@skaile/workspaces 4.30.1 → 4.31.0

package/dist/{chunk-TJRNJVGU.js → chunk-EINLFFP6.js}

@@ -1,4 +1,4 @@
-import { registryEntries, isEntryEnabled, parseModelRef } from './chunk-GZZPKAV5.js';
+import { registryEntries, isEntryEnabled, parseModelRef } from './chunk-MJHSLODD.js';
 
 // bridge/src/reconfigure-model-ref.ts
 function selectable(registry) {
@@ -55,5 +55,5 @@ function refuse(providerId, modelId) {
 }
 
 export { scopeReconfigureModel };
-//# sourceMappingURL=chunk-TJRNJVGU.js.map
-//# sourceMappingURL=chunk-TJRNJVGU.js.map
+//# sourceMappingURL=chunk-EINLFFP6.js.map
+//# sourceMappingURL=chunk-EINLFFP6.js.map

package/dist/{chunk-TJRNJVGU.js.map → chunk-EINLFFP6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/reconfigure-model-ref.ts"],"names":[],"mappings":";;;AAoCA,SAAS,WACP,QAAA,EACqC;AACrC,EAAA,OAAO,eAAA,CAAgB,QAAQ,CAAA,CAAE,MAAA;AAAA,IAC/B,CAAC,IAAA,KAAA,CACE,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,KAAA,IAAS,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,OAAA,KAAY,cAAA,CAAe,IAAA,CAAK,CAAC,CAAC;AAAA,GAClF;AACF;AAQA,SAAS,WAAA,CAAY,OAA2B,OAAA,EAA0B;AACxE,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,SAAA,IAAa,EAAC;AAChC,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,YAAA,IAAgB,EAAC;AACpC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC5E,EAAA,OAAO,OAAA,IAAW,OAAO,OAAA,IAAW,IAAA,IAAQ,OAAO,MAAA,CAAO,GAAG,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA;AACjF;AAGA,SAAS,iBAAA,CACP,QAAA,EACA,QAAA,EACA,OAAA,EACA,KAAA,EACoB;AACpB,EAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,EAAK;AAC7B,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,OAAA,CAAQ,CAAC,IAAI,CAAC,CAAA;AAEjC,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAC,CAAC,EAAE,CAAA,KAAM,EAAA,KAAO,KAAK,CAAA,EAAG,OAAO,KAAA;AACjD,EAAA,OAAO,aAAA,CAAc,KAAA,EAAO,QAAA,EAAU,KAAK,CAAA,EAAG,UAAA;AAChD;AAgBO,SAAS,sBAAsB,KAAA,EAA0D;AAC9F,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,OAAM,GAAI,KAAA;AAC7C,EAAA,MAAM,MAAA,GAAgC;AAAA,IACpC,EAAA,EAAI,IAAA;AAAA,IACJ,QAAA,EAAU,QAAA,KAAa,MAAA,GAAY,MAAA,GAAY;AAAA,GACjD;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,WAAW,QAAQ,CAAA;AACnC,EAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,CAAA,EAAG,OAAO,MAAA;AAEhC,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,EAAK;AAC5B,EAAA,IAAI,QAAA,CAAS,WAAW,GAAG,CAAA,SAAU,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,QAAA,EAAS;AAEpE,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAClC,EAAA,IAAI,QAAQ,CAAA,EAAG;AACb,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AACpC,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AACrC,IAAA,MAAM,KAAA,GAAQ,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,IAAI,CAAA;AAChD,IAAA,IAAI,KAAA,IAAS,SAAS,EAAA,EAAI;AACxB,MAAA,IAAI,WAAA,CAAY,KAAA,CAAM,CAAC,CAAA,EAAG,IAAI,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,QAAA,EAAS;AACvE,MAAA,OAAO,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,IAC1B;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,QAAA,EAAU,QAAA,EAAU,SAAS,KAAK,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,UAAU,CAAA;AACxD,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,CAAC,WAAA,CAAY,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAQ,CAAA,EAAG,OAAO,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAQ,CAAA;AAC1E,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,CAAA,EAAG,QAAQ,CAAC,CAAC,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAG;AAC3D;AAEA,SAAS,MAAA,CAAO,YAAoB,OAAA,EAAwC;AAC1E,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,IAAA,EAAM,uBAAA;AAAA,IACN,UAAA;AAAA,IACA,OAAA,EAAS,CAAA,mBAAA,EAAsB,UAAU,CAAA,uBAAA,EAA0B,OAAO,CAAA,mDAAA;AAAA,GAC5E;AACF","file":"chunk-TJRNJVGU.js","sourcesContent":["// The registry selector a live model change (`reconfigure({ model })`) leaves a\n// session on. Shared by the runner's `runner.reconfigure` handler and every\n// driver whose `reconfigure()` rewrites `modelRef`, so both pick the same entry.\nimport {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseModelRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\n\n/** What a model-only reconfigure does to the session's registry selector. */\nexport type ReconfigureModelScope =\n  | {\n      ok: true;\n      /** The selector to run from now on; `undefined` leaves `modelRef` unset. */\n      modelRef: string | undefined;\n    }\n  | {\n      ok: false;\n      code: \"model_not_on_provider\";\n      /** The entry the session runs on, or the one the patch named. */\n      providerId: string;\n      message: string;\n    };\n\nexport interface ReconfigureModelScopeInput {\n  /** The model the patch names: bare, `<providerId>/<modelId>` or `@role`. */\n  model: string;\n  /** The session's current selector (`AgentConfig.modelRef`). */\n  modelRef: string | undefined;\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined;\n  roles?: Record<string, string>;\n}\n\nfunction selectable(\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n): Array<[string, AIProviderLlmEntry]> {\n  return registryEntries(registry).filter(\n    (pair): pair is [string, AIProviderLlmEntry] =>\n      (pair[1].kind === \"llm\" || pair[1].kind === \"embed\") && isEntryEnabled(pair[1]),\n  );\n}\n\n/**\n * Whether an entry serves a model id. An entry that declares no model at all\n * (no `model_map`, no `capabilities`) passes any id through, as the wake does.\n * Otherwise the id must be a declared logical id or a `model_map` target: the\n * platform sends the provider-side id the wake translated to.\n */\nfunction entryServes(entry: AIProviderLlmEntry, modelId: string): boolean {\n  const map = entry.model_map ?? {};\n  const caps = entry.capabilities ?? {};\n  if (Object.keys(map).length === 0 && Object.keys(caps).length === 0) return true;\n  return modelId in map || modelId in caps || Object.values(map).includes(modelId);\n}\n\n/** The entry a selector runs on, resolved the way the drivers resolve it. */\nfunction currentProviderId(\n  modelRef: string | undefined,\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n  entries: Array<[string, AIProviderLlmEntry]>,\n  roles: Record<string, string> | undefined,\n): string | undefined {\n  const named = modelRef?.trim();\n  if (!named) return entries[0]?.[0];\n  // A selector that is exactly an entry id names the endpoint and no model.\n  if (entries.some(([id]) => id === named)) return named;\n  return parseModelRef(named, registry, roles)?.providerId;\n}\n\n/**\n * Decide the selector a live model change leaves the session on.\n *\n * A bare model id keeps the provider the session already runs on\n * (`<currentProvider>/<model>`): re-resolving it by id alone could move the\n * session to another entry that lists the same id, which changes billing and\n * data residency without a sign. Only a patch that names a provider\n * (`<providerId>/<model>` or `@role`) moves it. When the target entry declares\n * its models and this one is not among them, the patch is refused so the host\n * applies it at the next wake instead.\n *\n * A registry with at most one usable entry has nowhere to move to and keeps the\n * old behaviour: the selector becomes the patch's model when one was set.\n */\nexport function scopeReconfigureModel(input: ReconfigureModelScopeInput): ReconfigureModelScope {\n  const { model, modelRef, registry, roles } = input;\n  const legacy: ReconfigureModelScope = {\n    ok: true,\n    modelRef: modelRef === undefined ? undefined : model,\n  };\n  if (!registry) return legacy;\n  const entries = selectable(registry);\n  if (entries.length <= 1) return legacy;\n\n  const selector = model.trim();\n  if (selector.startsWith(\"@\")) return { ok: true, modelRef: selector };\n\n  const slash = selector.indexOf(\"/\");\n  if (slash > 0) {\n    const head = selector.slice(0, slash);\n    const tail = selector.slice(slash + 1);\n    const named = entries.find(([id]) => id === head);\n    if (named && tail !== \"\") {\n      if (entryServes(named[1], tail)) return { ok: true, modelRef: selector };\n      return refuse(head, tail);\n    }\n  }\n\n  const providerId = currentProviderId(modelRef, registry, entries, roles);\n  const current = entries.find(([id]) => id === providerId);\n  if (!current) return legacy;\n  if (!entryServes(current[1], selector)) return refuse(current[0], selector);\n  return { ok: true, modelRef: `${current[0]}/${selector}` };\n}\n\nfunction refuse(providerId: string, modelId: string): ReconfigureModelScope {\n  return {\n    ok: false,\n    code: \"model_not_on_provider\",\n    providerId,\n    message: `AI provider entry \"${providerId}\" does not list model \"${modelId}\"; the change applies when the session next starts.`,\n  };\n}\n"]}
+{"version":3,"sources":["../bridge/src/reconfigure-model-ref.ts"],"names":[],"mappings":";;;AAoCA,SAAS,WACP,QAAA,EACqC;AACrC,EAAA,OAAO,eAAA,CAAgB,QAAQ,CAAA,CAAE,MAAA;AAAA,IAC/B,CAAC,IAAA,KAAA,CACE,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,KAAA,IAAS,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,OAAA,KAAY,cAAA,CAAe,IAAA,CAAK,CAAC,CAAC;AAAA,GAClF;AACF;AAQA,SAAS,WAAA,CAAY,OAA2B,OAAA,EAA0B;AACxE,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,SAAA,IAAa,EAAC;AAChC,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,YAAA,IAAgB,EAAC;AACpC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC5E,EAAA,OAAO,OAAA,IAAW,OAAO,OAAA,IAAW,IAAA,IAAQ,OAAO,MAAA,CAAO,GAAG,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA;AACjF;AAGA,SAAS,iBAAA,CACP,QAAA,EACA,QAAA,EACA,OAAA,EACA,KAAA,EACoB;AACpB,EAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,EAAK;AAC7B,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,OAAA,CAAQ,CAAC,IAAI,CAAC,CAAA;AAEjC,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAC,CAAC,EAAE,CAAA,KAAM,EAAA,KAAO,KAAK,CAAA,EAAG,OAAO,KAAA;AACjD,EAAA,OAAO,aAAA,CAAc,KAAA,EAAO,QAAA,EAAU,KAAK,CAAA,EAAG,UAAA;AAChD;AAgBO,SAAS,sBAAsB,KAAA,EAA0D;AAC9F,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,OAAM,GAAI,KAAA;AAC7C,EAAA,MAAM,MAAA,GAAgC;AAAA,IACpC,EAAA,EAAI,IAAA;AAAA,IACJ,QAAA,EAAU,QAAA,KAAa,MAAA,GAAY,MAAA,GAAY;AAAA,GACjD;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,WAAW,QAAQ,CAAA;AACnC,EAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,CAAA,EAAG,OAAO,MAAA;AAEhC,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,EAAK;AAC5B,EAAA,IAAI,QAAA,CAAS,WAAW,GAAG,CAAA,SAAU,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,QAAA,EAAS;AAEpE,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAClC,EAAA,IAAI,QAAQ,CAAA,EAAG;AACb,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AACpC,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AACrC,IAAA,MAAM,KAAA,GAAQ,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,IAAI,CAAA;AAChD,IAAA,IAAI,KAAA,IAAS,SAAS,EAAA,EAAI;AACxB,MAAA,IAAI,WAAA,CAAY,KAAA,CAAM,CAAC,CAAA,EAAG,IAAI,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,QAAA,EAAS;AACvE,MAAA,OAAO,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,IAC1B;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,QAAA,EAAU,QAAA,EAAU,SAAS,KAAK,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,UAAU,CAAA;AACxD,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,CAAC,WAAA,CAAY,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAQ,CAAA,EAAG,OAAO,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAQ,CAAA;AAC1E,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,CAAA,EAAG,QAAQ,CAAC,CAAC,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAG;AAC3D;AAEA,SAAS,MAAA,CAAO,YAAoB,OAAA,EAAwC;AAC1E,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,IAAA,EAAM,uBAAA;AAAA,IACN,UAAA;AAAA,IACA,OAAA,EAAS,CAAA,mBAAA,EAAsB,UAAU,CAAA,uBAAA,EAA0B,OAAO,CAAA,mDAAA;AAAA,GAC5E;AACF","file":"chunk-EINLFFP6.js","sourcesContent":["// The registry selector a live model change (`reconfigure({ model })`) leaves a\n// session on. Shared by the runner's `runner.reconfigure` handler and every\n// driver whose `reconfigure()` rewrites `modelRef`, so both pick the same entry.\nimport {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseModelRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\n\n/** What a model-only reconfigure does to the session's registry selector. */\nexport type ReconfigureModelScope =\n  | {\n      ok: true;\n      /** The selector to run from now on; `undefined` leaves `modelRef` unset. */\n      modelRef: string | undefined;\n    }\n  | {\n      ok: false;\n      code: \"model_not_on_provider\";\n      /** The entry the session runs on, or the one the patch named. */\n      providerId: string;\n      message: string;\n    };\n\nexport interface ReconfigureModelScopeInput {\n  /** The model the patch names: bare, `<providerId>/<modelId>` or `@role`. */\n  model: string;\n  /** The session's current selector (`AgentConfig.modelRef`). */\n  modelRef: string | undefined;\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined;\n  roles?: Record<string, string>;\n}\n\nfunction selectable(\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n): Array<[string, AIProviderLlmEntry]> {\n  return registryEntries(registry).filter(\n    (pair): pair is [string, AIProviderLlmEntry] =>\n      (pair[1].kind === \"llm\" || pair[1].kind === \"embed\") && isEntryEnabled(pair[1]),\n  );\n}\n\n/**\n * Whether an entry serves a model id. An entry that declares no model at all\n * (no `model_map`, no `capabilities`) passes any id through, as the wake does.\n * Otherwise the id must be a declared logical id or a `model_map` target: the\n * platform sends the provider-side id the wake translated to.\n */\nfunction entryServes(entry: AIProviderLlmEntry, modelId: string): boolean {\n  const map = entry.model_map ?? {};\n  const caps = entry.capabilities ?? {};\n  if (Object.keys(map).length === 0 && Object.keys(caps).length === 0) return true;\n  return modelId in map || modelId in caps || Object.values(map).includes(modelId);\n}\n\n/** The entry a selector runs on, resolved the way the drivers resolve it. */\nfunction currentProviderId(\n  modelRef: string | undefined,\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n  entries: Array<[string, AIProviderLlmEntry]>,\n  roles: Record<string, string> | undefined,\n): string | undefined {\n  const named = modelRef?.trim();\n  if (!named) return entries[0]?.[0];\n  // A selector that is exactly an entry id names the endpoint and no model.\n  if (entries.some(([id]) => id === named)) return named;\n  return parseModelRef(named, registry, roles)?.providerId;\n}\n\n/**\n * Decide the selector a live model change leaves the session on.\n *\n * A bare model id keeps the provider the session already runs on\n * (`<currentProvider>/<model>`): re-resolving it by id alone could move the\n * session to another entry that lists the same id, which changes billing and\n * data residency without a sign. Only a patch that names a provider\n * (`<providerId>/<model>` or `@role`) moves it. When the target entry declares\n * its models and this one is not among them, the patch is refused so the host\n * applies it at the next wake instead.\n *\n * A registry with at most one usable entry has nowhere to move to and keeps the\n * old behaviour: the selector becomes the patch's model when one was set.\n */\nexport function scopeReconfigureModel(input: ReconfigureModelScopeInput): ReconfigureModelScope {\n  const { model, modelRef, registry, roles } = input;\n  const legacy: ReconfigureModelScope = {\n    ok: true,\n    modelRef: modelRef === undefined ? undefined : model,\n  };\n  if (!registry) return legacy;\n  const entries = selectable(registry);\n  if (entries.length <= 1) return legacy;\n\n  const selector = model.trim();\n  if (selector.startsWith(\"@\")) return { ok: true, modelRef: selector };\n\n  const slash = selector.indexOf(\"/\");\n  if (slash > 0) {\n    const head = selector.slice(0, slash);\n    const tail = selector.slice(slash + 1);\n    const named = entries.find(([id]) => id === head);\n    if (named && tail !== \"\") {\n      if (entryServes(named[1], tail)) return { ok: true, modelRef: selector };\n      return refuse(head, tail);\n    }\n  }\n\n  const providerId = currentProviderId(modelRef, registry, entries, roles);\n  const current = entries.find(([id]) => id === providerId);\n  if (!current) return legacy;\n  if (!entryServes(current[1], selector)) return refuse(current[0], selector);\n  return { ok: true, modelRef: `${current[0]}/${selector}` };\n}\n\nfunction refuse(providerId: string, modelId: string): ReconfigureModelScope {\n  return {\n    ok: false,\n    code: \"model_not_on_provider\",\n    providerId,\n    message: `AI provider entry \"${providerId}\" does not list model \"${modelId}\"; the change applies when the session next starts.`,\n  };\n}\n"]}

package/dist/{chunk-SM3UPDXE.js → chunk-GH3BHLBF.js}

@@ -1,7 +1,7 @@
-import { SubprocessCliDriver, extractText, extractCost, extractTokens } from './chunk-3AX5PZRA.js';
-import { resolveEnvDriverSession, bindSingleProviderEntry, resolveRegistryBinding } from './chunk-UKIL4XH5.js';
-import { getStaticModels, fetchProviderModels } from './chunk-3TK7CZVL.js';
-import { getProviderPreset, BUILTIN_DRIVER_CATALOG, getBridgeLogger, entryCredentialValue, registryDriverConfig } from './chunk-FAQRNZ44.js';
+import { SubprocessCliDriver, extractText, extractCost, extractTokens } from './chunk-7ZXENJLO.js';
+import { resolveEnvDriverSession, bindSingleProviderEntry, resolveRegistryBinding } from './chunk-AVXSY4WO.js';
+import { getStaticModels, fetchProviderModels } from './chunk-4UGEZIMA.js';
+import { getProviderPreset, BUILTIN_DRIVER_CATALOG, getBridgeLogger, entryCredentialValue, registryDriverConfig } from './chunk-WORPEN3X.js';
 import * as z from 'zod';
 
 var GOOGLE_DEFAULT_BASE_URL = getProviderPreset("google")?.base_url;
@@ -184,5 +184,5 @@ var geminiDriverTarget = {
 };
 
 export { GeminiDriver, GeminiFamilyDriver, geminiDriverTarget };
-//# sourceMappingURL=chunk-SM3UPDXE.js.map
-//# sourceMappingURL=chunk-SM3UPDXE.js.map
+//# sourceMappingURL=chunk-GH3BHLBF.js.map
+//# sourceMappingURL=chunk-GH3BHLBF.js.map

