@skaile/workspaces 4.32.1 → 4.34.0

package/dist/{chunk-3ZE7X5Y6.js.map → chunk-TB3LJ6NA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-auth.ts","../cli/src/store-client.ts"],"names":["readFileSync"],"mappings":";;;;;;AAsBA,SAAS,YAAA,GAAwD;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AAC1E,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAUA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,MAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,gBAAA,IAAoB,IAAA,CAAK,MAAM,WAAW;AAAA,GAClE;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,gBAAA,CACd,MAAA,GAA0B,mBAAA,EAAoB,EACM;AACpD,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,SAAS,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AAC3E,IAAA,MAAM,WACJ,OAAO,IAAA,CAAK,kBAAA,KAAuB,QAAA,GAAW,KAAK,kBAAA,GAAqB,KAAA,CAAA;AAC1E,IAAA,MAAM,cAAc,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,GAAW,KAAK,YAAA,GAAe,KAAA,CAAA;AAChF,IAAA,OAAO,QAAA,IAAY,WAAA,GAAc,EAAE,QAAA,EAAU,aAAY,GAAI,IAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACG;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,YAAA,EAAa;AAE1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,KAAA,EAAO,gBAAA;AAAA,MACP,gBAAgB,IAAA,CAAK,SAAA;AAAA,MACrB,qBAAA,EAAuB;AAAA,KACxB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,IAAA,CAAK;AAAA,OACrB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yBAAyB,KAAA,CAAM,iBAAA,IAAqB,KAAA,CAAM,KAAA,IAAS,IAAI,MAAM,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;AC/PO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAMA,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-3ZE7X5Y6.js","sourcesContent":["/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * A PKCE (RFC 7636) `code_verifier` + its S256 `code_challenge`. Keycloak\n * enforces PKCE on the `skaile-store-cli` device flow (the device-authorization\n * request 400s with \"Missing parameter: code_challenge_method\" otherwise), so\n * every `deviceLogin` mints a fresh pair: the challenge goes on the device-auth\n * request, the verifier on the matching token poll. `base64url` (no padding)\n * per the spec.\n */\nfunction makePkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  const challenge = createHash(\"sha256\").update(verifier).digest(\"base64url\");\n  return { verifier, challenge };\n}\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n  keycloakUrl: string;\n  realm: string;\n  clientId: string;\n  authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n  const home = process.env.SKAILE_HOME ?? join(homedir(), \".skaile\");\n  return {\n    keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n    realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n    clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n    authFile: process.env.SKAILE_AUTH_FILE ?? join(home, \"auth.json\"),\n  };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n  const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n  return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n  access_token: string;\n  refresh_token?: string;\n  /** Epoch ms when the access token expires (with a safety margin already applied). */\n  expires_at: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  interval?: number;\n  expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n  fetchImpl?: typeof fetch;\n  sleep?: (ms: number) => Promise<void>;\n  /** Called once with the verification URL + user code (default: write to stderr). */\n  onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n  try {\n    const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n    // Reject a corrupt / hand-edited file rather than treat it as a session.\n    if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The caller's store identity, decoded LOCALLY from the cached token's JWT\n * payload (no network, no signature check — this is an author-side hint, not an\n * authorization decision). Returns `null` when not signed in or the token is\n * unreadable. `githubLogin` is the verified GitHub handle (the preferred\n * publisher namespace); `username` is the Keycloak `preferred_username`.\n */\nexport function getStoreIdentity(\n  config: StoreAuthConfig = loadStoreAuthConfig(),\n): { username?: string; githubLogin?: string } | null {\n  const auth = readAuth(config);\n  if (!auth) return null;\n  try {\n    const payload = auth.access_token.split(\".\")[1];\n    const json = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf-8\"));\n    const username =\n      typeof json.preferred_username === \"string\" ? json.preferred_username : undefined;\n    const githubLogin = typeof json.github_login === \"string\" ? json.github_login : undefined;\n    return username || githubLogin ? { username, githubLogin } : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n  mkdirSync(dirname(config.authFile), { recursive: true });\n  writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n  chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n  try {\n    rmSync(config.authFile);\n  } catch {\n    // already absent — nothing to do\n  }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n  return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n  return {\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n  };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n  process.stderr.write(\n    `\\nTo sign in, open:\\n\\n    ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n  );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<StoredAuth> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const sleep = deps.sleep ?? defaultSleep;\n  const onPrompt = deps.onPrompt ?? defaultPrompt;\n  const endpoints = oidc(config);\n  const pkce = makePkcePair();\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      client_id: config.clientId,\n      scope: \"openid profile\",\n      code_challenge: pkce.challenge,\n      code_challenge_method: \"S256\",\n    }),\n  });\n  if (!deviceRes.ok) {\n    throw new Error(\n      `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n  onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n  const intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n  let waitMs = intervalMs;\n\n  while (Date.now() < deadline) {\n    await sleep(waitMs);\n    const tokenRes = await fetchImpl(endpoints.token, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: device.device_code,\n        client_id: config.clientId,\n        code_verifier: pkce.verifier,\n      }),\n    });\n    const token = (await tokenRes.json()) as TokenResponse;\n    if (tokenRes.ok) {\n      const stored = tokenToStored(token);\n      writeAuth(config, stored);\n      return stored;\n    }\n    // RFC 8628 §3.5 pending / slow-down handling.\n    if (token.error === \"authorization_pending\") continue;\n    if (token.error === \"slow_down\") {\n      waitMs += 5_000;\n      continue;\n    }\n    throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n  }\n  throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n  config: StoreAuthConfig,\n  refreshToken: string,\n  fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n  const res = await fetchImpl(oidc(config).token, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n      client_id: config.clientId,\n    }),\n  });\n  const token = (await res.json()) as TokenResponse;\n  if (!res.ok) {\n    throw new Error(\n      `Token refresh failed: ${token.error_description ?? token.error ?? res.status}`,\n    );\n  }\n  const stored = tokenToStored(token);\n  writeAuth(config, stored);\n  return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<string> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const auth = readAuth(config);\n  if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n  if (Date.now() < auth.expires_at) return auth.access_token;\n  if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n  try {\n    return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n  } catch {\n    throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n  }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}
+{"version":3,"sources":["../cli/src/store-auth.ts","../cli/src/store-client.ts"],"names":["readFileSync"],"mappings":";;;;;;AAsBA,SAAS,YAAA,GAAwD;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AAC1E,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAUA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,MAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,gBAAA,IAAoB,IAAA,CAAK,MAAM,WAAW;AAAA,GAClE;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,gBAAA,CACd,MAAA,GAA0B,mBAAA,EAAoB,EACM;AACpD,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,SAAS,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AAC3E,IAAA,MAAM,WACJ,OAAO,IAAA,CAAK,kBAAA,KAAuB,QAAA,GAAW,KAAK,kBAAA,GAAqB,KAAA,CAAA;AAC1E,IAAA,MAAM,cAAc,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,GAAW,KAAK,YAAA,GAAe,KAAA,CAAA;AAChF,IAAA,OAAO,QAAA,IAAY,WAAA,GAAc,EAAE,QAAA,EAAU,aAAY,GAAI,IAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACG;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,YAAA,EAAa;AAE1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,KAAA,EAAO,gBAAA;AAAA,MACP,gBAAgB,IAAA,CAAK,SAAA;AAAA,MACrB,qBAAA,EAAuB;AAAA,KACxB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,IAAA,CAAK;AAAA,OACrB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yBAAyB,KAAA,CAAM,iBAAA,IAAqB,KAAA,CAAM,KAAA,IAAS,IAAI,MAAM,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;AC/PO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAMA,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-TB3LJ6NA.js","sourcesContent":["/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * A PKCE (RFC 7636) `code_verifier` + its S256 `code_challenge`. Keycloak\n * enforces PKCE on the `skaile-store-cli` device flow (the device-authorization\n * request 400s with \"Missing parameter: code_challenge_method\" otherwise), so\n * every `deviceLogin` mints a fresh pair: the challenge goes on the device-auth\n * request, the verifier on the matching token poll. `base64url` (no padding)\n * per the spec.\n */\nfunction makePkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  const challenge = createHash(\"sha256\").update(verifier).digest(\"base64url\");\n  return { verifier, challenge };\n}\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n  keycloakUrl: string;\n  realm: string;\n  clientId: string;\n  authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n  const home = process.env.SKAILE_HOME ?? join(homedir(), \".skaile\");\n  return {\n    keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n    realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n    clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n    authFile: process.env.SKAILE_AUTH_FILE ?? join(home, \"auth.json\"),\n  };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n  const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n  return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n  access_token: string;\n  refresh_token?: string;\n  /** Epoch ms when the access token expires (with a safety margin already applied). */\n  expires_at: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  interval?: number;\n  expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n  fetchImpl?: typeof fetch;\n  sleep?: (ms: number) => Promise<void>;\n  /** Called once with the verification URL + user code (default: write to stderr). */\n  onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n  try {\n    const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n    // Reject a corrupt / hand-edited file rather than treat it as a session.\n    if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The caller's store identity, decoded LOCALLY from the cached token's JWT\n * payload (no network, no signature check — this is an author-side hint, not an\n * authorization decision). Returns `null` when not signed in or the token is\n * unreadable. `githubLogin` is the verified GitHub handle (the preferred\n * publisher namespace); `username` is the Keycloak `preferred_username`.\n */\nexport function getStoreIdentity(\n  config: StoreAuthConfig = loadStoreAuthConfig(),\n): { username?: string; githubLogin?: string } | null {\n  const auth = readAuth(config);\n  if (!auth) return null;\n  try {\n    const payload = auth.access_token.split(\".\")[1];\n    const json = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf-8\"));\n    const username =\n      typeof json.preferred_username === \"string\" ? json.preferred_username : undefined;\n    const githubLogin = typeof json.github_login === \"string\" ? json.github_login : undefined;\n    return username || githubLogin ? { username, githubLogin } : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n  mkdirSync(dirname(config.authFile), { recursive: true });\n  writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n  chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n  try {\n    rmSync(config.authFile);\n  } catch {\n    // already absent — nothing to do\n  }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n  return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n  return {\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n  };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n  process.stderr.write(\n    `\\nTo sign in, open:\\n\\n    ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n  );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<StoredAuth> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const sleep = deps.sleep ?? defaultSleep;\n  const onPrompt = deps.onPrompt ?? defaultPrompt;\n  const endpoints = oidc(config);\n  const pkce = makePkcePair();\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      client_id: config.clientId,\n      scope: \"openid profile\",\n      code_challenge: pkce.challenge,\n      code_challenge_method: \"S256\",\n    }),\n  });\n  if (!deviceRes.ok) {\n    throw new Error(\n      `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n  onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n  const intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n  let waitMs = intervalMs;\n\n  while (Date.now() < deadline) {\n    await sleep(waitMs);\n    const tokenRes = await fetchImpl(endpoints.token, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: device.device_code,\n        client_id: config.clientId,\n        code_verifier: pkce.verifier,\n      }),\n    });\n    const token = (await tokenRes.json()) as TokenResponse;\n    if (tokenRes.ok) {\n      const stored = tokenToStored(token);\n      writeAuth(config, stored);\n      return stored;\n    }\n    // RFC 8628 §3.5 pending / slow-down handling.\n    if (token.error === \"authorization_pending\") continue;\n    if (token.error === \"slow_down\") {\n      waitMs += 5_000;\n      continue;\n    }\n    throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n  }\n  throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n  config: StoreAuthConfig,\n  refreshToken: string,\n  fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n  const res = await fetchImpl(oidc(config).token, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n      client_id: config.clientId,\n    }),\n  });\n  const token = (await res.json()) as TokenResponse;\n  if (!res.ok) {\n    throw new Error(\n      `Token refresh failed: ${token.error_description ?? token.error ?? res.status}`,\n    );\n  }\n  const stored = tokenToStored(token);\n  writeAuth(config, stored);\n  return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<string> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const auth = readAuth(config);\n  if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n  if (Date.now() < auth.expires_at) return auth.access_token;\n  if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n  try {\n    return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n  } catch {\n    throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n  }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}

package/dist/{chunk-N7B3LZ7V.js → chunk-TGE33MKN.js}

@@ -427,5 +427,5 @@ function validateByKind(kind, data) {
 }
 
 export { ANTHROPIC_FIRST_PARTY_HOSTS, ANTHROPIC_FULL_ID_PATTERN, ANTHROPIC_MODEL_ALIASES, ANTHROPIC_MODEL_FAMILIES, AgentComposeItemSchema, AgentManifestSchema, AgentToolsSchema, ArtifactRefSchema, AssetKindSchema, AssetKindValues, BEDROCK_MODEL_ID_PATTERN, BaseFrontmatterSchema, BindingSchema, BindingValues, CommonMetadataSchema, ConnectorManifestSchema, ContractManifestSchema, FieldSchema, FilePrerequisiteSchema, FreeFormModelIdSchema, McpServerManifestSchema, ModelIdSchema, ModelSelectorSchema, MountManifestSchema, PersonaManifestSchema, PlaceholderSchema, PlaceholderTypeSchema, PresetItemSchema, PresetManifestSchema, PresetSourceSchema, PromptManifestSchema, RulesetManifestSchema, SkillManifestSchema, UserInputSchema, VERTEX_MODEL_ID_PATTERN, isFirstPartyAnthropicEndpoint, modelIdSchemaForCloud, modelIdSchemaForTarget, normalizeAnthropicModel, requiresAnthropicModelId, validateAgent, validateByKind, validateConnector, validateContract, validateManifest, validateMcpServer, validateMount, validatePersona, validatePreset, validatePrompt, validateRuleset, validateSkill };
-//# sourceMappingURL=chunk-N7B3LZ7V.js.map
-//# sourceMappingURL=chunk-N7B3LZ7V.js.map
+//# sourceMappingURL=chunk-TGE33MKN.js.map
+//# sourceMappingURL=chunk-TGE33MKN.js.map

