@skaile/workspaces 4.37.0 → 4.38.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaile/workspaces",
-  "version": "4.37.0",
+  "version": "4.38.0",
   "description": "Skaile workspaces runtime — types, core, bridge, runner, store, connectors, and supporting layers as one publishable package",
   "type": "module",
   "packageManager": "bun@1.3.9",

package/dist/asset-feeds-KTRFFJYM.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../cli/src/asset-feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqFA,SAAS,QAAQ,CAAA,EAAmB;AAClC,EAAA,OAAO,CAAA,CAAE,KAAA,CAAW,IAAA,CAAA,GAAG,CAAA,CAAE,KAAK,GAAG,CAAA;AACnC;AAGA,eAAe,cAAc,IAAA,EAAmC;AAC9D,EAAA,MAAM,MAAkB,EAAC;AACzB,EAAA,WAAA,MAAiB,EAAE,IAAA,EAAM,QAAA,EAAU,MAAK,IAAK,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC1D,IAAA,IAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,iBAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAChE,MAAA,GAAA,CAAI,IAAA,CAAK,cAAc,OAAA,CAAa,IAAA,CAAA,QAAA,CAAS,MAAM,QAAQ,CAAC,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,IACtE,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACX;AACA,EAAA,OAAO,GAAA;AACT;AAcA,eAAe,YAAA,CACb,IAAA,EACA,YAAA,EACA,OAAA,EACA,qBAAqB,IAAA,EACK;AAC1B,EAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,IAAI,CAAA;AAC1C,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,IAC1C,KAAA;AAAA,IACA,KAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAAA,IAChC,cAAc,OAAA,CAAa,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,KAAA,CAAM,MAAM,CAAC;AAAA,GACzD,CAAE,CAAA;AAEF,EAAA,IAAI,YAAA,GAAe,KAAA;AACnB,EAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,IAAA,MAAM,IAAA,GAAO,YAAA,CAAa,CAAA,CAAE,YAAA,EAAc,SAAS,CAAA;AACnD,IAAA,IAAI,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,SAAA,IACtB,kBAAA,EAAoB;AAC3B,MAAA,CAAA,CAAE,MAAM,UAAA,GAAa,YAAA;AACrB,MAAA,YAAA,GAAe,IAAA;AAAA,IACjB,CAAA,MAAO,CAAA,CAAE,KAAA,CAAM,UAAA,GAAa,EAAA;AAAA,EAC9B;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACzD,EAAA,MAAM,UAA2B,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,IAChE,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,GAAI,EAAE,WAAA,GAAc,EAAE,aAAa,CAAA,CAAE,WAAA,KAAgB,EAAC;AAAA,IACtD,GAAI,EAAE,QAAA,GAAW,EAAE,UAAU,CAAA,CAAE,QAAA,KAAa,EAAC;AAAA,IAC7C,GAAI,EAAE,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,IAClD,GAAI,CAAA,CAAE,WAAA,CAAY,CAAC,CAAA,GAAI,EAAE,cAAA,EAAgB,CAAA,CAAE,WAAA,CAAY,CAAC,CAAA,EAAE,GAAI;AAAC,GACjE,CAAE,CAAA;AACF,EAAA,IAAI,YAAA,UAAsB,IAAA,CAAK,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,cAAc,CAAA;AAC1E,EAAA,OAAO,OAAA;AACT;AAUA,eAAe,aAAA,GAIZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,MAAM,UAA2B,EAAC;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,EAAE,kBAAA,EAAmB,EAAG,EAAE,aAAA,EAAc,EAAG,EAAE,iBAAA,EAAmB,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,MAC3F,OAAO,4BAAmB,CAAA;AAAA,MAC1B,OAAO,oBAA4B,CAAA;AAAA,MACnC,OAAO,iBAAyB;AAAA,KACjC,CAAA;AACD,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,IAAA,IAAI;AAIF,MAAA,MAAM,UAAU,iBAAA,EAAkB;AAClC,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,aAAA,EAAc,EAAG,SAAS,CAAA;AACvD,MAAA,MAAM,IAAA,GAAA,CAAQ,MAAM,OAAA,CAAQ,aAAA,EAAc,EAAG,MAAA;AAAA,QAC3C,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA,IAAK,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,UAAU;AAAA,OACrE;AACA,MAAA,MAAM,UAAyB,EAAC;AAChC,MAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,QAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAI3B,QAAA,MAAM,UAAA,GAAa,CAAC,GAAI,MAAM,SAAS,GAAA,CAAI,IAAA,EAAM,GAAA,CAAI,IAAI,CAAE,CAAA;AAC3D,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAI,MAAM,YAAA,CAAa,GAAA,CAAI,MAAM,GAAA,CAAI,IAAA,EAAM,UAAA,EAAY,KAAK,CAAE,CAAA;AAC3E,QAAA,KAAA,MAAW,KAAA,IAAS,UAAA,EAAY,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,MAC5F;AACA,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,IACnC,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,SAAS,KAAA,EAAM;AAAA,EACvC;AACF;AAYA,eAAe,YAAY,UAAA,EAIxB;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACjE,IAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,MAAM,oBAAA,CAAqB,EAAE,YAAY,CAAA;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,MAAA,MAAM,OAAA,GAA0B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,IAAA,EAAO,EAAE,IAAA,IAAsB,OAAA;AAAA,QAC/B,WAAA,EAAa,EAAE,WAAA,IAAe,EAAA;AAAA,QAC9B,MAAA,EAAQ,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,CAAA;AAAA,QACvB,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,YAAY,CAAA,CAAE,UAAA;AAAA,QACd,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OACjB,CAAE,CAAA;AAIF,MAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,MAAM,CAAA;AACxC,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,IACnC,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG3D,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAK,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,IAAI,OAAA,EAAS,IAAI,KAAA,EAAM;AAAA,EAC3C;AACF;AAGA,eAAe,YAAY,MAAA,EAA2C;AACpE,EAAA,MAAM,KAAM,MAAA,CAA4D,WAAA;AACxE,EAAA,IAAI,OAAO,EAAA,KAAO,UAAA,EAAY,OAAO,EAAC;AACtC,EAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,IAAA,CAAK,MAAM,CAAA;AACpC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,UAAU,EAAC;AAC7C;AAcA,eAAe,aACb,EAAA,EAC+D;AAI/D,EAAA,MAAM,eAAA,GAAkB,iBAAA,EAAkB,CAAE,GAAA,CAAI,CAAC,CAAA,KAAO,CAAA,CAAE,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,CAAA,GAAI,CAAA,GAAS,IAAA,CAAA,GAAI,CAAA;AAChG,EAAA,MAAM,gBAAgB,CAAC,CAAA,KACrB,eAAA,CAAgB,IAAA,CAAK,CAAC,EAAA,KAAO,CAAA,KAAM,EAAA,CAAG,KAAA,CAAM,GAAG,EAAE,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,EAAE,CAAC,CAAA;AAExE,EAAA,MAAM,GAAA,GAAA,CAAO,MAAM,EAAA,CAAG,MAAA,EAAO,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AACtE,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,UAA2B,EAAC;AAMlC,EAAA,KAAA,MAAW,EAAE,QAAA,EAAU,IAAA,EAAK,IAAK,EAAA,CAAG,iBAAgB,EAAG;AACrD,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACzB,IAAA,MAAM,SAAS,IAAA,CAAK,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,OAAO,IAAA,GAAY,IAAA,CAAA,GAAA;AAC5D,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,IAAA,IAAQ,CAAA,CAAE,MAAA,CAAO,UAAA,CAAW,MAAM,CAAC,CAAA;AAChF,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACxB,IAAA,MAAM,aAAa,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,QAAA;AAGhD,IAAA,OAAA,CAAQ,IAAA,CAAK,GAAI,MAAM,YAAA,CAAa,MAAM,UAAA,EAAY,KAAA,EAAO,KAAK,CAAE,CAAA;AACpE,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,EAAE,QAAQ,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,EAAE,SAAS,OAAA,EAAQ;AAC5B;AAUA,eAAe,aAAA,GAIZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,MAAM,UAA2B,EAAC;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,IAAA,IAAQ,mBAAkB,EAAG;AACtC,MAAA,MAAM,cAAc,CAAC,GAAI,MAAM,QAAA,CAAS,IAAA,EAAM,gBAAgB,CAAE,CAAA;AAChE,MAAA,OAAA,CAAQ,KAAK,GAAI,MAAM,aAAa,IAAA,EAAM,gBAAA,EAAkB,WAAW,CAAE,CAAA;AACzE,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,WAAW,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,EACnC,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,SAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,SAAS,KAAA,EAAM;AAAA,EACvC;AACF;AAGA,SAAS,GAAA,CAAI,QAAqB,OAAA,EAAwC;AACxE,EAAA,OAAO,QAAQ,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAM,CAAE,CAAA;AACnD;AASA,eAAsB,gBAAA,CACpB,IACA,UAAA,EAC0B;AAC1B,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,aAAA,EAAc,EAAG,WAAA,CAAY,UAAU,CAAC,CAAC,CAAA;AAClF,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,EAAc;AACpC,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,EAAE,CAAA;AACjC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP,GAAG,GAAA,CAAI,OAAA;AAAA,MACP,GAAG,IAAA,CAAK,OAAA;AAAA,MACR,GAAG,GAAA,CAAI,SAAA,EAAW,OAAA,CAAQ,OAAO,CAAA;AAAA,MACjC,GAAG,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,OAAO;AAAA,KAC/B;AAAA;AAAA;AAAA,IAGA,OAAA,EAAS,YAAA,CAAa,CAAC,GAAG,MAAM,OAAA,EAAS,GAAG,GAAA,CAAI,OAAA,EAAS,GAAG,IAAA,CAAK,OAAA,EAAS,GAAG,OAAA,CAAQ,OAAO,CAAC,CAAA;AAAA,IAC7F,KAAA,EAAO,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,GAAG,KAAA,CAAM,KAAA,EAAO,GAAG,OAAA,CAAQ,KAAK;AAAA,GACzD;AACF;AAGA,SAAS,aAAa,OAAA,EAA2C;AAC/D,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAA,EAAG;AACtB,IAAA,IAAA,CAAK,GAAA,CAAI,EAAE,IAAI,CAAA;AACf,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,OAAO,GAAA;AACT","file":"asset-feeds-KTRFFJYM.js","sourcesContent":["/**\n * asset-feeds.ts — gather installable assets from every feed the manage TUI\n * surfaces.\n *\n * Four feeds, normalized into `CatalogEntry`:\n * - **Project sources** — `skaile.yaml` `sources:` entries (scanned via\n *   `AssetManager.search()`; the new `sources:` field is merged into the\n *   legacy repositories map in `AssetManager.loadConfig`).\n * - **Local libraries** — user authoring places from `LocalIndex` (filesystem\n *   scan of each library's `path`).\n * - **Factory assets** — the bundled first-party `factory-assets` tree\n *   (`factoryAssetRoots()`), scanned from disk. Always present; no network.\n * - **Remote store** — the configured catalog source when `catalog.url` is\n *   not `local`. Failures are non-fatal — they surface as notes.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  type AssetKind,\n  type CatalogDomain,\n  type CatalogEntry,\n  factoryAssetRoots,\n  parseFrontmatter,\n  scanRepo,\n  walkDir,\n} from \"@skaile/workspaces/core\";\nimport {\n  assignDomain,\n  buildDomainIndex,\n  DOMAIN_MD_FILENAME,\n  type DomainMd,\n  parseDomainMd,\n} from \"@skaile/workspaces/discovery\";\n\n/** One non-fatal note returned to the caller for surfacing in the UI. */\nexport interface FeedNote {\n  feed: \"sources\" | \"libraries\" | \"store\" | \"factory\";\n  message: string;\n}\n\n/**\n * Which feed an asset came from. This is the top-level grouping axis in the\n * manage TUI (\"where is this skill coming from?\") and is intentionally distinct\n * from `publisher` (asset-intrinsic identity): the same publisher can legitimately\n * appear under more than one origin (e.g. a github repo you added as a `source`\n * that is also listed in the remote `store`).\n */\nexport type AssetOrigin = \"source\" | \"library\" | \"factory\" | \"store\";\n\n/** A catalog entry tagged with the feed it was gathered from. */\nexport interface OriginEntry {\n  origin: AssetOrigin;\n  entry: CatalogEntry;\n  /**\n   * Second-level grouping label for the manage tree. Defaults (when unset) to the\n   * entry's `publisher`; the source feed sets it to the source's short repo name\n   * so the Sources band groups by source — \"which repo did this come from\" — not\n   * by the asset-intrinsic publisher.\n   */\n  group?: string;\n}\n\nexport interface AssetFeedResult {\n  entries: OriginEntry[];\n  /**\n   * Display-only domain metadata, keyed (by the consumer) on `slug`. Populated\n   * from the store's `catalog.listDomains` when the connected catalog source\n   * exposes it; empty otherwise. The manage TUI joins `entry.domainSlug` → a\n   * domain for grouping headers, descriptions, and relation badges.\n   */\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}\n\n// ── Domain stamping (on-disk feeds) ──────────────────────────────────────────\n//\n// `scanRepo` (the source / library / factory scan path) does not read the\n// `DOMAIN.md` sidecars, so its entries arrive with no `domainSlug` and render\n// flat under their publisher band. We re-derive the grouping here from the\n// root's `DOMAIN.md` files (the same sidecars the remote store computes\n// server-side), and fall back to the repo/source name for any entry no domain\n// claims so it still groups instead of landing in the synthetic \"no domain\" pile.\n\n/** Repo-relative POSIX path (DOMAIN.md slugs are matched whole-segment, `/`-joined). */\nfunction toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** Parse every `DOMAIN.md` sidecar under `root` into a {@link DomainMd}. */\nasync function loadDomainMds(root: string): Promise<DomainMd[]> {\n  const out: DomainMd[] = [];\n  for await (const { path: filePath, name } of walkDir(root)) {\n    if (name !== DOMAIN_MD_FILENAME) continue;\n    try {\n      const { data } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n      out.push(parseDomainMd(toPosix(path.relative(root, filePath)), data));\n    } catch {}\n  }\n  return out;\n}\n\n/**\n * Stamp `domainSlug` onto every entry scanned from `root` using the root's\n * `DOMAIN.md` sidecars. Returns the `CatalogDomain` registry for the real\n * domains, plus a synthetic fallback domain when any entry used the fallback.\n * Mutates `entries` in place (sets `entry.domainSlug`).\n *\n * `synthesizeFallback` (default true): entries no domain claims fall back to\n * `fallbackSlug` (the repo/source name). Pass `false` when the caller already\n * groups these entries one level up (e.g. the source feed groups by source\n * node) — unmatched entries then get no domain (`\"\"`) and hang directly under\n * that parent, instead of nesting under a same-named fallback domain.\n */\nasync function stampDomains(\n  root: string,\n  fallbackSlug: string,\n  entries: CatalogEntry[],\n  synthesizeFallback = true,\n): Promise<CatalogDomain[]> {\n  const domainMds = await loadDomainMds(root);\n  const assignables = entries.map((entry) => ({\n    entry,\n    ref: `${entry.kind}:${entry.name}`,\n    relativePath: toPosix(path.relative(root, entry.source)),\n  }));\n\n  let usedFallback = false;\n  for (const a of assignables) {\n    const slug = assignDomain(a.relativePath, domainMds);\n    if (slug) a.entry.domainSlug = slug;\n    else if (synthesizeFallback) {\n      a.entry.domainSlug = fallbackSlug;\n      usedFallback = true;\n    } else a.entry.domainSlug = \"\";\n  }\n\n  const { index } = buildDomainIndex(assignables, domainMds);\n  const catalog: CatalogDomain[] = Object.values(index).map((d) => ({\n    slug: d.slug,\n    title: d.title,\n    ...(d.description ? { description: d.description } : {}),\n    ...(d.relation ? { relation: d.relation } : {}),\n    ...(d.order !== undefined ? { order: d.order } : {}),\n    ...(d.recommended[0] ? { recommendedRef: d.recommended[0] } : {}),\n  }));\n  if (usedFallback) catalog.push({ slug: fallbackSlug, title: fallbackSlug });\n  return catalog;\n}\n\n/**\n * Pull assets from local libraries (the authoring places under\n * `~/.skaile/libraries/<name>/`, not the `~/.skaile/cache/sources/` cache). Each\n * library's `path` is scanned with `scanRepo` and grouped under the bare library\n * name (`group: <name>`) so the manage TUI shows a clean `<name>` band — no\n * `library:` prefix and no redundant same-named fallback domain (mirrors the\n * source feed).