package/dist/{chunk-SM3UPDXE.js.map → chunk-GH3BHLBF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/drivers/gemini.ts"],"names":[],"mappings":";;;;;;AAuBA,IAAM,uBAAA,GAA0B,iBAAA,CAAkB,QAAQ,CAAA,EAAG,QAAA;AAWtD,IAAe,kBAAA,GAAf,cAA0C,mBAAA,CAAoB;AAAA,EACzD,WAAW,IAAA,EAAiB;AACpC,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,MAAA;AAAA,MACL,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,eAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAA,IAAc,KAAK,EAAE,CAAA;AAChE,QAAA;AAAA,MAEF,KAAK,SAAA;AAAA,MACL,KAAK,WAAA,EAAa;AAChB,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,SAAS,IAAA,IAAQ,WAAA;AAChD,QAAA,IAAI,SAAS,WAAA,EAAa;AAC1B,QAAA,MAAM,IAAA,GAAO,YAAY,IAAI,CAAA;AAC7B,QAAA,IAAI,IAAA,CAAK,SAAS,IAAA,IAAQ,IAAA,CAAK,UAAU,IAAA,IAAQ,IAAA,CAAK,aAAa,IAAA,EAAM;AACvE,UAAA,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,QAC5B,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,mBAAmB,IAAI,CAAA;AAAA,QAC9B;AACA,QAAA;AAAA,MACF;AAAA,MAEA,KAAK,UAAA;AAAA,MACL,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA,EAAQ,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,IAAA,IAAQ,EAAE,CAAA;AACjF,QAAA;AAAA,MAEF,KAAK,aAAA;AACH,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA;AAAA,UAC1B,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,OAAA;AAAA,UACnC,QAAQ,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,OAAA,IAAW,KAAK,KAAK;AAAA,SACrD;AACA,QAAA;AAAA,MAEF,KAAK,OAAA;AACH,QAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,WAAW,IAAA,CAAK,KAAA,IAAS,OAAO,CAAC,CAAC,CAAA;AAClF,QAAA;AAAA,MAEF,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAU,CAAA;AACrD,QAAA,IAAA,CAAK,UAAA,CAAW;AAAA,UACd,MAAA,EAAQ,cAAc,IAAI,CAAA;AAAA,UAC1B,OAAA,EAAS,YAAY,IAAI,CAAA;AAAA,UACzB,OAAA,EAAS,WAAA,CAAY,IAAI,CAAA,IAAK;AAAA,SAC/B,CAAA;AACD,QAAA;AAAA;AACJ,EACF;AAAA;AAAA,EAIQ,SAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA,GAAkB,KAAA;AAAA;AAAA,EAGhB,eAAA,GAAoC;AAC5C,IAAA,IAAA,CAAK,SAAA,KAAc,uBAAA,CAAwB,IAAA,CAAK,MAAM,CAAA;AACtD,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWU,eAAA,GAAoD;AAC5D,IAAA,IAAI,IAAA,CAAK,eAAA,EAAiB,OAAO,IAAA,CAAK,UAAA;AACtC,IAAA,MAAM,OAAA,GAAU,uBAAA;AAAA,MACd,KAAK,UAAA,CAAW,EAAA;AAAA,MAChB,IAAA,CAAK,WAAA;AAAA,MACL,KAAK,eAAA;AAAgB,KACvB;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,QAAA,IAAY,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,OAAO,CAAA;AACpE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA;AAClB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAe,KAAA,GAAuB;AACpC,IAAA,IAAA,CAAK,eAAA,EAAgB;AACrB,IAAA,MAAM,MAAM,KAAA,EAAM;AAAA,EACpB;AAAA,EAES,YAAY,KAAA,EAA0E;AAC7F,IAAA,KAAA,CAAM,YAAY,KAAK,CAAA;AACvB,IAAA,IAAI,KAAA,CAAM,UAAU,MAAA,EAAW;AAC7B,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,MAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AAAA,IACzB;AAAA,EACF;AAAA;AAAA,EAGS,QAAA,GAA+B;AACtC,IAAA,OAAO,uBAAuB,IAAA,CAAK,eAAA,EAAiB,CAAA,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AAAA,EACxF;AACF;AAuBO,IAAM,YAAA,GAAN,cAA2B,kBAAA,CAAmB;AAAA,EAC1C,UAAA,GAAyB;AAAA,IAChC,EAAA,EAAI,QAAA;AAAA,IACJ,IAAA,EAAM,YAAA;AAAA,IACN,aAAA,EAAe,KAAA;AAAA,IACf,mBAAA,EAAqB;AAAA,GACvB;AAAA,EAEmB,GAAA,GAAc,gBAAgB,QAAQ,CAAA;AAAA,EACtC,UAAA,GAAa,QAAA;AAAA,EACb,WAAA,GAAc,YAAA;AAAA,EACd,SAAA,GAAY,QAAA;AAAA,EAErB,SAAA,CAAU,SAAiB,QAAA,EAAwC;AAC3E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,kEAAA,EAAoE;AAAA,QAChF;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,MAAM,IAAA,GAAO,CAAC,IAAA,EAAM,OAAA,EAAS,mBAAmB,aAAa,CAAA;AAC7D,IAAA,MAAM,QAAQ,IAAA,CAAK,eAAA,EAAgB,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AACrE,IAAA,IAAI,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,KAAK,CAAA;AAChC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEU,QAAA,GAAmC;AAC3C,IAAA,MAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,gBAAA,EAAkB,gBAAA,EAAkB,wBAAwB,CAAC,CAAA;AACvF,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,IAAI,CAAC,SAAS,OAAO,GAAA;AAIrB,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,sBAAA;AACX,IAAA,MAAM,GAAA,GAAM,oBAAA,CAAqB,OAAA,CAAQ,UAAA,EAAY,QAAQ,KAAA,EAAO;AAAA,MAClE,GAAA,EAAK,IAAA,CAAK,eAAA,EAAgB,CAAE;AAAA,KAC7B,CAAA;AACD,IAAA,IAAI,GAAA,MAAS,cAAA,GAAiB,GAAA;AAG9B,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,EAAyB;AAClE,MAAA,GAAA,CAAI,yBAAyB,OAAA,CAAQ,OAAA;AAAA,IACvC;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEU,WAAA,GAAsB;AAC9B,IAAA,OAAO,iHAAA;AAAA,EACT;AAAA,EAEmB,YAAA,CAAa,MAAqB,MAAA,EAA+B;AAClF,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,8CAAA;AAAA,QACT,QAAA,EAAU,YAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM;AAAA,OACR;AAAA,IACF;AACA,IAAA,IAAI,IAAA,KAAS,IAAI,OAAO,IAAA;AACxB,IAAA,OAAO,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAe,UAAA,GAAoC;AACjD,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,MAAM,OAAA,GAAU,uBAAuB,OAAO,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,OAAA,GACR,oBAAA,CAAqB,OAAA,CAAQ,YAAY,OAAA,CAAQ,KAAA,EAAO,EAAE,GAAA,EAAK,OAAA,CAAQ,SAAA,EAAW,CAAA,GAClF,QAAQ,SAAA,CAAU,cAAA;AACtB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,eAAA,CAAgB,QAAQ,CAAA;AACzC,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,QAAA;AAAA,MACA,GAAA;AAAA,MACA,OAAA,EAAS,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,GACpC,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAC3B;AAAC,KACP;AACA,IAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,GAAI,MAAA,CAAO,MAAA,GAAS,eAAA,CAAgB,QAAQ,CAAA;AAAA,EACzF;AACF;AAMO,IAAM,kBAAA,GAAgD;AAAA,EAC3D,EAAA,EAAI,QAAA;AAAA,EACJ,WAAA,EAAa,sBAAA,CAAuB,MAAA,EAAQ,IAAA,IAAQ,YAAA;AAAA,EACpD,UAAA,EAAY,CAAA;AAAA,EACZ,YAAA,EAAgB,CAAA,CAAA,MAAA,CAAoB,MAAM,IAAI,CAAA;AAAA,EAC9C,QAAQ,OAAO,MAAA,EAAQ,IAAA,KAAS,IAAI,aAAa,MAAM,CAAA;AAAA,EACvD,UAAA,EAAY,OAAO,QAAA,EAAU,OAAA,KAC3B,IAAI,YAAA,CAAa;AAAA,IACf,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IACjB,SAAA,EAAW,YAAA;AAAA,IACX,GAAG,oBAAA,CAAqB,QAAA,EAAU,OAAO;AAAA,GAC1C,EAAE,UAAA;AACP","file":"chunk-SM3UPDXE.js","sourcesContent":["import type { DriverTarget } from \"@skaile/workspaces/plugin-registry\";\nimport type { Logger } from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nimport { getBridgeLogger } from \"../logger.js\";\nimport { fetchProviderModels, getStaticModels, type ModelEntry } from \"../models.js\";\nimport { getProviderPreset } from \"../provider-catalog.js\";\nimport { entryCredentialValue } from \"../provider-materialize/credential-env.js\";\nimport {\n  bindSingleProviderEntry,\n  type EnvDriverSession,\n  type RegistryModelBinding,\n  resolveEnvDriverSession,\n  resolveRegistryBinding,\n} from \"../provider-materialize/env-drivers.js\";\nimport { registryDriverConfig } from \"../provider-registry-derive.js\";\nimport { BUILTIN_DRIVER_CATALOG } from \"../registry.js\";\nimport type { AgentConfig, DriverInfo } from \"../types.js\";\nimport { extractCost, extractText, extractTokens, SubprocessCliDriver } from \"./_subprocess-cli.js\";\n\n/**\n * The Gemini API host the CLI talks to unless told otherwise — the catalog's\n * `google` preset, so the two can never drift apart.\n */\nconst GOOGLE_DEFAULT_BASE_URL = getProviderPreset(\"google\")?.base_url;\n\n/**\n * Shared base for the Gemini-CLI event family. Gemini CLI and Qwen Code (a fork\n * of Gemini CLI) emit the same `stream-json` event shape, so both dispatch the\n * same {@link handleJson}: `init`/`system` → session capture, `message`/\n * `assistant` → streamed assistant text, `tool_use` / `tool_result` → tool\n * events, `result` → tokens + cost.\n *\n * @docLink packages/bridge/drivers#gemini-driver\n */\nexport abstract class GeminiFamilyDriver extends SubprocessCliDriver {\n  protected handleJson(json: any): void {\n    switch (json?.type) {\n      case \"init\":\n      case \"system\":\n        this.captureSession(json.sessionId ?? json.session_id ?? json.id);\n        break;\n\n      case \"message\":\n      case \"assistant\": {\n        const role = json.role ?? json.message?.role ?? \"assistant\";\n        if (role !== \"assistant\") break;\n        const text = extractText(json);\n        if (json.done === true || json.final === true || json.finished === true) {\n          this.pushAssistantEnd(text);\n        } else {\n          this.pushAssistantDelta(text);\n        }\n        break;\n      }\n\n      case \"tool_use\":\n      case \"tool_call\":\n        this.pushToolCall(json.name ?? json.tool ?? \"tool\", json.input ?? json.args ?? {});\n        break;\n\n      case \"tool_result\":\n        this.pushToolResult(\n          json.name ?? json.tool ?? \"tool\",\n          json.result ?? json.output ?? json.content,\n          Boolean(json.is_error ?? json.isError ?? json.error),\n        );\n        break;\n\n      case \"error\":\n        this.pushError(this.classifyMessage(String(json.message ?? json.error ?? \"error\")));\n        break;\n\n      case \"result\":\n        this.captureSession(json.sessionId ?? json.session_id);\n        this.pushResult({\n          tokens: extractTokens(json),\n          costUsd: extractCost(json),\n          summary: extractText(json) || \"Task completed\",\n        });\n        break;\n    }\n  }\n\n  // ── Registry binding ──────────────────────────────────────────────────────\n\n  private providers?: EnvDriverSession;\n  private boundEntry?: RegistryModelBinding;\n  private bindingResolved = false;\n\n  /** This session's AI providers, resolved once from the config. */\n  protected providerSession(): EnvDriverSession {\n    this.providers ??= resolveEnvDriverSession(this.config);\n    return this.providers;\n  }\n\n  /**\n   * The AI provider entry this session's model selector names, memoized until\n   * the model changes.\n   *\n   * Gemini CLI and Qwen Code are `single`-plurality backends (§2.3): they\n   * address one endpoint, so the bound entry supplies both the credential and\n   * the base URL. Resolving through {@link bindSingleProviderEntry} is what\n   * puts the surface check — which throws — on the start path.\n   */\n  protected registryBinding(): RegistryModelBinding | undefined {\n    if (this.bindingResolved) return this.boundEntry;\n    const binding = bindSingleProviderEntry(\n      this.driverInfo.id,\n      this.productName,\n      this.providerSession(),\n    );\n    for (const warning of binding?.warnings ?? []) this.log.warn(warning);\n    this.boundEntry = binding;\n    this.bindingResolved = true;\n    return binding;\n  }\n\n  /**\n   * Fail before the first spawn when the bound entry speaks a surface this\n   * backend cannot — the error names the surface.\n   */\n  override async start(): Promise<void> {\n    this.registryBinding();\n    await super.start();\n  }\n\n  override reconfigure(patch: Partial<Pick<AgentConfig, \"model\" | \"thinking\" | \"effort\">>): void {\n    super.reconfigure(patch);\n    if (patch.model !== undefined) {\n      this.providers = undefined;\n      this.bindingResolved = false;\n    }\n  }\n\n  /** The provider-side model id the backend is actually run with. */\n  override getModel(): string | undefined {\n    return resolveRegistryBinding(this.providerSession())?.providerModelId ?? this.config.model;\n  }\n}\n\n/**\n * Agent driver for the Google **Gemini CLI** (`gemini`).\n *\n * Spawns `gemini -p \"<prompt>\" --output-format stream-json` per turn and maps\n * the stream-json events to the unified {@link AgentEvent} stream. Google\n * models only (`surface: google-generative-ai`): the AI provider entry the\n * session's model selector names supplies `GEMINI_API_KEY`, the `-m` model id\n * and — for a non-default endpoint — `GOOGLE_GEMINI_BASE_URL`.\n *\n * @remarks\n * - **Requires Gemini CLI ≥ v0.6.1** — earlier versions reject\n *   `--output-format`. A too-old CLI surfaces as a `process`-category exit error.\n * - **Session resume is not available in headless (`-p`) mode** — the CLI errors\n *   if asked to resume non-interactively, so this driver runs single-turn per\n *   process and logs a warning when a resume id is present.\n * - Exit codes: `42` → input/validation error, `53` → turn-limit (treated as a\n *   completed turn).\n *\n * @see https://github.com/google-gemini/gemini-cli\n * @docLink packages/bridge/drivers#gemini-driver\n */\nexport class GeminiDriver extends GeminiFamilyDriver {\n  readonly driverInfo: DriverInfo = {\n    id: \"gemini\",\n    name: \"Gemini CLI\",\n    modelAgnostic: false,\n    supportsInBandAbort: false,\n  };\n\n  protected readonly log: Logger = getBridgeLogger(\"gemini\");\n  protected readonly defaultBin = \"gemini\";\n  protected readonly productName = \"Gemini CLI\";\n  protected readonly envPrefix = \"GEMINI\";\n\n  protected buildArgs(message: string, resumeId: string | undefined): string[] {\n    if (resumeId) {\n      this.log.warn(\"Gemini CLI cannot resume in headless mode; starting a fresh turn\", {\n        resumeId,\n      });\n    }\n    const args = [\"-p\", message, \"--output-format\", \"stream-json\"];\n    const model = this.registryBinding()?.providerModelId ?? this.config.model;\n    if (model) args.push(\"-m\", model);\n    return args;\n  }\n\n  protected buildEnv(): Record<string, string> {\n    const env = this.baseEnv([\"GEMINI_API_KEY\", \"GOOGLE_API_KEY\", \"GOOGLE_GEMINI_BASE_URL\"]);\n    const binding = this.registryBinding();\n    if (!binding) return env;\n\n    // The entry is the authority: inherited Google carriers are dropped so an\n    // ambient key cannot authenticate a session pointed somewhere else.\n    delete env.GEMINI_API_KEY;\n    delete env.GOOGLE_API_KEY;\n    delete env.GOOGLE_GEMINI_BASE_URL;\n    const key = entryCredentialValue(binding.providerId, binding.entry, {\n      env: this.providerSession().lookupEnv,\n    });\n    if (key) env.GEMINI_API_KEY = key;\n    // Only a non-default endpoint is worth naming: Gemini CLI reads\n    // GOOGLE_GEMINI_BASE_URL as an override of its own default host.\n    if (binding.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL) {\n      env.GOOGLE_GEMINI_BASE_URL = binding.baseUrl;\n    }\n    return env;\n  }\n\n  protected installHint(): string {\n    return \"Gemini CLI is not installed or not on your PATH. Install it with `npm i -g @google/gemini-cli` (≥ v0.6.1).\";\n  }\n\n  protected override classifyExit(code: number | null, signal: NodeJS.Signals | null) {\n    if (code === 42) {\n      return {\n        message: \"Gemini CLI reported an input error (exit 42)\",\n        category: \"validation\" as const,\n        retryable: false,\n        hint: \"The prompt or flags were rejected by Gemini CLI. Check the model name and arguments.\",\n      };\n    }\n    if (code === 53) return null; // turn-limit — the result was already emitted.\n    return super.classifyExit(code, signal);\n  }\n\n  /**\n   * Discovery runs against the bound entry: its credential and, for a\n   * non-default endpoint, its base URL. Without an entry the ambient\n   * `GEMINI_API_KEY` is the last resort, and an unreachable API falls back to\n   * the static Google catalog.\n   */\n  override async listModels(): Promise<ModelEntry[]> {\n    const session = this.providerSession();\n    const binding = resolveRegistryBinding(session);\n    const key = binding\n      ? entryCredentialValue(binding.providerId, binding.entry, { env: session.lookupEnv })\n      : session.lookupEnv.GEMINI_API_KEY;\n    if (!key) return getStaticModels(\"google\");\n    const result = await fetchProviderModels(\n      \"google\",\n      key,\n      binding?.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL\n        ? { baseUrl: binding.baseUrl }\n        : {},\n    );\n    return result.ok && result.models.length > 0 ? result.models : getStaticModels(\"google\");\n  }\n}\n\n/**\n * `DriverTarget` wrapper for the gemini driver. Registered into the plugin\n * registry by `registerBuiltinDrivers()`.\n */\nexport const geminiDriverTarget: DriverTarget<AgentConfig> = {\n  id: \"gemini\",\n  displayName: BUILTIN_DRIVER_CATALOG.gemini?.name ?? \"Gemini CLI\",\n  apiVersion: 1,\n  configSchema: z.custom<AgentConfig>(() => true),\n  create: async (config, _ctx) => new GeminiDriver(config),\n  listModels: async (registry, options) =>\n    new GeminiDriver({\n      cwd: process.cwd(),\n      sessionId: \"model-list\",\n      ...registryDriverConfig(registry, options),\n    }).listModels(),\n};\n"]}
+{"version":3,"sources":["../bridge/src/drivers/gemini.ts"],"names":[],"mappings":";;;;;;AAuBA,IAAM,uBAAA,GAA0B,iBAAA,CAAkB,QAAQ,CAAA,EAAG,QAAA;AAWtD,IAAe,kBAAA,GAAf,cAA0C,mBAAA,CAAoB;AAAA,EACzD,WAAW,IAAA,EAAiB;AACpC,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,MAAA;AAAA,MACL,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,eAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAA,IAAc,KAAK,EAAE,CAAA;AAChE,QAAA;AAAA,MAEF,KAAK,SAAA;AAAA,MACL,KAAK,WAAA,EAAa;AAChB,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,SAAS,IAAA,IAAQ,WAAA;AAChD,QAAA,IAAI,SAAS,WAAA,EAAa;AAC1B,QAAA,MAAM,IAAA,GAAO,YAAY,IAAI,CAAA;AAC7B,QAAA,IAAI,IAAA,CAAK,SAAS,IAAA,IAAQ,IAAA,CAAK,UAAU,IAAA,IAAQ,IAAA,CAAK,aAAa,IAAA,EAAM;AACvE,UAAA,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,QAC5B,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,mBAAmB,IAAI,CAAA;AAAA,QAC9B;AACA,QAAA;AAAA,MACF;AAAA,MAEA,KAAK,UAAA;AAAA,MACL,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA,EAAQ,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,IAAA,IAAQ,EAAE,CAAA;AACjF,QAAA;AAAA,MAEF,KAAK,aAAA;AACH,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA;AAAA,UAC1B,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,OAAA;AAAA,UACnC,QAAQ,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,OAAA,IAAW,KAAK,KAAK;AAAA,SACrD;AACA,QAAA;AAAA,MAEF,KAAK,OAAA;AACH,QAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,WAAW,IAAA,CAAK,KAAA,IAAS,OAAO,CAAC,CAAC,CAAA;AAClF,QAAA;AAAA,MAEF,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAU,CAAA;AACrD,QAAA,IAAA,CAAK,UAAA,CAAW;AAAA,UACd,MAAA,EAAQ,cAAc,IAAI,CAAA;AAAA,UAC1B,OAAA,EAAS,YAAY,IAAI,CAAA;AAAA,UACzB,OAAA,EAAS,WAAA,CAAY,IAAI,CAAA,IAAK;AAAA,SAC/B,CAAA;AACD,QAAA;AAAA;AACJ,EACF;AAAA;AAAA,EAIQ,SAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA,GAAkB,KAAA;AAAA;AAAA,EAGhB,eAAA,GAAoC;AAC5C,IAAA,IAAA,CAAK,SAAA,KAAc,uBAAA,CAAwB,IAAA,CAAK,MAAM,CAAA;AACtD,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWU,eAAA,GAAoD;AAC5D,IAAA,IAAI,IAAA,CAAK,eAAA,EAAiB,OAAO,IAAA,CAAK,UAAA;AACtC,IAAA,MAAM,OAAA,GAAU,uBAAA;AAAA,MACd,KAAK,UAAA,CAAW,EAAA;AAAA,MAChB,IAAA,CAAK,WAAA;AAAA,MACL,KAAK,eAAA;AAAgB,KACvB;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,QAAA,IAAY,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,OAAO,CAAA;AACpE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA;AAClB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAe,KAAA,GAAuB;AACpC,IAAA,IAAA,CAAK,eAAA,EAAgB;AACrB,IAAA,MAAM,MAAM,KAAA,EAAM;AAAA,EACpB;AAAA,EAES,YAAY,KAAA,EAA0E;AAC7F,IAAA,KAAA,CAAM,YAAY,KAAK,CAAA;AACvB,IAAA,IAAI,KAAA,CAAM,UAAU,MAAA,EAAW;AAC7B,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,MAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AAAA,IACzB;AAAA,EACF;AAAA;AAAA,EAGS,QAAA,GAA+B;AACtC,IAAA,OAAO,uBAAuB,IAAA,CAAK,eAAA,EAAiB,CAAA,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AAAA,EACxF;AACF;AAuBO,IAAM,YAAA,GAAN,cAA2B,kBAAA,CAAmB;AAAA,EAC1C,UAAA,GAAyB;AAAA,IAChC,EAAA,EAAI,QAAA;AAAA,IACJ,IAAA,EAAM,YAAA;AAAA,IACN,aAAA,EAAe,KAAA;AAAA,IACf,mBAAA,EAAqB;AAAA,GACvB;AAAA,EAEmB,GAAA,GAAc,gBAAgB,QAAQ,CAAA;AAAA,EACtC,UAAA,GAAa,QAAA;AAAA,EACb,WAAA,GAAc,YAAA;AAAA,EACd,SAAA,GAAY,QAAA;AAAA,EAErB,SAAA,CAAU,SAAiB,QAAA,EAAwC;AAC3E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,kEAAA,EAAoE;AAAA,QAChF;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,MAAM,IAAA,GAAO,CAAC,IAAA,EAAM,OAAA,EAAS,mBAAmB,aAAa,CAAA;AAC7D,IAAA,MAAM,QAAQ,IAAA,CAAK,eAAA,EAAgB,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AACrE,IAAA,IAAI,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,KAAK,CAAA;AAChC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEU,QAAA,GAAmC;AAC3C,IAAA,MAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,gBAAA,EAAkB,gBAAA,EAAkB,wBAAwB,CAAC,CAAA;AACvF,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,IAAI,CAAC,SAAS,OAAO,GAAA;AAIrB,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,sBAAA;AACX,IAAA,MAAM,GAAA,GAAM,oBAAA,CAAqB,OAAA,CAAQ,UAAA,EAAY,QAAQ,KAAA,EAAO;AAAA,MAClE,GAAA,EAAK,IAAA,CAAK,eAAA,EAAgB,CAAE;AAAA,KAC7B,CAAA;AACD,IAAA,IAAI,GAAA,MAAS,cAAA,GAAiB,GAAA;AAG9B,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,EAAyB;AAClE,MAAA,GAAA,CAAI,yBAAyB,OAAA,CAAQ,OAAA;AAAA,IACvC;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEU,WAAA,GAAsB;AAC9B,IAAA,OAAO,iHAAA;AAAA,EACT;AAAA,EAEmB,YAAA,CAAa,MAAqB,MAAA,EAA+B;AAClF,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,8CAAA;AAAA,QACT,QAAA,EAAU,YAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM;AAAA,OACR;AAAA,IACF;AACA,IAAA,IAAI,IAAA,KAAS,IAAI,OAAO,IAAA;AACxB,IAAA,OAAO,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAe,UAAA,GAAoC;AACjD,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,MAAM,OAAA,GAAU,uBAAuB,OAAO,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,OAAA,GACR,oBAAA,CAAqB,OAAA,CAAQ,YAAY,OAAA,CAAQ,KAAA,EAAO,EAAE,GAAA,EAAK,OAAA,CAAQ,SAAA,EAAW,CAAA,GAClF,QAAQ,SAAA,CAAU,cAAA;AACtB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,eAAA,CAAgB,QAAQ,CAAA;AACzC,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,QAAA;AAAA,MACA,GAAA;AAAA,MACA,OAAA,EAAS,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,GACpC,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAC3B;AAAC,KACP;AACA,IAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,GAAI,MAAA,CAAO,MAAA,GAAS,eAAA,CAAgB,QAAQ,CAAA;AAAA,EACzF;AACF;AAMO,IAAM,kBAAA,GAAgD;AAAA,EAC3D,EAAA,EAAI,QAAA;AAAA,EACJ,WAAA,EAAa,sBAAA,CAAuB,MAAA,EAAQ,IAAA,IAAQ,YAAA;AAAA,EACpD,UAAA,EAAY,CAAA;AAAA,EACZ,YAAA,EAAgB,CAAA,CAAA,MAAA,CAAoB,MAAM,IAAI,CAAA;AAAA,EAC9C,QAAQ,OAAO,MAAA,EAAQ,IAAA,KAAS,IAAI,aAAa,MAAM,CAAA;AAAA,EACvD,UAAA,EAAY,OAAO,QAAA,EAAU,OAAA,KAC3B,IAAI,YAAA,CAAa;AAAA,IACf,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IACjB,SAAA,EAAW,YAAA;AAAA,IACX,GAAG,oBAAA,CAAqB,QAAA,EAAU,OAAO;AAAA,GAC1C,EAAE,UAAA;AACP","file":"chunk-GH3BHLBF.js","sourcesContent":["import type { DriverTarget } from \"@skaile/workspaces/plugin-registry\";\nimport type { Logger } from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nimport { getBridgeLogger } from \"../logger.js\";\nimport { fetchProviderModels, getStaticModels, type ModelEntry } from \"../models.js\";\nimport { getProviderPreset } from \"../provider-catalog.js\";\nimport { entryCredentialValue } from \"../provider-materialize/credential-env.js\";\nimport {\n  bindSingleProviderEntry,\n  type EnvDriverSession,\n  type RegistryModelBinding,\n  resolveEnvDriverSession,\n  resolveRegistryBinding,\n} from \"../provider-materialize/env-drivers.js\";\nimport { registryDriverConfig } from \"../provider-registry-derive.js\";\nimport { BUILTIN_DRIVER_CATALOG } from \"../registry.js\";\nimport type { AgentConfig, DriverInfo } from \"../types.js\";\nimport { extractCost, extractText, extractTokens, SubprocessCliDriver } from \"./_subprocess-cli.js\";\n\n/**\n * The Gemini API host the CLI talks to unless told otherwise — the catalog's\n * `google` preset, so the two can never drift apart.\n */\nconst GOOGLE_DEFAULT_BASE_URL = getProviderPreset(\"google\")?.base_url;\n\n/**\n * Shared base for the Gemini-CLI event family. Gemini CLI and Qwen Code (a fork\n * of Gemini CLI) emit the same `stream-json` event shape, so both dispatch the\n * same {@link handleJson}: `init`/`system` → session capture, `message`/\n * `assistant` → streamed assistant text, `tool_use` / `tool_result` → tool\n * events, `result` → tokens + cost.\n *\n * @docLink packages/bridge/drivers#gemini-driver\n */\nexport abstract class GeminiFamilyDriver extends SubprocessCliDriver {\n  protected handleJson(json: any): void {\n    switch (json?.type) {\n      case \"init\":\n      case \"system\":\n        this.captureSession(json.sessionId ?? json.session_id ?? json.id);\n        break;\n\n      case \"message\":\n      case \"assistant\": {\n        const role = json.role ?? json.message?.role ?? \"assistant\";\n        if (role !== \"assistant\") break;\n        const text = extractText(json);\n        if (json.done === true || json.final === true || json.finished === true) {\n          this.pushAssistantEnd(text);\n        } else {\n          this.pushAssistantDelta(text);\n        }\n        break;\n      }\n\n      case \"tool_use\":\n      case \"tool_call\":\n        this.pushToolCall(json.name ?? json.tool ?? \"tool\", json.input ?? json.args ?? {});\n        break;\n\n      case \"tool_result\":\n        this.pushToolResult(\n          json.name ?? json.tool ?? \"tool\",\n          json.result ?? json.output ?? json.content,\n          Boolean(json.is_error ?? json.isError ?? json.error),\n        );\n        break;\n\n      case \"error\":\n        this.pushError(this.classifyMessage(String(json.message ?? json.error ?? \"error\")));\n        break;\n\n      case \"result\":\n        this.captureSession(json.sessionId ?? json.session_id);\n        this.pushResult({\n          tokens: extractTokens(json),\n          costUsd: extractCost(json),\n          summary: extractText(json) || \"Task completed\",\n        });\n        break;\n    }\n  }\n\n  // ── Registry binding ──────────────────────────────────────────────────────\n\n  private providers?: EnvDriverSession;\n  private boundEntry?: RegistryModelBinding;\n  private bindingResolved = false;\n\n  /** This session's AI providers, resolved once from the config. */\n  protected providerSession(): EnvDriverSession {\n    this.providers ??= resolveEnvDriverSession(this.config);\n    return this.providers;\n  }\n\n  /**\n   * The AI provider entry this session's model selector names, memoized until\n   * the model changes.\n   *\n   * Gemini CLI and Qwen Code are `single`-plurality backends (§2.3): they\n   * address one endpoint, so the bound entry supplies both the credential and\n   * the base URL. Resolving through {@link bindSingleProviderEntry} is what\n   * puts the surface check — which throws — on the start path.\n   */\n  protected registryBinding(): RegistryModelBinding | undefined {\n    if (this.bindingResolved) return this.boundEntry;\n    const binding = bindSingleProviderEntry(\n      this.driverInfo.id,\n      this.productName,\n      this.providerSession(),\n    );\n    for (const warning of binding?.warnings ?? []) this.log.warn(warning);\n    this.boundEntry = binding;\n    this.bindingResolved = true;\n    return binding;\n  }\n\n  /**\n   * Fail before the first spawn when the bound entry speaks a surface this\n   * backend cannot — the error names the surface.\n   */\n  override async start(): Promise<void> {\n    this.registryBinding();\n    await super.start();\n  }\n\n  override reconfigure(patch: Partial<Pick<AgentConfig, \"model\" | \"thinking\" | \"effort\">>): void {\n    super.reconfigure(patch);\n    if (patch.model !== undefined) {\n      this.providers = undefined;\n      this.bindingResolved = false;\n    }\n  }\n\n  /** The provider-side model id the backend is actually run with. */\n  override getModel(): string | undefined {\n    return resolveRegistryBinding(this.providerSession())?.providerModelId ?? this.config.model;\n  }\n}\n\n/**\n * Agent driver for the Google **Gemini CLI** (`gemini`).\n *\n * Spawns `gemini -p \"<prompt>\" --output-format stream-json` per turn and maps\n * the stream-json events to the unified {@link AgentEvent} stream. Google\n * models only (`surface: google-generative-ai`): the AI provider entry the\n * session's model selector names supplies `GEMINI_API_KEY`, the `-m` model id\n * and — for a non-default endpoint — `GOOGLE_GEMINI_BASE_URL`.\n *\n * @remarks\n * - **Requires Gemini CLI ≥ v0.6.1** — earlier versions reject\n *   `--output-format`. A too-old CLI surfaces as a `process`-category exit error.\n * - **Session resume is not available in headless (`-p`) mode** — the CLI errors\n *   if asked to resume non-interactively, so this driver runs single-turn per\n *   process and logs a warning when a resume id is present.\n * - Exit codes: `42` → input/validation error, `53` → turn-limit (treated as a\n *   completed turn).\n *\n * @see https://github.com/google-gemini/gemini-cli\n * @docLink packages/bridge/drivers#gemini-driver\n */\nexport class GeminiDriver extends GeminiFamilyDriver {\n  readonly driverInfo: DriverInfo = {\n    id: \"gemini\",\n    name: \"Gemini CLI\",\n    modelAgnostic: false,\n    supportsInBandAbort: false,\n  };\n\n  protected readonly log: Logger = getBridgeLogger(\"gemini\");\n  protected readonly defaultBin = \"gemini\";\n  protected readonly productName = \"Gemini CLI\";\n  protected readonly envPrefix = \"GEMINI\";\n\n  protected buildArgs(message: string, resumeId: string | undefined): string[] {\n    if (resumeId) {\n      this.log.warn(\"Gemini CLI cannot resume in headless mode; starting a fresh turn\", {\n        resumeId,\n      });\n    }\n    const args = [\"-p\", message, \"--output-format\", \"stream-json\"];\n    const model = this.registryBinding()?.providerModelId ?? this.config.model;\n    if (model) args.push(\"-m\", model);\n    return args;\n  }\n\n  protected buildEnv(): Record<string, string> {\n    const env = this.baseEnv([\"GEMINI_API_KEY\", \"GOOGLE_API_KEY\", \"GOOGLE_GEMINI_BASE_URL\"]);\n    const binding = this.registryBinding();\n    if (!binding) return env;\n\n    // The entry is the authority: inherited Google carriers are dropped so an\n    // ambient key cannot authenticate a session pointed somewhere else.\n    delete env.GEMINI_API_KEY;\n    delete env.GOOGLE_API_KEY;\n    delete env.GOOGLE_GEMINI_BASE_URL;\n    const key = entryCredentialValue(binding.providerId, binding.entry, {\n      env: this.providerSession().lookupEnv,\n    });\n    if (key) env.GEMINI_API_KEY = key;\n    // Only a non-default endpoint is worth naming: Gemini CLI reads\n    // GOOGLE_GEMINI_BASE_URL as an override of its own default host.\n    if (binding.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL) {\n      env.GOOGLE_GEMINI_BASE_URL = binding.baseUrl;\n    }\n    return env;\n  }\n\n  protected installHint(): string {\n    return \"Gemini CLI is not installed or not on your PATH. Install it with `npm i -g @google/gemini-cli` (≥ v0.6.1).\";\n  }\n\n  protected override classifyExit(code: number | null, signal: NodeJS.Signals | null) {\n    if (code === 42) {\n      return {\n        message: \"Gemini CLI reported an input error (exit 42)\",\n        category: \"validation\" as const,\n        retryable: false,\n        hint: \"The prompt or flags were rejected by Gemini CLI. Check the model name and arguments.\",\n      };\n    }\n    if (code === 53) return null; // turn-limit — the result was already emitted.\n    return super.classifyExit(code, signal);\n  }\n\n  /**\n   * Discovery runs against the bound entry: its credential and, for a\n   * non-default endpoint, its base URL. Without an entry the ambient\n   * `GEMINI_API_KEY` is the last resort, and an unreachable API falls back to\n   * the static Google catalog.\n   */\n  override async listModels(): Promise<ModelEntry[]> {\n    const session = this.providerSession();\n    const binding = resolveRegistryBinding(session);\n    const key = binding\n      ? entryCredentialValue(binding.providerId, binding.entry, { env: session.lookupEnv })\n      : session.lookupEnv.GEMINI_API_KEY;\n    if (!key) return getStaticModels(\"google\");\n    const result = await fetchProviderModels(\n      \"google\",\n      key,\n      binding?.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL\n        ? { baseUrl: binding.baseUrl }\n        : {},\n    );\n    return result.ok && result.models.length > 0 ? result.models : getStaticModels(\"google\");\n  }\n}\n\n/**\n * `DriverTarget` wrapper for the gemini driver. Registered into the plugin\n * registry by `registerBuiltinDrivers()`.\n */\nexport const geminiDriverTarget: DriverTarget<AgentConfig> = {\n  id: \"gemini\",\n  displayName: BUILTIN_DRIVER_CATALOG.gemini?.name ?? \"Gemini CLI\",\n  apiVersion: 1,\n  configSchema: z.custom<AgentConfig>(() => true),\n  create: async (config, _ctx) => new GeminiDriver(config),\n  listModels: async (registry, options) =>\n    new GeminiDriver({\n      cwd: process.cwd(),\n      sessionId: \"model-list\",\n      ...registryDriverConfig(registry, options),\n    }).listModels(),\n};\n"]}

package/dist/{chunk-PE3A6FFW.js → chunk-HCYS7GFP.js}

@@ -1,6 +1,6 @@
 import { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
 import { openSqlite } from './chunk-JMKB7IB4.js';
-import { registryEntries, isEntryEnabled, parseCredentialRef } from './chunk-GZZPKAV5.js';
+import { registryEntries, isEntryEnabled, parseCredentialRef } from './chunk-MJHSLODD.js';
 import { lstatSync, realpathSync, existsSync, chmodSync, rmSync, writeFileSync, renameSync, mkdirSync, readdirSync, readFileSync } from 'fs';
 import { isAbsolute, resolve, dirname, join, relative } from 'path';
 import * as z from 'zod';
@@ -353,5 +353,5 @@ function codexInstanceEnvironment(input, home) {
 }
 
 export { activateNativeApprovalPolicy, allowsNativeApprovalPath, codexInstanceEnvironment, isNativeApprovalPolicyActive, managedCodexRegistryViolation, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult, prepareCodexInstance, prepareNativePolicy };
-//# sourceMappingURL=chunk-PE3A6FFW.js.map
-//# sourceMappingURL=chunk-PE3A6FFW.js.map
+//# sourceMappingURL=chunk-HCYS7GFP.js.map
+//# sourceMappingURL=chunk-HCYS7GFP.js.map