package/dist/{chunk-N7B3LZ7V.js.map → chunk-TGE33MKN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../types/src/manifests/_shared.ts","../types/src/manifests/agent.ts","../types/src/manifests/connector.ts","../types/src/manifests/mount.ts","../types/src/manifests/skill.ts","../types/src/manifests/contract.ts","../types/src/manifests/mcp-server.ts","../types/src/manifests/prompt.ts","../types/src/manifests/persona.ts","../types/src/manifests/preset.ts","../types/src/manifests/ruleset.ts","../types/src/manifests/index.ts"],"names":["z2","z3","z4","z5","z6","z7","z8","z9","z10","z11"],"mappings":";;;AAUO,IAAM,eAAA,GAAkB;AAAA,EAC7B,OAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAEO,IAAM,eAAA,GAAoB,OAAK,eAAe;AAQ9C,IAAM,oBAAsB,CAAA,CAAA,MAAA,CAAO;AAAA,EACxC,EAAA,EAAM,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACpB,WAAA,EAAe,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC;AAGM,IAAM,yBAA2B,CAAA,CAAA,MAAA,CAAO;AAAA,EAC7C,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,WAAA,EAAe,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAC1B,CAAC;AAGM,IAAM,kBAAoB,CAAA,CAAA,WAAA,CAAY;AAAA,EAC3C,KAAO,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAChC,IAAM,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAC/B,KAAA,EAAS,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,MAAA,EAAU,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,QAAA,EAAY,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAW,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACtC,MAAA,EAAU,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,KAAA,CAAM,CAAG,CAAA,CAAA,MAAA,EAAO,EAAK,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC5D,OAAA,EACG,QAAM,CAAG,CAAA,CAAA,MAAA,IAAY,CAAA,CAAA,MAAA,EAAO,EAAK,WAAQ,EAAK,CAAA,CAAA,KAAA,CAAQ,QAAM,CAAG,CAAA,CAAA,MAAA,IAAY,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAC,CAAC,CAAA,CACvF,QAAA,EAAS;AAAA,EACZ,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC;AAGM,IAAM,cAAgB,CAAA,CAAA,MAAA,CAAO;AAAA,EAClC,GAAA,EAAO,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,KAAA,EAAS,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,QAAA,EAAY,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,SAAA,EAAa,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAChC,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,OAAA,EAAW,CAAA,CAAA,KAAA,CAAM,CAAG,CAAA,CAAA,MAAA,EAAO,EAAK,CAAA,CAAA,MAAA,EAAO,EAAK,CAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA;AAC1D,CAAC;AAMM,IAAM,uBAAyB,CAAA,CAAA,WAAA,CAAY;AAAA,EAChD,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAU,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAQ,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,KAAA,EAAS,OAAK,CAAC,OAAA,EAAS,QAAQ,QAAA,EAAU,YAAY,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAClE,MAAA,EAAU,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,aAAA,EAAiB,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA;AAC7B,CAAC;AAUM,IAAM,wBAA0B,CAAA,CAAA,MAAA,CAAO;AAAA,EAC5C,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAe,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAG7B,SAAA,EAAa,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,QAAA,EAAY,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAY,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA;AAChC,CAAC;AAkBM,SAAS,gBAAA,CACd,QACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA;AACpC,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,OAAO,IAAA,EAAK;AAAA,EACvC;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,QAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,MAC1C,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAAA,MACzB,SAAS,KAAA,CAAM;AAAA,KACjB,CAAE;AAAA,GACJ;AACF;ACtHO,IAAM,uBAAA,GAA0B,CAAC,SAAA,EAAW,MAAA,EAAQ,UAAU,OAAO;AAarE,IAAM,wBAAA,GAA2B,CAAC,MAAA,EAAQ,QAAA,EAAU,SAAS,OAAO;AAG3E,IAAM,UAAA,GAAa,wBAAA,CAAyB,IAAA,CAAK,GAAG,CAAA;AAkBpD,IAAM,mBAAA,GAAsB,CAAA,MAAA,EAAS,UAAU,CAAA,yCAAA,EAA4C,UAAU,CAAA,EAAA,CAAA;AAoB9F,IAAM,4BAA4B,IAAI,MAAA;AAAA,EAC3C,6BAA6B,mBAAmB,CAAA,aAAA;AAClD;AAmBO,IAAM,2BAA2B,IAAI,MAAA;AAAA,EAC1C,oDAAoD,mBAAmB,CAAA,kCAAA;AACzE;AASO,IAAM,uBAAA,GAA0B,IAAI,MAAA,CAAO,CAAA,QAAA,EAAW,mBAAmB,CAAA,QAAA,CAAU;AAoBnF,IAAM,gBAAkBA,CAAA,CAAA,KAAA,CAAM;AAAA,EACjCA,OAAK,uBAAuB,CAAA;AAAA,EAE3BA,UAAO,CACP,KAAA;AAAA,IACC,yBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACAA,CAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,wBAAwB,CAAA;AAAA,EACvCA,CAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,uBAAuB;AAC1C,CAAC;AAUM,IAAM,2BAAA,GAAiD,CAAC,mBAAmB;AAkC3E,SAAS,8BAA8B,OAAA,EAA2B;AACvE,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAI,GAAA,CAAI,OAAO,CAAA,CAAE,SAAS,WAAA,EAAY;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,2BAAA,CAA4B,SAAS,IAAI,CAAA;AAClD;AAkBO,SAAS,yBAAyB,MAAA,EAAiC;AACxE,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,oBAAA,EAAsB,OAAO,KAAA;AACpD,EAAA,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,QAAA,MAAc,QAAA,EAAU,OAAO,KAAA;AACxD,EAAA,OAAO,6BAAA,CAA8B,OAAO,QAAQ,CAAA;AACtD;AAQO,IAAM,qBAAA,GACVA,CAAA,CAAA,MAAA,EAAO,CACP,KAAA,CAAM,SAAS,yDAAyD;AAQpE,SAAS,uBAAuB,MAAA,EAA2C;AAChF,EAAA,OAAO,wBAAA,CAAyB,MAAM,CAAA,GACjC,aAAA,GACA,qBAAA;AACP;AAgBO,SAAS,sBAAsB,KAAA,EAAmC;AACvE,EAAA,OAAO,CAAC,KAAA,IAAS,KAAA,KAAU,SAAA,GACvB,wBAAuB,GACtB,qBAAA;AACP;AAgBO,SAAS,uBAAA,CACd,KAAA,EACA,QAAA,GAAgC,QAAA,EACxB;AACR,EAAA,IAAI,CAAC,OAAO,OAAO,QAAA;AACnB,EAAA,IAAK,uBAAA,CAA8C,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAC3E,EAAA,IAAI,yBAAA,CAA0B,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AAClD,EAAA,IAAI,wBAAA,CAAyB,KAAK,KAAK,CAAA,IAAK,wBAAwB,IAAA,CAAK,KAAK,GAAG,OAAO,KAAA;AAIxF,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,KAAA,CAAM,6BAA6B,CAAA;AAC7D,EAAA,IAAI,WAAA,EAAa,OAAO,WAAA,CAAY,CAAC,EAAG,WAAA,EAAY;AACpD,EAAA,OAAO,QAAA;AACT;AAiBO,IAAM,mBAAA,GACVA,UAAO,CACP,KAAA;AAAA,EACC,OAAA;AAAA,EACA;AACF;AAEF,IAAM,oBAAsBA,CAAA,CAAA,WAAA,CAAY;AAAA,EACtC,SAAA,EAAW,oBAAoB,QAAA,EAAS;AAAA,EACxC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,mBAAmB,CAAA,CAAE,QAAA,EAAS;AAAA,EAChD,aACGA,CAAA,CAAA,WAAA,CAAY;AAAA,IACX,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,UAAA,EAAcA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,GACjC,EACA,QAAA;AACL,CAAC,CAAA;AAMM,IAAM,aAAA,GAAgB,CAAC,cAAA,EAAgB,aAAA,EAAe,iBAAiB;AACvE,IAAM,aAAA,GAAkBA,OAAK,aAAa;AAW1C,IAAM,yBAA2BA,CAAA,CAAA,MAAA,CAAO;AAAA,EAC7C,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,QAAA,EAAYA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAS,cAAc,QAAA;AACzB,CAAC;AA6BM,IAAM,mBAAqBA,CAAA,CAAA,WAAA,CAAY;AAAA;AAAA,EAE5C,OAAA,EAAWA,QAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAC,EAAE,QAAA,EAAS;AAAA;AAAA,EAE7C,MAAA,EAAUA,QAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAC,EAAE,QAAA;AACrC,CAAC;AAIM,IAAM,sBAAwBA,CAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,YAAA,EAAgBA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAE7B,KAAA,EAAO,kBAAkB,QAAA,EAAS;AAAA,EAClC,KAAA,EAAO,iBAAiB,QAAA,EAAS;AAAA,EACjC,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACrC,UAAA,EAAcA,cAAY,EAAE,IAAA,EAAQA,UAAO,EAAG,EAAE,QAAA,EAAS;AAAA,EACzD,SACGA,CAAA,CAAA,WAAA,CAAY;AAAA,IACX,SAAA,EAAaA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,GAC9B,EACA,QAAA,EAAS;AAAA,EAEZ,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,IAAA,EAAQA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAGvC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,sBAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,EAEnD,UAAYA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA;AAC9C,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACtZO,IAAM,0BAA4BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACnD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,KAAA,EAASA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACvB,UACGA,CAAA,CAAA,MAAA,CAAO;AAAA,IACN,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACvC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA;AAAS,GACxC,EACA,QAAA,EAAS;AAAA,EACZ,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA,EAAS;AAAA,EACtC,YAAA,EAAgBA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC7C,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,SAAS,kBAAkB,IAAA,EAA4D;AAC5F,EAAA,OAAO,gBAAA,CAAiB,yBAAyB,IAAI,CAAA;AACvD;ACrBO,IAAM,sBAAwBC,CAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,KAAA,EAASA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACvB,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA,EAAS;AAAA,EACtC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACPA,IAAM,mBAAA,GAAsB,qBAAqB,MAAA,CAAO;AAAA,EACtD,YAAcC,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACvD,WACGA,CAAA,CAAA,MAAA,CAAO;AAAA,IACN,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA;AAAS,GAC/C,EACA,QAAA,EAAS;AAAA,EACZ,eACGA,CAAA,CAAA,MAAA,CAAO;AAAA,IACN,KAAA,EAASA,CAAA,CAAA,KAAA,CAAM,sBAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,IAChD,eAAA,EAAmBA,CAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA,IACnD,eAAA,EAAmBA,CAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,IAEnD,KAAA,EAASA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,CAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,CAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EAAE,QAAA,EAAS;AAAA,IAC5F,QAAA,EACGA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,CAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,CAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EACxE,QAAA,EAAS;AAAA,IACZ,SAAA,EACGA,CAAA,CAAA,KAAA;AAAA,MACGA,CAAA,CAAA,MAAA,CAAO;AAAA,QACP,IAAMA,CAAA,CAAA,MAAA,EAAO;AAAA,QACb,UAAA,EAAcA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACzC,QAAA,EAAYA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,QAC/B,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,OAClC;AAAA,MAEF,QAAA,EAAS;AAAA,IACZ,UAAA,EACGA,CAAA,CAAA,KAAA;AAAA,MACGA,CAAA,CAAA,MAAA,CAAO;AAAA,QACP,QAAUA,CAAA,CAAA,MAAA,EAAO;AAAA,QACjB,QAAUA,CAAA,CAAA,IAAA,CAAK,CAAC,aAAa,YAAY,CAAC,EAAE,QAAA;AAAS,OACtD;AAAA,MAEF,QAAA;AAAS,GACb,EACA,QAAA,EAAS;AAAA,EACZ,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,CAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,CAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EAAE,QAAA;AACxF,CAAC,CAAA;AAEM,IAAM,sBAAwBA,CAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,aAAA,EAAiBA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,eAAA,EAAmBA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAGtC,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,WAAA,EAAeA,CAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA,EAC/C,UAAA,EAAcA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACzC,SAAA,EAAaA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAExC,QAAA,EAAU,oBAAoB,QAAA;AAChC,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACtEO,IAAM,yBAA2BC,CAAA,CAAA,WAAA,CAAY;AAAA,EAClD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,iBAAiB,IAAA,EAA2D;AAC1F,EAAA,OAAO,gBAAA,CAAiB,wBAAwB,IAAI,CAAA;AACtD;ACjBO,IAAM,0BAA4BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACnD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,QAAM,CAAGA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIpD,SAAA,EAAaA,OAAK,CAAC,OAAA,EAAS,OAAO,MAAA,EAAQ,iBAAiB,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACxE,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,IAAA,EAAQA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,KAAOA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAC/C,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,SAAWA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnD,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7B,SACGA,CAAA,CAAA,MAAA,CAAO;AAAA;AAAA,IAEN,GAAA,EACGA,CAAA,CAAA,MAAA,EAAO,CACP,GAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,UAAU,CAAA,EAAG,EAAE,OAAA,EAAS,6BAA6B,CAAA;AAAA,IACnF,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,gBAAgB,CAAA;AAAA;AAAA,IAEzC,IAAA,EACGA,CAAA,CAAA,MAAA,EAAO,CACP,KAAA,CAAM,WAAA,EAAa,EAAE,OAAA,EAAS,2CAAA,EAA6C,CAAA,CAC3E,QAAA;AAAS,GACb,EACA,QAAA;AACL,CAAC;AAIM,SAAS,kBAAkB,IAAA,EAA4D;AAC5F,EAAA,OAAO,gBAAA,CAAiB,yBAAyB,IAAI,CAAA;AACvD;ACpCO,IAAM,uBAAyBC,CAAA,CAAA,WAAA,CAAY;AAAA,EAChD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,eAAe,IAAA,EAAyD;AACtF,EAAA,OAAO,gBAAA,CAAiB,sBAAsB,IAAI,CAAA;AACpD;ACbO,IAAM,wBAA0BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACjD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,gBAAgB,IAAA,EAA0D;AACxF,EAAA,OAAO,gBAAA,CAAiB,uBAAuB,IAAI,CAAA;AACrD;ACHA,IAAM,qBAAA,GAAwB;AAAA,EAC5B,MAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,qBAAA,GAA0BC,OAAK,qBAAqB;AAE1D,IAAM,oBAAsBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACxC,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAM,sBAAsB,QAAA,EAAS;AAAA,EACrC,QAAA,EAAYA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAWA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACjE,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA;AACrD,CAAC;AAMD,IAAM,mBAAqBA,CAAA,CAAA,MAAA,CAAO;AAAA,EAChC,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC;AACvB,CAAC,CAAA;AAMM,IAAM,mBAAqBA,CAAA,CAAA,WAAA,CAAY;AAAA;AAAA,EAE5C,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA;AAAA,EAErB,EAAA,EAAMA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAExB,QAAUA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA;AAAA,EAEnD,YAAA,EAAgBA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAElD,aAAeA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAEvD,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,gBAAgB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAE7C,QAAUA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA;AAC5C,CAAC;AAMD,IAAM,oBAAsBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACjC,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,IAAA,EAAM,sBAAsB,QAAA,EAAS;AAAA,EACrC,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,QAAA,EAAYA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC5D,OAAA,EAAWA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA;AAC1D,CAAC,CAAA;AAOM,IAAM,qBAAuBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACzC,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAClB,CAAC;AAMM,IAAM,uBAAyBA,CAAA,CAAA,WAAA,CAAY;AAAA,EAChD,SAAA,EAAaA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,SAAWA,CAAA,CAAA,KAAA,CAAM,CAAGA,UAAO,EAAKA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAA;AAAA,EACzC,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAGvC,KAAA,EAASA,CAAA,CAAA,KAAA,CAAM,gBAAgB,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA;AAAA,EAGtC,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAG5C,OAAA,EAAWA,CAAA,CAAA,KAAA,CAAM,kBAAkB,CAAA,CAAE,QAAA;AACvC,CAAC;AAOM,SAAS,eAAe,IAAA,EAAyD;AACtF,EAAA,OAAO,gBAAA,CAAiB,sBAAsB,IAAI,CAAA;AACpD;ACnHO,IAAM,wBAA0BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACjD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,gBAAgB,IAAA,EAA0D;AACxF,EAAA,OAAO,gBAAA,CAAiB,uBAAuB,IAAI,CAAA;AACrD;;;ACgGA,IAAM,UAAA,GACJ;AAAA,EACE,KAAA,EAAO,aAAA;AAAA,EACP,KAAA,EAAO,aAAA;AAAA,EACP,SAAA,EAAW,iBAAA;AAAA,EACX,KAAA,EAAO,aAAA;AAAA,EACP,QAAA,EAAU,gBAAA;AAAA,EACV,MAAA,EAAQ,cAAA;AAAA,EACR,YAAA,EAAc,iBAAA;AAAA,EACd,OAAA,EAAS,eAAA;AAAA,EACT,OAAA,EAAS;AACX,CAAA;AASK,SAAS,cAAA,CAAe,MAAiB,IAAA,EAAkD;AAChG,EAAA,MAAM,SAAA,GAAY,WAAW,IAAI,CAAA;AACjC,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,CAAA,oBAAA,EAAuB,IAAI,CAAA,CAAA,EAAI,CAAA,EAAE;AAAA,EACzF;AACA,EAAA,OAAO,UAAU,IAAI,CAAA;AACvB","file":"chunk-N7B3LZ7V.js","sourcesContent":["/**\n * Shared manifest frontmatter schemas and types.\n * Common across all 11 asset kinds + Preset.\n */\nimport * as z from \"zod\";\n\n// ---------------------------------------------------------------------------\n// Asset kind enum\n// ---------------------------------------------------------------------------\n\nexport const AssetKindValues = [\n  \"skill\",\n  \"agent\",\n  \"connector\",\n  \"mount\",\n  \"flow\",\n  \"contract\",\n  \"prompt\",\n  \"mcp-server\",\n  \"knowledge\",\n  \"persona\",\n  \"ruleset\",\n] as const;\n\nexport const AssetKindSchema = z.enum(AssetKindValues);\nexport type AssetKind = z.infer<typeof AssetKindSchema>;\n\n// ---------------------------------------------------------------------------\n// Shared metadata sub-schemas\n// ---------------------------------------------------------------------------\n\n/** Artifact dependency (requires/produces/consumes in skill metadata). */\nexport const ArtifactRefSchema = z.object({\n  id: z.string().min(1),\n  description: z.string().optional(),\n  gate: z.enum([\"hard\", \"soft\"]).optional(),\n  path: z.string().optional(),\n});\n\n/** File prerequisite for a skill. */\nexport const FilePrerequisiteSchema = z.object({\n  path: z.string().min(1),\n  gate: z.enum([\"hard\", \"soft\"]).optional(),\n  description: z.string().optional(),\n});\n\n/** User input definition (for skill user_inputs or metadata.prerequisites.inputs_*). */\nexport const UserInputSchema = z.looseObject({\n  key: z.string().min(1).optional(),\n  id: z.string().min(1).optional(),\n  label: z.string().optional(),\n  prompt: z.string().optional(),\n  type: z.string().optional(),\n  required: z.boolean().optional(),\n  options: z.array(z.string()).optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n  default: z\n    .union([z.string(), z.number(), z.boolean(), z.array(z.union([z.string(), z.number()]))])\n    .optional(),\n  hint: z.string().optional(),\n});\n\n/** Field definition for connectors/mounts. */\nexport const FieldSchema = z.object({\n  key: z.string().min(1),\n  label: z.string().optional(),\n  required: z.boolean().optional(),\n  sensitive: z.boolean().optional(),\n  type: z.string().optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Common metadata block (appears inside metadata: in most manifest kinds)\n// ---------------------------------------------------------------------------\n\nexport const CommonMetadataSchema = z.looseObject({\n  version: z.string().optional(),\n  author: z.string().optional(),\n  tags: z.array(z.string()).optional(),\n  stage: z.enum([\"alpha\", \"beta\", \"stable\", \"deprecated\"]).optional(),\n  source: z.string().optional(),\n  do_not_invoke: z.boolean().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Common frontmatter fields (top-level, shared across kinds)\n// ---------------------------------------------------------------------------\n\n/**\n * Fields that can appear at the top level of any manifest's frontmatter.\n * Not all are required -- each kind schema intersects with its own specifics.\n */\nexport const BaseFrontmatterSchema = z.object({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n\n  // Catalog identity (populated at discovery or authoring time)\n  publisher: z.string().optional(),\n  category: z.string().optional(),\n  license: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Validation result type\n// ---------------------------------------------------------------------------\n\nexport interface ManifestValidationSuccess<T> {\n  ok: true;\n  data: T;\n}\n\nexport interface ManifestValidationFailure {\n  ok: false;\n  errors: Array<{ path: string; message: string }>;\n}\n\nexport type ManifestValidationResult<T> = ManifestValidationSuccess<T> | ManifestValidationFailure;\n\nexport function validateManifest<T>(\n  schema: z.ZodType<T>,\n  data: unknown,\n): ManifestValidationResult<T> {\n  const result = schema.safeParse(data);\n  if (result.success) {\n    return { ok: true, data: result.data };\n  }\n  return {\n    ok: false,\n    errors: result.error.issues.map((issue) => ({\n      path: issue.path.join(\".\"),\n      message: issue.message,\n    })),\n  };\n}\n","import * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\n// ---------------------------------------------------------------------------\n// Model identifier validation + normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Anthropic model aliases recognized by Claude Code and the Claude Agent SDK.\n *\n * - `inherit` — use the parent agent's model (Claude Code only).\n * - `opus` / `sonnet` / `haiku` — auto-rolling pointer to the current top model\n *   in that family. Resolved by Claude Code / the Claude SDK at runtime.\n *\n * Use these in `agent.yaml` `model.preferred` for portability across Claude\n * Code and `claude-sdk`. Use a full ID (see {@link ANTHROPIC_FULL_ID_PATTERN})\n * when you need to pin to a specific Anthropic release.