@skaile/workspaces 4.15.0 → 4.16.0

package/dist/{chunk-NKRAHM7T.js → chunk-GMXG2JGN.js}

@@ -1,4 +1,4 @@
-import { factoryAssetRoots } from './chunk-NXTLDFLA.js';
+import { factoryAssetRoots } from './chunk-5RHPNNWP.js';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -19,5 +19,5 @@ var MONOREPO_ROOT = findMonorepoRoot(__ownDir);
 var AI_RESOURCES = factoryAssetRoots()[0] ?? path.join(os.homedir(), ".skaile", "libraries");
 
 export { AI_RESOURCES, MONOREPO_ROOT };
-//# sourceMappingURL=chunk-NKRAHM7T.js.map
-//# sourceMappingURL=chunk-NKRAHM7T.js.map
+//# sourceMappingURL=chunk-GMXG2JGN.js.map
+//# sourceMappingURL=chunk-GMXG2JGN.js.map

package/dist/{chunk-NKRAHM7T.js.map → chunk-GMXG2JGN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/paths.ts"],"names":[],"mappings":";;;;;;AAgBA,IAAM,WAAW,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAW5D,SAAS,iBAAiB,IAAA,EAA6B;AACrD,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,EAAA,CAAG,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,YAAY,CAAC,GAAG,OAAO,GAAA;AACxD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAYO,IAAM,aAAA,GAA+B,iBAAiB,QAAQ;AAc9D,IAAM,YAAA,GACX,iBAAA,EAAkB,CAAE,CAAC,CAAA,IAAK,IAAA,CAAK,IAAA,CAAK,EAAA,CAAG,OAAA,EAAQ,EAAG,SAAA,EAAW,WAAW","file":"chunk-NKRAHM7T.js","sourcesContent":["import fs from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { factoryAssetRoots } from \"@skaile/workspaces/core\";\n\n/**\n * The content-root policy lives in `@skaile/workspaces/core` so the flow\n * connector's resolution surfaces can reach it too — `factory-assets → cli`\n * would be a module cycle. Re-exported here because this module is the CLI's\n * documented path surface and every CLI caller imports it from here.\n *\n * @docLink cli/dev-guide#paths\n */\nexport { aiResourceRoots } from \"@skaile/workspaces/core\";\n\nconst __ownDir = path.dirname(fileURLToPath(import.meta.url));\n\n/**\n * Walk up from `from` looking for the monorepo marker (`biome.json`, the\n * repo-root shared tooling config). Returns the matching directory or `null`\n * when none is found within eight levels — the latter is the typical case when\n * `@skaile/workspaces` has been installed via `npm i` without a skaile-dev\n * workspace context. Used only to gate dev-only commands (e.g.\n * `serve --compile-test`); first-party content is located via\n * {@link aiResourceRoots}, not this.\n */\nfunction findMonorepoRoot(from: string): string | null {\n  let dir = from;\n  for (let i = 0; i < 8; i++) {\n    if (fs.existsSync(path.join(dir, \"biome.json\"))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Absolute path to the monorepo root, or `null` when the CLI is running\n * outside the skaile-dev workspace (typical for `npm i -g` installs).\n *\n * Consumers that only make sense inside the workspace (e.g.\n * `skaile serve --compile-test`) MUST check for `null` and report a\n * \"monorepo-only feature\" error before proceeding.\n *\n * @docLink cli/dev-guide#paths\n */\nexport const MONOREPO_ROOT: string | null = findMonorepoRoot(__ownDir);\n\n/**\n * Default content root used by path display and the `validate` command.\n *\n * The primary first-party `factory-assets/` root resolved through the shared\n * `factoryAssetRoots()` helper — the `SKAILE_FACTORY_ASSETS_DIR` override when\n * set, else the in-repo source during dev / bundled `dist/factory-assets/` after\n * `npm i`. Falls back to `~/.skaile/libraries/` — the user-library directory\n * managed by `skaile library add` — when the package cannot be located.\n * Consumers `fs.existsSync` first and degrade to \"no skills / flows discovered\".\n *\n * @docLink cli/dev-guide#paths\n */\nexport const AI_RESOURCES: string =\n  factoryAssetRoots()[0] ?? path.join(os.homedir(), \".skaile\", \"libraries\");\n"]}
+{"version":3,"sources":["../cli/src/paths.ts"],"names":[],"mappings":";;;;;;AAgBA,IAAM,WAAW,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAW5D,SAAS,iBAAiB,IAAA,EAA6B;AACrD,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,EAAA,CAAG,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,YAAY,CAAC,GAAG,OAAO,GAAA;AACxD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAYO,IAAM,aAAA,GAA+B,iBAAiB,QAAQ;AAc9D,IAAM,YAAA,GACX,iBAAA,EAAkB,CAAE,CAAC,CAAA,IAAK,IAAA,CAAK,IAAA,CAAK,EAAA,CAAG,OAAA,EAAQ,EAAG,SAAA,EAAW,WAAW","file":"chunk-GMXG2JGN.js","sourcesContent":["import fs from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { factoryAssetRoots } from \"@skaile/workspaces/core\";\n\n/**\n * The content-root policy lives in `@skaile/workspaces/core` so the flow\n * connector's resolution surfaces can reach it too — `factory-assets → cli`\n * would be a module cycle. Re-exported here because this module is the CLI's\n * documented path surface and every CLI caller imports it from here.\n *\n * @docLink cli/dev-guide#paths\n */\nexport { aiResourceRoots } from \"@skaile/workspaces/core\";\n\nconst __ownDir = path.dirname(fileURLToPath(import.meta.url));\n\n/**\n * Walk up from `from` looking for the monorepo marker (`biome.json`, the\n * repo-root shared tooling config). Returns the matching directory or `null`\n * when none is found within eight levels — the latter is the typical case when\n * `@skaile/workspaces` has been installed via `npm i` without a skaile-dev\n * workspace context. Used only to gate dev-only commands (e.g.\n * `serve --compile-test`); first-party content is located via\n * {@link aiResourceRoots}, not this.\n */\nfunction findMonorepoRoot(from: string): string | null {\n  let dir = from;\n  for (let i = 0; i < 8; i++) {\n    if (fs.existsSync(path.join(dir, \"biome.json\"))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Absolute path to the monorepo root, or `null` when the CLI is running\n * outside the skaile-dev workspace (typical for `npm i -g` installs).\n *\n * Consumers that only make sense inside the workspace (e.g.\n * `skaile serve --compile-test`) MUST check for `null` and report a\n * \"monorepo-only feature\" error before proceeding.\n *\n * @docLink cli/dev-guide#paths\n */\nexport const MONOREPO_ROOT: string | null = findMonorepoRoot(__ownDir);\n\n/**\n * Default content root used by path display and the `validate` command.\n *\n * The primary first-party `factory-assets/` root resolved through the shared\n * `factoryAssetRoots()` helper — the `SKAILE_FACTORY_ASSETS_DIR` override when\n * set, else the in-repo source during dev / bundled `dist/factory-assets/` after\n * `npm i`. Falls back to `~/.skaile/libraries/` — the user-library directory\n * managed by `skaile library add` — when the package cannot be located.\n * Consumers `fs.existsSync` first and degrade to \"no skills / flows discovered\".\n *\n * @docLink cli/dev-guide#paths\n */\nexport const AI_RESOURCES: string =\n  factoryAssetRoots()[0] ?? path.join(os.homedir(), \".skaile\", \"libraries\");\n"]}

package/dist/{chunk-KFKOXYQC.js → chunk-I7F3CG4Y.js}

@@ -1,6 +1,6 @@
-import { logErr, logOk, colorRef, logInfo, S, logWarn, formatSoftDepHint } from './chunk-VJKTXQ6D.js';
-import { AssetManager } from './chunk-DPKH7AK7.js';
-import { readLock } from './chunk-7NRF7BQB.js';
+import { logErr, logOk, colorRef, logInfo, S, logWarn, formatSoftDepHint } from './chunk-PBQ57MIY.js';
+import { AssetManager } from './chunk-3JBERZ4E.js';
+import { readLock } from './chunk-UWU572Q6.js';
 import { SUPPORTED_DRIVER_TARGETS } from './chunk-MENCWIHW.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import path from 'path';
@@ -82,7 +82,7 @@ async function runRefInstall(ref, opts) {
   const spinner2 = p.spinner();
   spinner2.start(`Installing ${ref}`);
   try {
-    const { openCatalogSource, openLibrary } = await import('./open-library-2CMPISRN.js');
+    const { openCatalogSource, openLibrary } = await import('./open-library-XYYK7HHI.js');
     const catalog = await openCatalogSource({ projectDir: path.resolve(opts.projectDir) });
     if (!supportsInstallManifest(catalog)) {
       throw new Error(
@@ -124,7 +124,7 @@ async function runYamlInstall(opts) {
     return;
   }
   try {
-    const { ensureSourcesCloned } = await import('./ensure-sources-6QOYW2PI.js');
+    const { ensureSourcesCloned } = await import('./ensure-sources-KXELEK4M.js');
     const hydrate = ensureSourcesCloned(projectDir, { quiet: true });
     if (hydrate.cloned.length > 0) {
       logOk(`Cloned source(s): ${hydrate.cloned.join(", ")}`);
@@ -290,5 +290,5 @@ function makeCleanCommand() {
 }
 
 export { makeCheckCommand, makeCleanCommand, makeInstallCommand, reportInstalledSoftDeps, runPointerOnlyInstall, supportsInstallManifest };
-//# sourceMappingURL=chunk-KFKOXYQC.js.map
-//# sourceMappingURL=chunk-KFKOXYQC.js.map
+//# sourceMappingURL=chunk-I7F3CG4Y.js.map
+//# sourceMappingURL=chunk-I7F3CG4Y.js.map