package/dist/{chunk-PE3A6FFW.js.map → chunk-HCYS7GFP.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/codex/native-policy.ts","../bridge/src/codex/credentials.ts","../bridge/src/codex/instance-state.ts"],"names":["invalid","within","relative","isAbsolute","directory","lstatSync","realpathSync","source"],"mappings":";;;;;;;;AAGA,IAAM,OAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE,IAAM,MAAA,GAAS,CAAC,KAAA,EAAe,MAAA,KAAmB;AAChD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,EAAQ,KAAK,CAAA;AAClC,EAAA,OAAO,GAAA,KAAQ,EAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,IAAK,GAAA,KAAQ,IAAA,IAAQ,CAAC,UAAA,CAAW,GAAG,CAAA;AACjF,CAAA;AACA,IAAM,aAAa,CAAC,IAAA,KAClB,CAAC,GAAG,IAAI,EAAE,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA,IAAM,UAAU,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC/F,IAAM,SAAA,GAAY,CAAC,IAAA,KAAiB;AAClC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,IAAK,WAAW,IAAI,CAAA,QAAS,OAAA,EAAQ;AACzD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,WAAA,EAAY,IAAK,KAAK,cAAA,EAAe,QAAS,OAAA,EAAQ;AAChE,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B,CAAA;AAGO,SAAS,oBAAoB,KAAA,EAKjC;AACD,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,SAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,SAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA;AACzD,EAAA,IACE,OAAO,GAAA,EAAK,WAAW,KACvB,MAAA,CAAO,WAAA,EAAa,GAAG,CAAA,IACvB,CAAC,OAAO,gBAAA,EAAkB,WAAW,KACrC,gBAAA,KAAqB,WAAA,IACpB,MAAM,WAAA,KAAgB,WAAA,IAAe,MAAM,WAAA,KAAgB,iBAAA;AAE5D,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,IAAA,GAAO,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,IAAA,GAAO,EAAA,IAAU,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,GAAA,KAAQ,CAAA,IAAK,IAAA,CAAK,GAAA,KAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,CAAC,GAAG,GAAG,KAAA,CAAM,WAAA,KAAgB,oBAAoB,OAAA,GAAU,MAAA;AAAA,IAC3D,CAAC,WAAW,GAAG;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,mBAAA,EAAqB,SAAA;AAAA,IACrB,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAAA,IACtD,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,MACzB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,QACrB,OAAA,EAAS,YAAA;AAAA,QACT,UAAA;AAAA,QACA,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,OAAO;AAAA,OAC1C;AAAA,KACF;AAAA,GACF,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,CAAA,qDAAA,EAAwD,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAC9F,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA,CAC7E,IAAA,CAAK,IAAI,CAAC,CAAA,qCAAA,CAAA;AACb,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,MACrB,IAAA;AAAA,MACA,+BAAA;AAAA,MACA,IAAA;AAAA,MACA,oCAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAe,OAAO,CAAA;AAAA,KACvB;AAAA,GACF,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,EAAE,GAAA,EAAK,aAAa,QAAA,EAAU,KAAA,CAAM,WAAA,KAAgB,iBAAA,EAAmB,CAAA;AAC5F,EAAA,OAAO,MAAA;AACT;AAIA,IAAM,QAAA,uBAAe,OAAA,EAAyB;AAG9C,IAAM,MAAA,uBAAa,OAAA,EAAqE;AAGjF,SAAS,4BAAA,CACd,MAAA,EACA,QAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IACE,CAAC,OAAA,IACD,MAAA,CAAO,OAAA,IACP,CAAC,OAAO,QAAQ,CAAA,IAChB,CAAC,MAAA,CAAO,SAAS,MAAM,CAAA,IACvB,OAAO,QAAA,CAAS,OAAO,EAAA,KAAO,QAAA,IAC9B,CAAC,QAAA,CAAS,OAAO,EAAA,IACjB,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,OACzB,CAAC,MAAA,CAAO,QAAA,CAAS,uBAAuB,KACxC,QAAA,CAAS,uBAAA,CAAwB,OAAO,SAAA,IACxC,QAAA,CAAS,wBAAwB,OAAA,KAAY,YAAA;AAE7C,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC9B,EAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,UAAU,QAAA,CAAS,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAAA,CACd,QACA,QAAA,EACgC;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,WAAW,CAAC,OAAA,CAAQ,OAAO,OAAA,IAAW,OAAA,CAAQ,aAAa,QAAQ,CAAA;AACpF;AAGO,SAAS,wBAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IACE,CAAC,OAAA,IACD,OAAA,CAAQ,OAAO,OAAA,IACf,CAAC,WAAW,IAAI,CAAA,IAChB,WAAW,IAAI,CAAA,IACd,WAAW,MAAA,IAAU,MAAA,KAAW,WAChC,MAAA,KAAW,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAEhC,IAAA,OAAO,KAAA;AACT,EAAA,IAAI;AACF,IAAA,IAAI,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC3B,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,IAAI;AACF,QAAA,SAAA,CAAU,QAAQ,CAAA;AAClB,QAAA;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,QAAQ,CAAA,KAAM,QAAA;AAC9E,UAAA,OAAO,KAAA;AACT,QAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAC3D,QAAA,QAAA,GAAW,QAAQ,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AACA,IAAA,MAAM,YAAY,OAAA,CAAQ,YAAA,CAAa,QAAQ,CAAA,EAAG,GAAG,MAAM,CAAA;AAC3D,IAAA,OAAO,MAAA,CAAO,WAAW,OAAA,CAAQ,GAAG,KAAK,CAAC,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAAA,EACjF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;ACzIA,IAAM,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA;AAC7C,IAAM,YAAc,CAAA,CAAA,GAAA,CAAI,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AACjD,IAAM,MAAA,GAAS;AAAA,EACb,QAAA,EAAU,UAAA;AAAA,EACV,mBAAqB,CAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACvD,QAAA,EAAU;AACZ,CAAA;AACA,IAAM,eAAiB,CAAA,CAAA,YAAA,CAAa;AAAA,EAClC,GAAG,MAAA;AAAA,EACH,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,EACpC,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA;AAAA,EACxC,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,EACrC,SAAA,EAAW;AACb,CAAC,CAAA;AACD,IAAM,QAAA,GAAa,qBAAmB,MAAA,EAAQ;AAAA,EAC5C,YAAA;AAAA,EACE,CAAA,CAAA,YAAA,CAAa;AAAA,IACb,GAAG,MAAA;AAAA,IACH,IAAA,EAAQ,UAAQ,gBAAgB,CAAA;AAAA,IAChC,QAAU,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK;AAAA,GACpC;AACH,CAAC,CAAA;AAGM,SAAS,oBAAA,CAAqB,KAAA,EAAgB,GAAA,GAAM,IAAA,CAAK,KAAI,EAA4B;AAC9F,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,SAAA,CAAU,KAAK,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACpE,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,QAAQ,CAAA;AAE/C,EAAA,IACE,WAAW,GAAA,GAAM,GAAA,IAChB,UAAA,CAAW,IAAA,KAAS,yBAClB,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,KAAK,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,QAAA,CAAA;AAElF,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC5D,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,sBAAA,CACd,OACA,MAAA,EAC+B;AAC/B,EAAA,MAAM,SACH,CAAA,CAAA,YAAA,CAAa;AAAA,IACZ,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,IACpC,QAAA,EAAU,UAAA;AAAA,IACV,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,QAAU,CAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAC;AAAA,GACnD,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IACE,CAAC,MAAA,CAAO,OAAA,IACR,MAAA,CAAO,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAChC,MAAA,CAAO,IAAA,CAAK,iBAAA,KAAsB,MAAA,CAAO,iBAAA;AAEzC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAGO,SAAS,wBACd,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACiB;AAChC,EAAA,MAAM,MAAA,GACH,qBAAmB,IAAA,EAAM;AAAA,IACtB,CAAA,CAAA,YAAA,CAAa,EAAE,EAAA,EAAM,CAAA,CAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,UAAA,EAAY,cAAc,CAAA;AAAA,IAC9D,CAAA,CAAA,YAAA,CAAa;AAAA,MACb,EAAA,EAAM,UAAQ,KAAK,CAAA;AAAA,MACnB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,kBAAkB,SAAA,EAAW,gBAAA,EAAkB,eAAe,CAAC,CAAA;AAAA,MAC7E,SAAW,CAAA,CAAA,MAAA;AAAO,KACnB;AAAA,GACF,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACxE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAO,EAAE,GAAG,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,qCAAA,EAAsC;AAC7F,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,MAAA,CAAO,IAAA,CAAK,YAAY,GAAG,CAAA;AACnE,EAAA,IACE,UAAA,CAAW,IAAA,KAAS,oBAAA,IACpB,UAAA,CAAW,QAAA,KAAa,MAAA,CAAO,QAAA,IAC/B,UAAA,CAAW,gBAAA,KAAqB,MAAA,CAAO,gBAAA,IACvC,UAAA,CAAW,oBAAoB,MAAA,CAAO,iBAAA;AAEtC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAW;AAChC;AA0BO,SAAS,8BACd,QAAA,EACoB;AACpB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,IAAI,QAAQ,MAAA,GAAS,CAAA;AACnB,IAAA,OAAO,CAAA,iBAAA,EAAoB,QAAQ,MAAM,CAAA,0CAAA,CAAA;AAC3C,EAAA,MAAM,CAAC,EAAA,EAAI,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG,OAAO,UAAU,EAAE,CAAA,aAAA,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO,OAAO,UAAU,EAAE,CAAA,QAAA,EAAW,MAAM,IAAI,CAAA,0BAAA,CAAA;AAClE,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,IAAI,OAAA,KAAY,wBAAA;AACd,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,oBAAA,EAAuB,OAAA,IAAW,MAAM,CAAA,mDAAA,CAAA;AAC7D,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,YAAY,IAAA,KAAS,OAAA;AACvB,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,UAAA,EAAY,QAAQ,MAAM,CAAA,4EAAA,CAAA;AAC/D,EAAA,MAAM,MAAM,UAAA,CAAW,GAAA,GAAM,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA;AAClE,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,IAAA,KAAS,UAAA;AACvB,IAAA,OAAO,UAAU,EAAE,CAAA,sGAAA,CAAA;AACrB,EAAA,OAAO,MAAA;AACT;AClIA,IAAMA,QAAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAMC,OAAAA,GAAS,CAAC,IAAA,EAAc,IAAA,KAAiB;AAC7C,EAAA,MAAM,GAAA,GAAMC,QAAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAC/B,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAACC,UAAAA,CAAW,GAAG,CAAA;AAChE,CAAA;AACA,SAASC,WAAU,IAAA,EAAoB;AACrC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,YAAa,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtD,EAAA,MAAM,IAAA,GAAOC,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,EAAA,EAAO,MAAML,QAAAA,EAAQ;AACvF;AACA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACxD,EAAA,MAAM,IAAA,GAAOK,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,KAAA,EAAO,MAAML,QAAAA,EAAQ;AAChF,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;AAGO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,EACA,UAAA,EACA;AACA,EAAA,IAAI,CAACG,UAAAA,CAAW,OAAA,CAAQ,gBAAgB,CAAA,IAAK,CAACA,UAAAA,CAAW,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA;AAC9E,IAAA,MAAMH,QAAAA,EAAQ;AAChB,EAAAI,UAAAA,CAAU,QAAQ,gBAAgB,CAAA;AAClC,EAAA,MAAM,IAAA,GAAOE,YAAAA,CAAa,OAAA,CAAQ,gBAAgB,CAAA;AAClD,EAAA,MAAM,GAAA,GAAMA,YAAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACnC,EAAA,IAAIL,OAAAA,CAAO,MAAM,GAAG,CAAA,IAAKA,QAAO,GAAA,EAAK,IAAI,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AAC1D,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,SAAS,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,IAAK,CAACK,SAAAA,CAAU,SAAS,CAAA,CAAE,MAAA,EAAO,EAAG,MAAML,QAAAA,EAAQ;AAC3E,EAAA,MAAM,KAAA,GAAQ,WAAW,SAAS,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,KAAK,wCAAwC,CAAA;AACnD,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAE1B,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,aAAA,CAAc,MAAM,QAAA,EAAU,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,EAC3D,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,EAAM;AACZ,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC9B,CAAA,SAAE;AACA,MAAA,KAAA,CAAM,KAAA,EAAM;AAAA,IACd;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAC5B,MAAA;AAAA,MACC,KAAK,SAAA,CAAU;AAAA,QACb,MAAA,EAAQ,qBAAA;AAAA,QACR,SAAS,MAAA,CAAO,SAAA;AAAA,QAChB,QAAQ,UAAA,CAAW,QAAA;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,OAAA,EAAS,UAAA,CAAW,IAAA,KAAS,oBAAA,GAAuB,WAAW,gBAAA,GAAmB;AAAA,OACnF;AAAA,KACH,CACC,OAAO,KAAK,CAAA;AACf,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAClD,IAAAI,WAAU,KAAK,CAAA;AACf,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACjC,IAAAA,WAAU,SAAS,CAAA;AACnB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,kBAAA,EAAoB,aAAa,CAAA;AACnD,MAAA,MAAA,CAAO,KAAK,SAAA,EAAW,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,cAAc,CAAA;AAClD,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AAC9F,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,WAAA,EAAa,IAAI,CAAA;AAC3C,MAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,QAAA,IAAI,OAAA;AACJ,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,QACxC;AACA,QAAA,IACE,CAAC,OAAA,IACD,OAAO,OAAA,KAAY,QAAA,IACnB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IACrB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAAM,qBAAA,IACzC,OAAA,CAAoC,MAAA,KAAW,yBAAA,IAC/C,OAAA,CAAoC,GAAA,KAAQ,GAAA,IAC5C,OAAA,CAAoC,QAAA,KAAa,MAAA,CAAO,eAAA;AAEzD,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,MAC1C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,MAAM,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AACvF,IAAAA,WAAU,IAAI,CAAA;AACd,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,EAAGA,UAAAA,CAAU,IAAA,CAAK,IAAA,EAAM,MAAM,CAAC,CAAA;AAErF,IAAA,IAAI,CAAC,WAAA,EAAa,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAChF,MAAA,MAAMJ,QAAAA,EAAQ;AAChB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,EAAW,iBAAiB,CAAA;AACzD,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA;AAAA,QAAI,CAAC,SACvC,WAAA,CAAY,IAAA,EAAM,OAAO,IAAI,CAAA,CAAE,SAAS,MAAM;AAAA,OAChD;AAAA,MACA,GAAI,MAAA,CAAO,YAAA,GAAe,CAAC,MAAA,CAAO,YAAY,IAAI;AAAC,KACrD,CAAE,KAAK,aAAa,CAAA;AACpB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAW,kBAAkB,CAAA;AACpD,IAAA,aAAA,CAAc,WAAW,YAAA,EAAc,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClE,IAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAClC,IAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,IAAmB,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACtF,IAAA,IAAI,QAAQ,eAAA,EAAiB;AAC3B,MAAA,MAAM,MAAA,GAASM,YAAAA,CAAa,OAAA,CAAQ,eAAe,CAAA;AACnD,MAAA,IAAIL,OAAAA,CAAO,QAAQ,MAAM,CAAA,IAAKA,QAAO,MAAA,EAAQ,MAAM,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AACpE,MAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,MAAM,IAAA,GAAO,CAACO,OAAAA,EAAgB,WAAA,KAAwB;AACpD,QAAA,IAAI,EAAE,OAAA,GAAU,IAAA,EAAM,MAAMP,QAAAA,EAAQ;AACpC,QAAA,IAAIK,UAAUE,OAAM,CAAA,CAAE,cAAA,EAAe,QAASP,QAAAA,EAAQ;AACtD,QAAA,SAAA,CAAU,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtC,QAAA,KAAA,MAAW,SAAS,WAAA,CAAYO,OAAAA,EAAQ,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,UAAA,MAAM,GAAA,GAAM,IAAA,CAAKA,OAAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AACxC,UAAA,IAAI,KAAA,CAAM,cAAA,EAAe,EAAG,MAAMP,QAAAA,EAAQ;AAC1C,UAAA,IAAI,KAAA,CAAM,WAAA,EAAY,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,eACjC;AACH,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,IAAA,GAAO,IAAI,CAAA;AAC5C,YAAA,KAAA,IAAS,OAAA,CAAQ,UAAA;AACjB,YAAA,IAAI,EAAE,QAAQ,GAAA,IAAO,KAAA,GAAQ,IAAI,IAAA,GAAO,IAAA,QAAYA,QAAAA,EAAQ;AAC5D,YAAA,aAAA,CAAc,KAAK,OAAA,EAAS,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,iBAAiB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAAqB;AACvC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,IAAA,QAAYA,QAAAA,EAAQ;AACvD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAC1C,MAAA,aAAA,CAAc,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,yBAAA,EAA2B,GAAA,EAAK,QAAA,EAAU,CAAA,EAAG;AAAA,QACxF,IAAA,EAAM,GAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,UAAA,CAAW,MAAM,WAAW,CAAA;AAAA,IAC9B,CAAA;AACA,IAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,KAAiB;AAC5C,MAAA,aAAA,CAAc,SAAA,EAAW,GAAG,YAAY;;AAAA,EAAO,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClF,MAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AAAA,IACvC,CAAA;AACA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,EAAQ;AACR,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAGO,SAAS,wBAAA,CACd,OACA,IAAA,EACwB;AACxB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IACE,CAAC,KAAA,IACD,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,OAAO,UAAU,QAAQ,CAAA;AAE3F,IAAA,MAAMA,QAAAA,EAAQ;AAChB,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,IAAA;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,eAAA,EAAiB,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAAA,IACpC,cAAA,EAAgB,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAAA,IAClC,aAAA,EAAe,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,KAAK;AAAA,GAC1B;AACF","file":"chunk-PE3A6FFW.js","sourcesContent":["import { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst record = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst within = (child: string, parent: string) => {\n  const rel = relative(parent, child);\n  return rel === \"\" || (!rel.startsWith(\"../\") && rel !== \"..\" && !isAbsolute(rel));\n};\nconst hasControl = (path: string) =>\n  [...path].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);\nconst directory = (path: string) => {\n  if (!isAbsolute(path) || hasControl(path)) throw invalid();\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink()) throw invalid();\n  return realpathSync(path);\n};\n\n/** Fixed pinned-native policy. No caller-supplied profile or sandbox override is admitted. */\nexport function prepareNativePolicy(input: {\n  cwd: string;\n  privateRoot: string;\n  privateDirectory: string;\n  sandboxMode: \"read-only\" | \"workspace-write\";\n}) {\n  const cwd = directory(input.cwd);\n  const privateRoot = directory(input.privateRoot);\n  const privateDirectory = directory(input.privateDirectory);\n  if (\n    within(cwd, privateRoot) ||\n    within(privateRoot, cwd) ||\n    !within(privateDirectory, privateRoot) ||\n    privateDirectory === privateRoot ||\n    (input.sandboxMode !== \"read-only\" && input.sandboxMode !== \"workspace-write\")\n  )\n    throw invalid();\n  const stat = lstatSync(privateRoot);\n  if (stat.mode & 0o077 || (process.getuid && stat.uid !== 0 && stat.uid !== process.getuid()))\n    throw invalid();\n  const filesystem = Object.freeze({\n    [cwd]: input.sandboxMode === \"workspace-write\" ? \"write\" : \"read\",\n    [privateRoot]: \"deny\",\n  });\n  const config = Object.freeze({\n    default_permissions: \"managed\",\n    features: Object.freeze({ use_legacy_landlock: false }),\n    permissions: Object.freeze({\n      managed: Object.freeze({\n        extends: \":read-only\",\n        filesystem,\n        network: Object.freeze({ enabled: false }),\n      }),\n    }),\n  });\n  // Native -c parses TOML, not JSON objects. Quote paths as TOML basic strings.\n  const profile = `{ managed = { extends = \":read-only\", filesystem = { ${Object.entries(filesystem)\n    .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n    .join(\", \")} }, network = { enabled = false } } }`;\n  const policy = Object.freeze({\n    config,\n    cliArgs: Object.freeze([\n      \"-c\",\n      'default_permissions=\"managed\"',\n      \"-c\",\n      \"features.use_legacy_landlock=false\",\n      \"-c\",\n      `permissions=${profile}`,\n    ]),\n  });\n  prepared.set(policy, { cwd, privateRoot, writable: input.sandboxMode === \"workspace-write\" });\n  return policy;\n}\n\ntype PreparedNativePolicy = ReturnType<typeof prepareNativePolicy>;\ntype Binding = { cwd: string; privateRoot: string; writable: boolean };\nconst prepared = new WeakMap<object, Binding>();\ndeclare const admissionBrand: unique symbol;\nexport type NativeApprovalPolicy = { readonly [admissionBrand]: true };\nconst active = new WeakMap<object, Binding & { threadId: string; signal: AbortSignal }>();\n\n/** Confirms composition and native selection, not live OS isolation (G1/G2 remain required). */\nexport function activateNativeApprovalPolicy(\n  policy: PreparedNativePolicy,\n  response: unknown,\n  signal: AbortSignal,\n): NativeApprovalPolicy {\n  const binding = prepared.get(policy);\n  if (\n    !binding ||\n    signal.aborted ||\n    !record(response) ||\n    !record(response.thread) ||\n    typeof response.thread.id !== \"string\" ||\n    !response.thread.id ||\n    response.cwd !== binding.cwd ||\n    !record(response.activePermissionProfile) ||\n    response.activePermissionProfile.id !== \"managed\" ||\n    response.activePermissionProfile.extends !== \":read-only\"\n  )\n    throw invalid();\n  const token = Object.freeze({}) as NativeApprovalPolicy;\n  active.set(token, { ...binding, threadId: response.thread.id, signal });\n  return token;\n}\n\nexport function isNativeApprovalPolicyActive(\n  policy: unknown,\n  threadId: string,\n): policy is NativeApprovalPolicy {\n  if (!record(policy)) return false;\n  const binding = active.get(policy);\n  return Boolean(binding && !binding.signal.aborted && binding.threadId === threadId);\n}\n\n/** Resolve existing ancestors too, so new files cannot escape via a project symlink. */\nexport function allowsNativeApprovalPath(\n  policy: NativeApprovalPolicy | undefined,\n  path: string,\n  access: \"read\" | \"write\",\n): boolean {\n  if (!policy) return false;\n  const binding = active.get(policy);\n  if (\n    !binding ||\n    binding.signal.aborted ||\n    !isAbsolute(path) ||\n    hasControl(path) ||\n    (access !== \"read\" && access !== \"write\") ||\n    (access === \"write\" && !binding.writable)\n  )\n    return false;\n  try {\n    let existing = resolve(path);\n    const suffix: string[] = [];\n    while (true) {\n      try {\n        lstatSync(existing);\n        break;\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== \"ENOENT\" || dirname(existing) === existing)\n          return false;\n        suffix.unshift(existing.slice(dirname(existing).length + 1));\n        existing = dirname(existing);\n      }\n    }\n    const canonical = resolve(realpathSync(existing), ...suffix);\n    return within(canonical, binding.cwd) && !within(canonical, binding.privateRoot);\n  } catch {\n    return false;\n  }\n}\n","import {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseCredentialRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type {\n  CodexCredentialDelivery,\n  CodexSubscriptionRefreshInput,\n  CodexSubscriptionRefreshResult,\n} from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nconst identifier = z.string().min(1).max(4096);\nconst timestamp = z.iso.datetime({ offset: true });\nconst common = {\n  configId: identifier,\n  credentialVersion: z.number().int().nonnegative().safe(),\n  mintedAt: timestamp,\n};\nconst subscription = z.strictObject({\n  ...common,\n  kind: z.literal(\"codex-subscription\"),\n  accessToken: z.string().min(1).max(65536),\n  chatgptAccountId: identifier,\n  chatgptPlanType: identifier.optional(),\n  expiresAt: timestamp,\n});\nconst delivery = z.discriminatedUnion(\"kind\", [\n  subscription,\n  z.strictObject({\n    ...common,\n    kind: z.literal(\"openai-api-key\"),\n    apiKey: z.string().min(1).max(65536),\n  }),\n]);\n\n/** Validate credential shape and provenance without including input values in errors. */\nexport function parseCodexCredential(value: unknown, now = Date.now()): CodexCredentialDelivery {\n  const parsed = delivery.safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI credential\");\n  const credential = parsed.data;\n  const mintedAt = Date.parse(credential.mintedAt);\n  // Issuer and runtime clocks may differ slightly; expiry remains strictly unexpired.\n  if (\n    mintedAt > now + 60_000 ||\n    (credential.kind === \"codex-subscription\" &&\n      (Date.parse(credential.expiresAt) <= now || Date.parse(credential.expiresAt) <= mintedAt))\n  )\n    throw new Error(\"Invalid managed AI credential timestamps\");\n  return credential;\n}\n\n/** Validate runtime-only refresh input against the authenticated session's pinned delivery. */\nexport function parseCodexRefreshInput(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n): CodexSubscriptionRefreshInput {\n  const parsed = z\n    .strictObject({\n      kind: z.literal(\"codex-subscription\"),\n      configId: identifier,\n      credentialVersion: common.credentialVersion,\n      reason: z.enum([\"initial\", \"refresh\", \"retry-401\"]),\n    })\n    .safeParse(value);\n  if (\n    !parsed.success ||\n    parsed.data.configId !== pinned.configId ||\n    parsed.data.credentialVersion !== pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return parsed.data;\n}\n\n/** Accept refreshed subscription credentials only within the existing config/account binding. */\nexport function parseCodexRefreshResult(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n  now = Date.now(),\n): CodexSubscriptionRefreshResult {\n  const parsed = z\n    .discriminatedUnion(\"ok\", [\n      z.strictObject({ ok: z.literal(true), credential: subscription }),\n      z.strictObject({\n        ok: z.literal(false),\n        code: z.enum([\"not-configured\", \"revoked\", \"provider-error\", \"backend-error\"]),\n        message: z.string(),\n      }),\n    ])\n    .safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI refresh result\");\n  if (!parsed.data.ok) return { ...parsed.data, message: \"Managed subscription refresh failed\" };\n  const credential = parseCodexCredential(parsed.data.credential, now);\n  if (\n    credential.kind !== \"codex-subscription\" ||\n    credential.configId !== pinned.configId ||\n    credential.chatgptAccountId !== pinned.chatgptAccountId ||\n    credential.credentialVersion < pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return { ok: true, credential };\n}\n\n/**\n * The AI provider registry a managed-codex session may carry (plan §2.2).\n *\n * Managed codex runs on a platform-minted, short-lived credential that the\n * host never writes to disk and never puts in the child environment. That\n * isolation is only meaningful if the session cannot *also* be told to talk\n * somewhere else, or to pick a credential up from the environment. Restated\n * on the registry, the admissible shape is exactly one enabled `llm` entry,\n * on codex's own OpenAI surface, whose credential is a platform-injected\n * `oauth` reference. A second entry, a different surface, or an `env:` /\n * `cmd:` / `keyring:` reference is an invalid AI profile.\n *\n * `surface` is read literally — no catalog-preset fallback. No preset\n * declares `openai-codex-responses`, so a preset-shaped entry reaching here\n * is a mis-provisioned session, not a terse one.\n *\n * An absent or empty registry is *not* a violation: nothing was configured,\n * and the credential the platform minted is the only one the session has.\n * Every configured entry is judged, whichever layer it came from — the\n * control-plane session layer, the user/workspace `providers.yml` files, or\n * a runtime override.\n *\n * @returns the reason the registry is inadmissible, or `undefined` when it is.\n */\nexport function managedCodexRegistryViolation(\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined,\n): string | undefined {\n  if (!registry) return undefined;\n  const entries = registryEntries(registry);\n  if (entries.length === 0) return undefined;\n  if (entries.length > 1)\n    return `registry carries ${entries.length} entries; managed codex admits exactly one`;\n  const [id, entry] = entries[0];\n  if (!isEntryEnabled(entry)) return `entry '${id}' is disabled`;\n  if (entry.kind !== \"llm\") return `entry '${id}' is a '${entry.kind}' endpoint, not an llm one`;\n  const surface = (entry as AIProviderLlmEntry).surface;\n  if (surface !== \"openai-codex-responses\")\n    return `entry '${id}' declares surface '${surface ?? \"none\"}'; managed codex admits only openai-codex-responses`;\n  const credential = entry.credential;\n  if (credential?.kind !== \"oauth\")\n    return `entry '${id}' carries a '${credential?.kind ?? \"none\"}' credential; managed codex admits only a platform-injected oauth credential`;\n  const ref = credential.ref ? parseCredentialRef(credential.ref) : undefined;\n  if (!ref || ref.form !== \"platform\")\n    return `entry '${id}' resolves its credential outside the control plane; managed codex admits only a 'platform:' reference`;\n  return undefined;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  chmodSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { isAbsolute, join, relative } from \"node:path\";\nimport { openSqlite } from \"../../../core/src/logging/sinks/sqlite-runtime.js\";\nimport type { CodexCredentialDelivery } from \"@skaile/workspaces/types\";\nimport type { AgentConfig, CodexManagedRuntimeOptions } from \"../types.js\";\n\nimport { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from \"./native-state.js\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst within = (path: string, root: string) => {\n  const rel = relative(root, path);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n};\nfunction directory(path: string): void {\n  if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 0o077) throw invalid();\n}\nfunction readRegular(path: string, limit: number): Buffer {\n  const stat = lstatSync(path);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw invalid();\n  return readFileSync(path);\n}\n\n/** Session-owned state lock and account-bound native resume metadata; never stores credentials. */\nexport function prepareCodexInstance(\n  config: AgentConfig,\n  options: CodexManagedRuntimeOptions,\n  credential: CodexCredentialDelivery,\n) {\n  if (!isAbsolute(options.privateDirectory) || !isAbsolute(config.cwd) || !config.sessionId)\n    throw invalid();\n  directory(options.privateDirectory);\n  const root = realpathSync(options.privateDirectory);\n  const cwd = realpathSync(config.cwd);\n  if (within(root, cwd) || within(cwd, root)) throw invalid();\n  const lock = join(root, \".active\");\n  const leasePath = join(root, \"lease.db\");\n  if (existsSync(leasePath) && !lstatSync(leasePath).isFile()) throw invalid();\n  const lease = openSqlite(leasePath);\n  try {\n    lease.exec(\"PRAGMA busy_timeout=0; BEGIN EXCLUSIVE\");\n    chmodSync(leasePath, 0o600);\n    // The OS releases the database lease on crashes; this marker never owns the lock.\n    rmSync(lock, { force: true });\n    writeFileSync(lock, \"active\", { flag: \"wx\", mode: 0o600 });\n  } catch (error) {\n    lease.close();\n    throw error;\n  }\n  let released = false;\n  const release = () => {\n    if (released) return;\n    released = true;\n    try {\n      rmSync(lock, { force: true });\n    } finally {\n      lease.close();\n    }\n  };\n  try {\n    const key = createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          driver: \"codex-app-server-v1\",\n          session: config.sessionId,\n          config: credential.configId,\n          kind: credential.kind,\n          account: credential.kind === \"codex-subscription\" ? credential.chatgptAccountId : null,\n        }),\n      )\n      .digest(\"hex\");\n    const slots = join(root, CODEX_NATIVE_STATE_FORMAT);\n    directory(slots);\n    const stateRoot = join(slots, key);\n    directory(stateRoot);\n    for (const name of [\"instructions.new\", \"binding.new\"])\n      rmSync(join(stateRoot, name), { force: true });\n    const bindingPath = join(stateRoot, \"binding.json\");\n    if (config.resumeSessionId && !existsSync(bindingPath)) throw new CodexNativeStateUnavailable();\n    if (existsSync(bindingPath)) {\n      // Filesystem authority failures (including symlinks) are fatal, not missing state.\n      const bytes = readRegular(bindingPath, 4096);\n      if (config.resumeSessionId) {\n        let binding: unknown;\n        try {\n          binding = JSON.parse(bytes.toString(\"utf8\"));\n        } catch {\n          throw new CodexNativeStateUnavailable();\n        }\n        if (\n          !binding ||\n          typeof binding !== \"object\" ||\n          Array.isArray(binding) ||\n          Object.keys(binding).sort().join(\",\") !== \"format,key,threadId\" ||\n          (binding as Record<string, unknown>).format !== CODEX_NATIVE_STATE_FORMAT ||\n          (binding as Record<string, unknown>).key !== key ||\n          (binding as Record<string, unknown>).threadId !== config.resumeSessionId\n        )\n          throw new CodexNativeStateUnavailable();\n      }\n    }\n    const home = join(stateRoot, \"home\");\n    if (config.resumeSessionId && !existsSync(home)) throw new CodexNativeStateUnavailable();\n    directory(home);\n    for (const subdir of [\"config\", \"cache\", \"data\", \"tmp\"]) directory(join(home, subdir));\n    // Auth persistence is forbidden even if a previous external process left a carrier here.\n    if ([\"auth.json\", \".credentials.json\"].some((name) => existsSync(join(home, name))))\n      throw invalid();\n    const instructionFile = join(stateRoot, \"instructions.md\");\n    const instructions = [\n      ...(options.instructionFiles ?? []).map((path) =>\n        readRegular(path, 1024 * 1024).toString(\"utf8\"),\n      ),\n      ...(config.systemPrompt ? [config.systemPrompt] : []),\n    ].join(\"\\n\\n---\\n\\n\");\n    const temporary = join(stateRoot, \"instructions.new\");\n    writeFileSync(temporary, instructions, { mode: 0o600, flag: \"wx\" });\n    renameSync(temporary, instructionFile);\n    const target = join(home, \"skills\");\n    if (!options.skillsDirectory && existsSync(target)) rmSync(target, { recursive: true });\n    if (options.skillsDirectory) {\n      const source = realpathSync(options.skillsDirectory);\n      if (within(target, source) || within(source, target)) throw invalid();\n      if (existsSync(target)) rmSync(target, { recursive: true });\n      let files = 0;\n      let entries = 0;\n      let bytes = 0;\n      const copy = (source: string, destination: string) => {\n        if (++entries > 1024) throw invalid();\n        if (lstatSync(source).isSymbolicLink()) throw invalid();\n        mkdirSync(destination, { mode: 0o700 });\n        for (const entry of readdirSync(source, { withFileTypes: true })) {\n          const src = join(source, entry.name);\n          const dst = join(destination, entry.name);\n          if (entry.isSymbolicLink()) throw invalid();\n          if (entry.isDirectory()) copy(src, dst);\n          else {\n            const content = readRegular(src, 1024 * 1024);\n            bytes += content.byteLength;\n            if (++files > 512 || bytes > 8 * 1024 * 1024) throw invalid();\n            writeFileSync(dst, content, { mode: 0o600, flag: \"wx\" });\n          }\n        }\n      };\n      copy(options.skillsDirectory, target);\n    }\n    const bindThread = (threadId: string) => {\n      if (!threadId || threadId.length > 4096) throw invalid();\n      const next = join(stateRoot, \"binding.new\");\n      writeFileSync(next, JSON.stringify({ format: CODEX_NATIVE_STATE_FORMAT, key, threadId }), {\n        mode: 0o600,\n        flag: \"wx\",\n      });\n      renameSync(next, bindingPath);\n    };\n    const setToolInstructions = (text: string) => {\n      writeFileSync(temporary, `${instructions}\\n\\n${text}`, { mode: 0o600, flag: \"wx\" });\n      renameSync(temporary, instructionFile);\n    };\n    return {\n      root,\n      stateRoot,\n      cwd,\n      home,\n      instructionFile,\n      bindThread,\n      release,\n      setToolInstructions,\n    };\n  } catch (error) {\n    release();\n    throw error;\n  }\n}\n\n/** A replacement environment; managed auth never reads or mutates ambient process.env. */\nexport function codexInstanceEnvironment(\n  input: Record<string, string>,\n  home: string,\n): Record<string, string> {\n  const allowed = new Set([\n    \"PATH\",\n    \"LANG\",\n    \"LC_ALL\",\n    \"TZ\",\n    \"SSL_CERT_FILE\",\n    \"SSL_CERT_DIR\",\n    \"HTTPS_PROXY\",\n    \"HTTP_PROXY\",\n    \"NO_PROXY\",\n  ]);\n  if (\n    !input ||\n    Object.entries(input).some(([key, value]) => !allowed.has(key) || typeof value !== \"string\")\n  )\n    throw invalid();\n  return {\n    ...input,\n    HOME: home,\n    CODEX_HOME: home,\n    XDG_CONFIG_HOME: join(home, \"config\"),\n    XDG_CACHE_HOME: join(home, \"cache\"),\n    XDG_DATA_HOME: join(home, \"data\"),\n    TMPDIR: join(home, \"tmp\"),\n  };\n}\n"]}
+{"version":3,"sources":["../bridge/src/codex/native-policy.ts","../bridge/src/codex/credentials.ts","../bridge/src/codex/instance-state.ts"],"names":["invalid","within","relative","isAbsolute","directory","lstatSync","realpathSync","source"],"mappings":";;;;;;;;AAGA,IAAM,OAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE,IAAM,MAAA,GAAS,CAAC,KAAA,EAAe,MAAA,KAAmB;AAChD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,EAAQ,KAAK,CAAA;AAClC,EAAA,OAAO,GAAA,KAAQ,EAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,IAAK,GAAA,KAAQ,IAAA,IAAQ,CAAC,UAAA,CAAW,GAAG,CAAA;AACjF,CAAA;AACA,IAAM,aAAa,CAAC,IAAA,KAClB,CAAC,GAAG,IAAI,EAAE,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA,IAAM,UAAU,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC/F,IAAM,SAAA,GAAY,CAAC,IAAA,KAAiB;AAClC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,IAAK,WAAW,IAAI,CAAA,QAAS,OAAA,EAAQ;AACzD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,WAAA,EAAY,IAAK,KAAK,cAAA,EAAe,QAAS,OAAA,EAAQ;AAChE,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B,CAAA;AAGO,SAAS,oBAAoB,KAAA,EAKjC;AACD,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,SAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,SAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA;AACzD,EAAA,IACE,OAAO,GAAA,EAAK,WAAW,KACvB,MAAA,CAAO,WAAA,EAAa,GAAG,CAAA,IACvB,CAAC,OAAO,gBAAA,EAAkB,WAAW,KACrC,gBAAA,KAAqB,WAAA,IACpB,MAAM,WAAA,KAAgB,WAAA,IAAe,MAAM,WAAA,KAAgB,iBAAA;AAE5D,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,IAAA,GAAO,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,IAAA,GAAO,EAAA,IAAU,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,GAAA,KAAQ,CAAA,IAAK,IAAA,CAAK,GAAA,KAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,CAAC,GAAG,GAAG,KAAA,CAAM,WAAA,KAAgB,oBAAoB,OAAA,GAAU,MAAA;AAAA,IAC3D,CAAC,WAAW,GAAG;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,mBAAA,EAAqB,SAAA;AAAA,IACrB,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAAA,IACtD,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,MACzB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,QACrB,OAAA,EAAS,YAAA;AAAA,QACT,UAAA;AAAA,QACA,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,OAAO;AAAA,OAC1C;AAAA,KACF;AAAA,GACF,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,CAAA,qDAAA,EAAwD,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAC9F,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA,CAC7E,IAAA,CAAK,IAAI,CAAC,CAAA,qCAAA,CAAA;AACb,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,MACrB,IAAA;AAAA,MACA,+BAAA;AAAA,MACA,IAAA;AAAA,MACA,oCAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAe,OAAO,CAAA;AAAA,KACvB;AAAA,GACF,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,EAAE,GAAA,EAAK,aAAa,QAAA,EAAU,KAAA,CAAM,WAAA,KAAgB,iBAAA,EAAmB,CAAA;AAC5F,EAAA,OAAO,MAAA;AACT;AAIA,IAAM,QAAA,uBAAe,OAAA,EAAyB;AAG9C,IAAM,MAAA,uBAAa,OAAA,EAAqE;AAGjF,SAAS,4BAAA,CACd,MAAA,EACA,QAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IACE,CAAC,OAAA,IACD,MAAA,CAAO,OAAA,IACP,CAAC,OAAO,QAAQ,CAAA,IAChB,CAAC,MAAA,CAAO,SAAS,MAAM,CAAA,IACvB,OAAO,QAAA,CAAS,OAAO,EAAA,KAAO,QAAA,IAC9B,CAAC,QAAA,CAAS,OAAO,EAAA,IACjB,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,OACzB,CAAC,MAAA,CAAO,QAAA,CAAS,uBAAuB,KACxC,QAAA,CAAS,uBAAA,CAAwB,OAAO,SAAA,IACxC,QAAA,CAAS,wBAAwB,OAAA,KAAY,YAAA;AAE7C,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC9B,EAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,UAAU,QAAA,CAAS,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAAA,CACd,QACA,QAAA,EACgC;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,WAAW,CAAC,OAAA,CAAQ,OAAO,OAAA,IAAW,OAAA,CAAQ,aAAa,QAAQ,CAAA;AACpF;AAGO,SAAS,wBAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IACE,CAAC,OAAA,IACD,OAAA,CAAQ,OAAO,OAAA,IACf,CAAC,WAAW,IAAI,CAAA,IAChB,WAAW,IAAI,CAAA,IACd,WAAW,MAAA,IAAU,MAAA,KAAW,WAChC,MAAA,KAAW,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAEhC,IAAA,OAAO,KAAA;AACT,EAAA,IAAI;AACF,IAAA,IAAI,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC3B,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,IAAI;AACF,QAAA,SAAA,CAAU,QAAQ,CAAA;AAClB,QAAA;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,QAAQ,CAAA,KAAM,QAAA;AAC9E,UAAA,OAAO,KAAA;AACT,QAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAC3D,QAAA,QAAA,GAAW,QAAQ,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AACA,IAAA,MAAM,YAAY,OAAA,CAAQ,YAAA,CAAa,QAAQ,CAAA,EAAG,GAAG,MAAM,CAAA;AAC3D,IAAA,OAAO,MAAA,CAAO,WAAW,OAAA,CAAQ,GAAG,KAAK,CAAC,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAAA,EACjF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;ACzIA,IAAM,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA;AAC7C,IAAM,YAAc,CAAA,CAAA,GAAA,CAAI,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AACjD,IAAM,MAAA,GAAS;AAAA,EACb,QAAA,EAAU,UAAA;AAAA,EACV,mBAAqB,CAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACvD,QAAA,EAAU;AACZ,CAAA;AACA,IAAM,eAAiB,CAAA,CAAA,YAAA,CAAa;AAAA,EAClC,GAAG,MAAA;AAAA,EACH,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,EACpC,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA;AAAA,EACxC,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,EACrC,SAAA,EAAW;AACb,CAAC,CAAA;AACD,IAAM,QAAA,GAAa,qBAAmB,MAAA,EAAQ;AAAA,EAC5C,YAAA;AAAA,EACE,CAAA,CAAA,YAAA,CAAa;AAAA,IACb,GAAG,MAAA;AAAA,IACH,IAAA,EAAQ,UAAQ,gBAAgB,CAAA;AAAA,IAChC,QAAU,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK;AAAA,GACpC;AACH,CAAC,CAAA;AAGM,SAAS,oBAAA,CAAqB,KAAA,EAAgB,GAAA,GAAM,IAAA,CAAK,KAAI,EAA4B;AAC9F,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,SAAA,CAAU,KAAK,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACpE,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,QAAQ,CAAA;AAE/C,EAAA,IACE,WAAW,GAAA,GAAM,GAAA,IAChB,UAAA,CAAW,IAAA,KAAS,yBAClB,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,KAAK,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,QAAA,CAAA;AAElF,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC5D,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,sBAAA,CACd,OACA,MAAA,EAC+B;AAC/B,EAAA,MAAM,SACH,CAAA,CAAA,YAAA,CAAa;AAAA,IACZ,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,IACpC,QAAA,EAAU,UAAA;AAAA,IACV,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,QAAU,CAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAC;AAAA,GACnD,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IACE,CAAC,MAAA,CAAO,OAAA,IACR,MAAA,CAAO,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAChC,MAAA,CAAO,IAAA,CAAK,iBAAA,KAAsB,MAAA,CAAO,iBAAA;AAEzC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAGO,SAAS,wBACd,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACiB;AAChC,EAAA,MAAM,MAAA,GACH,qBAAmB,IAAA,EAAM;AAAA,IACtB,CAAA,CAAA,YAAA,CAAa,EAAE,EAAA,EAAM,CAAA,CAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,UAAA,EAAY,cAAc,CAAA;AAAA,IAC9D,CAAA,CAAA,YAAA,CAAa;AAAA,MACb,EAAA,EAAM,UAAQ,KAAK,CAAA;AAAA,MACnB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,kBAAkB,SAAA,EAAW,gBAAA,EAAkB,eAAe,CAAC,CAAA;AAAA,MAC7E,SAAW,CAAA,CAAA,MAAA;AAAO,KACnB;AAAA,GACF,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACxE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAO,EAAE,GAAG,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,qCAAA,EAAsC;AAC7F,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,MAAA,CAAO,IAAA,CAAK,YAAY,GAAG,CAAA;AACnE,EAAA,IACE,UAAA,CAAW,IAAA,KAAS,oBAAA,IACpB,UAAA,CAAW,QAAA,KAAa,MAAA,CAAO,QAAA,IAC/B,UAAA,CAAW,gBAAA,KAAqB,MAAA,CAAO,gBAAA,IACvC,UAAA,CAAW,oBAAoB,MAAA,CAAO,iBAAA;AAEtC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAW;AAChC;AA0BO,SAAS,8BACd,QAAA,EACoB;AACpB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,IAAI,QAAQ,MAAA,GAAS,CAAA;AACnB,IAAA,OAAO,CAAA,iBAAA,EAAoB,QAAQ,MAAM,CAAA,0CAAA,CAAA;AAC3C,EAAA,MAAM,CAAC,EAAA,EAAI,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG,OAAO,UAAU,EAAE,CAAA,aAAA,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO,OAAO,UAAU,EAAE,CAAA,QAAA,EAAW,MAAM,IAAI,CAAA,0BAAA,CAAA;AAClE,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,IAAI,OAAA,KAAY,wBAAA;AACd,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,oBAAA,EAAuB,OAAA,IAAW,MAAM,CAAA,mDAAA,CAAA;AAC7D,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,YAAY,IAAA,KAAS,OAAA;AACvB,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,UAAA,EAAY,QAAQ,MAAM,CAAA,4EAAA,CAAA;AAC/D,EAAA,MAAM,MAAM,UAAA,CAAW,GAAA,GAAM,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA;AAClE,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,IAAA,KAAS,UAAA;AACvB,IAAA,OAAO,UAAU,EAAE,CAAA,sGAAA,CAAA;AACrB,EAAA,OAAO,MAAA;AACT;AClIA,IAAMA,QAAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAMC,OAAAA,GAAS,CAAC,IAAA,EAAc,IAAA,KAAiB;AAC7C,EAAA,MAAM,GAAA,GAAMC,QAAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAC/B,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAACC,UAAAA,CAAW,GAAG,CAAA;AAChE,CAAA;AACA,SAASC,WAAU,IAAA,EAAoB;AACrC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,YAAa,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtD,EAAA,MAAM,IAAA,GAAOC,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,EAAA,EAAO,MAAML,QAAAA,EAAQ;AACvF;AACA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACxD,EAAA,MAAM,IAAA,GAAOK,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,KAAA,EAAO,MAAML,QAAAA,EAAQ;AAChF,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;AAGO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,EACA,UAAA,EACA;AACA,EAAA,IAAI,CAACG,UAAAA,CAAW,OAAA,CAAQ,gBAAgB,CAAA,IAAK,CAACA,UAAAA,CAAW,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA;AAC9E,IAAA,MAAMH,QAAAA,EAAQ;AAChB,EAAAI,UAAAA,CAAU,QAAQ,gBAAgB,CAAA;AAClC,EAAA,MAAM,IAAA,GAAOE,YAAAA,CAAa,OAAA,CAAQ,gBAAgB,CAAA;AAClD,EAAA,MAAM,GAAA,GAAMA,YAAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACnC,EAAA,IAAIL,OAAAA,CAAO,MAAM,GAAG,CAAA,IAAKA,QAAO,GAAA,EAAK,IAAI,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AAC1D,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,SAAS,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,IAAK,CAACK,SAAAA,CAAU,SAAS,CAAA,CAAE,MAAA,EAAO,EAAG,MAAML,QAAAA,EAAQ;AAC3E,EAAA,MAAM,KAAA,GAAQ,WAAW,SAAS,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,KAAK,wCAAwC,CAAA;AACnD,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAE1B,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,aAAA,CAAc,MAAM,QAAA,EAAU,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,EAC3D,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,EAAM;AACZ,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC9B,CAAA,SAAE;AACA,MAAA,KAAA,CAAM,KAAA,EAAM;AAAA,IACd;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAC5B,MAAA;AAAA,MACC,KAAK,SAAA,CAAU;AAAA,QACb,MAAA,EAAQ,qBAAA;AAAA,QACR,SAAS,MAAA,CAAO,SAAA;AAAA,QAChB,QAAQ,UAAA,CAAW,QAAA;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,OAAA,EAAS,UAAA,CAAW,IAAA,KAAS,oBAAA,GAAuB,WAAW,gBAAA,GAAmB;AAAA,OACnF;AAAA,KACH,CACC,OAAO,KAAK,CAAA;AACf,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAClD,IAAAI,WAAU,KAAK,CAAA;AACf,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACjC,IAAAA,WAAU,SAAS,CAAA;AACnB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,kBAAA,EAAoB,aAAa,CAAA;AACnD,MAAA,MAAA,CAAO,KAAK,SAAA,EAAW,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,cAAc,CAAA;AAClD,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AAC9F,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,WAAA,EAAa,IAAI,CAAA;AAC3C,MAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,QAAA,IAAI,OAAA;AACJ,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,QACxC;AACA,QAAA,IACE,CAAC,OAAA,IACD,OAAO,OAAA,KAAY,QAAA,IACnB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IACrB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAAM,qBAAA,IACzC,OAAA,CAAoC,MAAA,KAAW,yBAAA,IAC/C,OAAA,CAAoC