@skaile/workspaces 4.38.0 → 5.0.0

package/dist/{chunk-5K2VT6E2.js.map → chunk-DXUQCMVT.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../core/src/fs-deadline.ts","../core/src/manifest.ts"],"names":[],"mappings":";;;;;;;AA4BO,IAAM,sBAAA,GAAyB;AAQ/B,IAAM,mBAAA,GAAsB;AAQ5B,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EAChC,SAAA;AAAA,EACA,SAAA;AAAA,EAET,WAAA,CAAY,WAAmB,SAAA,EAAmB;AAChD,IAAA,KAAA;AAAA,MACE,CAAA,sBAAA,EAAyB,SAAS,CAAA,WAAA,EAAc,SAAS,CAAA,uCAAA;AAAA,KAC3D;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAYO,SAAS,YAAA,CAAa,WAAmB,sBAAA,EAAgC;AAC9E,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC3C,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,QAAA;AAC9B,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,EAAE,CAAA;AAGtC,EAAA,OAAO,OAAO,QAAA,CAAS,MAAM,CAAA,IAAK,MAAA,GAAS,IAAI,MAAA,GAAS,QAAA;AAC1D;AAaA,eAAsB,cAAA,CACpB,SAAA,EACA,EAAA,EACA,SAAA,GAAoB,cAAa,EACrB;AACZ,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,QAAQ,IAAA,CAAK;AAAA,MACxB,EAAA,EAAG;AAAA,MACH,IAAI,OAAA,CAAe,CAAC,QAAA,EAAU,MAAA,KAAW;AACvC,QAAA,KAAA,GAAQ,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,gBAAgB,SAAA,EAAW,SAAS,CAAC,CAAA,EAAG,SAAS,CAAA;AAGrF,QAAA,KAAA,CAAM,KAAA,IAAQ;AAAA,MAChB,CAAC;AAAA,KACF,CAAA;AAAA,EACH,CAAA,SAAE;AACA,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAAA,EAC7C;AACF;AAeA,eAAsB,kBACpB,SAAA,EACA,EAAA,EACA,QAAA,EACA,SAAA,GAAoB,cAAa,EACrB;AACZ,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,cAAA,CAAe,SAAA,EAAW,EAAA,EAAI,SAAS,CAAA;AAAA,EACtD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AACF;;;AClGA,SAAS,gBAAA,CAAiB,UAAkB,SAAA,EAAqC;AAC/E,EAAA,OAAO,cAAA,CAAe,YAAY,QAAQ,CAAA,CAAA,EAAI,MAAM,QAAA,CAAS,QAAA,EAAU,MAAM,CAAA,EAAG,SAAS,CAAA;AAC3F;AAQA,SAAS,uBAAA,CAAwB,UAAkB,SAAA,EAAqC;AACtF,EAAA,OAAO,iBAAA,CAAkB,CAAA,SAAA,EAAY,QAAQ,CAAA,CAAA,EAAI,MAAM,SAAS,QAAA,EAAU,MAAM,CAAA,EAAG,EAAA,EAAI,SAAS,CAAA;AAClG;AAuBO,SAAS,iBAAiB,IAAA,EAAiC;AAChE,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,0BAA0B,CAAA;AAC/C,EAAA,IAAI,CAAC,CAAA,EAAG,OAAO,EAAE,IAAA,EAAM,EAAC,EAAG,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,EAAE;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,OAAQ,KAAA,CAAM,CAAA,CAAE,CAAC,CAAE,KAAiC,EAAC;AAC3D,IAAA,MAAM,IAAA,GAAO,KAAK,KAAA,CAAM,CAAA,CAAE,CAAC,CAAA,CAAE,MAAM,EAAE,IAAA,EAAK;AAC1C,IAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,IAAA,EAAM,IAAI,IAAA,EAAM,IAAA,CAAK,MAAK,EAAE;AAAA,EACvC;AACF;AAGA,SAAS,eAAe,IAAA,EAAuC;AAC7D,EAAA,OAAO,MAAA;AAAA,IACL,IAAA,CAAK,OAAA,IAAY,IAAA,CAAK,QAAA,EAAkD,OAAA,IAAW;AAAA,GACrF;AACF;AAaO,SAAS,cAAc,IAAA,EAA6C;AACzE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,IAAa,IAAA,CAAK,QAAA,EAAkD,QAAA;AACrF,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAClB,EAAA,MAAM,IAAA,GACJ,OAAO,GAAA,KAAQ,QAAA,GACX,IAAI,KAAA,CAAM,GAAG,EAAE,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,GAClC,KAAA,CAAM,QAAQ,GAAG,CAAA,GACd,MACD,EAAC;AACT,EAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,CAAE,IAAI,QAAQ,CAAA;AAC1C;AASA,SAAS,gBAAA,CAAiB,KAAc,GAAA,EAAyB;AAC/D,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzB,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,KAAM,IAAA,IAAQ,UAAU,CAAA,EAAG;AACtD,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,MAAA,CAAQ,CAAA,CAA8B,IAAI,CAAA,EAAG,CAAA;AAAA,IAC/E;AAAA,EACF;AACF;AAMA,SAAS,iBAAA,CAAkB,GAAA,EAAc,IAAA,EAA0B,GAAA,EAAyB;AAC1F,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzB,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,EAAG,GAAA,CAAI,KAAK,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA,EAAG,CAAA;AAAA,EAC5D;AACF;AASA,SAAS,gBAAA,CAAiB,GAAA,EAAc,WAAA,EAAqB,GAAA,EAAyB;AACpF,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzB,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAC,CAAA,EAAG;AACjC,IAAA,IAAI,EAAE,UAAA,CAAW,GAAG,KAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG;AAE5C,IAAA,MAAM,UAAA,GAAa,EAAE,QAAA,CAAS,GAAG,IAAI,CAAA,GAAI,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AAE5D,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,MAAM,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,QAAQ,EAAE,IAAA,EAAK;AAChD,IAAA,IAAI,OAAO,UAAA,CAAW,KAAA,CAAM,QAAA,GAAW,CAAC,EAAE,IAAA,EAAK;AAC/C,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAChC,IAAA,IAAI,OAAA,KAAY,IAAI,IAAA,GAAO,IAAA,CAAK,MAAM,CAAA,EAAG,OAAO,EAAE,IAAA,EAAK;AACvD,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AAExB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,MAAA,IAAA,GAAO,QAAA,KAAa,KAAK,IAAA,CAAK,KAAA,CAAM,WAAW,CAAC,CAAA,CAAE,MAAK,GAAI,EAAA;AAAA,IAC7D,CAAA,MAAO;AAEL,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC9B,MAAA,IAAA,GAAO,KAAA,KAAU,KAAK,IAAA,CAAK,KAAA,CAAM,GAAG,KAAK,CAAA,CAAE,MAAK,GAAI,IAAA;AAAA,IACtD;AACA,IAAA,IAAI,MAAM,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EACnC;AACF;AAgBA,eAAsB,WAAA,CAAY,UAAkB,QAAA,EAAyC;AAC3F,EAAA,OAAO,mBAAmB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AAChF;AAGA,SAAS,kBAAA,CAAmB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC7F,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,CAAC,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,WAAW,SAAA,EAAW,WAAW,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA;AAChF,IAAA,IAAA,GAAO,OAAA;AACT,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA;AAAA,IACA,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AAaA,eAAsB,WAAA,CAAY,UAAkB,QAAA,EAAyC;AAC3F,EAAA,OAAO,mBAAmB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AAChF;AAGA,SAAS,kBAAA,CAAmB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC7F,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,OAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AAcA,eAAsB,aAAA,CAAc,UAAkB,QAAA,EAAyC;AAC7F,EAAA,OAAO,qBAAqB,MAAM,uBAAA,CAAwB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACzF;AAGA,SAAS,oBAAA,CAAqB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC/F,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,KAAA,CAAM,OAAO,CAAA,IAAiC,EAAC;AAAA,EACzD,CAAA,CAAA,MAAQ;AAAA,EAAC;AAET,EAAA,MAAM,WAAyB,EAAC;AAGhC,EAAA,gBAAA,CAAiB,IAAA,CAAK,UAAU,QAAQ,CAAA;AAExC,EAAA,gBAAA,CAAiB,IAAA,CAAK,cAAc,QAAQ,CAAA;AAE5C,EAAA,iBAAA,CAAkB,IAAA,CAAK,SAAA,EAAW,OAAA,EAAS,QAAQ,CAAA;AAEnD,EAAA,iBAAA,CAAkB,IAAA,CAAK,SAAA,EAAW,UAAA,EAAY,QAAQ,CAAA;AAItD,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,WAAW,CAAA,IAAK;AAAA,IACjC,CAAC,WAAW,SAAS,CAAA;AAAA,IACrB,CAAC,SAAS,SAAS,CAAA;AAAA,IACnB,CAAC,aAAa,WAAW;AAAA,GAC3B,EAAY;AACV,IAAA,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG,WAAA,EAAa,QAAQ,CAAA;AAAA,EACrD;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,OAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAAA,IAClC,QAAA;AAAA,IACA,cAAc