package/dist/{chunk-KFKOXYQC.js.map → chunk-I7F3CG4Y.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/commands/project.ts"],"names":["spinner","confirm"],"mappings":";;;;;;;;;AAmBA,IAAM,QAAA,GAAW,uEAAA;AAGjB,SAAS,gBAAgB,GAAA,EAAsB;AAC7C,EAAA,IAAI;AACF,IAAA,aAAA,CAAc,GAAG,CAAA;AACjB,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAqBO,SAAS,wBAAwB,MAAA,EAAkD;AACxF,EAAA,OACE,OAAQ,QAAgE,kBAAA,KACxE,UAAA;AAEJ;AAwCA,eAAsB,qBAAA,CACpB,KACA,IAAA,EACmC;AACnC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,cAAc,GAAG,CAAA;AAAA,EAC/B,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,qBAAA,EAAwB,GAAG,CAAA,kBAAA,EAAgB,QAAQ,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,KACpG;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,mBAAmB,GAAG,CAAA;AAI1D,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,QAAA,CAAS,GAAG,CAAA;AACtC,EAAA,IACE,GAAA,CAAI,IAAA,KAAS,SAAA,CAAU,IAAA,IACvB,IAAI,SAAA,KAAc,SAAA,CAAU,SAAA,IAC5B,GAAA,CAAI,SAAS,SAAA,CAAU,IAAA,IACvB,GAAA,CAAI,GAAA,KAAQ,UAAU,GAAA,EACtB;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sCAAA,EAAyC,GAAG,CAAA,2CAAA,EAA8C,QAAA,CAAS,GAAG,CAAA,CAAA;AAAA,KACxG;AAAA,EACF;AACA,EAAA,MAAM,EAAE,WAAA,EAAY,GAAI,MAAM,IAAA,CAAK,OAAA,CAAQ,QAAQ,QAAQ,CAAA;AAC3D,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B,SAAA,EAAW,SAAS,KAAA,CAAM;AAAA,GAC5B;AACF;AAoBO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,OAAO,IAAI,OAAA,CAAQ,SAAS,CAAA,CACzB,WAAA,CAAY,CAAA,iEAAA,EAAoE,QAAQ,CAAA,CAAA,CAAG,CAAA,CAC3F,QAAA,CAAS,OAAA,EAAS,CAAA,uCAAA,EAA0C,QAAQ,CAAA,CAAA,CAAG,CAAA,CACvE,MAAA,CAAO,UAAA,EAAY,wDAAmD,CAAA,CACtE,MAAA,CAAO,sBAAA,EAAwB,mBAAA,EAAqB,OAAA,CAAQ,GAAA,EAAK,CAAA,CACjE,MAAA,CAAO,kBAAA,EAAoB,iBAAA,EAAmB,aAAa,CAAA,CAC3D,MAAA;AAAA,IACC,UAAA;AAAA,IACA;AAAA,GACF,CACC,MAAA;AAAA,IACC,iBAAA;AAAA,IACA;AAAA,GACF,CACC,MAAA;AAAA,IACC,QAAA;AAAA,IACA;AAAA,GACF,CACC,OAAO,iBAAiB,CAAA;AAC7B;AAiBA,SAAS,mBAAmB,GAAA,EAAqD;AAC/E,EAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,EAAA,MAAM,GAAA,GAAM,GAAA,CACT,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,OAAO,OAAO,CAAA;AACjB,EAAA,MAAM,MAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,MAAM,GAAA,EAAK;AACpB,IAAA,IAAI,CAAE,wBAAA,CAAsC,QAAA,CAAS,EAAE,CAAA,EAAG;AACxD,MAAA,MAAA,CAAO,oBAAoB,EAAE,CAAA,0BAAA,EAAwB,yBAAyB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAC1F,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,GAAA,CAAI,KAAK,EAAkB,CAAA;AAAA,EAC7B;AACA,EAAA,OAAO,GAAA,CAAI,MAAA,GAAS,CAAA,GAAI,GAAA,GAAM,MAAA;AAChC;AAOA,eAAe,iBAAA,CACb,KACA,IAAA,EACe;AAEf,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,MAAM,aAAA,CAAc,KAAK,IAAI,CAAA;AAC7B,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,eAAe,IAAI,CAAA;AAC3B;AAGA,eAAe,aAAA,CAAc,KAAa,IAAA,EAA4C;AACpF,EAAA,IAAI,CAAC,eAAA,CAAgB,GAAG,CAAA,EAAG;AACzB,IAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,GAAG,CAAA,kBAAA,EAAgB,QAAQ,CAAA,CAAE,CAAA;AAC5D,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,MAAMA,WAAY,CAAA,CAAA,OAAA,EAAQ;AAC1B,EAAAA,QAAAA,CAAQ,KAAA,CAAM,CAAA,WAAA,EAAc,GAAG,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,iBAAA,EAAmB,WAAA,EAAY,GAAI,MAAM,OAAO,4BAAoB,CAAA;AAC5E,IAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,CAAkB,EAAE,UAAA,EAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,EAAG,CAAA;AAIrF,IAAA,IAAI,CAAC,uBAAA,CAAwB,OAAO,CAAA,EAAG;AACrC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAIF;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,MAAM,qBAAA,CAAsB,KAAK,EAAE,OAAA,EAAS,SAAS,CAAA;AACpE,MAAAA,QAAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,MAAA,KAAA,CAAM,CAAA,UAAA,EAAa,QAAA,CAAS,GAAG,CAAC,CAAA,CAAE,CAAA;AAClC,MAAA,OAAA,CAAQ,SAAS,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,WAAW,CAAC,CAAA,CAAE,CAAA;AAC5C,MAAA,OAAA,CAAQ,WAAW,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,SAAS,CAAC,CAAA,CAAE,CAAA;AAC5C,MAAA,OAAA,CAAQ,CAAA,OAAA,EAAU,EAAE,GAAA,CAAI,MAAA,CAAO,OAAO,SAAS,CAAC,CAAC,CAAA,CAAE,CAAA;AACnD,MAAA,OAAA;AAAA,QACE,CAAA,CAAE,GAAA;AAAA,UACA,+DAA0D,GAAG,CAAA,+BAAA;AAAA;AAC/D,OACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAAA,QAAAA,CAAQ,KAAK,QAAQ,CAAA;AACrB,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,IAAA,IAAI,cAAA,CAAe,IAAA,CAAK,GAAG,CAAA,EAAG;AAC5B,MAAA,MAAA,CAAO,CAAA,8DAAA,EAA4D,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,GAAG,CAAA;AAAA,IACZ;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAGA,eAAe,eAAe,IAAA,EAA4C;AACxE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAE/C,EAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAA;AAEhD,EAAA,IAAI,IAAA,CAAK,UAAU,QAAA,EAAU;AAC3B,IAAA,MAAM,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AACrC,IAAA;AAAA,EACF;AAIA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,OAAO,8BAAsB,CAAA;AACnE,IAAA,MAAM,UAAU,mBAAA,CAAoB,UAAA,EAAY,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,KAAA,CAAM,qBAAqB,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,MAAA,CAAO,8BAA8B,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IAClE;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,CAAA,0BAAA,EAA6B,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EACzF;AAEA,EAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa;AAAA,IAC1B,UAAA;AAAA,IACA,cAAc,IAAA,CAAK;AAAA,GACpB,CAAA;AACD,EAAA,MAAMA,WAAY,CAAA,CAAA,OAAA,EAAQ;AAC1B,EAAAA,QAAAA,CAAQ,KAAA,CAAM,IAAA,CAAK,MAAA,GAAS,8BAA8B,yBAAyB,CAAA;AACnF,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,OAAA,CAAQ,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AACxE,IAAAA,QAAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC9B,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,QAAA,EAAU,KAAA,CAAM,CAAC,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,KAAA,MAAW,KAAK,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE,CAAA;AAAA,IACzD;AACA,IAAA,IAAI,OAAO,QAAA,CAAS,MAAA,KAAW,KAAK,MAAA,CAAO,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC/D,MAAA,OAAA,CAAQ,0CAA0C,CAAA;AAAA,IACpD;AACA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,KAAA,MAAW,KAAK,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE,CAAA;AAGtD,MAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,IACrB;AACA,IAAA,IAAI,OAAO,WAAA,EAAa;AACtB,MAAA,OAAA,CAAQ,CAAA,mBAAA,EAAsB,CAAA,CAAE,GAAA,CAAI,kBAAkB,CAAC,CAAA,CAAE,CAAA;AAAA,IAC3D;AAIA,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,wBAAwB,EAAE,CAAA;AAAA,EACpD,SAAS,GAAA,EAAK;AACZ,IAAAA,QAAAA,CAAQ,KAAK,QAAQ,CAAA;AACrB,IAAA,MAAA,CAAO,MAAA,CAAO,GAAG,CAAC,CAAA;AAClB,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AASA,eAAsB,uBAAA,CACpB,EAAA,EACA,MAAA,GAAiC,CAAC,CAAA,KAAM,QAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,CAAA,EACzC;AACf,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAA,CAAY,MAAM,EAAA,CAAG,YAAA,IAAgB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAA;AAC3D,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AAC3B,IAAA,MAAM,KAAA,GAAQ,MAAM,EAAA,CAAG,cAAA,CAAe,QAAQ,CAAA;AAC9C,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,CAAO,iBAAA,CAAkB,IAAI,CAAC,CAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQA,eAAe,gBAAA,CACb,MACA,QAAA,EACe;AACf,EAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa;AAAA,IAC1B,UAAA,EAAY,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,IACxC,MAAA,EAAQ,IAAA;AAAA,IACR;AAAA,GACD,CAAA;AACD,EAAA,MAAMA,WAAY,CAAA,CAAA,OAAA,EAAQ;AAC1B,EAAAA,QAAAA,CAAQ,MAAM,gCAAgC,CAAA;AAC9C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,OAAA,CAAQ,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AACxE,IAAAA,QAAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,IAAA,IAAI,MAAA,CAAO,SAAS,MAAA,GAAS,CAAA,aAAc,CAAA,IAAK,MAAA,CAAO,QAAA,EAAU,KAAA,CAAM,CAAC,CAAA;AACxE,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE,CAAA;AACtF,IAAA,IAAI,OAAO,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,QAAQ,MAAA,KAAW,CAAA;AAC5D,MAAA,OAAA,CAAQ,0CAA0C,CAAA;AACpD,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,KAAA,MAAW,KAAK,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE,CAAA;AACtD,MAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,IACrB;AACA,IAAA,IAAI,MAAA,CAAO,aAAa,OAAA,CAAQ,CAAA,qBAAA,EAAwB,EAAE,GAAA,CAAI,4BAA4B,CAAC,CAAA,CAAE,CAAA;AAG7F,IAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,WAAA,CAAY,EAAE,CAAA;AAC/B,IAAA,MAAM,SAAA,uBAAgB,GAAA,EAAoB;AAC1C,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA;AACd,MAAA,IAAI,CAAA,CAAE,KAAA,KAAU,WAAA,EAAa,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,OAAA,EAAA,CAAU,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,OAAO,CAAA,IAAK,KAAK,CAAC,CAAA;AAC3F,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,CAAC,CAAA,IAAK,SAAA,UAAmB,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,CAAC,CAAA,UAAA,CAAY,CAAA;AAAA,EAC5E,SAAS,GAAA,EAAK;AACZ,IAAAA,QAAAA,CAAQ,KAAK,QAAQ,CAAA;AACrB,IAAA,MAAA,CAAO,MAAA,CAAO,GAAG,CAAC,CAAA;AAClB,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAcO,SAAS,gBAAA,GAA4B;AAC1C,EAAA,OAAO,IAAI,OAAA,CAAQ,OAAO,CAAA,CACvB,WAAA,CAAY,8BAA8B,CAAA,CAC1C,MAAA,CAAO,sBAAA,EAAwB,mBAAA,EAAqB,QAAQ,GAAA,EAAK,CAAA,CACjE,MAAA,CAAO,OAAO,IAAA,KAAS;AACtB,IAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa,EAAE,UAAA,EAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,EAAG,CAAA;AACzE,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,MAAA,EAAO;AAG/B,IAAA,IAAI,UAAuD,EAAC;AAC5D,IAAA,IAAI;AACF,MAAA,OAAA,GAAA,CAAW,MAAM,GAAG,YAAA,EAAa,EAAG,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,KAAU,OAAO,CAAA;AAAA,IACvE,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,IAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC/C,MAAA,KAAA,CAAM,6BAA6B,CAAA;AAAA,IACrC,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,QAAA,MAAA;AAAA,UACE,GAAG,CAAA,CAAE,SAAS,CAAA,CAAA,EAAI,CAAA,CAAE,SAAS,CAAA,UAAA,EAAa,CAAA,CAAE,OAAO,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,GAAU,YAAY,WAAW,CAAA,CAAA;AAAA,SAC1G;AAAA,MACF;AACA,MAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,QAAA,MAAA,CAAO,CAAA,EAAG,CAAA,CAAE,GAAG,CAAA,0EAAA,CAAuE,CAAA;AAAA,MACxF;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,EACF,CAAC,CAAA;AACL;AAYO,SAAS,gBAAA,GAA4B;AAC1C,EAAA,OAAO,IAAI,OAAA,CAAQ,OAAO,CAAA,CACvB,YAAY,qDAAqD,CAAA,CACjE,MAAA,CAAO,OAAA,EAAS,gEAAgE,CAAA,CAChF,MAAA,CAAO,WAAA,EAAa,6CAA6C,CAAA,CACjE,MAAA,CAAO,WAAA,EAAa,0BAA0B,CAAA,CAC9C,MAAA,CAAO,sBAAA,EAAwB,mBAAA,EAAqB,QAAQ,GAAA,EAAK,CAAA,CACjE,MAAA,CAAO,oBAAoB,iBAAA,EAAmB,aAAa,CAAA,CAC3D,MAAA,CAAO,OAAO,IAAA,KAAS;AACtB,IAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa;AAAA,MAC1B,UAAA,EAAY,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,MACxC,cAAc,IAAA,CAAK;AAAA,KACpB,CAAA;AAGD,IAAA,MAAM,OAAO,QAAA,CAAS,IAAA,CAAK,QAAQ,IAAA,CAAK,UAAA,EAAY,kBAAkB,CAAC,CAAA;AAEvE,IAAA,IAAI,CAAC,QAAQ,MAAA,CAAO,IAAA,CAAK,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,EAAG;AAClD,MAAA,OAAA,CAAQ,oDAAoD,CAAA;AAC5D,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,mBAAmB,CAAC,CAAA,CAAA,EAAI,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,EAAI,SAAA,CAAU,MAAM,CAAA,CAAA,CAAG,CAAC,CAAA,CAAE,CAAA;AACnF,IAAA,KAAA,MAAW,OAAO,SAAA,EAAW;AAC3B,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,QAAA,CAAS,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IACpC;AAEA,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,gBAAgB,CAAC,CAAA,CAAE,CAAA;AAC9C,MAAA,OAAA,CAAQ,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAA,CAAI,sBAAsB,CAAC,CAAA,CAAE,CAAA;AAClD,MAAA,OAAA,CAAQ,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAA,CAAI,kBAAkB,CAAC,CAAA,CAAE,CAAA;AAC9C,MAAA,OAAA,CAAQ,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAA,CAAI,kBAAkB,CAAC,CAAA,CAAE,CAAA;AAAA,IAChD;AAEA,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,MAAA,OAAA,CAAQ,iCAA4B,CAAA;AACpC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,KAAK,GAAA,EAAK;AACb,MAAA,MAAMC,WAAU,MAAQ,CAAA,CAAA,OAAA,CAAQ,EAAE,OAAA,EAAS,YAAY,CAAA;AACvD,MAAA,IAAM,CAAA,CAAA,QAAA,CAASA,QAAO,CAAA,IAAK,CAACA,QAAAA,EAAS;AACnC,QAAA,OAAA,CAAQ,YAAY,CAAA;AACpB,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,EAAA,CAAG,KAAA,CAAM,EAAE,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AAEzC,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,OAAA,EAAS;AAC9B,MAAA,KAAA,CAAM,CAAA,QAAA,EAAW,CAAC,CAAA,CAAE,CAAA;AAAA,IACtB;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,OAAA,EAAS;AAC9B,MAAA,OAAA,CAAQ,WAAW,CAAA,CAAE,GAAG,CAAA,EAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG;AAC/B,MAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,MAAA,OAAA,CAAQ,CAAA,KAAA,EAAQ,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,oBAAA,CAAsB,CAAA;AAC7D,MAAA,KAAA,MAAW,CAAA,IAAK,OAAO,SAAA,EAAW;AAChC,QAAA,OAAA,CAAQ,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,MAC/B;AAAA,IACF;AACA,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,MAAA,KAAA,CAAM,sBAAsB,CAAA;AAAA,IAC9B;AAAA,EACF,CAAC,CAAA;AACL","file":"chunk-KFKOXYQC.js","sourcesContent":["import path from \"node:path\";\nimport * as p from \"@clack/prompts\";\nimport { AssetManager } from \"@skaile/workspaces/asset-manager\";\nimport {\n  type DriverTarget,\n  parseAssetRef,\n  readLock,\n  SUPPORTED_DRIVER_TARGETS,\n} from \"@skaile/workspaces/core\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\nimport { Command } from \"commander\";\nimport { colorRef, formatSoftDepHint, logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\n\n/**\n * Canonical asset-ref shape accepted by `skaile install <ref>`:\n * `kind:@<publisher>/<name>#<version>` (the `#` version sigil). Validated via\n * `parseAssetRef` so the CLI shares the single canonical grammar; the legacy\n * trailing-`@version` shape is rejected.\n */\nconst REF_HINT = \"kind:@<publisher>/<name>#<version> (e.g. skill:@skaile/use-exa#1.0.0)\";\n\n/** True when `ref` parses as a canonical asset ref. */\nfunction isValidAssetRef(ref: string): boolean {\n  try {\n    parseAssetRef(ref);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Minimal catalog-source surface the pointer-only install path needs.\n * `RemoteCatalogSource` satisfies this — narrowing keeps {@link runPointerOnlyInstall}\n * testable with a hand-rolled stub.\n */\nexport interface InstallManifestSource {\n  getInstallManifest(ref: string): Promise<InstallManifest>;\n}\n\n/**\n * Capability check: is this catalog source able to serve install manifests?\n *\n * `openCatalogSource` returns a `RemoteCatalogSource | RestCatalogSource`.\n * Only the tRPC-framed `RemoteCatalogSource` implements `getInstallManifest`;\n * the REST-framed `RestCatalogSource` (the default for any catalog URL other\n * than `https://skaile.store`) does not. Calling it unconditionally would be a\n * runtime `TypeError`, so the pointer-only install path must capability-detect\n * first and fail with a clear, actionable message.\n */\nexport function supportsInstallManifest(source: unknown): source is InstallManifestSource {\n  return (\n    typeof (source as { getInstallManifest?: unknown } | null | undefined)?.getInstallManifest ===\n    \"function\"\n  );\n}\n\n/**\n * Minimal library surface the pointer-only install path needs.\n * `LocalIndex` satisfies this.\n */\nexport interface InstallLibrary {\n  install(manifest: InstallManifest): Promise<{ installPath: string }>;\n}\n\n/**\n * Result of a pointer-only catalog install.\n */\nexport interface PointerOnlyInstallResult {\n  /** Absolute path the verified asset bytes were written to. */\n  installPath: string;\n  /** The pinned upstream commit SHA the asset was fetched at. */\n  commitSha: string;\n  /** Number of files in the install manifest. */\n  fileCount: number;\n}\n\n/**\n * Pointer-only catalog install — the `skaile install <ref>` code path.\n *\n * 1. Resolves the pointer-only {@link InstallManifest} from the Catalog.\n * 2. Hands it to the library, which fetches each file's bytes directly from\n *    the upstream repo at the pinned commit, verifies every per-file SHA256\n *    plus the composite SHA256, and only then writes the verified files.\n *\n * Both dependencies are injected so the function is unit-testable without a\n * network round-trip. In production the CLI passes a `RemoteCatalogSource`\n * and a `LocalIndex`.\n *\n * @param ref - Asset ref (`<publisher>/<name>@<version>`, optional leading `@`).\n * @param deps - Injected catalog source + library.\n * @returns The install path, pinned commit SHA, and file count.\n * @throws When the ref is malformed, the manifest cannot be resolved, or any\n *   hash verification fails. The underlying error message is surfaced as-is.\n */\nexport async function runPointerOnlyInstall(\n  ref: string,\n  deps: { catalog: InstallManifestSource; library: InstallLibrary },\n): Promise<PointerOnlyInstallResult> {\n  let requested: ReturnType<typeof parseAssetRef>;\n  try {\n    requested = parseAssetRef(ref);\n  } catch (e) {\n    throw new Error(\n      `malformed asset ref '${ref}' — expected ${REF_HINT}: ${e instanceof Error ? e.message : String(e)}`,\n    );\n  }\n  const manifest = await deps.catalog.getInstallManifest(ref);\n  // [M1] Identity check: the catalog must not install a different asset than\n  // requested. Compare the PARSED refs (kind/publisher/name/pin) so equivalent\n  // spellings (optional `kind:`, default `skill`) are treated as the same ref.\n  const got = parseAssetRef(manifest.ref);\n  if (\n    got.kind !== requested.kind ||\n    got.publisher !== requested.publisher ||\n    got.name !== requested.name ||\n    got.pin !== requested.pin\n  ) {\n    throw new Error(\n      `catalog identity mismatch: requested '${ref}' but the catalog returned a manifest for '${manifest.ref}'`,\n    );\n  }\n  const { installPath } = await deps.library.install(manifest);\n  return {\n    installPath,\n    commitSha: manifest.source.commitSha,\n    fileCount: manifest.files.length,\n  };\n}\n\n/**\n * Creates the `skaile install` command.\n *\n * Two modes, selected by argument shape:\n *\n * - `skaile install` (no positional arg) — reads `skaile.yaml` and deploys all\n *   declared assets (and their transitive dependencies) to the configured\n *   driver target directory. Supports `--locked` for CI-mode install from a\n *   lock file.\n * - `skaile install <publisher>/<name>@<version>` — pointer-only catalog\n *   install: resolves the pointer-only install manifest from the configured\n *   Catalog, fetches each file's bytes directly from the upstream repo at the\n *   pinned commit, verifies every per-file + the composite SHA256, then writes\n *   the verified files into the local Library.\n *\n * @returns Configured {@link Command} ready for `program.addCommand()`.\n * @docLink cli/commands/project#make-install-command\n */\nexport function makeInstallCommand(): Command {\n  return new Command(\"install\")\n    .description(`Install dependencies from skaile.yaml, or a single asset by ref (${REF_HINT})`)\n    .argument(\"[ref]\", `Asset ref to install from the Catalog (${REF_HINT})`)\n    .option(\"--locked\", \"Install from lock file (CI mode — fails on drift)\")\n    .option(\"--project-dir <path>\", \"Project directory\", process.cwd())\n    .option(\"--target <agent>\", \"Agent framework\", \"claude-code\")\n    .option(\n      \"--global\",\n      \"Install the global SSOT (~/.skaile/skaile.yaml), fanning out to every global backend\",\n    )\n    .option(\n      \"--backend <ids>\",\n      \"Comma-separated global backends to install into (default: all resolved); implies --global\",\n    )\n    .option(\n      \"--link\",\n      \"symlink local-path assets instead of copying (dev loop; machine-local, not for committing)\",\n    )\n    .action(runInstallCommand);\n}\n\n/** Options shape accepted by the `skaile install` command action. */\ninterface InstallCommandOptions {\n  locked?: boolean;\n  projectDir: string;\n  target: string;\n  global?: boolean;\n  backend?: string;\n  link?: boolean;\n}\n\n/**\n * Parse a `--backend a,b` value into validated {@link DriverTarget}s, exiting on\n * an unknown id. Returns `undefined` when the flag is absent (resolve the full\n * global set instead).\n */\nfunction parseBackendFilter(raw: string | undefined): DriverTarget[] | undefined {\n  if (!raw) return undefined;\n  const ids = raw\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter(Boolean);\n  const out: DriverTarget[] = [];\n  for (const id of ids) {\n    if (!(SUPPORTED_DRIVER_TARGETS as string[]).includes(id)) {\n      logErr(`unknown backend '${id}' — expected one of: ${SUPPORTED_DRIVER_TARGETS.join(\", \")}`);\n      process.exit(1);\n    }\n    out.push(id as DriverTarget);\n  }\n  return out.length > 0 ? out : undefined;\n}\n\n/**\n * `skaile install` action body. Dispatches by argument shape:\n * a positional `ref` selects pointer-only catalog install, otherwise the\n * legacy `skaile.yaml` install path runs.\n */\nasync function runInstallCommand(\n  ref: string | undefined,\n  opts: InstallCommandOptions,\n): Promise<void> {\n  // ── Pointer-only catalog install: `skaile install <ref>` ──────────────\n  if (ref !== undefined) {\n    await runRefInstall(ref, opts);\n    return;\n  }\n\n  // ── Legacy install: `skaile install` reads skaile.yaml ────────────────\n  await runYamlInstall(opts);\n}\n\n/** Pointer-only catalog install path for `skaile install <ref>`. */\nasync function runRefInstall(ref: string, opts: InstallCommandOptions): Promise<void> {\n  if (!isValidAssetRef(ref)) {\n    logErr(`malformed asset ref '${ref}' — expected ${REF_HINT}`);\n    process.exit(1);\n  }\n  const spinner = p.spinner();\n  spinner.start(`Installing ${ref}`);\n  try {\n    const { openCatalogSource, openLibrary } = await import(\"../open-library.ts\");\n    const catalog = await openCatalogSource({ projectDir: path.resolve(opts.projectDir) });\n    // [H2] REST-framed catalogs (the default for any catalog URL other\n    // than https://skaile.store) cannot serve install manifests. Detect\n    // and fail clearly rather than throwing a runtime TypeError.\n    if (!supportsInstallManifest(catalog)) {\n      throw new Error(\n        \"pointer-only install (skaile install <ref>) requires a tRPC-framed Catalog. \" +\n          \"The configured catalog uses REST framing, which does not serve install \" +\n          \"manifests. Set catalog.url to https://skaile.store, or catalog.framing: trpc, \" +\n          \"in ~/.skaile/config.yaml.