\n */\nasync function libraryAssets(): Promise<{\n  entries: OriginEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  const domains: CatalogDomain[] = [];\n  try {\n    const [{ openLibraryManager }, { skaileHomeDir }, { getGlobalCacheDir }] = await Promise.all([\n      import(\"./open-library.ts\"),\n      import(\"@skaile/workspaces/library\"),\n      import(\"@skaile/workspaces/core\"),\n    ]);\n    const { manager, close } = await openLibraryManager();\n    try {\n      // Authoring libraries are the rows that are NOT source clones. index.db\n      // rows predating the cache migration still carry the legacy\n      // ~/.skaile/sources path, so exclude both roots.\n      const newRoot = getGlobalCacheDir();\n      const legacyRoot = path.join(skaileHomeDir(), \"sources\");\n      const libs = (await manager.listLibraries()).filter(\n        (l) => !l.path.startsWith(newRoot) && !l.path.startsWith(legacyRoot),\n      );\n      const entries: OriginEntry[] = [];\n      for (const lib of libs) {\n        if (!existsSync(lib.path)) continue;\n        // Scan + group under the bare library name. `synthesizeFallback: false`\n        // (as the source feed does) keeps domainless assets directly under the\n        // library band instead of a redundant same-named fallback domain.\n        const libEntries = [...(await scanRepo(lib.path, lib.name))];\n        domains.push(...(await stampDomains(lib.path, lib.name, libEntries, false)));\n        for (const entry of libEntries) entries.push({ origin: \"library\", entry, group: lib.name });\n      }\n      return { entries, domains, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    notes.push({\n      feed: \"libraries\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], domains, notes };\n  }\n}\n\n/**\n * Pull a (best-effort) snapshot of the connected remote store catalog.\n *\n * - Returns no entries when the resolved catalog is local-only or the host\n *   is unreachable (the failure becomes a note, not an exception).\n * - Maps `CatalogAsset` → `CatalogEntry`, carrying `publisher`, `repo`, and\n *   `category` straight through and using `source = \"store://<id>\"`; per-file\n *   `source` paths are not available for remote assets so the canonical ref is\n *   a stable placeholder.\n */\nasync function storeAssets(projectDir: string): Promise<{\n  entries: CatalogEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { resolveCatalogSource } = await import(\"./open-library.ts\");\n    const { source, close } = await resolveCatalogSource({ projectDir });\n    try {\n      const assets = await source.listAssets();\n      const entries: CatalogEntry[] = assets.map((a) => ({\n        name: a.name,\n        kind: (a.kind as AssetKind) ?? \"skill\",\n        description: a.description ?? \"\",\n        source: `store://${a.id}`,\n        publisher: a.publisher,\n        repo: a.repo,\n        domainSlug: a.domainSlug,\n        category: a.category,\n        version: a.version,\n        requires: [],\n        dependencies: [],\n      }));\n      // Domains are optional on the catalog source — only the store backend\n      // (post Part 4 `catalog.listDomains`) exposes them. Duck-type the call so\n      // older sources and the local catalog degrade to no domains, not an error.\n      const domains = await loadDomains(source);\n      return { entries, domains, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    // Local-only catalog throws a recognizable message — silence it; absence\n    // is the user's choice, not an error.\n    if (!/local/i.test(msg)) {\n      notes.push({ feed: \"store\", message: msg });\n    }\n    return { entries: [], domains: [], notes };\n  }\n}\n\n/** Optional `listDomains` capability — returns `[]` when the source lacks it. */\nasync function loadDomains(source: unknown): Promise<CatalogDomain[]> {\n  const fn = (source as { listDomains?: () => Promise<CatalogDomain[]> }).listDomains;\n  if (typeof fn !== \"function\") return [];\n  const domains = await fn.call(source);\n  return Array.isArray(domains) ? domains : [];\n}\n\n/** The slice of `AssetManager` the source feed needs (kept narrow for tests). */\ninterface AssetManagerLike {\n  search: () => Promise<CatalogEntry[]>;\n  searchRepoRoots: () => { repoName: string; root: string }[];\n}\n\n/**\n * Project-source feed: leans on `AssetManager.search()`, which now merges\n * `skaile.yaml`'s `sources:` field into the repositories map, then stamps\n * `DOMAIN.md`-derived domain grouping onto the scanned entries via\n * `searchRepoRoots()`.\n */\nasync function sourceAssets(\n  am: AssetManagerLike,\n): Promise<{ entries: OriginEntry[]; domains: CatalogDomain[] }> {\n  // The bundled factory tree is injected into the repositories map as an implicit\n  // source, so `am.search()` returns it too. It has its own `factory` origin band,\n  // so drop it here — otherwise the same first-party skills list twice under Sources.\n  const factoryPrefixes = factoryAssetRoots().map((r) => (r.endsWith(path.sep) ? r : r + path.sep));\n  const isFactoryPath = (p: string) =>\n    factoryPrefixes.some((fp) => p === fp.slice(0, -1) || p.startsWith(fp));\n\n  const all = (await am.search()).filter((e) => !isFactoryPath(e.source));\n  const entries: OriginEntry[] = [];\n  const domains: CatalogDomain[] = [];\n  // Group each source's entries under the source node (its short repo name), not\n  // the publisher: under Sources the navigational question is \"which repo did\n  // this come from\". Each entry's `source` (absolute manifest path) lives under\n  // exactly one declared root, so group + stamp by prefix. The cache slug is\n  // URL-keyed `github.com/<org>/<repo>` — take the trailing segment.\n  for (const { repoName, root } of am.searchRepoRoots()) {\n    if (isFactoryPath(root)) continue;\n    const prefix = root.endsWith(path.sep) ? root : root + path.sep;\n    const owned = all.filter((e) => e.source === root || e.source.startsWith(prefix));\n    if (owned.length === 0) continue;\n    const sourceName = repoName.split(\"/\").pop() || repoName;\n    // No synthetic fallback domain — the source node already groups these, so a\n    // same-named fallback would just nest the source under itself.\n    domains.push(...(await stampDomains(root, sourceName, owned, false)));\n    for (const entry of owned) entries.push({ origin: \"source\", entry, group: sourceName });\n  }\n  return { entries, domains };\n}\n\n/**\n * Factory-asset feed: scan the bundled first-party `factory-assets` tree(s)\n * resolved by `factoryAssetRoots()` (the `SKAILE_FACTORY_ASSETS_DIR` override\n * layer ahead of the bundled tree). Local disk only, no network — the entries are\n * the built-in skills / connectors / bundles that ship with `@skaile/workspaces`.\n * `factoryAssetRoots()` already dedupes, so the env override pointing at the\n * bundled dir collapses to one root.\n */\nasync function factoryAssets(): Promise<{\n  entries: CatalogEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  const domains: CatalogDomain[] = [];\n  try {\n    const entries: CatalogEntry[] = [];\n    for (const root of factoryAssetRoots()) {\n      const rootEntries = [...(await scanRepo(root, \"skaile-factory\"))];\n      domains.push(...(await stampDomains(root, \"skaile-factory\", rootEntries)));\n      entries.push(...rootEntries);\n    }\n    return { entries, domains, notes };\n  } catch (err) {\n    notes.push({\n      feed: \"factory\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], domains, notes };\n  }\n}\n\n/** Tag a flat entry list with a single origin. */\nfunction tag(origin: AssetOrigin, entries: CatalogEntry[]): OriginEntry[] {\n  return entries.map((entry) => ({ origin, entry }));\n}\n\n/**\n * Run all feeds and return a single normalized result.\n *\n * Feeds run in parallel where possible — the store fetch is the slow one\n * (one HTTP call) and is fired alongside the local library walk. The factory\n * scan is local disk only, so it runs inline.\n */\nexport async function gatherAssetFeeds(\n  am: AssetManagerLike,\n  projectDir: string,\n): Promise<AssetFeedResult> {\n  const [libs, store] = await Promise.all([libraryAssets(), storeAssets(projectDir)]);\n  const factory = await factoryAssets();\n  const src = await sourceAssets(am);\n  return {\n    entries: [\n      ...src.entries,\n      ...libs.entries,\n      ...tag(\"factory\", factory.entries),\n      ...tag(\"store\", store.entries),\n    ],\n    // Store domains first (server-curated), then the on-disk feeds; dedupe by\n    // slug, first-wins, so a store-served domain shadows a same-slug local one.\n    domains: dedupeBySlug([...store.domains, ...src.domains, ...libs.domains, ...factory.domains]),\n    notes: [...libs.notes, ...store.notes, ...factory.notes],\n  };\n}\n\n/** First-wins dedupe of a domain list by `slug`. */\nfunction dedupeBySlug(domains: CatalogDomain[]): CatalogDomain[] {\n  const seen = new Set<string>();\n  const out: CatalogDomain[] = [];\n  for (const d of domains) {\n    if (seen.has(d.slug)) continue;\n    seen.add(d.slug);\n    out.push(d);\n  }\n  return out;\n}\n"]}

package/dist/chunk-2D3C4AJP.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../types/src/manifests/_shared.ts","../types/src/manifests/agent.ts","../types/src/manifests/connector.ts","../types/src/manifests/mount.ts","../types/src/manifests/skill.ts","../types/src/manifests/contract.ts","../types/src/manifests/mcp-server.ts","../types/src/manifests/prompt.ts","../types/src/manifests/persona.ts","../types/src/manifests/preset.ts","../types/src/manifests/ruleset.ts","../types/src/manifests/index.ts"],"names":["z2","z3","z4","z5","z6","z7","z8","z9","z10","z11"],"mappings":";;;AAUO,IAAM,eAAA,GAAkB;AAAA,EAC7B,OAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAEO,IAAM,eAAA,GAAoB,OAAK,eAAe;AAQ9C,IAAM,oBAAsB,CAAA,CAAA,MAAA,CAAO;AAAA,EACxC,EAAA,EAAM,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACpB,WAAA,EAAe,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC;AAGM,IAAM,yBAA2B,CAAA,CAAA,MAAA,CAAO;AAAA,EAC7C,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,WAAA,EAAe,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAC1B,CAAC;AAGM,IAAM,kBAAoB,CAAA,CAAA,WAAA,CAAY;AAAA,EAC3C,KAAO,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAChC,IAAM,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAC/B,KAAA,EAAS,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,MAAA,EAAU,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,QAAA,EAAY,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAW,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACtC,MAAA,EAAU,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,KAAA,CAAM,CAAG,CAAA,CAAA,MAAA,EAAO,EAAK,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC5D,OAAA,EACG,QAAM,CAAG,CAAA,CAAA,MAAA,IAAY,CAAA,CAAA,MAAA,EAAO,EAAK,WAAQ,EAAK,CAAA,CAAA,KAAA,CAAQ,QAAM,CAAG,CAAA,CAAA,MAAA,IAAY,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAC,CAAC,CAAA,CACvF,QAAA,EAAS;AAAA,EACZ,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC;AAGM,IAAM,cAAgB,CAAA,CAAA,MAAA,CAAO;AAAA,EAClC,GAAA,EAAO,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,KAAA,EAAS,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,QAAA,EAAY,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,SAAA,EAAa,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAChC,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,OAAA,EAAW,CAAA,CAAA,KAAA,CAAM,CAAG,CAAA,CAAA,MAAA,EAAO,EAAK,CAAA,CAAA,MAAA,EAAO,EAAK,CAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA;AAC1D,CAAC;AAMM,IAAM,uBAAyB,CAAA,CAAA,WAAA,CAAY;AAAA,EAChD,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAU,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAQ,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,KAAA,EAAS,OAAK,CAAC,OAAA,EAAS,QAAQ,QAAA,EAAU,YAAY,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAClE,MAAA,EAAU,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,aAAA,EAAiB,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA;AAC7B,CAAC;AAUM,IAAM,wBAA0B,CAAA,CAAA,MAAA,CAAO;AAAA,EAC5C,IAAA,EAAQ,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAe,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAG7B,SAAA,EAAa,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,QAAA,EAAY,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAY,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA;AAChC,CAAC;AAkBM,SAAS,gBAAA,CACd,QACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA;AACpC,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,OAAO,IAAA,EAAK;AAAA,EACvC;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,QAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,MAC1C,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAAA,MACzB,SAAS,KAAA,CAAM;AAAA,KACjB,CAAE;AAAA,GACJ;AACF;ACtHO,IAAM,uBAAA,GAA0B,CAAC,SAAA,EAAW,MAAA,EAAQ,UAAU,OAAO;AAarE,IAAM,wBAAA,GAA2B,CAAC,MAAA,EAAQ,QAAA,EAAU,SAAS,OAAO;AAG3E,IAAM,UAAA,GAAa,wBAAA,CAAyB,IAAA,CAAK,GAAG,CAAA;AAkBpD,IAAM,mBAAA,GAAsB,CAAA,MAAA,EAAS,UAAU,CAAA,yCAAA,EAA4C,UAAU,CAAA,EAAA,CAAA;AAoB9F,IAAM,4BAA4B,IAAI,MAAA;AAAA,EAC3C,6BAA6B,mBAAmB,CAAA,aAAA;AAClD;AAmBO,IAAM,2BAA2B,IAAI,MAAA;AAAA,EAC1C,oDAAoD,mBAAmB,CAAA,kCAAA;AACzE;AASO,IAAM,uBAAA,GAA0B,IAAI,MAAA,CAAO,CAAA,QAAA,EAAW,mBAAmB,CAAA,QAAA,CAAU;AAoBnF,IAAM,gBAAkBA,CAAA,CAAA,KAAA,CAAM;AAAA,EACjCA,OAAK,uBAAuB,CAAA;AAAA,EAE3BA,UAAO,CACP,KAAA;AAAA,IACC,yBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACAA,CAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,wBAAwB,CAAA;AAAA,EACvCA,CAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,uBAAuB;AAC1C,CAAC;AAUM,IAAM,2BAAA,GAAiD,CAAC,mBAAmB;AAkC3E,SAAS,8BAA8B,OAAA,EAA2B;AACvE,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAI,GAAA,CAAI,OAAO,CAAA,CAAE,SAAS,WAAA,EAAY;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,2BAAA,CAA4B,SAAS,IAAI,CAAA;AAClD;AAkBO,SAAS,yBAAyB,MAAA,EAAiC;AACxE,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,oBAAA,EAAsB,OAAO,KAAA;AACpD,EAAA,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,QAAA,MAAc,QAAA,EAAU,OAAO,KAAA;AACxD,EAAA,OAAO,6BAAA,CAA8B,OAAO,QAAQ,CAAA;AACtD;AAQO,IAAM,qBAAA,GACVA,CAAA,CAAA,MAAA,EAAO,CACP,KAAA,CAAM,SAAS,yDAAyD;AAQpE,SAAS,uBAAuB,MAAA,EAA2C;AAChF,EAAA,OAAO,wBAAA,CAAyB,MAAM,CAAA,GACjC,aAAA,GACA,qBAAA;AACP;AAgBO,SAAS,sBAAsB,KAAA,EAAmC;AACvE,EAAA,OAAO,CAAC,KAAA,IAAS,KAAA,KAAU,SAAA,GACvB,wBAAuB,GACtB,qBAAA;AACP;AAgBO,SAAS,uBAAA,CACd,KAAA,EACA,QAAA,GAAgC,QAAA,EACxB;AACR,EAAA,IAAI,CAAC,OAAO,OAAO,QAAA;AACnB,EAAA,IAAK,uBAAA,CAA8C,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAC3E,EAAA,IAAI,yBAAA,CAA0B,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AAClD,EAAA,IAAI,wBAAA,CAAyB,KAAK,KAAK,CAAA,IAAK,wBAAwB,IAAA,CAAK,KAAK,GAAG,OAAO,KAAA;AAIxF,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,KAAA,CAAM,6BAA6B,CAAA;AAC7D,EAAA,IAAI,WAAA,EAAa,OAAO,WAAA,CAAY,CAAC,EAAG,WAAA,EAAY;AACpD,EAAA,OAAO,QAAA;AACT