\n */\nexport const ANTHROPIC_MODEL_ALIASES = [\"inherit\", \"opus\", \"sonnet\", \"haiku\"] as const;\nexport type AnthropicModelAlias = (typeof ANTHROPIC_MODEL_ALIASES)[number];\n\n/**\n * Anthropic model family segments recognized inside a full model identifier.\n *\n * This is the *ID* vocabulary, deliberately wider than\n * {@link ANTHROPIC_MODEL_ALIASES}: `fable` ships as a real model family\n * (`claude-fable-5`) but has no Claude Code rolling alias, so it belongs here\n * and not there.\n *\n * @since 1.5.0\n */\nexport const ANTHROPIC_MODEL_FAMILIES = [\"opus\", \"sonnet\", \"haiku\", \"fable\"] as const;\nexport type AnthropicModelFamily = (typeof ANTHROPIC_MODEL_FAMILIES)[number];\n\nconst FAMILY_ALT = ANTHROPIC_MODEL_FAMILIES.join(\"|\");\n\n/**\n * Family + version core shared by the full / Bedrock / Vertex patterns.\n *\n * Matches both the Claude 4+ \"family-first\" form (`opus-4-6`, `opus-5`) and the\n * legacy \"version-first\" form used by Claude 3.x and some OpenRouter aliases\n * (`3-5-sonnet`).\n *\n * The version is `\\d+(?:[-.]\\d+)*` — one *or more* numeric components. It used\n * to demand two or more, which rejected every current single-digit-major ID\n * (`claude-opus-5`, `claude-sonnet-5`, `claude-fable-5`). Those are structurally\n * indistinguishable from the older partial IDs the two-component rule was\n * written to catch (`claude-opus-4`), so accepting the current lineup\n * necessarily accepts those too. This validator is structural, not a catalog\n * check — a well-formed ID that no provider serves is caught at dispatch, not\n * here.\n */\nconst FAMILY_VERSION_CORE = `(?:(?:${FAMILY_ALT})-\\\\d+(?:[-.]\\\\d+)*|\\\\d+(?:[-.]\\\\d+)*-(?:${FAMILY_ALT}))`;\n\n/**\n * Regex matching a full Anthropic model identifier, optionally provider-prefixed.\n *\n * Examples that match (family-first):\n * - `claude-opus-5`\n * - `claude-sonnet-5`\n * - `claude-fable-5`\n * - `claude-opus-4-6`\n * - `claude-haiku-4-5-20251001`\n * - `anthropic/claude-sonnet-4.6` (OpenRouter form)\n *\n * Examples that match (version-first / legacy):\n * - `claude-3-5-sonnet-20241022`\n * - `anthropic/claude-3.7-sonnet`\n *\n * Still rejected: a bare family (`claude-opus`), a non-Claude vendor\n * (`gpt-4o`), an unknown family (`claude-turbo-5`).\n */\nexport const ANTHROPIC_FULL_ID_PATTERN = new RegExp(\n  `^(?:[a-z0-9-]+\\\\/)?claude-${FAMILY_VERSION_CORE}(?:-\\\\d{8})?$`,\n);\n\n/**\n * Regex matching an Amazon Bedrock-form Anthropic model identifier: an\n * optional region/scope prefix (`us.` / `eu.` / `apac.` / `global.`), the\n * `anthropic.` vendor segment, the same family/version core as\n * {@link ANTHROPIC_FULL_ID_PATTERN}, plus Bedrock's optional\n * `-v<major>[:<minor>]` suffix.\n *\n * Examples that match:\n * - `anthropic.claude-3-5-sonnet-20241022-v2:0`\n * - `us.anthropic.claude-opus-4-6-v1:0`\n * - `anthropic.claude-sonnet-4-5-20250929-v1:0`\n *\n * Does NOT match `anthropic.gpt-4` (not a Claude family) or a bare\n * `us.claude-…` (the `anthropic.` segment is required).\n *\n * @since 1.3.0\n */\nexport const BEDROCK_MODEL_ID_PATTERN = new RegExp(\n  `^(?:(?:us|eu|apac|global)\\\\.)?anthropic\\\\.claude-${FAMILY_VERSION_CORE}(?:-\\\\d{8})?(?:-v\\\\d+(?::\\\\d+)?)?$`,\n);\n\n/**\n * Regex matching a Google Vertex AI publisher-form Anthropic identifier —\n * a first-party ID pinned with an `@YYYYMMDD` date suffix instead of the\n * native `-YYYYMMDD` (e.g. `claude-sonnet-4-5@20250929`).\n *\n * @since 1.3.0\n */\nexport const VERTEX_MODEL_ID_PATTERN = new RegExp(`^claude-${FAMILY_VERSION_CORE}@\\\\d{8}$`);\n\n/**\n * Zod schema for a **first-party Anthropic** model identifier: a Claude Code\n * alias, a full Anthropic ID, a Bedrock-form ID (see\n * {@link BEDROCK_MODEL_ID_PATTERN}), or a Vertex `@date`-pinned ID (see\n * {@link VERTEX_MODEL_ID_PATTERN}).\n *\n * This is **not** a universal model-id rule. It is the vocabulary of exactly\n * one wire target — `surface: anthropic-messages` on `transport: direct`\n * pointed at Anthropic's own host — because that is the only endpoint whose\n * model namespace this package knows. Every other endpoint names models it\n * cannot enumerate (a Bedrock ARN, an Azure deployment name,\n * `accounts/fireworks/models/…`, `meta-llama/Llama-3.3-70B`, an Ollama tag),\n * and applying this schema there rejected working configurations. Pick between\n * the two vocabularies with {@link modelIdSchemaForTarget}.\n *\n * Use {@link normalizeAnthropicModel} to coerce an unrecognized value to a safe\n * alias instead of failing.\n */\nexport const ModelIdSchema = z.union([\n  z.enum(ANTHROPIC_MODEL_ALIASES),\n  z\n    .string()\n    .regex(\n      ANTHROPIC_FULL_ID_PATTERN,\n      \"Invalid Anthropic model ID. Use an alias (opus | sonnet | haiku | inherit), a full ID (e.g. claude-opus-5, claude-sonnet-4-6), a Bedrock ID (e.g. us.anthropic.claude-opus-4-6-v1:0), or a Vertex ID (e.g. claude-sonnet-4-5@20250929).\",\n    ),\n  z.string().regex(BEDROCK_MODEL_ID_PATTERN),\n  z.string().regex(VERTEX_MODEL_ID_PATTERN),\n]);\n\n/**\n * Hosts that serve the first-party Anthropic Messages API. An\n * `anthropic-messages` entry pointed anywhere else — a gateway, LiteLLM, an\n * Azure AI Foundry deployment — speaks the same wire protocol over its own\n * model namespace.\n *\n * @since 3.21.0\n */\nexport const ANTHROPIC_FIRST_PARTY_HOSTS: readonly string[] = [\"api.anthropic.com\"];\n\n/**\n * The slice of a provider-registry `llm` entry that decides which model-id\n * vocabulary applies.\n *\n * Structurally a subset of `AIProviderLlmEntry`\n * (`@skaile/workspaces/core/provider-registry`), so a registry entry can be\n * passed straight in. The fields are plain strings because this module sits\n * *below* the registry in the dependency graph and must not import it; the\n * enums live in exactly one place, and this is not it.\n *\n * @since 3.21.0\n */\nexport interface ModelIdTarget {\n  /** omp `api` value — `anthropic-messages`, `openai-completions`, … */\n  surface?: string;\n  /** `direct` when absent. */\n  transport?: string;\n  /** Resolved endpoint: `resolveEntryBaseUrl(entry)`, or the preset literal. */\n  base_url?: string;\n}\n\n/**\n * True when `baseUrl` is the first-party Anthropic API.\n *\n * An absent URL counts: an `anthropic-messages` entry with no endpoint of its\n * own is the first-party API (the catalog layer fills in\n * `https://api.anthropic.com` during the merge). A URL that will not parse is\n * treated as *not* first-party — guessing the other way would reject ids that\n * whatever is at the other end serves.\n *\n * @since 3.21.0\n */\nexport function isFirstPartyAnthropicEndpoint(baseUrl?: string): boolean {\n  if (!baseUrl) return true;\n  let host: string;\n  try {\n    host = new URL(baseUrl).hostname.toLowerCase();\n  } catch {\n    return false;\n  }\n  return ANTHROPIC_FIRST_PARTY_HOSTS.includes(host);\n}\n\n/**\n * Whether `target` demands an Anthropic-shaped model id.\n *\n * Exactly one combination does: the Anthropic Messages wire, spoken directly,\n * to Anthropic's own host. Every gateway transport (`bedrock`, `vertex`,\n * `foundry`, `azure-openai`) addresses the same models under a renamed\n * namespace — an inference-profile ARN, a publisher path, a deployment name —\n * and an `anthropic-messages` proxy owns its namespace outright.\n *\n * An absent `target` is the pre-registry default: first-party Anthropic is what\n * the Claude drivers talk to when nothing says otherwise, so the strict\n * vocabulary still applies there and nothing that validates today stops\n * validating.\n *\n * @since 3.21.0\n */\nexport function requiresAnthropicModelId(target?: ModelIdTarget): boolean {\n  if (!target) return true;\n  if (target.surface !== \"anthropic-messages\") return false;\n  if ((target.transport ?? \"direct\") !== \"direct\") return false;\n  return isFirstPartyAnthropicEndpoint(target.base_url);\n}\n\n/**\n * Any non-empty, whitespace-free model id — the vocabulary of every endpoint\n * whose model namespace belongs to the operator rather than to us.\n *\n * @since 3.21.0\n */\nexport const FreeFormModelIdSchema = z\n  .string()\n  .regex(/^\\S+$/, \"Model ID must be a non-empty string with no whitespace.\");\n\n/**\n * The model-id schema a given wire target enforces: {@link ModelIdSchema} for\n * first-party Anthropic, {@link FreeFormModelIdSchema} everywhere else.\n *\n * @since 3.21.0\n */\nexport function modelIdSchemaForTarget(target?: ModelIdTarget): z.ZodType<string> {\n  return requiresAnthropicModelId(target)\n    ? (ModelIdSchema as z.ZodType<string>)\n    : (FreeFormModelIdSchema as z.ZodType<string>);\n}\n\n/**\n * Contextual model-ID schema for the legacy `cloud` dimension.\n *\n * `default` (or absent) is the first-party Anthropic API, so the strict\n * vocabulary applies. Every other value either renames the namespace\n * (`bedrock` ARNs, `vertex` publisher paths, `azure` deployments) or is an\n * unknowable proxy (`gateway`) — all free-form, the same answer\n * {@link modelIdSchemaForTarget} gives for the equivalent registry entry.\n *\n * Superseded by {@link modelIdSchemaForTarget}; it goes when the rest of the\n * `cloud` surface does.\n *\n * @since 1.3.0\n */\nexport function modelIdSchemaForCloud(cloud?: string): z.ZodType<string> {\n  return !cloud || cloud === \"default\"\n    ? modelIdSchemaForTarget()\n    : (FreeFormModelIdSchema as z.ZodType<string>);\n}\n\n/**\n * Normalize an arbitrary model string to a safe Claude Code value.\n *\n * - If `input` is a recognized alias or a full / Bedrock-form / Vertex-form ID,\n *   returns it unchanged.\n * - If `input` looks like `claude-<family>-...` but doesn't match any full-ID\n *   regex (e.g. the broken `claude-opus-4`), returns the family alias.\n * - Otherwise returns `fallback` (default `\"sonnet\"` — Claude Code's default).\n *\n * Used by renderers that target Claude Code / the Claude SDK to coerce stale\n * or malformed model fields into a working alias rather than propagating a\n * silent runtime failure. All full-pattern checks run BEFORE the family\n * fallback so a valid Bedrock/Vertex ID is never downgraded to an alias.\n */\nexport function normalizeAnthropicModel(\n  input: string | undefined | null,\n  fallback: AnthropicModelAlias = \"sonnet\",\n): string {\n  if (!input) return fallback;\n  if ((ANTHROPIC_MODEL_ALIASES as readonly string[]).includes(input)) return input;\n  if (ANTHROPIC_FULL_ID_PATTERN.test(input)) return input;\n  if (BEDROCK_MODEL_ID_PATTERN.test(input) || VERTEX_MODEL_ID_PATTERN.test(input)) return input;\n  // Family fallback is restricted to the rolling *aliases* — `fable` has no\n  // Claude Code alias, so a malformed `claude-fable-*` falls through to\n  // `fallback` rather than to an alias the runtime would reject.\n  const familyMatch = input.match(/claude-(opus|sonnet|haiku)/i);\n  if (familyMatch) return familyMatch[1]!.toLowerCase() as AnthropicModelAlias;\n  return fallback;\n}\n\n/**\n * A model *selector* as a manifest writes it: `@role`,\n * `<providerId>/<modelId>`, a bare provider-side id, or an Anthropic alias.\n * Resolved against the provider registry — and only then checked against the\n * selected entry's own vocabulary — by `resolveManifestModel`\n * (`@skaile/workspaces/bridge`).\n *\n * Structural on purpose. An agent manifest is portable across providers: it\n * cannot know which registry entry will serve it, so an id-vocabulary check\n * here would enforce one endpoint's namespace on every other one. That check\n * belongs to {@link modelIdSchemaForTarget}, at the point where the endpoint is\n * known.\n *\n * @since 3.21.0\n */\nexport const ModelSelectorSchema = z\n  .string()\n  .regex(\n    /^\\S+$/,\n    'Model selector must be a non-empty string with no whitespace: \"@role\", \"provider/model\", a model ID, or an Anthropic alias.',\n  );\n\nconst ModelConfigSchema = z.looseObject({\n  preferred: ModelSelectorSchema.optional(),\n  fallback: z.array(ModelSelectorSchema).optional(),\n  constraints: z\n    .looseObject({\n      temperature: z.number().optional(),\n      max_tokens: z.number().optional(),\n    })\n    .optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Composition binding types (Task 1.7)\n// ---------------------------------------------------------------------------\n\nexport const BindingValues = [\"discoverable\", \"inline-live\", \"inline-snapshot\"] as const;\nexport const BindingSchema = z.enum(BindingValues);\nexport type Binding = z.infer<typeof BindingSchema>;\n\n/**\n * A single composition item within an agent's `composes:` field.\n *\n * - `kind`: the asset kind being composed (skill, connector, ruleset, etc.)\n * - `ref`: asset ref (e.g. '@skaile/gmail@^1')\n * - `instance`: optional Library Instance ref to reuse (e.g. 'library://personal/instances/uuid')\n * - `binding`: how the asset integrates into the agent runtime; defaults per-kind\n */\nexport const AgentComposeItemSchema = z.object({\n  kind: z.string().min(1),\n  ref: z.string().min(1),\n  instance: z.string().optional(),\n  binding: BindingSchema.optional(),\n});\n\nexport type AgentComposeItem = z.infer<typeof AgentComposeItemSchema>;\n\n// ---------------------------------------------------------------------------\n// Agent manifest\n// ---------------------------------------------------------------------------\n\n/**\n * Declared tool restrictions for an agent.\n *\n * `allowed` is an allowlist: when non-empty, the agent may invoke only these\n * tools. `denied` is a denylist applied on top. An absent block (or two empty\n * arrays) means \"no restriction\" — the backend's full default toolset.\n *\n * Tool names are written in the canonical Claude Code vocabulary (`Read`,\n * `Write`, `Bash`, `WebSearch`, …). Each driver maps them onto its own\n * runtime: `claude-sdk` passes them through as `allowedTools` /\n * `disallowedTools`; the omp driver translates them to omp's built-in tool\n * names and passes `--tools`. A name a backend does not recognize is dropped\n * for that backend rather than failing the manifest, because the same manifest\n * is expected to run on more than one backend.\n *\n * This was previously an undeclared field that survived only because\n * {@link AgentManifestSchema} is a loose object — so `AgentManifest.tools` was\n * typed `unknown` and every consumer read it through a cast.\n *\n * @since 1.5.0\n */\nexport const AgentToolsSchema = z.looseObject({\n  /** Tool names the agent may invoke. Empty or absent means \"no allowlist\". */\n  allowed: z.array(z.string().min(1)).optional(),\n  /** Tool names the agent must not invoke. Applied after `allowed`. */\n  denied: z.array(z.string().min(1)).optional(),\n});\n\nexport type AgentTools = z.infer<typeof AgentToolsSchema>;\n\nexport const AgentManifestSchema = z.looseObject({\n  spec_version: z.string().optional(),\n  name: z.string().min(1),\n  version: z.string().optional(),\n  description: z.string().min(1),\n  extends: z.string().optional(),\n\n  model: ModelConfigSchema.optional(),\n  tools: AgentToolsSchema.optional(),\n  skills: z.array(z.string()).optional(),\n  delegation: z.looseObject({ mode: z.string() }).optional(),\n  runtime: z\n    .looseObject({\n      max_turns: z.number().optional(),\n      timeout: z.number().optional(),\n    })\n    .optional(),\n\n  author: z.string().optional(),\n  license: z.string().optional(),\n  tags: z.array(z.string()).optional(),\n  keywords: z.array(z.string()).optional(),\n\n  // v2 composition (Task 1.7)\n  composes: z.array(AgentComposeItemSchema).optional(),\n\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type AgentManifest = z.infer<typeof AgentManifestSchema>;\n\nexport function validateAgent(data: unknown): ManifestValidationResult<AgentManifest> {\n  return validateManifest(AgentManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { FieldSchema, type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const ConnectorManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  entry: z.string().min(1),\n  npm_deps: z\n    .object({\n      required: z.array(z.string()).optional(),\n      optional: z.array(z.string()).optional(),\n    })\n    .optional(),\n  fields: z.array(FieldSchema).optional(),\n  health_check: z.string().nullable().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n});\n\nexport type ConnectorManifest = z.infer<typeof ConnectorManifestSchema>;\n\nexport function validateConnector(data: unknown): ManifestValidationResult<ConnectorManifest> {\n  return validateManifest(ConnectorManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { FieldSchema, type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const MountManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  entry: z.string().min(1),\n  fields: z.array(FieldSchema).optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n});\n\nexport type MountManifest = z.infer<typeof MountManifestSchema>;\n\nexport function validateMount(data: unknown): ManifestValidationResult<MountManifest> {\n  return validateManifest(MountManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  ArtifactRefSchema,\n  CommonMetadataSchema,\n  FilePrerequisiteSchema,\n  type ManifestValidationResult,\n  UserInputSchema,\n  validateManifest,\n} from \"./_shared.js\";\n\nconst SkillMetadataSchema = CommonMetadataSchema.extend({\n  parameters: z.record(z.string(), z.unknown()).optional(),\n  artifacts: z\n    .object({\n      requires: z.array(ArtifactRefSchema).optional(),\n      produces: z.array(ArtifactRefSchema).optional(),\n      consumes: z.array(ArtifactRefSchema).optional(),\n    })\n    .optional(),\n  prerequisites: z\n    .object({\n      files: z.array(FilePrerequisiteSchema).optional(),\n      inputs_required: z.array(UserInputSchema).optional(),\n      inputs_optional: z.array(UserInputSchema).optional(),\n      // Parsed by the resolver's parseSkillRequirements; Zod would strip them otherwise.\n      reads: z.array(z.object({ path: z.string(), description: z.string().optional() })).optional(),\n      produces: z\n        .array(z.object({ path: z.string(), description: z.string().optional() }))\n        .optional(),\n      resources: z\n        .array(\n          z.object({\n            id: z.string(),\n            operations: z.array(z.string()).optional(),\n            optional: z.boolean().optional(),\n            description: z.string().optional(),\n          }),\n        )\n        .optional(),\n      connectors: z\n        .array(\n          z.object({\n            driver: z.string(),\n            access: z.enum([\"read-only\", \"read-write\"]).optional(),\n          }),\n        )\n        .optional(),\n    })\n    .optional(),\n  produces: z.array(z.object({ path: z.string(), description: z.string().optional() })).optional(),\n});\n\nexport const SkillManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  license: z.string().optional(),\n  compatibility: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  // agentskills.io standard field. Kept as `unknown` (not `string`) so a legacy\n  // array form never hard-fails validateSkill — the string-typing rule is\n  // advisory, owned by checkAgentSkillConformance (warn, not error).