,GAAA,KAAQ,GAAA,IAC5C,OAAA,CAAoC,QAAA,KAAa,MAAA,CAAO,eAAA;AAEzD,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,MAC1C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,MAAM,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AACvF,IAAAA,WAAU,IAAI,CAAA;AACd,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,EAAGA,UAAAA,CAAU,IAAA,CAAK,IAAA,EAAM,MAAM,CAAC,CAAA;AAErF,IAAA,IAAI,CAAC,WAAA,EAAa,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAChF,MAAA,MAAMJ,QAAAA,EAAQ;AAChB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,EAAW,iBAAiB,CAAA;AACzD,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA;AAAA,QAAI,CAAC,SACvC,WAAA,CAAY,IAAA,EAAM,OAAO,IAAI,CAAA,CAAE,SAAS,MAAM;AAAA,OAChD;AAAA,MACA,GAAI,MAAA,CAAO,YAAA,GAAe,CAAC,MAAA,CAAO,YAAY,IAAI;AAAC,KACrD,CAAE,KAAK,aAAa,CAAA;AACpB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAW,kBAAkB,CAAA;AACpD,IAAA,aAAA,CAAc,WAAW,YAAA,EAAc,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClE,IAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAClC,IAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,IAAmB,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACtF,IAAA,IAAI,QAAQ,eAAA,EAAiB;AAC3B,MAAA,MAAM,MAAA,GAASM,YAAAA,CAAa,OAAA,CAAQ,eAAe,CAAA;AACnD,MAAA,IAAIL,OAAAA,CAAO,QAAQ,MAAM,CAAA,IAAKA,QAAO,MAAA,EAAQ,MAAM,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AACpE,MAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,MAAM,IAAA,GAAO,CAACO,OAAAA,EAAgB,WAAA,KAAwB;AACpD,QAAA,IAAI,EAAE,OAAA,GAAU,IAAA,EAAM,MAAMP,QAAAA,EAAQ;AACpC,QAAA,IAAIK,UAAUE,OAAM,CAAA,CAAE,cAAA,EAAe,QAASP,QAAAA,EAAQ;AACtD,QAAA,SAAA,CAAU,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtC,QAAA,KAAA,MAAW,SAAS,WAAA,CAAYO,OAAAA,EAAQ,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,UAAA,MAAM,GAAA,GAAM,IAAA,CAAKA,OAAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AACxC,UAAA,IAAI,KAAA,CAAM,cAAA,EAAe,EAAG,MAAMP,QAAAA,EAAQ;AAC1C,UAAA,IAAI,KAAA,CAAM,WAAA,EAAY,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,eACjC;AACH,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,IAAA,GAAO,IAAI,CAAA;AAC5C,YAAA,KAAA,IAAS,OAAA,CAAQ,UAAA;AACjB,YAAA,IAAI,EAAE,QAAQ,GAAA,IAAO,KAAA,GAAQ,IAAI,IAAA,GAAO,IAAA,QAAYA,QAAAA,EAAQ;AAC5D,YAAA,aAAA,CAAc,KAAK,OAAA,EAAS,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,iBAAiB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAAqB;AACvC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,IAAA,QAAYA,QAAAA,EAAQ;AACvD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAC1C,MAAA,aAAA,CAAc,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,yBAAA,EAA2B,GAAA,EAAK,QAAA,EAAU,CAAA,EAAG;AAAA,QACxF,IAAA,EAAM,GAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,UAAA,CAAW,MAAM,WAAW,CAAA;AAAA,IAC9B,CAAA;AACA,IAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,KAAiB;AAC5C,MAAA,aAAA,CAAc,SAAA,EAAW,GAAG,YAAY;;AAAA,EAAO,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClF,MAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AAAA,IACvC,CAAA;AACA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,EAAQ;AACR,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAGO,SAAS,wBAAA,CACd,OACA,IAAA,EACwB;AACxB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IACE,CAAC,KAAA,IACD,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,OAAO,UAAU,QAAQ,CAAA;AAE3F,IAAA,MAAMA,QAAAA,EAAQ;AAChB,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,IAAA;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,eAAA,EAAiB,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAAA,IACpC,cAAA,EAAgB,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAAA,IAClC,aAAA,EAAe,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,KAAK;AAAA,GAC1B;AACF","file":"chunk-HCYS7GFP.js","sourcesContent":["import { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst record = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst within = (child: string, parent: string) => {\n  const rel = relative(parent, child);\n  return rel === \"\" || (!rel.startsWith(\"../\") && rel !== \"..\" && !isAbsolute(rel));\n};\nconst hasControl = (path: string) =>\n  [...path].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);\nconst directory = (path: string) => {\n  if (!isAbsolute(path) || hasControl(path)) throw invalid();\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink()) throw invalid();\n  return realpathSync(path);\n};\n\n/** Fixed pinned-native policy. No caller-supplied profile or sandbox override is admitted. */\nexport function prepareNativePolicy(input: {\n  cwd: string;\n  privateRoot: string;\n  privateDirectory: string;\n  sandboxMode: \"read-only\" | \"workspace-write\";\n}) {\n  const cwd = directory(input.cwd);\n  const privateRoot = directory(input.privateRoot);\n  const privateDirectory = directory(input.privateDirectory);\n  if (\n    within(cwd, privateRoot) ||\n    within(privateRoot, cwd) ||\n    !within(privateDirectory, privateRoot) ||\n    privateDirectory === privateRoot ||\n    (input.sandboxMode !== \"read-only\" && input.sandboxMode !== \"workspace-write\")\n  )\n    throw invalid();\n  const stat = lstatSync(privateRoot);\n  if (stat.mode & 0o077 || (process.getuid && stat.uid !== 0 && stat.uid !== process.getuid()))\n    throw invalid();\n  const filesystem = Object.freeze({\n    [cwd]: input.sandboxMode === \"workspace-write\" ? \"write\" : \"read\",\n    [privateRoot]: \"deny\",\n  });\n  const config = Object.freeze({\n    default_permissions: \"managed\",\n    features: Object.freeze({ use_legacy_landlock: false }),\n    permissions: Object.freeze({\n      managed: Object.freeze({\n        extends: \":read-only\",\n        filesystem,\n        network: Object.freeze({ enabled: false }),\n      }),\n    }),\n  });\n  // Native -c parses TOML, not JSON objects. Quote paths as TOML basic strings.\n  const profile = `{ managed = { extends = \":read-only\", filesystem = { ${Object.entries(filesystem)\n    .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n    .join(\", \")} }, network = { enabled = false } } }`;\n  const policy = Object.freeze({\n    config,\n    cliArgs: Object.freeze([\n      \"-c\",\n      'default_permissions=\"managed\"',\n      \"-c\",\n      \"features.use_legacy_landlock=false\",\n      \"-c\",\n      `permissions=${profile}`,\n    ]),\n  });\n  prepared.set(policy, { cwd, privateRoot, writable: input.sandboxMode === \"workspace-write\" });\n  return policy;\n}\n\ntype PreparedNativePolicy = ReturnType<typeof prepareNativePolicy>;\ntype Binding = { cwd: string; privateRoot: string; writable: boolean };\nconst prepared = new WeakMap<object, Binding>();\ndeclare const admissionBrand: unique symbol;\nexport type NativeApprovalPolicy = { readonly [admissionBrand]: true };\nconst active = new WeakMap<object, Binding & { threadId: string; signal: AbortSignal }>();\n\n/** Confirms composition and native selection, not live OS isolation (G1/G2 remain required). */\nexport function activateNativeApprovalPolicy(\n  policy: PreparedNativePolicy,\n  response: unknown,\n  signal: AbortSignal,\n): NativeApprovalPolicy {\n  const binding = prepared.get(policy);\n  if (\n    !binding ||\n    signal.aborted ||\n    !record(response) ||\n    !record(response.thread) ||\n    typeof response.thread.id !== \"string\" ||\n    !response.thread.id ||\n    response.cwd !== binding.cwd ||\n    !record(response.activePermissionProfile) ||\n    response.activePermissionProfile.id !== \"managed\" ||\n    response.activePermissionProfile.extends !== \":read-only\"\n  )\n    throw invalid();\n  const token = Object.freeze({}) as NativeApprovalPolicy;\n  active.set(token, { ...binding, threadId: response.thread.id, signal });\n  return token;\n}\n\nexport function isNativeApprovalPolicyActive(\n  policy: unknown,\n  threadId: string,\n): policy is NativeApprovalPolicy {\n  if (!record(policy)) return false;\n  const binding = active.get(policy);\n  return Boolean(binding && !binding.signal.aborted && binding.threadId === threadId);\n}\n\n/** Resolve existing ancestors too, so new files cannot escape via a project symlink. */\nexport function allowsNativeApprovalPath(\n  policy: NativeApprovalPolicy | undefined,\n  path: string,\n  access: \"read\" | \"write\",\n): boolean {\n  if (!policy) return false;\n  const binding = active.get(policy);\n  if (\n    !binding ||\n    binding.signal.aborted ||\n    !isAbsolute(path) ||\n    hasControl(path) ||\n    (access !== \"read\" && access !== \"write\") ||\n    (access === \"write\" && !binding.writable)\n  )\n    return false;\n  try {\n    let existing = resolve(path);\n    const suffix: string[] = [];\n    while (true) {\n      try {\n        lstatSync(existing);\n        break;\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== \"ENOENT\" || dirname(existing) === existing)\n          return false;\n        suffix.unshift(existing.slice(dirname(existing).length + 1));\n        existing = dirname(existing);\n      }\n    }\n    const canonical = resolve(realpathSync(existing), ...suffix);\n    return within(canonical, binding.cwd) && !within(canonical, binding.privateRoot);\n  } catch {\n    return false;\n  }\n}\n","import {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseCredentialRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type {\n  CodexCredentialDelivery,\n  CodexSubscriptionRefreshInput,\n  CodexSubscriptionRefreshResult,\n} from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nconst identifier = z.string().min(1).max(4096);\nconst timestamp = z.iso.datetime({ offset: true });\nconst common = {\n  configId: identifier,\n  credentialVersion: z.number().int().nonnegative().safe(),\n  mintedAt: timestamp,\n};\nconst subscription = z.strictObject({\n  ...common,\n  kind: z.literal(\"codex-subscription\"),\n  accessToken: z.string().min(1).max(65536),\n  chatgptAccountId: identifier,\n  chatgptPlanType: identifier.optional(),\n  expiresAt: timestamp,\n});\nconst delivery = z.discriminatedUnion(\"kind\", [\n  subscription,\n  z.strictObject({\n    ...common,\n    kind: z.literal(\"openai-api-key\"),\n    apiKey: z.string().min(1).max(65536),\n  }),\n]);\n\n/** Validate credential shape and provenance without including input values in errors. */\nexport function parseCodexCredential(value: unknown, now = Date.now()): CodexCredentialDelivery {\n  const parsed = delivery.safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI credential\");\n  const credential = parsed.data;\n  const mintedAt = Date.parse(credential.mintedAt);\n  // Issuer and runtime clocks may differ slightly; expiry remains strictly unexpired.\n  if (\n    mintedAt > now + 60_000 ||\n    (credential.kind === \"codex-subscription\" &&\n      (Date.parse(credential.expiresAt) <= now || Date.parse(credential.expiresAt) <= mintedAt))\n  )\n    throw new Error(\"Invalid managed AI credential timestamps\");\n  return credential;\n}\n\n/** Validate runtime-only refresh input against the authenticated session's pinned delivery. */\nexport function parseCodexRefreshInput(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n): CodexSubscriptionRefreshInput {\n  const parsed = z\n    .strictObject({\n      kind: z.literal(\"codex-subscription\"),\n      configId: identifier,\n      credentialVersion: common.credentialVersion,\n      reason: z.enum([\"initial\", \"refresh\", \"retry-401\"]),\n    })\n    .safeParse(value);\n  if (\n    !parsed.success ||\n    parsed.data.configId !== pinned.configId ||\n    parsed.data.credentialVersion !== pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return parsed.data;\n}\n\n/** Accept refreshed subscription credentials only within the existing config/account binding. */\nexport function parseCodexRefreshResult(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n  now = Date.now(),\n): CodexSubscriptionRefreshResult {\n  const parsed = z\n    .discriminatedUnion(\"ok\", [\n      z.strictObject({ ok: z.literal(true), credential: subscription }),\n      z.strictObject({\n        ok: z.literal(false),\n        code: z.enum([\"not-configured\", \"revoked\", \"provider-error\", \"backend-error\"]),\n        message: z.string(),\n      }),\n    ])\n    .safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI refresh result\");\n  if (!parsed.data.ok) return { ...parsed.data, message: \"Managed subscription refresh failed\" };\n  const credential = parseCodexCredential(parsed.data.credential, now);\n  if (\n    credential.kind !== \"codex-subscription\" ||\n    credential.configId !== pinned.configId ||\n    credential.chatgptAccountId !== pinned.chatgptAccountId ||\n    credential.credentialVersion < pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return { ok: true, credential };\n}\n\n/**\n * The AI provider registry a managed-codex session may carry (plan §2.2).\n *\n * Managed codex runs on a platform-minted, short-lived credential that the\n * host never writes to disk and never puts in the child environment. That\n * isolation is only meaningful if the session cannot *also* be told to talk\n * somewhere else, or to pick a credential up from the environment. Restated\n * on the registry, the admissible shape is exactly one enabled `llm` entry,\n * on codex's own OpenAI surface, whose credential is a platform-injected\n * `oauth` reference. A second entry, a different surface, or an `env:` /\n * `cmd:` / `keyring:` reference is an invalid AI profile.\n *\n * `surface` is read literally — no catalog-preset fallback. No preset\n * declares `openai-codex-responses`, so a preset-shaped entry reaching here\n * is a mis-provisioned session, not a terse one.\n *\n * An absent or empty registry is *not* a violation: nothing was configured,\n * and the credential the platform minted is the only one the session has.\n * Every configured entry is judged, whichever layer it came from — the\n * control-plane session layer, the user/workspace `providers.yml` files, or\n * a runtime override.\n *\n * @returns the reason the registry is inadmissible, or `undefined` when it is.\n */\nexport function managedCodexRegistryViolation(\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined,\n): string | undefined {\n  if (!registry) return undefined;\n  const entries = registryEntries(registry);\n  if (entries.length === 0) return undefined;\n  if (entries.length > 1)\n    return `registry carries ${entries.length} entries; managed codex admits exactly one`;\n  const [id, entry] = entries[0];\n  if (!isEntryEnabled(entry)) return `entry '${id}' is disabled`;\n  if (entry.kind !== \"llm\") return `entry '${id}' is a '${entry.kind}' endpoint, not an llm one`;\n  const surface = (entry as AIProviderLlmEntry).surface;\n  if (surface !== \"openai-codex-responses\")\n    return `entry '${id}' declares surface '${surface ?? \"none\"}'; managed codex admits only openai-codex-responses`;\n  const credential = entry.credential;\n  if (credential?.kind !== \"oauth\")\n    return `entry '${id}' carries a '${credential?.kind ?? \"none\"}' credential; managed codex admits only a platform-injected oauth credential`;\n  const ref = credential.ref ? parseCredentialRef(credential.ref) : undefined;\n  if (!ref || ref.form !== \"platform\")\n    return `entry '${id}' resolves its credential outside the control plane; managed codex admits only a 'platform:' reference`;\n  return undefined;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  chmodSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { isAbsolute, join, relative } from \"node:path\";\nimport { openSqlite } from \"../../../core/src/logging/sinks/sqlite-runtime.js\";\nimport type { CodexCredentialDelivery } from \"@skaile/workspaces/types\";\nimport type { AgentConfig, CodexManagedRuntimeOptions } from \"../types.js\";\n\nimport { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from \"./native-state.js\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst within = (path: string, root: string) => {\n  const rel = relative(root, path);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n};\nfunction directory(path: string): void {\n  if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 0o077) throw invalid();\n}\nfunction readRegular(path: string, limit: number): Buffer {\n  const stat = lstatSync(path);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw invalid();\n  return readFileSync(path);\n}\n\n/** Session-owned state lock and account-bound native resume metadata; never stores credentials. */\nexport function prepareCodexInstance(\n  config: AgentConfig,\n  options: CodexManagedRuntimeOptions,\n  credential: CodexCredentialDelivery,\n) {\n  if (!isAbsolute(options.privateDirectory) || !isAbsolute(config.cwd) || !config.sessionId)\n    throw invalid();\n  directory(options.privateDirectory);\n  const root = realpathSync(options.privateDirectory);\n  const cwd = realpathSync(config.cwd);\n  if (within(root, cwd) || within(cwd, root)) throw invalid();\n  const lock = join(root, \".active\");\n  const leasePath = join(root, \"lease.db\");\n  if (existsSync(leasePath) && !lstatSync(leasePath).isFile()) throw invalid();\n  const lease = openSqlite(leasePath);\n  try {\n    lease.exec(\"PRAGMA busy_timeout=0; BEGIN EXCLUSIVE\");\n    chmodSync(leasePath, 0o600);\n    // The OS releases the database lease on crashes; this marker never owns the lock.\n    rmSync(lock, { force: true });\n    writeFileSync(lock, \"active\", { flag: \"wx\", mode: 0o600 });\n  } catch (error) {\n    lease.close();\n    throw error;\n  }\n  let released = false;\n  const release = () => {\n    if (released) return;\n    released = true;\n    try {\n      rmSync(lock, { force: true });\n    } finally {\n      lease.close();\n    }\n  };\n  try {\n    const key = createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          driver: \"codex-app-server-v1\",\n          session: config.sessionId,\n          config: credential.configId,\n          kind: credential.kind,\n          account: credential.kind === \"codex-subscription\" ? credential.chatgptAccountId : null,\n        }),\n      )\n      .digest(\"hex\");\n    const slots = join(root, CODEX_NATIVE_STATE_FORMAT);\n    directory(slots);\n    const stateRoot = join(slots, key);\n    directory(stateRoot);\n    for (const name of [\"instructions.new\", \"binding.new\"])\n      rmSync(join(stateRoot, name), { force: true });\n    const bindingPath = join(stateRoot, \"binding.json\");\n    if (config.resumeSessionId && !existsSync(bindingPath)) throw new CodexNativeStateUnavailable();\n    if (existsSync(bindingPath)) {\n      // Filesystem authority failures (including symlinks) are fatal, not missing state.\n      const bytes = readRegular(bindingPath, 4096);\n      if (config.resumeSessionId) {\n        let binding: unknown;\n        try {\n          binding = JSON.parse(bytes.toString(\"utf8\"));\n        } catch {\n          throw new CodexNativeStateUnavailable();\n        }\n        if (\n          !binding ||\n          typeof binding !== \"object\" ||\n          Array.isArray(binding) ||\n          Object.keys(binding).sort().join(\",\") !== \"format,key,threadId\" ||\n          (binding as Record<string, unknown>).format !== CODEX_NATIVE_STATE_FORMAT ||\n          (binding as Record<string, unknown>).key !== key ||\n          (binding as Record<string, unknown>).threadId !== config.resumeSessionId\n        )\n          throw new CodexNativeStateUnavailable();\n      }\n    }\n    const home = join(stateRoot, \"home\");\n    if (config.resumeSessionId && !existsSync(home)) throw new CodexNativeStateUnavailable();\n    directory(home);\n    for (const subdir of [\"config\", \"cache\", \"data\", \"tmp\"]) directory(join(home, subdir));\n    // Auth persistence is forbidden even if a previous external process left a carrier here.\n    if ([\"auth.json\", \".credentials.json\"].some((name) => existsSync(join(home, name))))\n      throw invalid();\n    const instructionFile = join(stateRoot, \"instructions.md\");\n    const instructions = [\n      ...(options.instructionFiles ?? []).map((path) =>\n        readRegular(path, 1024 * 1024).toString(\"utf8\"),\n      ),\n      ...(config.systemPrompt ? [config.systemPrompt] : []),\n    ].join(\"\\n\\n---\\n\\n\");\n    const temporary = join(stateRoot, \"instructions.new\");\n    writeFileSync(temporary, instructions, { mode: 0o600, flag: \"wx\" });\n    renameSync(temporary, instructionFile);\n    const target = join(home, \"skills\");\n    if (!options.skillsDirectory && existsSync(target)) rmSync(target, { recursive: true });\n    if (options.skillsDirectory) {\n      const source = realpathSync(options.skillsDirectory);\n      if (within(target, source) || within(source, target)) throw invalid();\n      if (existsSync(target)) rmSync(target, { recursive: true });\n      let files = 0;\n      let entries = 0;\n      let bytes = 0;\n      const copy = (source: string, destination: string) => {\n        if (++entries > 1024) throw invalid();\n        if (lstatSync(source).isSymbolicLink()) throw invalid();\n        mkdirSync(destination, { mode: 0o700 });\n        for (const entry of readdirSync(source, { withFileTypes: true })) {\n          const src = join(source, entry.name);\n          const dst = join(destination, entry.name);\n          if (entry.isSymbolicLink()) throw invalid();\n          if (entry.isDirectory()) copy(src, dst);\n          else {\n            const content = readRegular(src, 1024 * 1024);\n            bytes += content.byteLength;\n            if (++files > 512 || bytes > 8 * 1024 * 1024) throw invalid();\n            writeFileSync(dst, content, { mode: 0o600, flag: \"wx\" });\n          }\n        }\n      };\n      copy(options.skillsDirectory, target);\n    }\n    const bindThread = (threadId: string) => {\n      if (!threadId || threadId.length > 4096) throw invalid();\n      const next = join(stateRoot, \"binding.new\");\n      writeFileSync(next, JSON.stringify({ format: CODEX_NATIVE_STATE_FORMAT, key, threadId }), {\n        mode: 0o600,\n        flag: \"wx\",\n      });\n      renameSync(next, bindingPath);\n    };\n    const setToolInstructions = (text: string) => {\n      writeFileSync(temporary, `${instructions}\\n\\n${text}`, { mode: 0o600, flag: \"wx\" });\n      renameSync(temporary, instructionFile);\n    };\n    return {\n      root,\n      stateRoot,\n      cwd,\n      home,\n      instructionFile,\n      bindThread,\n      release,\n      setToolInstructions,\n    };\n  } catch (error) {\n    release();\n    throw error;\n  }\n}\n\n/** A replacement environment; managed auth never reads or mutates ambient process.env. */\nexport function codexInstanceEnvironment(\n  input: Record<string, string>,\n  home: string,\n): Record<string, string> {\n  const allowed = new Set([\n    \"PATH\",\n    \"LANG\",\n    \"LC_ALL\",\n    \"TZ\",\n    \"SSL_CERT_FILE\",\n    \"SSL_CERT_DIR\",\n    \"HTTPS_PROXY\",\n    \"HTTP_PROXY\",\n    \"NO_PROXY\",\n  ]);\n  if (\n    !input ||\n    Object.entries(input).some(([key, value]) => !allowed.has(key) || typeof value !== \"string\")\n  )\n    throw invalid();\n  return {\n    ...input,\n    HOME: home,\n    CODEX_HOME: home,\n    XDG_CONFIG_HOME: join(home, \"config\"),\n    XDG_CACHE_HOME: join(home, \"cache\"),\n    XDG_DATA_HOME: join(home, \"data\"),\n    TMPDIR: join(home, \"tmp\"),\n  };\n}\n"]}