\",\n      );\n    }\n    const library = await openLibrary();\n    try {\n      const result = await runPointerOnlyInstall(ref, { catalog, library });\n      spinner.stop(\"Done\");\n      logOk(`Installed ${colorRef(ref)}`);\n      logInfo(`Path: ${S.dim(result.installPath)}`);\n      logInfo(`Commit: ${S.dim(result.commitSha)}`);\n      logInfo(`Files: ${S.dim(String(result.fileCount))}`);\n      logInfo(\n        S.dim(\n          `Installed globally (see Path above) — use \\`skaile add ${ref}\\` to deploy into this project.`,\n        ),\n      );\n    } finally {\n      library.close();\n    }\n  } catch (err) {\n    spinner.stop(\"Failed\");\n    const msg = err instanceof Error ? err.message : String(err);\n    if (/unreachable/i.test(msg)) {\n      logErr(`asset uninstallable — source commit no longer available (${msg})`);\n    } else {\n      logErr(msg);\n    }\n    process.exit(1);\n  }\n}\n\n/** Legacy install path for bare `skaile install` (reads skaile.yaml). */\nasync function runYamlInstall(opts: InstallCommandOptions): Promise<void> {\n  const projectDir = path.resolve(opts.projectDir);\n\n  const backends = parseBackendFilter(opts.backend);\n  // `--backend` implies `--global`.\n  if (opts.global || backends) {\n    await runGlobalInstall(opts, backends);\n    return;\n  }\n\n  // Hydrate sources declared in skaile.yaml before resolving assets, so\n  // freshly checked-out projects pull their source clones automatically.\n  try {\n    const { ensureSourcesCloned } = await import(\"../ensure-sources.ts\");\n    const hydrate = ensureSourcesCloned(projectDir, { quiet: true });\n    if (hydrate.cloned.length > 0) {\n      logOk(`Cloned source(s): ${hydrate.cloned.join(\", \")}`);\n    }\n    if (hydrate.failed.length > 0) {\n      logErr(`Failed to clone source(s): ${hydrate.failed.join(\", \")}`);\n    }\n  } catch (err) {\n    logWarn(`source hydration skipped: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  const am = new AssetManager({\n    projectDir,\n    driverTarget: opts.target as DriverTarget,\n  });\n  const spinner = p.spinner();\n  spinner.start(opts.locked ? \"Installing from lock file\" : \"Installing dependencies\");\n  try {\n    const result = await am.install({ locked: opts.locked, link: opts.link });\n    spinner.stop(\"Done\");\n    if (result.deployed.length > 0) {\n      for (const d of result.deployed) logOk(d);\n    }\n    if (result.removed.length > 0) {\n      for (const r of result.removed) logWarn(`Removed: ${r}`);\n    }\n    if (result.deployed.length === 0 && result.removed.length === 0) {\n      logInfo(\"Nothing to install (already up to date).\");\n    }\n    if (result.missing.length > 0) {\n      for (const m of result.missing) logErr(`Missing: ${m}`);\n      // Partial-miss must fail the process — CI can't otherwise distinguish a\n      // clean install from \"half the assets never resolved\".\n      process.exitCode = 1;\n    }\n    if (result.lockWritten) {\n      logInfo(`Lock file written: ${S.dim(\"skaile.lock.yaml\")}`);\n    }\n    // Report-only: surface soft deps the declared assets reference but aren't\n    // present. Never a prompt — install is a batch/CI path. Skipped under\n    // --locked: that mode is \"restore exactly\", so an `add` nudge would jar.\n    if (!opts.locked) await reportInstalledSoftDeps(am);\n  } catch (err) {\n    spinner.stop(\"Failed\");\n    logErr(String(err));\n    process.exit(1);\n  }\n}\n\n/**\n * Report (never prompt) the body-link soft deps that the declared assets\n * reference but that aren't in the project — the `install` counterpart to the\n * `add`-time soft-dep surface. `install` is a batch/CI path (often non-TTY), so\n * it only ever prints a hint: pulling stays an explicit `skaile add`. Best-effort\n * — `reportSoftDeps` swallows any index failure and returns `[]`.\n */\nexport async function reportInstalledSoftDeps(\n  am: Pick<AssetManager, \"listDeclared\" | \"reportSoftDeps\">,\n  onHint: (line: string) => void = (l) => logInfo(S.dim(l)),\n): Promise<void> {\n  try {\n    const declared = (await am.listDeclared()).map((d) => d.ref);\n    if (declared.length === 0) return;\n    const edges = await am.reportSoftDeps(declared);\n    for (const edge of edges) onHint(formatSoftDepHint(edge));\n  } catch {\n    // Best-effort: a soft-dep report must never fail an install that succeeded.\n  }\n}\n\n/**\n * Global cross-backend install: deploy every dep declared in the global SSOT\n * (`~/.skaile/skaile.yaml`) into each resolved global backend's dir under `~`,\n * write the global lock (`~/.skaile/skaile.lock.yaml`), then print per-backend\n * state. `backends` is the `--backend` filter (omit for the full resolved set).\n */\nasync function runGlobalInstall(\n  opts: InstallCommandOptions,\n  backends: DriverTarget[] | undefined,\n): Promise<void> {\n  const am = new AssetManager({\n    projectDir: path.resolve(opts.projectDir),\n    global: true,\n    backends,\n  });\n  const spinner = p.spinner();\n  spinner.start(\"Installing global dependencies\");\n  try {\n    const result = await am.install({ locked: opts.locked, link: opts.link });\n    spinner.stop(\"Done\");\n    if (result.deployed.length > 0) for (const d of result.deployed) logOk(d);\n    if (result.removed.length > 0) for (const r of result.removed) logWarn(`Removed: ${r}`);\n    if (result.deployed.length === 0 && result.removed.length === 0)\n      logInfo(\"Nothing to install (already up to date).\");\n    if (result.missing.length > 0) {\n      for (const m of result.missing) logErr(`Missing: ${m}`);\n      process.exitCode = 1;\n    }\n    if (result.lockWritten) logInfo(`Global lock written: ${S.dim(\"~/.skaile/skaile.lock.yaml\")}`);\n\n    // Per-backend reconciliation summary so a partial fan-out is visible.\n    const state = am.globalState({});\n    const byBackend = new Map<string, number>();\n    for (const s of state)\n      if (s.state === \"installed\") byBackend.set(s.backend, (byBackend.get(s.backend) ?? 0) + 1);\n    for (const [backend, n] of byBackend) logInfo(`${backend}: ${n} installed`);\n  } catch (err) {\n    spinner.stop(\"Failed\");\n    logErr(String(err));\n    process.exit(1);\n  }\n}\n\n/**\n * Creates the `skaile check` command.\n *\n * Scans all deployed assets for unmet dependency requirements **and** the\n * declared set for deps that resolved into the lock but never materialized, and\n * exits with code 1 if either is found. `doctor()` alone only walks *deployed*\n * assets' `requires`, so a declared dep whose bytes never landed (e.g. a\n * store-sourced `mcp-server`) used to report \"satisfied\" (#462).\n *\n * @returns Configured {@link Command} ready for `program.addCommand()`.\n * @docLink cli/commands/project#make-check-command\n */\nexport function makeCheckCommand(): Command {\n  return new Command(\"check\")\n    .description(\"Check for unmet requirements\")\n    .option(\"--project-dir <path>\", \"Project directory\", process.cwd())\n    .action(async (opts) => {\n      const am = new AssetManager({ projectDir: path.resolve(opts.projectDir) });\n      const issues = await am.doctor();\n      // A project with no (or an unreadable) skaile.yaml has no declared set to\n      // reconcile — treat it as drift-free so `check` behaves as it always has.\n      let drifted: Awaited<ReturnType<typeof am.listDeclared>> = [];\n      try {\n        drifted = (await am.listDeclared()).filter((d) => d.state === \"drift\");\n      } catch {\n        // ignored — doctor() below is still authoritative for deployed assets.\n      }\n      if (issues.length === 0 && drifted.length === 0) {\n        logOk(\"All dependencies satisfied.\");\n      } else {\n        for (const i of issues) {\n          logErr(\n            `${i.assetKind}:${i.assetName} requires ${i.depKind}:${i.depName} (${i.inRepos ? \"fixable\" : \"not found\"})`,\n          );\n        }\n        for (const d of drifted) {\n          logErr(`${d.ref} is declared and locked but not materialized — run \\`skaile install\\``);\n        }\n        process.exit(1);\n      }\n    });\n}\n\n/**\n * Creates the `skaile clean` command.\n *\n * Removes all skaile-managed assets tracked in `skaile.lock.yaml` from the\n * workspace. With `--all` also removes history, patches, repos, and the lock\n * file itself. Preserves unmanaged (manually placed) assets.\n *\n * @returns Configured {@link Command} ready for `program.addCommand()`.\n * @docLink cli/commands/project#make-clean-command\n */\nexport function makeCleanCommand(): Command {\n  return new Command(\"clean\")\n    .description(\"Remove all skaile-managed assets from the workspace\")\n    .option(\"--all\", \"Full reset: also remove history, patches, repos, and lock file\")\n    .option(\"--dry-run\", \"Show what would be removed without doing it\")\n    .option(\"-y, --yes\", \"Skip confirmation prompt\")\n    .option(\"--project-dir <path>\", \"Project directory\", process.cwd())\n    .option(\"--target <agent>\", \"Agent framework\", \"claude-code\")\n    .action(async (opts) => {\n      const am = new AssetManager({\n        projectDir: path.resolve(opts.projectDir),\n        driverTarget: opts.target as DriverTarget,\n      });\n\n      // Preview: load lock file to show what will be cleaned\n      const lock = readLock(path.resolve(opts.projectDir, \"skaile.lock.yaml\"));\n\n      if (!lock || Object.keys(lock.assets).length === 0) {\n        logInfo(\"Nothing to clean (no skaile-managed assets found).\");\n        return;\n      }\n\n      const assetRefs = Object.keys(lock.assets);\n      console.log();\n      console.log(`  ${S.heading(\"Assets to remove:\")} ${S.dim(`(${assetRefs.length})`)}`);\n      for (const ref of assetRefs) {\n        console.log(`    ${colorRef(ref)}`);\n      }\n\n      if (opts.all) {\n        console.log();\n        console.log(`  ${S.heading(\"Also removing:\")}`);\n        console.log(`    ${S.dim(\".skaile/history.yaml\")}`);\n        console.log(`    ${S.dim(\".skaile/patches/\")}`);\n        console.log(`    ${S.dim(\"skaile.lock.yaml\")}`);\n      }\n\n      if (opts.dryRun) {\n        console.log();\n        logInfo(\"Dry run — no changes made.\");\n        return;\n      }\n\n      if (!opts.yes) {\n        const confirm = await p.confirm({ message: \"Proceed?\" });\n        if (p.isCancel(confirm) || !confirm) {\n          logInfo(\"Cancelled.\");\n          return;\n        }\n      }\n\n      const result = am.clean({ all: opts.all });\n\n      console.log();\n      for (const r of result.removed) {\n        logOk(`Removed ${r}`);\n      }\n      for (const s of result.skipped) {\n        logWarn(`Skipped ${s.ref}: ${s.reason}`);\n      }\n      if (result.unmanaged.length > 0) {\n        console.log();\n        logInfo(`Kept ${result.unmanaged.length} unmanaged asset(s):`);\n        for (const u of result.unmanaged) {\n          console.log(`    ${S.dim(u)}`);\n        }\n      }\n      if (opts.all) {\n        console.log();\n        logOk(\"Full reset complete.\");\n      }\n    });\n}\n"]}
+{"version":3,"sources":["../cli/src/commands/project.ts"],"names":["spinner","confirm"],"mappings":";;;;;;;;;AAmBA,IAAM,QAAA,GAAW,uEAAA;AAGjB,SAAS,gBAAgB,GAAA,EAAsB;AAC7C,EAAA,IAAI;AACF,IAAA,aAAA,CAAc,GAAG,CAAA;AACjB,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAqBO,SAAS,wBAAwB,MAAA,EAAkD;AACxF,EAAA,OACE,OAAQ,QAAgE,kBAAA,KACxE,UAAA;AAEJ;AAwCA,eAAsB,qBAAA,CACpB,KACA,IAAA,EACmC;AACnC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,cAAc,GAAG,CAAA;AAAA,EAC/B,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,qBAAA,EAAwB,GAAG,CAAA,kBAAA,EAAgB,QAAQ,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,KACpG;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,mBAAmB,GAAG,CAAA;AAI1D,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,QAAA,CAAS,GAAG,CAAA;AACtC,EAAA,IACE,GAAA,CAAI,IAAA,KAAS,SAAA,CAAU,IAAA,IACvB,IAAI,SAAA,KAAc,SAAA,CAAU,SAAA,IAC5B,GAAA,CAAI,SAAS,SAAA,CAAU,IAAA,IACvB,GAAA,CAAI,GAAA,KAAQ,UAAU,GAAA,EACtB;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sCAAA,EAAyC,GAAG,CAAA,2CAAA,EAA8C,QAAA,CAAS,GAAG,CAAA,CAAA;AAAA,KACxG;AAAA,EACF;AACA,EAAA,MAAM,EAAE,WAAA,EAAY,GAAI,MAAM,IAAA,CAAK,OAAA,CAAQ,QAAQ,QAAQ,CAAA;AAC3D,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B,SAAA,EAAW,SAAS,KAAA,CAAM;AAAA,GAC5B;AACF;AAoBO,SAAS,kBAAA,GAA8B;AAC5C,EAAA,OAAO,IAAI,OAAA,CAAQ,SAAS,CAAA,CACzB,WAAA,CAAY,CAAA,iEAAA,EAAoE,QAAQ,CAAA,CAAA,CAAG,CAAA,CAC3F,QAAA,CAAS,OAAA,EAAS,CAAA,uCAAA,EAA0C,QAAQ,CAAA,CAAA,CAAG,CAAA,CACvE,MAAA,CAAO,UAAA,EAAY,wDAAmD,CAAA,CACtE,MAAA,CAAO,sBAAA,EAAwB,mBAAA,EAAqB,OAAA,CAAQ,GAAA,EAAK,CAAA,CACjE,MAAA,CAAO,kBAAA,EAAoB,iBAAA,EAAmB,aAAa,CAAA,CAC3D,MAAA;AAAA,IACC,UAAA;AAAA,IACA;AAAA,GACF,CACC,MAAA;AAAA,IACC,iBAAA;AAAA,IACA;AAAA,GACF,CACC,MAAA;AAAA,IACC,QAAA;AAAA,IACA;AAAA,GACF,CACC,OAAO,iBAAiB,CAAA;AAC7B;AAiBA,SAAS,mBAAmB,GAAA,EAAqD;AAC/E,EAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,EAAA,MAAM,GAAA,GAAM,GAAA,CACT,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,OAAO,OAAO,CAAA;AACjB,EAAA,MAAM,MAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,MAAM,GAAA,EAAK;AACpB,IAAA,IAAI,CAAE,wBAAA,CAAsC,QAAA,CAAS,EAAE,CAAA,EAAG;AACxD,MAAA,MAAA,CAAO,oBAAoB,EAAE,CAAA,0BAAA,EAAwB,yBAAyB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAC1F,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,GAAA,CAAI,KAAK,EAAkB,CAAA;AAAA,EAC7B;AACA,EAAA,OAAO,GAAA,CAAI,MAAA,GAAS,CAAA,GAAI,GAAA,GAAM,MAAA;AAChC;AAOA,eAAe,iBAAA,CACb,KACA,IAAA,EACe;AAEf,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,MAAM,aAAA,CAAc,KAAK,IAAI,CAAA;AAC7B,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,eAAe,IAAI,CAAA;AAC3B;AAGA,eAAe,aAAA,CAAc,KAAa,IAAA,EAA4C;AACpF,EAAA,IAAI,CAAC,eAAA,CAAgB,GAAG,CAAA,EAAG;AACzB,IAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,GAAG,CAAA,kBAAA,EAAgB,QAAQ,CAAA,CAAE,CAAA;AAC5D,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,MAAMA,WAAY,CAAA,CAAA,OAAA,EAAQ;AAC1B,EAAAA,QAAAA,CAAQ,KAAA,CAAM,CAAA,WAAA,EAAc,GAAG,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,iBAAA,EAAmB,WAAA,EAAY,GAAI,MAAM,OAAO,4BAAoB,CAAA;AAC5E,IAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,CAAkB,EAAE,UAAA,EAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,EAAG,CAAA;AAIrF,IAAA,IAAI,CAAC,uBAAA,CAAwB,OAAO,CAAA,EAAG;AACrC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAIF;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,MAAM,qBAAA,CAAsB,KAAK,EAAE,OAAA,EAAS,SAAS,CAAA;AACpE,MAAAA,QAAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,MAAA,KAAA,CAAM,CAAA,UAAA,EAAa,QAAA,CAAS,GAAG,CAAC,CAAA,CAAE,CAAA;AAClC,MAAA,OAAA,CAAQ,SAAS,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,WAAW,CAAC,CAAA,CAAE,CAAA;AAC5C,MAAA,OAAA,CAAQ,WAAW,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,SAAS,CAAC,CAAA,CAAE,CAAA;AAC5C,MAAA,OAAA,CAAQ,CAAA,OAAA,EAAU,EAAE,GAAA,CAAI,MAAA,CAAO,OAAO,SAAS,CAAC,CAAC,CAAA,CAAE,CAAA;AACnD,MAAA,OAAA;AAAA,QACE,CAAA,CAAE,GAAA;AAAA,UACA,+DAA0D,GAAG,CAAA,+BAAA;AAAA;AAC/D,OACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAAA,QAAAA,CAAQ,KAAK,QAAQ,CAAA;AACrB,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,IAAA,IAAI,cAAA,CAAe,IAAA,CAAK,GAAG,CAAA,EAAG;AAC5B,MAAA,MAAA,CAAO,CAAA,8DAAA,EAA4D,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,GAAG,CAAA;AAAA,IACZ;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAGA,eAAe,eAAe,IAAA,EAA4C;AACxE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAE/C,EAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAA;AAEhD,EAAA,IAAI,IAAA,CAAK,UAAU,QAAA,EAAU;AAC3B,IAAA,MAAM,gBAAA,CAAiB,MAAM,QAAQ,CAAA;AACrC,IAAA;AAAA,EACF;AAIA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,OAAO,8BAAsB,CAAA;AACnE,IAAA,MAAM,UAAU,mBAAA,CAAoB,UAAA,EAAY,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,KAAA,CAAM,qBAAqB,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,MAAA,CAAO,8BAA8B,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IAClE;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,CAAA,0BAAA,EAA6B,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EACzF;AAEA,EAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa;AAAA,IAC1B,UAAA;AAAA,IACA,cAAc,IAAA,CAAK;AAAA,GACpB,CAAA;AACD,EAAA,MAAMA,WAAY,CAAA,CAAA,OAAA,EAAQ;AAC1B,EAAAA,QAAAA,CAAQ,KAAA,CAAM,IAAA,CAAK,MAAA,GAAS,8BAA8B,yBAAyB,CAAA;AACnF,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,OAAA,CAAQ,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AACxE,IAAAA,QAAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC9B,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,QAAA,EAAU,KAAA,CAAM,CAAC,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,KAAA,MAAW,KAAK,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE,CAAA;AAAA,IACzD;AACA,IAAA,IAAI,OAAO,QAAA,CAAS,MAAA,KAAW,KAAK,MAAA,CAAO,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC/D,MAAA,OAAA,CAAQ,0CAA0C,CAAA;AAAA,IACpD;AACA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,KAAA,MAAW,KAAK,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE,CAAA;AAGtD,MAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,IACrB;AACA,IAAA,IAAI,OAAO,WAAA,EAAa;AACtB,MAAA,OAAA,CAAQ,CAAA,mBAAA,EAAsB,CAAA,CAAE,GAAA,CAAI,kBAAkB,CAAC,CAAA,CAAE,CAAA;AAAA,IAC3D;AAIA,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,wBAAwB,EAAE,CAAA;AAAA,EACpD,SAAS,GAAA,EAAK;AACZ,IAAAA,QAAAA,CAAQ,KAAK,QAAQ,CAAA;AACrB,IAAA,MAAA,CAAO,MAAA,CAAO,GAAG,CAAC,CAAA;AAClB,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AASA,eAAsB,uBAAA,CACpB,EAAA,EACA,MAAA,GAAiC,CAAC,CAAA,KAAM,QAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,CAAA,EACzC;AACf,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAA,CAAY,MAAM,EAAA,CAAG,YAAA,IAAgB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAA;AAC3D,IAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AAC3B,IAAA,MAAM,KAAA,GAAQ,MAAM,EAAA,CAAG,cAAA,CAAe,QAAQ,CAAA;AAC9C,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,CAAO,iBAAA,CAAkB,IAAI,CAAC,CAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQA,eAAe,gBAAA,CACb,MACA,QAAA,EACe;AACf,EAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa;AAAA,IAC1B,UAAA,EAAY,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,IACxC,MAAA,EAAQ,IAAA;AAAA,IACR;AAAA,GACD,CAAA;AACD,EAAA,MAAMA,WAAY,CAAA,CAAA,OAAA,EAAQ;AAC1B,EAAAA,QAAAA,CAAQ,MAAM,gCAAgC,CAAA;AAC9C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,OAAA,CAAQ,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AACxE,IAAAA,QAAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,IAAA,IAAI,MAAA,CAAO,SAAS,MAAA,GAAS,CAAA,aAAc,CAAA,IAAK,MAAA,CAAO,QAAA,EAAU,KAAA,CAAM,CAAC,CAAA;AACxE,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE,CAAA;AACtF,IAAA,IAAI,OAAO,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,QAAQ,MAAA,KAAW,CAAA;AAC5D,MAAA,OAAA,CAAQ,0CAA0C,CAAA;AACpD,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,KAAA,MAAW,KAAK,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,CAAA,SAAA,EAAY,CAAC,CAAA,CAAE,CAAA;AACtD,MAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,IACrB;AACA,IAAA,IAAI,MAAA,CAAO,aAAa,OAAA,CAAQ,CAAA,qBAAA,EAAwB,EAAE,GAAA,CAAI,4BAA4B,CAAC,CAAA,CAAE,CAAA;AAG7F,IAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,WAAA,CAAY,EAAE,CAAA;AAC/B,IAAA,MAAM,SAAA,uBAAgB,GAAA,EAAoB;AAC1C,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA;AACd,MAAA,IAAI,CAAA,CAAE,KAAA,KAAU,WAAA,EAAa,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,OAAA,EAAA,CAAU,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,OAAO,CAAA,IAAK,KAAK,CAAC,CAAA;AAC3F,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,CAAC,CAAA,IAAK,SAAA,UAAmB,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,CAAC,CAAA,UAAA,CAAY,CAAA;AAAA,EAC5E,SAAS,GAAA,EAAK;AACZ,IAAAA,QAAAA,CAAQ,KAAK,QAAQ,CAAA;AACrB,IAAA,MAAA,CAAO,MAAA,CAAO,GAAG,CAAC,CAAA;AAClB,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAcO,SAAS,gBAAA,GAA4B;AAC1C,EAAA,OAAO,IAAI,OAAA,CAAQ,OAAO,CAAA,CACvB,WAAA,CAAY,8BAA8B,CAAA,CAC1C,MAAA,CAAO,sBAAA,EAAwB,mBAAA,EAAqB,QAAQ,GAAA,EAAK,CAAA,CACjE,MAAA,CAAO,OAAO,IAAA,KAAS;AACtB,IAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa,EAAE,UAAA,EAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,EAAG,CAAA;AACzE,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,MAAA,EAAO;AAG/B,IAAA,IAAI,UAAuD,EAAC;AAC5D,IAAA,IAAI;AACF,MAAA,OAAA,GAAA,CAAW,MAAM,GAAG,YAAA,EAAa,EAAG,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,KAAU,OAAO,CAAA;AAAA,IACvE,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,IAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC/C,MAAA,KAAA,CAAM,6BAA6B,CAAA;AAAA,IACrC,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,QAAA,MAAA;AAAA,UACE,GAAG,CAAA,CAAE,SAAS,CAAA,CAAA,EAAI,CAAA,CAAE,SAAS,CAAA,UAAA,EAAa,CAAA,CAAE,OAAO,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,GAAU,YAAY,WAAW,CAAA,CAAA;AAAA,SAC1G;AAAA,MACF;AACA,MAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,QAAA,MAAA,CAAO,CAAA,EAAG,CAAA,CAAE,GAAG,CAAA,0EAAA,CAAuE,CAAA;AAAA,MACxF;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,EACF,CAAC,CAAA;AACL;AAYO,SAAS,gBAAA,GAA4B;AAC1C,EAAA,OAAO,IAAI,OAAA,CAAQ,OAAO,CAAA,CACvB,YAAY,qDAAqD,CAAA,CACjE,MAAA,CAAO,OAAA,EAAS,gEAAgE,CAAA,CAChF,MAAA,CAAO,WAAA,EAAa,6CAA6C,CAAA,CACjE,MAAA,CAAO,WAAA,EAAa,0BAA0B,CAAA,CAC9C,MAAA,CAAO,sBAAA,EAAwB,mBAAA,EAAqB,QAAQ,GAAA,EAAK,CAAA,CACjE,MAAA,CAAO,oBAAoB,iBAAA,EAAmB,aAAa,CAAA,CAC3D,MAAA,CAAO,OAAO,IAAA,KAAS;AACtB,IAAA,MAAM,EAAA,GAAK,IAAI,YAAA,CAAa;AAAA,MAC1B,UAAA,EAAY,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,MACxC,cAAc,IAAA,CAAK;AAAA,KACpB,CAAA;AAGD,IAAA,MAAM,OAAO,QAAA,CAAS,IAAA,CAAK,QAAQ,IAAA,CAAK,UAAA,EAAY,kBAAkB,CAAC,CAAA;AAEvE,IAAA,IAAI,CAAC,QAAQ,MAAA,CAAO,IAAA,CAAK,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,EAAG;AAClD,MAAA,OAAA,CAAQ,oDAAoD,CAAA;AAC5D,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,mBAAmB,CAAC,CAAA,CAAA,EAAI,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,EAAI,SAAA,CAAU,MAAM,CAAA,CAAA,CAAG,CAAC,CAAA,CAAE,CAAA;AACnF,IAAA,KAAA,MAAW,OAAO,SAAA,EAAW;AAC3B,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,QAAA,CAAS,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IACpC;AAEA,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,gBAAgB,CAAC,CAAA,CAAE,CAAA;AAC9C,MAAA,OAAA,CAAQ,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAA,CAAI,sBAAsB,CAAC,CAAA,CAAE,CAAA;AAClD,MAAA,OAAA,CAAQ,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAA,CAAI,kBAAkB,CAAC,CAAA,CAAE,CAAA;AAC9C,MAAA,OAAA,CAAQ,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAA,CAAI,kBAAkB,CAAC,CAAA,CAAE,CAAA;AAAA,IAChD;AAEA,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,MAAA,OAAA,CAAQ,iCAA4B,CAAA;AACpC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,KAAK,GAAA,EAAK;AACb,MAAA,MAAMC,WAAU,MAAQ,CAAA,CAAA,OAAA,CAAQ,EAAE,OAAA,EAAS,YAAY,CAAA;AACvD,MAAA,IAAM,CAAA,CAAA,QAAA,CAASA,QAAO,CAAA,IAAK,CAACA,QAAAA,EAAS;AACnC,QAAA,OAAA,CAAQ,YAAY,CAAA;AACpB,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,EAAA,CAAG,KAAA,CAAM,EAAE,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AAEzC,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,OAAA,EAAS;AAC9B,MAAA,KAAA,CAAM,CAAA,QAAA,EAAW,CAAC,CAAA,CAAE,CAAA;AAAA,IACtB;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,OAAA,EAAS;AAC9B,MAAA,OAAA,CAAQ,WAAW,CAAA,CAAE,GAAG,CAAA,EAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG;AAC/B,MAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,MAAA,OAAA,CAAQ,CAAA,KAAA,EAAQ,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,oBAAA,CAAsB,CAAA;AAC7D,MAAA,KAAA,MAAW,CAAA,IAAK,OAAO,SAAA,EAAW;AAChC,QAAA,OAAA,CAAQ,IAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,MAC/B;AAAA,IACF;AACA,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,MAAA,KAAA,CAAM,sBAAsB,CAAA;AAAA,IAC9B;AAAA,EACF,CAAC,CAAA;AACL","file":"chunk-I7F3CG4Y.js","sourcesContent":["import path from \"node:path\";\nimport * as p from \"@clack/prompts\";\nimport { AssetManager } from \"@skaile/workspaces/asset-manager\";\nimport {\n  type DriverTarget,\n  parseAssetRef,\n  readLock,\n  SUPPORTED_DRIVER_TARGETS,\n} from \"@skaile/workspaces/core\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\nimport { Command } from \"commander\";\nimport { colorRef, formatSoftDepHint, logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\n\n/**\n * Canonical asset-ref shape accepted by `skaile install <ref>`:\n * `kind:@<publisher>/<name>#<version>` (the `#` version sigil). Validated via\n * `parseAssetRef` so the CLI shares the single canonical grammar; the legacy\n * trailing-`@version` shape is rejected.