;AAiBO,IAAM,mBAAA,GACVA,UAAO,CACP,KAAA;AAAA,EACC,OAAA;AAAA,EACA;AACF;AAEF,IAAM,oBAAsBA,CAAA,CAAA,WAAA,CAAY;AAAA,EACtC,SAAA,EAAW,oBAAoB,QAAA,EAAS;AAAA,EACxC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,mBAAmB,CAAA,CAAE,QAAA,EAAS;AAAA,EAChD,aACGA,CAAA,CAAA,WAAA,CAAY;AAAA,IACX,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,UAAA,EAAcA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,GACjC,EACA,QAAA;AACL,CAAC,CAAA;AAMM,IAAM,aAAA,GAAgB,CAAC,cAAA,EAAgB,aAAA,EAAe,iBAAiB;AACvE,IAAM,aAAA,GAAkBA,OAAK,aAAa;AAW1C,IAAM,yBAA2BA,CAAA,CAAA,MAAA,CAAO;AAAA,EAC7C,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,QAAA,EAAYA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAS,cAAc,QAAA;AACzB,CAAC;AA6BM,IAAM,mBAAqBA,CAAA,CAAA,WAAA,CAAY;AAAA;AAAA,EAE5C,OAAA,EAAWA,QAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAC,EAAE,QAAA,EAAS;AAAA;AAAA,EAE7C,MAAA,EAAUA,QAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAC,EAAE,QAAA;AACrC,CAAC;AAIM,IAAM,sBAAwBA,CAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,YAAA,EAAgBA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAE7B,KAAA,EAAO,kBAAkB,QAAA,EAAS;AAAA,EAClC,KAAA,EAAO,iBAAiB,QAAA,EAAS;AAAA,EACjC,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACrC,UAAA,EAAcA,cAAY,EAAE,IAAA,EAAQA,UAAO,EAAG,EAAE,QAAA,EAAS;AAAA,EACzD,SACGA,CAAA,CAAA,WAAA,CAAY;AAAA,IACX,SAAA,EAAaA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,GAC9B,EACA,QAAA,EAAS;AAAA,EAEZ,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,IAAA,EAAQA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAGvC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,sBAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,EAEnD,UAAYA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA;AAC9C,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACtZO,IAAM,0BAA4BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACnD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,KAAA,EAASA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACvB,UACGA,CAAA,CAAA,MAAA,CAAO;AAAA,IACN,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACvC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA;AAAS,GACxC,EACA,QAAA,EAAS;AAAA,EACZ,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA,EAAS;AAAA,EACtC,YAAA,EAAgBA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC7C,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,SAAS,kBAAkB,IAAA,EAA4D;AAC5F,EAAA,OAAO,gBAAA,CAAiB,yBAAyB,IAAI,CAAA;AACvD;ACrBO,IAAM,sBAAwBC,CAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,KAAA,EAASA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACvB,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA,EAAS;AAAA,EACtC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACPA,IAAM,mBAAA,GAAsB,qBAAqB,MAAA,CAAO;AAAA,EACtD,YAAcC,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACvD,WACGA,CAAA,CAAA,MAAA,CAAO;AAAA,IACN,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA;AAAS,GAC/C,EACA,QAAA,EAAS;AAAA,EACZ,eACGA,CAAA,CAAA,MAAA,CAAO;AAAA,IACN,KAAA,EAASA,CAAA,CAAA,KAAA,CAAM,sBAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,IAChD,eAAA,EAAmBA,CAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA,IACnD,eAAA,EAAmBA,CAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,IAEnD,KAAA,EAASA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,CAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,CAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EAAE,QAAA,EAAS;AAAA,IAC5F,QAAA,EACGA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,CAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,CAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EACxE,QAAA,EAAS;AAAA,IACZ,SAAA,EACGA,CAAA,CAAA,KAAA;AAAA,MACGA,CAAA,CAAA,MAAA,CAAO;AAAA,QACP,IAAMA,CAAA,CAAA,MAAA,EAAO;AAAA,QACb,UAAA,EAAcA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACzC,QAAA,EAAYA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,QAC/B,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,OAClC;AAAA,MAEF,QAAA,EAAS;AAAA,IACZ,UAAA,EACGA,CAAA,CAAA,KAAA;AAAA,MACGA,CAAA,CAAA,MAAA,CAAO;AAAA,QACP,QAAUA,CAAA,CAAA,MAAA,EAAO;AAAA,QACjB,QAAUA,CAAA,CAAA,IAAA,CAAK,CAAC,aAAa,YAAY,CAAC,EAAE,QAAA;AAAS,OACtD;AAAA,MAEF,QAAA;AAAS,GACb,EACA,QAAA,EAAS;AAAA,EACZ,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,CAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,CAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EAAE,QAAA;AACxF,CAAC,CAAA;AAEM,IAAM,sBAAwBA,CAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,aAAA,EAAiBA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,eAAA,EAAmBA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAGtC,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,WAAA,EAAeA,CAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA,EAC/C,UAAA,EAAcA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACzC,SAAA,EAAaA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAExC,QAAA,EAAU,oBAAoB,QAAA;AAChC,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACtEO,IAAM,yBAA2BC,CAAA,CAAA,WAAA,CAAY;AAAA,EAClD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,iBAAiB,IAAA,EAA2D;AAC1F,EAAA,OAAO,gBAAA,CAAiB,wBAAwB,IAAI,CAAA;AACtD;ACjBO,IAAM,0BAA4BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACnD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,QAAM,CAAGA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIpD,SAAA,EAAaA,OAAK,CAAC,OAAA,EAAS,OAAO,MAAA,EAAQ,iBAAiB,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACxE,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,IAAA,EAAQA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,KAAOA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAC/C,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,SAAWA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAEnD,EAAA,EAAMA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACxB,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7B,SACGA,CAAA,CAAA,MAAA,CAAO;AAAA;AAAA,IAEN,GAAA,EACGA,CAAA,CAAA,MAAA,EAAO,CACP,GAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,UAAU,CAAA,EAAG,EAAE,OAAA,EAAS,6BAA6B,CAAA;AAAA,IACnF,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,gBAAgB,CAAA;AAAA;AAAA,IAEzC,IAAA,EACGA,CAAA,CAAA,MAAA,EAAO,CACP,KAAA,CAAM,WAAA,EAAa,EAAE,OAAA,EAAS,2CAAA,EAA6C,CAAA,CAC3E,QAAA;AAAS,GACb,EACA,QAAA;AACL,CAAC;AAIM,SAAS,kBAAkB,IAAA,EAA4D;AAC5F,EAAA,OAAO,gBAAA,CAAiB,yBAAyB,IAAI,CAAA;AACvD;ACtCO,IAAM,uBAAyBC,CAAA,CAAA,WAAA,CAAY;AAAA,EAChD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,eAAe,IAAA,EAAyD;AACtF,EAAA,OAAO,gBAAA,CAAiB,sBAAsB,IAAI,CAAA;AACpD;ACbO,IAAM,wBAA0BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACjD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,gBAAgB,IAAA,EAA0D;AACxF,EAAA,OAAO,gBAAA,CAAiB,uBAAuB,IAAI,CAAA;AACrD;ACHA,IAAM,qBAAA,GAAwB;AAAA,EAC5B,MAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,qBAAA,GAA0BC,OAAK,qBAAqB;AAE1D,IAAM,oBAAsBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACxC,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAM,sBAAsB,QAAA,EAAS;AAAA,EACrC,QAAA,EAAYA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAWA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACjE,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA;AACrD,CAAC;AAMD,IAAM,mBAAqBA,CAAA,CAAA,MAAA,CAAO;AAAA,EAChC,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC;AACvB,CAAC,CAAA;AAMM,IAAM,mBAAqBA,CAAA,CAAA,WAAA,CAAY;AAAA;AAAA,EAE5C,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA;AAAA,EAErB,EAAA,EAAMA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAExB,QAAUA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA;AAAA,EAEnD,YAAA,EAAgBA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAElD,aAAeA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAEvD,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAM,gBAAgB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAE7C,QAAUA,CAAA,CAAA,MAAA,CAASA,CAAA,CAAA,MAAA,IAAYA,CAAA,CAAA,OAAA,EAAS,EAAE,QAAA;AAC5C,CAAC;AAMD,IAAM,oBAAsBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACjC,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,IAAA,EAAM,sBAAsB,QAAA,EAAS;AAAA,EACrC,MAAA,EAAUA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,QAAA,EAAYA,CAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC5D,OAAA,EAAWA,CAAA,CAAA,KAAA,CAAM,CAAGA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,MAAA,EAAO,EAAKA,CAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA;AAC1D,CAAC,CAAA;AAOM,IAAM,qBAAuBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACzC,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,GAAA,EAAOA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAClB,CAAC;AAMM,IAAM,uBAAyBA,CAAA,CAAA,WAAA,CAAY;AAAA,EAChD,SAAA,EAAaA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,SAAWA,CAAA,CAAA,KAAA,CAAM,CAAGA,UAAO,EAAKA,CAAA,CAAA,MAAA,EAAQ,CAAC,CAAA;AAAA,EACzC,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAGvC,KAAA,EAASA,CAAA,CAAA,KAAA,CAAM,gBAAgB,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA;AAAA,EAGtC,MAAA,EAAUA,CAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAG5C,OAAA,EAAWA,CAAA,CAAA,KAAA,CAAM,kBAAkB,CAAA,CAAE,QAAA;AACvC,CAAC;AAOM,SAAS,eAAe,IAAA,EAAyD;AACtF,EAAA,OAAO,gBAAA,CAAiB,sBAAsB,IAAI,CAAA;AACpD;ACnHO,IAAM,wBAA0BC,CAAA,CAAA,WAAA,CAAY;AAAA,EACjD,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,CAAA,CAAA,KAAA,CAAQA,CAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,CAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,gBAAgB,IAAA,EAA0D;AACxF,EAAA,OAAO,gBAAA,CAAiB,uBAAuB,IAAI,CAAA;AACrD;;;ACgGA,IAAM,UAAA,GACJ;AAAA,EACE,KAAA,EAAO,aAAA;AAAA,EACP,KAAA,EAAO,aAAA;AAAA,EACP,SAAA,EAAW,iBAAA;AAAA,EACX,KAAA,EAAO,aAAA;AAAA,EACP,QAAA,EAAU,gBAAA;AAAA,EACV,MAAA,EAAQ,cAAA;AAAA,EACR,YAAA,EAAc,iBAAA;AAAA,EACd,OAAA,EAAS,eAAA;AAAA,EACT,OAAA,EAAS;AACX,CAAA;AASK,SAAS,cAAA,CAAe,MAAiB,IAAA,EAAkD;AAChG,EAAA,MAAM,SAAA,GAAY,WAAW,IAAI,CAAA;AACjC,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,CAAA,oBAAA,EAAuB,IAAI,CAAA,CAAA,EAAI,CAAA,EAAE;AAAA,EACzF;AACA,EAAA,OAAO,UAAU,IAAI,CAAA;AACvB","file":"chunk-2D3C4AJP.js","sourcesContent":["/**\n * Shared manifest frontmatter schemas and types.\n * Common across all 11 asset kinds + Preset.\n */\nimport * as z from \"zod\";\n\n// ---------------------------------------------------------------------------\n// Asset kind enum\n// ---------------------------------------------------------------------------\n\nexport const AssetKindValues = [\n  \"skill\",\n  \"agent\",\n  \"connector\",\n  \"mount\",\n  \"flow\",\n  \"contract\",\n  \"prompt\",\n  \"mcp-server\",\n  \"knowledge\",\n  \"persona\",\n  \"ruleset\",\n] as const;\n\nexport const AssetKindSchema = z.enum(AssetKindValues);\nexport type AssetKind = z.infer<typeof AssetKindSchema>;\n\n// ---------------------------------------------------------------------------\n// Shared metadata sub-schemas\n// ---------------------------------------------------------------------------\n\n/** Artifact dependency (requires/produces/consumes in skill metadata). */\nexport const ArtifactRefSchema = z.object({\n  id: z.string().min(1),\n  description: z.string().optional(),\n  gate: z.enum([\"hard\", \"soft\"]).optional(),\n  path: z.string().optional(),\n});\n\n/** File prerequisite for a skill. */\nexport const FilePrerequisiteSchema = z.object({\n  path: z.string().min(1),\n  gate: z.enum([\"hard\", \"soft\"]).optional(),\n  description: z.string().optional(),\n});\n\n/** User input definition (for skill user_inputs or metadata.prerequisites.inputs_*). */\nexport const UserInputSchema = z.looseObject({\n  key: z.string().min(1).optional(),\n  id: z.string().min(1).optional(),\n  label: z.string().optional(),\n  prompt: z.string().optional(),\n  type: z.string().optional(),\n  required: z.boolean().optional(),\n  options: z.array(z.string()).optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n  default: z\n    .union([z.string(), z.number(), z.boolean(), z.array(z.union([z.string(), z.number()]))])\n    .optional(),\n  hint: z.string().optional(),\n});\n\n/** Field definition for connectors/mounts. */\nexport const FieldSchema = z.object({\n  key: z.string().min(1),\n  label: z.string().optional(),\n  required: z.boolean().optional(),\n  sensitive: z.boolean().optional(),\n  type: z.string().optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Common metadata block (appears inside metadata: in most manifest kinds)\n// ---------------------------------------------------------------------------\n\nexport const CommonMetadataSchema = z.looseObject({\n  version: z.string().optional(),\n  author: z.string().optional(),\n  tags: z.array(z.string()).optional(),\n  stage: z.enum([\"alpha\", \"beta\", \"stable\", \"deprecated\"]).optional(),\n  source: z.string().optional(),\n  do_not_invoke: z.boolean().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Common frontmatter fields (top-level, shared across kinds)\n// ---------------------------------------------------------------------------\n\n/**\n * Fields that can appear at the top level of any manifest's frontmatter.\n * Not all are required -- each kind schema intersects with its own specifics.\n */\nexport const BaseFrontmatterSchema = z.object({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n\n  // Catalog identity (populated at discovery or authoring time)\n  publisher: z.string().optional(),\n  category: z.string().optional(),\n  license: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Validation result type\n// ---------------------------------------------------------------------------\n\nexport interface ManifestValidationSuccess<T> {\n  ok: true;\n  data: T;\n}\n\nexport interface ManifestValidationFailure {\n  ok: false;\n  errors: Array<{ path: string; message: string }>;\n}\n\nexport type ManifestValidationResult<T> = ManifestValidationSuccess<T> | ManifestValidationFailure;\n\nexport function validateManifest<T>(\n  schema: z.ZodType<T>,\n  data: unknown,\n): ManifestValidationResult<T> {\n  const result = schema.safeParse(data);\n  if (result.success) {\n    return { ok: true, data: result.data };\n  }\n  return {\n    ok: false,\n    errors: result.error.issues.map((issue) => ({\n      path: issue.path.join(\".\"),\n      message: issue.message,\n    })),\n  };\n}\n","import * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\n// ---------------------------------------------------------------------------\n// Model identifier validation + normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Anthropic model aliases recognized by Claude Code and the Claude Agent SDK.\n *\n * - `inherit` — use the parent agent's model (Claude Code only).\n * - `opus` / `sonnet` / `haiku` — auto-rolling pointer to the current top model\n *   in that family. Resolved by Claude Code / the Claude SDK at runtime.