package/dist/{chunk-XFWB3KFV.js → chunk-HL6SZ7Z3.js}

@@ -1,5 +1,5 @@
 import { resolveFragments, loadPromptExtensions } from './chunk-CGYEHQOX.js';
-import { computeHash, applyPatch } from './chunk-UWU572Q6.js';
+import { computeHash, applyPatch } from './chunk-WPISSDEI.js';
 import { deployedBase, deployedDir, isDeployed } from './chunk-F3HNW354.js';
 import { resolveSkWorkspaceConfig } from './chunk-DF7C3KZK.js';
 import { DRIVER_TARGETS } from './chunk-MENCWIHW.js';
@@ -415,5 +415,5 @@ function createScaffold(name, kind, destDir) {
 }
 
 export { createScaffold, deployAll, deployAsset, installAgent, removeAsset };
-//# sourceMappingURL=chunk-XFWB3KFV.js.map
-//# sourceMappingURL=chunk-XFWB3KFV.js.map
+//# sourceMappingURL=chunk-HL6SZ7Z3.js.map
+//# sourceMappingURL=chunk-HL6SZ7Z3.js.map

package/dist/{chunk-XFWB3KFV.js.map → chunk-HL6SZ7Z3.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../asset-manager/src/install-agent.ts","../asset-manager/src/installer.ts"],"names":["parseYaml","basename","join","resolve","existsSync"],"mappings":";;;;;;;;;;AAmCA,SAAS,aAAa,QAAA,EAAwC;AAC5D,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,EAAU,YAAY,CAAA;AAC5C,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAOA,KAAA,CAAU,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,QAAA,CAAS,UAAkB,IAAA,EAA6B;AAC/D,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAC7B,EAAA,IAAI,CAAC,UAAA,CAAW,CAAC,CAAA,EAAG,OAAO,IAAA;AAC3B,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,GAAG,OAAO,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGA,SAAS,iBAAiB,OAAA,EAA0C;AAClE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,uBAAuB,CAAA;AACnD,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAC;AACpB,EAAA,IAAI;AACF,IAAA,OAAQA,KAAA,CAAU,KAAA,CAAM,CAAC,CAAE,KAAiC,EAAC;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAMA,SAAS,cAAA,CAAe,QAAuB,KAAA,EAAqC;AAClF,EAAA,MAAM,MAAA,GAAwB,EAAE,GAAG,MAAA,EAAO;AAC1C,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,GAAG,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAuC;AAChF,IAAA,IAAI,QAAQ,MAAA,EAAW;AACvB,IAAA,MAAM,SAAA,GAAY,OAAO,CAAwB,CAAA;AACjD,IAAA,IAAI,MAAM,OAAA,CAAQ,GAAG,KAAK,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAClD,MAAC,MAAA,CAAmC,CAAC,CAAA,GAAI,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,SAAA,EAAW,GAAG,GAAG,CAAC,CAAC,CAAA;AAAA,IAC9E,CAAA,MAAO;AACL,MAAC,MAAA,CAAmC,CAAC,CAAA,GAAI,GAAA;AAAA,IAC3C;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAMA,SAAS,iBAAA,CACP,QAAA,EACA,MAAA,EACA,QAAA,EACe;AACf,EAAA,IAAI,CAAC,QAAA,CAAS,OAAA,EAAS,OAAO,QAAA;AAC9B,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,MAAA,EAAQ,QAAA,CAAS,OAAO,CAAA;AAClD,EAAA,MAAM,cAAA,GAAiB,aAAa,SAAS,CAAA;AAC7C,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAO,cAAA,CAAe,gBAAgB,QAAQ,CAAA;AAAA,EAChD;AACA,EAAA,QAAA,CAAS,IAAA;AAAA,IACP,CAAA,oCAAA,EAAuC,QAAA,CAAS,OAAO,CAAA,QAAA,EAAW,MAAM,CAAA,6BAAA;AAAA,GAC1E;AACA,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,kBAAA,CACP,QAAA,EACA,aAAA,EACA,YAAA,EACc;AACd,EAAA,MAAM,cAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,SAAA,IAAa,EAAC,EAAG;AAC3C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,aAAA,EAAe,YAAA,EAAc,MAAM,UAAU,CAAA;AACtE,IAAA,IAAI,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,GAAK,gBAAA,CAAiB,YAAA,CAAa,WAAA,EAAa,OAAO,CAAC,CAAA;AAC9D,MAAA,MAAM,OAAO,OAAO,EAAA,CAAG,WAAA,KAAgB,QAAA,GAAW,GAAG,WAAA,GAAc,KAAA,CAAA;AACnE,MAAA,IAAI,MAAM,WAAA,CAAY,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAM,CAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,WAAA;AACT;AAGA,SAAS,mBAAA,CACP,QAAA,EACA,aAAA,EACA,YAAA,EACe;AACf,EAAA,MAAM,eAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,SAAA,IAAa,EAAC,EAAG;AAC3C,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,aAAA,EAAe,YAAA,EAAc,MAAM,aAAa,CAAA;AAC7E,IAAA,IAAI,CAAC,UAAA,CAAW,eAAe,CAAA,EAAG;AAClC,IAAA,YAAA,CAAa,IAAA,CAAK,EAAE,IAAA,EAAM,YAAA,EAAc,SAAS,aAAA,EAAe,eAAe,GAAG,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,YAAA;AACT;AAGA,SAAS,qBACP,QAAA,EACA,YAAA,EACA,YAAA,EACA,QAAA,EACA,aACA,YAAA,EACiB;AACjB,EAAA,MAAM,aAAA,GAAA,CAAiB,QAAA,CAAS,QAAA,IAAY,IAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAEvF,EAAA,MAAM,cAA8B,QAAA,EAAU,UAAA,IAAc,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,IAC1E,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU;AAAA,GACtB,CAAE,CAAA;AAEF,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,YAA4B,CAAA,EAAG,MAAM,KAAA,IAAS,EAAA;AAElF,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,YAAA;AAAA,IACX,SAAA,EAAW,YAAA;AAAA,IACX,SAAA,EAAW,YAAA;AAAA,IACX,SAAA,EAAW,aAAA;AAAA,IACX,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;AAwBO,SAAS,YAAA,CACd,MAAA,EACA,cAAA,EACA,aAAA,EACA,YAAA,EAEA,cACA,YAAA,EACA,gBAAA,EACA,OAAA,EACA,QAAA,EACA,GAAA,EAC2C;AAC3C,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAM,CAAA;AAC9B,EAAA,IAAI,QAAQ,GAAA,CAAI,OAAO,GAAG,OAAO,EAAE,SAAS,QAAA,EAAS;AACrD,EAAA,OAAA,CAAQ,IAAI,OAAO,CAAA;AAEnB,EAAA,MAAM,eAAA,GAAkB,aAAa,MAAM,CAAA;AAC3C,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,iEAAA,CAA8D,CAAA;AACrF,IAAA,OAAO,EAAE,SAAS,QAAA,EAAS;AAAA,EAC7B;AAGA,EAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,eAAA,EAAiB,MAAA,EAAQ,QAAQ,CAAA;AAEpE,EAAA,MAAM,SAAA,GAAY,YAAA,IAAgB,QAAA,CAAS,IAAA,IAAQ,SAAS,MAAM,CAAA;AAElE,EAAA,GAAA,GAAM,CAAA,sBAAA,EAAyB,SAAS,CAAA,EAAA,EAAK,YAAY,CAAA,CAAA,CAAG,CAAA;AAG5D,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,QAAA,EAAU,aAAA,EAAe,YAAY,CAAA;AAG5E,EAAA,MAAM,YAAA,GAAe,mBAAA,CAAoB,QAAA,EAAU,aAAA,EAAe,YAAY,CAAA;AAG9E,EAAA,MAAM,WAAA,GAAc,oBAAA;AAAA,IAClB,QAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA,QAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,kBAAA,GAAqB,gBAAA;AAAA,IACzB,WAAA;AAAA,IACA,UAAU,KAAA,EAAO,SAAA;AAAA,IACjB;AAAA,GACF;AACA,EAAA,MAAM,gBAAA,GAAmB,oBAAA;AAAA,IACvB,QAAA,EAAU,QAAQ,mBAAmB,CAAA;AAAA,IACrC;AAAA,GACF;AAEA,EAAA,MAAM,KAAA,GAA0B;AAAA,IAC9B,QAAA;AAAA,IACA,IAAA,EAAM,QAAA,CAAS,MAAA,EAAQ,SAAS,CAAA;AAAA,IAChC,KAAA,EAAO,QAAA,CAAS,MAAA,EAAQ,UAAU,CAAA;AAAA,IAClC,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,WAAW,CAAA;AAAA,IACpC,SAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,KAAA,EAAO,YAAA,EAAc,GAAG,CAAA;AAC9D,EAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAA,CAAO,OAAO,CAAA;AAC9B,EAAA,QAAA,CAAS,IAAA,CAAK,GAAG,MAAA,CAAO,QAAQ,CAAA;AAGhC,EAAA,IAAI,gBAAA,EAAkB;AACpB,IAAA,gBAAA,CAAiB,QAAA,EAAU,SAAA,EAAW,MAAA,EAAQ,cAAA,EAAgB,eAAe,YAAA,EAAc;AAAA,MACzF,YAAA;AAAA,MACA,gBAAA;AAAA,MACA,OAAA;AAAA,MACA,QAAA;AAAA,MACA,GAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,EAAE,SAAS,QAAA,EAAS;AAC7B;AAOA,SAAS,iBACP,QAAA,EACA,SAAA,EACA,QACA,cAAA,EACA,aAAA,EACA,cACA,GAAA,EASM;AACN,EAAA,KAAA,MAAW,GAAA,IAAO,QAAA,CAAS,QAAA,IAAY,EAAC,EAAG;AACzC,IAAA,IAAI,CAAC,GAAA,CAAI,MAAA,IAAU,CAAC,IAAI,IAAA,EAAM;AAE9B,IAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,GAAI,IAAI,MAAA,GAAS,OAAA,CAAQ,MAAA,EAAQ,GAAA,CAAI,MAAM,CAAA;AAE/E,IAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG;AACvB,MAAA,GAAA,CAAI,SAAS,IAAA,CAAK,CAAA,4BAAA,EAA+B,IAAI,MAAM,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,CAAG,CAAA;AACjF,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,YAAA;AAAA,MACV,MAAA;AAAA,MACA,cAAA;AAAA,MACA,aAAA;AAAA,MACA,YAAA;AAAA,MACA,GAAA,CAAI,YAAA;AAAA,MACJ,MAAA;AAAA;AAAA,MACA,GAAA,CAAI,gBAAA;AAAA,MACJ,GAAA,CAAI,OAAA;AAAA,MACJ,GAAA,CAAI,QAAA;AAAA,MACJ,GAAA,CAAI;AAAA,KACN;AACA,IAAA,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,GAAA,CAAI,OAAO,CAAA;AAC/B,IAAA,GAAA,CAAI,QAAA,CAAS,IAAA,CAAK,GAAG,GAAA,CAAI,QAAQ,CAAA;AAAA,EACnC;AACF;;;ACxSA,IAAM,OAAY,MAAM;AAAC,CAAA;AAIzB,IAAM,mBAAA,uBAA0B,GAAA,CAAI,CAAC,YAAY,UAAA,EAAY,YAAA,EAAc,aAAa,CAAC,CAAA;AAEzF,SAAS,UAAU,IAAA,EAAoB;AACrC,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,UAAU,IAAI,CAAA;AACxB,IAAA,IAAI,CAAA,CAAE,cAAA,EAAe,EAAG,UAAA,CAAW,IAAI,CAAA;AAAA,gBAC3B,IAAA,EAAM,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AAAA,EAAC;AACX;AAEA,SAAS,gBAAA,CAAiB,cAAsB,IAAA,EAAoB;AAClE,EAAA,MAAM,IAAA,GAAOC,SAAS,YAAY,CAAA;AAClC,EAAA,MAAM,SAAA,GAAY,QAAQ,YAAY,CAAA;AACtC,EAAA,SAAA,CAAU,IAAI,CAAA;AAId,EAAA,IAAI,QAAA,CAAS,YAAY,CAAA,CAAE,WAAA,EAAY,EAAG;AACxC,IAAA,MAAA,CAAO,YAAA,EAAc,IAAA,EAAM,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,EAChD,CAAA,MAAA,IAAW,mBAAA,CAAoB,GAAA,CAAI,IAAI,CAAA,IAAKA,SAAS,SAAS,CAAA,KAAMA,QAAAA,CAAS,IAAI,CAAA,EAAG;AAClF,IAAA,MAAA,CAAO,SAAA,EAAW,IAAA,EAAM,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,EAC7C,CAAA,MAAO;AACL,IAAA,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACnC,IAAA,MAAA,CAAO,YAAA,EAAcC,IAAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,EACvC;AACF;AAEA,SAAS,mBAAA,CAAoB,cAAsB,IAAA,EAAoB;AACrE,EAAA,MAAM,IAAA,GAAOD,SAAS,YAAY,CAAA;AAClC,EAAA,MAAM,SAAA,GAAY,QAAQ,YAAY,CAAA;AACtC,EAAA,SAAA,CAAU,IAAI,CAAA;AACd,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAE5C,EAAA,IAAI,QAAA,CAAS,YAAY,CAAA,CAAE,WAAA,EAAY,EAAG;AACxC,IAAA,WAAA,CAAYE,OAAAA,CAAQ,YAAY,CAAA,EAAG,IAAI,CAAA;AAAA,EACzC,CAAA,MAAA,IAAW,mBAAA,CAAoB,GAAA,CAAI,IAAI,CAAA,IAAKF,SAAS,SAAS,CAAA,KAAMA,QAAAA,CAAS,IAAI,CAAA,EAAG;AAClF,IAAA,WAAA,CAAYE,OAAAA,CAAQ,SAAS,CAAA,EAAG,IAAI,CAAA;AAAA,EACtC,CAAA,MAAO;AACL,IAAA,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACnC,IAAA,WAAA,CAAYA,QAAQ,YAAY,CAAA,EAAGD,IAAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,EACrD;AACF;AA6CO,SAAS,YACd,KAAA,EACA,YAAA,EACA,OAAsB,EAAC,EACvB,MAAW,IAAA,EACF;AACT,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,KAAK,MAAA,IAAU,KAAA;AACrC,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AAIjB,EAAA,IAAI,MAAM,IAAA,KAAS,QAAA,IAAY,KAAA,CAAM,IAAA,KAAS,cAAc,OAAO,IAAA;AAGnE,EAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,IAAA,MAAM,aAAA,GAAgB,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACzC,IAAA,MAAM,cAAA,GAAiB,YAAA;AAAA,MACrB,OAAA;AAAA,MACA,YAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,SAAA,GAAY,eAAe,YAA4B,CAAA;AAC7D,IAAA,MAAM,YAAA,GAAe,SAAA,EAAW,KAAA,CAAM,KAAA,IAAS,EAAA;AAC/C,IAAA,MAAM,QAAA,GAAW,yBAAyB,aAAa,CAAA;AACvD,IAAA,MAAM,IAAA,GAAOD,QAAAA,CAAS,KAAA,CAAM,MAAM,CAAA;AAClC,IAAA,MAAM,MAAA,GAAS,oBAAoB,GAAA,CAAI,IAAI,IAAI,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA,GAAI,KAAA,CAAM,MAAA;AAC7E,IAAA,MAAM,MAAA,GAAS,YAAA;AAAA,MACb,MAAA;AAAA,MACA,cAAA;AAAA,MACA,aAAA;AAAA,MACA,YAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA,CAAM,IAAA;AAAA;AAAA,MACiB,IAAA;AAAA,0BACnB,GAAA,EAAY;AAAA,MAChB,QAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,KAAA,MAAW,KAAK,MAAA,CAAO,QAAA,EAAU,GAAA,CAAI,CAAA,QAAA,EAAW,CAAC,CAAA,CAAE,CAAA;AACnD,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA;AAAA,EAExC;AAEA,EAAA,MAAM,IAAA,GAAO,YAAY,KAAA,CAAM,IAAA,EAAqB,MAAM,IAAA,EAAM,YAAA,EAAc,eAAe,GAAG,CAAA;AAChG,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAM5C,EAAA,MAAM,WAAW,KAAA,CAAM,SAAA,GAAY,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA,GAAI,MAAA;AACnE,EAAA,MAAM,YAAA,GAAe,QAAA,EAAU,IAAA,IAAQ,IAAA,IAAQ,SAAS,OAAA,KAAY,IAAA;AAEpE,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,IAAA,IAAQ,YAAA,EAAc;AACtC,IAAA,mBAAA,CAAoB,KAAA,CAAM,QAAQ,IAAI,CAAA;AACtC,IAAA,GAAA,CAAI,aAAa,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,CAAE,CAAA;AAC3C,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,MAAO;AACL,IAAA,gBAAA,CAAiB,KAAA,CAAM,QAAQ,IAAI,CAAA;AACnC,IAAA,GAAA,CAAI,UAAU,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,CAAE,CAAA;AACxC,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAmBO,SAAS,SAAA,CACd,UACA,YAAA,EACA,OAAA,EACA,OAAsB,EAAC,EACvB,MAAW,IAAA,EACD;AACV,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,KAAK,MAAA,IAAU,KAAA;AACrC,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AAEjB,EAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAI5B,IAAA,IACE,KAAA,CAAM,IAAA,KAAS,QAAA,IACf,KAAA,CAAM,IAAA,KAAS,YAAA,IACf,KAAA,CAAM,IAAA,KAAS,SAAA,IACf,KAAA,CAAM,IAAA,KAAS,SAAA,IACf,MAAM,IAAA,KAAS,WAAA;AAEf,MAAA;AAEF,IAAA,MAAM,MAAM,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAEvC,IAAA,IAAI,UAAA,CAAW,MAAM,IAAA,EAAqB,KAAA,CAAM,MAAM,YAAA,EAAc,aAAA,EAAe,GAAG,CAAA,EAAG;AAIvF,MAAA,MAAM,IAAA,GAAO,WAAA;AAAA,QACX,KAAA,CAAM,IAAA;AAAA,QACN,KAAA,CAAM,IAAA;AAAA,QACN,YAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAIA,MAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,MAAA,IAAI;AACF,QAAA,aAAA,GAAgB,SAAA,CAAU,IAAI,CAAA,CAAE,cAAA,EAAe;AAAA,MACjD,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,WAAA,GAAc,aAAA,IAAiB,IAAA,CAAK,IAAA,KAAS,IAAA;AAGnD,MAAA,IAAI,WAAA,EAAa,GAAA,CAAI,CAAA,8BAAA,EAA4B,GAAG,CAAA,8BAAA,CAAgC,CAAA;AAEpF,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,MAAM,YAAA,GAAeA,QAAAA,CAAS,KAAA,CAAM,MAAM,CAAA;AAC1C,QAAA,MAAM,gBAAA,GAAmBC,IAAAA,CAAK,IAAA,EAAM,YAAY,CAAA;AAOhD,QAAA,IAAIE,UAAAA,CAAW,gBAAgB,CAAA,EAAG;AAChC,UAAA,IAAI;AACF,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,KAAA,CAAM,MAAM,CAAA;AACxC,YAAA,MAAM,OAAA,GAAU,YAAY,gBAAgB,CAAA;AAC5C,YAAA,IAAI,YAAY,OAAA,EAAS;AACvB,cAAA,GAAA,CAAI,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAE,CAAA;AAChC,cAAA;AAAA,YACF;AACA,YAAA,GAAA,CAAI,CAAA,YAAA,EAAe,GAAG,CAAA,kBAAA,CAAoB,CAAA;AAAA,UAE5C,CAAA,CAAA,MAAQ;AAEN,YAAA,GAAA,CAAI,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAE,CAAA;AAChC,YAAA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,WAAA,CAAY,KAAA,EAAO,YAAA,EAAc,IAAA,EAAM,GAAG,CAAA;AAC1C,IAAA,QAAA,CAAS,KAAK,GAAG,CAAA;AAGjB,IAAA,MAAM,SAAA,GAAY,QAAQ,GAAG,CAAA;AAC7B,IAAA,IAAI,SAAA,IAAaA,UAAAA,CAAW,SAAS,CAAA,EAAG;AACtC,MAAA,MAAM,IAAA,GAAO,WAAA;AAAA,QACX,KAAA,CAAM,IAAA;AAAA,QACN,KAAA,CAAM,IAAA;AAAA,QACN,YAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,UAAA,CAAW,IAAA,EAAM,SAAS,CAAA,EAAG;AAC/B,QAAA,GAAA,CAAI,CAAA,UAAA,EAAa,GAAG,CAAA,CAAE,CAAA;AAAA,MACxB,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,CAAA,mBAAA,EAAsB,GAAG,CAAA,CAAE,CAAA;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,QAAA;AACT;AAaO,SAAS,WAAA,CAAY,IAAA,EAAc,IAAA,EAAc,IAAA,GAAsB,EAAC,EAAY;AACzF,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,KAAK,MAAA,IAAU,KAAA;AACrC,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AAEjB,EAAA,MAAM,OAAO,WAAA,CAAY,IAAA,EAAqB,IAAA,EAAM,YAAA,EAAc,eAAe,GAAG,CAAA;AACpF,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,UAAU,IAAI,CAAA;AACxB,IAAA,IAAI,CAAA,CAAE,cAAA,EAAe,EAAG,UAAA,CAAW,IAAI,CAAA;AAAA,gBAC3B,IAAA,EAAM,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAClD,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAIA,IAAM,cAAA,GAAiB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA,CAAA;AAYvB,IAAM,eAAA,GAAkB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAOxB,IAAM,aAAA,GAAgB,CAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA,CAAA;AAyBf,SAAS,cAAA,CACd,IAAA,EACA,IAAA,EACA,OAAA,EAC+B;AAC/B,EAAA,MAAM,IAAA,GAAOF,IAAAA,CAAK,OAAA,EAAS,IAAI,CAAA;AAC/B,EAAA,IAAIE,UAAAA,CAAW,IAAI,CAAA,EAAG;AACpB,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,IAAA,EAAM,cAAc,IAAI,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,EAAG;AAAA,EAC/E;AACA,EAAA,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAEnC,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,aAAA;AAAA,MACEF,IAAAA,CAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,YAAA,CAAc,CAAA;AAAA,MAChC,eAAA,CAAgB,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA;AAAA,MACzC;AAAA,KACF;AAAA,EACF,CAAA,MAAA,IAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,aAAA;AAAA,MACEA,IAAAA,CAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,UAAA,CAAY,CAAA;AAAA,MAC9B,aAAA,CAAc,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA;AAAA,MACvC;AAAA,KACF;AAAA,EACF,CAAA,MAAA,IAAW,SAAS,QAAA,EAAU;AAC5B,IAAA,aAAA;AAAA,MACEA,IAAAA,CAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,UAAA,CAAY,CAAA;AAAA,MAC9B,cAAA,CAAe,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA;AAAA,MACxC;AAAA,KACF;AAAA,EACF,CAAA,MAAA,IAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,aAAA,CAAcA,IAAAA,CAAK,MAAM,UAAU,CAAA,EAAG,eAAe,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA,EAAG,MAAM,CAAA;AAAA,EACzF,CAAA,MAAA,IAAW,SAAS,UAAA,EAAY;AAC9B,IAAA,aAAA,CAAcA,IAAAA,CAAK,MAAM,aAAa,CAAA,EAAG,eAAe,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA,EAAG,MAAM,CAAA;AAAA,EAC5F,CAAA,MAAO;AAEL,IAAA,aAAA,CAAcA,IAAAA,CAAK,MAAM,UAAU,CAAA,EAAG,eAAe,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA,EAAG,MAAM,CAAA;AAAA,EACzF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,IAAA,EAAK;AAChC","file":"chunk-XFWB3KFV.js","sourcesContent":["/**\n * Agent installation — renders a GitAgent package (agent.yaml + SOUL.md + RULES.md)\n * into the framework-native format (`.claude/agents/<name>.md`, `.omp/agents/<name>/`,\n * `.codex/agents/<name>.toml`) and resolves abilities, contracts, fragments, and\n * prompt extensions from the workspace config along the way.\n *\n * System prompt phases (per agent):\n *   1. extends merge     — inherit from parent agent.yaml if manifest.extends is set\n *   2. ability refs      — read SKILL.md frontmatter from installed skills dir\n *   3. contract refs     — locate CONTRACT.md files in the installed skills dir\n *   4. fragments         — resolve framework fragments (agent-mode, handoff, etc.)\n *   5. prompt-extensions — load per-project markdown extensions from skaile.yaml\n *\n * Used by `installer.ts` (the asset-install path) and `skaile install`. Sub-agents\n * declared in `agent.yaml#requires` are installed flat (no nesting) in the same\n * deploy directory.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { basename, isAbsolute, join, relative, resolve } from \"node:path\";\nimport type { DriverTarget, SkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport { DRIVER_TARGETS } from \"@skaile/workspaces/core\";\nimport { parse as parseYaml } from \"yaml\";\nimport {\n  type AbilityRef,\n  type ConnectorRef,\n  type ContractRef,\n  type FragmentContext,\n  loadPromptExtensions,\n  resolveFragments,\n} from \"./fragments.js\";\nimport { type AgentManifest, type AgentRenderInput, renderAgentToFramework } from \"./renderers.js\";\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nfunction readManifest(agentDir: string): AgentManifest | null {\n  const yamlPath = join(agentDir, \"agent.yaml\");\n  if (!existsSync(yamlPath)) return null;\n  try {\n    return parseYaml(readFileSync(yamlPath, \"utf-8\")) as AgentManifest;\n  } catch {\n    return null;\n  }\n}\n\nfunction readFile(agentDir: string, name: string): string | null {\n  const p = join(agentDir, name);\n  if (!existsSync(p)) return null;\n  try {\n    return readFileSync(p, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\n/** Extract YAML frontmatter from a markdown file (content between first two --- delimiters). */\nfunction parseFrontmatter(content: string): Record<string, unknown> {\n  const match = content.match(/^---\\n([\\s\\S]*?)\\n---/);\n  if (!match) return {};\n  try {\n    return (parseYaml(match[1]!) as Record<string, unknown>) ?? {};\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Merge parent and child agent manifests.\n * Scalars: child wins. Arrays: parent + child, deduplicated.\n */\nfunction mergeManifests(parent: AgentManifest, child: AgentManifest): AgentManifest {\n  const result: AgentManifest = { ...parent };\n  for (const [k, val] of Object.entries(child) as [keyof AgentManifest, unknown][]) {\n    if (val === undefined) continue;\n    const parentVal = result[k as keyof AgentManifest];\n    if (Array.isArray(val) && Array.isArray(parentVal)) {\n      (result as Record<string, unknown>)[k] = [...new Set([...parentVal, ...val])];\n    } else {\n      (result as Record<string, unknown>)[k] = val;\n    }\n  }\n  return result;\n}\n\n/**\n * Phase 1: inherit scalars/arrays from a parent agent when `manifest.extends` is set.\n * Returns the (possibly merged) manifest; pushes a warning when the parent is missing.\n */\nfunction applyExtendsMerge(\n  manifest: AgentManifest,\n  srcDir: string,\n  warnings: string[],\n): AgentManifest {\n  if (!manifest.extends) return manifest;\n  const parentDir = resolve(srcDir, manifest.extends);\n  const parentManifest = readManifest(parentDir);\n  if (parentManifest) {\n    return mergeManifests(parentManifest, manifest);\n  }\n  warnings.push(\n    `extends: parent agent not found at \"${manifest.extends}\" (from ${srcDir}) — skipping inheritance`,\n  );\n  return manifest;\n}\n\n/** Phase 2: resolve ability refs — read description from installed SKILL.md files. */\nfunction resolveAbilityRefs(\n  manifest: AgentManifest,\n  workspaceRoot: string,\n  skillsRelDir: string,\n): AbilityRef[] {\n  const abilityRefs: AbilityRef[] = [];\n  for (const name of manifest.abilities ?? []) {\n    const skillMdPath = join(workspaceRoot, skillsRelDir, name, \"SKILL.md\");\n    if (!existsSync(skillMdPath)) continue;\n    try {\n      const fm = parseFrontmatter(readFileSync(skillMdPath, \"utf-8\"));\n      const desc = typeof fm.description === \"string\" ? fm.description : undefined;\n      if (desc) abilityRefs.push({ name, description: desc });\n    } catch {\n      // skip unreadable SKILL.md\n    }\n  }\n  return abilityRefs;\n}\n\n/** Phase 3: resolve contract refs — locate CONTRACT.md files in the skills dir. */\nfunction resolveContractRefs(\n  manifest: AgentManifest,\n  workspaceRoot: string,\n  skillsRelDir: string,\n): ContractRef[] {\n  const contractRefs: ContractRef[] = [];\n  for (const name of manifest.contracts ?? []) {\n    const contractAbsPath = join(workspaceRoot, skillsRelDir, name, \"CONTRACT.md\");\n    if (!existsSync(contractAbsPath)) continue;\n    contractRefs.push({ name, relativePath: relative(workspaceRoot, contractAbsPath) });\n  }\n  return contractRefs;\n}\n\n/** Phase 4: assemble the fragment context from the manifest, workspace config, and resolved refs. */\nfunction buildFragmentContext(\n  manifest: AgentManifest,\n  driverTarget: string,\n  skillsRelDir: string,\n  wsConfig: SkWorkspaceConfig | undefined,\n  abilityRefs: AbilityRef[],\n  contractRefs: ContractRef[],\n): FragmentContext {\n  const subAgentNames = (manifest.requires ?? []).filter((r) => r.name).map((r) => r.name);\n\n  const connectors: ConnectorRef[] = (wsConfig?.connectors ?? []).map((c) => ({\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-write\",\n  }));\n\n  const agentsRelDir = DRIVER_TARGETS[driverTarget as DriverTarget]?.local.agent ?? \"\";\n\n  return {\n    framework: driverTarget,\n    skillsDir: skillsRelDir,\n    agentsDir: agentsRelDir,\n    subAgents: subAgentNames,\n    connectors,\n    abilityRefs,\n    contractRefs,\n  };\n}\n\n// ── Core installation ─────────────────────────────────────────────────────────\n\n/**\n * Install a single GitAgent source directory using the appropriate renderer.\n *\n * When `includeSubAgents` is `true`, recursively installs `requires[]` entries as\n * separate flat agents in the same deploy directory (no nesting). Tracks visited\n * directories to prevent infinite loops in `requires[]` cycles.\n *\n * @param srcDir - Absolute path to the GitAgent source directory (contains `agent.yaml`).\n * @param agentDeployDir - Absolute path to the framework's agent deploy directory.\n * @param workspaceRoot - Absolute path to the workspace root.\n * @param driverTarget - Agent framework ID used to select the renderer.\n * @param skillsRelDir - Relative path to the installed skills dir (e.g. `\".claude/skills\"`).\n * @param nameOverride - Override name for the installed agent. Defaults to `manifest.name`.\n * @param includeSubAgents - When `true`, recursively install `requires[]` sub-agents.\n * @param visited - Set of resolved source paths already processed (cycle guard).\n * @param wsConfig - Workspace config from `skaile.yaml` (fragments, connectors, extensions).\n * @param log - Optional logger callback for progress messages.\n * @returns Object with `created` file paths and `warnings` list.\n * @docLink packages/asset-manager/concepts#install-agent\n */\nexport function installAgent(\n  srcDir: string,\n  agentDeployDir: string,\n  workspaceRoot: string,\n  driverTarget: string,\n  /** Relative path to the installed skills dir (e.g. \".claude/skills\") */\n  skillsRelDir: string,\n  nameOverride: string | undefined,\n  includeSubAgents: boolean,\n  visited: Set<string>,\n  wsConfig: SkWorkspaceConfig | undefined,\n  log?: (msg: string) => void,\n): { created: string[]; warnings: string[] } {\n  const created: string[] = [];\n  const warnings: string[] = [];\n\n  const realSrc = resolve(srcDir);\n  if (visited.has(realSrc)) return { created, warnings };\n  visited.add(realSrc);\n\n  const initialManifest = readManifest(srcDir);\n  if (!initialManifest) {\n    warnings.push(`${srcDir} has no agent.yaml — skipping (not a valid GitAgent package)`);\n    return { created, warnings };\n  }\n\n  // Phase 1: extends merge — inherit scalars/arrays from parent agent\n  const manifest = applyExtendsMerge(initialManifest, srcDir, warnings);\n\n  const agentName = nameOverride ?? manifest.name ?? basename(srcDir);\n\n  log?.(`Installing git-agent: ${agentName} (${driverTarget})`);\n\n  // Phase 2: resolve ability refs — read description from installed SKILL.md files\n  const abilityRefs = resolveAbilityRefs(manifest, workspaceRoot, skillsRelDir);\n\n  // Phase 3: resolve contract refs — locate CONTRACT.md files in the skills dir\n  const contractRefs = resolveContractRefs(manifest, workspaceRoot, skillsRelDir);\n\n  // Phase 4: build fragment context and resolve framework fragments + prompt extensions\n  const fragmentCtx = buildFragmentContext(\n    manifest,\n    driverTarget,\n    skillsRelDir,\n    wsConfig,\n    abilityRefs,\n    contractRefs,\n  );\n\n  const frameworkFragments = resolveFragments(\n    fragmentCtx,\n    wsConfig?.agent?.fragments,\n    workspaceRoot,\n  );\n  const promptExtensions = loadPromptExtensions(\n    wsConfig?.agent?.[\"prompt-extensions\"],\n    workspaceRoot,\n  );\n\n  const input: AgentRenderInput = {\n    manifest,\n    soul: readFile(srcDir, \"SOUL.md\"),\n    rules: readFile(srcDir, \"RULES.md\"),\n    duties: readFile(srcDir, \"DUTIES.md\"),\n    agentName,\n    agentDeployDir,\n    workspaceRoot,\n    abilityRefs,\n    contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  };\n\n  const result = renderAgentToFramework(input, driverTarget, log);\n  created.push(...result.created);\n  warnings.push(...result.warnings);\n\n  // Recursively install sub-agents from requires[] as flat top-level agents\n  if (includeSubAgents) {\n    installSubAgents(manifest, agentName, srcDir, agentDeployDir, workspaceRoot, driverTarget, {\n      skillsRelDir,\n      includeSubAgents,\n      visited,\n      wsConfig,\n      log,\n      created,\n      warnings,\n    });\n  }\n\n  return { created, warnings };\n}\n\n/**\n * Recursively install `requires[]` entries as separate flat agents in the same deploy\n * directory. Appends rendered file paths and warnings into the shared `created`/`warnings`\n * arrays carried on `ctx`.\n */\nfunction installSubAgents(\n  manifest: AgentManifest,\n  agentName: string,\n  srcDir: string,\n  agentDeployDir: string,\n  workspaceRoot: string,\n  driverTarget: string,\n  ctx: {\n    skillsRelDir: string;\n    includeSubAgents: boolean;\n    visited: Set<string>;\n    wsConfig: SkWorkspaceConfig | undefined;\n    log?: (msg: string) => void;\n    created: string[];\n    warnings: string[];\n  },\n): void {\n  for (const req of manifest.requires ?? []) {\n    if (!req.source || !req.name) continue;\n\n    const subSrc = isAbsolute(req.source) ? req.source : resolve(srcDir, req.source);\n\n    if (!existsSync(subSrc)) {\n      ctx.warnings.push(`Sub-agent source not found: ${req.source} (from ${agentName})`);\n      continue;\n    }\n\n    const sub = installAgent(\n      subSrc,\n      agentDeployDir,\n      workspaceRoot,\n      driverTarget,\n      ctx.skillsRelDir,\n      undefined, // use sub-agent's own name from its agent.yaml\n      ctx.includeSubAgents,\n      ctx.visited,\n      ctx.wsConfig,\n      ctx.log,\n    );\n    ctx.created.push(...sub.created);\n    ctx.warnings.push(...sub.warnings);\n  }\n}\n","/**\n * Asset deployment — copies assets into framework dirs by default (self-contained,\n * cache-safe, portable); `--link` opts into a symlink for the local-path dev loop.\n */\n\nimport {\n  cpSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  rmSync,\n  statSync,\n  symlinkSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { basename, dirname, join, resolve } from \"node:path\";\nimport type {\n  AiComponent,\n  CatalogEntry,\n  DriverTarget,\n  SourceDeclaration,\n} from \"@skaile/workspaces/core\";\nimport {\n  applyPatch,\n  computeHash,\n  DRIVER_TARGETS,\n  deployedBase,\n  deployedDir,\n  isDeployed,\n  resolveSkWorkspaceConfig,\n} from \"@skaile/workspaces/core\";\nimport { installAgent } from \"./install-agent.js\";\nimport type { Log } from \"./renderers.js\";\n\nexport type { Log } from \"./renderers.js\";\n\nconst noop: Log = () => {};\n\n// ── Filesystem helpers ────────────────────────────────────────────────────────\n\nconst DIRECTORY_MANIFESTS = new Set([\"SKILL.md\", \"AGENT.md\", \"agent.yaml\", \"CONTRACT.md\"]);\n\nfunction clearDest(dest: string): void {\n  try {\n    const s = lstatSync(dest);\n    if (s.isSymbolicLink()) unlinkSync(dest);\n    else rmSync(dest, { recursive: true, force: true });\n  } catch {}\n}\n\nfunction copyFromManifest(manifestPath: string, dest: string): void {\n  const name = basename(manifestPath);\n  const parentDir = dirname(manifestPath);\n  clearDest(dest);\n\n  // Source resolved to a directory itself (not a manifest file) — copy it whole;\n  // a plain cpSync without `recursive` throws on a directory.