai-models-list", "anthropic-models-list", "google-models-list", "none"];
+/** Union of {@link AI_PROVIDER_DISCOVERY_TYPES}. */
+export type AIProviderDiscoveryType = (typeof AI_PROVIDER_DISCOVERY_TYPES)[number];
+/**
+ * Configuration layers, **lowest precedence first** (§1.5). `runtime` is the
+ * CLI/runtime override layer (`--model`, `--api-key`); `session` is the
+ * control-plane layer the platform injects into `session_init`.
+ */
+export declare const AI_PROVIDER_LAYERS: readonly ["catalog", "user", "workspace", "runtime", "session"];
+/** Union of {@link AI_PROVIDER_LAYERS}. */
+export type AIProviderLayerId = (typeof AI_PROVIDER_LAYERS)[number];
+/** `transport: bedrock` routing parameters. */
+export interface AIProviderBedrockParams {
+    /** AWS region, e.g. `us-east-1`. */
+    region: string;
+}
+/** `transport: vertex` routing parameters. */
+export interface AIProviderVertexParams {
+    /** GCP project id. */
+    project: string;
+    /** Vertex location, e.g. `europe-west4`. */
+    location: string;
+    /** Model publisher; defaults to `google` (use `anthropic` for Claude on Vertex). */
+    publisher?: string;
+}
+/** `transport: foundry` routing parameters. */
+export interface AIProviderFoundryParams {
+    /** Azure AI Foundry resource name (the `{resource}` in the endpoint host). */
+    resource: string;
+}
+/**
+ * `transport: azure-openai` routing parameters. `resource` is required even
+ * though the plan's §1.3 table lists only `deployment`/`api_version`: the
+ * derived `base_url` in that same row interpolates `{resource}`.
+ */
+export interface AIProviderAzureOpenAIParams {
+    /** Azure OpenAI resource name (the `{resource}` in the endpoint host). */
+    resource: string;
+    /** Deployment name the request is routed to. */
+    deployment: string;
+    /** `api-version` query value; mirrored into `query_params` by the adapter. */
+    api_version: string;
+}
+/** Free-form voice parameters, typed per preset (Deepgram, ElevenLabs, …). */
+export type AIProviderVoiceParams = Record<string, string | number | boolean>;
+/**
+ * The `transport` → `params` discriminated union (§1.3, decision §9.9). An open
+ * `Record<string, string>` would lose per-transport field rendering in the
+ * admin UI, so the pairing is encoded in the type.
+ */
+export type AIProviderTransportSlice = {
+    transport?: "direct";
+    params?: Record<string, never>;
+} | {
+    transport: "bedrock";
+    params: AIProviderBedrockParams;
+} | {
+    transport: "vertex";
+    params: AIProviderVertexParams;
+} | {
+    transport: "foundry";
+    params: AIProviderFoundryParams;
+} | {
+    transport: "azure-openai";
+    params: AIProviderAzureOpenAIParams;
+};
+/** Reference to a secret. Never the secret itself — see {@link parseCredentialRef}. */
+export interface AIProviderCredential {
+    kind: AIProviderCredentialKind;
+    /**
+     * `env:NAME` · `cmd:<shell>` · `platform:<configId>` · `keyring:<service>/<account>`.
+     * A literal secret here is a validation error.
+     */
+    ref?: string;
+}
+/** Per-model capability facts; unknown ids otherwise truncate silently. */
+export interface AIProviderCapabilities {
+    context_window?: number;
+    tools?: boolean;
+    images?: boolean;
+    thinking_max?: number;
+}
+/** omp-compatible discovery descriptor. */
+export interface AIProviderDiscovery {
+    type: AIProviderDiscoveryType | (string & {});
+    /** Path appended to `base_url` when the surface default does not apply. */
+    path?: string;
+}
+/** Fields every entry carries, whatever its `kind`. */
+export interface AIProviderEntryCommon {
+    /** Display name. Never load-bearing. */
+    label?: string;
+    /** Catalog preset this entry inherits from (`bridge/src/provider-catalog.ts`). */
+    preset?: string;
+    /** Literal endpoint; wins over the preset value and the transport derivation. */
+    base_url?: string;
+    /** Static, non-secret request headers. */
+    headers?: Record<string, string>;
+    credential?: AIProviderCredential;
+    /** Default `true`; read it through {@link isEntryEnabled}. */
+    enabled?: boolean;
+    /** Set by the control plane: lower layers cannot override this entry (§1.5). */
+    locked?: boolean;
+}
+/** An `llm`/`embed` entry — the full record. */
+export type AIProviderLlmEntry = AIProviderEntryCommon & AIProviderTransportSlice & {
+    kind: "llm" | "embed";
+    /** Required unless a `preset` supplies it. */
+    surface?: AIProviderSurface;
+    /** Azure's `api-version` lives here. */
+    query_params?: Record<string, string>;
+    /** Logical id → provider-side id. */
+    model_map?: Record<string, string>;
+    /** Keyed by the *logical* id, i.e. the `model_map` key. */
+    capabilities?: Record<string, AIProviderCapabilities>;
+    discovery?: AIProviderDiscovery;
+};
+/**
+ * An `stt`/`tts` entry — the reduced record (§1.7). `surface`, `transport`,
+ * `model_map`, `capabilities` and `discovery` are `llm`-only and rejected here:
+ * a TTS voice is not a wire protocol.