\n *\n * Use these in `agent.yaml` `model.preferred` for portability across Claude\n * Code and `claude-sdk`. Use a full ID (see {@link ANTHROPIC_FULL_ID_PATTERN})\n * when you need to pin to a specific Anthropic release.\n */\nexport const ANTHROPIC_MODEL_ALIASES = [\"inherit\", \"opus\", \"sonnet\", \"haiku\"] as const;\nexport type AnthropicModelAlias = (typeof ANTHROPIC_MODEL_ALIASES)[number];\n\n/**\n * Anthropic model family segments recognized inside a full model identifier.\n *\n * This is the *ID* vocabulary, deliberately wider than\n * {@link ANTHROPIC_MODEL_ALIASES}: `fable` ships as a real model family\n * (`claude-fable-5`) but has no Claude Code rolling alias, so it belongs here\n * and not there.\n *\n * @since 1.5.0\n */\nexport const ANTHROPIC_MODEL_FAMILIES = [\"opus\", \"sonnet\", \"haiku\", \"fable\"] as const;\nexport type AnthropicModelFamily = (typeof ANTHROPIC_MODEL_FAMILIES)[number];\n\nconst FAMILY_ALT = ANTHROPIC_MODEL_FAMILIES.join(\"|\");\n\n/**\n * Family + version core shared by the full / Bedrock / Vertex patterns.\n *\n * Matches both the Claude 4+ \"family-first\" form (`opus-4-6`, `opus-5`) and the\n * legacy \"version-first\" form used by Claude 3.x and some OpenRouter aliases\n * (`3-5-sonnet`).\n *\n * The version is `\\d+(?:[-.]\\d+)*` — one *or more* numeric components. It used\n * to demand two or more, which rejected every current single-digit-major ID\n * (`claude-opus-5`, `claude-sonnet-5`, `claude-fable-5`). Those are structurally\n * indistinguishable from the older partial IDs the two-component rule was\n * written to catch (`claude-opus-4`), so accepting the current lineup\n * necessarily accepts those too. This validator is structural, not a catalog\n * check — a well-formed ID that no provider serves is caught at dispatch, not\n * here.\n */\nconst FAMILY_VERSION_CORE = `(?:(?:${FAMILY_ALT})-\\\\d+(?:[-.]\\\\d+)*|\\\\d+(?:[-.]\\\\d+)*-(?:${FAMILY_ALT}))`;\n\n/**\n * Regex matching a full Anthropic model identifier, optionally provider-prefixed.\n *\n * Examples that match (family-first):\n * - `claude-opus-5`\n * - `claude-sonnet-5`\n * - `claude-fable-5`\n * - `claude-opus-4-6`\n * - `claude-haiku-4-5-20251001`\n * - `anthropic/claude-sonnet-4.6` (OpenRouter form)\n *\n * Examples that match (version-first / legacy):\n * - `claude-3-5-sonnet-20241022`\n * - `anthropic/claude-3.7-sonnet`\n *\n * Still rejected: a bare family (`claude-opus`), a non-Claude vendor\n * (`gpt-4o`), an unknown family (`claude-turbo-5`).\n */\nexport const ANTHROPIC_FULL_ID_PATTERN = new RegExp(\n  `^(?:[a-z0-9-]+\\\\/)?claude-${FAMILY_VERSION_CORE}(?:-\\\\d{8})?$`,\n);\n\n/**\n * Regex matching an Amazon Bedrock-form Anthropic model identifier: an\n * optional region/scope prefix (`us.` / `eu.` / `apac.` / `global.`), the\n * `anthropic.` vendor segment, the same family/version core as\n * {@link ANTHROPIC_FULL_ID_PATTERN}, plus Bedrock's optional\n * `-v<major>[:<minor>]` suffix.\n *\n * Examples that match:\n * - `anthropic.claude-3-5-sonnet-20241022-v2:0`\n * - `us.anthropic.claude-opus-4-6-v1:0`\n * - `anthropic.claude-sonnet-4-5-20250929-v1:0`\n *\n * Does NOT match `anthropic.gpt-4` (not a Claude family) or a bare\n * `us.claude-…` (the `anthropic.` segment is required).\n *\n * @since 1.3.0\n */\nexport const BEDROCK_MODEL_ID_PATTERN = new RegExp(\n  `^(?:(?:us|eu|apac|global)\\\\.)?anthropic\\\\.claude-${FAMILY_VERSION_CORE}(?:-\\\\d{8})?(?:-v\\\\d+(?::\\\\d+)?)?$`,\n);\n\n/**\n * Regex matching a Google Vertex AI publisher-form Anthropic identifier —\n * a first-party ID pinned with an `@YYYYMMDD` date suffix instead of the\n * native `-YYYYMMDD` (e.g. `claude-sonnet-4-5@20250929`).\n *\n * @since 1.3.0\n */\nexport const VERTEX_MODEL_ID_PATTERN = new RegExp(`^claude-${FAMILY_VERSION_CORE}@\\\\d{8}$`);\n\n/**\n * Zod schema for a **first-party Anthropic** model identifier: a Claude Code\n * alias, a full Anthropic ID, a Bedrock-form ID (see\n * {@link BEDROCK_MODEL_ID_PATTERN}), or a Vertex `@date`-pinned ID (see\n * {@link VERTEX_MODEL_ID_PATTERN}).\n *\n * This is **not** a universal model-id rule. It is the vocabulary of exactly\n * one wire target — `surface: anthropic-messages` on `transport: direct`\n * pointed at Anthropic's own host — because that is the only endpoint whose\n * model namespace this package knows. Every other endpoint names models it\n * cannot enumerate (a Bedrock ARN, an Azure deployment name,\n * `accounts/fireworks/models/…`, `meta-llama/Llama-3.3-70B`, an Ollama tag),\n * and applying this schema there rejected working configurations. Pick between\n * the two vocabularies with {@link modelIdSchemaForTarget}.\n *\n * Use {@link normalizeAnthropicModel} to coerce an unrecognized value to a safe\n * alias instead of failing.\n */\nexport const ModelIdSchema = z.union([\n  z.enum(ANTHROPIC_MODEL_ALIASES),\n  z\n    .string()\n    .regex(\n      ANTHROPIC_FULL_ID_PATTERN,\n      \"Invalid Anthropic model ID. Use an alias (opus | sonnet | haiku | inherit), a full ID (e.g. claude-opus-5, claude-sonnet-4-6), a Bedrock ID (e.g. us.anthropic.claude-opus-4-6-v1:0), or a Vertex ID (e.g. claude-sonnet-4-5@20250929).\",\n    ),\n  z.string().regex(BEDROCK_MODEL_ID_PATTERN),\n  z.string().regex(VERTEX_MODEL_ID_PATTERN),\n]);\n\n/**\n * Hosts that serve the first-party Anthropic Messages API. An\n * `anthropic-messages` entry pointed anywhere else — a gateway, LiteLLM, an\n * Azure AI Foundry deployment — speaks the same wire protocol over its own\n * model namespace.\n *\n * @since 3.21.0\n */\nexport const ANTHROPIC_FIRST_PARTY_HOSTS: readonly string[] = [\"api.anthropic.com\"];\n\n/**\n * The slice of a provider-registry `llm` entry that decides which model-id\n * vocabulary applies.\n *\n * Structurally a subset of `AIProviderLlmEntry`\n * (`@skaile/workspaces/core/provider-registry`), so a registry entry can be\n * passed straight in. The fields are plain strings because this module sits\n * *below* the registry in the dependency graph and must not import it; the\n * enums live in exactly one place, and this is not it.\n *\n * @since 3.21.0\n */\nexport interface ModelIdTarget {\n  /** omp `api` value — `anthropic-messages`, `openai-completions`, … */\n  surface?: string;\n  /** `direct` when absent. */\n  transport?: string;\n  /** Resolved endpoint: `resolveEntryBaseUrl(entry)`, or the preset literal. */\n  base_url?: string;\n}\n\n/**\n * True when `baseUrl` is the first-party Anthropic API.\n *\n * An absent URL counts: an `anthropic-messages` entry with no endpoint of its\n * own is the first-party API (the catalog layer fills in\n * `https://api.anthropic.com` during the merge). A URL that will not parse is\n * treated as *not* first-party — guessing the other way would reject ids that\n * whatever is at the other end serves.\n *\n * @since 3.21.0\n */\nexport function isFirstPartyAnthropicEndpoint(baseUrl?: string): boolean {\n  if (!baseUrl) return true;\n  let host: string;\n  try {\n    host = new URL(baseUrl).hostname.toLowerCase();\n  } catch {\n    return false;\n  }\n  return ANTHROPIC_FIRST_PARTY_HOSTS.includes(host);\n}\n\n/**\n * Whether `target` demands an Anthropic-shaped model id.\n *\n * Exactly one combination does: the Anthropic Messages wire, spoken directly,\n * to Anthropic's own host. Every gateway transport (`bedrock`, `vertex`,\n * `foundry`, `azure-openai`) addresses the same models under a renamed\n * namespace — an inference-profile ARN, a publisher path, a deployment name —\n * and an `anthropic-messages` proxy owns its namespace outright.\n *\n * An absent `target` is the pre-registry default: first-party Anthropic is what\n * the Claude drivers talk to when nothing says otherwise, so the strict\n * vocabulary still applies there and nothing that validates today stops\n * validating.\n *\n * @since 3.21.0\n */\nexport function requiresAnthropicModelId(target?: ModelIdTarget): boolean {\n  if (!target) return true;\n  if (target.surface !== \"anthropic-messages\") return false;\n  if ((target.transport ?? \"direct\") !== \"direct\") return false;\n  return isFirstPartyAnthropicEndpoint(target.base_url);\n}\n\n/**\n * Any non-empty, whitespace-free model id — the vocabulary of every endpoint\n * whose model namespace belongs to the operator rather than to us.\n *\n * @since 3.21.0\n */\nexport const FreeFormModelIdSchema = z\n  .string()\n  .regex(/^\\S+$/, \"Model ID must be a non-empty string with no whitespace.\");\n\n/**\n * The model-id schema a given wire target enforces: {@link ModelIdSchema} for\n * first-party Anthropic, {@link FreeFormModelIdSchema} everywhere else.\n *\n * @since 3.21.0\n */\nexport function modelIdSchemaForTarget(target?: ModelIdTarget): z.ZodType<string> {\n  return requiresAnthropicModelId(target)\n    ? (ModelIdSchema as z.ZodType<string>)\n    : (FreeFormModelIdSchema as z.ZodType<string>);\n}\n\n/**\n * Contextual model-ID schema for the legacy `cloud` dimension.\n *\n * `default` (or absent) is the first-party Anthropic API, so the strict\n * vocabulary applies. Every other value either renames the namespace\n * (`bedrock` ARNs, `vertex` publisher paths, `azure` deployments) or is an\n * unknowable proxy (`gateway`) — all free-form, the same answer\n * {@link modelIdSchemaForTarget} gives for the equivalent registry entry.\n *\n * Superseded by {@link modelIdSchemaForTarget}; it goes when the rest of the\n * `cloud` surface does.\n *\n * @since 1.3.0\n */\nexport function modelIdSchemaForCloud(cloud?: string): z.ZodType<string> {\n  return !cloud || cloud === \"default\"\n    ? modelIdSchemaForTarget()\n    : (FreeFormModelIdSchema as z.ZodType<string>);\n}\n\n/**\n * Normalize an arbitrary model string to a safe Claude Code value.\n *\n * - If `input` is a recognized alias or a full / Bedrock-form / Vertex-form ID,\n *   returns it unchanged.\n * - If `input` looks like `claude-<family>-...` but doesn't match any full-ID\n *   regex (e.g. the broken `claude-opus-4`), returns the family alias.\n * - Otherwise returns `fallback` (default `\"sonnet\"` — Claude Code's default).\n *\n * Used by renderers that target Claude Code / the Claude SDK to coerce stale\n * or malformed model fields into a working alias rather than propagating a\n * silent runtime failure. All full-pattern checks run BEFORE the family\n * fallback so a valid Bedrock/Vertex ID is never downgraded to an alias.\n */\nexport function normalizeAnthropicModel(\n  input: string | undefined | null,\n  fallback: AnthropicModelAlias = \"sonnet\",\n): string {\n  if (!input) return fallback;\n  if ((ANTHROPIC_MODEL_ALIASES as readonly string[]).includes(input)) return input;\n  if (ANTHROPIC_FULL_ID_PATTERN.test(input)) return input;\n  if (BEDROCK_MODEL_ID_PATTERN.test(input) || VERTEX_MODEL_ID_PATTERN.test(input)) return input;\n  // Family fallback is restricted to the rolling *aliases* — `fable` has no\n  // Claude Code alias, so a malformed `claude-fable-*` falls through to\n  // `fallback` rather than to an alias the runtime would reject.\n  const familyMatch = input.match(/claude-(opus|sonnet|haiku)/i);\n  if (familyMatch) return familyMatch[1]!.toLowerCase() as AnthropicModelAlias;\n  return fallback;\n}\n\n/**\n * A model *selector* as a manifest writes it: `@role`,\n * `<providerId>/<modelId>`, a bare provider-side id, or an Anthropic alias.\n * Resolved against the provider registry — and only then checked against the\n * selected entry's own vocabulary — by `resolveManifestModel`\n * (`@skaile/workspaces/bridge`).\n *\n * Structural on purpose. An agent manifest is portable across providers: it\n * cannot know which registry entry will serve it, so an id-vocabulary check\n * here would enforce one endpoint's namespace on every other one. That check\n * belongs to {@link modelIdSchemaForTarget}, at the point where the endpoint is\n * known.\n *\n * @since 3.21.0\n */\nexport const ModelSelectorSchema = z\n  .string()\n  .regex(\n    /^\\S+$/,\n    'Model selector must be a non-empty string with no whitespace: \"@role\", \"provider/model\", a model ID, or an Anthropic alias.',\n  );\n\nconst ModelConfigSchema = z.looseObject({\n  preferred: ModelSelectorSchema.optional(),\n  fallback: z.array(ModelSelectorSchema).optional(),\n  constraints: z\n    .looseObject({\n      temperature: z.number().optional(),\n      max_tokens: z.number().optional(),\n    })\n    .optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Composition binding types (Task 1.7)\n// ---------------------------------------------------------------------------\n\nexport const BindingValues = [\"discoverable\", \"inline-live\", \"inline-snapshot\"] as const;\nexport const BindingSchema = z.enum(BindingValues);\nexport type Binding = z.infer<typeof BindingSchema>;\n\n/**\n * A single composition item within an agent's `composes:` field.\n *\n * - `kind`: the asset kind being composed (skill, connector, ruleset, etc.)\n * - `ref`: asset ref (e.g. '@skaile/gmail@^1')\n * - `instance`: optional Library Instance ref to reuse (e.g. 'library://personal/instances/uuid')\n * - `binding`: how the asset integrates into the agent runtime; defaults per-kind\n */\nexport const AgentComposeItemSchema = z.object({\n  kind: z.string().min(1),\n  ref: z.string().min(1),\n  instance: z.string().optional(),\n  binding: BindingSchema.optional(),\n});\n\nexport type AgentComposeItem = z.infer<typeof AgentComposeItemSchema>;\n\n// ---------------------------------------------------------------------------\n// Agent manifest\n// ---------------------------------------------------------------------------\n\n/**\n * Declared tool restrictions for an agent.\n *\n * `allowed` is an allowlist: when non-empty, the agent may invoke only these\n * tools. `denied` is a denylist applied on top. An absent block (or two empty\n * arrays) means \"no restriction\" — the harness's full default toolset.\n *\n * Tool names are written in the canonical Claude Code vocabulary (`Read`,\n * `Write`, `Bash`, `WebSearch`, …). Each driver maps them onto its own\n * runtime: `claude-sdk` passes them through as `allowedTools` /\n * `disallowedTools`; the omp driver translates them to omp's built-in tool\n * names and passes `--tools`. A name a harness does not recognize is dropped\n * for that harness rather than failing the manifest, because the same manifest\n * is expected to run on more than one harness.\n *\n * This was previously an undeclared field that survived only because\n * {@link AgentManifestSchema} is a loose object — so `AgentManifest.tools` was\n * typed `unknown` and every consumer read it through a cast.