\n  if (statSync(manifestPath).isDirectory()) {\n    cpSync(manifestPath, dest, { recursive: true });\n  } else if (DIRECTORY_MANIFESTS.has(name) || basename(parentDir) === basename(dest)) {\n    cpSync(parentDir, dest, { recursive: true });\n  } else {\n    mkdirSync(dest, { recursive: true });\n    cpSync(manifestPath, join(dest, name));\n  }\n}\n\nfunction symlinkFromManifest(manifestPath: string, dest: string): void {\n  const name = basename(manifestPath);\n  const parentDir = dirname(manifestPath);\n  clearDest(dest);\n  mkdirSync(dirname(dest), { recursive: true });\n\n  if (statSync(manifestPath).isDirectory()) {\n    symlinkSync(resolve(manifestPath), dest);\n  } else if (DIRECTORY_MANIFESTS.has(name) || basename(parentDir) === basename(dest)) {\n    symlinkSync(resolve(parentDir), dest);\n  } else {\n    mkdirSync(dest, { recursive: true });\n    symlinkSync(resolve(manifestPath), join(dest, name));\n  }\n}\n\n// ── Deploy options ───────────────────────────────────────────────────────────\n\n/**\n * Options controlling where and how assets are deployed.\n *\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport interface DeployOptions {\n  /** Agent framework to target (determines framework-specific directory layout). Defaults to `\"claude-code\"`. */\n  driverTarget?: DriverTarget;\n  /** When `true`, deploy into the global Skaile cache rather than a project workspace. */\n  global?: boolean;\n  /** Absolute path to the workspace root. Defaults to `process.cwd()`. */\n  cwd?: string;\n  /**\n   * Opt into a symlink (the author dev-loop) instead of a copy — honoured only\n   * when the source has a real local path. Machine-local / not for committing;\n   * for store/factory sources (no stable local path) it is a no-op (still copy).\n   */\n  link?: boolean;\n}\n\n// ── Deploy / remove ──────────────────────────────────────────────────────────\n\n/**\n * Deploy a single asset to the framework-specific directory.\n *\n * Copies by default — self-contained, cache-safe, and portable, so a deployed\n * asset survives a `cache clean` of its source and a committed `.claude/` stays\n * machine-independent. `opts.link` opts into a symlink (the live dev-loop), but\n * only when the source has a real local path; store/factory sources (no stable\n * local path) ignore it and still copy. Agents are rendered via the enriched\n * `installAgent` path which resolves abilities, contracts, and framework\n * fragments before writing the native agent file.\n *\n * @param entry - Catalog entry describing the asset to deploy.\n * @param repositories - Repository declarations from `skaile.yaml` (used to\n *   determine whether the source is a local path or a remote clone).\n * @param opts - Deployment target options.\n * @param log - Optional logger callback for progress messages.\n * @returns `true` when the asset was deployed successfully.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function deployAsset(\n  entry: CatalogEntry,\n  repositories: Record<string, SourceDeclaration>,\n  opts: DeployOptions = {},\n  log: Log = noop,\n): boolean {\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const globalInstall = opts.global ?? false;\n  const cwd = opts.cwd;\n\n  // Bundles are not deployed directly — their dependencies are.\n  // MCP servers are configured in skaile.yaml, not deployed to driver target dirs.\n  if (entry.kind === \"bundle\" || entry.kind === \"mcp-server\") return true;\n\n  // Agents need framework-specific rendering via the enriched installAgent path\n  if (entry.kind === \"agent\") {\n    const workspaceRoot = cwd ?? process.cwd();\n    const agentDeployDir = deployedBase(\n      \"agent\" as AiComponent,\n      driverTarget as DriverTarget,\n      globalInstall,\n      cwd,\n    );\n    const targetMap = DRIVER_TARGETS[driverTarget as DriverTarget];\n    const skillsRelDir = targetMap?.local.skill ?? \"\";\n    const wsConfig = resolveSkWorkspaceConfig(workspaceRoot);\n    const name = basename(entry.source);\n    const srcDir = DIRECTORY_MANIFESTS.has(name) ? dirname(entry.source) : entry.source;\n    const result = installAgent(\n      srcDir,\n      agentDeployDir,\n      workspaceRoot,\n      driverTarget,\n      skillsRelDir,\n      entry.name,\n      /* includeSubAgents */ true,\n      new Set<string>(),\n      wsConfig,\n      log,\n    );\n    for (const w of result.warnings) log(`  warn: ${w}`);\n    if (result.created.length > 0) return true;\n    // Fall through to raw deploy if renderer produces no files (unsupported framework, etc.)\n  }\n\n  const dest = deployedDir(entry.kind as AiComponent, entry.name, driverTarget, globalInstall, cwd);\n  mkdirSync(dirname(dest), { recursive: true });\n\n  // Symlink only on explicit opt-in AND when the source has a real local path.\n  // Factory sources have a `path` (the bundled dir under node_modules, replaced\n  // on every upgrade) but no stable dev-loop, so they always copy. Default copy\n  // keeps deploys cache-safe and portable.\n  const repoDecl = entry.publisher ? repositories[entry.publisher] : undefined;\n  const hasLocalPath = repoDecl?.path != null && repoDecl.factory !== true;\n\n  if (opts.link === true && hasLocalPath) {\n    symlinkFromManifest(entry.source, dest);\n    log(`  symlink ${entry.kind}:${entry.name}`);\n    return true;\n  } else {\n    copyFromManifest(entry.source, dest);\n    log(`  copy ${entry.kind}:${entry.name}`);\n    return true;\n  }\n}\n\n/**\n * Deploy all resolved assets, applying patches where configured.\n *\n * Already-deployed assets are skipped unless their deployed manifest content differs\n * from the source. This handles copies that have gone stale after a source update.\n * In copy mode (the default, `!opts.link`) an existing **symlink** dest is healed:\n * it is removed and re-deployed as a real copy, so an old/legacy symlink deploy is\n * silently upgraded. With `opts.link` an existing symlink is left alone.\n *\n * @param resolved - Catalog entries to deploy (output of `resolveAll`).\n * @param repositories - Repository declarations from `skaile.yaml`.\n * @param patches - Map of `kind:name` → patch file path for patch application.\n * @param opts - Deployment target options.\n * @param log - Optional logger callback for progress messages.\n * @returns Array of asset refs (`kind:name`) that were newly deployed in this call.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function deployAll(\n  resolved: CatalogEntry[],\n  repositories: Record<string, SourceDeclaration>,\n  patches: Record<string, string>,\n  opts: DeployOptions = {},\n  log: Log = noop,\n): string[] {\n  const deployed: string[] = [];\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const globalInstall = opts.global ?? false;\n  const cwd = opts.cwd;\n\n  for (const entry of resolved) {\n    // Skip non-deployable asset kinds — bundles are resolved to their contents,\n    // mcp-servers are wired at session startup, and mixin kinds (persona, ruleset,\n    // knowledge) are resolved by the mixin-resolver at session creation time.\n    if (\n      entry.kind === \"bundle\" ||\n      entry.kind === \"mcp-server\" ||\n      entry.kind === \"persona\" ||\n      entry.kind === \"ruleset\" ||\n      entry.kind === \"knowledge\"\n    )\n      continue;\n\n    const ref = `${entry.kind}:${entry.name}`;\n\n    if (isDeployed(entry.kind as AiComponent, entry.name, driverTarget, globalInstall, cwd)) {\n      // Compare the deployed manifest file against the source to detect stale copies.\n      // For symlinks the deployed path resolves through to the source file, so hashes\n      // always match — symlinked installs are never needlessly re-linked.\n      const dest = deployedDir(\n        entry.kind as AiComponent,\n        entry.name,\n        driverTarget,\n        globalInstall,\n        cwd,\n      );\n      // Heal: in copy mode an existing symlink dest is left to fall through to a\n      // real copy below (cache-safe + portable) — bypass the hash skip entirely.\n      // With --link a symlink dest is intentional, so it takes the normal skip path.\n      let destIsSymlink = false;\n      try {\n        destIsSymlink = lstatSync(dest).isSymbolicLink();\n      } catch {}\n      const healSymlink = destIsSymlink && opts.link !== true;\n      // Surface the one-time symlink→copy migration so an author who relied on a\n      // live symlink dev-loop knows why edits stopped reflecting.\n      if (healSymlink) log(`  healed symlink → copy: ${ref} (use --link for the dev-loop)`);\n\n      if (!healSymlink) {\n        const manifestName = basename(entry.source);\n        const deployedManifest = join(dest, manifestName);\n        // isDeployed() only lstats the dir, so a present-but-empty dir (manifest\n        // file deleted) reads as deployed. A missing manifest must never count as\n        // \"already deployed\" — fall through to re-deploy instead of skipping.\n        // (existsSync follows symlinks, so for symlinked installs the manifest\n        // resolves through to the live source and the hash check below still\n        // skips them.)\n        if (existsSync(deployedManifest)) {\n          try {\n            const srcHash = computeHash(entry.source);\n            const depHash = computeHash(deployedManifest);\n            if (srcHash === depHash) {\n              log(`  already deployed: ${ref}`);\n              continue;\n            }\n            log(`  updating: ${ref} (content changed)`);\n            // fall through to redeploy\n          } catch {\n            // Deployed manifest unreadable (e.g. agent rendered to a different path) — skip\n            log(`  already deployed: ${ref}`);\n            continue;\n          }\n        }\n      }\n    }\n\n    deployAsset(entry, repositories, opts, log);\n    deployed.push(ref);\n\n    // Apply patch if configured\n    const patchFile = patches[ref];\n    if (patchFile && existsSync(patchFile)) {\n      const dest = deployedDir(\n        entry.kind as AiComponent,\n        entry.name,\n        driverTarget,\n        globalInstall,\n        cwd,\n      );\n      if (applyPatch(dest, patchFile)) {\n        log(`  patched ${ref}`);\n      } else {\n        log(`  patch failed for ${ref}`);\n      }\n    }\n  }\n\n  return deployed;\n}\n\n/**\n * Remove a deployed asset from the framework directory.\n *\n * Removes symlinks with `unlink`; removes copied directories with `rm -rf`.\n *\n * @param kind - Asset kind (`skill`, `agent`, `prompt`, `flow`, `contract`).\n * @param name - Asset name as registered in the catalog.\n * @param opts - Deployment target options (must match the options used at install time).\n * @returns `true` if the asset existed and was removed; `false` if it was not deployed.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function removeAsset(kind: string, name: string, opts: DeployOptions = {}): boolean {\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const globalInstall = opts.global ?? false;\n  const cwd = opts.cwd;\n\n  const dest = deployedDir(kind as AiComponent, name, driverTarget, globalInstall, cwd);\n  try {\n    const s = lstatSync(dest);\n    if (s.isSymbolicLink()) unlinkSync(dest);\n    else rmSync(dest, { recursive: true, force: true });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n// ── Scaffold ─────────────────────────────────────────────────────────────────\n\nconst SKILL_TEMPLATE = `---\nname: \"{name}\"\ndescription: \"\"\nmetadata:\n  version: \"0.1.0\"\n---\n\n# {name}\n\nSkill prompt goes here.\n`;\n\nconst BUNDLE_TEMPLATE = `name: {name}\ndescription: A curated set of assets\nversion: 0.1.0\ndependencies:\n  - skill:example-skill\n`;\n\nconst FLOW_TEMPLATE = `id: \"{name}\"\nversion: \"0.1.0\"\nname: \"{name}\"\ndescription: Flow description\n\nglobals:\n  approval_mode: checkpoint\n\nnodes: []\n`;\n\n/**\n * Create a minimal scaffold directory for a new asset.\n *\n * Writes the appropriate manifest file (`SKILL.md`, `AGENT.md`, `CONTRACT.md`,\n * `<name>.bundle.yaml`, `<name>.flow.yaml`, or `<name>.prompt.md`) inside a\n * new `<destDir>/<name>/` directory.\n *\n * @param name - Asset name (also used as the directory name).\n * @param kind - Asset kind: `skill` | `agent` | `bundle` | `flow` | `prompt` | `contract`.\n * @param destDir - Parent directory to create the asset in.\n * @returns `{ ok: true, path }` on success, `{ ok: false, path: errorMessage }` if the\n *   directory already exists.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function createScaffold(\n  name: string,\n  kind: string,\n  destDir: string,\n): { ok: boolean; path: string } {\n  const dest = join(destDir, name);\n  if (existsSync(dest)) {\n    return { ok: false, path: `Directory '${name}' already exists in ${destDir}` };\n  }\n  mkdirSync(dest, { recursive: true });\n\n  if (kind === \"bundle\") {\n    writeFileSync(\n      join(dest, `${name}.bundle.yaml`),\n      BUNDLE_TEMPLATE.replace(/\\{name\\}/g, name),\n      \"utf8\",\n    );\n  } else if (kind === \"flow\") {\n    writeFileSync(\n      join(dest, `${name}.flow.yaml`),\n      FLOW_TEMPLATE.replace(/\\{name\\}/g, name),\n      \"utf8\",\n    );\n  } else if (kind === \"prompt\") {\n    writeFileSync(\n      join(dest, `${name}.prompt.md`),\n      SKILL_TEMPLATE.replace(/\\{name\\}/g, name),\n      \"utf8\",\n    );\n  } else if (kind === \"agent\") {\n    writeFileSync(join(dest, \"AGENT.md\"), SKILL_TEMPLATE.replace(/\\{name\\}/g, name), \"utf8\");\n  } else if (kind === \"contract\") {\n    writeFileSync(join(dest, \"CONTRACT.md\"), SKILL_TEMPLATE.replace(/\\{name\\}/g, name), \"utf8\");\n  } else {\n    // Default: skill\n    writeFileSync(join(dest, \"SKILL.md\"), SKILL_TEMPLATE.replace(/\\{name\\}/g, name), \"utf8\");\n  }\n\n  return { ok: true, path: dest };\n}\n"]}
+{"version":3,"sources":["../asset-manager/src/install-agent.ts","../asset-manager/src/installer.ts"],"names":["parseYaml","basename","join","resolve","existsSync"],"mappings":";;;;;;;;;;AAmCA,SAAS,aAAa,QAAA,EAAwC;AAC5D,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,EAAU,YAAY,CAAA;AAC5C,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAOA,KAAA,CAAU,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,QAAA,CAAS,UAAkB,IAAA,EAA6B;AAC/D,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAC7B,EAAA,IAAI,CAAC,UAAA,CAAW,CAAC,CAAA,EAAG,OAAO,IAAA;AAC3B,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,GAAG,OAAO,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGA,SAAS,iBAAiB,OAAA,EAA0C;AAClE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,uBAAuB,CAAA;AACnD,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAC;AACpB,EAAA,IAAI;AACF,IAAA,OAAQA,KAAA,CAAU,KAAA,CAAM,CAAC,CAAE,KAAiC,EAAC;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAMA,SAAS,cAAA,CAAe,QAAuB,KAAA,EAAqC;AAClF,EAAA,MAAM,MAAA,GAAwB,EAAE,GAAG,MAAA,EAAO;AAC1C,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,GAAG,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAuC;AAChF,IAAA,IAAI,QAAQ,MAAA,EAAW;AACvB,IAAA,MAAM,SAAA,GAAY,OAAO,CAAwB,CAAA;AACjD,IAAA,IAAI,MAAM,OAAA,CAAQ,GAAG,KAAK,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAClD,MAAC,MAAA,CAAmC,CAAC,CAAA,GAAI,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,SAAA,EAAW,GAAG,GAAG,CAAC,CAAC,CAAA;AAAA,IAC9E,CAAA,MAAO;AACL,MAAC,MAAA,CAAmC,CAAC,CAAA,GAAI,GAAA;AAAA,IAC3C;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAMA,SAAS,iBAAA,CACP,QAAA,EACA,MAAA,EACA,QAAA,EACe;AACf,EAAA,IAAI,CAAC,QAAA,CAAS,OAAA,EAAS,OAAO,QAAA;AAC9B,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,MAAA,EAAQ,QAAA,CAAS,OAAO,CAAA;AAClD,EAAA,MAAM,cAAA,GAAiB,aAAa,SAAS,CAAA;AAC7C,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAO,cAAA,CAAe,gBAAgB,QAAQ,CAAA;AAAA,EAChD;AACA,EAAA,QAAA,CAAS,IAAA;AAAA,IACP,CAAA,oCAAA,EAAuC,QAAA,CAAS,OAAO,CAAA,QAAA,EAAW,MAAM,CAAA,6BAAA;AAAA,GAC1E;AACA,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,kBAAA,CACP,QAAA,EACA,aAAA,EACA,YAAA,EACc;AACd,EAAA,MAAM,cAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,SAAA,IAAa,EAAC,EAAG;AAC3C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,aAAA,EAAe,YAAA,EAAc,MAAM,UAAU,CAAA;AACtE,IAAA,IAAI,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,GAAK,gBAAA,CAAiB,YAAA,CAAa,WAAA,EAAa,OAAO,CAAC,CAAA;AAC9D,MAAA,MAAM,OAAO,OAAO,EAAA,CAAG,WAAA,KAAgB,QAAA,GAAW,GAAG,WAAA,GAAc,KAAA,CAAA;AACnE,MAAA,IAAI,MAAM,WAAA,CAAY,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAM,CAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,WAAA;AACT;AAGA,SAAS,mBAAA,CACP,QAAA,EACA,aAAA,EACA,YAAA,EACe;AACf,EAAA,MAAM,eAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,SAAA,IAAa,EAAC,EAAG;AAC3C,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,aAAA,EAAe,YAAA,EAAc,MAAM,aAAa,CAAA;AAC7E,IAAA,IAAI,CAAC,UAAA,CAAW,eAAe,CAAA,EAAG;AAClC,IAAA,YAAA,CAAa,IAAA,CAAK,EAAE,IAAA,EAAM,YAAA,EAAc,SAAS,aAAA,EAAe,eAAe,GAAG,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,YAAA;AACT;AAGA,SAAS,qBACP,QAAA,EACA,YAAA,EACA,YAAA,EACA,QAAA,EACA,aACA,YAAA,EACiB;AACjB,EAAA,MAAM,aAAA,GAAA,CAAiB,QAAA,CAAS,QAAA,IAAY,IAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAEvF,EAAA,MAAM,cAA8B,QAAA,EAAU,UAAA,IAAc,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,IAC1E,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU;AAAA,GACtB,CAAE,CAAA;AAEF,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,YAA4B,CAAA,EAAG,MAAM,KAAA,IAAS,EAAA;AAElF,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,YAAA;AAAA,IACX,SAAA,EAAW,YAAA;AAAA,IACX,SAAA,EAAW,YAAA;AAAA,IACX,SAAA,EAAW,aAAA;AAAA,IACX,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;AAwBO,SAAS,YAAA,CACd,MAAA,EACA,cAAA,EACA,aAAA,EACA,YAAA,EAEA,cACA,YAAA,EACA,gBAAA,EACA,OAAA,EACA,QAAA,EACA,GAAA,EAC2C;AAC3C,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAM,CAAA;AAC9B,EAAA,IAAI,QAAQ,GAAA,CAAI,OAAO,GAAG,OAAO,EAAE,SAAS,QAAA,EAAS;AACrD,EAAA,OAAA,CAAQ,IAAI,OAAO,CAAA;AAEnB,EAAA,MAAM,eAAA,GAAkB,aAAa,MAAM,CAAA;AAC3C,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,iEAAA,CAA8D,CAAA;AACrF,IAAA,OAAO,EAAE,SAAS,QAAA,EAAS;AAAA,EAC7B;AAGA,EAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,eAAA,EAAiB,MAAA,EAAQ,QAAQ,CAAA;AAEpE,EAAA,MAAM,SAAA,GAAY,YAAA,IAAgB,QAAA,CAAS,IAAA,IAAQ,SAAS,MAAM,CAAA;AAElE,EAAA,GAAA,GAAM,CAAA,sBAAA,EAAyB,SAAS,CAAA,EAAA,EAAK,YAAY,CAAA,CAAA,CAAG,CAAA;AAG5D,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,QAAA,EAAU,aAAA,EAAe,YAAY,CAAA;AAG5E,EAAA,MAAM,YAAA,GAAe,mBAAA,CAAoB,QAAA,EAAU,aAAA,EAAe,YAAY,CAAA;AAG9E,EAAA,MAAM,WAAA,GAAc,oBAAA;AAAA,IAClB,QAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA,QAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,kBAAA,GAAqB,gBAAA;AAAA,IACzB,WAAA;AAAA,IACA,UAAU,KAAA,EAAO,SAAA;AAAA,IACjB;AAAA,GACF;AACA,EAAA,MAAM,gBAAA,GAAmB,oBAAA;AAAA,IACvB,QAAA,EAAU,QAAQ,mBAAmB,CAAA;AAAA,IACrC;AAAA,GACF;AAEA,EAAA,MAAM,KAAA,GAA0B;AAAA,IAC9B,QAAA;AAAA,IACA,IAAA,EAAM,QAAA,CAAS,MAAA,EAAQ,SAAS,CAAA;AAAA,IAChC,KAAA,EAAO,QAAA,CAAS,MAAA,EAAQ,UAAU,CAAA;AAAA,IAClC,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,WAAW,CAAA;AAAA,IACpC,SAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,KAAA,EAAO,YAAA,EAAc,GAAG,CAAA;AAC9D,EAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAA,CAAO,OAAO,CAAA;AAC9B,EAAA,QAAA,CAAS,IAAA,CAAK,GAAG,MAAA,CAAO,QAAQ,CAAA;AAGhC,EAAA,IAAI,gBAAA,EAAkB;AACpB,IAAA,gBAAA,CAAiB,QAAA,EAAU,SAAA,EAAW,MAAA,EAAQ,cAAA,EAAgB,eAAe,YAAA,EAAc;AAAA,MACzF,YAAA;AAAA,MACA,gBAAA;AAAA,MACA,OAAA;AAAA,MACA,QAAA;AAAA,MACA,GAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,EAAE,SAAS,QAAA,EAAS;AAC7B;AAOA,SAAS,iBACP,QAAA,EACA,SAAA,EACA,QACA,cAAA,EACA,aAAA,EACA,cACA,GAAA,EASM;AACN,EAAA,KAAA,MAAW,GAAA,IAAO,QAAA,CAAS,QAAA,IAAY,EAAC,EAAG;AACzC,IAAA,IAAI,CAAC,GAAA,CAAI,MAAA,IAAU,CAAC,IAAI,IAAA,EAAM;AAE9B,IAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,GAAI,IAAI,MAAA,GAAS,OAAA,CAAQ,MAAA,EAAQ,GAAA,CAAI,MAAM,CAAA;AAE/E,IAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG;AACvB,MAAA,GAAA,CAAI,SAAS,IAAA,CAAK,CAAA,4BAAA,EAA+B,IAAI,MAAM,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,CAAG,CAAA;AACjF,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,YAAA;AAAA,MACV,MAAA;AAAA,MACA,cAAA;AAAA,MACA,aAAA;AAAA,MACA,YAAA;AAAA,MACA,GAAA,CAAI,YAAA;AAAA,MACJ,MAAA;AAAA;AAAA,MACA,GAAA,CAAI,gBAAA;AAAA,MACJ,GAAA,CAAI,OAAA;AAAA,MACJ,GAAA,CAAI,QAAA;AAAA,MACJ,GAAA,CAAI;AAAA,KACN;AACA,IAAA,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,GAAA,CAAI,OAAO,CAAA;AAC/B,IAAA,GAAA,CAAI,QAAA,CAAS,IAAA,CAAK,GAAG,GAAA,CAAI,QAAQ,CAAA;AAAA,EACnC;AACF;;;ACxSA,IAAM,OAAY,MAAM;AAAC,CAAA;AAIzB,IAAM,mBAAA,uBAA0B,GAAA,CAAI,CAAC,YAAY,UAAA,EAAY,YAAA,EAAc,aAAa,CAAC,CAAA;AAEzF,SAAS,UAAU,IAAA,EAAoB;AACrC,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,UAAU,IAAI,CAAA;AACxB,IAAA,IAAI,CAAA,CAAE,cAAA,EAAe,EAAG,UAAA,CAAW,IAAI,CAAA;AAAA,gBAC3B,IAAA,EAAM,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AAAA,EAAC;AACX;AAEA,SAAS,gBAAA,CAAiB,cAAsB,IAAA,EAAoB;AAClE,EAAA,MAAM,IAAA,GAAOC,SAAS,YAAY,CAAA;AAClC,EAAA,MAAM,SAAA,GAAY,QAAQ,YAAY,CAAA;AACtC,EAAA,SAAA,CAAU,IAAI,CAAA;AAId,EAAA,IAAI,QAAA,CAAS,YAAY,CAAA,CAAE,WAAA,EAAY,EAAG;AACxC,IAAA,MAAA,CAAO,YAAA,EAAc,IAAA,EAAM,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,EAChD,CAAA,MAAA,IAAW,mBAAA,CAAoB,GAAA,CAAI,IAAI,CAAA,IAAKA,SAAS,SAAS,CAAA,KAAMA,QAAAA,CAAS,IAAI,CAAA,EAAG;AAClF,IAAA,MAAA,CAAO,SAAA,EAAW,IAAA,EAAM,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,EAC7C,CAAA,MAAO;AACL,IAAA,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACnC,IAAA,MAAA,CAAO,YAAA,EAAcC,IAAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,EACvC;AACF;AAEA,SAAS,mBAAA,CAAoB,cAAsB,IAAA,EAAoB;AACrE,EAAA,MAAM,IAAA,GAAOD,SAAS,YAAY,CAAA;AAClC,EAAA,MAAM,SAAA,GAAY,QAAQ,YAAY,CAAA;AACtC,EAAA,SAAA,CAAU,IAAI,CAAA;AACd,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAE5C,EAAA,IAAI,QAAA,CAAS,YAAY,CAAA,CAAE,WAAA,EAAY,EAAG;AACxC,IAAA,WAAA,CAAYE,OAAAA,CAAQ,YAAY,CAAA,EAAG,IAAI,CAAA;AAAA,EACzC,CAAA,MAAA,IAAW,mBAAA,CAAoB,GAAA,CAAI,IAAI,CAAA,IAAKF,SAAS,SAAS,CAAA,KAAMA,QAAAA,CAAS,IAAI,CAAA,EAAG;AAClF,IAAA,WAAA,CAAYE,OAAAA,CAAQ,SAAS,CAAA,EAAG,IAAI,CAAA;AAAA,EACtC,CAAA,MAAO;AACL,IAAA,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACnC,IAAA,WAAA,CAAYA,QAAQ,YAAY,CAAA,EAAGD,IAAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,EACrD;AACF;AA6CO,SAAS,YACd,KAAA,EACA,YAAA,EACA,OAAsB,EAAC,EACvB,MAAW,IAAA,EACF;AACT,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,KAAK,MAAA,IAAU,KAAA;AACrC,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AAIjB,EAAA,IAAI,MAAM,IAAA,KAAS,QAAA,IAAY,KAAA,CAAM,IAAA,KAAS,cAAc,OAAO,IAAA;AAGnE,EAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,IAAA,MAAM,aAAA,GAAgB,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACzC,IAAA,MAAM,cAAA,GAAiB,YAAA;AAAA,MACrB,OAAA;AAAA,MACA,YAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,SAAA,GAAY,eAAe,YAA4B,CAAA;AAC7D,IAAA,MAAM,YAAA,GAAe,SAAA,EAAW,KAAA,CAAM,KAAA,IAAS,EAAA;AAC/C,IAAA,MAAM,QAAA,GAAW,yBAAyB,aAAa,CAAA;AACvD,IAAA,MAAM,IAAA,GAAOD,QAAAA,CAAS,KAAA,CAAM,MAAM,CAAA;AAClC,IAAA,MAAM,MAAA,GAAS,oBAAoB,GAAA,CAAI,IAAI,IAAI,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA,GAAI,KAAA,CAAM,MAAA;AAC7E,IAAA,MAAM,MAAA,GAAS,YAAA;AAAA,MACb,MAAA;AAAA,MACA,cAAA;AAAA,MACA,aAAA;AAAA,MACA,YAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA,CAAM,IAAA;AAAA;AAAA,MACiB,IAAA;AAAA,0BACnB,GAAA,EAAY;AAAA,MAChB,QAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,KAAA,MAAW,KAAK,MAAA,CAAO,QAAA,EAAU,GAAA,CAAI,CAAA,QAAA,EAAW,CAAC,CAAA,CAAE,CAAA;AACnD,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA;AAAA,EAExC;AAEA,EAAA,MAAM,IAAA,GAAO,YAAY,KAAA,CAAM,IAAA,EAAqB,MAAM,IAAA,EAAM,YAAA,EAAc,eAAe,GAAG,CAAA;AAChG,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAM5C,EAAA,MAAM,WAAW,KAAA,CAAM,SAAA,GAAY,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA,GAAI,MAAA;AACnE,EAAA,MAAM,YAAA,GAAe,QAAA,EAAU,IAAA,IAAQ,IAAA,IAAQ,SAAS,OAAA,KAAY,IAAA;AAEpE,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,IAAA,IAAQ,YAAA,EAAc;AACtC,IAAA,mBAAA,CAAoB,KAAA,CAAM,QAAQ,IAAI,CAAA;AACtC,IAAA,GAAA,CAAI,aAAa,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,CAAE,CAAA;AAC3C,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,MAAO;AACL,IAAA,gBAAA,CAAiB,KAAA,CAAM,QAAQ,IAAI,CAAA;AACnC,IAAA,GAAA,CAAI,UAAU,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,CAAE,CAAA;AACxC,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAmBO,SAAS,SAAA,CACd,UACA,YAAA,EACA,OAAA,EACA,OAAsB,EAAC,EACvB,MAAW,IAAA,EACD;AACV,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,KAAK,MAAA,IAAU,KAAA;AACrC,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AAEjB,EAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAI5B,IAAA,IACE,KAAA,CAAM,IAAA,KAAS,QAAA,IACf,KAAA,CAAM,IAAA,KAAS,YAAA,IACf,KAAA,CAAM,IAAA,KAAS,SAAA,IACf,KAAA,CAAM,IAAA,KAAS,SAAA,IACf,MAAM,IAAA,KAAS,WAAA;AAEf,MAAA;AAEF,IAAA,MAAM,MAAM,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAEvC,IAAA,IAAI,UAAA,CAAW,MAAM,IAAA,EAAqB,KAAA,CAAM,MAAM,YAAA,EAAc,aAAA,EAAe,GAAG,CAAA,EAAG;AAIvF,MAAA,MAAM,IAAA,GAAO,WAAA;AAAA,QACX,KAAA,CAAM,IAAA;AAAA,QACN,KAAA,CAAM,IAAA;AAAA,QACN,YAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAIA,MAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,MAAA,IAAI;AACF,QAAA,aAAA,GAAgB,SAAA,CAAU,IAAI,CAAA,CAAE,cAAA,EAAe;AAAA,MACjD,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,WAAA,GAAc,aAAA,IAAiB,IAAA,CAAK,IAAA,KAAS,IAAA;AAGnD,MAAA,IAAI,WAAA,EAAa,GAAA,CAAI,CAAA,8BAAA,EAA4B,GAAG,CAAA,8BAAA,CAAgC,CAAA;AAEpF,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,MAAM,YAAA,GAAeA,QAAAA,CAAS,KAAA,CAAM,MAAM,CAAA;AAC1C,QAAA,MAAM,gBAAA,GAAmBC,IAAAA,CAAK,IAAA,EAAM,YAAY,CAAA;AAOhD,QAAA,IAAIE,UAAAA,CAAW,gBAAgB,CAAA,EAAG;AAChC,UAAA,IAAI;AACF,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,KAAA,CAAM,MAAM,CAAA;AACxC,YAAA,MAAM,OAAA,GAAU,YAAY,gBAAgB,CAAA;AAC5C,YAAA,IAAI,YAAY,OAAA,EAAS;AACvB,cAAA,GAAA,CAAI,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAE,CAAA;AAChC,cAAA;AAAA,YACF;AACA,YAAA,GAAA,CAAI,CAAA,YAAA,EAAe,GAAG,CAAA,kBAAA,CAAoB,CAAA;AAAA,UAE5C,CAAA,CAAA,MAAQ;AAEN,YAAA,GAAA,CAAI,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAE,CAAA;AAChC,YAAA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,WAAA,CAAY,KAAA,EAAO,YAAA,EAAc,IAAA,EAAM,GAAG,CAAA;AAC1C,IAAA,QAAA,CAAS,KAAK,GAAG,CAAA;AAGjB,IAAA,MAAM,SAAA,GAAY,QAAQ,GAAG,CAAA;AAC7B,IAAA,IAAI,SAAA,IAAaA,UAAAA,CAAW,SAAS,CAAA,EAAG;AACtC,MAAA,MAAM,IAAA,GAAO,WAAA;AAAA,QACX,KAAA,CAAM,IAAA;AAAA,QACN,KAAA,CAAM,IAAA;AAAA,QACN,YAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,UAAA,CAAW,IAAA,EAAM,SAAS,CAAA,EAAG;AAC/B,QAAA,GAAA,CAAI,CAAA,UAAA,EAAa,GAAG,CAAA,CAAE,CAAA;AAAA,MACxB,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,CAAA,mBAAA,EAAsB,GAAG,CAAA,CAAE,CAAA;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,QAAA;AACT;AAaO,SAAS,WAAA,CAAY,IAAA,EAAc,IAAA,EAAc,IAAA,GAAsB,EAAC,EAAY;AACzF,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,KAAK,MAAA,IAAU,KAAA;AACrC,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AAEjB,EAAA,MAAM,OAAO,WAAA,CAAY,IAAA,EAAqB,IAAA,EAAM,YAAA,EAAc,eAAe,GAAG,CAAA;AACpF,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,UAAU,IAAI,CAAA;AACxB,IAAA,IAAI,CAAA,CAAE,cAAA,EAAe,EAAG,UAAA,CAAW,IAAI,CAAA;AAAA,gBAC3B,IAAA,EAAM,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAClD,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAIA,IAAM,cAAA,GAAiB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA,CAAA;AAYvB,IAAM,eAAA,GAAkB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAOxB,IAAM,aAAA,GAAgB,CAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA,CAAA;AAyBf,SAAS,cAAA,CACd,IAAA,EACA,IAAA,EACA,OAAA,EAC+B;AAC/B,EAAA,MAAM,IAAA,GAAOF,IAAAA,CAAK,OAAA,EAAS,IAAI,CAAA;AAC/B,EAAA,IAAIE,UAAAA,CAAW,IAAI,CAAA,EAAG;AACpB,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,IAAA,EAAM,cAAc,IAAI,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,EAAG;AAAA,EAC/E;AACA,EAAA,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAEnC,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,aAAA;AAAA,MACEF,IAAAA,CAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,YAAA,CAAc,CAAA;AAAA,MAChC,eAAA,CAAgB,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA;AAAA,MACzC;AAAA,KACF;AAAA,EACF,CAAA,MAAA,IAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,aAAA;AAAA,MACEA,IAAAA,CAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,UAAA,CAAY,CAAA;AAAA,MAC9B,aAAA,CAAc,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA;AAAA,MACvC;AAAA,KACF;AAAA,EACF,CAAA,MAAA,IAAW,SAAS,QAAA,EAAU;AAC5B,IAAA,aAAA;AAAA,MACEA,IAAAA,CAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,UAAA,CAAY,CAAA;AAAA,MAC9B,cAAA,CAAe,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA;AAAA,MACxC;AAAA,KACF;AAAA,EACF,CAAA,MAAA,IAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,aAAA,CAAcA,IAAAA,CAAK,MAAM,UAAU,CAAA,EAAG,eAAe,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA,EAAG,MAAM,CAAA;AAAA,EACzF,CAAA,MAAA,IAAW,SAAS,UAAA,EAAY;AAC9B,IAAA,aAAA,CAAcA,IAAAA,CAAK,MAAM,aAAa,CAAA,EAAG,eAAe,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA,EAAG,MAAM,CAAA;AAAA,EAC5F,CAAA,MAAO;AAEL,IAAA,aAAA,CAAcA,IAAAA,CAAK,MAAM,UAAU,CAAA,EAAG,eAAe,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA,EAAG,MAAM,CAAA;AAAA,EACzF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,IAAA,EAAK;AAChC","file":"chunk-HL6SZ7Z3.js","sourcesContent":["/**\n * Agent installation — renders a GitAgent package (agent.yaml + SOUL.md + RULES.md)\n * into the framework-native format (`.claude/agents/<name>.md`, `.omp/agents/<name>/`,\n * `.codex/agents/<name>.toml`) and resolves abilities, contracts, fragments, and\n * prompt extensions from the workspace config along the way.