;AAAC,GACjB;AACF;AAcA,eAAsB,YAAA,CAAa,UAAkB,QAAA,EAAyC;AAC5F,EAAA,OAAO,oBAAoB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACjF;AAGA,SAAS,mBAAA,CAAoB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC9F,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,QAAA,CAAS,QAAQ,CAAA,CAAE,OAAA,CAAQ,eAAA,EAAiB,EAAE,CAAC,CAAA;AAChF,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,IAAA,EAAM,QAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AAaA,eAAsB,YAAA,CAAa,UAAkB,QAAA,EAAyC;AAC5F,EAAA,OAAO,oBAAoB,MAAM,uBAAA,CAAwB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACxF;AAGA,SAAS,mBAAA,CAAoB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC9F,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,KAAA,CAAM,OAAO,CAAA,IAAiC,EAAC;AAAA,EACzD,CAAA,CAAA,MAAQ;AAAA,EAAC;AAET,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,QAAQ,CAAA,CAC3B,OAAA,CAAQ,iBAAiB,EAAE,CAAA,CAC3B,OAAA,CAAQ,eAAA,EAAiB,EAAE,CAAA;AAC9B,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACzC,IAAA,EAAM,MAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAAA,IAClC,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AAcA,eAAsB,cAAA,CAAe,UAAkB,QAAA,EAAyC;AAC9F,EAAA,OAAO,sBAAsB,MAAM,uBAAA,CAAwB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AAC1F;AAGA,SAAS,qBAAA,CAAsB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAChG,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,KAAA,CAAM,OAAO,CAAA,IAAiC,EAAC;AAAA,EACzD,CAAA,CAAA,MAAQ;AAAA,EAAC;AAET,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,QAAA,CAAS,QAAQ,CAAA,CAAE,OAAA,CAAQ,iBAAA,EAAmB,EAAE,CAAC,CAAA;AAElF,EAAA,MAAM,OAAO,IAAA,CAAK,YAAA;AAClB,EAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,IAAI,IAAK,IAAA,CAAkB,MAAA,CAAO,OAAO,CAAA,GAAI,EAAC;AAEjF,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,IAAA,EAAM,QAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAAA,IAClC,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B;AAAA,GACF;AACF;AAmBA,eAAsB,cAAc,QAAA,EAAqC;AACvE,EAAA,OAAO,wBAAA,CAAyB,MAAM,uBAAA,CAAwB,QAAQ,GAAG,QAAQ,CAAA;AACnF;AAGA,SAAS,wBAAA,CAAyB,SAAiB,QAAA,EAA4B;AAI7E,EAAA,MAAM,QAAA,GAAW,yCAAA,CAA0C,IAAA,CAAK,QAAQ,CAAA;AACxE,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,QAAA,GACD,MAAM,OAAO,CAAA,IAAiC,EAAC,GACjD,gBAAA,CAAiB,OAAO,CAAA,CAAE,IAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,OAAA,GAAU,CAAC,CAAA,KAAe;AAC9B,IAAA,IAAI,KAAA,CAAM,QAAQ,CAAC,CAAA,EAAA;AACjB,MAAA,KAAA,MAAW,CAAA,IAAK,CAAA,EAAG,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,IAAA,EAAK,EAAG,GAAA,CAAI,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA;AAAA,IAAA;AAAA,EAC/E,CAAA;AACA,EAAA,OAAA,CAAQ,KAAK,QAAQ,CAAA;AACrB,EAAA,OAAA,CAAS,IAAA,CAAK,UAAkD,QAAQ,CAAA;AACxE,EAAA,OAAA,CAAQ,KAAK,YAAY,CAAA;AACzB,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACzB;AAaA,eAAsB,cAAA,CAAe,UAAkB,QAAA,EAAyC;AAC9F,EAAA,OAAO,sBAAsB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACnF;AAGA,SAAS,qBAAA,CAAsB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAChG,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,UAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AA+BA,eAAsB,eAAA,CAAgB,UAAkB,QAAA,EAAyC;AAC/F,EAAA,OAAO,uBAAuB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACpF;AAYO,SAAS,sBAAA,CACd,OAAA,EACA,QAAA,EACA,QAAA,EACc;AACd,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAG/C,EAAA,MAAM,WAAoC,EAAC;AAC3C,EAAA,IAAI,KAAK,SAAA,EAAW,QAAA,CAAS,SAAA,GAAY,MAAA,CAAO,KAAK,SAAS,CAAA;AAC9D,EAAA,IAAI,KAAK,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,MAAA,CAAO,KAAK,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,WAAY,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAClE,EAAA,IAAI,IAAA,CAAK,GAAA,IAAO,OAAO,IAAA,CAAK,GAAA,KAAQ,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AACxE,IAAA,QAAA,CAAS,MAAM,IAAA,CAAK,GAAA;AAAA,EACtB;AACA,EAAA,IAAI,KAAK,GAAA,EAAK,QAAA,CAAS,GAAA,GAAM,MAAA,CAAO,KAAK,GAAG,CAAA;AAC5C,EAAA,IAAI,OAAO,IAAA,CAAK,EAAA,KAAO,QAAA,EAAU,QAAA,CAAS,KAAK,IAAA,CAAK,EAAA;AACpD,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACpF,IAAA,QAAA,CAAS,UAAU,IAAA,CAAK,OAAA;AAAA,EAC1B;AACA,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,OAAO,IAAA,CAAK,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA,EAAG;AACjF,IAAA,QAAA,CAAS,SAAS,IAAA,CAAK,MAAA;AAAA,EACzB;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,YAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc,EAAC;AAAA,IACf,UAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,MAAA,GAAS,IAAI,QAAA,GAAW;AAAA,GAC1D;AACF;AAaA,eAAsB,iBAAA,CAAkB,UAAkB,QAAA,EAAyC;AACjG,EAAA,OAAO,yBAAyB,MAAM,uBAAA,CAAwB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AAC7F;AAGA,SAAS,wBAAA,CACP,OAAA,EACA,QAAA,EACA,QAAA,EACc;AACd,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,KAAA,CAAM,OAAO,CAAA,IAAiC,EAAC;AAAA,EACzD,CAAA,CAAA,MAAQ;AAAA,EAAC;AACT,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,WAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAAA,IAClC,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AA4BA,eAAsB,eAAA,CAAgB,UAAkB,QAAA,EAAyC;AAC/F,EAAA,OAAO,uBAAuB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACpF;AAGA,SAAS,sBAAA,CAAuB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AACjG,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AACrD,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAC5D,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,IAAA,EAAM,WAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc,EAAC;AAAA,IACf,QAAA,EAAU;AAAA,MACR,KAAA,EAAO,KAAK,KAAA,IAAS,cAAA;AAAA,MACrB,QAAA,EAAU,IAAA,CAAK,QAAA,IAAY,EAAC;AAAA,MAC5B,MAAA,EAAQ,IAAA,CAAK,MAAA,IAAU,EAAC;AAAA,MACxB,YAAA,EAAc,KAAK,YAAA,IAAgB,IAAA;AAAA,MACnC;AAAA;AACF,GACF;AACF;AAUO,IAAM,sBAAA,GAAyB;AAG/B,IAAM,wBAAA,GAA2B;AAGjC,IAAM,sBAAA,GAAyB;AAG/B,IAAM,sBAAA,GAAyB;AAG/B,IAAM,wBAAA,GAA2B;AAGjC,IAAM,sBAAA,GAAyB;AAGtC,SAAS,MAAA,CAAO,MAAc,QAAA,EAA0B;AACtD,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAC5B,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,QAAA;AAC9B,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,EAAE,CAAA;AACtC,EAAA,OAAO,OAAO,QAAA,CAAS,MAAM,CAAA,IAAK,MAAA,GAAS,IAAI,MAAA,GAAS,QAAA;AAC1D;AAyDA,IAAI,UAAA;AAGJ,SAAS,eAAe,IAAA,EAA4B;AAClD,EAAA,UAAA,KAAe,aAAa,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAc,CAAA;AACrE,EAAA,UAAA,CAAW,IAAA,CAAK,CAAA,sBAAA,EAAyB,IAAA,CAAK,MAAM,CAAA,+BAAA,CAAA,EAA8B;AAAA,IAChF,GAAG;AAAA,GACJ,CAAA;AACH;AAGA,SAAS,QAAA,CAAS,OAAkB,IAAA,EAA4B;AAC9D,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA,EAAG;AACrC,EAAA,KAAA,CAAM,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AAC9B,EAAA,KAAA,CAAM,WAAW,IAAI,CAAA;AACvB;AAOA,eAAe,WAAA,CAAY,MAAc,SAAA,EAAuD;AAC9F,EAAA,MAAM,EAAA,GAAK,MAAM,iBAAA,CAAkB,CAAA,KAAA,EAAQ,IAAI,CAAA,CAAA,EAAI,MAAM,IAAA,CAAK,IAAI,CAAA,EAAG,IAAA,EAAM,SAAS,CAAA;AACpF,EAAA,OAAO,KAAK,CAAA,EAAG,EAAA,CAAG,GAAG,CAAA,CAAA,EAAI,EAAA,CAAG,GAAG,CAAA,CAAA,GAAK,IAAA;AACtC;AASA,eAAe,cAAA,CACb,KACA,KAAA,EACwD;AACxD,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,UAAA,GAAa,KAAA,CAAM,QAAA;AAC3C,EAAA,IAAI,SAAA,IAAa,GAAG,OAAO,EAAE,SAAS,EAAC,EAAG,QAAQ,IAAA,EAAK;AACvD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,cAAA;AAAA,MACX,WAAW,GAAG,CAAA,CAAA;AAAA,MACd,YAAY;AACV,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAG,CAAA;AAChC,QAAA,MAAM,UAAoB,EAAC;AAC3B,QAAA,IAAI,MAAA,GAAS,KAAA;AACb,QAAA,WAAA,MAAiB,KAAK,MAAA,EAAQ;AAM5B,UAAA,IAAI,OAAA,CAAQ,UAAU,SAAA,EAAW;AAC/B,YAAA,MAAA,GAAS,IAAA;AACT,YAAA;AAAA,UACF;AACA,UAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,QAChB;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAO,EAAE,IAAA,GAAO,CAAA,CAAE,IAAA,GAAO,CAAA,CAAA,GAAK,CAAE,CAAA;AACjD,QAAA,OAAO,EAAE,SAAS,MAAA,EAAO;AAAA,MAC3B,CAAA;AAAA,MACA,KAAA,CAAM;AAAA,KACR;AAAA,EACF,CAAA,CAAA,MAAQ;AAGN,IAAA,QAAA,CAAS,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAc,IAAA,EAAM,KAAK,CAAA;AACnD,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AA8BA,gBAAuB,OAAA,CAAQ,GAAA,EAAa,OAAA,GAAuB,EAAC,EAA8B;AAChG,EAAA,MAAM,KAAA,GAAmB;AAAA,IACvB,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,MAAA,CAAO,wBAAwB,sBAAsB,CAAA;AAAA,IACnF,UAAA,EAAY,OAAA,CAAQ,UAAA,IAAc,MAAA,CAAO,0BAA0B,wBAAwB,CAAA;AAAA,IAC3F,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,UAAA,EACE,KAAK,GAAA,EAAI,IAAK,QAAQ,QAAA,IAAY,MAAA,CAAO,wBAAwB,sBAAsB,CAAA,CAAA;AAAA,IACzF,QAAA,EAAU,CAAA;AAAA,IACV,SAAA,sBAAe,GAAA,EAAY;AAAA,IAC3B,QAAA,sBAAc,GAAA,EAA8B;AAAA,IAC5C,UAAA,EAAY,QAAQ,UAAA,IAAc;AAAA,GACpC;AAGA,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,GAAA,EAAK,MAAM,WAAW,CAAA;AACvD,EAAA,IAAI,MAAA,EAAQ,KAAA,CAAM,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACtC,EAAA,OAAO,QAAA,CAAS,GAAA,EAAK,CAAA,EAAG,KAAK,CAAA;AAC/B;AAEA,gBAAgB,QAAA,CAAS,GAAA,EAAa,KAAA,EAAe,KAAA,EAA6C;AAChG,EAAA,IAAI,KAAA,GAAQ,MAAM,QAAA,EAAU;AAC1B,IAAA,QAAA,CAAS,KAAA,EAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,GAAA,EAAK,KAAA,EAAO,KAAA,CAAM,QAAA,EAAU,CAAA;AACrE,IAAA;AAAA,EACF;AACA,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,CAAM,UAAA,EAAY;AAClC,IAAA,QAAA,CAAS,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,KAAK,CAAA;AAC/C,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,KAAK,CAAA;AAC5C,EAAA,IAAI,CAAC,IAAA,EAAM;AACX,EAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,QAAA,CAAS,KAAA,EAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,IAAA,EAAM,GAAA,EAAK,KAAA,EAAO,KAAA,CAAM,UAAA,EAAY,CAAA;AAE1F,EAAA,KAAA,MAAW,CAAA,IAAK,KAAK,OAAA,EAAS;AAC5B,IAAA,IAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,UAAA,EAAY;AACtC,MAAA,QAAA,CAAS,KAAA,EAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,MAAM,GAAA,EAAK,KAAA,EAAO,KAAA,CAAM,UAAA,EAAY,CAAA;AACzE,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,CAAM,UAAA,EAAY;AAClC,MAAA,QAAA,CAAS,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,KAAK,CAAA;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,KAAA,CAAM,QAAA,EAAA;AACN,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,CAAA;AAE7B,IAAA,IAAI,CAAA,CAAE,gBAAe,EAAG;AAItB,MAAA,MAAM,EAAA,GAAK,MAAM,iBAAA,CAAkB,CAAA,KAAA,EAAQ,IAAI,CAAA,CAAA,EAAI,MAAM,IAAA,CAAK,IAAI,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,WAAW,CAAA;AAC5F,MAAA,IAAI,CAAC,EAAA,EAAI;AACT,MAAA,IAAI,EAAA,CAAG,aAAY,EAAG;AACpB,QAAA,IAAI,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,SAAS,cAAA,EAAgB;AACpD,QAAA,MAAM,KAAK,CAAA,EAAG,EAAA,CAAG,GAAG,CAAA,CAAA,EAAI,GAAG,GAAG,CAAA,CAAA;AAI9B,QAAA,IAAI,KAAA,CAAM,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA,EAAG;AAC3B,UAAA,QAAA,CAAS,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,MAAM,CAAA;AAC/C,UAAA;AAAA,QACF;AACA,QAAA,KAAA,CAAM,SAAA,CAAU,IAAI,EAAE,CAAA;AACtB,QAAA,IAAI;AACF,UAAA,OAAO,QAAA,CAAS,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,QACxC,CAAA,SAAE;AAIA,UAAA,KAAA,CAAM,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,QAC3B;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,EAAE,IAAA,EAAK;AAAA,MACnC;AAAA,IACF,CAAA,MAAA,IAAW,CAAA,CAAE,WAAA,EAAY,EAAG;AAC1B,MAAA,IAAI,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,cAAA,EAAgB,OAAO,QAAA,CAAS,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,IAC5F,CAAA,MAAA,IAAW,CAAA,CAAE,MAAA,EAAO,EAAG;AACrB,MAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,EAAE,IAAA,EAAK;AAAA,IACnC;AAAA,EACF;AACF;AAWA,SAAS,mBAAmB,CAAA,EAAuB;AACjD,EAAA,IAAI,gBAAA,CAAiB,CAAA,CAAE,IAAI,CAAA,EAAG;AAC9B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,gBAAA,CAAiB,EAAE,IAAI,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,WAAW,CAAA,CAAE,IAAA;AACnB,EAAA,CAAA,CAAE,IAAA,GAAO,IAAA;AACT,EAAA,IAAI,CAAA,CAAE,QAAA,EAAU,WAAA,KAAgB,MAAA,EAAW;AACzC,IAAA,CAAA,CAAE,WAAW,EAAE,GAAG,CAAA,CAAE,QAAA,EAAU,aAAa,QAAA,EAAS;AAAA,EACtD;AACF;AAMA,SAAS,iBAAA,CACP,IAAA,EACA,OAAA,EACA,QAAA,EACA,QAAA,EACqB;AACrB,EAAA,IAAI,SAAS,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAC9E,EAAA,IAAI,SAAS,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAC9E,EAAA,IAAI,SAAS,YAAA,EAAc,OAAO,oBAAA,CAAqB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAClF,EAAA,IAAI,SAAS,aAAA,EAAe,OAAO,qBAAA,CAAsB,OAAA,EAAS,UAAU,QAAQ,CAAA;AACpF,EAAA,IAAI,SAAS,QAAA,EAAU,OAAO,sBAAA,CAAuB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAChF,EAAA,IAAI,SAAS,cAAA,EAAgB,OAAO,sBAAA,CAAuB,OAAA,EAAS,UAAU,QAAQ,CAAA;AACtF,EAAA,IAAI,SAAS,gBAAA,EAAkB,OAAO,wBAAA,CAAyB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAC1F,EAAA,IAAI,IAAA,CAAK,SAAS,YAAY,CAAA,SAAU,mBAAA,CAAoB,OAAA,EAAS,UAAU,QAAQ,CAAA;AACvF,EAAA,IAAI,IAAA,CAAK,SAAS,cAAc,CAAA,SAAU,qBAAA,CAAsB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAC3F,EAAA,IAAI,KAAK,QAAA,CAAS,YAAY,CAAA,IAAK,IAAA,CAAK,SAAS,YAAY,CAAA;AAC3D,IAAA,OAAO,mBAAA,CAAoB,OAAA,EAAS,QAAA,EAAU,QAAQ,CAAA;AACxD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,eAAe,IAAA,EAAuB;AAC7C,EAAA,OACE,IAAA,KAAS,UAAA,IACT,IAAA,KAAS,UAAA,IACT,IAAA,KAAS,YAAA,IACT,IAAA,KAAS,aAAA,IACT,IAAA,KAAS,QAAA,IACT,IAAA,KAAS,cAAA,IACT,IAAA,KAAS,gBAAA,IACT,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,IAC1B,IAAA,CAAK,QAAA,CAAS,cAAc,CAAA,IAC5B,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,IAC1B,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA;AAE9B;AA4BA,eAAsB,aAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,GAAuB,EAAC,EACC;AACzB,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA0B;AAC9C,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,cAAA;AACzC,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA8B;AACnD,