\n */\nconst REF_HINT = \"kind:@<publisher>/<name>#<version> (e.g. skill:@skaile/use-exa#1.0.0)\";\n\n/** True when `ref` parses as a canonical asset ref. */\nfunction isValidAssetRef(ref: string): boolean {\n  try {\n    parseAssetRef(ref);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Minimal catalog-source surface the pointer-only install path needs.\n * `RemoteCatalogSource` satisfies this — narrowing keeps {@link runPointerOnlyInstall}\n * testable with a hand-rolled stub.\n */\nexport interface InstallManifestSource {\n  getInstallManifest(ref: string): Promise<InstallManifest>;\n}\n\n/**\n * Capability check: is this catalog source able to serve install manifests?\n *\n * `openCatalogSource` returns a `RemoteCatalogSource | RestCatalogSource`.\n * Only the tRPC-framed `RemoteCatalogSource` implements `getInstallManifest`;\n * the REST-framed `RestCatalogSource` (the default for any catalog URL other\n * than `https://skaile.store`) does not. Calling it unconditionally would be a\n * runtime `TypeError`, so the pointer-only install path must capability-detect\n * first and fail with a clear, actionable message.\n */\nexport function supportsInstallManifest(source: unknown): source is InstallManifestSource {\n  return (\n    typeof (source as { getInstallManifest?: unknown } | null | undefined)?.getInstallManifest ===\n    \"function\"\n  );\n}\n\n/**\n * Minimal library surface the pointer-only install path needs.\n * `LocalIndex` satisfies this.\n */\nexport interface InstallLibrary {\n  install(manifest: InstallManifest): Promise<{ installPath: string }>;\n}\n\n/**\n * Result of a pointer-only catalog install.\n */\nexport interface PointerOnlyInstallResult {\n  /** Absolute path the verified asset bytes were written to. */\n  installPath: string;\n  /** The pinned upstream commit SHA the asset was fetched at. */\n  commitSha: string;\n  /** Number of files in the install manifest. */\n  fileCount: number;\n}\n\n/**\n * Pointer-only catalog install — the `skaile install <ref>` code path.\n *\n * 1. Resolves the pointer-only {@link InstallManifest} from the Catalog.\n * 2. Hands it to the library, which fetches each file's bytes directly from\n *    the upstream repo at the pinned commit, verifies every per-file SHA256\n *    plus the composite SHA256, and only then writes the verified files.\n *\n * Both dependencies are injected so the function is unit-testable without a\n * network round-trip. In production the CLI passes a `RemoteCatalogSource`\n * and a `LocalIndex`.\n *\n * @param ref - Asset ref (`<publisher>/<name>@<version>`, optional leading `@`).\n * @param deps - Injected catalog source + library.\n * @returns The install path, pinned commit SHA, and file count.\n * @throws When the ref is malformed, the manifest cannot be resolved, or any\n *   hash verification fails. The underlying error message is surfaced as-is.\n */\nexport async function runPointerOnlyInstall(\n  ref: string,\n  deps: { catalog: InstallManifestSource; library: InstallLibrary },\n): Promise<PointerOnlyInstallResult> {\n  let requested: ReturnType<typeof parseAssetRef>;\n  try {\n    requested = parseAssetRef(ref);\n  } catch (e) {\n    throw new Error(\n      `malformed asset ref '${ref}' — expected ${REF_HINT}: ${e instanceof Error ? e.message : String(e)}`,\n    );\n  }\n  const manifest = await deps.catalog.getInstallManifest(ref);\n  // [M1] Identity check: the catalog must not install a different asset than\n  // requested. Compare the PARSED refs (kind/publisher/name/pin) so equivalent\n  // spellings (optional `kind:`, default `skill`) are treated as the same ref.\n  const got = parseAssetRef(manifest.ref);\n  if (\n    got.kind !== requested.kind ||\n    got.publisher !== requested.publisher ||\n    got.name !== requested.name ||\n    got.pin !== requested.pin\n  ) {\n    throw new Error(\n      `catalog identity mismatch: requested '${ref}' but the catalog returned a manifest for '${manifest.ref}'`,\n    );\n  }\n  const { installPath } = await deps.library.install(manifest);\n  return {\n    installPath,\n    commitSha: manifest.source.commitSha,\n    fileCount: manifest.files.length,\n  };\n}\n\n/**\n * Creates the `skaile install` command.\n *\n * Two modes, selected by argument shape:\n *\n * - `skaile install` (no positional arg) — reads `skaile.yaml` and deploys all\n *   declared assets (and their transitive dependencies) to the configured\n *   driver target directory. Supports `--locked` for CI-mode install from a\n *   lock file.\n * - `skaile install <publisher>/<name>@<version>` — pointer-only catalog\n *   install: resolves the pointer-only install manifest from the configured\n *   Catalog, fetches each file's bytes directly from the upstream repo at the\n *   pinned commit, verifies every per-file + the composite SHA256, then writes\n *   the verified files into the local Library.\n *\n * @returns Configured {@link Command} ready for `program.addCommand()`.\n * @docLink cli/commands/project#make-install-command\n */\nexport function makeInstallCommand(): Command {\n  return new Command(\"install\")\n    .description(`Install dependencies from skaile.yaml, or a single asset by ref (${REF_HINT})`)\n    .argument(\"[ref]\", `Asset ref to install from the Catalog (${REF_HINT})`)\n    .option(\"--locked\", \"Install from lock file (CI mode — fails on drift)\")\n    .option(\"--project-dir <path>\", \"Project directory\", process.cwd())\n    .option(\"--target <agent>\", \"Agent framework\", \"claude-code\")\n    .option(\n      \"--global\",\n      \"Install the global SSOT (~/.skaile/skaile.yaml), fanning out to every global backend\",\n    )\n    .option(\n      \"--backend <ids>\",\n      \"Comma-separated global backends to install into (default: all resolved); implies --global\",\n    )\n    .option(\n      \"--link\",\n      \"symlink local-path assets instead of copying (dev loop; machine-local, not for committing)\",\n    )\n    .action(runInstallCommand);\n}\n\n/** Options shape accepted by the `skaile install` command action. */\ninterface InstallCommandOptions {\n  locked?: boolean;\n  projectDir: string;\n  target: string;\n  global?: boolean;\n  backend?: string;\n  link?: boolean;\n}\n\n/**\n * Parse a `--backend a,b` value into validated {@link DriverTarget}s, exiting on\n * an unknown id. Returns `undefined` when the flag is absent (resolve the full\n * global set instead).\n */\nfunction parseBackendFilter(raw: string | undefined): DriverTarget[] | undefined {\n  if (!raw) return undefined;\n  const ids = raw\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter(Boolean);\n  const out: DriverTarget[] = [];\n  for (const id of ids) {\n    if (!(SUPPORTED_DRIVER_TARGETS as string[]).includes(id)) {\n      logErr(`unknown backend '${id}' — expected one of: ${SUPPORTED_DRIVER_TARGETS.join(\", \")}`);\n      process.exit(1);\n    }\n    out.push(id as DriverTarget);\n  }\n  return out.length > 0 ? out : undefined;\n}\n\n/**\n * `skaile install` action body. Dispatches by argument shape:\n * a positional `ref` selects pointer-only catalog install, otherwise the\n * legacy `skaile.yaml` install path runs.\n */\nasync function runInstallCommand(\n  ref: string | undefined,\n  opts: InstallCommandOptions,\n): Promise<void> {\n  // ── Pointer-only catalog install: `skaile install <ref>` ──────────────\n  if (ref !== undefined) {\n    await runRefInstall(ref, opts);\n    return;\n  }\n\n  // ── Legacy install: `skaile install` reads skaile.yaml ────────────────\n  await runYamlInstall(opts);\n}\n\n/** Pointer-only catalog install path for `skaile install <ref>`. */\nasync function runRefInstall(ref: string, opts: InstallCommandOptions): Promise<void> {\n  if (!isValidAssetRef(ref)) {\n    logErr(`malformed asset ref '${ref}' — expected ${REF_HINT}`);\n    process.exit(1);\n  }\n  const spinner = p.spinner();\n  spinner.start(`Installing ${ref}`);\n  try {\n    const { openCatalogSource, openLibrary } = await import(\"../open-library.ts\");\n    const catalog = await openCatalogSource({ projectDir: path.resolve(opts.projectDir) });\n    // [H2] REST-framed catalogs (the default for any catalog URL other\n    // than https://skaile.store) cannot serve install manifests. Detect\n    // and fail clearly rather than throwing a runtime TypeError.\n    if (!supportsInstallManifest(catalog)) {\n      throw new Error(\n        \"pointer-only install (skaile install <ref>) requires a tRPC-framed Catalog. \" +\n          \"The configured catalog uses REST framing, which does not serve install \" +\n          \"manifests. Set catalog.url to https://skaile.store, or catalog.framing: trpc, \" +\n          \"in ~/.skaile/config.yaml.\",\n      );\n    }\n    const library = await openLibrary();\n    try {\n      const result = await runPointerOnlyInstall(ref, { catalog, library });\n      spinner.stop(\"Done\");\n      logOk(`Installed ${colorRef(ref)}`);\n      logInfo(`Path: ${S.dim(result.installPath)}`);\n      logInfo(`Commit: ${S.dim(result.commitSha)}`);\n      logInfo(`Files: ${S.dim(String(result.fileCount))}`);\n      logInfo(\n        S.dim(\n          `Installed globally (see Path above) — use \\`skaile add ${ref}\\` to deploy into this project.`,\n        ),\n      );\n    } finally {\n      library.close();\n    }\n  } catch (err) {\n    spinner.stop(\"Failed\");\n    const msg = err instanceof Error ? err.message : String(err);\n    if (/unreachable/i.test(msg)) {\n      logErr(`asset uninstallable — source commit no longer available (${msg})`);\n    } else {\n      logErr(msg);\n    }\n    process.exit(1);\n  }\n}\n\n/** Legacy install path for bare `skaile install` (reads skaile.yaml). */\nasync function runYamlInstall(opts: InstallCommandOptions): Promise<void> {\n  const projectDir = path.resolve(opts.projectDir);\n\n  const backends = parseBackendFilter(opts.backend);\n  // `--backend` implies `--global`.\n  if (opts.global || backends) {\n    await runGlobalInstall(opts, backends);\n    return;\n  }\n\n  // Hydrate sources declared in skaile.yaml before resolving assets, so\n  // freshly checked-out projects pull their source clones automatically.\n  try {\n    const { ensureSourcesCloned } = await import(\"../ensure-sources.ts\");\n    const hydrate = ensureSourcesCloned(projectDir, { quiet: true });\n    if (hydrate.cloned.length > 0) {\n      logOk(`Cloned source(s): ${hydrate.cloned.join(\", \")}`);\n    }\n    if (hydrate.failed.length > 0) {\n      logErr(`Failed to clone source(s): ${hydrate.failed.join(\", \")}`);\n    }\n  } catch (err) {\n    logWarn(`source hydration skipped: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  const am = new AssetManager({\n    projectDir,\n    driverTarget: opts.target as DriverTarget,\n  });\n  const spinner = p.spinner();\n  spinner.start(opts.locked ? \"Installing from lock file\" : \"Installing dependencies\");\n  try {\n    const result = await am.install({ locked: opts.locked, link: opts.link });\n    spinner.stop(\"Done\");\n    if (result.deployed.length > 0) {\n      for (const d of result.deployed) logOk(d);\n    }\n    if (result.removed.length > 0) {\n      for (const r of result.removed) logWarn(`Removed: ${r}`);\n    }\n    if (result.deployed.length === 0 && result.removed.length === 0) {\n      logInfo(\"Nothing to install (already up to date).\");\n    }\n    if (result.missing.length > 0) {\n      for (const m of result.missing) logErr(`Missing: ${m}`);\n      // Partial-miss must fail the process — CI can't otherwise distinguish a\n      // clean install from \"half the assets never resolved\".\n      process.exitCode = 1;\n    }\n    if (result.lockWritten) {\n      logInfo(`Lock file written: ${S.dim(\"skaile.lock.yaml\")}`);\n    }\n    // Report-only: surface soft deps the declared assets reference but aren't\n    // present. Never a prompt — install is a batch/CI path. Skipped under\n    // --locked: that mode is \"restore exactly\", so an `add` nudge would jar.\n    if (!opts.locked) await reportInstalledSoftDeps(am);\n  } catch (err) {\n    spinner.stop(\"Failed\");\n    logErr(String(err));\n    process.exit(1);\n  }\n}\n\n/**\n * Report (never prompt) the body-link soft deps that the declared assets\n * reference but that aren't in the project — the `install` counterpart to the\n * `add`-time soft-dep surface. `install` is a batch/CI path (often non-TTY), so\n * it only ever prints a hint: pulling stays an explicit `skaile add`. Best-effort\n * — `reportSoftDeps` swallows any index failure and returns `[]`.\n */\nexport async function reportInstalledSoftDeps(\n  am: Pick<AssetManager, \"listDeclared\" | \"reportSoftDeps\">,\n  onHint: (line: string) => void = (l) => logInfo(S.dim(l)),\n): Promise<void> {\n  try {\n    const declared = (await am.listDeclared()).map((d) => d.ref);\n    if (declared.length === 0) return;\n    const edges = await am.reportSoftDeps(declared);\n    for (const edge of edges) onHint(formatSoftDepHint(edge));\n  } catch {\n    // Best-effort: a soft-dep report must never fail an install that succeeded.\n  }\n}\n\n/**\n * Global cross-backend install: deploy every dep declared in the global SSOT\n * (`~/.skaile/skaile.yaml`) into each resolved global backend's dir under `~`,\n * write the global lock (`~/.skaile/skaile.lock.yaml`), then print per-backend\n * state. `backends` is the `--backend` filter (omit for the full resolved set).\n */\nasync function runGlobalInstall(\n  opts: InstallCommandOptions,\n  backends: DriverTarget[] | undefined,\n): Promise<void> {\n  const am = new AssetManager({\n    projectDir: path.resolve(opts.projectDir),\n    global: true,\n    backends,\n  });\n  const spinner = p.spinner();\n  spinner.start(\"Installing global dependencies\");\n  try {\n    const result = await am.install({ locked: opts.locked, link: opts.link });\n    spinner.stop(\"Done\");\n    if (result.deployed.length > 0) for (const d of result.deployed) logOk(d);\n    if (result.removed.length > 0) for (const r of result.removed) logWarn(`Removed: ${r}`);\n    if (result.deployed.length === 0 && result.removed.length === 0)\n      logInfo(\"Nothing to install (already up to date).\");\n    if (result.missing.length > 0) {\n      for (const m of result.missing) logErr(`Missing: ${m}`);\n      process.exitCode = 1;\n    }\n    if (result.lockWritten) logInfo(`Global lock written: ${S.dim(\"~/.skaile/skaile.lock.yaml\")}`);\n\n    // Per-backend reconciliation summary so a partial fan-out is visible.\n    const state = am.globalState({});\n    const byBackend = new Map<string, number>();\n    for (const s of state)\n      if (s.state === \"installed\") byBackend.set(s.backend, (byBackend.get(s.backend) ?? 0) + 1);\n    for (const [backend, n] of byBackend) logInfo(`${backend}: ${n} installed`);\n  } catch (err) {\n    spinner.stop(\"Failed\");\n    logErr(String(err));\n    process.exit(1);\n  }\n}\n\n/**\n * Creates the `skaile check` command.\n *\n * Scans all deployed assets for unmet dependency requirements **and** the\n * declared set for deps that resolved into the lock but never materialized, and\n * exits with code 1 if either is found. `doctor()` alone only walks *deployed*\n * assets' `requires`, so a declared dep whose bytes never landed (e.g. a\n * store-sourced `mcp-server`) used to report \"satisfied\" (#462).\n *\n * @returns Configured {@link Command} ready for `program.addCommand()`.\n * @docLink cli/commands/project#make-check-command\n */\nexport function makeCheckCommand(): Command {\n  return new Command(\"check\")\n    .description(\"Check for unmet requirements\")\n    .option(\"--project-dir <path>\", \"Project directory\", process.cwd())\n    .action(async (opts) => {\n      const am = new AssetManager({ projectDir: path.resolve(opts.projectDir) });\n      const issues = await am.doctor();\n      // A project with no (or an unreadable) skaile.yaml has no declared set to\n      // reconcile — treat it as drift-free so `check` behaves as it always has.\n      let drifted: Awaited<ReturnType<typeof am.listDeclared>> = [];\n      try {\n        drifted = (await am.listDeclared()).filter((d) => d.state === \"drift\");\n      } catch {\n        // ignored — doctor() below is still authoritative for deployed assets.\n      }\n      if (issues.length === 0 && drifted.length === 0) {\n        logOk(\"All dependencies satisfied.\");\n      } else {\n        for (const i of issues) {\n          logErr(\n            `${i.assetKind}:${i.assetName} requires ${i.depKind}:${i.depName} (${i.inRepos ? \"fixable\" : \"not found\"})`,\n          );\n        }\n        for (const d of drifted) {\n          logErr(`${d.ref} is declared and locked but not materialized — run \\`skaile install\\``);\n        }\n        process.exit(1);\n      }\n    });\n}\n\n/**\n * Creates the `skaile clean` command.\n *\n * Removes all skaile-managed assets tracked in `skaile.lock.yaml` from the\n * workspace. With `--all` also removes history, patches, repos, and the lock\n * file itself. Preserves unmanaged (manually placed) assets.\n *\n * @returns Configured {@link Command} ready for `program.addCommand()`.\n * @docLink cli/commands/project#make-clean-command\n */\nexport function makeCleanCommand(): Command {\n  return new Command(\"clean\")\n    .description(\"Remove all skaile-managed assets from the workspace\")\n    .option(\"--all\", \"Full reset: also remove history, patches, repos, and lock file\")\n    .option(\"--dry-run\", \"Show what would be removed without doing it\")\n    .option(\"-y, --yes\", \"Skip confirmation prompt\")\n    .option(\"--project-dir <path>\", \"Project directory\", process.cwd())\n    .option(\"--target <agent>\", \"Agent framework\", \"claude-code\")\n    .action(async (opts) => {\n      const am = new AssetManager({\n        projectDir: path.resolve(opts.projectDir),\n        driverTarget: opts.target as DriverTarget,\n      });\n\n      // Preview: load lock file to show what will be cleaned\n      const lock = readLock(path.resolve(opts.projectDir, \"skaile.lock.yaml\"));\n\n      if (!lock || Object.keys(lock.assets).length === 0) {\n        logInfo(\"Nothing to clean (no skaile-managed assets found).\");\n        return;\n      }\n\n      const assetRefs = Object.keys(lock.assets);\n      console.log();\n      console.log(`  ${S.heading(\"Assets to remove:\")} ${S.dim(`(${assetRefs.length})`)}`);\n      for (const ref of assetRefs) {\n        console.log(`    ${colorRef(ref)}`);\n      }\n\n      if (opts.all) {\n        console.log();\n        console.log(`  ${S.heading(\"Also removing:\")}`);\n        console.log(`    ${S.dim(\".skaile/history.yaml\")}`);\n        console.log(`    ${S.dim(\".skaile/patches/\")}`);\n        console.log(`    ${S.dim(\"skaile.lock.yaml\")}`);\n      }\n\n      if (opts.dryRun) {\n        console.log();\n        logInfo(\"Dry run — no changes made.\");\n        return;\n      }\n\n      if (!opts.yes) {\n        const confirm = await p.confirm({ message: \"Proceed?\" });\n        if (p.isCancel(confirm) || !confirm) {\n          logInfo(\"Cancelled.\");\n          return;\n        }\n      }\n\n      const result = am.clean({ all: opts.all });\n\n      console.log();\n      for (const r of result.removed) {\n        logOk(`Removed ${r}`);\n      }\n      for (const s of result.skipped) {\n        logWarn(`Skipped ${s.ref}: ${s.reason}`);\n      }\n      if (result.unmanaged.length > 0) {\n        console.log();\n        logInfo(`Kept ${result.unmanaged.length} unmanaged asset(s):`);\n        for (const u of result.unmanaged) {\n          console.log(`    ${S.dim(u)}`);\n        }\n      }\n      if (opts.all) {\n        console.log();\n        logOk(\"Full reset complete.\");\n      }\n    });\n}\n"]}