\n *\n * @since 1.5.0\n */\nexport const AgentToolsSchema = z.looseObject({\n  /** Tool names the agent may invoke. Empty or absent means \"no allowlist\". */\n  allowed: z.array(z.string().min(1)).optional(),\n  /** Tool names the agent must not invoke. Applied after `allowed`. */\n  denied: z.array(z.string().min(1)).optional(),\n});\n\nexport type AgentTools = z.infer<typeof AgentToolsSchema>;\n\nexport const AgentManifestSchema = z.looseObject({\n  spec_version: z.string().optional(),\n  name: z.string().min(1),\n  version: z.string().optional(),\n  description: z.string().min(1),\n  extends: z.string().optional(),\n\n  model: ModelConfigSchema.optional(),\n  tools: AgentToolsSchema.optional(),\n  skills: z.array(z.string()).optional(),\n  delegation: z.looseObject({ mode: z.string() }).optional(),\n  runtime: z\n    .looseObject({\n      max_turns: z.number().optional(),\n      timeout: z.number().optional(),\n    })\n    .optional(),\n\n  author: z.string().optional(),\n  license: z.string().optional(),\n  tags: z.array(z.string()).optional(),\n  keywords: z.array(z.string()).optional(),\n\n  // v2 composition (Task 1.7)\n  composes: z.array(AgentComposeItemSchema).optional(),\n\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type AgentManifest = z.infer<typeof AgentManifestSchema>;\n\nexport function validateAgent(data: unknown): ManifestValidationResult<AgentManifest> {\n  return validateManifest(AgentManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { FieldSchema, type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const ConnectorManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  entry: z.string().min(1),\n  npm_deps: z\n    .object({\n      required: z.array(z.string()).optional(),\n      optional: z.array(z.string()).optional(),\n    })\n    .optional(),\n  fields: z.array(FieldSchema).optional(),\n  health_check: z.string().nullable().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n});\n\nexport type ConnectorManifest = z.infer<typeof ConnectorManifestSchema>;\n\nexport function validateConnector(data: unknown): ManifestValidationResult<ConnectorManifest> {\n  return validateManifest(ConnectorManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { FieldSchema, type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const MountManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  entry: z.string().min(1),\n  fields: z.array(FieldSchema).optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n});\n\nexport type MountManifest = z.infer<typeof MountManifestSchema>;\n\nexport function validateMount(data: unknown): ManifestValidationResult<MountManifest> {\n  return validateManifest(MountManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  ArtifactRefSchema,\n  CommonMetadataSchema,\n  FilePrerequisiteSchema,\n  type ManifestValidationResult,\n  UserInputSchema,\n  validateManifest,\n} from \"./_shared.js\";\n\nconst SkillMetadataSchema = CommonMetadataSchema.extend({\n  parameters: z.record(z.string(), z.unknown()).optional(),\n  artifacts: z\n    .object({\n      requires: z.array(ArtifactRefSchema).optional(),\n      produces: z.array(ArtifactRefSchema).optional(),\n      consumes: z.array(ArtifactRefSchema).optional(),\n    })\n    .optional(),\n  prerequisites: z\n    .object({\n      files: z.array(FilePrerequisiteSchema).optional(),\n      inputs_required: z.array(UserInputSchema).optional(),\n      inputs_optional: z.array(UserInputSchema).optional(),\n      // Parsed by the resolver's parseSkillRequirements; Zod would strip them otherwise.\n      reads: z.array(z.object({ path: z.string(), description: z.string().optional() })).optional(),\n      produces: z\n        .array(z.object({ path: z.string(), description: z.string().optional() }))\n        .optional(),\n      resources: z\n        .array(\n          z.object({\n            id: z.string(),\n            operations: z.array(z.string()).optional(),\n            optional: z.boolean().optional(),\n            description: z.string().optional(),\n          }),\n        )\n        .optional(),\n      connectors: z\n        .array(\n          z.object({\n            driver: z.string(),\n            access: z.enum([\"read-only\", \"read-write\"]).optional(),\n          }),\n        )\n        .optional(),\n    })\n    .optional(),\n  produces: z.array(z.object({ path: z.string(), description: z.string().optional() })).optional(),\n});\n\nexport const SkillManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  license: z.string().optional(),\n  compatibility: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  // agentskills.io standard field. Kept as `unknown` (not `string`) so a legacy\n  // array form never hard-fails validateSkill — the string-typing rule is\n  // advisory, owned by checkAgentSkillConformance (warn, not error).\n  \"allowed-tools\": z.unknown().optional(),\n\n  // Legacy fields (SKILL.md convention)\n  source: z.string().optional(),\n  user_inputs: z.array(UserInputSchema).optional(),\n  reads_from: z.array(z.string()).optional(),\n  writes_to: z.array(z.string()).optional(),\n\n  metadata: SkillMetadataSchema.optional(),\n});\n\nexport type SkillManifest = z.infer<typeof SkillManifestSchema>;\n\nexport function validateSkill(data: unknown): ManifestValidationResult<SkillManifest> {\n  return validateManifest(SkillManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const ContractManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type ContractManifest = z.infer<typeof ContractManifestSchema>;\n\nexport function validateContract(data: unknown): ManifestValidationResult<ContractManifest> {\n  return validateManifest(ContractManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const McpServerManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.union([z.string(), z.number()]).optional(),\n  // \"http\" is the runtime literal the runner honours (StreamableHTTPClientTransport);\n  // \"streamable-http\" is accepted as an MCP-spec-aligned alias and normalized to\n  // \"http\" in mcpDeclFromCatalogEntry. Keep both until the alias is retired.\n  transport: z.enum([\"stdio\", \"sse\", \"http\", \"streamable-http\"]).optional(),\n  command: z.string().optional(),\n  args: z.array(z.string()).optional(),\n  env: z.record(z.string(), z.string()).optional(),\n  url: z.string().optional(),\n  headers: z.record(z.string(), z.string()).optional(),\n  /** Remote only: PEM CA certificate (or a secret ref to one) pinned for this server's TLS. */\n  ca: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  // Optional runnable payload fetched + sha256-verified by the platform\n  // session-materializer into the asset dir at materialize time (e.g. a bundled\n  // server.js shipped as a GitHub release asset). `dest` defaults to the URL\n  // basename.\n  payload: z\n    .object({\n      // https only — bare `z.string().url()` also accepts file:/data:/javascript: schemes.\n      url: z\n        .string()\n        .url()\n        .refine((u) => u.startsWith(\"https://\"), { message: \"payload url must be https\" }),\n      sha256: z.string().regex(/^[a-f0-9]{64}$/),\n      // Plain filename, no path separators — schema-level guard against a traversal dest.\n      dest: z\n        .string()\n        .regex(/^[^/\\\\]+$/, { message: \"dest must be a plain filename, not a path\" })\n        .optional(),\n    })\n    .optional(),\n});\n\nexport type McpServerManifest = z.infer<typeof McpServerManifestSchema>;\n\nexport function validateMcpServer(data: unknown): ManifestValidationResult<McpServerManifest> {\n  return validateManifest(McpServerManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const PromptManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type PromptManifest = z.infer<typeof PromptManifestSchema>;\n\nexport function validatePrompt(data: unknown): ManifestValidationResult<PromptManifest> {\n  return validateManifest(PromptManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const PersonaManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type PersonaManifest = z.infer<typeof PersonaManifestSchema>;\n\nexport function validatePersona(data: unknown): ManifestValidationResult<PersonaManifest> {\n  return validateManifest(PersonaManifestSchema, data);\n}\n","/**\n * Polymorphic Preset manifest schema.\n *\n * A Preset is the unified composition + configuration primitive. Items can be:\n * - Asset ref (plain or with inline config + placeholders)\n * - Library Instance ref (`library://tier/instances/id`)\n * - Nested Preset ref (resolved recursively, max depth 3)\n *\n * Apply semantics derive from ref type, not an explicit mode field.\n */\nimport * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\n// ---------------------------------------------------------------------------\n// Placeholder types\n// ---------------------------------------------------------------------------\n\nconst PlaceholderTypeValues = [\n  \"text\",\n  \"multiline\",\n  \"secret\",\n  \"number\",\n  \"boolean\",\n  \"enum\",\n  \"oauth\",\n  \"instance-picker\",\n] as const;\n\nexport const PlaceholderTypeSchema = z.enum(PlaceholderTypeValues);\n\nexport const PlaceholderSchema = z.object({\n  key: z.string().min(1),\n  prompt: z.string().optional(),\n  type: PlaceholderTypeSchema.optional(),\n  required: z.boolean().optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Compose item (for agents within presets)\n// ---------------------------------------------------------------------------\n\nconst ComposeRefSchema = z.object({\n  kind: z.string().min(1),\n  ref: z.string().min(1),\n});\n\n// ---------------------------------------------------------------------------\n// Preset item\n// ---------------------------------------------------------------------------\n\nexport const PresetItemSchema = z.looseObject({\n  /** Asset ref, Library Instance ref, or nested Preset ref. */\n  ref: z.string().min(1),\n  /** Local item ID for cross-item references (#item-id). */\n  id: z.string().optional(),\n  /** Author-prefilled non-secret config values. */\n  config: z.record(z.string(), z.unknown()).optional(),\n  /** User/secret values prompted at install. */\n  placeholders: z.array(PlaceholderSchema).optional(),\n  /** How placeholder values fold into the Instance config. */\n  materialize: z.record(z.string(), z.string()).optional(),\n  /** Composition for agent items. */\n  composes: z.array(ComposeRefSchema).optional(),\n  /** Outer-Preset-author-supplied placeholder values for nested Presets. */\n  inputs: z.record(z.string(), z.unknown()).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Preset-level input (rare, shared across items)\n// ---------------------------------------------------------------------------\n\nconst PresetInputSchema = z.object({\n  key: z.string().min(1),\n  type: PlaceholderTypeSchema.optional(),\n  prompt: z.string().optional(),\n  required: z.boolean().optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Source (git repo backing non-factory dependencies)\n// ---------------------------------------------------------------------------\n\n/** A `{url, pin?}` source the preset's dependencies resolve from (mirrors `SourceEntry`). */\nexport const PresetSourceSchema = z.object({\n  url: z.string().min(1),\n  pin: z.string().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Preset manifest\n// ---------------------------------------------------------------------------\n\nexport const PresetManifestSchema = z.looseObject({\n  publisher: z.string().optional(),\n  name: z.string().min(1),\n  version: z.union([z.string(), z.number()]),\n  description: z.string().min(1),\n  category: z.string().optional(),\n  license: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n\n  /** 1+ polymorphic items. */\n  items: z.array(PresetItemSchema).min(1),\n\n  /** Preset-level inputs shared across items (rare). */\n  inputs: z.array(PresetInputSchema).optional(),\n\n  /** Git sources the dependency items resolve from; `apply` registers these first. */\n  sources: z.array(PresetSourceSchema).optional(),\n});\n\nexport type PresetManifest = z.infer<typeof PresetManifestSchema>;\nexport type PresetItem = z.infer<typeof PresetItemSchema>;\nexport type PresetSource = z.infer<typeof PresetSourceSchema>;\nexport type Placeholder = z.infer<typeof PlaceholderSchema>;\n\nexport function validatePreset(data: unknown): ManifestValidationResult<PresetManifest> {\n  return validateManifest(PresetManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const RulesetManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type RulesetManifest = z.infer<typeof RulesetManifestSchema>;\n\nexport function validateRuleset(data: unknown): ManifestValidationResult<RulesetManifest> {\n  return validateManifest(RulesetManifestSchema, data);\n}\n","/**\n * Asset manifest schemas for all 11 kinds + Preset.\n *\n * Each kind exports:\n * - <Kind>ManifestSchema (zod)\n * - <Kind>Manifest (type)\n * - validate<Kind>(data) -> ManifestValidationResult\n */\n\nexport type {\n  AssetKind,\n  ManifestValidationFailure,\n  ManifestValidationResult,\n  ManifestValidationSuccess,\n} from \"./_shared.js\";\n// Shared\nexport {\n  ArtifactRefSchema,\n  AssetKindSchema,\n  AssetKindValues,\n  BaseFrontmatterSchema,\n  CommonMetadataSchema,\n  FieldSchema,\n  FilePrerequisiteSchema,\n  UserInputSchema,\n  validateManifest,\n} from \"./_shared.js\";\nexport type {\n  AgentComposeItem,\n  AgentManifest,\n  AgentTools,\n  AnthropicModelAlias,\n  AnthropicModelFamily,\n  Binding,\n  ModelIdTarget,\n} from \"./agent.js\";\nexport {\n  AgentComposeItemSchema,\n  AgentManifestSchema,\n  AgentToolsSchema,\n  ANTHROPIC_FIRST_PARTY_HOSTS,\n  ANTHROPIC_FULL_ID_PATTERN,\n  ANTHROPIC_MODEL_ALIASES,\n  ANTHROPIC_MODEL_FAMILIES,\n  BEDROCK_MODEL_ID_PATTERN,\n  BindingSchema,\n  BindingValues,\n  FreeFormModelIdSchema,\n  isFirstPartyAnthropicEndpoint,\n  ModelIdSchema,\n  modelIdSchemaForCloud,\n  modelIdSchemaForTarget,\n  ModelSelectorSchema,\n  normalizeAnthropicModel,\n  requiresAnthropicModelId,\n  validateAgent,\n  VERTEX_MODEL_ID_PATTERN,\n} from \"./agent.js\";\nexport type { ConnectorManifest } from \"./connector.js\";\nexport { ConnectorManifestSchema, validateConnector } from \"./connector.js\";\nexport type { MountManifest } from \"./mount.js\";\nexport { MountManifestSchema, validateMount } from \"./mount.js\";\nexport type { SkillManifest } from \"./skill.js\";\n// Per-kind\nexport { SkillManifestSchema, validateSkill } from \"./skill.js\";\n\n// NOTE: FlowManifestSchema, FlowManifest, validateFlow live in @skaile/workspaces/factory-assets/connectors/flow/engine.\n// Import from @skaile/workspaces/factory-assets/connectors/flow/engine directly.