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAyB;AACtC,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,MAAM,CAAA;AACxB,IAAA,UAAA,CAAW,IAAI,CAAA;AAAA,EACjB,CAAA;AACA,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,YAAA,EAAa;AAExD,EAAA,SAAS,IAAI,CAAA,EAAuB;AAKlC,IAAA,kBAAA,CAAmB,CAAC,CAAA;AACpB,IAAA,MAAM,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,CAAA;AAC/B,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAC,CAAA;AAClB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,EAAE,MAAA,GAAS,QAAA,CAAS,QAAQ,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACpD;AAEA,EAAA,WAAA,MAAiB,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAK,IAAK,QAAQ,IAAA,EAAM;AAAA,IACzD,GAAG,OAAA;AAAA,IACH,WAAA;AAAA,IACA,UAAA,EAAY;AAAA,GACb,CAAA,EAAG;AACF,IAAA,IAAI,CAAC,cAAA,CAAe,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,UAAU,MAAM,iBAAA;AAAA,MACpB,YAAY,QAAQ,CAAA,CAAA;AAAA,MACpB,MAAM,QAAA,CAAS,QAAA,EAAU,MAAM,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,YAAY,IAAA,EAAM;AAGpB,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,YAAY,CAAA,EAAG,KAAA,CAAM,EAAE,MAAA,EAAQ,YAAA,EAAc,IAAA,EAAM,QAAA,EAAU,CAAA;AAC/E,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,IAAA,EAAM,OAAA,EAAS,UAAU,QAAQ,CAAA;AACjE,MAAA,IAAI,KAAA,MAAW,KAAK,CAAA;AAAA,IACtB,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACX;AAEA,EAAA,OAAO,CAAC,GAAG,OAAA,CAAQ,MAAA,EAAQ,CAAA;AAC7B","file":"chunk-5K2VT6E2.js","sourcesContent":["/**\n * Deadline guards for filesystem work that can land on a network mount.\n *\n * Inside the agent container `/skaile/workspace` **is** an rclone FUSE mount\n * (SharePoint / OneDrive / WebDAV). When the host rclone process wedges, a\n * filesystem call against that path parks in an uninterruptible kernel wait.\n * A **synchronous** call there stops the entire single-threaded event loop —\n * the whole `skaile serve` process stops serving, and the platform reads the\n * session as dead or idle. A hang is not an error, so `try/catch` never fires.\n *\n * Two rules follow, and both matter:\n *\n * 1. **Never touch a mount synchronously.** Async `node:fs/promises` keeps the\n *    loop free, so a wedged mount degrades to one stuck request instead of a\n *    dead session. This is the actual fix.\n * 2. **Bound the wait.** {@link withFsDeadline} converts an unbounded wait into\n *    a bounded failure so the requester gets an error rather than nothing.\n *\n * `withFsDeadline` does **not** cancel the underlying operation — Node cannot\n * abort a syscall already in the kernel. The losing promise stays pending until\n * the mount recovers or the process exits. That is acceptable precisely because\n * rule 1 holds: a pending promise costs one handle, not the event loop.\n *\n * Modelled on `connectors/src/fleet-utils.ts` (`ensureFleetMounted`), which\n * already does async-stat-with-deadline correctly.\n */\n\n/** Default deadline for a single filesystem operation on a possibly-networked mount. */\nexport const DEFAULT_FS_DEADLINE_MS = 15_000;\n\n/**\n * Env override for {@link DEFAULT_FS_DEADLINE_MS}, in milliseconds.\n *\n * A cloud-backed mount over a slow link can legitimately need longer than the\n * default; operators raise this rather than patching call sites.\n */\nexport const FS_DEADLINE_ENV_VAR = \"SKAILE_FS_DEADLINE_MS\";\n\n/**\n * Thrown when a filesystem operation misses its deadline.\n *\n * Distinct from a plain `Error` so callers can tell \"the mount is wedged\" apart\n * from \"the file does not exist\" and surface the right message to the frontend.\n */\nexport class FsDeadlineError extends Error {\n  readonly timeoutMs: number;\n  readonly operation: string;\n\n  constructor(operation: string, timeoutMs: number) {\n    super(\n      `filesystem operation \"${operation}\" exceeded ${timeoutMs}ms — the mount may be unresponsive`,\n    );\n    this.name = \"FsDeadlineError\";\n    this.operation = operation;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Resolve the effective filesystem deadline.\n *\n * Reads {@link FS_DEADLINE_ENV_VAR} on every call rather than caching it: the\n * runner mutates `process.env` while wiring a session, so a module-load-time\n * snapshot would pin the value set before configuration ran.\n *\n * @param fallback - Deadline to use when the env var is absent or unusable.\n * @returns The deadline in milliseconds.\n */\nexport function fsDeadlineMs(fallback: number = DEFAULT_FS_DEADLINE_MS): number {\n  const raw = process.env[FS_DEADLINE_ENV_VAR];\n  if (raw === undefined) return fallback;\n  const parsed = Number.parseInt(raw, 10);\n  // A non-positive or non-numeric override would disable the guard entirely,\n  // which is exactly the failure mode this module exists to prevent.\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\n/**\n * Run an async filesystem operation under a deadline.\n *\n * @param operation - Short label used in the timeout message (e.g. `\"readdir /skaile/workspace\"`).\n * @param fn - Thunk performing the operation. Called immediately.\n * @param timeoutMs - Deadline override; defaults to {@link fsDeadlineMs}.\n * @returns The operation's result.\n * @throws {FsDeadlineError} when the deadline elapses first.\n * @throws Whatever `fn` rejects with, unchanged, when it loses no race.\n * @docLink packages/core/api-reference#with-fs-deadline\n */\nexport async function withFsDeadline<T>(\n  operation: string,\n  fn: () => Promise<T>,\n  timeoutMs: number = fsDeadlineMs(),\n): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      fn(),\n      new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => reject(new FsDeadlineError(operation, timeoutMs)), timeoutMs);\n        // Never hold the process open on the guard alone — without unref a\n        // pending deadline would keep `skaile serve` alive after shutdown.\n        timer.unref?.();\n      }),\n    ]);\n  } finally {\n    if (timer !== undefined) clearTimeout(timer);\n  }\n}\n\n/**\n * Run an async filesystem operation under a deadline, mapping every failure to\n * `fallback`.\n *\n * For best-effort probes that previously used `existsSync` — a missing file, an\n * unreadable file, and a wedged mount are all \"nothing usable here\", and the\n * caller has no better move than to continue without it.\n *\n * @param operation - Short label used in the timeout message.\n * @param fn - Thunk performing the operation.\n * @param fallback - Value returned when `fn` rejects or the deadline elapses.\n * @param timeoutMs - Deadline override; defaults to {@link fsDeadlineMs}.