package/dist/{chunk-BRNGJTHH.js → chunk-IJTEDXWQ.js}

@@ -1,4 +1,4 @@
-import { globalSettingsPath, mapLegacyFields } from './chunk-7NRF7BQB.js';
+import { globalSettingsPath, mapLegacyFields } from './chunk-UWU572Q6.js';
 import { rmSync, existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
 import { randomBytes, createHash } from 'crypto';
 import { homedir } from 'os';
@@ -228,5 +228,5 @@ function isStoreAuthenticated() {
 }
 
 export { deviceLogin, getStoreConfig, getStoreIdentity, getStoreToken, hasStoredAuth, isStoreAuthenticated, loadStoreAuthConfig, logout, storeFetch };
-//# sourceMappingURL=chunk-BRNGJTHH.js.map
-//# sourceMappingURL=chunk-BRNGJTHH.js.map
+//# sourceMappingURL=chunk-IJTEDXWQ.js.map
+//# sourceMappingURL=chunk-IJTEDXWQ.js.map

package/dist/{chunk-BRNGJTHH.js.map → chunk-IJTEDXWQ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-auth.ts","../cli/src/store-client.ts"],"names":["readFileSync"],"mappings":";;;;;;AAsBA,SAAS,YAAA,GAAwD;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AAC1E,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAUA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,MAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,gBAAA,IAAoB,IAAA,CAAK,MAAM,WAAW;AAAA,GAClE;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,gBAAA,CACd,MAAA,GAA0B,mBAAA,EAAoB,EACM;AACpD,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,SAAS,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AAC3E,IAAA,MAAM,WACJ,OAAO,IAAA,CAAK,kBAAA,KAAuB,QAAA,GAAW,KAAK,kBAAA,GAAqB,KAAA,CAAA;AAC1E,IAAA,MAAM,cAAc,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,GAAW,KAAK,YAAA,GAAe,KAAA,CAAA;AAChF,IAAA,OAAO,QAAA,IAAY,WAAA,GAAc,EAAE,QAAA,EAAU,aAAY,GAAI,IAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACG;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,YAAA,EAAa;AAE1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,KAAA,EAAO,gBAAA;AAAA,MACP,gBAAgB,IAAA,CAAK,SAAA;AAAA,MACrB,qBAAA,EAAuB;AAAA,KACxB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,IAAA,CAAK;AAAA,OACrB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yBAAyB,KAAA,CAAM,iBAAA,IAAqB,KAAA,CAAM,KAAA,IAAS,IAAI,MAAM,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;AC/PO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAMA,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-BRNGJTHH.js","sourcesContent":["/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * A PKCE (RFC 7636) `code_verifier` + its S256 `code_challenge`. Keycloak\n * enforces PKCE on the `skaile-store-cli` device flow (the device-authorization\n * request 400s with \"Missing parameter: code_challenge_method\" otherwise), so\n * every `deviceLogin` mints a fresh pair: the challenge goes on the device-auth\n * request, the verifier on the matching token poll. `base64url` (no padding)\n * per the spec.\n */\nfunction makePkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  const challenge = createHash(\"sha256\").update(verifier).digest(\"base64url\");\n  return { verifier, challenge };\n}\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n  keycloakUrl: string;\n  realm: string;\n  clientId: string;\n  authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n  const home = process.env.SKAILE_HOME ?? join(homedir(), \".skaile\");\n  return {\n    keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n    realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n    clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n    authFile: process.env.SKAILE_AUTH_FILE ?? join(home, \"auth.json\"),\n  };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n  const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n  return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n  access_token: string;\n  refresh_token?: string;\n  /** Epoch ms when the access token expires (with a safety margin already applied). */\n  expires_at: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  interval?: number;\n  expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n  fetchImpl?: typeof fetch;\n  sleep?: (ms: number) => Promise<void>;\n  /** Called once with the verification URL + user code (default: write to stderr). */\n  onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n  try {\n    const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n    // Reject a corrupt / hand-edited file rather than treat it as a session.\n    if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The caller's store identity, decoded LOCALLY from the cached token's JWT\n * payload (no network, no signature check — this is an author-side hint, not an\n * authorization decision). Returns `null` when not signed in or the token is\n * unreadable. `githubLogin` is the verified GitHub handle (the preferred\n * publisher namespace); `username` is the Keycloak `preferred_username`.\n */\nexport function getStoreIdentity(\n  config: StoreAuthConfig = loadStoreAuthConfig(),\n): { username?: string; githubLogin?: string } | null {\n  const auth = readAuth(config);\n  if (!auth) return null;\n  try {\n    const payload = auth.access_token.split(\".\")[1];\n    const json = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf-8\"));\n    const username =\n      typeof json.preferred_username === \"string\" ? json.preferred_username : undefined;\n    const githubLogin = typeof json.github_login === \"string\" ? json.github_login : undefined;\n    return username || githubLogin ? { username, githubLogin } : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n  mkdirSync(dirname(config.authFile), { recursive: true });\n  writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n  chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n  try {\n    rmSync(config.authFile);\n  } catch {\n    // already absent — nothing to do\n  }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n  return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n  return {\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n  };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n  process.stderr.write(\n    `\\nTo sign in, open:\\n\\n    ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n  );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<StoredAuth> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const sleep = deps.sleep ?? defaultSleep;\n  const onPrompt = deps.onPrompt ?? defaultPrompt;\n  const endpoints = oidc(config);\n  const pkce = makePkcePair();\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      client_id: config.clientId,\n      scope: \"openid profile\",\n      code_challenge: pkce.challenge,\n      code_challenge_method: \"S256\",\n    }),\n  });\n  if (!deviceRes.ok) {\n    throw new Error(\n      `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n  onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n  const intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n  let waitMs = intervalMs;\n\n  while (Date.now() < deadline) {\n    await sleep(waitMs);\n    const tokenRes = await fetchImpl(endpoints.token, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: device.device_code,\n        client_id: config.clientId,\n        code_verifier: pkce.verifier,\n      }),\n    });\n    const token = (await tokenRes.json()) as TokenResponse;\n    if (tokenRes.ok) {\n      const stored = tokenToStored(token);\n      writeAuth(config, stored);\n      return stored;\n    }\n    // RFC 8628 §3.5 pending / slow-down handling.\n    if (token.error === \"authorization_pending\") continue;\n    if (token.error === \"slow_down\") {\n      waitMs += 5_000;\n      continue;\n    }\n    throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n  }\n  throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n  config: StoreAuthConfig,\n  refreshToken: string,\n  fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n  const res = await fetchImpl(oidc(config).token, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n      client_id: config.clientId,\n    }),\n  });\n  const token = (await res.json()) as TokenResponse;\n  if (!res.ok) {\n    throw new Error(\n      `Token refresh failed: ${token.error_description ?? token.error ?? res.status}`,\n    );\n  }\n  const stored = tokenToStored(token);\n  writeAuth(config, stored);\n  return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<string> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const auth = readAuth(config);\n  if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n  if (Date.now() < auth.expires_at) return auth.access_token;\n  if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n  try {\n    return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n  } catch {\n    throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n  }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}
+{"version":3,"sources":["../cli/src/store-auth.ts","../cli/src/store-client.ts"],"names":["readFileSync"],"mappings":";;;;;;AAsBA,SAAS,YAAA,GAAwD;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AAC1E,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAUA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,MAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,gBAAA,IAAoB,IAAA,CAAK,MAAM,WAAW;AAAA,GAClE;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,gBAAA,CACd,MAAA,GAA0B,mBAAA,EAAoB,EACM;AACpD,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,SAAS,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AAC3E,IAAA,MAAM,WACJ,OAAO,IAAA,CAAK,kBAAA,KAAuB,QAAA,GAAW,KAAK,kBAAA,GAAqB,KAAA,CAAA;AAC1E,IAAA,MAAM,cAAc,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,GAAW,KAAK,YAAA,GAAe,KAAA,CAAA;AAChF,IAAA,OAAO,QAAA,IAAY,WAAA,GAAc,EAAE,QAAA,EAAU,aAAY,GAAI,IAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACG;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,YAAA,EAAa;AAE1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,KAAA,EAAO,gBAAA;AAAA,MACP,gBAAgB,IAAA,CAAK,SAAA;AAAA,MACrB,qBAAA,EAAuB;AAAA,KACxB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,IAAA,CAAK;AAAA,OACrB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yBAAyB,KAAA,CAAM,iBAAA,IAAqB,KAAA,CAAM,KAAA,IAAS,IAAI,MAAM,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;AC/PO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAMA,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-IJTEDXWQ.js","sourcesContent":["/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * A PKCE (RFC 7636) `code_verifier` + its S256 `code_challenge`. Keycloak\n * enforces PKCE on the `skaile-store-cli` device flow (the device-authorization\n * request 400s with \"Missing parameter: code_challenge_method\" otherwise), so\n * every `deviceLogin` mints a fresh pair: the challenge goes on the device-auth\n * request, the verifier on the matching token poll. `base64url` (no padding)\n * per the spec.\n */\nfunction makePkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  const challenge = createHash(\"sha256\").update(verifier).digest(\"base64url\");\n  return { verifier, challenge };\n}\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n  keycloakUrl: string;\n  realm: string;\n  clientId: string;\n  authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n  const home = process.env.SKAILE_HOME ?? join(homedir(), \".skaile\");\n  return {\n    keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n    realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n    clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n    authFile: process.env.SKAILE_AUTH_FILE ?? join(home, \"auth.json\"),\n  };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n  const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n  return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n  access_token: string;\n  refresh_token?: string;\n  /** Epoch ms when the access token expires (with a safety margin already applied). */\n  expires_at: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  interval?: number;\n  expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n  fetchImpl?: typeof fetch;\n  sleep?: (ms: number) => Promise<void>;\n  /** Called once with the verification URL + user code (default: write to stderr). */\n  onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n  try {\n    const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n    // Reject a corrupt / hand-edited file rather than treat it as a session.\n    if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The caller's store identity, decoded LOCALLY from the cached token's JWT\n * payload (no network, no signature check — this is an author-side hint, not an\n * authorization decision). Returns `null` when not signed in or the token is\n * unreadable. `githubLogin` is the verified GitHub handle (the preferred\n * publisher namespace); `username` is the Keycloak `preferred_username`.\n */\nexport function getStoreIdentity(\n  config: StoreAuthConfig = loadStoreAuthConfig(),\n): { username?: string; githubLogin?: string } | null {\n  const auth = readAuth(config);\n  if (!auth) return null;\n  try {\n    const payload = auth.access_token.split(\".\")[1];\n    const json = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf-8\"));\n    const username =\n      typeof json.preferred_username === \"string\" ? json.preferred_username : undefined;\n    const githubLogin = typeof json.github_login === \"string\" ? json.github_login : undefined;\n    return username || githubLogin ? { username, githubLogin } : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n  mkdirSync(dirname(config.authFile), { recursive: true });\n  writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n  chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n  try {\n    rmSync(config.authFile);\n  } catch {\n    // already absent — nothing to do\n  }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n  return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n  return {\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n  };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n  process.stderr.write(\n    `\\nTo sign in, open:\\n\\n    ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n  );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<StoredAuth> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const sleep = deps.sleep ?? defaultSleep;\n  const onPrompt = deps.onPrompt ?? defaultPrompt;\n  const endpoints = oidc(config);\n  const pkce = makePkcePair();\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      client_id: config.clientId,\n      scope: \"openid profile\",\n      code_challenge: pkce.challenge,\n      code_challenge_method: \"S256\",\n    }),\n  });\n  if (!deviceRes.ok) {\n    throw new Error(\n      `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n  onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n  const intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n  let waitMs = intervalMs;\n\n  while (Date.now() < deadline) {\n    await sleep(waitMs);\n    const tokenRes = await fetchImpl(endpoints.token, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: device.device_code,\n        client_id: config.clientId,\n        code_verifier: pkce.verifier,\n      }),\n    });\n    const token = (await tokenRes.json()) as TokenResponse;\n    if (tokenRes.ok) {\n      const stored = tokenToStored(token);\n      writeAuth(config, stored);\n      return stored;\n    }\n    // RFC 8628 §3.5 pending / slow-down handling.\n    if (token.error === \"authorization_pending\") continue;\n    if (token.error === \"slow_down\") {\n      waitMs += 5_000;\n      continue;\n    }\n    throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n  }\n  throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n  config: StoreAuthConfig,\n  refreshToken: string,\n  fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n  const res = await fetchImpl(oidc(config).token, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n      client_id: config.clientId,\n    }),\n  });\n  const token = (await res.json()) as TokenResponse;\n  if (!res.ok) {\n    throw new Error(\n      `Token refresh failed: ${token.error_description ?? token.error ?? res.status}`,\n    );\n  }\n  const stored = tokenToStored(token);\n  writeAuth(config, stored);\n  return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<string> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const auth = readAuth(config);\n  if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n  if (Date.now() < auth.expires_at) return auth.access_token;\n  if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n  try {\n    return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n  } catch {\n    throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n  }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}

package/dist/{chunk-PB2Y4AMQ.js → chunk-J7WFDLV6.js}

@@ -1,5 +1,5 @@
 import { classifyGenericErrorMessage } from './chunk-GAH4YRCI.js';
-import { AgentDriver } from './chunk-LQMALDDB.js';
+import { AgentDriver } from './chunk-CJGNYHPG.js';
 import { spawn } from 'child_process';
 import { createInterface } from 'readline';
 
@@ -405,6 +405,7 @@ function extractText(json) {
   if (Array.isArray(json?.parts)) {
     return json.parts.filter((p) => typeof p?.text === "string").map((p) => p.text).join("");
   }
+  if (typeof json?.part?.text === "string") return json.part.text;
   return "";
 }
 function extractTokens(json) {
@@ -426,5 +427,5 @@ function extractCost(json) {
 }
 
 export { SubprocessCliDriver, extractCost, extractText, extractTokens };
-//# sourceMappingURL=chunk-PB2Y4AMQ.js.map
-//# sourceMappingURL=chunk-PB2Y4AMQ.js.map
+//# sourceMappingURL=chunk-J7WFDLV6.js.map
+//# sourceMappingURL=chunk-J7WFDLV6.js.map