+ */
+export type AIProviderVoiceEntry = AIProviderEntryCommon & {
+    kind: AIProviderVoiceKind;
+    /** Preset-typed: Deepgram `{model, language}`, ElevenLabs `{voice_id, output_format}`. */
+    params?: AIProviderVoiceParams;
+};
+/** One registry entry. */
+export type AIProviderEntry = AIProviderLlmEntry | AIProviderVoiceEntry;
+/** Entry id → entry. Iteration order is registry order. */
+export type AIProviderRegistry = Record<string, AIProviderEntry>;
+/**
+ * Any entry's `params`: transport routing parameters (§1.3) or voice options
+ * (§1.7). Which of them applies is decided by `transport` and `kind`, and a
+ * layer may not carry either — so a patch holds the union and
+ * {@link validateMergedRegistry} narrows it.
+ */
+export type AIProviderParams = AIProviderBedrockParams | AIProviderVertexParams | AIProviderFoundryParams | AIProviderAzureOpenAIParams | AIProviderVoiceParams;
+/**
+ * An entry as a single layer may write it (§1.5): any subset of the record,
+ * `kind` included. A `<workspace>/.skaile/providers.yml` that names `base_url`
+ * alone is an override of one field, not a redefinition — so a layer holds
+ * patches, and completeness is gated on the merged entry
+ * ({@link validateMergedRegistry}) rather than per layer.
+ *
+ * Every {@link AIProviderEntry} is a patch; the reverse needs the gate. The
+ * `transport`/`params` pairing is deliberately un-discriminated here, because
+ * the two halves may come from different layers.
+ */
+export type AIProviderEntryPatch = AIProviderEntryCommon & {
+    kind?: AIProviderKind;
+    surface?: AIProviderSurface;
+    transport?: AIProviderTransport;
+    params?: AIProviderParams;
+    query_params?: Record<string, string>;
+    model_map?: Record<string, string>;
+    capabilities?: Record<string, AIProviderCapabilities>;
+    discovery?: AIProviderDiscovery;
+};
+/** Entry id → partial entry: one layer's contribution to the registry. */
+export type AIProviderRegistryPatch = Record<string, AIProviderEntryPatch>;
+/** A parsed `providers.yml` document — one layer, so entries may be partial. */
+export interface AIProviderRegistryDocument {
+    version: 1;
+    providers: AIProviderRegistryPatch;
+}
+/** One input to {@link mergeRegistries}. */
+export interface AIProviderRegistryLayer {
+    layer: AIProviderLayerId;
+    providers: AIProviderRegistryPatch;
+}
+/** The merged view every consumer reads. */
+export interface MergedAIProviderRegistry {
+    version: 1;
+    providers: AIProviderRegistry;
+    /**
+     * Registry order: highest-precedence layer first, document order within a
+     * layer. Bare model ids resolve down this list (§1.6).
+     */
+    order: string[];
+    /** Highest-precedence layer that contributed to each entry. */
+    origin: Record<string, AIProviderLayerId>;
+    /** Entries frozen by `locked: true`; lower layers were ignored for these. */
+    locked: string[];
+}
+/** Severity of an {@link AIProviderDiagnostic}. */
+export type AIProviderDiagnosticSeverity = "error" | "warning";
+/**
+ * A structured note about a registry document. {@link validateRegistry} never
+ * throws: every problem is reported here with the offending key in `path`, and
+ * each caller (CLI, runner, platform) decides how loud to be.