\n  \"allowed-tools\": z.unknown().optional(),\n\n  // Legacy fields (SKILL.md convention)\n  source: z.string().optional(),\n  user_inputs: z.array(UserInputSchema).optional(),\n  reads_from: z.array(z.string()).optional(),\n  writes_to: z.array(z.string()).optional(),\n\n  metadata: SkillMetadataSchema.optional(),\n});\n\nexport type SkillManifest = z.infer<typeof SkillManifestSchema>;\n\nexport function validateSkill(data: unknown): ManifestValidationResult<SkillManifest> {\n  return validateManifest(SkillManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const ContractManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type ContractManifest = z.infer<typeof ContractManifestSchema>;\n\nexport function validateContract(data: unknown): ManifestValidationResult<ContractManifest> {\n  return validateManifest(ContractManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const McpServerManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.union([z.string(), z.number()]).optional(),\n  // \"http\" is the runtime literal the runner honours (StreamableHTTPClientTransport);\n  // \"streamable-http\" is accepted as an MCP-spec-aligned alias and normalized to\n  // \"http\" in mcpDeclFromCatalogEntry. Keep both until the alias is retired.\n  transport: z.enum([\"stdio\", \"sse\", \"http\", \"streamable-http\"]).optional(),\n  command: z.string().optional(),\n  args: z.array(z.string()).optional(),\n  env: z.record(z.string(), z.string()).optional(),\n  url: z.string().optional(),\n  headers: z.record(z.string(), z.string()).optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  // Optional runnable payload fetched + sha256-verified by the platform\n  // session-materializer into the asset dir at materialize time (e.g. a bundled\n  // server.js shipped as a GitHub release asset). `dest` defaults to the URL\n  // basename.\n  payload: z\n    .object({\n      // https only — bare `z.string().url()` also accepts file:/data:/javascript: schemes.\n      url: z\n        .string()\n        .url()\n        .refine((u) => u.startsWith(\"https://\"), { message: \"payload url must be https\" }),\n      sha256: z.string().regex(/^[a-f0-9]{64}$/),\n      // Plain filename, no path separators — schema-level guard against a traversal dest.\n      dest: z\n        .string()\n        .regex(/^[^/\\\\]+$/, { message: \"dest must be a plain filename, not a path\" })\n        .optional(),\n    })\n    .optional(),\n});\n\nexport type McpServerManifest = z.infer<typeof McpServerManifestSchema>;\n\nexport function validateMcpServer(data: unknown): ManifestValidationResult<McpServerManifest> {\n  return validateManifest(McpServerManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const PromptManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type PromptManifest = z.infer<typeof PromptManifestSchema>;\n\nexport function validatePrompt(data: unknown): ManifestValidationResult<PromptManifest> {\n  return validateManifest(PromptManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const PersonaManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type PersonaManifest = z.infer<typeof PersonaManifestSchema>;\n\nexport function validatePersona(data: unknown): ManifestValidationResult<PersonaManifest> {\n  return validateManifest(PersonaManifestSchema, data);\n}\n","/**\n * Polymorphic Preset manifest schema.\n *\n * A Preset is the unified composition + configuration primitive. Items can be:\n * - Asset ref (plain or with inline config + placeholders)\n * - Library Instance ref (`library://tier/instances/id`)\n * - Nested Preset ref (resolved recursively, max depth 3)\n *\n * Apply semantics derive from ref type, not an explicit mode field.\n */\nimport * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\n// ---------------------------------------------------------------------------\n// Placeholder types\n// ---------------------------------------------------------------------------\n\nconst PlaceholderTypeValues = [\n  \"text\",\n  \"multiline\",\n  \"secret\",\n  \"number\",\n  \"boolean\",\n  \"enum\",\n  \"oauth\",\n  \"instance-picker\",\n] as const;\n\nexport const PlaceholderTypeSchema = z.enum(PlaceholderTypeValues);\n\nexport const PlaceholderSchema = z.object({\n  key: z.string().min(1),\n  prompt: z.string().optional(),\n  type: PlaceholderTypeSchema.optional(),\n  required: z.boolean().optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Compose item (for agents within presets)\n// ---------------------------------------------------------------------------\n\nconst ComposeRefSchema = z.object({\n  kind: z.string().min(1),\n  ref: z.string().min(1),\n});\n\n// ---------------------------------------------------------------------------\n// Preset item\n// ---------------------------------------------------------------------------\n\nexport const PresetItemSchema = z.looseObject({\n  /** Asset ref, Library Instance ref, or nested Preset ref. */\n  ref: z.string().min(1),\n  /** Local item ID for cross-item references (#item-id). */\n  id: z.string().optional(),\n  /** Author-prefilled non-secret config values. */\n  config: z.record(z.string(), z.unknown()).optional(),\n  /** User/secret values prompted at install. */\n  placeholders: z.array(PlaceholderSchema).optional(),\n  /** How placeholder values fold into the Instance config. */\n  materialize: z.record(z.string(), z.string()).optional(),\n  /** Composition for agent items. */\n  composes: z.array(ComposeRefSchema).optional(),\n  /** Outer-Preset-author-supplied placeholder values for nested Presets. */\n  inputs: z.record(z.string(), z.unknown()).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Preset-level input (rare, shared across items)\n// ---------------------------------------------------------------------------\n\nconst PresetInputSchema = z.object({\n  key: z.string().min(1),\n  type: PlaceholderTypeSchema.optional(),\n  prompt: z.string().optional(),\n  required: z.boolean().optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Source (git repo backing non-factory dependencies)\n// ---------------------------------------------------------------------------\n\n/** A `{url, pin?}` source the preset's dependencies resolve from (mirrors `SourceEntry`). */\nexport const PresetSourceSchema = z.object({\n  url: z.string().min(1),\n  pin: z.string().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Preset manifest\n// ---------------------------------------------------------------------------\n\nexport const PresetManifestSchema = z.looseObject({\n  publisher: z.string().optional(),\n  name: z.string().min(1),\n  version: z.union([z.string(), z.number()]),\n  description: z.string().min(1),\n  category: z.string().optional(),\n  license: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n\n  /** 1+ polymorphic items. */\n  items: z.array(PresetItemSchema).min(1),\n\n  /** Preset-level inputs shared across items (rare). */\n  inputs: z.array(PresetInputSchema).optional(),\n\n  /** Git sources the dependency items resolve from; `apply` registers these first. */\n  sources: z.array(PresetSourceSchema).optional(),\n});\n\nexport type PresetManifest = z.infer<typeof PresetManifestSchema>;\nexport type PresetItem = z.infer<typeof PresetItemSchema>;\nexport type PresetSource = z.infer<typeof PresetSourceSchema>;\nexport type Placeholder = z.infer<typeof PlaceholderSchema>;\n\nexport function validatePreset(data: unknown): ManifestValidationResult<PresetManifest> {\n  return validateManifest(PresetManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const RulesetManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type RulesetManifest = z.infer<typeof RulesetManifestSchema>;\n\nexport function validateRuleset(data: unknown): ManifestValidationResult<RulesetManifest> {\n  return validateManifest(RulesetManifestSchema, data);\n}\n","/**\n * Asset manifest schemas for all 11 kinds + Preset.\n *\n * Each kind exports:\n * - <Kind>ManifestSchema (zod)\n * - <Kind>Manifest (type)\n * - validate<Kind>(data) -> ManifestValidationResult\n */\n\nexport type {\n  AssetKind,\n  ManifestValidationFailure,\n  ManifestValidationResult,\n  ManifestValidationSuccess,\n} from \"./_shared.js\";\n// Shared\nexport {\n  ArtifactRefSchema,\n  AssetKindSchema,\n  AssetKindValues,\n  BaseFrontmatterSchema,\n  CommonMetadataSchema,\n  FieldSchema,\n  FilePrerequisiteSchema,\n  UserInputSchema,\n  validateManifest,\n} from \"./_shared.js\";\nexport type {\n  AgentComposeItem,\n  AgentManifest,\n  AgentTools,\n  AnthropicModelAlias,\n  AnthropicModelFamily,\n  Binding,\n  ModelIdTarget,\n} from \"./agent.js\";\nexport {\n  AgentComposeItemSchema,\n  AgentManifestSchema,\n  AgentToolsSchema,\n  ANTHROPIC_FIRST_PARTY_HOSTS,\n  ANTHROPIC_FULL_ID_PATTERN,\n  ANTHROPIC_MODEL_ALIASES,\n  ANTHROPIC_MODEL_FAMILIES,\n  BEDROCK_MODEL_ID_PATTERN,\n  BindingSchema,\n  BindingValues,\n  FreeFormModelIdSchema,\n  isFirstPartyAnthropicEndpoint,\n  ModelIdSchema,\n  modelIdSchemaForCloud,\n  modelIdSchemaForTarget,\n  ModelSelectorSchema,\n  normalizeAnthropicModel,\n  requiresAnthropicModelId,\n  validateAgent,\n  VERTEX_MODEL_ID_PATTERN,\n} from \"./agent.js\";\nexport type { ConnectorManifest } from \"./connector.js\";\nexport { ConnectorManifestSchema, validateConnector } from \"./connector.js\";\nexport type { MountManifest } from \"./mount.js\";\nexport { MountManifestSchema, validateMount } from \"./mount.js\";\nexport type { SkillManifest } from \"./skill.js\";\n// Per-kind\nexport { SkillManifestSchema, validateSkill } from \"./skill.js\";\n\n// NOTE: FlowManifestSchema, FlowManifest, validateFlow live in @skaile/workspaces/factory-assets/connectors/flow/engine.\n// Import from @skaile/workspaces/factory-assets/connectors/flow/engine directly.\n\nexport type { ContractManifest } from \"./contract.js\";\nexport { ContractManifestSchema, validateContract } from \"./contract.js\";\nexport type { McpServerManifest } from \"./mcp-server.js\";\nexport { McpServerManifestSchema, validateMcpServer } from \"./mcp-server.js\";\nexport type { PromptManifest } from \"./prompt.js\";\nexport { PromptManifestSchema, validatePrompt } from \"./prompt.js\";\n\n// NOTE: KnowledgeManifestSchema, KnowledgeManifest, validateKnowledge moved to @skaile/library in 1.7.4.\n// Import from @skaile/library directly.\n\nexport type { PersonaManifest } from \"./persona.js\";\nexport { PersonaManifestSchema, validatePersona } from \"./persona.js\";\nexport type { Placeholder, PresetItem, PresetManifest, PresetSource } from \"./preset.js\";\n// Preset (composition entity, not an asset kind)\nexport {\n  PlaceholderSchema,\n  PlaceholderTypeSchema,\n  PresetItemSchema,\n  PresetManifestSchema,\n  PresetSourceSchema,\n  validatePreset,\n} from \"./preset.js\";\nexport type { RulesetManifest } from \"./ruleset.js\";\nexport { RulesetManifestSchema, validateRuleset } from \"./ruleset.js\";\n\n// ---------------------------------------------------------------------------\n// Kind-to-validator lookup\n// ---------------------------------------------------------------------------\n\nimport type { AssetKind, ManifestValidationResult } from \"./_shared.js\";\nimport { validateAgent } from \"./agent.js\";\nimport { validateConnector } from \"./connector.js\";\nimport { validateContract } from \"./contract.js\";\nimport { validateMcpServer } from \"./mcp-server.js\";\nimport { validateMount } from \"./mount.js\";\nimport { validatePersona } from \"./persona.js\";\nimport { validatePrompt } from \"./prompt.js\";\nimport { validateRuleset } from \"./ruleset.js\";\nimport { validateSkill } from \"./skill.js\";\n\n/**\n * Validators for core kinds that still live in this package.\n * flow: lives in @skaile/workspaces/factory-assets/connectors/flow/engine\n * knowledge: lives in @skaile/library\n *\n * For kinds not in this map, use the IAssetKindRegistry from @skaile/plugins.\n */\nconst validators: Partial<Record<AssetKind, (data: unknown) => ManifestValidationResult<unknown>>> =\n  {\n    skill: validateSkill,\n    agent: validateAgent,\n    connector: validateConnector,\n    mount: validateMount,\n    contract: validateContract,\n    prompt: validatePrompt,\n    \"mcp-server\": validateMcpServer,\n    persona: validatePersona,\n    ruleset: validateRuleset,\n  };\n\n/**\n * Validate a manifest against the schema for the given asset kind.\n *\n * NOTE: flow validation lives in @skaile/workspaces/factory-assets/connectors/flow/engine. Use the\n * IAssetKindRegistry for kind-agnostic validation that includes all\n * registered providers (including extension kinds).\n */\nexport function validateByKind(kind: AssetKind, data: unknown): ManifestValidationResult<unknown> {\n  const validator = validators[kind];\n  if (!validator) {\n    return { ok: false, errors: [{ path: \"kind\", message: `Unknown asset kind: ${kind}` }] };\n  }\n  return validator(data);\n}\n"]}
+{"version":3,"sources":["../types/src/manifests/_shared.ts","../types/src/manifests/agent.ts","../types/src/manifests/connector.ts","../types/src/manifests/mount.ts","../types/src/manifests/skill.ts","../types/src/manifests/contract.ts","../types/src/manifests/mcp-server.ts","../types/src/manifests/prompt.ts","../types/src/manifests/persona.ts","../types/src/manifests/preset.ts","../types/src/manifests/ruleset.ts","../types/src/manifests/index.ts"],"names":["z2","z3","z4","z5","z6","z7","z8","z9","z10","z11"],"mappings":";;;AAUO,IAAM,eAAA,GAAkB;AAAA,EAC7B,OAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAEO,IAAM,eAAA,GAAoB,OAAK,eAAe;AAQ9C,IAAM,oBAAsB,CAAA,CAAA,MAAA,CAAO;AAAA,EACxC,EAAA,EAAM,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACpB,WAAA,EAAe,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC;AAGM,IAAM,yBAA2B,CAAA,CAAA,MAAA,CAAO;AAAA,EAC7C,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,WAAA,EAAe,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAC1B,CAAC;AAGM,IAAM,kBAAoB,CAAA,CAAA,WAAA,CAAY;AAAA,EAC3C,KAAO,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAChC,IAAM,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAC/B,KAAA,EAAS,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,MAAA,EAAU,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,QAAA,EAAY,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAW,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACtC,MAAA,EAAU,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,KAAA,CAAM,CAAG,CAAA,CAAA,MAAA,EAAO,EAAK,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC5D,OAAA,EACG,QAAM,CAAG,CAAA,CAAA,MAAA,IAAY,CAAA,CAAA,MAAA,EAAO,EAAK,WAAQ,EAAK,CAAA,CAAA,KAAA,CAAQ,QAAM,CAAG,CAAA,CAAA,MAAA,IAAY,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAC,CAAC,CAAA,CACvF,QAAA,EAAS;AAAA,EACZ,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC;AAGM,IAAM,cAAgB,CAAA,CAAA,MAAA,CAAO;AAAA,EAClC,GAAA,EAAO,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,KAAA,EAAS,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,QAAA,EAAY,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,SAAA,EAAa,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAChC,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,OAAA,EAAW,CAAA,CAAA,KAAA,CAAM,CAAG,CAAA,CAAA,MAAA,EAAO,EAAK,CAAA,CAAA,MAAA,EAAO,EAAK,CAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA;AAC1D,CAAC;AAMM,IAAM,uBAAyB,CAAA,CAAA,WAAA,CAAY;AAAA,EAChD,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAU,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAQ,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,KAAA,EAAS,OAAK,CAAC,OAAA,EAAS,QAAQ,QAAA,EAAU,YAAY,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAClE,MAAA,EAAU,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,aAAA,EAAiB,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA;AAC7B,CAAC;AAUM,IAAM,wBAA0B,CAAA,CAAA,MAAA,CAAO;AAAA,EAC5C,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAe,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAG7B,SAAA,EAAa,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,QAAA,EAAY,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAY,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA;AAChC,CAAC;AAkBM,SAAS,gBAAA,CACd,QACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA;AACpC,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,OAAO,IAAA,EAAK;AAAA,EACvC;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,QAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,MAC1C,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAAA,MACzB,SAAS,KAAA,CAAM;AAAA,KACjB,CAAE;AAAA,GACJ;AACF;ACtHO,IAAM,uBAAA,GAA0B,CAAC,SAAA,EAAW,MAAA,EAAQ,UAAU,OAAO;AAarE,IAAM,wBAAA,GAA2B,CAAC,MAAA,EAAQ,QAAA,EAAU,SAAS,OAAO;AAG3E,IAAM,UAAA,GAAa,wBAAA,CAAyB,IAAA,CAAK,GAAG,CAAA;AAkBpD,IAAM,mBAAA,GAAsB,CAAA,MAAA,EAAS,UAAU,CAAA,yCAAA,EAA4C,UAAU,CAAA,EAAA,CAAA;AAoB9F,IAAM,4BAA4B,IAAI,MAAA;AAAA,EAC3C,6BAA6B,mBAAmB,CAAA,aAAA;AAClD;AAmBO,IAAM,2BAA2B,IAAI,MAAA;AAAA,EAC1C,oDAAoD,mBAAmB,CAAA,kCAAA;AACzE;AASO,IAAM,uBAAA,GAA0B,IAAI,MAAA,CAAO,CAAA,QAAA,EAAW,mBAAmB,CAAA,QAAA,CAAU;AAoBnF,IAAM,gBAAkBA,CAAA,CAAA,KAAA,CAAM;AAAA,EACjCA,OAAK,uBAAuB,CAAA;AAAA,EAE3BA,UAAO,CACP,KAAA;AAAA,IACC,yBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACAA,CAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,wBAAwB,CAAA;AAAA,EACvCA,CAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,uBAAuB;AAC1C,CAAC;AAUM,IAAM,2BAAA,GAAiD,CAAC,mBAAmB;AAkC3E,SAAS,8BAA8B,OAAA,EAA2B;AACvE,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAI,GAAA,CAAI,OAAO,CAAA,CAAE,SAAS,WAAA,EAAY;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,2BAAA,CAA4B,SAAS,IAAI,CAAA;AAClD;AAkBO,SAAS,yBAAyB,MAAA,EAAiC;AACxE,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,oBAAA,EAAsB,OAAO,KAAA;AACpD,EAAA,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,QAAA,MAAc,QAAA,EAAU,OAAO,KAAA;AACxD,EAAA,OAAO,6BAAA,CAA8B,OAAO,QAAQ,CAAA;AACtD;AAQO,IAAM,qBAAA,GACVA,CAAA,CAAA,MAAA,EAAO,CACP,KAAA,CAAM,SAAS,yDAAyD;AAQpE,SAAS,uBAAuB,MAAA,EAA2C;AAChF,EAAA,OAAO,wBAAA,CAAyB,MAAM,CAAA,GACjC,aAAA,GACA,qBAAA;AACP;AAgBO,SAAS,sBAAsB,KAAA,EAAmC;AACvE,EAAA,OAAO,CAAC,KAAA,IAAS,KAAA,KAAU,SAAA,GACvB,wBAAuB,GACtB,qBAAA;AACP;AAgBO,SAAS,uBAAA,CACd,KAAA,EACA,QAAA,GAAgC,QAAA,EACxB;AACR,EAAA,IAAI,CAAC,OAAO,OAAO,QAAA;AACnB,EAAA,IAAK,uBAAA,CAA8C,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAC3E,EAAA,IAAI,yBAAA,CAA0B,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AAClD,EAAA,IAAI,wBAAA,CAAyB,KAAK,KAAK,CAAA,IAAK,wBAAwB,IAAA,CAAK,KAAK,GAAG,OAAO,KAAA;AAIxF,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,KAAA,CAAM,6BAA6B,CAAA;AAC7D,EAAA,IAAI,WAAA,EAAa,OAAO,WAAA,CAAY,CAAC,EAAG,WAAA,EAAY;AACpD,EAAA,OAAO,QAAA;AACT;AAiBO,IAAM,mBAAA,GACVA,UAAO,CACP,KAAA;AAAA,EACC,OAAA;AAAA,EACA;AACF;AAEF,IAAM,oBAAsBA,CAAA,CAAA,WAAA,CAAY;AAAA,EACtC,SAAA,EAAW,oBAAoB,QAAA,EAAS;AAAA,EACxC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,mBAAmB,CAAA,CAAE,QAAA,EAAS;AAAA,EAChD,aACGA,CAAA,CAAA,WAAA,CAAY;AAAA,IACX,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,UAAA,EAAcA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,GACjC,EACA,QAAA;AACL,CAAC,CAAA;AAMM,IAAM,aAAA,GAAgB,CAAC,cAAA,EAAgB,aAAA,EAAe,iBAAiB;AACvE,IAAM,aAAA,GAAkBA,OAAK,aAAa;AAW1C,IAAM,yBAA2BA,CAAA,CAAA,MAAA,CAAO;AAAA,EAC7C,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,QAAA,EAAYA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAS,cAAc,QAAA;AACzB,CAAC;AA6BM,IAAM,mBAAqBA,CAAA,CAAA,WAAA,CAAY;AAAA;AAAA,EAE5C,OAAA,EAAWA,QAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAC,EAAE,QAAA,EAAS;AAAA;AAAA,EAE7C,MAAA,EAAUA,QAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAC,EAAE,QAAA;AACrC,CAAC;AAIM,IAAM,sBAAwBA,CAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,YAAA,EAAgBA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAE7B,KAAA,EAAO,kBAAkB,QAAA,EAAS;AAAA,EAClC,KAAA,EAAO,iBAAiB,QAAA,EAAS;AAAA,EACjC,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACrC,UAAA,EAAcA,cAAY,EAAE,IAAA,EAAQA,UAAO,EAAG,EAAE,QAAA,EAAS;AAAA,EACzD,SACGA,CAAA,CAAA,WAAA,CAAY;AAAA,IACX,SAAA,EAAaA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,GAC9B,EACA,QAAA,EAAS;AAAA,EAEZ,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,IAAA,EAAQA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAGvC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,sBAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,EAEnD,UAAYA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA;AAC9C,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACtZO,IAAM,0BAA4BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACnD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,KAAA,EAASA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACvB,UACGA,CAAA,CAAA,MAAA,CAAO;AAAA,IACN,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACvC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA;AAAS,GACxC,EACA,QAAA,EAAS;AAAA,EACZ,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA,EAAS;AAAA,EACtC,YAAA,EAAgBA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC7C,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,SAAS,kBAAkB,IAAA,EAA4D;AAC5F,EAAA,OAAO,gBAAA,CAAiB,yBAAyB,IAAI,CAAA;AACvD;ACrBO,IAAM,sBAAwBC,CAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,KAAA,EAASA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACvB,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA,EAAS;AAAA,EACtC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACPA,IAAM,mBAAA,GAAsB,qBAAqB,MAAA,CAAO;AAAA,EACtD,YAAcC,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACvD,WACGA,CAAA,CAAA,MAAA,CAAO;AAAA,IACN,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA;AAAS,GAC/C,EACA,QAAA,EAAS;AAAA,EACZ,eACGA,CAAA,CAAA,MAAA,CAAO;AAAA,IACN,KAAA,EAASA,CAAA,CAAA,KAAA,CAAM,sBAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,IAChD,eAAA,EAAmBA,CAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA,IACnD,eAAA,EAAmBA,CAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,IAEnD,KAAA,EAASA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,CAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,CAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EAAE,QAAA,EAAS;AAAA,IAC5F,QAAA,EACGA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,CAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,CAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EACxE,QAAA,EAAS;AAAA,IACZ,SAAA,EACGA,CAAA,CAAA,KAAA;AAAA,MACGA,CAAA,CAAA,MAAA,CAAO;AAAA,QACP,IAAMA,CAAA,CAAA,MAAA,EAAO;AAAA,QACb,UAAA,EAAcA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACzC,QAAA,EAAYA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,QAC/B,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,OAClC;AAAA,MAEF,QAAA,EAAS;AAAA,IACZ,UAAA,EACGA,CAAA,CAAA,KAAA;AAAA,MACGA,CAAA,CAAA,MAAA,CAAO;AAAA,QACP,QAAUA,CAAA,CAAA,MAAA,EAAO;AAAA,QACjB,QAAUA,CAAA,CAAA,IAAA,CAAK,CAAC,aAAa,YAAY,CAAC,EAAE,QAAA;AAAS,OACtD;AAAA,MAEF,QAAA;AAAS,GACb,EACA,QAAA,EAAS;AAAA,EACZ,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,CAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,CAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EAAE,QAAA;AACxF,CAAC,CAAA;AAEM,IAAM,sBAAwBA,CAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,aAAA,EAAiBA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,eAAA,EAAmBA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAGtC,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,WAAA,EAAeA,CAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA,EAC/C,UAAA,EAAcA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACzC,SAAA,EAAaA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAExC,QAAA,EAAU,oBAAoB,QAAA;AAChC,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACtEO,IAAM,yBAA2BC,CAAA,CAAA,WAAA,CAAY;AAAA,EAClD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,iBAAiB,IAAA,EAA2D;AAC1F,EAAA,OAAO,gBAAA,CAAiB,wBAAwB,IAAI,CAAA;AACtD;ACjBO,IAAM,0BAA4BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACnD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,QAAM,CAAGA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIpD,SAAA,EAAaA,OAAK,CAAC,OAAA,EAAS,OAAO,MAAA,EAAQ,iBAAiB,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACxE,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,IAAA,EAAQA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,KAAOA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAC/C,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,SAAWA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnD,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7B,SACGA,CAAA,CAAA,MAAA,CAAO;AAAA;AAAA,IAEN,GAAA,EACGA,CAAA,CAAA,MAAA,EAAO,CACP,GAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,UAAU,CAAA,EAAG,EAAE,OAAA,EAAS,6BAA6B,CAAA;AAAA,IACnF,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,gBAAgB,CAAA;AAAA;AAAA,IAEzC,IAAA,EACGA,CAAA,CAAA,MAAA,EAAO,CACP,KAAA,CAAM,WAAA,EAAa,EAAE,OAAA,EAAS,2CAAA,EAA6C,CAAA,CAC3E,QAAA;AAAS,GACb,EACA,QAAA;AACL,CAAC;AAIM,SAAS,kBAAkB,IAAA,EAA4D;AAC5F,EAAA,OAAO,gBAAA,CAAiB,yBAAyB,IAAI,CAAA;AACvD;ACpCO,IAAM,uBAAyBC,CAAA,CAAA,WAAA,CAAY;AAAA,EAChD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,eAAe,IAAA,EAAyD;AACtF,EAAA,OAAO,gBAAA,CAAiB,sBAAsB,IAAI,CAAA;AACpD;ACbO,IAAM,wBAA0BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACjD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,gBAAgB,IAAA,EAA0D;AACxF,EAAA,OAAO,gBAAA,CAAiB,uBAAuB,IAAI,CAAA;AACrD;ACHA,IAAM,qBAAA,GAAwB;AAAA,EAC5B,MAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,qBAAA,GAA0BC,OAAK,qBAAqB;AAE1D,IAAM,oBAAsBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACxC,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAM,sBAAsB,QAAA,EAAS;AAAA,EACrC,QAAA,EAAYA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAWA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACjE,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA;AACrD,CAAC;AAMD,IAAM,mBAAqBA,CAAA,CAAA,MAAA,CAAO;AAAA,EAChC,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC;AACvB,CAAC,CAAA;AAMM,IAAM,mBAAqBA,CAAA,CAAA,WAAA,CAAY;AAAA;AAAA,EAE5C,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA;AAAA,EAErB,EAAA,EAAMA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAExB,QAAUA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA;AAAA,EAEnD,YAAA,EAAgBA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAElD,aAAeA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAEvD,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,gBAAgB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAE7C,QAAUA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA;AAC5C,CAAC;AAMD,IAAM,oBAAsBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACjC,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,IAAA,EAAM,sBAAsB,QAAA,EAAS;AAAA,EACrC,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,QAAA,EAAYA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC5D,OAAA,EAAWA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA;AAC1D,CAAC,CAAA;AAOM,IAAM,qBAAuBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACzC,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAClB,CAAC;AAMM,IAAM,uBAAyBA,CAAA,CAAA,WAAA,CAAY;AAAA,EAChD,SAAA,EAAaA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,SAAWA,CAAA,CAAA,KAAA,CAAM,CAAGA,UAAO,EAAKA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAA;AAAA,EACzC,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAGvC,KAAA,EAASA,CAAA,CAAA,KAAA,CAAM,gBAAgB,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA;AAAA,EAGtC,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAG5C,OAAA,EAAWA,CAAA,CAAA,KAAA,CAAM,kBAAkB,CAAA,CAAE,QAAA;AACvC,CAAC;AAOM,SAAS,eAAe,IAAA,EAAyD;AACtF,EAAA,OAAO,gBAAA,CAAiB,sBAAsB,IAAI,CAAA;AACpD;ACnHO,IAAM,wBAA0BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACjD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,gBAAgB,IAAA,EAA0D;AACxF,EAAA,OAAO,gBAAA,CAAiB,uBAAuB,IAAI,CAAA;AACrD;;;ACgGA,IAAM,UAAA,GACJ;AAAA,EACE,KAAA,EAAO,aAAA;AAAA,EACP,KAAA,EAAO,aAAA;AAAA,EACP,SAAA,EAAW,iBAAA;AAAA,EACX,KAAA,EAAO,aAAA;AAAA,EACP,QAAA,EAAU,gBAAA;AAAA,EACV,MAAA,EAAQ,cAAA;AAAA,EACR,YAAA,EAAc,iBAAA;AAAA,EACd,OAAA,EAAS,eAAA;AAAA,EACT,OAAA,EAAS;AACX,CAAA;AASK,SAAS,cAAA,CAAe,MAAiB,IAAA,EAAkD;AAChG,EAAA,MAAM,SAAA,GAAY,WAAW,IAAI,CAAA;AACjC,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,CAAA,oBAAA,EAAuB,IAAI,CAAA,CAAA,EAAI,CAAA,EAAE;AAAA,EACzF;AACA,EAAA,OAAO,UAAU,IAAI,CAAA;AACvB","file":"chunk-TGE33MKN.js","sourcesContent":["/**\n * Shared manifest frontmatter schemas and types.\n * Common across all 11 asset kinds + Preset.\n */\nimport * as z from \"zod\";\n\n// ---------------------------------------------------------------------------\n// Asset kind enum\n// ---------------------------------------------------------------------------\n\nexport const AssetKindValues = [\n  \"skill\",\n  \"agent\",\n  \"connector\",\n  \"mount\",\n  \"flow\",\n  \"contract\",\n  \"prompt\",\n  \"mcp-server\",\n  \"knowledge\",\n  \"persona\",\n  \"ruleset\",\n] as const;\n\nexport const AssetKindSchema = z.enum(AssetKindValues);\nexport type AssetKind = z.infer<typeof AssetKindSchema>;\n\n// ---------------------------------------------------------------------------\n// Shared metadata sub-schemas\n// ---------------------------------------------------------------------------\n\n/** Artifact dependency (requires/produces/consumes in skill metadata). */\nexport const ArtifactRefSchema = z.object({\n  id: z.string().min(1),\n  description: z.string().optional(),\n  gate: z.enum([\"hard\", \"soft\"]).optional(),\n  path: z.string().optional(),\n});\n\n/** File prerequisite for a skill. */\nexport const FilePrerequisiteSchema = z.object({\n  path: z.string().min(1),\n  gate: z.enum([\"hard\", \"soft\"]).optional(),\n  description: z.string().optional(),\n});\n\n/** User input definition (for skill user_inputs or metadata.prerequisites.inputs_*). */\nexport const UserInputSchema = z.looseObject({\n  key: z.string().min(1).optional(),\n  id: z.string().min(1).optional(),\n  label: z.string().optional(),\n  prompt: z.string().optional(),\n  type: z.string().optional(),\n  required: z.boolean().optional(),\n  options: z.array(z.string()).optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n  default: z\n    .union([z.string(), z.number(), z.boolean(), z.array(z.union([z.string(), z.number()]))])\n    .optional(),\n  hint: z.string().optional(),\n});\n\n/** Field definition for connectors/mounts. */\nexport const FieldSchema = z.object({\n  key: z.string().min(1),\n  label: z.string().optional(),\n  required: z.boolean().optional(),\n  sensitive: z.boolean().optional(),\n  type: z.string().optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Common metadata block (appears inside metadata: in most manifest kinds)\n// ---------------------------------------------------------------------------\n\nexport const CommonMetadataSchema = z.looseObject({\n  version: z.string().optional(),\n  author: z.string().optional(),\n  tags: z.array(z.string()).optional(),\n  stage: z.enum([\"alpha\", \"beta\", \"stable\", \"deprecated\"]).optional(),\n  source: z.string().optional(),\n  do_not_invoke: z.boolean().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Common frontmatter fields (top-level, shared across kinds)\n// ---------------------------------------------------------------------------\n\n/**\n * Fields that can appear at the top level of any manifest's frontmatter.\n * Not all are required -- each kind schema intersects with its own specifics.\n */\nexport const BaseFrontmatterSchema = z.object({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n\n  // Catalog identity (populated at discovery or authoring time)\n  publisher: z.string().optional(),\n  category: z.string().optional(),\n  license: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Validation result type\n// ---------------------------------------------------------------------------\n\nexport interface ManifestValidationSuccess<T> {\n  ok: true;\n  data: T;\n}\n\nexport interface ManifestValidationFailure {\n  ok: false;\n  errors: Array<{ path: string; message: string }>;\n}\n\nexport type ManifestValidationResult<T> = ManifestValidationSuccess<T> | ManifestValidationFailure;\n\nexport function validateManifest<T>(\n  schema: z.ZodType<T>,\n  data: unknown,\n): ManifestValidationResult<T> {\n  const result = schema.safeParse(data);\n  if (result.success) {\n    return { ok: true, data: result.data };\n  }\n  return {\n    ok: false,\n    errors: result.error.issues.map((issue) => ({\n      path: issue.path.join(\".\"),\n      message: issue.message,\n    })),\n  };\n}\n","import * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\n// ---------------------------------------------------------------------------\n// Model identifier validation + normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Anthropic model aliases recognized by Claude Code and the Claude Agent SDK.\n *\n * - `inherit` — use the parent agent's model (Claude Code only).\n * - `opus` / `sonnet` / `haiku` — auto-rolling pointer to the current top model\n *   in that family. Resolved by Claude Code / the Claude SDK at runtime.\n *\n * Use these in `agent.yaml` `model.preferred` for portability across Claude\n * Code and `claude-sdk`. Use a full ID (see {@link ANTHROPIC_FULL_ID_PATTERN})\n * when you need to pin to a specific Anthropic release.\n */\nexport const ANTHROPIC_MODEL_ALIASES = [\"inherit\", \"opus\", \"sonnet\", \"haiku\"] as const;\nexport type AnthropicModelAlias = (typeof ANTHROPIC_MODEL_ALIASES)[number];\n\n/**\n * Anthropic model family segments recognized inside a full model identifier.\n *\n * This is the *ID* vocabulary, deliberately wider than\n * {@link ANTHROPIC_MODEL_ALIASES}: `fable` ships as a real model family\n * (`claude-fable-5`) but has no Claude Code rolling alias, so it belongs here\n * and not there.\n *\n * @since 1.5.0\n */\nexport const ANTHROPIC_MODEL_FAMILIES = [\"opus\", \"sonnet\", \"haiku\", \"fable\"] as const;\nexport type AnthropicModelFamily = (typeof ANTHROPIC_MODEL_FAMILIES)[number];\n\nconst FAMILY_ALT = ANTHROPIC_MODEL_FAMILIES.join(\"|\");\n\n/**\n * Family + version core shared by the full / Bedrock / Vertex patterns.\n *\n * Matches both the Claude 4+ \"family-first\" form (`opus-4-6`, `opus-5`) and the\n * legacy \"version-first\" form used by Claude 3.x and some OpenRouter aliases\n * (`3-5-sonnet`).\n *\n * The version is `\\d+(?:[-.]\\d+)*` — one *or more* numeric components. It used\n * to demand two or more, which rejected every current single-digit-major ID\n * (`claude-opus-5`, `claude-sonnet-5`, `claude-fable-5`). Those are structurally\n * indistinguishable from the older partial IDs the two-component rule was\n * written to catch (`claude-opus-4`), so accepting the current lineup\n * necessarily accepts those too. This validator is structural, not a catalog\n * check — a well-formed ID that no provider serves is caught at dispatch, not\n * here.\n */\nconst FAMILY_VERSION_CORE = `(?:(?:${FAMILY_ALT})-\\\\d+(?:[-.]\\\\d+)*|\\\\d+(?:[-.]\\\\d+)*-(?:${FAMILY_ALT}))`;\n\n/**\n * Regex matching a full Anthropic model identifier, optionally provider-prefixed.\n *\n * Examples that match (family-first):\n * - `claude-opus-5`\n * - `claude-sonnet-5`\n * - `claude-fable-5`\n * - `claude-opus-4-6`\n * - `claude-haiku-4-5-20251001`\n * - `anthropic/claude-sonnet-4.6` (OpenRouter form)\n *\n * Examples that match (version-first / legacy):\n * - `claude-3-5-sonnet-20241022`\n * - `anthropic/claude-3.7-sonnet`\n *\n * Still rejected: a bare family (`claude-opus`), a non-Claude vendor\n * (`gpt-4o`), an unknown family (`claude-turbo-5`).\n */\nexport const ANTHROPIC_FULL_ID_PATTERN = new RegExp(\n  `^(?:[a-z0-9-]+\\\\/)?claude-${FAMILY_VERSION_CORE}(?:-\\\\d{8})?$`,\n);\n\n/**\n * Regex matching an Amazon Bedrock-form Anthropic model identifier: an\n * optional region/scope prefix (`us.` / `eu.` / `apac.` / `global.`), the\n * `anthropic.` vendor segment, the same family/version core as\n * {@link ANTHROPIC_FULL_ID_PATTERN}, plus Bedrock's optional\n * `-v<major>[:<minor>]` suffix.\n *\n * Examples that match:\n * - `anthropic.claude-3-5-sonnet-20241022-v2:0`\n * - `us.anthropic.claude-opus-4-6-v1:0`\n * - `anthropic.claude-sonnet-4-5-20250929-v1:0`\n *\n * Does NOT match `anthropic.gpt-4` (not a Claude family) or a bare\n * `us.claude-…` (the `anthropic.` segment is required).\n *\n * @since 1.3.0\n */\nexport const BEDROCK_MODEL_ID_PATTERN = new RegExp(\n  `^(?:(?:us|eu|apac|global)\\\\.)?anthropic\\\\.claude-${FAMILY_VERSION_CORE}(?:-\\\\d{8})?(?:-v\\\\d+(?::\\\\d+)?)?$`,\n);\n\n/**\n * Regex matching a Google Vertex AI publisher-form Anthropic identifier —\n * a first-party ID pinned with an `@YYYYMMDD` date suffix instead of the\n * native `-YYYYMMDD` (e.g. `claude-sonnet-4-5@20250929`).\n *\n * @since 1.3.0\n */\nexport const VERTEX_MODEL_ID_PATTERN = new RegExp(`^claude-${FAMILY_VERSION_CORE}@\\\\d{8}$`);\n\n/**\n * Zod schema for a **first-party Anthropic** model identifier: a Claude Code\n * alias, a full Anthropic ID, a Bedrock-form ID (see\n * {@link BEDROCK_MODEL_ID_PATTERN}), or a Vertex `@date`-pinned ID (see\n * {@link VERTEX_MODEL_ID_PATTERN}).