package/dist/chunk-J7WFDLV6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/drivers/_subprocess-cli.ts"],"names":[],"mappings":";;;;;AAqCO,IAAe,mBAAA,GAAf,cAA2C,WAAA,CAAY;AAAA;AAAA,EAezC,IAAA,GAA6B,OAAA;AAAA,EAEtC,MAAA;AAAA,EAEF,IAAA,GAA4B,IAAA;AAAA,EAC5B,EAAA,GAAuB,IAAA;AAAA,EACvB,eAAyB,EAAC;AAAA,EAC1B,YAAA,GAAe,EAAA;AAAA,EACf,OAAA,GAAU,KAAA;AAAA;AAAA,EAGV,QAAA,GAAW,EAAA;AAAA,EACX,eAAA,GAAkB,KAAA;AAAA,EAClB,qBAAqC,EAAC;AAAA,EACtC,SAAA,GAAY,KAAA;AAAA,EACZ,QAAA,GAAW,KAAA;AAAA,EACX,WAAA,GAAmC,IAAA;AAAA,EACnC,UAAA,GAA4C,IAAA;AAAA,EAE1C,UAAA;AAAA,EACA,WAAA,GAAiC,IAAA;AAAA,EAE3C,YAAY,MAAA,EAAqB;AAC/B,IAAA,KAAA,EAAM;AACN,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,IAAa,gBAAA,GAAuC;AAClD,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACd;AAAA,EAES,QAAA,GAA+B;AACtC,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAES,aAAA,GAAmC;AAC1C,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA,EAES,YAAY,KAAA,EAA0E;AAC7F,IAAA,IAAI,MAAM,KAAA,KAAU,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,QAAQ,KAAA,CAAM,KAAA;AACzD,IAAA,IAAI,MAAM,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,WAAW,KAAA,CAAM,QAAA;AAC/D,IAAA,IAAI,MAAM,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,SAAS,KAAA,CAAM,MAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,EACjB;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,IAAA,KAAS,IAAA,IAAQ,CAAC,KAAK,IAAA,CAAK,MAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,IAAA,CAAK,MAAM,MAAM,IAAI,MAAM,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,yBAAA,CAA2B,CAAA;AAC7E,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,MAAM,KAAK,KAAA,EAAM;AAEpC,IAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAChB,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,qBAAqB,EAAC;AAC3B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,KAAA;AAChB,IAAA,IAAA,CAAK,eAAe,EAAC;AACrB,IAAA,IAAA,CAAK,YAAA,GAAe,EAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAEnB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,aAAA,CAAc,OAAO,CAAA;AAC3C,IAAA,MAAM,cAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,WAAA,CAAa,CAAA;AAC9D,IAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,CAAA,EAAG,KAAK,SAAS,CAAA,eAAA,CAAiB,IACzD,OAAA,CAAQ,GAAA,CAAI,GAAG,IAAA,CAAK,SAAS,iBAAiB,CAAA,CAAa,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,GACvF,EAAC;AACL,IAAA,MAAM,GAAA,GAAM,eAAe,IAAA,CAAK,UAAA;AAChC,IAAA,MAAM,IAAA,GAAO,CAAC,GAAG,OAAA,EAAS,GAAG,KAAK,SAAA,CAAU,QAAA,EAAU,IAAA,CAAK,UAAU,CAAC,CAAA;AACtE,IAAA,MAAM,GAAA,GAAM,KAAK,QAAA,EAAS;AAE1B,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,MAAA,IAAA,CAAK,WAAA,GAAc,OAAA;AACnB,MAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,cAAA,EAAgB;AAAA,QAC5B,GAAA;AAAA,QACA,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,QACjB,MAAA,EAAQ,OAAA,CAAQ,IAAA,CAAK,UAAU;AAAA,OAChC,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,GAAA,EAAK,IAAA,EAAM;AAAA,QAC5B,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,QACjB,GAAA;AAAA,QACA,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,OACjC,CAAA;AACD,MAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,MAAA,MAAM,WAAA,GAAc,IAAA;AAEpB,MAAA,WAAA,CAAY,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAe;AACtC,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,oBAAA,CAAqB,GAA4B,CAAA;AACrE,QAAA,IAAA,CAAK,IAAI,KAAA,CAAM,aAAA,EAAe,GAAA,EAAK,EAAE,QAAQ,CAAA;AAC7C,QAAA,IAAA,CAAK,UAAU,MAAM,CAAA;AACrB,QAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,QAAA,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG,EAAE,MAAA,EAAQ,CAAC,CAAA;AAAA,MACxE,CAAC,CAAA;AAED,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,IAAI,IAAA,CAAK,SAAS,OAAA,EAAS;AACzB,UAAA,MAAM,KAAK,eAAA,CAAgB,EAAE,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACjD,UAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AACV,UAAC,EAAA,CAA+B,GAAG,MAAA,EAAQ,CAAC,SAAiB,IAAA,CAAK,YAAA,CAAa,IAAI,CAAC,CAAA;AAAA,QACtF,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,MAAA,CAAO,YAAY,MAAM,CAAA;AAC9B,UAAA,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACxC,YAAA,IAAA,CAAK,YAAA,IAAgB,KAAA;AAAA,UACvB,CAAC,CAAA;AAAA,QACH;AAAA,MACF;AAEA,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,MAAM,WAAW,eAAA,CAAgB,EAAE,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACvD,QAAC,QAAA,CAAqC,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,KAAiB;AACjE,UAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,QAAA,EAAU,EAAE,MAAM,CAAA;AACjC,UAAA,IAAA,CAAK,YAAA,CAAa,KAAK,IAAI,CAAA;AAC3B,UAAA,IAAI,KAAK,YAAA,CAAa,MAAA,GAAS,EAAA,EAAI,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,QAC7D,CAAC,CAAA;AAAA,MACH;AAEA,MAAA,WAAA,CAAY,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,EAAqB,MAAA,KAAkC;AAC7E,QAAA,IAAA,CAAK,IAAI,IAAA,CAAK,YAAA,EAAc,EAAE,IAAA,EAAM,QAAQ,CAAA;AAC5C,QAAA,IAAA,CAAK,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC1B,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,IAAA,EAAM,KAAK,SAAS,CAAA;AAAA,EAC3B;AAAA,EAEA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,IAAA,EAAM,KAAK,SAAS,CAAA;AACzB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA,EAEA,MAAM,YAAA,GAA8B;AAClC,IAAA,IAAA,CAAK,IAAA,EAAK;AACV,IAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA,EAWU,WAAW,KAAA,EAAsB;AAAA,EAAC;AAAA;AAAA,EAGlC,eAAe,IAAA,EAAoB;AAAA,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUpC,YAAA,CAAa,MAAqB,MAAA,EAAkD;AAC5F,IAAA,IAAI,SAAS,CAAA,IAAM,IAAA,KAAS,IAAA,IAAQ,MAAA,KAAW,MAAO,OAAO,IAAA;AAC7D,IAAA,MAAM,OAAO,IAAA,CAAK,YAAA,CAAa,MAAM,GAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AACnD,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,kBAAA,EAAqB,IAAA,IAAQ,MAAM,CAAA,EAAG,IAAA,GAAO,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,MACzF,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,IAAA,IAAQ,CAAA,IAAA,EAAO,IAAA,CAAK,WAAW,CAAA,mDAAA;AAAA,KACvC;AAAA,EACF;AAAA;AAAA;AAAA,EAKU,cAAc,OAAA,EAAyB;AAC/C,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA,GAAe,CAAA,EAAG,IAAA,CAAK,OAAO,YAAY;;AAAA;;AAAA,EAAc,OAAO,CAAA,CAAA,GAAK,OAAA;AAAA,EACzF;AAAA,EAEU,mBAAmB,QAAA,EAAwB;AACnD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAChB,MAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,QACvB,IAAA,EAAM,eAAA;AAAA,QACN,OAAA,EAAS,YAAY,EAAE;AAAA,OACH,CAAA;AAAA,IACxB;AACA,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,UAAA,CAAW,IAAA,CAAK,QAAQ,CAAA,GAC3C,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,GACnC,QAAA;AACJ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,QACvB,IAAA,EAAM,gBAAA;AAAA,QACN,OAAA,EAAS,YAAY,QAAQ,CAAA;AAAA,QAC7B,UAAA,EAAY;AAAA,OACQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEU,iBAAiB,QAAA,EAAyB;AAClD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC3B,IAAA,MAAM,IAAA,GAAO,YAAY,IAAA,CAAK,QAAA;AAC9B,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,aAAA;AAAA,MACN,OAAA,EAAS,YAAY,IAAI;AAAA,KACL,CAAA;AACtB,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAAA,EAClB;AAAA,EAEU,YAAA,CAAa,MAAc,KAAA,EAAsB;AACzD,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,WAAA;AAAA,MACN,IAAA;AAAA,MACA,IAAA,EAAM,EAAE,IAAA,EAAK;AAAA,MACb;AAAA,KACoB,CAAA;AAAA,EACxB;AAAA,EAEU,cAAA,CAAe,IAAA,EAAc,IAAA,EAAe,OAAA,GAAU,KAAA,EAAa;AAC3E,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,OAAA,EAAS,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,CAAA;AACzF,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,oBAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACU,CAAA;AAAA,EACxB;AAAA,EAEQ,gBAAA,GAAyB;AAC/B,IAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,MAAA,KAAW,CAAA,EAAG;AAC1C,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,UAAA;AAAA,MACN,WAAA,EAAa,CAAC,GAAG,IAAA,CAAK,kBAAkB;AAAA,KACpB,CAAA;AACtB,IAAA,IAAA,CAAK,qBAAqB,EAAC;AAAA,EAC7B;AAAA,EAEU,WAAW,IAAA,EAKZ;AACP,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,MAAA;AACzC,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,QAAA;AAAA,MACN,OAAA,EAAS,KAAK,OAAA,IAAW,SAAA;AAAA,MACzB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,KAAK,OAAA,IAAW,CAAA;AAAA,MACzB,GAAI,KAAK,MAAA,GAAS,EAAE,QAAQ,IAAA,CAAK,MAAA,KAAW;AAAC,KACzB,CAAA;AAAA,EACxB;AAAA,EAEU,SAAA,CAAU,MAAA,EAAoB,KAAA,GAAQ,KAAA,EAAa;AAC3D,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,OAAA;AAAA,MACN,OAAO,MAAA,CAAO,OAAA;AAAA,MACd,MAAA;AAAA,MACA;AAAA,KACoB,CAAA;AAAA,EACxB;AAAA,EAEU,cAAA,CAAe,IAAa,IAAA,EAAqB;AACzD,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,KAAO,IAAA,CAAK,UAAA,EAAY;AACnC,IAAA,IAAA,CAAK,UAAA,GAAa,EAAA;AAClB,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,cAAA;AAAA,MACN,eAAA,EAAiB,EAAA;AAAA,MACjB,GAAI,IAAA,GAAO,EAAE,WAAA,EAAa,IAAA,KAAS;AAAC,KAChB,CAAA;AAAA,EACxB;AAAA;AAAA,EAGU,gBAAgB,OAAA,EAA6B;AACrD,IAAA,MAAM,OAAA,GAAU,4BAA4B,OAAO,CAAA;AACnD,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO;AAAA,QACL,OAAA;AAAA,QACA,QAAA,EAAU,SAAA;AAAA,QACV,SAAA,EAAW,IAAA;AAAA,QACX,IAAA,EAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,WAAW,CAAA,sCAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GACJ,QAAQ,QAAA,KAAa,MAAA,GACjB,4CAA4C,IAAA,CAAK,WAAW,MAC5D,OAAA,CAAQ,QAAA,KAAa,eACnB,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,wDAAA,CAAA,GACnB,OAAA,CAAQ,aAAa,OAAA,GACnB,wGAAA,GACA,CAAA,0CAAA,EAA6C,IAAA,CAAK,WAAW,CAAA,CAAA,CAAA;AACvE,IAAA,OAAO,EAAE,SAAS,QAAA,EAAU,OAAA,CAAQ,UAAU,SAAA,EAAW,OAAA,CAAQ,WAAW,IAAA,EAAK;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBU,OAAA,CAAQ,SAAA,GAAsB,EAAC,EAA2B;AAClE,IAAA,MAAM,MAA8B,EAAC;AACrC,IAAA,MAAM,QAAA,GAAW,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,UAAA,EAAY,mBAAA,EAAqB,GAAG,SAAS,CAAA;AACvF,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACzB,MAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA;AAAA,IAClC;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtD,MAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC/B,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,CAAA,EAAG,IAAA,CAAK,SAAS,UAAU,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC9E,QAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,MACb;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,UAAA,EAAY;AAC1B,MAAA,GAAA,CAAI,eAAA,GAAkB,CAAA,QAAA,EAAW,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA,qCAAA,CAAA;AAAA,IACzD;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,GAAA,EAAK,MAAA,CAAO,OAAO,GAAA,EAAK,IAAA,CAAK,OAAO,GAAG,CAAA;AACvD,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAIQ,aAAa,IAAA,EAAoB;AACvC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG;AAClB,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,sBAAA,EAAwB,EAAE,MAAM,CAAA;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,WAAW,IAAI,CAAA;AAAA,IACtB,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,kBAAA,EAAoB,EAAE,OAAO,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,IAC1D;AAAA,EACF;AAAA,EAEQ,MAAA,CAAO,MAAqB,MAAA,EAAqC;AACvE,IAAA,IAAA,CAAK,OAAA,EAAQ;AAEb,IAAA,IAAI,KAAK,QAAA,EAAU;AACjB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,MAAA,IAAA,CAAK,aAAA,EAAc;AACnB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAK,IAAA,KAAS,UAAA,KAAe,IAAA,KAAS,CAAA,IAAK,SAAS,IAAA,CAAA,EAAO;AAC7D,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,cAAA,CAAe,KAAK,YAAY,CAAA;AAAA,MACvC,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,sBAAA,EAAwB,EAAE,OAAO,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,MAC9D;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAC9C,IAAA,IAAI,OAAA,IAAW,CAAC,IAAA,CAAK,SAAA,EAAW;AAC9B,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,UAAU,OAAO,CAAA;AACtB,MAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,MAAA,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAC,CAAA;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW,IAAA,CAAK,WAAW,EAAE,OAAA,EAAS,kBAAkB,CAAA;AAAA,SAC7D;AACH,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,IACxB;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,IAAA,IAAA,CAAK,aAAA,EAAc;AAAA,EACrB;AAAA,EAEQ,aAAA,GAAsB;AAC5B,IAAA,MAAM,UAAU,IAAA,CAAK,WAAA;AACrB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,OAAA,IAAU;AAAA,EACZ;AAAA,EAEQ,aAAa,GAAA,EAAkB;AACrC,IAAA,MAAM,SAAS,IAAA,CAAK,UAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,MAAA,GAAS,GAAG,CAAA;AAAA,EACd;AAAA,EAEQ,OAAA,GAAgB;AACtB,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AACf,IAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AACV,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAEQ,qBAAqB,GAAA,EAAwC;AACnE,IAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,UAAU,CAAA,kBAAA,CAAA;AAAA,QAC3B,QAAA,EAAU,QAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM,KAAK,WAAA;AAAY,OACzB;AAAA,IACF;AACA,IAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAA,0BAAA,EAA6B,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,QACrD,QAAA,EAAU,QAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM,CAAA,+BAAA,EAAkC,IAAA,CAAK,UAAU,CAAA,QAAA;AAAA,OACzD;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,CAAA,6CAAA,EAAgD,IAAA,CAAK,WAAW,CAAA,YAAA;AAAA,KACxE;AAAA,EACF;AACF;AAOA,SAAS,YAAY,IAAA,EAA4B;AAC/C,EAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA,EAAE;AAChE;AAGO,SAAS,YAAY,IAAA,EAAmB;AAC7C,EAAA,IAAI,OAAO,IAAA,EAAM,IAAA,KAAS,QAAA,SAAiB,IAAA,CAAK,IAAA;AAChD,EAAA,IAAI,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,SAAiB,IAAA,CAAK,KAAA;AACjD,EAAA,IAAI,OAAO,IAAA,EAAM,OAAA,KAAY,QAAA,SAAiB,IAAA,CAAK,OAAA;AACnD,EAAA,IAAI,OAAO,IAAA,EAAM,QAAA,KAAa,QAAA,SAAiB,IAAA,CAAK,QAAA;AACpD,EAAA,MAAM,MAAM,IAAA,EAAM,OAAA;AAClB,EAAA,IAAI,OAAO,GAAA,EAAK,OAAA,KAAY,QAAA,SAAiB,GAAA,CAAI,OAAA;AACjD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAI,OAAA,CACR,MAAA;AAAA,MACC,CAAC,CAAA,KAAA,CAAY,CAAA,EAAG,IAAA,KAAS,MAAA,IAAU,GAAG,IAAA,KAAS,MAAA,KAAc,OAAO,CAAA,EAAG,IAAA,KAAS;AAAA,KAClF,CACC,IAAI,CAAC,CAAA,KAAW,EAAE,IAAI,CAAA,CACtB,KAAK,EAAE,CAAA;AAAA,EACZ;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAA,EAAG;AAC9B,IAAA,OAAO,KAAK,KAAA,CACT,MAAA,CAAO,CAAC,CAAA,KAAW,OAAO,CAAA,EAAG,IAAA,KAAS,QAAQ,CAAA,CAC9C,IAAI,CAAC,CAAA,KAAW,EAAE,IAAI,CAAA,CACtB,KAAK,EAAE,CAAA;AAAA,EACZ;AAEA,EAAA,IAAI,OAAO,IAAA,EAAM,IAAA,EAAM,SAAS,QAAA,EAAU,OAAO,KAAK,IAAA,CAAK,IAAA;AAC3D,EAAA,OAAO,EAAA;AACT;AAGO,SAAS,cAAc,IAAA,EAA8B;AAC1D,EAAA,MAAM,CAAA,GAAI,MAAM,KAAA,IAAS,IAAA,EAAM,OAAO,KAAA,IAAS,IAAA,EAAM,KAAA,IAAS,IAAA,EAAM,MAAA,IAAU,IAAA;AAC9E,EAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,UAAU,OAAO,IAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,EAAE,YAAA,IAAgB,CAAA,CAAE,eAAe,CAAA,CAAE,aAAA,IAAiB,CAAA,CAAE,gBAAA,IAAoB,CAAA,CAAE,KAAA;AAC5F,EAAA,MAAM,MAAA,GACJ,EAAE,aAAA,IAAiB,CAAA,CAAE,gBAAgB,CAAA,CAAE,iBAAA,IAAqB,CAAA,CAAE,oBAAA,IAAwB,CAAA,CAAE,MAAA;AAC1F,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,mBAAA,IAAuB,CAAA,CAAE,mBAAmB,CAAA,CAAE,uBAAA;AAClE,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW,OAAO,IAAA;AACxD,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,MAAA,CAAO,WAAA,GAAc,KAAA;AACpD,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,MAAA,CAAO,YAAA,GAAe,MAAA;AACtD,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,MAAA,CAAO,eAAA,GAAkB,SAAA;AAC5D,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,YAAY,IAAA,EAA+B;AACzD,EAAA,MAAM,CAAA,GACJ,IAAA,EAAM,IAAA,IAAQ,IAAA,EAAM,OAAA,IAAW,IAAA,EAAM,cAAA,IAAkB,IAAA,EAAM,KAAA,EAAO,IAAA,IAAQ,IAAA,EAAM,KAAA,EAAO,IAAA;AAC3F,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AACrC","file":"chunk-J7WFDLV6.js","sourcesContent":["import { type ChildProcess, spawn } from \"node:child_process\";\nimport type { EventEmitter } from \"node:events\";\nimport { createInterface, type Interface } from \"node:readline\";\nimport type { Logger, TokenUsage } from \"@skaile/workspaces/types\";\nimport { classifyGenericErrorMessage } from \"../error-classifier.js\";\nimport {\n  type AgentConfig,\n  AgentDriver,\n  type AgentError,\n  type AgentEvent,\n  type AgentMessage,\n} from \"../types.js\";\n\n/**\n * Shared base for one-shot **subprocess CLI** agent backends (Gemini, Qwen,\n * OpenCode, Goose, Continue).\n *\n * These backends are neither persistent JSON-RPC subprocesses (`omp`) nor\n * in-process SDKs (`claude-sdk`, `codex`). In headless mode each is invoked\n * **once per turn** — `prompt()` spawns the CLI fresh, a `readline` loop maps\n * newline-delimited JSON on stdout to the unified {@link AgentEvent} stream, and\n * **process exit marks the end of the turn**. Multi-turn continuity comes from\n * capturing a backend session id (emitted as `session_info`) and replaying it\n * via a resume flag on the next spawn.\n *\n * Subclasses implement {@link buildArgs}, {@link buildEnv}, and either\n * {@link handleJson} (streaming JSONL, the default) or {@link handleBuffered}\n * (`mode = \"buffered\"`, for CLIs that print a single JSON blob at the end).\n *\n * **Terminal-sequence invariant.** Subclasses MUST NOT emit `agent_end`. The\n * base emits exactly one `result` (synthesizing a success result when the\n * stream produced none) followed by a single `agent_end` on clean exit, or an\n * `error` + `agent_end` on crash. This keeps the turn-completion contract\n * (`prompt()` resolves after `agent_end`) identical across every CLI driver.\n *\n * @docLink packages/bridge/drivers#subprocess-cli\n */\nexport abstract class SubprocessCliDriver extends AgentDriver {\n  /** Per-driver logger, constructed once by the subclass. */\n  protected abstract readonly log: Logger;\n  /** Default binary name spawned in production (e.g. `\"gemini\"`). */\n  protected abstract readonly defaultBin: string;\n  /** Human product name used in error messages / hints (e.g. `\"Gemini CLI\"`). */\n  protected abstract readonly productName: string;\n  /**\n   * Test-seam env prefix. `<PREFIX>_BRIDGE_BIN` overrides the spawn binary and\n   * `<PREFIX>_BRIDGE_PREARGS` (space-delimited) supplies leading argv — used by\n   * the fake-CLI harness to redirect spawn without monkey-patching\n   * `child_process`. Both are ignored in production.