+ */
+export interface AIProviderDiagnostic {
+    /** Stable machine code, e.g. `"literal_secret"` / `"unknown_surface"`. */
+    code: string;
+    severity: AIProviderDiagnosticSeverity;
+    /** Human-readable, actionable message. */
+    message: string;
+    /** Dotted path to the offending key, e.g. `providers.groq.headers.x-api-key`. */
+    path: string;
+}
+/** Result of {@link validateRegistry}: the surviving document plus every note. */
+export interface RegistryValidation {
+    /** Entries that produced an error diagnostic are omitted. */
+    document: AIProviderRegistryDocument;
+    diagnostics: AIProviderDiagnostic[];
+}
+/**
+ * `transport` → `base_url` template (§1.3). Placeholders are `params` keys.
+ * `direct` has no template: it uses the preset literal or an explicit value.
+ */
+export declare const AI_PROVIDER_BASE_URL_TEMPLATES: Record<Exclude<AIProviderTransport, "direct">, string>;
+/** True when `id` is usable as a registry key (`[a-z0-9][a-z0-9_-]*`). */
+export declare function isSafeProviderId(id: string): boolean;
+/**
+ * True when `value` must not appear literally under `key`.
+ *
+ * A value is acceptable when it is an indirection — a `${...}` interpolation or
+ * one of the four `credential.ref` forms. Otherwise a value is a literal secret
+ * when the key names a credential-bearing header (`authorization`, `x-api-key`,
+ * the bare `key` query param Google uses…) or when the value itself has the
+ * shape of a token (`sk-…`, `AIza…`, a 40-char opaque blob…).
+ *
+ * Non-secret literals stay legal: `anthropic-version: 2023-06-01`,
+ * `api-version: 2026-01-01`, `HTTP-Referer: https://skaile.ai`.
+ */
+export declare function looksLikeLiteralSecret(key: string, value: string): boolean;
+/** Options for {@link validateRegistry}. */
+export interface ValidateRegistryOptions {
+    /** Prefix for diagnostic paths — normally the file the document came from. */
+    source?: string;
+    /**
+     * The layer this document feeds. Given — and not `catalog` — the document is
+     * read as **one layer** of the §1.5 stack: an entry may be a partial
+     * override, so a `kind`, `surface` or transport `params` that another layer
+     * supplies is not an error here. {@link validateMergedRegistry} gates the
+     * merged entry instead.
+     *
+     * Omitted, the document has to stand on its own: every entry must be
+     * complete, which is what a writer (`skaile providers add`) checks the entry
+     * it just built against.
+     */
+    layer?: AIProviderLayerId;
+}
+/**
+ * Validate a parsed `providers.yml` document (§1.1–§1.7).
+ *
+ * Total: never throws. Entries that produce an error are omitted from
+ * `document`, mirroring the resolver's per-entry skip semantics — one bad entry
+ * must not take the whole registry down. Every diagnostic names the offending
+ * key in `path`.
+ *
+ * Enforced here whatever the mode: safe entry ids, the `kind`/`surface`/
+ * `transport`/`credential.kind` enums, the value types, and the
+ * no-literal-secrets rule for `credential.ref`, `headers`, `query_params`,
+ * `params` and `base_url` userinfo — a secret must be caught in the file it
+ * was written into, not in an anonymous merged document.
+ *
+ * Enforced only when {@link ValidateRegistryOptions.layer} says this document
+ * is complete on its own: that an entry has a `kind`, that an `llm` entry has a
+ * `surface`, the voice subset (§1.7), and the per-transport `params` union
+ * (§1.3). Those depend on `kind`, which a layer may leave to a lower one.
+ *
+ * Defaults are deliberately **not** materialized: writing `enabled: true` or
+ * `transport: direct` into a layer would let that layer's implicit default
+ * override a lower layer's explicit value during the merge. Read them through
+ * {@link isEntryEnabled} / {@link entryTransport}.
+ */
+export declare function validateRegistry(raw: unknown, options?: ValidateRegistryOptions): RegistryValidation;
+/** `enabled` defaults to `true`. */
+export declare function isEntryEnabled(entry: AIProviderEntry): boolean;
+/** `transport` defaults to `direct`; voice entries have none. */
+export declare function entryTransport(entry: AIProviderEntry): AIProviderTransport | undefined;
+/**
+ * Resolve an entry's endpoint (§1.3).