\n *\n * This is **not** a universal model-id rule. It is the vocabulary of exactly\n * one wire target — `surface: anthropic-messages` on `transport: direct`\n * pointed at Anthropic's own host — because that is the only endpoint whose\n * model namespace this package knows. Every other endpoint names models it\n * cannot enumerate (a Bedrock ARN, an Azure deployment name,\n * `accounts/fireworks/models/…`, `meta-llama/Llama-3.3-70B`, an Ollama tag),\n * and applying this schema there rejected working configurations. Pick between\n * the two vocabularies with {@link modelIdSchemaForTarget}.\n *\n * Use {@link normalizeAnthropicModel} to coerce an unrecognized value to a safe\n * alias instead of failing.\n */\nexport const ModelIdSchema = z.union([\n  z.enum(ANTHROPIC_MODEL_ALIASES),\n  z\n    .string()\n    .regex(\n      ANTHROPIC_FULL_ID_PATTERN,\n      \"Invalid Anthropic model ID. Use an alias (opus | sonnet | haiku | inherit), a full ID (e.g. claude-opus-5, claude-sonnet-4-6), a Bedrock ID (e.g. us.anthropic.claude-opus-4-6-v1:0), or a Vertex ID (e.g. claude-sonnet-4-5@20250929).\",\n    ),\n  z.string().regex(BEDROCK_MODEL_ID_PATTERN),\n  z.string().regex(VERTEX_MODEL_ID_PATTERN),\n]);\n\n/**\n * Hosts that serve the first-party Anthropic Messages API. An\n * `anthropic-messages` entry pointed anywhere else — a gateway, LiteLLM, an\n * Azure AI Foundry deployment — speaks the same wire protocol over its own\n * model namespace.\n *\n * @since 3.21.0\n */\nexport const ANTHROPIC_FIRST_PARTY_HOSTS: readonly string[] = [\"api.anthropic.com\"];\n\n/**\n * The slice of a provider-registry `llm` entry that decides which model-id\n * vocabulary applies.\n *\n * Structurally a subset of `AIProviderLlmEntry`\n * (`@skaile/workspaces/core/provider-registry`), so a registry entry can be\n * passed straight in. The fields are plain strings because this module sits\n * *below* the registry in the dependency graph and must not import it; the\n * enums live in exactly one place, and this is not it.\n *\n * @since 3.21.0\n */\nexport interface ModelIdTarget {\n  /** omp `api` value — `anthropic-messages`, `openai-completions`, … */\n  surface?: string;\n  /** `direct` when absent. */\n  transport?: string;\n  /** Resolved endpoint: `resolveEntryBaseUrl(entry)`, or the preset literal. */\n  base_url?: string;\n}\n\n/**\n * True when `baseUrl` is the first-party Anthropic API.\n *\n * An absent URL counts: an `anthropic-messages` entry with no endpoint of its\n * own is the first-party API (the catalog layer fills in\n * `https://api.anthropic.com` during the merge). A URL that will not parse is\n * treated as *not* first-party — guessing the other way would reject ids that\n * whatever is at the other end serves.\n *\n * @since 3.21.0\n */\nexport function isFirstPartyAnthropicEndpoint(baseUrl?: string): boolean {\n  if (!baseUrl) return true;\n  let host: string;\n  try {\n    host = new URL(baseUrl).hostname.toLowerCase();\n  } catch {\n    return false;\n  }\n  return ANTHROPIC_FIRST_PARTY_HOSTS.includes(host);\n}\n\n/**\n * Whether `target` demands an Anthropic-shaped model id.\n *\n * Exactly one combination does: the Anthropic Messages wire, spoken directly,\n * to Anthropic's own host. Every gateway transport (`bedrock`, `vertex`,\n * `foundry`, `azure-openai`) addresses the same models under a renamed\n * namespace — an inference-profile ARN, a publisher path, a deployment name —\n * and an `anthropic-messages` proxy owns its namespace outright.\n *\n * An absent `target` is the pre-registry default: first-party Anthropic is what\n * the Claude drivers talk to when nothing says otherwise, so the strict\n * vocabulary still applies there and nothing that validates today stops\n * validating.\n *\n * @since 3.21.0\n */\nexport function requiresAnthropicModelId(target?: ModelIdTarget): boolean {\n  if (!target) return true;\n  if (target.surface !== \"anthropic-messages\") return false;\n  if ((target.transport ?? \"direct\") !== \"direct\") return false;\n  return isFirstPartyAnthropicEndpoint(target.base_url);\n}\n\n/**\n * Any non-empty, whitespace-free model id — the vocabulary of every endpoint\n * whose model namespace belongs to the operator rather than to us.\n *\n * @since 3.21.0\n */\nexport const FreeFormModelIdSchema = z\n  .string()\n  .regex(/^\\S+$/, \"Model ID must be a non-empty string with no whitespace.\");\n\n/**\n * The model-id schema a given wire target enforces: {@link ModelIdSchema} for\n * first-party Anthropic, {@link FreeFormModelIdSchema} everywhere else.\n *\n * @since 3.21.0\n */\nexport function modelIdSchemaForTarget(target?: ModelIdTarget): z.ZodType<string> {\n  return requiresAnthropicModelId(target)\n    ? (ModelIdSchema as z.ZodType<string>)\n    : (FreeFormModelIdSchema as z.ZodType<string>);\n}\n\n/**\n * Contextual model-ID schema for the legacy `cloud` dimension.\n *\n * `default` (or absent) is the first-party Anthropic API, so the strict\n * vocabulary applies. Every other value either renames the namespace\n * (`bedrock` ARNs, `vertex` publisher paths, `azure` deployments) or is an\n * unknowable proxy (`gateway`) — all free-form, the same answer\n * {@link modelIdSchemaForTarget} gives for the equivalent registry entry.\n *\n * Superseded by {@link modelIdSchemaForTarget}; it goes when the rest of the\n * `cloud` surface does.\n *\n * @since 1.3.0\n */\nexport function modelIdSchemaForCloud(cloud?: string): z.ZodType<string> {\n  return !cloud || cloud === \"default\"\n    ? modelIdSchemaForTarget()\n    : (FreeFormModelIdSchema as z.ZodType<string>);\n}\n\n/**\n * Normalize an arbitrary model string to a safe Claude Code value.\n *\n * - If `input` is a recognized alias or a full / Bedrock-form / Vertex-form ID,\n *   returns it unchanged.\n * - If `input` looks like `claude-<family>-...` but doesn't match any full-ID\n *   regex (e.g. the broken `claude-opus-4`), returns the family alias.\n * - Otherwise returns `fallback` (default `\"sonnet\"` — Claude Code's default).\n *\n * Used by renderers that target Claude Code / the Claude SDK to coerce stale\n * or malformed model fields into a working alias rather than propagating a\n * silent runtime failure. All full-pattern checks run BEFORE the family\n * fallback so a valid Bedrock/Vertex ID is never downgraded to an alias.\n */\nexport function normalizeAnthropicModel(\n  input: string | undefined | null,\n  fallback: AnthropicModelAlias = \"sonnet\",\n): string {\n  if (!input) return fallback;\n  if ((ANTHROPIC_MODEL_ALIASES as readonly string[]).includes(input)) return input;\n  if (ANTHROPIC_FULL_ID_PATTERN.test(input)) return input;\n  if (BEDROCK_MODEL_ID_PATTERN.test(input) || VERTEX_MODEL_ID_PATTERN.test(input)) return input;\n  // Family fallback is restricted to the rolling *aliases* — `fable` has no\n  // Claude Code alias, so a malformed `claude-fable-*` falls through to\n  // `fallback` rather than to an alias the runtime would reject.\n  const familyMatch = input.match(/claude-(opus|sonnet|haiku)/i);\n  if (familyMatch) return familyMatch[1]!.toLowerCase() as AnthropicModelAlias;\n  return fallback;\n}\n\n/**\n * A model *selector* as a manifest writes it: `@role`,\n * `<providerId>/<modelId>`, a bare provider-side id, or an Anthropic alias.\n * Resolved against the provider registry — and only then checked against the\n * selected entry's own vocabulary — by `resolveManifestModel`\n * (`@skaile/workspaces/bridge`).\n *\n * Structural on purpose. An agent manifest is portable across providers: it\n * cannot know which registry entry will serve it, so an id-vocabulary check\n * here would enforce one endpoint's namespace on every other one. That check\n * belongs to {@link modelIdSchemaForTarget}, at the point where the endpoint is\n * known.\n *\n * @since 3.21.0\n */\nexport const ModelSelectorSchema = z\n  .string()\n  .regex(\n    /^\\S+$/,\n    'Model selector must be a non-empty string with no whitespace: \"@role\", \"provider/model\", a model ID, or an Anthropic alias.',\n  );\n\nconst ModelConfigSchema = z.looseObject({\n  preferred: ModelSelectorSchema.optional(),\n  fallback: z.array(ModelSelectorSchema).optional(),\n  constraints: z\n    .looseObject({\n      temperature: z.number().optional(),\n      max_tokens: z.number().optional(),\n    })\n    .optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Composition binding types (Task 1.7)\n// ---------------------------------------------------------------------------\n\nexport const BindingValues = [\"discoverable\", \"inline-live\", \"inline-snapshot\"] as const;\nexport const BindingSchema = z.enum(BindingValues);\nexport type Binding = z.infer<typeof BindingSchema>;\n\n/**\n * A single composition item within an agent's `composes:` field.\n *\n * - `kind`: the asset kind being composed (skill, connector, ruleset, etc.)\n * - `ref`: asset ref (e.g. '@skaile/gmail@^1')\n * - `instance`: optional Library Instance ref to reuse (e.g. 'library://personal/instances/uuid')\n * - `binding`: how the asset integrates into the agent runtime; defaults per-kind\n */\nexport const AgentComposeItemSchema = z.object({\n  kind: z.string().min(1),\n  ref: z.string().min(1),\n  instance: z.string().optional(),\n  binding: BindingSchema.optional(),\n});\n\nexport type AgentComposeItem = z.infer<typeof AgentComposeItemSchema>;\n\n// ---------------------------------------------------------------------------\n// Agent manifest\n// ---------------------------------------------------------------------------\n\n/**\n * Declared tool restrictions for an agent.\n *\n * `allowed` is an allowlist: when non-empty, the agent may invoke only these\n * tools. `denied` is a denylist applied on top. An absent block (or two empty\n * arrays) means \"no restriction\" — the harness's full default toolset.\n *\n * Tool names are written in the canonical Claude Code vocabulary (`Read`,\n * `Write`, `Bash`, `WebSearch`, …). Each driver maps them onto its own\n * runtime: `claude-sdk` passes them through as `allowedTools` /\n * `disallowedTools`; the omp driver translates them to omp's built-in tool\n * names and passes `--tools`. A name a harness does not recognize is dropped\n * for that harness rather than failing the manifest, because the same manifest\n * is expected to run on more than one harness.\n *\n * This was previously an undeclared field that survived only because\n * {@link AgentManifestSchema} is a loose object — so `AgentManifest.tools` was\n * typed `unknown` and every consumer read it through a cast.\n *\n * @since 1.5.0\n */\nexport const AgentToolsSchema = z.looseObject({\n  /** Tool names the agent may invoke. Empty or absent means \"no allowlist\". */\n  allowed: z.array(z.string().min(1)).optional(),\n  /** Tool names the agent must not invoke. Applied after `allowed`. */\n  denied: z.array(z.string().min(1)).optional(),\n});\n\nexport type AgentTools = z.infer<typeof AgentToolsSchema>;\n\nexport const AgentManifestSchema = z.looseObject({\n  spec_version: z.string().optional(),\n  name: z.string().min(1),\n  version: z.string().optional(),\n  description: z.string().min(1),\n  extends: z.string().optional(),\n\n  model: ModelConfigSchema.optional(),\n  tools: AgentToolsSchema.optional(),\n  skills: z.array(z.string()).optional(),\n  delegation: z.looseObject({ mode: z.string() }).optional(),\n  runtime: z\n    .looseObject({\n      max_turns: z.number().optional(),\n      timeout: z.number().optional(),\n    })\n    .optional(),\n\n  author: z.string().optional(),\n  license: z.string().optional(),\n  tags: z.array(z.string()).optional(),\n  keywords: z.array(z.string()).optional(),\n\n  // v2 composition (Task 1.7)\n  composes: z.array(AgentComposeItemSchema).optional(),\n\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type AgentManifest = z.infer<typeof AgentManifestSchema>;\n\nexport function validateAgent(data: unknown): ManifestValidationResult<AgentManifest> {\n  return validateManifest(AgentManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { FieldSchema, type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const ConnectorManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  entry: z.string().min(1),\n  npm_deps: z\n    .object({\n      required: z.array(z.string()).optional(),\n      optional: z.array(z.string()).optional(),\n    })\n    .optional(),\n  fields: z.array(FieldSchema).optional(),\n  health_check: z.string().nullable().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n});\n\nexport type ConnectorManifest = z.infer<typeof ConnectorManifestSchema>;\n\nexport function validateConnector(data: unknown): ManifestValidationResult<ConnectorManifest> {\n  return validateManifest(ConnectorManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { FieldSchema, type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const MountManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  entry: z.string().min(1),\n  fields: z.array(FieldSchema).optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n});\n\nexport type MountManifest = z.infer<typeof MountManifestSchema>;\n\nexport function validateMount(data: unknown): ManifestValidationResult<MountManifest> {\n  return validateManifest(MountManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  ArtifactRefSchema,\n  CommonMetadataSchema,\n  FilePrerequisiteSchema,\n  type ManifestValidationResult,\n  UserInputSchema,\n  validateManifest,\n} from \"./_shared.js\";\n\nconst SkillMetadataSchema = CommonMetadataSchema.extend({\n  parameters: z.record(z.string(), z.unknown()).optional(),\n  artifacts: z\n    .object({\n      requires: z.array(ArtifactRefSchema).optional(),\n      produces: z.array(ArtifactRefSchema).optional(),\n      consumes: z.array(ArtifactRefSchema).optional(),\n    })\n    .optional(),\n  prerequisites: z\n    .object({\n      files: z.array(FilePrerequisiteSchema).optional(),\n      inputs_required: z.array(UserInputSchema).optional(),\n      inputs_optional: z.array(UserInputSchema).optional(),\n      // Parsed by the resolver's parseSkillRequirements; Zod would strip them otherwise.\n      reads: z.array(z.object({ path: z.string(), description: z.string().optional() })).optional(),\n      produces: z\n        .array(z.object({ path: z.string(), description: z.string().optional() }))\n        .optional(),\n      resources: z\n        .array(\n          z.object({\n            id: z.string(),\n            operations: z.array(z.string()).optional(),\n            optional: z.boolean().optional(),\n            description: z.string().optional(),\n          }),\n        )\n        .optional(),\n      connectors: z\n        .array(\n          z.object({\n            driver: z.string(),\n            access: z.enum([\"read-only\", \"read-write\"]).optional(),\n          }),\n        )\n        .optional(),\n    })\n    .optional(),\n  produces: z.array(z.object({ path: z.string(), description: z.string().optional() })).optional(),\n});\n\nexport const SkillManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  license: z.string().optional(),\n  compatibility: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  // agentskills.io standard field. Kept as `unknown` (not `string`) so a legacy\n  // array form never hard-fails validateSkill — the string-typing rule is\n  // advisory, owned by checkAgentSkillConformance (warn, not error).\n  \"allowed-tools\": z.unknown().optional(),\n\n  // Legacy fields (SKILL.md convention)\n  source: z.string().optional(),\n  user_inputs: z.array(UserInputSchema).optional(),\n  reads_from: z.array(z.string()).optional(),\n  writes_to: z.array(z.string()).optional(),\n\n  metadata: SkillMetadataSchema.optional(),\n});\n\nexport type SkillManifest = z.infer<typeof SkillManifestSchema>;\n\nexport function validateSkill(data: unknown): ManifestValidationResult<SkillManifest> {\n  return validateManifest(SkillManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const ContractManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type ContractManifest = z.infer<typeof ContractManifestSchema>;\n\nexport function validateContract(data: unknown): ManifestValidationResult<ContractManifest> {\n  return validateManifest(ContractManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const McpServerManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.union([z.string(), z.number()]).optional(),\n  // \"http\" is the runtime literal the runner honours (StreamableHTTPClientTransport);\n  // \"streamable-http\" is accepted as an MCP-spec-aligned alias and normalized to\n  // \"http\" in mcpDeclFromCatalogEntry. Keep both until the alias is retired.\n  transport: z.enum([\"stdio\", \"sse\", \"http\", \"streamable-http\"]).optional(),\n  command: z.string().optional(),\n  args: z.array(z.string()).optional(),\n  env: z.record(z.string(), z.string()).optional(),\n  url: z.string().optional(),\n  headers: z.record(z.string(), z.string()).optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  // Optional runnable payload fetched + sha256-verified by the platform\n  // session-materializer into the asset dir at materialize time (e.g. a bundled\n  // server.js shipped as a GitHub release asset). `dest` defaults to the URL\n  // basename.\n  payload: z\n    .object({\n      // https only — bare `z.string().url()` also accepts file:/data:/javascript: schemes.\n      url: z\n        .string()\n        .url()\n        .refine((u) => u.startsWith(\"https://\"), { message: \"payload url must be https\" }),\n      sha256: z.string().regex(/^[a-f0-9]{64}$/),\n      // Plain filename, no path separators — schema-level guard against a traversal dest.\n      dest: z\n        .string()\n        .regex(/^[^/\\\\]+$/, { message: \"dest must be a plain filename, not a path\" })\n        .optional(),\n    })\n    .optional(),\n});\n\nexport type McpServerManifest = z.infer<typeof McpServerManifestSchema>;\n\nexport function validateMcpServer(data: unknown): ManifestValidationResult<McpServerManifest> {\n  return validateManifest(McpServerManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const PromptManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type PromptManifest = z.infer<typeof PromptManifestSchema>;\n\nexport function validatePrompt(data: unknown): ManifestValidationResult<PromptManifest> {\n  return validateManifest(PromptManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const PersonaManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type PersonaManifest = z.infer<typeof PersonaManifestSchema>;\n\nexport function validatePersona(data: unknown): ManifestValidationResult<PersonaManifest> {\n  return validateManifest(PersonaManifestSchema, data);\n}\n","/**\n * Polymorphic Preset manifest schema.