\n */\nexport async function tryWithFsDeadline<T>(\n  operation: string,\n  fn: () => Promise<T>,\n  fallback: T,\n  timeoutMs: number = fsDeadlineMs(),\n): Promise<T> {\n  try {\n    return await withFsDeadline(operation, fn, timeoutMs);\n  } catch {\n    return fallback;\n  }\n}\n","/**\n * Manifest parsing — reads SKILL.md, AGENT.md, agent.yaml, CONTRACT.md,\n * CONNECTOR.md, *.prompt.md, *.flow.yaml, *.bundle.yaml files and\n * produces CatalogEntry objects.\n * Used by @skaile/asset-manager for on-demand repo scanning.\n *\n * **All filesystem access here is async and bounded** (issue #454). A repo root\n * can resolve onto the rclone FUSE mount at `/skaile/workspace` — either\n * directly (a `sources[].path` pointing into the workspace) or indirectly, since\n * the walk follows symlinks and an off-mount tree can link into one. A\n * synchronous `readdirSync`/`statSync`/`readFileSync` there parks the whole\n * `skaile serve` event loop in an uninterruptible kernel wait, and a hang is not\n * an error so `try/catch` never fires. Every call goes through\n * {@link withFsDeadline}/{@link tryWithFsDeadline}, and the walk itself is\n * bounded by depth, entry count, a wall-clock budget, and an ancestor-inode set.\n */\n\nimport type { Dirent } from \"node:fs\";\nimport { opendir, readFile, stat } from \"node:fs/promises\";\nimport { basename, dirname, join } from \"node:path\";\nimport { parse } from \"yaml\";\nimport { fsDeadlineMs, tryWithFsDeadline, withFsDeadline } from \"./fs-deadline.js\";\nimport { createLogger } from \"./logging/create-logger.js\";\nimport type { AssetKind, CatalogEntry, Dependency } from \"./models.js\";\nimport { isValidAssetName, parseDep, slugifyAssetName } from \"./models.js\";\n\n// ── Bounded manifest I/O ──────────────────────────────────────────────────────\n\n/**\n * Read one manifest file under a deadline.\n *\n * @param filePath - Absolute path to the manifest.\n * @param timeoutMs - Per-operation deadline; defaults to {@link fsDeadlineMs}.\n * @throws {import(\"./fs-deadline.js\").FsDeadlineError} when the read outlives the deadline.\n */\nfunction readManifestFile(filePath: string, timeoutMs?: number): Promise<string> {\n  return withFsDeadline(`readFile ${filePath}`, () => readFile(filePath, \"utf8\"), timeoutMs);\n}\n\n/**\n * Read one manifest file under a deadline, degrading an unreadable/slow file to\n * an empty document. Mirrors the pre-#454 `try { readFileSync } catch {}` shape\n * of the YAML parsers: a file we cannot read yields `{}` metadata rather than\n * aborting the caller.\n */\nfunction readManifestFileOrEmpty(filePath: string, timeoutMs?: number): Promise<string> {\n  return tryWithFsDeadline(`readFile ${filePath}`, () => readFile(filePath, \"utf8\"), \"\", timeoutMs);\n}\n\n// ── Frontmatter helpers ───────────────────────────────────────────────────────\n\n/**\n * Result of parsing YAML frontmatter from a markdown file.\n * @docLink packages/core/concepts#frontmatter-result\n */\nexport interface FrontmatterResult {\n  /** Parsed YAML data. Empty object if no frontmatter block is present. */\n  data: Record<string, unknown>;\n  /** Markdown body below the frontmatter block (trimmed). */\n  body: string;\n}\n\n/**\n * Parse YAML frontmatter from a markdown file (`---` delimited).\n * Returns `{ data: {}, body: text }` when no frontmatter block is present.\n *\n * @param text - Raw file contents\n * @returns Parsed frontmatter data and the remaining body text\n * @docLink packages/core/concepts#parse-frontmatter\n */\nexport function parseFrontmatter(text: string): FrontmatterResult {\n  const m = text.match(/^---\\s*\\n([\\s\\S]*?)\\n---/);\n  if (!m) return { data: {}, body: text.trim() };\n  try {\n    const data = (parse(m[1]!) as Record<string, unknown>) ?? {};\n    const body = text.slice(m[0].length).trim();\n    return { data, body };\n  } catch {\n    return { data: {}, body: text.trim() };\n  }\n}\n\n/** Extract version from frontmatter, checking both top-level and metadata.version. */\nfunction extractVersion(meta: Record<string, unknown>): string {\n  return String(\n    meta.version ?? (meta.metadata as Record<string, unknown> | undefined)?.version ?? \"\",\n  );\n}\n\n/**\n * Parse the `requires:` field from manifest frontmatter into typed `Dependency` objects.\n * Accepts a comma-separated string or an array of `\"kind:name\"` strings. Reads from either\n * the root or `metadata.requires` (matching `extractVersion`'s dual-location behavior) so\n * skill authors can follow the agentskills.io convention of placing skaile extensions under\n * `metadata:` while remaining backward-compatible with root-level declarations.\n *\n * @param meta - Parsed frontmatter data object\n * @returns Array of `Dependency` objects (empty when `requires` is absent)\n * @docLink packages/core/concepts#parse-requires\n */\nexport function parseRequires(meta: Record<string, unknown>): Dependency[] {\n  const raw = meta.requires ?? (meta.metadata as Record<string, unknown> | undefined)?.requires;\n  if (!raw) return [];\n  const list =\n    typeof raw === \"string\"\n      ? raw.split(\",\").map((s) => s.trim())\n      : Array.isArray(raw)\n        ? (raw as string[])\n        : [];\n  return list.filter(Boolean).map(parseDep);\n}\n\n// ── agent.yaml dependency collectors ───────────────────────────────────────────\n\n/**\n * Collect named sub-agent dependencies from an `agent.yaml` array field.\n * Each `{name, ...}` object entry becomes an `{kind: \"agent\", name}` dependency.\n * Covers both the new `requires[]` and legacy `dependencies[]` formats.\n */\nfunction collectAgentDeps(raw: unknown, out: Dependency[]): void {\n  if (!Array.isArray(raw)) return;\n  for (const d of raw) {\n    if (typeof d === \"object\" && d !== null && \"name\" in d) {\n      out.push({ kind: \"agent\", name: String((d as Record<string, unknown>).name) });\n    }\n  }\n}\n\n/**\n * Collect string refs from an `agent.yaml` array field (`abilities[]`,\n * `contracts[]`) as `{kind, name}` dependencies, skipping empty entries.\n */\nfunction collectStringRefs(raw: unknown, kind: Dependency[\"kind\"], out: Dependency[]): void {\n  if (!Array.isArray(raw)) return;\n  for (const r of raw) {\n    if (typeof r === \"string\" && r) out.push({ kind, name: r });\n  }\n}\n\n/**\n * Collect catalog refs from an `agent.yaml` mixin field (`persona`, `rules`,\n * `knowledge`) as requires so `skaile install` pulls them automatically. Local\n * paths (`.`/`/`) are skipped — not catalog assets. Refs without a `kind:`\n * prefix get `defaultKind` injected; the publisher scope and `#pin` are stripped\n * so only `kind:name` is tracked.