\n   */\n  protected abstract readonly envPrefix: string;\n  /** `\"jsonl\"` streams events line-by-line; `\"buffered\"` parses all stdout once on exit. */\n  protected readonly mode: \"jsonl\" | \"buffered\" = \"jsonl\";\n\n  protected config: AgentConfig;\n\n  private proc: ChildProcess | null = null;\n  private rl: Interface | null = null;\n  private stderrBuffer: string[] = [];\n  private stdoutBuffer = \"\";\n  private started = false;\n\n  // ── Per-turn state ──────────────────────────────────────────────────────\n  private prevText = \"\";\n  private activeAssistant = false;\n  private pendingToolResults: AgentMessage[] = [];\n  private sawResult = false;\n  private aborting = false;\n  private turnResolve: (() => void) | null = null;\n  private turnReject: ((err: Error) => void) | null = null;\n\n  protected _sessionId?: string;\n  protected _lastTokens: TokenUsage | null = null;\n\n  constructor(config: AgentConfig) {\n    super();\n    this.config = config;\n  }\n\n  override get runtimeSessionId(): string | undefined {\n    return this._sessionId;\n  }\n\n  override getModel(): string | undefined {\n    return this.config.model;\n  }\n\n  override getTokenUsage(): TokenUsage | null {\n    return this._lastTokens;\n  }\n\n  override reconfigure(patch: Partial<Pick<AgentConfig, \"model\" | \"thinking\" | \"effort\">>): void {\n    if (patch.model !== undefined) this.config.model = patch.model;\n    if (patch.thinking !== undefined) this.config.thinking = patch.thinking;\n    if (patch.effort !== undefined) this.config.effort = patch.effort;\n  }\n\n  /**\n   * No-op for one-shot CLIs — there is no long-lived process to spawn until the\n   * first prompt. Kept so the runner's `start()` → `prompt()` ordering works\n   * uniformly; binary-presence failures surface as a `config` error on the\n   * first spawn (see {@link classifyProcessError}).\n   */\n  async start(): Promise<void> {\n    this.started = true;\n  }\n\n  get isRunning(): boolean {\n    return this.proc !== null && !this.proc.killed;\n  }\n\n  /**\n   * Sends a user message to the CLI and resolves after the turn completes\n   * (`agent_end`). Spawns a fresh child per call; rejects if the child exits\n   * non-zero before emitting a result, so the caller never hangs.\n   */\n  async prompt(message: string): Promise<void> {\n    if (this.proc) throw new Error(`${this.productName} turn already in progress`);\n    if (!this.started) await this.start();\n\n    this.prevText = \"\";\n    this.activeAssistant = false;\n    this.pendingToolResults = [];\n    this.sawResult = false;\n    this.aborting = false;\n    this.stderrBuffer = [];\n    this.stdoutBuffer = \"\";\n    this._lastTokens = null;\n\n    const composed = this.composePrompt(message);\n    const overrideBin = process.env[`${this.envPrefix}_BRIDGE_BIN`];\n    const preArgs = process.env[`${this.envPrefix}_BRIDGE_PREARGS`]\n      ? (process.env[`${this.envPrefix}_BRIDGE_PREARGS`] as string).split(/\\s+/).filter(Boolean)\n      : [];\n    const bin = overrideBin || this.defaultBin;\n    const args = [...preArgs, ...this.buildArgs(composed, this._sessionId)];\n    const env = this.buildEnv();\n\n    return new Promise<void>((resolve, reject) => {\n      this.turnResolve = resolve;\n      this.turnReject = reject;\n      this.log.info(\"spawning CLI\", {\n        bin,\n        cwd: this.config.cwd,\n        resume: Boolean(this._sessionId),\n      });\n\n      const proc = spawn(bin, args, {\n        cwd: this.config.cwd,\n        env,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      }) as ChildProcess;\n      this.proc = proc;\n      const procEmitter = proc as unknown as EventEmitter;\n\n      procEmitter.on(\"error\", (err: Error) => {\n        const detail = this.classifyProcessError(err as NodeJS.ErrnoException);\n        this.log.error(\"spawn error\", err, { detail });\n        this.pushError(detail);\n        this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n        this.settleReject(Object.assign(new Error(detail.message), { detail }));\n      });\n\n      if (proc.stdout) {\n        if (this.mode === \"jsonl\") {\n          const rl = createInterface({ input: proc.stdout });\n          this.rl = rl;\n          (rl as unknown as EventEmitter).on(\"line\", (line: string) => this.onStdoutLine(line));\n        } else {\n          proc.stdout.setEncoding(\"utf8\");\n          proc.stdout.on(\"data\", (chunk: string) => {\n            this.stdoutBuffer += chunk;\n          });\n        }\n      }\n\n      if (proc.stderr) {\n        const stderrRl = createInterface({ input: proc.stderr });\n        (stderrRl as unknown as EventEmitter).on(\"line\", (line: string) => {\n          this.log.debug(\"stderr\", { line });\n          this.stderrBuffer.push(line);\n          if (this.stderrBuffer.length > 20) this.stderrBuffer.shift();\n        });\n      }\n\n      procEmitter.on(\"exit\", (code: number | null, signal: NodeJS.Signals | null) => {\n        this.log.info(\"CLI exited\", { code, signal });\n        this.onExit(code, signal);\n      });\n    });\n  }\n\n  /** Out-of-band abort: terminates the current child. Driver stays usable for the next prompt. */\n  async abort(): Promise<void> {\n    this.aborting = true;\n    this.proc?.kill(\"SIGTERM\");\n  }\n\n  kill(): void {\n    this.aborting = true;\n    this.proc?.kill(\"SIGTERM\");\n    this.cleanup();\n  }\n\n  async resetSession(): Promise<void> {\n    this.kill();\n    this._sessionId = undefined;\n    this._lastTokens = null;\n  }\n\n  // ── Subclass hooks ────────────────────────────────────────────────────────\n\n  /** Build the CLI argv (binary excluded) for one turn. `resumeId` is the captured session id, if any. */\n  protected abstract buildArgs(message: string, resumeId: string | undefined): string[];\n\n  /** Build the child-process env (explicit allowlist — see {@link baseEnv}). */\n  protected abstract buildEnv(): Record<string, string>;\n\n  /** Map one parsed stdout JSON object to events via the `push*` helpers. Streaming (`jsonl`) mode only. */\n  protected handleJson(_json: unknown): void {}\n\n  /** Parse the full stdout blob once on clean exit. `buffered` mode only. */\n  protected handleBuffered(_raw: string): void {}\n\n  /** Install-failure hint surfaced when the binary is missing. */\n  protected abstract installHint(): string;\n\n  /**\n   * Classify a non-zero exit into an {@link AgentError}, or `null` to treat the\n   * exit as success (e.g. a turn-limit code where a result was already\n   * emitted). Default: code `0` / clean signal → success; otherwise `process`.\n   */\n  protected classifyExit(code: number | null, signal: NodeJS.Signals | null): AgentError | null {\n    if (code === 0 || (code === null && signal === null)) return null;\n    const tail = this.stderrBuffer.slice(-10).join(\"\\n\");\n    return {\n      message: `${this.productName} exited with code ${code ?? \"null\"}${tail ? `: ${tail}` : \"\"}`,\n      category: \"process\",\n      retryable: true,\n      hint: tail || `The ${this.productName} process exited unexpectedly. Try the prompt again.`,\n    };\n  }\n\n  // ── Protected emit helpers (used by handleJson / handleBuffered) ────────────\n\n  /** Prepend `systemPrompt` to the user message — uniform across CLIs lacking a reliable system flag. */\n  protected composePrompt(message: string): string {\n    return this.config.systemPrompt ? `${this.config.systemPrompt}\\n\\n---\\n\\n${message}` : message;\n  }\n\n  protected pushAssistantDelta(fullText: string): void {\n    if (!this.activeAssistant) {\n      this.activeAssistant = true;\n      this.prevText = \"\";\n      this.emit(\"agent-event\", {\n        type: \"message_start\",\n        message: asstMessage(\"\"),\n      } satisfies AgentEvent);\n    }\n    const delta = fullText.startsWith(this.prevText)\n      ? fullText.slice(this.prevText.length)\n      : fullText;\n    this.prevText = fullText;\n    if (delta) {\n      this.emit(\"agent-event\", {\n        type: \"message_update\",\n        message: asstMessage(fullText),\n        _textDelta: delta,\n      } satisfies AgentEvent);\n    }\n  }\n\n  protected pushAssistantEnd(fullText?: string): void {\n    if (!this.activeAssistant) return;\n    const text = fullText ?? this.prevText;\n    this.emit(\"agent-event\", {\n      type: \"message_end\",\n      message: asstMessage(text),\n    } satisfies AgentEvent);\n    this.activeAssistant = false;\n    this.prevText = \"\";\n  }\n\n  protected pushToolCall(name: string, input: unknown): void {\n    this.emit(\"agent-event\", {\n      type: \"tool_call\",\n      name,\n      tool: { name },\n      input,\n    } satisfies AgentEvent);\n  }\n\n  protected pushToolResult(name: string, data: unknown, isError = false): void {\n    this.pendingToolResults.push({ role: \"tool\", toolName: name, content: \"\", data, isError });\n    this.emit(\"agent-event\", {\n      type: \"tool_execution_end\",\n      toolName: name,\n    } satisfies AgentEvent);\n  }\n\n  private flushToolResults(): void {\n    if (this.pendingToolResults.length === 0) return;\n    this.emit(\"agent-event\", {\n      type: \"turn_end\",\n      toolResults: [...this.pendingToolResults],\n    } satisfies AgentEvent);\n    this.pendingToolResults = [];\n  }\n\n  protected pushResult(opts: {\n    tokens?: TokenUsage | null;\n    costUsd?: number;\n    summary?: string;\n    subtype?: string;\n  }): void {\n    this.pushAssistantEnd();\n    this.flushToolResults();\n    if (opts.tokens) this._lastTokens = opts.tokens;\n    this.sawResult = true;\n    this.emit(\"agent-event\", {\n      type: \"result\",\n      subtype: opts.subtype ?? \"success\",\n      summary: opts.summary,\n      costUsd: opts.costUsd ?? 0,\n      ...(opts.tokens ? { tokens: opts.tokens } : {}),\n    } satisfies AgentEvent);\n  }\n\n  protected pushError(detail: AgentError, fatal = false): void {\n    this.emit(\"agent-event\", {\n      type: \"error\",\n      error: detail.message,\n      detail,\n      fatal,\n    } satisfies AgentEvent);\n  }\n\n  protected captureSession(id?: string, file?: string): void {\n    if (!id || id === this._sessionId) return;\n    this._sessionId = id;\n    this.emit(\"agent-event\", {\n      type: \"session_info\",\n      driverSessionId: id,\n      ...(file ? { sessionFile: file } : {}),\n    } satisfies AgentEvent);\n  }\n\n  /** Shared keyword classification + per-driver hint copy (mirrors omp/codex). */\n  protected classifyMessage(message: string): AgentError {\n    const generic = classifyGenericErrorMessage(message);\n    if (!generic) {\n      return {\n        message,\n        category: \"unknown\",\n        retryable: true,\n        hint: `An unexpected ${this.productName} error occurred. Try the prompt again.`,\n      };\n    }\n    const hint =\n      generic.category === \"auth\"\n        ? `Check the API key / login configured for ${this.productName}.`\n        : generic.category === \"rate_limit\"\n          ? `${this.productName} hit a provider rate limit. Wait a moment and try again.`\n          : generic.category === \"model\"\n            ? \"The selected model is unavailable or the context is too long. Change the model or start a new session.\"\n            : `A network error occurred while talking to ${this.productName}.`;\n    return { message, category: generic.category, retryable: generic.retryable, hint };\n  }\n\n  // ── Env allowlist ──────────────────────────────────────────────────────────\n\n  /**\n   * Explicit env whitelist forwarded to the child. Omits anything provisioned\n   * by `provision_secrets` so user credentials stay out of the subprocess\n   * environment. Always passes through the driver's test-seam vars and\n   * `FAKE_CLI_*`.\n   *\n   * `config.env` is merged **over** the whitelist, not in place of it. It used\n   * to replace it wholesale, which meant any caller that set a single variable\n   * silently dropped `PATH` and `HOME` and the spawn failed with ENOENT —\n   * unusable as the delivery channel for registry-derived endpoint variables\n   * (plan §2.3, \"Delivery rule\"). Widening keeps both: the caller's variables\n   * win per key, the process still has a `PATH`.\n   */\n  protected baseEnv(extraKeys: string[] = []): Record<string, string> {\n    const out: Record<string, string> = {};\n    const explicit = [\"PATH\", \"HOME\", \"USER\", \"HOSTNAME\", \"SKAILE_SESSION_ID\", ...extraKeys];\n    for (const key of explicit) {\n      const v = process.env[key];\n      if (v !== undefined) out[key] = v;\n    }\n    for (const [key, value] of Object.entries(process.env)) {\n      if (typeof value !== \"string\") continue;\n      if (key.startsWith(`${this.envPrefix}_BRIDGE_`) || key.startsWith(\"FAKE_CLI_\")) {\n        out[key] = value;\n      }\n    }\n    if (this.config.sshKeyPath) {\n      out.GIT_SSH_COMMAND = `ssh -i \"${this.config.sshKeyPath}\" -o StrictHostKeyChecking=accept-new`;\n    }\n    if (this.config.env) Object.assign(out, this.config.env);\n    return out;\n  }\n\n  // ── Internals ────────────────────────────────────────────────────────────\n\n  private onStdoutLine(line: string): void {\n    if (!line.trim()) return;\n    let json: unknown;\n    try {\n      json = JSON.parse(line);\n    } catch {\n      this.log.debug(\"non-JSON stdout line\", { line });\n      return;\n    }\n    try {\n      this.handleJson(json);\n    } catch (err) {\n      this.log.warn(\"handleJson threw\", { error: String(err) });\n    }\n  }\n\n  private onExit(code: number | null, signal: NodeJS.Signals | null): void {\n    this.cleanup();\n\n    if (this.aborting) {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n      this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n      this.settleResolve();\n      return;\n    }\n\n    if (this.mode === \"buffered\" && (code === 0 || code === null)) {\n      try {\n        this.handleBuffered(this.stdoutBuffer);\n      } catch (err) {\n        this.log.warn(\"handleBuffered threw\", { error: String(err) });\n      }\n    }\n\n    const exitErr = this.classifyExit(code, signal);\n    if (exitErr && !this.sawResult) {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n      this.pushError(exitErr);\n      this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n      this.settleReject(Object.assign(new Error(exitErr.message), { detail: exitErr }));\n      return;\n    }\n\n    // Clean exit (or non-zero exit after a result already streamed): close any\n    // open assistant message, synthesize a success result if none arrived, end.\n    if (!this.sawResult) this.pushResult({ summary: \"Task completed\" });\n    else {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n    }\n    this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n    this.settleResolve();\n  }\n\n  private settleResolve(): void {\n    const resolve = this.turnResolve;\n    this.turnResolve = null;\n    this.turnReject = null;\n    resolve?.();\n  }\n\n  private settleReject(err: Error): void {\n    const reject = this.turnReject;\n    this.turnResolve = null;\n    this.turnReject = null;\n    reject?.(err);\n  }\n\n  private cleanup(): void {\n    this.rl?.close();\n    this.rl = null;\n    this.proc = null;\n  }\n\n  private classifyProcessError(err: NodeJS.ErrnoException): AgentError {\n    if (err.code === \"ENOENT\") {\n      return {\n        message: `${this.defaultBin} command not found`,\n        category: \"config\",\n        retryable: false,\n        hint: this.installHint(),\n      };\n    }\n    if (err.code === \"EACCES\") {\n      return {\n        message: `Permission denied running ${this.defaultBin}`,\n        category: \"config\",\n        retryable: false,\n        hint: `Check file permissions for the ${this.defaultBin} binary.`,\n      };\n    }\n    return {\n      message: err.message,\n      category: \"process\",\n      retryable: true,\n      hint: `An unexpected process error occurred running ${this.productName}. Try again.`,\n    };\n  }\n}\n\n// ───────────────────────────────────────────────────────────────────────────\n// Tolerant JSON extractors — shared because the upstream stream-json schemas\n// are not fully pinned; read the common field-name variants defensively.\n// ───────────────────────────────────────────────────────────────────────────\n\nfunction asstMessage(text: string): AgentMessage {\n  return { role: \"assistant\", content: [{ type: \"text\", text }] };\n}\n\n/** Pull assistant text out of a CLI event, trying the common field names. */\nexport function extractText(json: any): string {\n  if (typeof json?.text === \"string\") return json.text;\n  if (typeof json?.delta === \"string\") return json.delta;\n  if (typeof json?.content === \"string\") return json.content;\n  if (typeof json?.response === \"string\") return json.response;\n  const msg = json?.message;\n  if (typeof msg?.content === \"string\") return msg.content;\n  if (Array.isArray(msg?.content)) {\n    return msg.content\n      .filter(\n        (b: any) => (b?.type === \"text\" || b?.type === undefined) && typeof b?.text === \"string\",\n      )\n      .map((b: any) => b.text)\n      .join(\"\");\n  }\n  if (Array.isArray(json?.parts)) {\n    return json.parts\n      .filter((p: any) => typeof p?.text === \"string\")\n      .map((p: any) => p.text)\n      .join(\"\");\n  }\n  // OpenCode (`run --format json`) nests the payload under `part`.\n  if (typeof json?.part?.text === \"string\") return json.part.text;\n  return \"\";\n}\n\n/** Map a CLI usage/stats object onto {@link TokenUsage}, trying common field names. */\nexport function extractTokens(json: any): TokenUsage | null {\n  const u = json?.usage ?? json?.stats?.usage ?? json?.stats ?? json?.tokens ?? json;\n  if (!u || typeof u !== \"object\") return null;\n  const input = u.input_tokens ?? u.inputTokens ?? u.prompt_tokens ?? u.promptTokenCount ?? u.input;\n  const output =\n    u.output_tokens ?? u.outputTokens ?? u.completion_tokens ?? u.candidatesTokenCount ?? u.output;\n  const cacheRead = u.cached_input_tokens ?? u.cacheReadTokens ?? u.cachedContentTokenCount;\n  if (input === undefined && output === undefined) return null;\n  const tokens: TokenUsage = {};\n  if (typeof input === \"number\") tokens.inputTokens = input;\n  if (typeof output === \"number\") tokens.outputTokens = output;\n  if (typeof cacheRead === \"number\") tokens.cacheReadTokens = cacheRead;\n  return tokens;\n}\n\n/** Pull a per-turn USD cost from a CLI result object, or `undefined`. */\nexport function extractCost(json: any): number | undefined {\n  const c =\n    json?.cost ?? json?.costUsd ?? json?.total_cost_usd ?? json?.stats?.cost ?? json?.usage?.cost;\n  return typeof c === \"number\" ? c : undefined;\n}\n"]}