+ *
+ * An explicit `base_url` always wins. Otherwise the transport's template is
+ * interpolated from `params` (`publisher` defaults to `google` for Vertex).
+ * `transport: direct` has no derivation — an entry that reaches here without a
+ * `base_url` inherits one from its preset, which the catalog layer supplies
+ * during the merge.
+ */
+export declare function resolveEntryBaseUrl(entry: AIProviderEntry): string | undefined;
+/**
+ * Merge registry layers into one view (§1.5).
+ *
+ * Precedence is taken from each layer's `layer` id, not from array position:
+ * `catalog` < `user` < `workspace` < `runtime` < `session`. Two layers with the
+ * same id are applied in array order, earliest winning. The merge is per key
+ * and deep — a workspace entry that sets only `base_url` keeps the user
+ * entry's credential, headers and model map.
+ *
+ * `locked: true` freezes an entry: every **lower** layer's contribution to that
+ * id is dropped silently, which is what makes a control-plane-pinned endpoint
+ * un-overridable from a checkout. (`skaile providers set` refuses loudly
+ * instead — silence is only correct for the merge.)
+ *
+ * This is a fold over layer *patches* and checks nothing: an entry no layer
+ * completed comes out of here incomplete. {@link validateMergedRegistry} is
+ * the gate — {@link loadProviderRegistry} runs it, and any other caller that
+ * merges hand-written layers has to as well.
+ */
+export declare function mergeRegistries(layers: AIProviderRegistryLayer[]): MergedAIProviderRegistry;
+/** One labelled input to {@link validateMergedRegistry}. */
+export interface AIProviderRegistrySource {
+    /** Where the layer came from — the file path, for the two on-disk layers. */
+    label: string;
+    providers: AIProviderRegistryPatch;
+}
+/** Options for {@link validateMergedRegistry}. */
+export interface ValidateMergedRegistryOptions {
+    /**
+     * The layers that were merged, labelled. A merge-time diagnostic names the
+     * files that contributed the entry, because those are what the operator has
+     * to edit — collapsing the layers into one anonymous document would lose
+     * exactly the information the error is about.
+     */
+    sources?: AIProviderRegistrySource[];
+}
+/** Result of {@link validateMergedRegistry}. */
+export interface MergedRegistryValidation {
+    /** The merged view, with every entry no layer completed removed. */
+    registry: MergedAIProviderRegistry;
+    diagnostics: AIProviderDiagnostic[];
+}
+/**
+ * Gate the **merged** registry (§1.5) — the completeness half of validation.
+ *
+ * {@link validateRegistry} in layer mode accepts a partial entry, because a
+ * workspace file that names `base_url` alone is an override, not a
+ * redefinition. This is where an entry has to be whole: only here has every
+ * layer folded in, so only here is `kind` known and with it which record
+ * applies (§1.7), whether a `surface` is missing, and which transport the
+ * `params` belong to (§1.3).
+ *
+ * Entries that fail are dropped, so a consumer never sees a half-defined
+ * endpoint. Every diagnostic names the entry id and — when `sources` are
+ * given — the layers that fed the entry, whatever the check that raised it.
+ */
+export declare function validateMergedRegistry(merged: MergedAIProviderRegistry, options?: ValidateMergedRegistryOptions): MergedRegistryValidation;
+/** Entries of a registry in registry order, as `[id, entry]` pairs. */
+export declare function registryEntries(registry: AIProviderRegistry | MergedAIProviderRegistry): Array<[string, AIProviderEntry]>;
+/** A parsed `credential.ref` (§1.4). */
+export type AIProviderCredentialRef = {
+    form: "env";
+    name: string;
+} | {
+    form: "cmd";
+    command: string;
+} | {
+    form: "platform";
+    configId: string;
+} | {
+    form: "keyring";
+    service: string;
+    account: string;
+};
+/**
+ * Parse a `credential.ref`. Returns `undefined` for anything that is not one of
+ * the four reference forms — which, in a registry file, means a literal secret.
+ */
+export declare function parseCredentialRef(ref: string): AIProviderCredentialRef | undefined;
+/** Render a parsed reference back to its `<form>:<body>` string. */
+export declare function formatCredentialRef(ref: AIProviderCredentialRef): string;
+/** A model selector resolved against a registry. */
+export interface ResolvedModelRef {
+    /** Entry the model routes to. */
+    providerId: string;
+    /**
+     * Logical model id, after `@role` expansion and before `model_map`. Absent
+     * only when a dangling role left the provider without a named model — the
+     * driver then uses its own default.