\n */\nfunction collectMixinRefs(raw: unknown, defaultKind: string, out: Dependency[]): void {\n  if (!Array.isArray(raw)) return;\n  for (const r of raw) {\n    if (typeof r !== \"string\" || !r) continue;\n    if (r.startsWith(\".\") || r.startsWith(\"/\")) continue; // local path — skip\n    // Normalize: if no kind: prefix, inject the default kind\n    const normalized = r.includes(\":\") ? r : `${defaultKind}:${r}`;\n    // Only kind:name matters for requires — strip the publisher scope and #pin.\n    const colonIdx = normalized.indexOf(\":\");\n    const kind = normalized.slice(0, colonIdx).trim();\n    let rest = normalized.slice(colonIdx + 1).trim();\n    const hashIdx = rest.indexOf(\"#\");\n    if (hashIdx !== -1) rest = rest.slice(0, hashIdx).trim();\n    let name: string;\n    if (rest.startsWith(\"@\")) {\n      // Scoped form @publisher/name → name is the segment after the slash.\n      const slashIdx = rest.indexOf(\"/\");\n      name = slashIdx !== -1 ? rest.slice(slashIdx + 1).trim() : \"\";\n    } else {\n      // Legacy name@publisher (deprecated) or a bare name.\n      const atIdx = rest.indexOf(\"@\");\n      name = atIdx !== -1 ? rest.slice(0, atIdx).trim() : rest;\n    }\n    if (name) out.push({ kind, name });\n  }\n}\n\n// ── Manifest parsers ──────────────────────────────────────────────────────────\n\n/**\n * Parse a `SKILL.md` file into a `CatalogEntry`.\n * The `kind` field defaults to `\"skill\"` but can be overridden to `\"agent\"` or `\"prompt\"`\n * via the `type:` frontmatter key. Falls back to the parent directory name when `name:` is absent.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `SKILL.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind, name, description, version, and requires\n * @docLink packages/core/concepts#from-skill-md\n */\nexport async function fromSkillMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromSkillMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromSkillMd} core over already-read content (no I/O). */\nfunction fromSkillMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n  let kind = String(meta.type ?? \"skill\") as AssetKind;\n  if (![\"skill\", \"agent\", \"prompt\", \"persona\", \"ruleset\", \"knowledge\"].includes(kind))\n    kind = \"skill\";\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind,\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse an `AGENT.md` file into a `CatalogEntry` with `kind: \"agent\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `AGENT.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"agent\"`\n * @docLink packages/core/concepts#from-agent-md\n */\nexport async function fromAgentMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromAgentMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromAgentMd} core over already-read content (no I/O). */\nfunction fromAgentMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"agent\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse an `agent.yaml` file into a `CatalogEntry` with `kind: \"agent\"`.\n * Collects sub-agent dependencies from `requires[]` (new format) and `dependencies[]`\n * (legacy format), skill abilities from `abilities[]`, and contracts from `contracts[]`.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `agent.yaml` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"agent\"` and full dependency graph\n * @docLink packages/core/concepts#from-agent-yaml\n */\nexport async function fromAgentYaml(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromAgentYamlContent(await readManifestFileOrEmpty(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromAgentYaml} core over already-read content (no I/O). */\nfunction fromAgentYamlContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = (parse(content) as Record<string, unknown>) ?? {};\n  } catch {}\n\n  const requires: Dependency[] = [];\n\n  // Sub-agent dependencies from requires[] (new format: {name, source, ...})\n  collectAgentDeps(meta.requires, requires);\n  // Legacy sub-agent dependencies from dependencies[] (old format: {name, ...})\n  collectAgentDeps(meta.dependencies, requires);\n  // Skill abilities referenced in the system prompt\n  collectStringRefs(meta.abilities, \"skill\", requires);\n  // Contracts referenced in the system prompt (co-located in skills dir)\n  collectStringRefs(meta.contracts, \"contract\", requires);\n\n  // Mixin composition fields — track catalog refs as requires so `skaile install`\n  // automatically pulls them. Local paths (. or /) are skipped — not catalog assets.\n  for (const [field, defaultKind] of [\n    [\"persona\", \"persona\"],\n    [\"rules\", \"ruleset\"],\n    [\"knowledge\", \"knowledge\"],\n  ] as const) {\n    collectMixinRefs(meta[field], defaultKind, requires);\n  }\n\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"agent\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: String(meta.version ?? \"\"),\n    requires,\n    dependencies: [],\n  };\n}\n\n/**\n * Parse a `*.prompt.md` file into a `CatalogEntry` with `kind: \"prompt\"`.\n * The name defaults to the filename stem (without the `.prompt.md` suffix)\n * when no `name:` frontmatter key is present.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `.prompt.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"prompt\"`\n * @docLink packages/core/concepts#from-prompt-md\n */\nexport async function fromPromptMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromPromptMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromPromptMd} core over already-read content (no I/O). */\nfunction fromPromptMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n  const name = String(meta.name ?? basename(filePath).replace(/\\.prompt\\.md$/, \"\"));\n  return {\n    name,\n    kind: \"prompt\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse a `*.flow.yaml` or `*.flow.json` file into a `CatalogEntry` with `kind: \"flow\"`.\n * The name resolves from `name:` or `id:` frontmatter, falling back to the filename stem.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the flow definition file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"flow\"`\n * @docLink packages/core/concepts#from-flow-yaml\n */\nexport async function fromFlowYaml(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromFlowYamlContent(await readManifestFileOrEmpty(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromFlowYaml} core over already-read content (no I/O). */\nfunction fromFlowYamlContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = (parse(content) as Record<string, unknown>) ?? {};\n  } catch {}\n\n  const stem = basename(filePath)\n    .replace(/\\.flow\\.yaml$/, \"\")\n    .replace(/\\.flow\\.json$/, \"\");\n  return {\n    name: String(meta.name ?? meta.id ?? stem),\n    kind: \"flow\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: String(meta.version ?? \"\"),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse a `*.bundle.yaml` file into a `CatalogEntry` with `kind: \"bundle\"`.