\n *\n * A Preset is the unified composition + configuration primitive. Items can be:\n * - Asset ref (plain or with inline config + placeholders)\n * - Library Instance ref (`library://tier/instances/id`)\n * - Nested Preset ref (resolved recursively, max depth 3)\n *\n * Apply semantics derive from ref type, not an explicit mode field.\n */\nimport * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\n// ---------------------------------------------------------------------------\n// Placeholder types\n// ---------------------------------------------------------------------------\n\nconst PlaceholderTypeValues = [\n  \"text\",\n  \"multiline\",\n  \"secret\",\n  \"number\",\n  \"boolean\",\n  \"enum\",\n  \"oauth\",\n  \"instance-picker\",\n] as const;\n\nexport const PlaceholderTypeSchema = z.enum(PlaceholderTypeValues);\n\nexport const PlaceholderSchema = z.object({\n  key: z.string().min(1),\n  prompt: z.string().optional(),\n  type: PlaceholderTypeSchema.optional(),\n  required: z.boolean().optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Compose item (for agents within presets)\n// ---------------------------------------------------------------------------\n\nconst ComposeRefSchema = z.object({\n  kind: z.string().min(1),\n  ref: z.string().min(1),\n});\n\n// ---------------------------------------------------------------------------\n// Preset item\n// ---------------------------------------------------------------------------\n\nexport const PresetItemSchema = z.looseObject({\n  /** Asset ref, Library Instance ref, or nested Preset ref. */\n  ref: z.string().min(1),\n  /** Local item ID for cross-item references (#item-id). */\n  id: z.string().optional(),\n  /** Author-prefilled non-secret config values. */\n  config: z.record(z.string(), z.unknown()).optional(),\n  /** User/secret values prompted at install. */\n  placeholders: z.array(PlaceholderSchema).optional(),\n  /** How placeholder values fold into the Instance config. */\n  materialize: z.record(z.string(), z.string()).optional(),\n  /** Composition for agent items. */\n  composes: z.array(ComposeRefSchema).optional(),\n  /** Outer-Preset-author-supplied placeholder values for nested Presets. */\n  inputs: z.record(z.string(), z.unknown()).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Preset-level input (rare, shared across items)\n// ---------------------------------------------------------------------------\n\nconst PresetInputSchema = z.object({\n  key: z.string().min(1),\n  type: PlaceholderTypeSchema.optional(),\n  prompt: z.string().optional(),\n  required: z.boolean().optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Source (git repo backing non-factory dependencies)\n// ---------------------------------------------------------------------------\n\n/** A `{url, pin?}` source the preset's dependencies resolve from (mirrors `SourceEntry`). */\nexport const PresetSourceSchema = z.object({\n  url: z.string().min(1),\n  pin: z.string().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Preset manifest\n// ---------------------------------------------------------------------------\n\nexport const PresetManifestSchema = z.looseObject({\n  publisher: z.string().optional(),\n  name: z.string().min(1),\n  version: z.union([z.string(), z.number()]),\n  description: z.string().min(1),\n  category: z.string().optional(),\n  license: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n\n  /** 1+ polymorphic items. */\n  items: z.array(PresetItemSchema).min(1),\n\n  /** Preset-level inputs shared across items (rare). */\n  inputs: z.array(PresetInputSchema).optional(),\n\n  /** Git sources the dependency items resolve from; `apply` registers these first. */\n  sources: z.array(PresetSourceSchema).optional(),\n});\n\nexport type PresetManifest = z.infer<typeof PresetManifestSchema>;\nexport type PresetItem = z.infer<typeof PresetItemSchema>;\nexport type PresetSource = z.infer<typeof PresetSourceSchema>;\nexport type Placeholder = z.infer<typeof PlaceholderSchema>;\n\nexport function validatePreset(data: unknown): ManifestValidationResult<PresetManifest> {\n  return validateManifest(PresetManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const RulesetManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type RulesetManifest = z.infer<typeof RulesetManifestSchema>;\n\nexport function validateRuleset(data: unknown): ManifestValidationResult<RulesetManifest> {\n  return validateManifest(RulesetManifestSchema, data);\n}\n","/**\n * Asset manifest schemas for all 11 kinds + Preset.\n *\n * Each kind exports:\n * - <Kind>ManifestSchema (zod)\n * - <Kind>Manifest (type)\n * - validate<Kind>(data) -> ManifestValidationResult\n */\n\nexport type {\n  AssetKind,\n  ManifestValidationFailure,\n  ManifestValidationResult,\n  ManifestValidationSuccess,\n} from \"./_shared.js\";\n// Shared\nexport {\n  ArtifactRefSchema,\n  AssetKindSchema,\n  AssetKindValues,\n  BaseFrontmatterSchema,\n  CommonMetadataSchema,\n  FieldSchema,\n  FilePrerequisiteSchema,\n  UserInputSchema,\n  validateManifest,\n} from \"./_shared.js\";\nexport type {\n  AgentComposeItem,\n  AgentManifest,\n  AgentTools,\n  AnthropicModelAlias,\n  AnthropicModelFamily,\n  Binding,\n  ModelIdTarget,\n} from \"./agent.js\";\nexport {\n  AgentComposeItemSchema,\n  AgentManifestSchema,\n  AgentToolsSchema,\n  ANTHROPIC_FIRST_PARTY_HOSTS,\n  ANTHROPIC_FULL_ID_PATTERN,\n  ANTHROPIC_MODEL_ALIASES,\n  ANTHROPIC_MODEL_FAMILIES,\n  BEDROCK_MODEL_ID_PATTERN,\n  BindingSchema,\n  BindingValues,\n  FreeFormModelIdSchema,\n  isFirstPartyAnthropicEndpoint,\n  ModelIdSchema,\n  modelIdSchemaForCloud,\n  modelIdSchemaForTarget,\n  ModelSelectorSchema,\n  normalizeAnthropicModel,\n  requiresAnthropicModelId,\n  validateAgent,\n  VERTEX_MODEL_ID_PATTERN,\n} from \"./agent.js\";\nexport type { ConnectorManifest } from \"./connector.js\";\nexport { ConnectorManifestSchema, validateConnector } from \"./connector.js\";\nexport type { MountManifest } from \"./mount.js\";\nexport { MountManifestSchema, validateMount } from \"./mount.js\";\nexport type { SkillManifest } from \"./skill.js\";\n// Per-kind\nexport { SkillManifestSchema, validateSkill } from \"./skill.js\";\n\n// NOTE: FlowManifestSchema, FlowManifest, validateFlow live in @skaile/workspaces/factory-assets/connectors/flow/engine.\n// Import from @skaile/workspaces/factory-assets/connectors/flow/engine directly.\n\nexport type { ContractManifest } from \"./contract.js\";\nexport { ContractManifestSchema, validateContract } from \"./contract.js\";\nexport type { McpServerManifest } from \"./mcp-server.js\";\nexport { McpServerManifestSchema, validateMcpServer } from \"./mcp-server.js\";\nexport type { PromptManifest } from \"./prompt.js\";\nexport { PromptManifestSchema, validatePrompt } from \"./prompt.js\";\n\n// NOTE: KnowledgeManifestSchema, KnowledgeManifest, validateKnowledge moved to @skaile/library in 1.7.4.\n// Import from @skaile/library directly.\n\nexport type { PersonaManifest } from \"./persona.js\";\nexport { PersonaManifestSchema, validatePersona } from \"./persona.js\";\nexport type { Placeholder, PresetItem, PresetManifest, PresetSource } from \"./preset.js\";\n// Preset (composition entity, not an asset kind)\nexport {\n  PlaceholderSchema,\n  PlaceholderTypeSchema,\n  PresetItemSchema,\n  PresetManifestSchema,\n  PresetSourceSchema,\n  validatePreset,\n} from \"./preset.js\";\nexport type { RulesetManifest } from \"./ruleset.js\";\nexport { RulesetManifestSchema, validateRuleset } from \"./ruleset.js\";\n\n// ---------------------------------------------------------------------------\n// Kind-to-validator lookup\n// ---------------------------------------------------------------------------\n\nimport type { AssetKind, ManifestValidationResult } from \"./_shared.js\";\nimport { validateAgent } from \"./agent.js\";\nimport { validateConnector } from \"./connector.js\";\nimport { validateContract } from \"./contract.js\";\nimport { validateMcpServer } from \"./mcp-server.js\";\nimport { validateMount } from \"./mount.js\";\nimport { validatePersona } from \"./persona.js\";\nimport { validatePrompt } from \"./prompt.js\";\nimport { validateRuleset } from \"./ruleset.js\";\nimport { validateSkill } from \"./skill.js\";\n\n/**\n * Validators for core kinds that still live in this package.\n * flow: lives in @skaile/workspaces/factory-assets/connectors/flow/engine\n * knowledge: lives in @skaile/library\n *\n * For kinds not in this map, use the IAssetKindRegistry from @skaile/plugins.\n */\nconst validators: Partial<Record<AssetKind, (data: unknown) => ManifestValidationResult<unknown>>> =\n  {\n    skill: validateSkill,\n    agent: validateAgent,\n    connector: validateConnector,\n    mount: validateMount,\n    contract: validateContract,\n    prompt: validatePrompt,\n    \"mcp-server\": validateMcpServer,\n    persona: validatePersona,\n    ruleset: validateRuleset,\n  };\n\n/**\n * Validate a manifest against the schema for the given asset kind.\n *\n * NOTE: flow validation lives in @skaile/workspaces/factory-assets/connectors/flow/engine. Use the\n * IAssetKindRegistry for kind-agnostic validation that includes all\n * registered providers (including extension kinds).\n */\nexport function validateByKind(kind: AssetKind, data: unknown): ManifestValidationResult<unknown> {\n  const validator = validators[kind];\n  if (!validator) {\n    return { ok: false, errors: [{ path: \"kind\", message: `Unknown asset kind: ${kind}` }] };\n  }\n  return validator(data);\n}\n"]}

package/dist/{chunk-3DZGPJU5.js → chunk-TGJIX77V.js}

@@ -1,4 +1,4 @@
-import { getProviderPreset, registryCredentialEnv, providerCredentialEnvName, BUILTIN_DRIVER_CATALOG } from './chunk-MVSF6AB4.js';
+import { getProviderPreset, registryCredentialEnv, providerCredentialEnvName, BUILTIN_DRIVER_CATALOG } from './chunk-MTWZ7KHZ.js';
 import { mergeRegistries, resolveEntryBaseUrl, normalizeEntryBaseUrl, registryEntries, isEntryEnabled, parseModelRef } from './chunk-MJHSLODD.js';
 
 // bridge/src/provider-materialize/env-drivers.ts
@@ -33,7 +33,7 @@ function isStockCatalogEndpoint(entry) {
   if (!preset) return false;
   return entryBaseUrl(entry) === normalizeEntryBaseUrl(preset.base_url, entrySurface(entry));
 }
-function backendProviderName(providerId, entry) {
+function harnessProviderName(providerId, entry) {
   const preset = entry.preset ? getProviderPreset(entry.preset) : void 0;
   if (!preset || !isStockCatalogEndpoint(entry)) return providerId;
   return preset.id;
@@ -60,7 +60,7 @@ function describeBinding(providerId, entry, modelId, providerModelId, warnings)
     ...providerModelId === void 0 ? {} : { providerModelId },
     ...surface ? { surface } : {},
     ...baseUrl ? { baseUrl } : {},
-    backendProviderId: backendProviderName(providerId, entry),
+    harnessProviderId: harnessProviderName(providerId, entry),
     warnings
   };
 }
@@ -102,10 +102,10 @@ function registryModelEntries(session) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   for (const [providerId, entry] of selectableEntries(session.registry)) {
-    const backendId = backendProviderName(providerId, entry);
+    const harnessId = harnessProviderName(providerId, entry);
     const label = entry.label ?? providerId;
     for (const [logicalId, providerModelId] of entryModelIds(entry)) {
-      const id = `${backendId}/${providerModelId}`;
+      const id = `${harnessId}/${providerModelId}`;
       if (seen.has(id)) continue;
       seen.add(id);
       out.push({ id, name: `${label} ${logicalId}` });
@@ -119,9 +119,9 @@ function bindSingleProviderEntry(driverId, productName, session) {
   assertDriverSpeaksSurface(driverId, productName, binding);
   return binding;
 }
-function backendModelSelector(binding) {
+function harnessModelSelector(binding) {
   if (!binding.providerModelId) return void 0;
-  return `${binding.backendProviderId}/${binding.providerModelId}`;
+  return `${binding.harnessProviderId}/${binding.providerModelId}`;
 }
 function continueRoleBinding(session) {
   const binding = resolveRegistryBinding(session);
@@ -129,13 +129,13 @@ function continueRoleBinding(session) {
   return {
     role: "chat",
     providerId: binding.providerId,
-    provider: binding.backendProviderId,
+    provider: binding.harnessProviderId,
     ...binding.providerModelId ? { model: binding.providerModelId } : {},
     ...binding.baseUrl ? { apiBase: versionedAnthropicBaseUrl(binding.baseUrl, binding.surface) } : {},
     apiKeyEnv: providerCredentialEnvName(binding.providerId)
   };
 }
 
-export { backendModelSelector, backendProviderName, bindSingleProviderEntry, continueRoleBinding, credentialsForEveryProvider, entryBaseUrl, entryModelIds, entrySurface, isStockCatalogEndpoint, registryModelEntries, resolveEnvDriverSession, resolveRegistryBinding, selectableEntries, versionedAnthropicBaseUrl };
-//# sourceMappingURL=chunk-3DZGPJU5.js.map
-//# sourceMappingURL=chunk-3DZGPJU5.js.map
+export { bindSingleProviderEntry, continueRoleBinding, credentialsForEveryProvider, entryBaseUrl, entryModelIds, entrySurface, harnessModelSelector, harnessProviderName, isStockCatalogEndpoint, registryModelEntries, resolveEnvDriverSession, resolveRegistryBinding, selectableEntries, versionedAnthropicBaseUrl };
+//# sourceMappingURL=chunk-TGJIX77V.js.map
+//# sourceMappingURL=chunk-TGJIX77V.js.map

package/dist/chunk-TGJIX77V.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/provider-materialize/env-drivers.ts"],"names":[],"mappings":";;;;AAyEO,SAAS,uBAAA,CACd,MAAA,EACA,UAAA,GAAiD,OAAA,CAAQ,GAAA,EACvC;AAClB,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,MAAA,CAAO,QAAA,IAAY,eAAA,CAAgB,EAAE,CAAA;AAAA,IAC/C,WAAW,EAAE,GAAG,UAAA,EAAY,GAAG,OAAO,GAAA,EAAI;AAAA,IAC1C,GAAI,OAAO,QAAA,GAAW,EAAE,UAAU,MAAA,CAAO,QAAA,KAAa,EAAC;AAAA,IACvD,GAAI,OAAO,KAAA,GAAQ,EAAE,OAAO,MAAA,CAAO,KAAA,KAAU;AAAC,GAChD;AACF;AA2BO,SAAS,aAAa,KAAA,EAA0D;AACrF,EAAA,IAAI,KAAA,CAAM,OAAA,EAAS,OAAO,KAAA,CAAM,OAAA;AAChC,EAAA,OAAO,MAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,GAAG,OAAA,GAAU,MAAA;AACnE;AAcO,SAAS,aAAa,KAAA,EAA+C;AAC1E,EAAA,MAAM,QAAA,GACJ,mBAAA,CAAoB,KAAK,CAAA,KACxB,KAAA,CAAM,SAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,CAAA,EAAG,QAAA,GAAW,MAAA,CAAA;AAC9D,EAAA,OAAO,qBAAA,CAAsB,QAAA,EAAU,YAAA,CAAa,KAAK,CAAC,CAAA;AAC5D;AASO,SAAS,yBAAA,CACd,SACA,OAAA,EACQ;AACR,EAAA,IAAI,OAAA,KAAY,sBAAsB,OAAO,OAAA;AAE7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAO,CAAA;AAC3B,IAAA,GAAA,CAAI,WAAW,CAAA,EAAG,GAAA,CAAI,SAAS,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAC,CAAA,GAAA,CAAA;AAClD,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,GAAG,OAAO,CAAA,GAAA,CAAA;AAAA,EACnB;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAoC;AACzE,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,CAAA,GAAI,MAAA;AAChE,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,OAAO,YAAA,CAAa,KAAK,CAAA,KAAM,qBAAA,CAAsB,OAAO,QAAA,EAAU,YAAA,CAAa,KAAK,CAAC,CAAA;AAC3F;AAaO,SAAS,mBAAA,CAAoB,YAAoB,KAAA,EAAmC;AACzF,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,CAAA,GAAI,MAAA;AAChE,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,sBAAA,CAAuB,KAAK,GAAG,OAAO,UAAA;AACtD,EAAA,OAAO,MAAA,CAAO,EAAA;AAChB;AAQO,SAAS,kBACd,QAAA,EACqC;AACrC,EAAA,OAAO,eAAA,CAAgB,QAAQ,CAAA,CAAE,MAAA;AAAA,IAC/B,CAAC,IAAA,KAAA,CACE,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,KAAA,IAAS,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,OAAA,KAAY,cAAA,CAAe,IAAA,CAAK,CAAC,CAAC;AAAA,GAClF;AACF;AAOO,SAAS,cAAc,KAAA,EAAoD;AAChF,EAAA,MAAM,UAAA,GAAa;AAAA,IACjB,GAAG,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,SAAA,IAAa,EAAE,CAAA;AAAA,IACpC,GAAG,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,YAAA,IAAgB,EAAE,CAAA,CAAE,MAAA,CAAO,CAAC,OAAO,EAAE,EAAA,KAAO,KAAA,CAAM,SAAA,IAAa,EAAC,CAAA,CAAG;AAAA,GAC1F;AACA,EAAA,OAAO,UAAA,CAAW,GAAA,CAAI,CAAC,EAAA,KAAO,CAAC,EAAA,EAAI,KAAA,CAAM,SAAA,GAAY,EAAE,CAAA,IAAK,EAAE,CAAC,CAAA;AACjE;AAEA,SAAS,eAAA,CACP,UAAA,EACA,KAAA,EACA,OAAA,EACA,iBACA,QAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,aAAa,KAAK,CAAA;AAClC,EAAA,MAAM,OAAA,GAAU,aAAa,KAAK,CAAA;AAClC,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,KAAA;AAAA,IACA,GAAI,OAAA,KAAY,MAAA,GAAY,EAAC,GAAI,EAAE,OAAA,EAAQ;AAAA,IAC3C,GAAI,eAAA,KAAoB,MAAA,GAAY,EAAC,GAAI,EAAE,eAAA,EAAgB;AAAA,IAC3D,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,IAC7B,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,IAC7B,iBAAA,EAAmB,mBAAA,CAAoB,UAAA,EAAY,KAAK,CAAA;AAAA,IACxD;AAAA,GACF;AACF;AAUO,SAAS,uBACd,OAAA,EACkC;AAClC,EAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,OAAA,CAAQ,QAAQ,CAAA;AAClD,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAEjC,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,EAAU,IAAA,EAAK;AACxC,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,CAAC,UAAA,EAAY,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AACrC,IAAA,OAAO,gBAAgB,UAAA,EAAY,KAAA,EAAO,MAAA,EAAW,MAAA,EAAW,EAAE,CAAA;AAAA,EACpE;AAKA,EAAA,MAAM,KAAA,GAAQ,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,QAAQ,CAAA;AACpD,EAAA,IAAI,KAAA,EAAO,OAAO,eAAA,CAAgB,KAAA,CAAM,CAAC,CAAA,EAAG,KAAA,CAAM,CAAC,CAAA,EAAG,MAAA,EAAW,MAAA,EAAW,EAAE,CAAA;AAE9E,EAAA,MAAM,WAAW,aAAA,CAAc,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAU,QAAQ,KAAK,CAAA;AACxE,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,KAAA,GAAQ,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,EAAA,KAAO,QAAA,CAAS,UAAU,CAAA;AAC/D,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,eAAA;AAAA,IACL,MAAM,CAAC,CAAA;AAAA,IACP,MAAM,CAAC,CAAA;AAAA,IACP,QAAA,CAAS,OAAA;AAAA,IACT,QAAA,CAAS,eAAA;AAAA,IACT,QAAA,CAAS;AAAA,GACX;AACF;AAQO,SAAS,4BAA4B,OAAA,EAAmD;AAC7F,EAAA,OAAO,sBAAsB,OAAA,CAAQ,QAAA,EAAU,EAAE,GAAA,EAAK,OAAA,CAAQ,WAAW,CAAA;AAC3E;AASO,SAAS,yBAAA,CACd,QAAA,EACA,WAAA,EACA,OAAA,EACM;AACN,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,QAAQ,CAAA,EAAG,QAAA;AACpD,EAAA,IAAI,CAAC,SAAA,IAAa,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG;AAC1C,EAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AACxB,EAAA,IAAI,CAAC,OAAA,IAAW,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA,EAAG;AAC7C,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,EAAG,WAAW,CAAA,mBAAA,EAAsB,OAAO,mCACrC,OAAA,CAAQ,UAAU,CAAA,GAAA,EAAM,WAAW,YAAY,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,2GAEjC,OAAO,CAAA,EAAA;AAAA,GACjD;AACF;AAYO,SAAS,qBAAqB,OAAA,EAAyC;AAC5E,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,CAAC,UAAA,EAAY,KAAK,KAAK,iBAAA,CAAkB,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACrE,IAAA,MAAM,SAAA,GAAY,mBAAA,CAAoB,UAAA,EAAY,KAAK,CAAA;AACvD,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,UAAA;AAC7B,IAAA,KAAA,MAAW,CAAC,SAAA,EAAW,eAAe,CAAA,IAAK,aAAA,CAAc,KAAK,CAAA,EAAG;AAC/D,MAAA,MAAM,EAAA,GAAK,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,eAAe,CAAA,CAAA;AAC1C,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA,EAAG;AAClB,MAAA,IAAA,CAAK,IAAI,EAAE,CAAA;AACX,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,GAAG,KAAK,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,EAAI,CAAA;AAAA,IAChD;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,uBAAA,CACd,QAAA,EACA,WAAA,EACA,OAAA,EACkC;AAClC,EAAA,MAAM,OAAA,GAAU,uBAAuB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,yBAAA,CAA0B,QAAA,EAAU,aAAa,OAAO,CAAA;AACxD,EAAA,OAAO,OAAA;AACT;AAOO,SAAS,qBAAqB,OAAA,EAAmD;AACtF,EAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,EAAiB,OAAO,MAAA;AACrC,EAAA,OAAO,CAAA,EAAG,OAAA,CAAQ,iBAAiB,CAAA,CAAA,EAAI,QAAQ,eAAe,CAAA,CAAA;AAChE;AAgCO,SAAS,oBAAoB,OAAA,EAA4D;AAC9F,EAAA,MAAM,OAAA,GAAU,uBAAuB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,YAAY,OAAA,CAAQ,UAAA;AAAA,IACpB,UAAU,OAAA,CAAQ,iBAAA;AAAA,IAClB,GAAI,QAAQ,eAAA,GAAkB,EAAE,OAAO,OAAA,CAAQ,eAAA,KAAoB,EAAC;AAAA,IACpE,GAAI,OAAA,CAAQ,OAAA,GACR,EAAE,OAAA,EAAS,yBAAA,CAA0B,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,OAAO,CAAA,EAAE,GACvE,EAAC;AAAA,IACL,SAAA,EAAW,yBAAA,CAA0B,OAAA,CAAQ,UAAU;AAAA,GACzD;AACF","file":"chunk-TGJIX77V.js","sourcesContent":["/**\n * Registry adapter for the **env-shaped CLI drivers** — Gemini, Qwen, OpenCode,\n * Goose and Continue (§2.3).