package/dist/{chunk-IOFPX6OO.js → chunk-JZ52Y3ZR.js}

@@ -1,27 +1,27 @@
-import { WorkspacePlugin } from './chunk-2E3EGCQ3.js';
-import { buildWorkspaceToolDefs } from './chunk-ZXPIKQAN.js';
+import { WorkspacePlugin } from './chunk-MHAH5HDX.js';
+import { buildWorkspaceToolDefs } from './chunk-PQE2MYB6.js';
 import { findAiAssetsRoot } from './chunk-7IH3RKKK.js';
 import { WebSocketServerTransport } from './chunk-73ZXUUL6.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-PE3A6FFW.js';
-import { resolveFlowPath } from './chunk-RDOEZBVB.js';
+import { resolveFlowPath } from './chunk-CPJRS7ZC.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-Q6NDQ6BH.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-E4Q5GKO2.js';
-import { loadConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-MK3OCWBG.js';
-import { EventNormalizer } from './chunk-W64ZXABT.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-MDRV5EWH.js';
+import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-MC2MF4U5.js';
+import { EventNormalizer } from './chunk-TEQDWOBS.js';
 import { probeResumeTranscript } from './chunk-4SIMGJIU.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
 import { dispatchCapability } from './chunk-TOXPRXAK.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-LQMALDDB.js';
-import { loadFlow } from './chunk-A2T4WIZL.js';
+import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-CJGNYHPG.js';
+import { loadFlow } from './chunk-KTCMBEEB.js';
 import { parseFlowDefinition } from './chunk-ALLCAFHQ.js';
 import { renderStimulusPrompt } from './chunk-RQLL7L72.js';
 import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-QQ3G5N7X.js';
-import { resolveSettings, loadProviderRegistry } from './chunk-7NRF7BQB.js';
-import { resolveRuntimeAssets } from './chunk-NXTLDFLA.js';
+import { resolveSettings, loadProviderRegistry } from './chunk-UWU572Q6.js';
+import { resolveRuntimeAssets } from './chunk-5RHPNNWP.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-QWGSKDD7.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-DF7C3KZK.js';
 import { withFsDeadline, FsDeadlineError, fsDeadlineMs, tryWithFsDeadline } from './chunk-2FBPAR2V.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention } from './chunk-JMKB7IB4.js';
@@ -2249,11 +2249,16 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
     }
     if (!sessionMeta?.managedCodex)
       await maybeInstallNpmPeerDeps(runtimeAssets, projectDir, resLog);
-    const diskDeclarations = loadConnectorDeclarations(projectDir);
-    const connectorDeclarations = diskDeclarations.length > 0 ? diskDeclarations : fallbackConnectorDeclarations ?? [];
-    if (diskDeclarations.length === 0 && connectorDeclarations.length > 0) {
-      resLog.info("no disk connector declarations \u2014 using session_init resolvedConfig fallback", {
-        count: connectorDeclarations.length
+    const yamlDeclarations = loadYamlConnectorDeclarations(projectDir);
+    const wireDeclarations = fallbackConnectorDeclarations ?? [];
+    const usesWire = yamlDeclarations.length === 0 && wireDeclarations.length > 0;
+    const connectorDeclarations = withMaterializedConnectorDeclarations(
+      usesWire ? wireDeclarations : yamlDeclarations,
+      projectDir
+    );
+    if (usesWire) {
+      resLog.info("no skaile.yaml connector declarations \u2014 using session_init resolvedConfig", {
+        count: wireDeclarations.length
       });
     }
     let resourceManager = null;
@@ -7591,6 +7596,7 @@ async function startAgentServer(opts) {
   let managedInitFingerprint;
   let managedInitComplete = false;
   let appliedWireAgentConfigKey;
+  let wireConnectorDeclarationsApplied = false;
   const stagedSkillDirs = /* @__PURE__ */ new Map();
   const withSkillFsLock = createSerialLock();
   const stageDeclaredSkills = createCoalescedTask(
@@ -8296,6 +8302,16 @@ async function startAgentServer(opts) {
     }
     return initialAiCredentialExpiresAt;
   }
+  function yamlDeclaresNoConnectors() {
+    try {
+      return loadYamlConnectorDeclarations(opts.projectDir).length === 0;
+    } catch (err) {
+      log(
+        `[serve] session_init: skaile.yaml connectors unreadable, wire connector set not applied: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return false;
+    }
+  }
   async function buildSessionFromInit(secrets, fallbackConnectorDeclarations) {
     const wireRegistry = managedCodex ? void 0 : wireAgentConfig?.registry;
     const credentialEnv = wireRegistry ? registryCredentialEnv(wireRegistry, {
@@ -8325,10 +8341,11 @@ async function startAgentServer(opts) {
       emitResourcesAvailable();
       agentSession.startWatching();
       appliedWireAgentConfigKey = wireAgentConfig ? JSON.stringify(wireAgentConfig) : void 0;
+      wireConnectorDeclarationsApplied = (fallbackConnectorDeclarations?.length ?? 0) > 0;
       log("[serve] session built from session_init envelope");
-    } else if ((fallbackConnectorDeclarations?.length ?? 0) > 0 && !agentSession.resourceManager) {
+    } else if ((fallbackConnectorDeclarations?.length ?? 0) > 0 && !wireConnectorDeclarationsApplied && yamlDeclaresNoConnectors()) {
       log(
-        `[serve] session_init: recreating eagerly-built session to apply ${fallbackConnectorDeclarations.length} wire connector declaration(s) (no disk declarations)`
+        `[serve] session_init: recreating eagerly-built session to apply ${fallbackConnectorDeclarations.length} wire connector declaration(s) (no skaile.yaml declarations)`
       );
       needsWireFallbackRecreate = true;
     }
@@ -8833,6 +8850,7 @@ async function startAgentServer(opts) {
         log("[serve] session_init: consolidated session recreate");
         const recreateStartedAt = Date.now();
         await recreateSessionForInit(pendingResumeSessionId);
+        if (needsWireFallbackRecreate) wireConnectorDeclarationsApplied = true;
         logPhase("session_recreate", recreateStartedAt, {
           resuming: !!pendingResumeSessionId
         });
@@ -9544,5 +9562,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, computeDirectoryTotals, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-IOFPX6OO.js.map
-//# sourceMappingURL=chunk-IOFPX6OO.js.map
+//# sourceMappingURL=chunk-JZ52Y3ZR.js.map
+//# sourceMappingURL=chunk-JZ52Y3ZR.js.map