\n * Bundles declare a flat list of string `dependencies` (asset refs) rather than\n * typed `Dependency` objects; both `requires` and `dependencies` are populated.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the bundle YAML file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"bundle\"`\n * @docLink packages/core/concepts#from-bundle-yaml\n */\nexport async function fromBundleYaml(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromBundleYamlContent(await readManifestFileOrEmpty(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromBundleYaml} core over already-read content (no I/O). */\nfunction fromBundleYamlContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = (parse(content) as Record<string, unknown>) ?? {};\n  } catch {}\n\n  const name = String(meta.name ?? basename(filePath).replace(/\\.bundle\\.yaml$/, \"\"));\n\n  const deps = meta.dependencies;\n  const dependencies = Array.isArray(deps) ? (deps as string[]).filter(Boolean) : [];\n\n  return {\n    name,\n    kind: \"bundle\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: String(meta.version ?? \"\"),\n    requires: parseRequires(meta),\n    dependencies,\n  };\n}\n\n/**\n * Extract a bundle's raw transitive dependency ref strings from its manifest\n * file — the union of its `requires` and `dependencies` lists, kept verbatim\n * (publisher/pin qualifiers preserved, comments dropped by the parser).\n *\n * Supports `*.bundle.yaml` / `*.flow.{yaml,json}` (top-level\n * `requires`/`dependencies`) and the `BUNDLE.md` frontmatter layout\n * (`requires`/`dependencies`, incl. nested under `metadata`). Unlike\n * {@link parseRequires}, refs are returned as-is — the resolver needs the full\n * `kind:name@<publisher>[#pin]` form, not a publisher-stripped {@link Dependency}.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to a `.bundle.yaml`, `.flow.{yaml,json}`, or `BUNDLE.md`.\n * @returns Deduped list of ref strings; `[]` on parse failure or no deps.\n * @docLink packages/core/concepts#bundle-dep-refs\n */\nexport async function bundleDepRefs(filePath: string): Promise<string[]> {\n  return bundleDepRefsFromContent(await readManifestFileOrEmpty(filePath), filePath);\n}\n\n/** Pure {@link bundleDepRefs} core over already-read content (no I/O). */\nfunction bundleDepRefsFromContent(content: string, filePath: string): string[] {\n  // `.bundle.yaml` / `.flow.yaml` / `.flow.json` carry their dep list as a\n  // top-level document key (`requires`/`dependencies`); `BUNDLE.md` carries it\n  // in frontmatter. YAML is a JSON superset, so `parse` reads `.flow.json` too.\n  const wholeDoc = /\\.(bundle\\.yaml|flow\\.yaml|flow\\.json)$/.test(filePath);\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = wholeDoc\n      ? ((parse(content) as Record<string, unknown>) ?? {})\n      : parseFrontmatter(content).data;\n  } catch {\n    return [];\n  }\n  const out: string[] = [];\n  const collect = (v: unknown) => {\n    if (Array.isArray(v))\n      for (const x of v) if (typeof x === \"string\" && x.trim()) out.push(x.trim());\n  };\n  collect(meta.requires);\n  collect((meta.metadata as Record<string, unknown> | undefined)?.requires);\n  collect(meta.dependencies);\n  return [...new Set(out)];\n}\n\n/**\n * Parse a `CONTRACT.md` file into a `CatalogEntry` with `kind: \"contract\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `CONTRACT.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"contract\"`\n * @docLink packages/core/concepts#from-contract-md\n */\nexport async function fromContractMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromContractMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromContractMd} core over already-read content (no I/O). */\nfunction fromContractMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"contract\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse an `MCP.md` file into a `CatalogEntry` with `kind: \"mcp-server\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Frontmatter fields (catalog identity):\n *   - `name`        — server name (default: parent dir name)\n *   - `description` — short description\n *   - `version`     — semver\n *   - `keywords`    — array of discovery tags\n *\n * Frontmatter fields (runtime defaults, stored in `metadata`):\n *   - `transport`   — \"stdio\" | \"sse\" | \"http\" (default: \"stdio\")\n *   - `command`     — command to execute (stdio)\n *   - `args`        — command arguments (stdio)\n *   - `env`         — environment variables (stdio)\n *   - `url`         — server URL (sse/http)\n *   - `headers`     — HTTP headers (sse/http)\n *\n * When `mcp:name` appears in `skaile.yaml` `dependencies`, the runner reads\n * these defaults from `metadata` to build a `McpServerDeclaration` without\n * requiring verbose inline config.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `MCP.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"mcp-server\"`\n * @docLink packages/core/concepts#from-mcp-server-md\n */\nexport async function fromMcpServerMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromMcpServerMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/**\n * Parse pre-read MCP.md content into a `CatalogEntry`.\n * Callers that already hold the file content (e.g. to avoid a second read) use\n * this directly; `fromMcpServerMd` is a thin wrapper that reads then delegates here.