\n\nexport type { ContractManifest } from \"./contract.js\";\nexport { ContractManifestSchema, validateContract } from \"./contract.js\";\nexport type { McpServerManifest } from \"./mcp-server.js\";\nexport { McpServerManifestSchema, validateMcpServer } from \"./mcp-server.js\";\nexport type { PromptManifest } from \"./prompt.js\";\nexport { PromptManifestSchema, validatePrompt } from \"./prompt.js\";\n\n// NOTE: KnowledgeManifestSchema, KnowledgeManifest, validateKnowledge moved to @skaile/library in 1.7.4.\n// Import from @skaile/library directly.\n\nexport type { PersonaManifest } from \"./persona.js\";\nexport { PersonaManifestSchema, validatePersona } from \"./persona.js\";\nexport type { Placeholder, PresetItem, PresetManifest, PresetSource } from \"./preset.js\";\n// Preset (composition entity, not an asset kind)\nexport {\n  PlaceholderSchema,\n  PlaceholderTypeSchema,\n  PresetItemSchema,\n  PresetManifestSchema,\n  PresetSourceSchema,\n  validatePreset,\n} from \"./preset.js\";\nexport type { RulesetManifest } from \"./ruleset.js\";\nexport { RulesetManifestSchema, validateRuleset } from \"./ruleset.js\";\n\n// ---------------------------------------------------------------------------\n// Kind-to-validator lookup\n// ---------------------------------------------------------------------------\n\nimport type { AssetKind, ManifestValidationResult } from \"./_shared.js\";\nimport { validateAgent } from \"./agent.js\";\nimport { validateConnector } from \"./connector.js\";\nimport { validateContract } from \"./contract.js\";\nimport { validateMcpServer } from \"./mcp-server.js\";\nimport { validateMount } from \"./mount.js\";\nimport { validatePersona } from \"./persona.js\";\nimport { validatePrompt } from \"./prompt.js\";\nimport { validateRuleset } from \"./ruleset.js\";\nimport { validateSkill } from \"./skill.js\";\n\n/**\n * Validators for core kinds that still live in this package.\n * flow: lives in @skaile/workspaces/factory-assets/connectors/flow/engine\n * knowledge: lives in @skaile/library\n *\n * For kinds not in this map, use the IAssetKindRegistry from @skaile/plugins.\n */\nconst validators: Partial<Record<AssetKind, (data: unknown) => ManifestValidationResult<unknown>>> =\n  {\n    skill: validateSkill,\n    agent: validateAgent,\n    connector: validateConnector,\n    mount: validateMount,\n    contract: validateContract,\n    prompt: validatePrompt,\n    \"mcp-server\": validateMcpServer,\n    persona: validatePersona,\n    ruleset: validateRuleset,\n  };\n\n/**\n * Validate a manifest against the schema for the given asset kind.\n *\n * NOTE: flow validation lives in @skaile/workspaces/factory-assets/connectors/flow/engine. Use the\n * IAssetKindRegistry for kind-agnostic validation that includes all\n * registered providers (including extension kinds).\n */\nexport function validateByKind(kind: AssetKind, data: unknown): ManifestValidationResult<unknown> {\n  const validator = validators[kind];\n  if (!validator) {\n    return { ok: false, errors: [{ path: \"kind\", message: `Unknown asset kind: ${kind}` }] };\n  }\n  return validator(data);\n}\n"]}

package/dist/chunk-6BEGKO2Q.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../secrets/src/lifecycle.ts","../secrets/src/providers/env.ts","../secrets/src/providers/local.ts","../secrets/src/router.ts","../secrets/src/index.ts"],"names":["provider"],"mappings":";;;;;;;AAuCO,IAAM,6BAAN,MAAiC;AAAA,EAC9B,MAAA;AAAA;AAAA;AAAA;AAAA,EAKR,WAAA,CAAY,QAAuB,OAAA,EAA8C;AAC/E,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,aAAA,EAA+C;AAGnE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA;AAC3C,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,IACtD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAkB,OAAO,sBAAA,EAAuB;AAAA,IACrF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,aAAA,EAAyC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AACzC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACnDA,IAAM,qBAAA,mBAAwB,IAAI,IAAA,CAAK,CAAC,CAAA;AAEjC,IAAM,qBAAN,MAAqD;AAAA,EACjD,EAAA,GAAK,KAAA;AAAA,EAEd,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvC;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,MAAA,EAAoB,KAAA,EAAyC;AACzF,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,aAAa,IAAA,EAA6B;AAC9C,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAClC,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AAKA,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,qBAAA;AAAA,MACX,SAAA,EAAW,qBAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;ACnDA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,aAAA,GAAgB,QAAA;AAEtB,IAAM,gBAAA,GAAmB,gBAAA;AACzB,IAAM,gBAAA,GAAmB,YAAA;AAGzB,IAAM,cAAA,GAAiB,2BAAA;AAoBvB,SAAS,eAAA,CAAgB,YAAoB,IAAA,EAAsB;AACjE,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,iBAAA,EAAmB,YAAY,aAAa,CAAA;AACzF;AAEA,SAAS,oBAAA,GAA+B;AAEtC,EAAA,OAAO,UAAa,EAAA,CAAA,QAAA,EAAU,CAAA,CAAA,EAAO,EAAA,CAAA,QAAA,GAAW,QAAQ,CAAA,CAAA;AAC1D;AAGA,SAAS,eAAe,UAAA,EAA4B;AAClD,EAAA,OAAc,kBAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACpE;AAMA,SAAS,UAAU,GAAA,EAAqB;AACtC,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC1E;AAMA,SAAS,OAAA,CAAQ,MAAkB,GAAA,EAAqB;AACtD,EAAA,MAAM,EAAA,GAAY,mBAAY,SAAS,CAAA;AACvC,EAAA,MAAM,MAAA,GAAgB,sBAAe,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC3F,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,EAAA,EAAI,OAAA,EAAS,SAAS,CAAC,CAAA;AAC/C;AAEA,SAAS,OAAA,CAAQ,MAAc,GAAA,EAAqB;AAClD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,CAAA,EAAG,SAAS,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,YAAY,eAAe,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,QAAA,CAAS,SAAA,GAAY,eAAe,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAkB,wBAAiB,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC/F,EAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACtE;AAMO,IAAM,uBAAN,MAAuD;AAAA,EACnD,EAAA,GAAK,OAAA;AAAA,EACN,UAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAC3B,IAAA,GAAsB,IAAA;AAAA,EACtB,QAAA,GAAwB,SAAA;AAAA,EAEhC,YAAY,UAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,aAAa,UAAA,IAAmB,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,WAAW,SAAS,CAAA;AAAA,EAC9E;AAAA;AAAA,EAIQ,SAAA,GAAkB;AACxB,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,EAAG;AACnC,MAAG,EAAA,CAAA,SAAA,CAAU,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,gBAAA,GAA2B;AACjC,IAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,OAAU,gBAAa,QAAQ,CAAA;AAAA,IACjC;AACA,IAAA,MAAM,IAAA,GAAc,mBAAY,WAAW,CAAA;AAC3C,IAAG,iBAAc,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAA,GAA2B;AACvC,IAAA,IAAI,KAAK,SAAA,EAAW;AAEpB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,gBAAA,EAAiB;AAGlC,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,IAAA,CAAK,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,EAAE,IAAA,EAAK;AAAA,IAC9D,CAAA,MAAO;AAEL,MAAA,IAAA,CAAK,QAAA,GAAY,MAAM,IAAA,CAAK,mBAAA,KAAyB,UAAA,GAAa,SAAA;AAClE,MAAG,iBAAc,YAAA,EAAc,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,wBAAA,CAAyB,KAAK,QAAQ,CAAA;AACpE,IAAA,IAAA,CAAK,SAAA,GAAY,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAAA,EACxD;AAAA,EAEA,MAAc,mBAAA,GAAwC;AACpD,IAAA,IAAI;AAGF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AACxE,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,GAAgB,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACjD,QAAA,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAA,EAAkB,gBAAA,EAAkB,MAAM,CAAA;AAAA,MACrE;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,yBAAyB,QAAA,EAAwC;AAC7E,IAAA,QAAQ,QAAA;AAAU,MAChB,KAAK,UAAA,EAAY;AACf,QAAA,IAAI;AAGF,UAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AAC1E,UAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,QACrB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,QAAA,IAAI,aAAA,EAAe;AAEjB,UAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,UAAA,IAAO,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,YAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC7D,YAAA,IAAI,cAAA,CAAe,aAAa,CAAA,KAAM,UAAA,EAAY;AAChD,cAAA,MAAM,IAAI,YAAA;AAAA,gBACR,mBAAmB,cAAc,CAAA,kFAAA,CAAA;AAAA,gBAEjC;AAAA,eACF;AAAA,YACF;AAAA,UACF;AACA,UAAA,OAAO,aAAA;AAAA,QACT;AAIA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,6BAAA,EAAgC,cAAc,CAAA,8CAAA,EACR,cAAc,CAAA,MAAA,CAAA;AAAA,UACpD;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,SAAA;AACH,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AACE,QAAA,OAAO,oBAAA,EAAqB;AAAA;AAChC,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CAAe,QAAA,EAAuB,UAAA,EAAoC;AAC9E,IAAA,IAAA,CAAK,SAAA,EAAU;AAIf,IAAA,MAAM,mBAAA,GAAsB,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEpE,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,sDAAsD,cAAc,CAAA,CAAA,CAAA;AAAA,UACpE;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC/C,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,wBAAA,CAAyB,OAAA,EAAS,2BAA2B,CAAA;AAAA,MACzE;AAAA,IACF;AAOA,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AACnC,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,KAAK,SAAA,EAAU;AACrB,MAAA,MAAM,SAAS,IAAA,CAAK,SAAA;AAGpB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,MAAA,MAAM,aAAA,GACJ,QAAA,KAAa,YAAA,GACT,mBAAA,GACA,QAAA,KAAa,UAAA,GACX,MAAM,IAAA,CAAK,wBAAA,CAAyB,UAAU,CAAA,GAC9C,oBAAA,EAAqB;AAC7B,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,aAAA,EAAe,IAAI,CAAA;AAOlD,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,QAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AACtC,UAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AAC7C,UAAG,iBAAc,QAAA,EAAU,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,QACzD,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,QACrB;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sEACK,MAAA,CAAO,MAAM,eAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,mFAAA;AAAA,SAEpD;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,MAAG,EAAA,CAAA,aAAA,CAAc,YAAY,cAAA,CAAe,mBAAoB,GAAG,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAG,iBAAc,YAAA,EAAc,QAAA,EAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AACxD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,cAAA,GAA8B;AAC5B,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,OAAU,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAA,CAAE,IAAA,EAAK;AAAA,IACrD;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA,EAIQ,YAAY,GAAA,EAAqB;AACvC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,IAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,aAAa,GAAA,EAAqB;AACxC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,UAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,SAAS,GAAA,EAAqB;AACpC,IAAA,OAAY,UAAK,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,YAAA,CAAa,GAAG,CAAC,CAAA;AAAA,EAC1D;AAAA,EAEQ,YAAA,GAAyB;AAC/B,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,SAAU,EAAC;AAC7C,IAAA,OAAU,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACzE;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,IAAA,CAAK,SAAU,CAAA;AAG/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC1D,QAAA,IAAA,CAAK,cAAA,GAAA,iBAAiB,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAC7C,QAAG,EAAA,CAAA,aAAA,CAAc,UAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,MAClE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,WAAW,SAAS,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,EAAO,IAAA,CAAK,SAAU,CAAA;AAChD,IAAG,iBAAc,QAAA,EAAU,SAAA,EAAW,EAAE,IAAA,EAAM,KAAO,CAAA;AAGrD,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,GAAA;AAAA,MACA,SAAA,EAAW,SAAS,SAAA,IAAa,GAAA;AAAA,MACjC,SAAA,EAAW,GAAA;AAAA,MACX,cAAA,EAAgB,GAAA;AAAA,MAChB,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,IAAA,CAAK,QAAA,KAAa,EAAC;AAAA,MACpD,GAAI,IAAA,EAAM,UAAA,GACN,EAAE,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY,KACvE;AAAC,KACP;AACA,IAAG,EAAA,CAAA,aAAA,CAAc,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAG,cAAW,QAAQ,CAAA;AACtB,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAG,cAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAA,CAAK,SAAA,EAAU;AAEf,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,YAAY,CAAC,CAAA;AACxF,IAAA,IAAI,OAAiB,EAAC;AACtB,IAAA,KAAA,MAAW,MAAM,SAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,UAAA,EAAY,EAAE,CAAA,EAAG,OAAO,CAAC,CAAA;AAChF,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,MAClC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,SAAA,EAAU;AAErB,MAAA,MAAM,UAAU,CAAA,OAAA,EAAiB,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AAC/D,MAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,SAAS,CAAA;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,aAAa,OAAO,CAAA;AAC/B,MAAA,IAAI,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACnD;AACA,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAW,IAAA,CAAK,GAAA,KAAQ,KAAA,EAAM;AAAA,IACnD,SAAS,CAAA,EAAG;AACV,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,QACxB,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC;AAAA,OAClD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,GAAA,EAAK,IAAI,GAAA,IAAO,GAAA;AAAA,QAChB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,gBAAgB,GAAA,CAAI,cAAA,GAAiB,IAAI,IAAA,CAAK,GAAA,CAAI,cAAc,CAAA,GAAI,MAAA;AAAA,QACpE,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAU,YAAS,QAAQ,CAAA;AACjC,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,KAAA;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;;;ACtZO,IAAM,gBAAN,MAAoB;AAAA,EACjB,SAAA,uBAAgB,GAAA,EAA8B;AAAA,EAC9C,MAAA;AAAA,EACA,QAAqB,EAAC;AAAA;AAAA,EAG9B,eAAA;AAAA,EACA,cAAA;AAAA,EAEA,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA,EAIA,SAAS,QAAA,EAAkC;AACzC,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC1C;AAAA,EAEA,WAAW,EAAA,EAAkB;AAC3B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,EAC1B;AAAA,EAEA,aAAA,GAA0B;AACxB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAA,EAClC;AAAA;AAAA,EAIA,QAAQ,IAAA,EAAuB;AAC7B,IAAA,IAAA,CAAK,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACtB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,SAAA,EAA4C,UAAA,EAA0B;AAC9F,IAAA,MAAM,KAAA,GAA4B;AAAA,MAChC,cAAA,EAAgB,GAAA;AAAA,MAChB,SAAA;AAAA,MACA,WAAA,EAAa,UAAA;AAAA,MACb,mBAAmB,IAAA,CAAK,eAAA;AAAA,MACxB,kBAAkB,IAAA,CAAK,cAAA;AAAA,MACvB,SAAA,sBAAe,IAAA;AAAK,KACtB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIQ,QAAQ,GAAA,EAA+B;AAE7C,IAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO;AACpC,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,MAAMA,SAAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,KAAK,WAAW,CAAA;AACpD,UAAA,IAAIA,WAAU,OAAOA,SAAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,KAAK,MAAA,CAAO,gBAAA;AAAA,QACZ,CAAA,uCAAA,EAA0C,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,UAAU,GAAG,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,IAAI,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,QAAA,CAAS,EAAE,CAAA;AACpC,IAAA,OAAO,QAAA,CAAS,aAAa,GAAG,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AAIxD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,CAAS,EAAE,CAAA;AAClC,IAAA,OAAO,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAA,EAAY,QAAA,CAAS,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,CAAS,YAAY,GAAG,CAAA;AAAA,EACjC;AAAA,EAEA,gBAAgB,UAAA,EAAkD;AAChE,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,EAAU,iBAAgB,IAAK,IAAA;AAAA,EACxC;AAAA,EAEA,MAAM,eACJ,UAAA,EAC8D;AAC9D,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,UAAA,EAAa,EAAE,CAAA,gBAAA,CAAA,EAAmB;AAAA,IAC/D;AACA,IAAA,OAAO,SAAS,cAAA,EAAe;AAAA,EACjC;AACF;;;ACvNO,IAAM,OAAA,GAAU","file":"chunk-6BEGKO2Q.js","sourcesContent":["/**\n * CredentialLifecycleService — manages OAuth token refresh outside the SecretsRouter.