\n *\n * System prompt phases (per agent):\n *   1. extends merge     — inherit from parent agent.yaml if manifest.extends is set\n *   2. ability refs      — read SKILL.md frontmatter from installed skills dir\n *   3. contract refs     — locate CONTRACT.md files in the installed skills dir\n *   4. fragments         — resolve framework fragments (agent-mode, handoff, etc.)\n *   5. prompt-extensions — load per-project markdown extensions from skaile.yaml\n *\n * Used by `installer.ts` (the asset-install path) and `skaile install`. Sub-agents\n * declared in `agent.yaml#requires` are installed flat (no nesting) in the same\n * deploy directory.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { basename, isAbsolute, join, relative, resolve } from \"node:path\";\nimport type { DriverTarget, SkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport { DRIVER_TARGETS } from \"@skaile/workspaces/core\";\nimport { parse as parseYaml } from \"yaml\";\nimport {\n  type AbilityRef,\n  type ConnectorRef,\n  type ContractRef,\n  type FragmentContext,\n  loadPromptExtensions,\n  resolveFragments,\n} from \"./fragments.js\";\nimport { type AgentManifest, type AgentRenderInput, renderAgentToFramework } from \"./renderers.js\";\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nfunction readManifest(agentDir: string): AgentManifest | null {\n  const yamlPath = join(agentDir, \"agent.yaml\");\n  if (!existsSync(yamlPath)) return null;\n  try {\n    return parseYaml(readFileSync(yamlPath, \"utf-8\")) as AgentManifest;\n  } catch {\n    return null;\n  }\n}\n\nfunction readFile(agentDir: string, name: string): string | null {\n  const p = join(agentDir, name);\n  if (!existsSync(p)) return null;\n  try {\n    return readFileSync(p, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\n/** Extract YAML frontmatter from a markdown file (content between first two --- delimiters). */\nfunction parseFrontmatter(content: string): Record<string, unknown> {\n  const match = content.match(/^---\\n([\\s\\S]*?)\\n---/);\n  if (!match) return {};\n  try {\n    return (parseYaml(match[1]!) as Record<string, unknown>) ?? {};\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Merge parent and child agent manifests.\n * Scalars: child wins. Arrays: parent + child, deduplicated.\n */\nfunction mergeManifests(parent: AgentManifest, child: AgentManifest): AgentManifest {\n  const result: AgentManifest = { ...parent };\n  for (const [k, val] of Object.entries(child) as [keyof AgentManifest, unknown][]) {\n    if (val === undefined) continue;\n    const parentVal = result[k as keyof AgentManifest];\n    if (Array.isArray(val) && Array.isArray(parentVal)) {\n      (result as Record<string, unknown>)[k] = [...new Set([...parentVal, ...val])];\n    } else {\n      (result as Record<string, unknown>)[k] = val;\n    }\n  }\n  return result;\n}\n\n/**\n * Phase 1: inherit scalars/arrays from a parent agent when `manifest.extends` is set.\n * Returns the (possibly merged) manifest; pushes a warning when the parent is missing.\n */\nfunction applyExtendsMerge(\n  manifest: AgentManifest,\n  srcDir: string,\n  warnings: string[],\n): AgentManifest {\n  if (!manifest.extends) return manifest;\n  const parentDir = resolve(srcDir, manifest.extends);\n  const parentManifest = readManifest(parentDir);\n  if (parentManifest) {\n    return mergeManifests(parentManifest, manifest);\n  }\n  warnings.push(\n    `extends: parent agent not found at \"${manifest.extends}\" (from ${srcDir}) — skipping inheritance`,\n  );\n  return manifest;\n}\n\n/** Phase 2: resolve ability refs — read description from installed SKILL.md files. */\nfunction resolveAbilityRefs(\n  manifest: AgentManifest,\n  workspaceRoot: string,\n  skillsRelDir: string,\n): AbilityRef[] {\n  const abilityRefs: AbilityRef[] = [];\n  for (const name of manifest.abilities ?? []) {\n    const skillMdPath = join(workspaceRoot, skillsRelDir, name, \"SKILL.md\");\n    if (!existsSync(skillMdPath)) continue;\n    try {\n      const fm = parseFrontmatter(readFileSync(skillMdPath, \"utf-8\"));\n      const desc = typeof fm.description === \"string\" ? fm.description : undefined;\n      if (desc) abilityRefs.push({ name, description: desc });\n    } catch {\n      // skip unreadable SKILL.md\n    }\n  }\n  return abilityRefs;\n}\n\n/** Phase 3: resolve contract refs — locate CONTRACT.md files in the skills dir. */\nfunction resolveContractRefs(\n  manifest: AgentManifest,\n  workspaceRoot: string,\n  skillsRelDir: string,\n): ContractRef[] {\n  const contractRefs: ContractRef[] = [];\n  for (const name of manifest.contracts ?? []) {\n    const contractAbsPath = join(workspaceRoot, skillsRelDir, name, \"CONTRACT.md\");\n    if (!existsSync(contractAbsPath)) continue;\n    contractRefs.push({ name, relativePath: relative(workspaceRoot, contractAbsPath) });\n  }\n  return contractRefs;\n}\n\n/** Phase 4: assemble the fragment context from the manifest, workspace config, and resolved refs. */\nfunction buildFragmentContext(\n  manifest: AgentManifest,\n  driverTarget: string,\n  skillsRelDir: string,\n  wsConfig: SkWorkspaceConfig | undefined,\n  abilityRefs: AbilityRef[],\n  contractRefs: ContractRef[],\n): FragmentContext {\n  const subAgentNames = (manifest.requires ?? []).filter((r) => r.name).map((r) => r.name);\n\n  const connectors: ConnectorRef[] = (wsConfig?.connectors ?? []).map((c) => ({\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-write\",\n  }));\n\n  const agentsRelDir = DRIVER_TARGETS[driverTarget as DriverTarget]?.local.agent ?? \"\";\n\n  return {\n    framework: driverTarget,\n    skillsDir: skillsRelDir,\n    agentsDir: agentsRelDir,\n    subAgents: subAgentNames,\n    connectors,\n    abilityRefs,\n    contractRefs,\n  };\n}\n\n// ── Core installation ─────────────────────────────────────────────────────────\n\n/**\n * Install a single GitAgent source directory using the appropriate renderer.\n *\n * When `includeSubAgents` is `true`, recursively installs `requires[]` entries as\n * separate flat agents in the same deploy directory (no nesting). Tracks visited\n * directories to prevent infinite loops in `requires[]` cycles.\n *\n * @param srcDir - Absolute path to the GitAgent source directory (contains `agent.yaml`).\n * @param agentDeployDir - Absolute path to the framework's agent deploy directory.\n * @param workspaceRoot - Absolute path to the workspace root.\n * @param driverTarget - Agent framework ID used to select the renderer.\n * @param skillsRelDir - Relative path to the installed skills dir (e.g. `\".claude/skills\"`).\n * @param nameOverride - Override name for the installed agent. Defaults to `manifest.name`.\n * @param includeSubAgents - When `true`, recursively install `requires[]` sub-agents.\n * @param visited - Set of resolved source paths already processed (cycle guard).\n * @param wsConfig - Workspace config from `skaile.yaml` (fragments, connectors, extensions).\n * @param log - Optional logger callback for progress messages.\n * @returns Object with `created` file paths and `warnings` list.\n * @docLink packages/asset-manager/concepts#install-agent\n */\nexport function installAgent(\n  srcDir: string,\n  agentDeployDir: string,\n  workspaceRoot: string,\n  driverTarget: string,\n  /** Relative path to the installed skills dir (e.g. \".claude/skills\") */\n  skillsRelDir: string,\n  nameOverride: string | undefined,\n  includeSubAgents: boolean,\n  visited: Set<string>,\n  wsConfig: SkWorkspaceConfig | undefined,\n  log?: (msg: string) => void,\n): { created: string[]; warnings: string[] } {\n  const created: string[] = [];\n  const warnings: string[] = [];\n\n  const realSrc = resolve(srcDir);\n  if (visited.has(realSrc)) return { created, warnings };\n  visited.add(realSrc);\n\n  const initialManifest = readManifest(srcDir);\n  if (!initialManifest) {\n    warnings.push(`${srcDir} has no agent.yaml — skipping (not a valid GitAgent package)`);\n    return { created, warnings };\n  }\n\n  // Phase 1: extends merge — inherit scalars/arrays from parent agent\n  const manifest = applyExtendsMerge(initialManifest, srcDir, warnings);\n\n  const agentName = nameOverride ?? manifest.name ?? basename(srcDir);\n\n  log?.(`Installing git-agent: ${agentName} (${driverTarget})`);\n\n  // Phase 2: resolve ability refs — read description from installed SKILL.md files\n  const abilityRefs = resolveAbilityRefs(manifest, workspaceRoot, skillsRelDir);\n\n  // Phase 3: resolve contract refs — locate CONTRACT.md files in the skills dir\n  const contractRefs = resolveContractRefs(manifest, workspaceRoot, skillsRelDir);\n\n  // Phase 4: build fragment context and resolve framework fragments + prompt extensions\n  const fragmentCtx = buildFragmentContext(\n    manifest,\n    driverTarget,\n    skillsRelDir,\n    wsConfig,\n    abilityRefs,\n    contractRefs,\n  );\n\n  const frameworkFragments = resolveFragments(\n    fragmentCtx,\n    wsConfig?.agent?.fragments,\n    workspaceRoot,\n  );\n  const promptExtensions = loadPromptExtensions(\n    wsConfig?.agent?.[\"prompt-extensions\"],\n    workspaceRoot,\n  );\n\n  const input: AgentRenderInput = {\n    manifest,\n    soul: readFile(srcDir, \"SOUL.md\"),\n    rules: readFile(srcDir, \"RULES.md\"),\n    duties: readFile(srcDir, \"DUTIES.md\"),\n    agentName,\n    agentDeployDir,\n    workspaceRoot,\n    abilityRefs,\n    contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  };\n\n  const result = renderAgentToFramework(input, driverTarget, log);\n  created.push(...result.created);\n  warnings.push(...result.warnings);\n\n  // Recursively install sub-agents from requires[] as flat top-level agents\n  if (includeSubAgents) {\n    installSubAgents(manifest, agentName, srcDir, agentDeployDir, workspaceRoot, driverTarget, {\n      skillsRelDir,\n      includeSubAgents,\n      visited,\n      wsConfig,\n      log,\n      created,\n      warnings,\n    });\n  }\n\n  return { created, warnings };\n}\n\n/**\n * Recursively install `requires[]` entries as separate flat agents in the same deploy\n * directory. Appends rendered file paths and warnings into the shared `created`/`warnings`\n * arrays carried on `ctx`.\n */\nfunction installSubAgents(\n  manifest: AgentManifest,\n  agentName: string,\n  srcDir: string,\n  agentDeployDir: string,\n  workspaceRoot: string,\n  driverTarget: string,\n  ctx: {\n    skillsRelDir: string;\n    includeSubAgents: boolean;\n    visited: Set<string>;\n    wsConfig: SkWorkspaceConfig | undefined;\n    log?: (msg: string) => void;\n    created: string[];\n    warnings: string[];\n  },\n): void {\n  for (const req of manifest.requires ?? []) {\n    if (!req.source || !req.name) continue;\n\n    const subSrc = isAbsolute(req.source) ? req.source : resolve(srcDir, req.source);\n\n    if (!existsSync(subSrc)) {\n      ctx.warnings.push(`Sub-agent source not found: ${req.source} (from ${agentName})`);\n      continue;\n    }\n\n    const sub = installAgent(\n      subSrc,\n      agentDeployDir,\n      workspaceRoot,\n      driverTarget,\n      ctx.skillsRelDir,\n      undefined, // use sub-agent's own name from its agent.yaml\n      ctx.includeSubAgents,\n      ctx.visited,\n      ctx.wsConfig,\n      ctx.log,\n    );\n    ctx.created.push(...sub.created);\n    ctx.warnings.push(...sub.warnings);\n  }\n}\n","/**\n * Asset deployment — copies assets into framework dirs by default (self-contained,\n * cache-safe, portable); `--link` opts into a symlink for the local-path dev loop.\n */\n\nimport {\n  cpSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  rmSync,\n  statSync,\n  symlinkSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { basename, dirname, join, resolve } from \"node:path\";\nimport type {\n  AiComponent,\n  CatalogEntry,\n  DriverTarget,\n  SourceDeclaration,\n} from \"@skaile/workspaces/core\";\nimport {\n  applyPatch,\n  computeHash,\n  DRIVER_TARGETS,\n  deployedBase,\n  deployedDir,\n  isDeployed,\n  resolveSkWorkspaceConfig,\n} from \"@skaile/workspaces/core\";\nimport { installAgent } from \"./install-agent.js\";\nimport type { Log } from \"./renderers.js\";\n\nexport type { Log } from \"./renderers.js\";\n\nconst noop: Log = () => {};\n\n// ── Filesystem helpers ────────────────────────────────────────────────────────\n\nconst DIRECTORY_MANIFESTS = new Set([\"SKILL.md\", \"AGENT.md\", \"agent.yaml\", \"CONTRACT.md\"]);\n\nfunction clearDest(dest: string): void {\n  try {\n    const s = lstatSync(dest);\n    if (s.isSymbolicLink()) unlinkSync(dest);\n    else rmSync(dest, { recursive: true, force: true });\n  } catch {}\n}\n\nfunction copyFromManifest(manifestPath: string, dest: string): void {\n  const name = basename(manifestPath);\n  const parentDir = dirname(manifestPath);\n  clearDest(dest);\n\n  // Source resolved to a directory itself (not a manifest file) — copy it whole;\n  // a plain cpSync without `recursive` throws on a directory.\n  if (statSync(manifestPath).isDirectory()) {\n    cpSync(manifestPath, dest, { recursive: true });\n  } else if (DIRECTORY_MANIFESTS.has(name) || basename(parentDir) === basename(dest)) {\n    cpSync(parentDir, dest, { recursive: true });\n  } else {\n    mkdirSync(dest, { recursive: true });\n    cpSync(manifestPath, join(dest, name));\n  }\n}\n\nfunction symlinkFromManifest(manifestPath: string, dest: string): void {\n  const name = basename(manifestPath);\n  const parentDir = dirname(manifestPath);\n  clearDest(dest);\n  mkdirSync(dirname(dest), { recursive: true });\n\n  if (statSync(manifestPath).isDirectory()) {\n    symlinkSync(resolve(manifestPath), dest);\n  } else if (DIRECTORY_MANIFESTS.has(name) || basename(parentDir) === basename(dest)) {\n    symlinkSync(resolve(parentDir), dest);\n  } else {\n    mkdirSync(dest, { recursive: true });\n    symlinkSync(resolve(manifestPath), join(dest, name));\n  }\n}\n\n// ── Deploy options ───────────────────────────────────────────────────────────\n\n/**\n * Options controlling where and how assets are deployed.\n *\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport interface DeployOptions {\n  /** Agent framework to target (determines framework-specific directory layout). Defaults to `\"claude-code\"`. */\n  driverTarget?: DriverTarget;\n  /** When `true`, deploy into the global Skaile cache rather than a project workspace. */\n  global?: boolean;\n  /** Absolute path to the workspace root. Defaults to `process.cwd()`. */\n  cwd?: string;\n  /**\n   * Opt into a symlink (the author dev-loop) instead of a copy — honoured only\n   * when the source has a real local path. Machine-local / not for committing;\n   * for store/factory sources (no stable local path) it is a no-op (still copy).\n   */\n  link?: boolean;\n}\n\n// ── Deploy / remove ──────────────────────────────────────────────────────────\n\n/**\n * Deploy a single asset to the framework-specific directory.\n *\n * Copies by default — self-contained, cache-safe, and portable, so a deployed\n * asset survives a `cache clean` of its source and a committed `.claude/` stays\n * machine-independent. `opts.link` opts into a symlink (the live dev-loop), but\n * only when the source has a real local path; store/factory sources (no stable\n * local path) ignore it and still copy. Agents are rendered via the enriched\n * `installAgent` path which resolves abilities, contracts, and framework\n * fragments before writing the native agent file.\n *\n * @param entry - Catalog entry describing the asset to deploy.\n * @param repositories - Repository declarations from `skaile.yaml` (used to\n *   determine whether the source is a local path or a remote clone).\n * @param opts - Deployment target options.\n * @param log - Optional logger callback for progress messages.\n * @returns `true` when the asset was deployed successfully.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function deployAsset(\n  entry: CatalogEntry,\n  repositories: Record<string, SourceDeclaration>,\n  opts: DeployOptions = {},\n  log: Log = noop,\n): boolean {\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const globalInstall = opts.global ?? false;\n  const cwd = opts.cwd;\n\n  // Bundles are not deployed directly — their dependencies are.\n  // MCP servers are configured in skaile.yaml, not deployed to driver target dirs.\n  if (entry.kind === \"bundle\" || entry.kind === \"mcp-server\") return true;\n\n  // Agents need framework-specific rendering via the enriched installAgent path\n  if (entry.kind === \"agent\") {\n    const workspaceRoot = cwd ?? process.cwd();\n    const agentDeployDir = deployedBase(\n      \"agent\" as AiComponent,\n      driverTarget as DriverTarget,\n      globalInstall,\n      cwd,\n    );\n    const targetMap = DRIVER_TARGETS[driverTarget as DriverTarget];\n    const skillsRelDir = targetMap?.local.skill ?? \"\";\n    const wsConfig = resolveSkWorkspaceConfig(workspaceRoot);\n    const name = basename(entry.source);\n    const srcDir = DIRECTORY_MANIFESTS.has(name) ? dirname(entry.source) : entry.source;\n    const result = installAgent(\n      srcDir,\n      agentDeployDir,\n      workspaceRoot,\n      driverTarget,\n      skillsRelDir,\n      entry.name,\n      /* includeSubAgents */ true,\n      new Set<string>(),\n      wsConfig,\n      log,\n    );\n    for (const w of result.warnings) log(`  warn: ${w}`);\n    if (result.created.length > 0) return true;\n    // Fall through to raw deploy if renderer produces no files (unsupported framework, etc.)\n  }\n\n  const dest = deployedDir(entry.kind as AiComponent, entry.name, driverTarget, globalInstall, cwd);\n  mkdirSync(dirname(dest), { recursive: true });\n\n  // Symlink only on explicit opt-in AND when the source has a real local path.\n  // Factory sources have a `path` (the bundled dir under node_modules, replaced\n  // on every upgrade) but no stable dev-loop, so they always copy. Default copy\n  // keeps deploys cache-safe and portable.\n  const repoDecl = entry.publisher ? repositories[entry.publisher] : undefined;\n  const hasLocalPath = repoDecl?.path != null && repoDecl.factory !== true;\n\n  if (opts.link === true && hasLocalPath) {\n    symlinkFromManifest(entry.source, dest);\n    log(`  symlink ${entry.kind}:${entry.name}`);\n    return true;\n  } else {\n    copyFromManifest(entry.source, dest);\n    log(`  copy ${entry.kind}:${entry.name}`);\n    return true;\n  }\n}\n\n/**\n * Deploy all resolved assets, applying patches where configured.\n *\n * Already-deployed assets are skipped unless their deployed manifest content differs\n * from the source. This handles copies that have gone stale after a source update.\n * In copy mode (the default, `!opts.link`) an existing **symlink** dest is healed:\n * it is removed and re-deployed as a real copy, so an old/legacy symlink deploy is\n * silently upgraded. With `opts.link` an existing symlink is left alone.\n *\n * @param resolved - Catalog entries to deploy (output of `resolveAll`).\n * @param repositories - Repository declarations from `skaile.yaml`.\n * @param patches - Map of `kind:name` → patch file path for patch application.\n * @param opts - Deployment target options.\n * @param log - Optional logger callback for progress messages.\n * @returns Array of asset refs (`kind:name`) that were newly deployed in this call.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function deployAll(\n  resolved: CatalogEntry[],\n  repositories: Record<string, SourceDeclaration>,\n  patches: Record<string, string>,\n  opts: DeployOptions = {},\n  log: Log = noop,\n): string[] {\n  const deployed: string[] = [];\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const globalInstall = opts.global ?? false;\n  const cwd = opts.cwd;\n\n  for (const entry of resolved) {\n    // Skip non-deployable asset kinds — bundles are resolved to their contents,\n    // mcp-servers are wired at session startup, and mixin kinds (persona, ruleset,\n    // knowledge) are resolved by the mixin-resolver at session creation time.\n    if (\n      entry.kind === \"bundle\" ||\n      entry.kind === \"mcp-server\" ||\n      entry.kind === \"persona\" ||\n      entry.kind === \"ruleset\" ||\n      entry.kind === \"knowledge\"\n    )\n      continue;\n\n    const ref = `${entry.kind}:${entry.name}`;\n\n    if (isDeployed(entry.kind as AiComponent, entry.name, driverTarget, globalInstall, cwd)) {\n      // Compare the deployed manifest file against the source to detect stale copies.\n      // For symlinks the deployed path resolves through to the source file, so hashes\n      // always match — symlinked installs are never needlessly re-linked.\n      const dest = deployedDir(\n        entry.kind as AiComponent,\n        entry.name,\n        driverTarget,\n        globalInstall,\n        cwd,\n      );\n      // Heal: in copy mode an existing symlink dest is left to fall through to a\n      // real copy below (cache-safe + portable) — bypass the hash skip entirely.\n      // With --link a symlink dest is intentional, so it takes the normal skip path.\n      let destIsSymlink = false;\n      try {\n        destIsSymlink = lstatSync(dest).isSymbolicLink();\n      } catch {}\n      const healSymlink = destIsSymlink && opts.link !== true;\n      // Surface the one-time symlink→copy migration so an author who relied on a\n      // live symlink dev-loop knows why edits stopped reflecting.\n      if (healSymlink) log(`  healed symlink → copy: ${ref} (use --link for the dev-loop)`);\n\n      if (!healSymlink) {\n        const manifestName = basename(entry.source);\n        const deployedManifest = join(dest, manifestName);\n        // isDeployed() only lstats the dir, so a present-but-empty dir (manifest\n        // file deleted) reads as deployed. A missing manifest must never count as\n        // \"already deployed\" — fall through to re-deploy instead of skipping.\n        // (existsSync follows symlinks, so for symlinked installs the manifest\n        // resolves through to the live source and the hash check below still\n        // skips them.)\n        if (existsSync(deployedManifest)) {\n          try {\n            const srcHash = computeHash(entry.source);\n            const depHash = computeHash(deployedManifest);\n            if (srcHash === depHash) {\n              log(`  already deployed: ${ref}`);\n              continue;\n            }\n            log(`  updating: ${ref} (content changed)`);\n            // fall through to redeploy\n          } catch {\n            // Deployed manifest unreadable (e.g. agent rendered to a different path) — skip\n            log(`  already deployed: ${ref}`);\n            continue;\n          }\n        }\n      }\n    }\n\n    deployAsset(entry, repositories, opts, log);\n    deployed.push(ref);\n\n    // Apply patch if configured\n    const patchFile = patches[ref];\n    if (patchFile && existsSync(patchFile)) {\n      const dest = deployedDir(\n        entry.kind as AiComponent,\n        entry.name,\n        driverTarget,\n        globalInstall,\n        cwd,\n      );\n      if (applyPatch(dest, patchFile)) {\n        log(`  patched ${ref}`);\n      } else {\n        log(`  patch failed for ${ref}`);\n      }\n    }\n  }\n\n  return deployed;\n}\n\n/**\n * Remove a deployed asset from the framework directory.\n *\n * Removes symlinks with `unlink`; removes copied directories with `rm -rf`.\n *\n * @param kind - Asset kind (`skill`, `agent`, `prompt`, `flow`, `contract`).\n * @param name - Asset name as registered in the catalog.\n * @param opts - Deployment target options (must match the options used at install time).\n * @returns `true` if the asset existed and was removed; `false` if it was not deployed.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function removeAsset(kind: string, name: string, opts: DeployOptions = {}): boolean {\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const globalInstall = opts.global ?? false;\n  const cwd = opts.cwd;\n\n  const dest = deployedDir(kind as AiComponent, name, driverTarget, globalInstall, cwd);\n  try {\n    const s = lstatSync(dest);\n    if (s.isSymbolicLink()) unlinkSync(dest);\n    else rmSync(dest, { recursive: true, force: true });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n// ── Scaffold ─────────────────────────────────────────────────────────────────\n\nconst SKILL_TEMPLATE = `---\nname: \"{name}\"\ndescription: \"\"\nmetadata:\n  version: \"0.1.0\"\n---\n\n# {name}\n\nSkill prompt goes here.\n`;\n\nconst BUNDLE_TEMPLATE = `name: {name}\ndescription: A curated set of assets\nversion: 0.1.0\ndependencies:\n  - skill:example-skill\n`;\n\nconst FLOW_TEMPLATE = `id: \"{name}\"\nversion: \"0.1.0\"\nname: \"{name}\"\ndescription: Flow description\n\nglobals:\n  approval_mode: checkpoint\n\nnodes: []\n`;\n\n/**\n * Create a minimal scaffold directory for a new asset.\n *\n * Writes the appropriate manifest file (`SKILL.md`, `AGENT.md`, `CONTRACT.md`,\n * `<name>.bundle.yaml`, `<name>.flow.yaml`, or `<name>.prompt.md`) inside a\n * new `<destDir>/<name>/` directory.\n *\n * @param name - Asset name (also used as the directory name).\n * @param kind - Asset kind: `skill` | `agent` | `bundle` | `flow` | `prompt` | `contract`.\n * @param destDir - Parent directory to create the asset in.\n * @returns `{ ok: true, path }` on success, `{ ok: false, path: errorMessage }` if the\n *   directory already exists.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function createScaffold(\n  name: string,\n  kind: string,\n  destDir: string,\n): { ok: boolean; path: string } {\n  const dest = join(destDir, name);\n  if (existsSync(dest)) {\n    return { ok: false, path: `Directory '${name}' already exists in ${destDir}` };\n  }\n  mkdirSync(dest, { recursive: true });\n\n  if (kind === \"bundle\") {\n    writeFileSync(\n      join(dest, `${name}.bundle.yaml`),\n      BUNDLE_TEMPLATE.replace(/\\{name\\}/g, name),\n      \"utf8\",\n    );\n  } else if (kind === \"flow\") {\n    writeFileSync(\n      join(dest, `${name}.flow.yaml`),\n      FLOW_TEMPLATE.replace(/\\{name\\}/g, name),\n      \"utf8\",\n    );\n  } else if (kind === \"prompt\") {\n    writeFileSync(\n      join(dest, `${name}.prompt.md`),\n      SKILL_TEMPLATE.replace(/\\{name\\}/g, name),\n      \"utf8\",\n    );\n  } else if (kind === \"agent\") {\n    writeFileSync(join(dest, \"AGENT.md\"), SKILL_TEMPLATE.replace(/\\{name\\}/g, name), \"utf8\");\n  } else if (kind === \"contract\") {\n    writeFileSync(join(dest, \"CONTRACT.md\"), SKILL_TEMPLATE.replace(/\\{name\\}/g, name), \"utf8\");\n  } else {\n    // Default: skill\n    writeFileSync(join(dest, \"SKILL.md\"), SKILL_TEMPLATE.replace(/\\{name\\}/g, name), \"utf8\");\n  }\n\n  return { ok: true, path: dest };\n}\n"]}

package/dist/{chunk-DPLIN2RA.js → chunk-ICSCSM5D.js}

@@ -1,4 +1,4 @@
-import { parseCredentialRef } from './chunk-GZZPKAV5.js';
+import { parseCredentialRef } from './chunk-MJHSLODD.js';
 import { spawn, spawnSync } from 'child_process';
 import { constants } from 'os';
 import { Readable } from 'stream';
@@ -138,5 +138,5 @@ function resolveCredential(entry, options = {}) {
 }
 
 export { __resetCredentialCommandCache, portableSpawn, portableSpawnSync, resolveCredential };
-//# sourceMappingURL=chunk-DPLIN2RA.js.map
-//# sourceMappingURL=chunk-DPLIN2RA.js.map
+//# sourceMappingURL=chunk-ICSCSM5D.js.map
+//# sourceMappingURL=chunk-ICSCSM5D.js.map