\n *\n * These harnesses take their endpoint from the environment rather than from a\n * config file, so the adapter's job is three things: resolve which registry\n * entry the session's model selector names, refuse at start when that entry\n * speaks a wire surface the harness cannot, and hand the driver the\n * provider-side model id it must put on the command line.\n *\n * Two pluralities meet here (`BUILTIN_DRIVER_CATALOG.providerPlurality`):\n *\n * - `single` — Gemini and Qwen address exactly one endpoint. The bound entry\n *   supplies the credential *and* the base URL, and a surface mismatch is\n *   fatal: a Gemini CLI pointed at an `openai-completions` endpoint cannot\n *   work, and failing at start names the surface instead of leaving the user\n *   with an opaque error mid-turn.\n * - `credentials-n` — OpenCode, Goose and Continue accept every enabled\n *   entry's credential at once and select one active model. The credential\n *   fan-out is `registryCredentialEnv`; the active model is this module's\n *   `<provider>/<model>` binding.\n *\n * Writing the per-endpoint config files those three need for *custom*\n * endpoints (`opencode.json`, Goose `custom_providers/*.json`, Continue\n * `config.yaml`) is the file half, and is deliberately not here.\n *\n * @see PROVIDER-CONFIG-PLAN.md §2.3\n */\n\nimport {\n  type AIProviderLlmEntry,\n  type AIProviderSurface,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  mergeRegistries,\n  normalizeEntryBaseUrl,\n  parseModelRef,\n  registryEntries,\n  resolveEntryBaseUrl,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type { ModelEntry } from \"../models.js\";\nimport { getProviderPreset } from \"../provider-catalog.js\";\nimport { BUILTIN_DRIVER_CATALOG } from \"../registry.js\";\nimport type { AgentConfig } from \"../types.js\";\nimport { providerCredentialEnvName, registryCredentialEnv } from \"./credential-env.js\";\n\n/**\n * Everything a CLI driver needs to know about this session's AI providers,\n * resolved once from its {@link AgentConfig}.\n */\nexport interface EnvDriverSession {\n  /** The merged registry this session may address. Empty when none was configured. */\n  registry: MergedAIProviderRegistry;\n  /**\n   * Environment `credential.ref` lookups resolve against — the process\n   * environment widened with `config.env`, which is where the session\n   * boundary delivered every resolved `SKAILE_AIP_<ID>_KEY`.\n   */\n  lookupEnv: Record<string, string | undefined>;\n  /** Model selector: `<providerId>/<modelId>`, a bare id, or `@role`. */\n  modelRef?: string;\n  /** Roles table an `@role` selector resolves through. */\n  roles?: Record<string, string>;\n}\n\n/**\n * Resolve the session's providers once, from its {@link AgentConfig}.\n *\n * `config.env` is folded into `lookupEnv` rather than kept apart: it is part\n * of the session's environment, not an extra, and a credential or\n * `*_BASE_URL` delivered there must be visible exactly as the child will see\n * it.\n */\nexport function resolveEnvDriverSession(\n  config: AgentConfig,\n  processEnv: Record<string, string | undefined> = process.env,\n): EnvDriverSession {\n  return {\n    registry: config.registry ?? mergeRegistries([]),\n    lookupEnv: { ...processEnv, ...config.env },\n    ...(config.modelRef ? { modelRef: config.modelRef } : {}),\n    ...(config.roles ? { roles: config.roles } : {}),\n  };\n}\n\n/** One resolved endpoint + model — everything a driver needs to spawn. */\nexport interface RegistryModelBinding {\n  /** Registry id of the selected entry. */\n  providerId: string;\n  /** The selected entry itself. */\n  entry: AIProviderLlmEntry;\n  /** Logical model id, after `@role` expansion and before `model_map`. */\n  modelId?: string;\n  /** Provider-side model id — what goes on the wire / command line. */\n  providerModelId?: string;\n  /** Wire protocol, from the entry or its preset. */\n  surface?: AIProviderSurface;\n  /** Resolved endpoint, from the entry, its transport params, or its preset. */\n  baseUrl?: string;\n  /**\n   * The provider name the *harness* knows this endpoint by — a catalog preset\n   * id for a stock endpoint, the registry id for anything custom. See\n   * {@link harnessProviderName}.\n   */\n  harnessProviderId: string;\n  /** Non-fatal notes from `parseModelRef` (dangling role, disabled provider). */\n  warnings: string[];\n}\n\n/** The entry's wire surface: its own, else its preset's. */\nexport function entrySurface(entry: AIProviderLlmEntry): AIProviderSurface | undefined {\n  if (entry.surface) return entry.surface;\n  return entry.preset ? getProviderPreset(entry.preset)?.surface : undefined;\n}\n\n/**\n * The entry's endpoint: its literal or transport-derived URL, else its\n * preset's literal, in the canonical spelling for its surface\n * (`normalizeEntryBaseUrl`: an `anthropic-messages` endpoint is its host root,\n * so `https://api.anthropic.com/v1` reads as `https://api.anthropic.com`).\n * Transport templates that still carry `{param}` placeholders never come\n * back — `resolveEntryBaseUrl` withholds those, and a preset's template is not\n * a URL.\n *\n * Every adapter reads the endpoint here and only re-spells it for a client\n * that wants something else ({@link versionedAnthropicBaseUrl}).\n */\nexport function entryBaseUrl(entry: AIProviderLlmEntry): string | undefined {\n  const resolved =\n    resolveEntryBaseUrl(entry) ??\n    (entry.preset ? getProviderPreset(entry.preset)?.base_url : undefined);\n  return normalizeEntryBaseUrl(resolved, entrySurface(entry));\n}\n\n/**\n * An `anthropic-messages` endpoint spelled for a client that appends only\n * `/messages` — `@ai-sdk/anthropic` (OpenCode) and Continue — rather than\n * `/v1/messages` like the Claude CLI, the Anthropic SDK and Goose. `baseUrl`\n * must already be canonical ({@link entryBaseUrl}); every other surface passes\n * through unchanged.\n */\nexport function versionedAnthropicBaseUrl(\n  baseUrl: string,\n  surface: AIProviderSurface | undefined,\n): string {\n  if (surface !== \"anthropic-messages\") return baseUrl;\n  // Append to the path, not the string: a query or fragment stays at the end.\n  try {\n    const url = new URL(baseUrl);\n    url.pathname = `${url.pathname.replace(/\\/+$/, \"\")}/v1`;\n    return url.toString();\n  } catch {\n    return `${baseUrl}/v1`;\n  }\n}\n\n/**\n * True when a `credentials-n` harness already knows this endpoint under its\n * own catalog name — the entry names a preset and did not move it somewhere\n * else. Both sides are compared canonically, so `https://api.anthropic.com/v1`\n * is still the `anthropic` preset's endpoint.\n *\n * The one rule both halves of §2.3 read: it decides the name the env half\n * puts on the command line ({@link harnessProviderName}) *and* whether the\n * file half has to describe the endpoint at all. Reading it twice is what\n * keeps `-m <name>/<model>` and the generated provider file talking about the\n * same thing.\n */\nexport function isStockCatalogEndpoint(entry: AIProviderLlmEntry): boolean {\n  const preset = entry.preset ? getProviderPreset(entry.preset) : undefined;\n  if (!preset) return false;\n  return entryBaseUrl(entry) === normalizeEntryBaseUrl(preset.base_url, entrySurface(entry));\n}\n\n/**\n * The provider name to give a `credentials-n` harness (`-m <name>/<model>`,\n * `GOOSE_PROVIDER`).\n *\n * A stock catalog endpoint is named by its preset, because that is the name\n * OpenCode's models.dev list and Goose's built-in provider table already use —\n * `prod-claude: {preset: anthropic}` is still Anthropic to them. An entry with\n * an endpoint of its own is named by its registry id: no built-in table knows\n * it, so the id is what its generated provider file is keyed by (the file half\n * of §2.3).\n */\nexport function harnessProviderName(providerId: string, entry: AIProviderLlmEntry): string {\n  const preset = entry.preset ? getProviderPreset(entry.preset) : undefined;\n  if (!preset || !isStockCatalogEndpoint(entry)) return providerId;\n  return preset.id;\n}\n\n/**\n * Enabled `llm`/`embed` entries, in registry order. Also the set the file\n * adapters render (`opencode-config.ts`, `goose-custom-providers.ts`,\n * `continue-config-yaml.ts`): the env half and the file half must agree on\n * which entries exist before they can agree on what to call them.\n */\nexport function selectableEntries(\n  registry: MergedAIProviderRegistry,\n): Array<[string, AIProviderLlmEntry]> {\n  return registryEntries(registry).filter(\n    (pair): pair is [string, AIProviderLlmEntry] =>\n      (pair[1].kind === \"llm\" || pair[1].kind === \"embed\") && isEntryEnabled(pair[1]),\n  );\n}\n\n/**\n * The provider-side model ids an entry declares, as `[logicalId, providerId]`\n * pairs in declaration order: every `model_map` entry, plus every\n * `capabilities` key the map does not rename.\n */\nexport function entryModelIds(entry: AIProviderLlmEntry): Array<[string, string]> {\n  const logicalIds = [\n    ...Object.keys(entry.model_map ?? {}),\n    ...Object.keys(entry.capabilities ?? {}).filter((id) => !(id in (entry.model_map ?? {}))),\n  ];\n  return logicalIds.map((id) => [id, entry.model_map?.[id] ?? id]);\n}\n\nfunction describeBinding(\n  providerId: string,\n  entry: AIProviderLlmEntry,\n  modelId: string | undefined,\n  providerModelId: string | undefined,\n  warnings: string[],\n): RegistryModelBinding {\n  const surface = entrySurface(entry);\n  const baseUrl = entryBaseUrl(entry);\n  return {\n    providerId,\n    entry,\n    ...(modelId === undefined ? {} : { modelId }),\n    ...(providerModelId === undefined ? {} : { providerModelId }),\n    ...(surface ? { surface } : {}),\n    ...(baseUrl ? { baseUrl } : {}),\n    harnessProviderId: harnessProviderName(providerId, entry),\n    warnings,\n  };\n}\n\n/**\n * Resolve the session's endpoint + model.\n *\n * With no selector the first entry in registry order wins and the harness\n * keeps its own default model — exactly what an absent `model` meant before\n * the registry existed. Returns `undefined` when no entry can serve a model\n * (an empty, fully-disabled or voice-only registry).\n */\nexport function resolveRegistryBinding(\n  session: EnvDriverSession,\n): RegistryModelBinding | undefined {\n  const entries = selectableEntries(session.registry);\n  if (entries.length === 0) return undefined;\n\n  const selector = session.modelRef?.trim();\n  if (!selector) {\n    const [providerId, entry] = entries[0];\n    return describeBinding(providerId, entry, undefined, undefined, []);\n  }\n\n  // A selector that is exactly an entry id names the endpoint and nothing\n  // else: the harness keeps its own default model. `parseModelRef` would read\n  // it as a bare *model* id and fall back to registry order.\n  const named = entries.find(([id]) => id === selector);\n  if (named) return describeBinding(named[0], named[1], undefined, undefined, []);\n\n  const resolved = parseModelRef(selector, session.registry, session.roles);\n  if (!resolved) return undefined;\n  const match = entries.find(([id]) => id === resolved.providerId);\n  if (!match) return undefined;\n  return describeBinding(\n    match[0],\n    match[1],\n    resolved.modelId,\n    resolved.providerModelId,\n    resolved.warnings,\n  );\n}\n\n/**\n * Every credential a `credentials-n` harness may use: one variable per\n * enabled registry entry. OpenCode, Goose and Continue have always received\n * *all* of them, not just the selected endpoint's, because they route across\n * providers inside a single session.\n */\nexport function credentialsForEveryProvider(session: EnvDriverSession): Record<string, string> {\n  return registryCredentialEnv(session.registry, { env: session.lookupEnv });\n}\n\n/**\n * Throw when the bound entry speaks a wire surface this driver cannot.\n *\n * The message names the offending surface and lists the ones the harness does\n * speak (`BUILTIN_DRIVER_CATALOG[driverId].surfaces`). An entry that declares\n * no surface and names no preset is not judged — there is nothing to compare.\n */\nexport function assertDriverSpeaksSurface(\n  driverId: string,\n  productName: string,\n  binding: RegistryModelBinding,\n): void {\n  const supported = BUILTIN_DRIVER_CATALOG[driverId]?.surfaces;\n  if (!supported || supported.length === 0) return;\n  const surface = binding.surface;\n  if (!surface || supported.includes(surface)) return;\n  throw new Error(\n    `${productName} cannot speak the '${surface}' surface of AI provider entry ` +\n      `'${binding.providerId}'. ${productName} speaks: ${supported.join(\", \")}. ` +\n      `Point this session's model at an entry with one of those surfaces, ` +\n      `or run it on a driver that speaks '${surface}'.`,\n  );\n}\n\n/**\n * The models a `credentials-n` harness can be pointed at, straight from the\n * registry: every enabled entry's mapped ids, namespaced the way the harness\n * takes them (`-m <provider>/<model>`).\n *\n * These harnesses have no model-list endpoint of their own — OpenCode reads\n * models.dev, Goose and Continue read their config — so the registry is the\n * only list that describes *this* session's reachable models, and it needs no\n * network call to produce.\n */\nexport function registryModelEntries(session: EnvDriverSession): ModelEntry[] {\n  const out: ModelEntry[] = [];\n  const seen = new Set<string>();\n  for (const [providerId, entry] of selectableEntries(session.registry)) {\n    const harnessId = harnessProviderName(providerId, entry);\n    const label = entry.label ?? providerId;\n    for (const [logicalId, providerModelId] of entryModelIds(entry)) {\n      const id = `${harnessId}/${providerModelId}`;\n      if (seen.has(id)) continue;\n      seen.add(id);\n      out.push({ id, name: `${label} ${logicalId}` });\n    }\n  }\n  return out;\n}\n\n/**\n * Resolve the binding and enforce the surface — what a `single`-plurality\n * driver does at start.\n *\n * The registry is authoritative: pointing the driver at an entry it cannot\n * speak throws rather than silently running somewhere else. `undefined` when\n * the session configured no endpoint at all, which leaves the driver on its\n * own native auth.\n */\nexport function bindSingleProviderEntry(\n  driverId: string,\n  productName: string,\n  session: EnvDriverSession,\n): RegistryModelBinding | undefined {\n  const binding = resolveRegistryBinding(session);\n  if (!binding) return undefined;\n  assertDriverSpeaksSurface(driverId, productName, binding);\n  return binding;\n}\n\n/**\n * The `<provider>/<model>` selector a `credentials-n` harness takes on its\n * command line (`opencode -m`). `undefined` when no model was selected — the\n * harness then uses its own default rather than being handed a bare provider.\n */\nexport function harnessModelSelector(binding: RegistryModelBinding): string | undefined {\n  if (!binding.providerModelId) return undefined;\n  return `${binding.harnessProviderId}/${binding.providerModelId}`;\n}\n\n/**\n * Continue's model selection is a **role binding**, not a flag: `cn` has no\n * `--model` option (only `--config <slug>`), and its `config.yaml` binds each\n * model to roles (`chat`, `edit`, `apply`, …). This is the binding for the\n * role a headless `cn -p` turn runs as, and the shape its generated\n * `config.yaml` is rendered from.\n *\n * `apiKeyEnv` is a variable *name*: the secret travels in the child\n * environment, never in a rendered config.\n */\nexport interface ContinueRoleBinding {\n  /** Continue role this model serves. A headless prompt is a `chat` turn. */\n  role: \"chat\";\n  /** Registry id of the entry. */\n  providerId: string;\n  /** Provider name Continue knows the endpoint by. */\n  provider: string;\n  /** Provider-side model id. */\n  model?: string;\n  /** Endpoint, when the entry states one, spelled the way Continue's `apiBase` wants it. */\n  apiBase?: string;\n  /** Env var holding the credential — the name, never the value. */\n  apiKeyEnv: string;\n}\n\n/**\n * Map the session's chosen endpoint onto the Continue role a headless turn\n * runs as. `undefined` when the session configured no endpoint — `cn` then\n * runs against whatever its own `config.yaml` / Hub login provides.\n */\nexport function continueRoleBinding(session: EnvDriverSession): ContinueRoleBinding | undefined {\n  const binding = resolveRegistryBinding(session);\n  if (!binding) return undefined;\n  return {\n    role: \"chat\",\n    providerId: binding.providerId,\n    provider: binding.harnessProviderId,\n    ...(binding.providerModelId ? { model: binding.providerModelId } : {}),\n    ...(binding.baseUrl\n      ? { apiBase: versionedAnthropicBaseUrl(binding.baseUrl, binding.surface) }\n      : {}),\n    apiKeyEnv: providerCredentialEnvName(binding.providerId),\n  };\n}\n"]}

package/dist/{chunk-XVGB3K4B.js → chunk-TTITGVXV.js}

@@ -1,4 +1,4 @@
-import { declaresActivityLabel, stripActivityLabel } from './chunk-34ZVTPDV.js';
+import { declaresActivityLabel, stripActivityLabel } from './chunk-JS7DCCDA.js';
 import { randomUUID } from 'crypto';
 
 async function dispatchCapability(hooks, name, input, onBackgroundError = () => {
@@ -52,5 +52,5 @@ function filterRenderCapabilities(caps) {
 }
 
 export { dispatchCapability, filterRenderCapabilities, renderFallback };
-//# sourceMappingURL=chunk-XVGB3K4B.js.map
-//# sourceMappingURL=chunk-XVGB3K4B.js.map
+//# sourceMappingURL=chunk-TTITGVXV.js.map
+//# sourceMappingURL=chunk-TTITGVXV.js.map