\n *\n * Works with opaque token blobs stored via the {@link SecretsRouter}; providers remain\n * OAuth-unaware. Phase 1 ships non-OAuth paths (always returns `not_applicable`).\n * Full proactive OAuth refresh with expiry checking ships in Phase 3.4.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\n\nimport type { SecretsRouter } from \"./router.js\";\n\n/**\n * Configuration for {@link CredentialLifecycleService}.\n *\n * Controls how aggressively the service proactively refreshes credentials before they expire.\n * The default lead time is 300 seconds (5 minutes).\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface CredentialLifecycleConfig {\n  /** How far before expiry to trigger a proactive refresh (seconds). */\n  refreshLeadTimeSec: number;\n}\n\n/**\n * Result returned by {@link CredentialLifecycleService.refreshIfNeeded}.\n *\n * The `reason` discriminant indicates why a refresh did or did not occur.\n * An `error` string is present only when `reason` is `refresh_failed`.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface RefreshResult {\n  refreshed: boolean;\n  reason: \"not_applicable\" | \"still_valid\" | \"refreshed\" | \"refresh_failed\";\n  error?: string;\n}\n\nexport class CredentialLifecycleService {\n  private router: SecretsRouter;\n\n  // `_config` is accepted for signature stability but not stored yet: Phase 1\n  // ships no OAuth refresh, so there is nothing to configure. Phase 3.4 will\n  // store and read `refreshLeadTimeSec` when proactive refresh lands.\n  constructor(router: SecretsRouter, _config?: Partial<CredentialLifecycleConfig>) {\n    this.router = router;\n  }\n\n  /**\n   * Attempt to refresh a credential if needed.\n   * Phase 1: always returns not_applicable (no OAuth support yet).\n   */\n  async refreshIfNeeded(credentialRef: string): Promise<RefreshResult> {\n    // Phase 1: no OAuth refresh implemented.\n    // The credential exists and is valid as-is (static secrets, env vars, etc.)\n    try {\n      await this.router.getMetadata(credentialRef);\n      return { refreshed: false, reason: \"not_applicable\" };\n    } catch {\n      return { refreshed: false, reason: \"refresh_failed\", error: \"Credential not found\" };\n    }\n  }\n\n  /**\n   * Check if a credential is still valid (not expired).\n   * Phase 1: always returns true for non-OAuth credentials.\n   */\n  async isValid(credentialRef: string): Promise<boolean> {\n    try {\n      await this.router.getSecret(credentialRef);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","/**\n * EnvSecretsProvider — read-only provider that resolves secrets from environment variables.\n *\n * Refs are expected to be plain env var names (e.g. `DATABASE_URL`). The provider is\n * always available with zero configuration and requires no encryption or keychain access.\n * `setSecret` and `deleteSecret` always throw `SecretAccessDeniedError` because\n * environment variables are managed externally to the running process.\n *\n * @docLink packages/secrets/concepts#env-secrets-provider\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { SecretAccessDeniedError, SecretNotFoundError } from \"@skaile/workspaces/plugins\";\n\n/**\n * Sentinel timestamp for env secrets, which have no real created/updated time.\n * The Unix epoch is unambiguously not \"now\", so consumers can recognise it as\n * \"unknown\" rather than treating it as a genuine recent timestamp.\n */\nconst ENV_UNKNOWN_TIMESTAMP = new Date(0);\n\nexport class EnvSecretsProvider implements ISecretsProvider {\n  readonly id = \"env\";\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    return new TextEncoder().encode(value);\n  }\n\n  async setSecret(_ref: string, _value: Uint8Array, _opts?: SetSecretOptions): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async deleteSecret(_ref: string): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    let keys = Object.keys(process.env);\n    if (filter?.prefix) {\n      keys = keys.filter((k) => k.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      keys = keys.slice(0, filter.limit);\n    }\n    return keys;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    return { ok: true, latencyMs: 0 };\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    // Env vars carry no creation/modification time. `SecretMetadata` requires\n    // both fields, so use the Unix epoch as a documented \"unknown\" sentinel\n    // rather than `new Date()`, which would falsely imply the secret was just\n    // created/updated. The read-only scope summary already signals the source.\n    return {\n      ref,\n      createdAt: ENV_UNKNOWN_TIMESTAMP,\n      updatedAt: ENV_UNKNOWN_TIMESTAMP,\n      scopeSummary: \"environment variable (read-only)\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * LocalSecretsProvider — AES-256-GCM encrypted file-blob storage at `~/.skaile/secrets/`.\n *\n * Each secret is stored as a separate `.enc` file named by the SHA-256 hash of the ref\n * (collision-free, filesystem-safe). A companion `.meta.json` stores the original ref,\n * timestamps, and optional user metadata. The master key is derived via PBKDF2-SHA-512\n * from one of three {@link KeyStrategy} sources: OS keychain (keytar), a passphrase from\n * `SKAILE_SECRETS_PASSPHRASE`, or a machine-derived passphrase as last resort.\n * Switching strategies re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport {\n  ProviderUnavailableError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\nconst KEY_LENGTH = 32;\nconst PBKDF2_ITERATIONS = 100_000;\nconst PBKDF2_DIGEST = \"sha512\";\n\nconst KEYCHAIN_SERVICE = \"skaile-secrets\";\nconst KEYCHAIN_ACCOUNT = \"master-key\";\n\n/** Env var that provides the passphrase at runtime (never stored on disk). */\nconst PASSPHRASE_ENV = \"SKAILE_SECRETS_PASSPHRASE\";\n\n/**\n * Master key derivation strategy used by {@link LocalSecretsProvider}.\n *\n * - `keychain` — OS keychain (via keytar); most secure, requires keytar to be installed.\n * - `passphrase` — PBKDF2 from `SKAILE_SECRETS_PASSPHRASE` env var; portable across machines.\n * - `machine` — deterministic from hostname + username; least secure, last-resort fallback.\n *\n * The active strategy is persisted in `~/.skaile/secrets/.key-strategy`. Switching strategies\n * re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\nexport type KeyStrategy = \"keychain\" | \"passphrase\" | \"machine\";\n\n// ---------------------------------------------------------------------------\n// Key derivation\n// ---------------------------------------------------------------------------\n\nfunction deriveMasterKey(passphrase: string, salt: Buffer): Buffer {\n  return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);\n}\n\nfunction getMachinePassphrase(): string {\n  // Deterministic but not secret -- last resort only.\n  return `skaile:${os.hostname()}:${os.userInfo().username}`;\n}\n\n/** Hash a passphrase for verification (stored in .master). */\nfunction hashPassphrase(passphrase: string): string {\n  return crypto.createHash(\"sha256\").update(passphrase).digest(\"hex\");\n}\n\n// ---------------------------------------------------------------------------\n// Filename hashing (injective: sha256 of ref)\n// ---------------------------------------------------------------------------\n\nfunction refToHash(ref: string): string {\n  return crypto.createHash(\"sha256\").update(ref).digest(\"hex\").slice(0, 40);\n}\n\n// ---------------------------------------------------------------------------\n// Encryption / decryption\n// ---------------------------------------------------------------------------\n\nfunction encrypt(data: Uint8Array, key: Buffer): Buffer {\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);\n  const authTag = cipher.getAuthTag();\n  // Format: [iv (12)] [authTag (16)] [ciphertext (...)]\n  return Buffer.concat([iv, authTag, encrypted]);\n}\n\nfunction decrypt(blob: Buffer, key: Buffer): Buffer {\n  const iv = blob.subarray(0, IV_LENGTH);\n  const authTag = blob.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);\n  const ciphertext = blob.subarray(IV_LENGTH + AUTH_TAG_LENGTH);\n  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  decipher.setAuthTag(authTag);\n  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n}\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport class LocalSecretsProvider implements ISecretsProvider {\n  readonly id = \"local\";\n  private secretsDir: string;\n  private masterKey: Buffer | null = null;\n  private salt: Buffer | null = null;\n  private strategy: KeyStrategy = \"machine\";\n\n  constructor(secretsDir?: string) {\n    this.secretsDir = secretsDir ?? path.join(os.homedir(), \".skaile\", \"secrets\");\n  }\n\n  // -- Initialization --------------------------------------------------------\n\n  private ensureDir(): void {\n    if (!fs.existsSync(this.secretsDir)) {\n      fs.mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });\n    }\n  }\n\n  private loadOrCreateSalt(): Buffer {\n    const saltPath = path.join(this.secretsDir, \".salt\");\n    if (fs.existsSync(saltPath)) {\n      return fs.readFileSync(saltPath);\n    }\n    const salt = crypto.randomBytes(SALT_LENGTH);\n    fs.writeFileSync(saltPath, salt, { mode: 0o600 });\n    return salt;\n  }\n\n  private async ensureKey(): Promise<void> {\n    if (this.masterKey) return;\n\n    this.ensureDir();\n    this.salt = this.loadOrCreateSalt();\n\n    // Determine strategy\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      this.strategy = fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    } else {\n      // Auto-detect: try keychain, fall back to machine\n      this.strategy = (await this.tryKeychainStrategy()) ? \"keychain\" : \"machine\";\n      fs.writeFileSync(strategyPath, this.strategy, { mode: 0o600 });\n    }\n\n    // Derive key from strategy\n    const passphrase = await this.getPassphraseForStrategy(this.strategy);\n    this.masterKey = deriveMasterKey(passphrase, this.salt);\n  }\n\n  private async tryKeychainStrategy(): Promise<boolean> {\n    try {\n      // `keytar` is an optional OS-keychain native module the user installs\n      // themselves; the `as string` specifier keeps it out of tsc resolution.\n      const keytar = await import(\"keytar\" as string);\n      let stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n      if (!stored) {\n        stored = crypto.randomBytes(32).toString(\"base64\");\n        await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, stored);\n      }\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private async getPassphraseForStrategy(strategy: KeyStrategy): Promise<string> {\n    switch (strategy) {\n      case \"keychain\": {\n        try {\n          // `keytar` is an optional OS-keychain native module the user installs\n          // themselves; the `as string` specifier keeps it out of tsc resolution.\n          const keytar = await import(\"keytar\" as string);\n          const stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n          if (stored) return stored;\n        } catch {\n          // Keychain failed; fall through to machine\n        }\n        return getMachinePassphrase();\n      }\n      case \"passphrase\": {\n        const envPassphrase = process.env[PASSPHRASE_ENV];\n        if (envPassphrase) {\n          // Verify against stored hash if it exists\n          const masterPath = path.join(this.secretsDir, \".master\");\n          if (fs.existsSync(masterPath)) {\n            const storedHash = fs.readFileSync(masterPath, \"utf-8\").trim();\n            if (hashPassphrase(envPassphrase) !== storedHash) {\n              throw new SecretsError(\n                `Passphrase from ${PASSPHRASE_ENV} does not match stored hash. ` +\n                  \"Use skaile auth set-key-strategy passphrase to reset.\",\n                \"PASSPHRASE_MISMATCH\",\n              );\n            }\n          }\n          return envPassphrase;\n        }\n        // No env var -- hard error. Silent fallback to machine would\n        // produce a different key, causing AES-GCM auth-tag failures\n        // on secrets encrypted with the real passphrase.\n        throw new SecretsError(\n          `Strategy is \"passphrase\" but ${PASSPHRASE_ENV} is not set. ` +\n            `Export it before running: export ${PASSPHRASE_ENV}='...'`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n      case \"machine\":\n        return getMachinePassphrase();\n      default:\n        return getMachinePassphrase();\n    }\n  }\n\n  // -- Strategy management ---------------------------------------------------\n\n  /**\n   * Set the key strategy explicitly. Called by `skaile auth set-key-strategy`.\n   *\n   * When existing secrets are present, they are re-encrypted with the new key\n   * to prevent data loss from key mismatch.\n   */\n  async setKeyStrategy(strategy: KeyStrategy, passphrase?: string): Promise<void> {\n    this.ensureDir();\n\n    // --- 1. Validate new strategy prerequisites -------------------------\n\n    const effectivePassphrase = passphrase ?? process.env[PASSPHRASE_ENV];\n\n    if (strategy === \"passphrase\") {\n      if (!effectivePassphrase) {\n        throw new SecretsError(\n          `Passphrase required. Pass it as an argument or set ${PASSPHRASE_ENV}.`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n    }\n\n    if (strategy === \"keychain\") {\n      const success = await this.tryKeychainStrategy();\n      if (!success) {\n        throw new ProviderUnavailableError(\"local\", \"OS keychain not available\");\n      }\n    }\n\n    // --- 2. Load the OLD key under the current strategy -----------------\n    // ensureKey() reads the current strategy file and derives the key\n    // that was used to encrypt existing secrets. This is critical for\n    // cross-process scenarios where masterKey starts as null.