+     */
+    modelId?: string;
+    /** Provider-side id: `model_map[modelId] ?? modelId`. */
+    providerModelId?: string;
+    /** The role name, when the selector was `@role`. */
+    role?: string;
+    /** Non-fatal notes: a dangling role, a role pointing at an unknown provider. */
+    warnings: string[];
+}
+/**
+ * Resolve a model selector against a registry (§1.6, §9.8).
+ *
+ * Three forms:
+ * - `"<providerId>/<modelId>"` — explicit. The leading segment is only treated
+ *   as a provider when the registry actually has that entry, so vendor-scoped
+ *   ids (`meta-llama/Llama-3.3-70B`, `openai/gpt-oss-120b`) still resolve as
+ *   bare model ids.
+ * - `"<modelId>"` — bare; the first entry in registry order that maps the id
+ *   wins, else the first entry in registry order.
+ * - `"@role"` — resolved through `roles` (which lives in `skaile.yaml`). A
+ *   dangling role is **not** fatal: it falls back to registry order and reports
+ *   a warning.
+ *
+ * Returns `undefined` when no entry can serve the reference at all (an empty or
+ * fully-disabled registry).
+ */
+export declare function parseModelRef(ref: string, registry: AIProviderRegistry | MergedAIProviderRegistry, roles?: Record<string, string>): ResolvedModelRef | undefined;
+//# sourceMappingURL=provider-registry.d.ts.map

package/dist/core/src/provider-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.d.ts","sourceRoot":"","sources":["../../../core/src/provider-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH;;;GAGG;AACH,eAAO,MAAM,iBAAiB,yCAA0C,CAAC;AAEzE,0CAA0C;AAC1C,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,yBAA0B,CAAC;AAE/D,gDAAgD;AAChD,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,oBAAoB,mMASvB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,qEAMzB,CAAC;AAEX,+CAA+C;AAC/C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,4BAA4B,yGAS/B,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAcrF,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,wFAK9B,CAAC;AAEX,oDAAoD;AACpD,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,iEAAkE,CAAC;AAElG,2CAA2C;AAC3C,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAIpE,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,8EAA8E;AAC9E,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,SAAS,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAAE,GACxD;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACzD;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACvD;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACzD;IAAE,SAAS,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEvE,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,wBAAwB,CAAC;IAC/B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9C,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uDAAuD;AACvD,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GACpD,wBAAwB,GAAG;IACzB,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC;IACtB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACtD,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC,CAAC;AAEJ;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IACzD,IAAI,EAAE,mBAAmB,CAAC;IAC1B,0FAA0F;IAC1F,MAAM,CAAC,EAAE,qBAAqB,CAAC;CAChC,CAAC;AAEF,0BAA0B;AAC1B,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAExE,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GACxB,uBAAuB,GACvB,sBAAsB,GACtB,uBAAuB,GACvB,2BAA2B,GAC3B,qBAAqB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IACzD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACtD,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAE3E,gFAAgF;AAChF,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAED,4CAA4C;AAC5C,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,kBAAkB,CAAC;IAC9B;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAID,mDAAmD;AACnD,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,4BAA4B,CAAC;IACvC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,QAAQ,EAAE,0BAA0B,CAAC;IACrC,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AA+FD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CACjD,OAAO,CAAC,mBAAmB,EAAE,QAAQ,CAAC,EACtC,MAAM,CAOP,CAAC;AAMF,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAO1E;AA8rBD,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,uBAA4B,GACpC,kBAAkB,CAmEpB;AAID,oCAAoC;AACpC,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAE9D;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,mBAAmB,GAAG,SAAS,CAGtF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAc9E;AA2BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,uBAAuB,EAAE,GAAG,wBAAwB,CAqC3F;AAED,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAED,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C;;;;;OAKG;IACH,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACtC;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,QAAQ,EAAE,wBAAwB,CAAC;IACnC,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,wBAAwB,EAChC,OAAO,GAAE,6BAAkC,GAC1C,wBAAwB,CAyC1B;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,kBAAkB,GAAG,wBAAwB,GACtD,KAAK,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAKlC;AAUD,wCAAwC;AACxC,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAqBnF;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,uBAAuB,GAAG,MAAM,CAWxE;AAID,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA2BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,kBAAkB,GAAG,wBAAwB,EACvD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,gBAAgB,GAAG,SAAS,CA0C9B"}