\n\n    const encFiles = this.listEncFiles();\n    if (encFiles.length > 0) {\n      await this.ensureKey();\n      const oldKey = this.masterKey!;\n\n      // Derive the new key\n      const salt = this.salt!;\n      const newPassphrase =\n        strategy === \"passphrase\"\n          ? effectivePassphrase!\n          : strategy === \"keychain\"\n            ? await this.getPassphraseForStrategy(\"keychain\")\n            : getMachinePassphrase();\n      const newKey = deriveMasterKey(newPassphrase, salt);\n\n      // Re-encrypt each secret with the new key. A single failure must abort the\n      // whole switch: committing the new strategy while a secret is still under\n      // the old key orphans that secret (the registry advertises a key that no\n      // longer decrypts it). Collect failures and throw before the commit below,\n      // leaving `.key-strategy`/`.master` — and every secret — on the old key.\n      const failed: string[] = [];\n      for (const encFile of encFiles) {\n        const filePath = path.join(this.secretsDir, encFile);\n        const blob = fs.readFileSync(filePath);\n        try {\n          const plaintext = decrypt(blob, oldKey);\n          const reEncrypted = encrypt(plaintext, newKey);\n          fs.writeFileSync(filePath, reEncrypted, { mode: 0o600 });\n        } catch {\n          failed.push(encFile);\n        }\n      }\n      if (failed.length > 0) {\n        throw new Error(\n          `[skaile/secrets] Key-strategy switch aborted: could not re-encrypt ` +\n            `${failed.length} secret(s) (${failed.join(\", \")}). The previous strategy ` +\n            \"is unchanged; resolve the failing secrets before retrying.\",\n        );\n      }\n    }\n\n    // --- 3. Commit the new strategy (last write -- failure above leaves\n    //        the old strategy intact) ------------------------------------\n\n    if (strategy === \"passphrase\") {\n      const masterPath = path.join(this.secretsDir, \".master\");\n      fs.writeFileSync(masterPath, hashPassphrase(effectivePassphrase!), { mode: 0o600 });\n    }\n\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    fs.writeFileSync(strategyPath, strategy, { mode: 0o600 });\n    this.masterKey = null;\n    this.strategy = strategy;\n  }\n\n  getKeyStrategy(): KeyStrategy {\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      return fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    }\n    return \"machine\";\n  }\n\n  // -- File helpers ----------------------------------------------------------\n\n  private encFilename(ref: string): string {\n    return `${refToHash(ref)}.enc`;\n  }\n\n  private metaFilename(ref: string): string {\n    return `${refToHash(ref)}.meta.json`;\n  }\n\n  private metaPath(ref: string): string {\n    return path.join(this.secretsDir, this.metaFilename(ref));\n  }\n\n  private listEncFiles(): string[] {\n    if (!fs.existsSync(this.secretsDir)) return [];\n    return fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".enc\"));\n  }\n\n  // -- ISecretsProvider implementation ----------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    await this.ensureKey();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    const blob = fs.readFileSync(filePath);\n    const decrypted = decrypt(blob, this.masterKey!);\n\n    // Update lastAccessedAt\n    const metaFile = this.metaPath(ref);\n    if (fs.existsSync(metaFile)) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n        meta.lastAccessedAt = new Date().toISOString();\n        fs.writeFileSync(metaFile, JSON.stringify(meta), { mode: 0o600 });\n      } catch {\n        // Non-fatal\n      }\n    }\n\n    return new Uint8Array(decrypted);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    await this.ensureKey();\n    this.ensureDir();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const encrypted = encrypt(value, this.masterKey!);\n    fs.writeFileSync(filePath, encrypted, { mode: 0o600 });\n\n    // Write metadata (stores the original ref for reverse lookup)\n    const now = new Date().toISOString();\n    const metaFile = this.metaPath(ref);\n    let existing: Record<string, unknown> = {};\n    if (fs.existsSync(metaFile)) {\n      try {\n        existing = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      } catch {\n        // Overwrite corrupt meta\n      }\n    }\n    const meta = {\n      ref,\n      createdAt: existing.createdAt ?? now,\n      updatedAt: now,\n      lastAccessedAt: now,\n      ...(opts?.metadata ? { userMeta: opts.metadata } : {}),\n      ...(opts?.ttlSeconds\n        ? { expiresAt: new Date(Date.now() + opts.ttlSeconds * 1000).toISOString() }\n        : {}),\n    };\n    fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2), { mode: 0o600 });\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const metaFile = this.metaPath(ref);\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    fs.unlinkSync(filePath);\n    if (fs.existsSync(metaFile)) {\n      fs.unlinkSync(metaFile);\n    }\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    this.ensureDir();\n    // Read refs from meta files (the .enc filenames are hashes, not refs)\n    const metaFiles = fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".meta.json\"));\n    let refs: string[] = [];\n    for (const mf of metaFiles) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(path.join(this.secretsDir, mf), \"utf-8\"));\n        if (meta.ref) refs.push(meta.ref);\n      } catch {\n        // Skip corrupt meta files\n      }\n    }\n    if (filter?.prefix) {\n      refs = refs.filter((r) => r.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      refs = refs.slice(0, filter.limit);\n    }\n    return refs;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const start = Date.now();\n    try {\n      await this.ensureKey();\n      // Write + read + delete a test secret\n      const testRef = `__test_${crypto.randomBytes(4).toString(\"hex\")}`;\n      const testValue = new TextEncoder().encode(\"test\");\n      await this.setSecret(testRef, testValue);\n      const read = await this.getSecret(testRef);\n      await this.deleteSecret(testRef);\n      if (new TextDecoder().decode(read) !== \"test\") {\n        return { ok: false, error: \"Round-trip mismatch\" };\n      }\n      return { ok: true, latencyMs: Date.now() - start };\n    } catch (e) {\n      return {\n        ok: false,\n        latencyMs: Date.now() - start,\n        error: e instanceof Error ? e.message : String(e),\n      };\n    }\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const metaFile = this.metaPath(ref);\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    if (fs.existsSync(metaFile)) {\n      const raw = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      return {\n        ref: raw.ref ?? ref,\n        createdAt: new Date(raw.createdAt),\n        updatedAt: new Date(raw.updatedAt),\n        lastAccessedAt: raw.lastAccessedAt ? new Date(raw.lastAccessedAt) : undefined,\n        owner: raw.owner,\n        scopeSummary: \"local encrypted file\",\n      };\n    }\n    // Fallback: derive from file stat\n    const stat = fs.statSync(filePath);\n    return {\n      ref,\n      createdAt: stat.birthtime,\n      updatedAt: stat.mtime,\n      scopeSummary: \"local encrypted file\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * SecretsRouter — audit chokepoint for all secret operations.\n *\n * Registers {@link ISecretsProvider} implementations by id, routes credential refs by\n * prefix or via routing config, and emits {@link CredentialAccessed} events for every\n * get, set, delete, list, and metadata operation. Routing rules are evaluated top-to-bottom;\n * the first matching prefix wins and falls back to the configured default provider.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { ProviderUnavailableError } from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Audit event\n// ---------------------------------------------------------------------------\n\n/**\n * Audit event emitted by {@link SecretsRouter} after every secret operation.\n *\n * Delivered synchronously to all registered {@link AuditSink} functions. Errors thrown\n * by sinks are swallowed to ensure they never break the underlying secret operation.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface CredentialAccessed {\n  credential_ref: string;\n  operation: \"get\" | \"set\" | \"delete\" | \"list\" | \"metadata\";\n  provider_id: string;\n  caller_session_id?: string;\n  caller_tool_call?: string;\n  timestamp: Date;\n}\n\n/**\n * Callback function that receives {@link CredentialAccessed} audit events from {@link SecretsRouter}.\n *\n * Register sinks via `SecretsRouter.addSink()`. Sinks run synchronously after each operation;\n * exceptions are caught and suppressed so they cannot interrupt credential resolution.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport type AuditSink = (event: CredentialAccessed) => void;\n\n// ---------------------------------------------------------------------------\n// Routing config\n// ---------------------------------------------------------------------------\n\n/**\n * A single routing rule that maps a credential ref prefix to a provider.\n *\n * Rules in {@link SecretsRouterConfig.rules} are evaluated top-to-bottom;\n * the first rule whose `prefix` matches the start of the credential ref wins.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface RoutingRule {\n  /** Prefix match on credential_ref. First match wins. */\n  prefix: string;\n  /** Provider id to route to. */\n  provider_id: string;\n}\n\n/**\n * Configuration object for {@link SecretsRouter}.\n *\n * Specifies the default provider id used when no routing rule matches, and an optional\n * ordered list of {@link RoutingRule} entries for prefix-based routing.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface SecretsRouterConfig {\n  /** Default provider id when no routing rule matches. */\n  default_provider: string;\n  /** Ordered routing rules. Evaluated top-to-bottom; first prefix match wins. */\n  rules?: RoutingRule[];\n}\n\n// ---------------------------------------------------------------------------\n// Router\n// ---------------------------------------------------------------------------\n\nexport class SecretsRouter {\n  private providers = new Map<string, ISecretsProvider>();\n  private config: SecretsRouterConfig;\n  private sinks: AuditSink[] = [];\n\n  /** Caller context for audit events (set per-request by the runner). */\n  callerSessionId?: string;\n  callerToolCall?: string;\n\n  constructor(config: SecretsRouterConfig) {\n    this.config = config;\n  }\n\n  // -- Provider registration ------------------------------------------------\n\n  register(provider: ISecretsProvider): void {\n    this.providers.set(provider.id, provider);\n  }\n\n  unregister(id: string): void {\n    this.providers.delete(id);\n  }\n\n  listProviders(): string[] {\n    return [...this.providers.keys()];\n  }\n\n  // -- Audit sinks -----------------------------------------------------------\n\n  addSink(sink: AuditSink): void {\n    this.sinks.push(sink);\n  }\n\n  private emit(ref: string, operation: CredentialAccessed[\"operation\"], providerId: string): void {\n    const event: CredentialAccessed = {\n      credential_ref: ref,\n      operation,\n      provider_id: providerId,\n      caller_session_id: this.callerSessionId,\n      caller_tool_call: this.callerToolCall,\n      timestamp: new Date(),\n    };\n    for (const sink of this.sinks) {\n      try {\n        sink(event);\n      } catch {\n        // Audit sink errors must not break the secret operation.\n      }\n    }\n  }\n\n  // -- Routing ---------------------------------------------------------------\n\n  private resolve(ref: string): ISecretsProvider {\n    // Check routing rules first\n    if (this.config.rules) {\n      for (const rule of this.config.rules) {\n        if (ref.startsWith(rule.prefix)) {\n          const provider = this.providers.get(rule.provider_id);\n          if (provider) return provider;\n        }\n      }\n    }\n\n    // Fall back to default\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) {\n      throw new ProviderUnavailableError(\n        this.config.default_provider,\n        `No provider registered for default id \"${this.config.default_provider}\"`,\n      );\n    }\n    return provider;\n  }\n\n  // -- Delegated operations --------------------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"get\", provider.id);\n    return provider.getSecret(ref);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"set\", provider.id);\n    return provider.setSecret(ref, value, opts);\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"delete\", provider.id);\n    return provider.deleteSecret(ref);\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    // List aggregates from the default provider only (per-provider listing\n    // would require iterating all providers; deferred to Phase 3 with\n    // federated catalogs).\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) return [];\n    this.emit(\"*\", \"list\", provider.id);\n    return provider.listSecrets(filter);\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"metadata\", provider.id);\n    return provider.getMetadata(ref);\n  }\n\n  getCapabilities(providerId?: string): ProviderCapabilities | null {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    return provider?.getCapabilities() ?? null;\n  }\n\n  async testConnection(\n    providerId?: string,\n  ): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    if (!provider) {\n      return { ok: false, error: `Provider \"${id}\" not registered` };\n    }\n    return provider.testConnection();\n  }\n}\n","/** Package version of `@skaile/secrets`. */\nexport const VERSION = \"0.0.0\";\n\n// Re-export interface + errors from plugins (convenience for consumers)\nexport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nexport {\n  ProviderUnavailableError,\n  SecretAccessDeniedError,\n  SecretExpiredError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\nexport type { CredentialLifecycleConfig, RefreshResult } from \"./lifecycle.js\";\n// Lifecycle\nexport { CredentialLifecycleService } from \"./lifecycle.js\";\nexport { EnvSecretsProvider } from \"./providers/env.js\";\nexport type { KeyStrategy } from \"./providers/local.js\";\n// Built-in providers\nexport { LocalSecretsProvider } from \"./providers/local.js\";\nexport type { AuditSink, CredentialAccessed, RoutingRule, SecretsRouterConfig } from \"./router.js\";\n// Router\nexport { SecretsRouter } from \"./router.js\";\n"]}