\n *\n * @param content  - UTF-8 content of the `MCP.md` file\n * @param repoName - Repository name used as the `publisher` field of the entry\n * @param filePath - Absolute path (used as `source` and for name fallback)\n * @returns Populated `CatalogEntry` with kind `\"mcp-server\"`\n */\nexport function fromMcpServerMdContent(\n  content: string,\n  repoName: string,\n  filePath: string,\n): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n\n  // Extract runtime defaults into metadata\n  const metadata: Record<string, unknown> = {};\n  if (meta.transport) metadata.transport = String(meta.transport);\n  if (meta.command) metadata.command = String(meta.command);\n  if (Array.isArray(meta.args)) metadata.args = meta.args.map(String);\n  if (meta.env && typeof meta.env === \"object\" && !Array.isArray(meta.env)) {\n    metadata.env = meta.env as Record<string, string>;\n  }\n  if (meta.url) metadata.url = String(meta.url);\n  if (typeof meta.ca === \"string\") metadata.ca = meta.ca;\n  if (meta.headers && typeof meta.headers === \"object\" && !Array.isArray(meta.headers)) {\n    metadata.headers = meta.headers as Record<string, string>;\n  }\n  if (meta.recipe && typeof meta.recipe === \"object\" && !Array.isArray(meta.recipe)) {\n    metadata.recipe = meta.recipe;\n  }\n\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"mcp-server\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n    metadata: Object.keys(metadata).length > 0 ? metadata : undefined,\n  };\n}\n\n/**\n * Parse a `knowledge.yaml` file into a `CatalogEntry` with `kind: \"knowledge\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `knowledge.yaml` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"knowledge\"`\n * @docLink packages/core/concepts#from-knowledge-yaml\n */\nexport async function fromKnowledgeYaml(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromKnowledgeYamlContent(await readManifestFileOrEmpty(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromKnowledgeYaml} core over already-read content (no I/O). */\nfunction fromKnowledgeYamlContent(\n  content: string,\n  repoName: string,\n  filePath: string,\n): CatalogEntry {\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = (parse(content) as Record<string, unknown>) ?? {};\n  } catch {}\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"knowledge\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: String(meta.version ?? \"\"),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse a `CONNECTOR.md` file into a `CatalogEntry` with `kind: \"connector\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Frontmatter fields (catalog identity):\n *   - `name`        — connector name (default: parent dir name)\n *   - `description` — short description\n *   - `version`     — semver\n *\n * Frontmatter fields (runtime defaults, stored in `metadata`):\n *   - `entry`        — adapter entry point (default: \"./adapter.ts\")\n *   - `npm_deps`     — npm dependencies required by the adapter\n *   - `fields`       — configuration fields the adapter expects\n *   - `health_check` — whether to run a health check on connect\n *\n * The markdown body (below the frontmatter) is stored in `metadata.body`\n * so the runner can inject the connector's skill description into the\n * system prompt when `expose_as_skill` is enabled.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `CONNECTOR.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"connector\"`\n * @docLink packages/core/concepts#from-connector-md\n */\nexport async function fromConnectorMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromConnectorMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromConnectorMd} core over already-read content (no I/O). */\nfunction fromConnectorMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta, body } = parseFrontmatter(content);\n  const name = String(meta.name ?? basename(dirname(filePath)));\n  return {\n    name,\n    kind: \"connector\" as AssetKind,\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n    metadata: {\n      entry: meta.entry ?? \"./adapter.ts\",\n      npm_deps: meta.npm_deps ?? {},\n      fields: meta.fields ?? [],\n      health_check: meta.health_check ?? null,\n      body,\n    },\n  };\n}\n\n// ── Recursive walker ──────────────────────────────────────────────────────────\n\ninterface WalkEntry {\n  path: string;\n  name: string;\n}\n\n/** Default maximum directory nesting the walk descends into. */\nexport const DEFAULT_WALK_MAX_DEPTH = 32;\n\n/** Default maximum number of directory entries a single walk may examine. */\nexport const DEFAULT_WALK_MAX_ENTRIES = 50_000;\n\n/** Default wall-clock budget for one whole walk / scan pass, in milliseconds. */\nexport const DEFAULT_WALK_BUDGET_MS = 60_000;\n\n/** Env override for {@link DEFAULT_WALK_MAX_DEPTH}. */\nexport const WALK_MAX_DEPTH_ENV_VAR = \"SKAILE_SCAN_MAX_DEPTH\";\n\n/** Env override for {@link DEFAULT_WALK_MAX_ENTRIES}. */\nexport const WALK_MAX_ENTRIES_ENV_VAR = \"SKAILE_SCAN_MAX_ENTRIES\";\n\n/** Env override for {@link DEFAULT_WALK_BUDGET_MS}. */\nexport const WALK_BUDGET_MS_ENV_VAR = \"SKAILE_SCAN_DEADLINE_MS\";\n\n/** Read a positive-integer env override, falling back when absent or unusable. */\nfunction envInt(name: string, fallback: number): number {\n  const raw = process.env[name];\n  if (raw === undefined) return fallback;\n  const parsed = Number.parseInt(raw, 10);\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\n/**\n * Why a walk stopped early. Every one of these means the returned entries are a\n * **partial** view of the tree — never present a truncated walk as complete.\n *\n * @docLink packages/core/concepts#walk-dir\n */\nexport interface WalkTruncation {\n  reason: \"depth\" | \"entries\" | \"budget\" | \"cycle\" | \"unreadable\";\n  /** Directory (or symlink) at which the bound was hit. */\n  path: string;\n  /** The bound that was hit, when the reason has a numeric limit. */\n  limit?: number;\n}\n\n/**\n * Bounds for {@link walkDir} / {@link scanDirectory}.\n *\n * @docLink packages/core/concepts#walk-dir\n */\nexport interface WalkOptions {\n  /** Maximum nesting depth below the root. Default {@link DEFAULT_WALK_MAX_DEPTH}. */\n  maxDepth?: number;\n  /** Maximum directory entries examined across the whole walk. Default {@link DEFAULT_WALK_MAX_ENTRIES}. */\n  maxEntries?: number;\n  /**\n   * Wall-clock budget for the whole walk. Default {@link DEFAULT_WALK_BUDGET_MS}.\n   * The check is inclusive, so `0` yields no entries at all.\n   */\n  budgetMs?: number;\n  /** Per-`opendir`/`stat`/`readFile` deadline. Default {@link fsDeadlineMs}. */\n  opTimeoutMs?: number;\n  /**\n   * Called once per distinct truncation reason. Defaults to a `warn` on the\n   * core logger — override to route the signal somewhere the caller can act on.\n   */\n  onTruncate?: (info: WalkTruncation) => void;\n}\n\n/** Mutable bookkeeping threaded through one walk. */\ninterface WalkState {\n  maxDepth: number;\n  maxEntries: number;\n  opTimeoutMs: number | undefined;\n  deadlineAt: number;\n  examined: number;\n  /**\n   * `dev:ino` of the directories on the **current path from the root** — an\n   * ancestor stack, not an ever-visited set. Re-entering an ancestor is a cycle;\n   * re-reaching a directory off the current path is a diamond, and must be walked.\n   */\n  ancestors: Set<string>;\n  reported: Set<WalkTruncation[\"reason\"]>;\n  onTruncate: (info: WalkTruncation) => void;\n}\n\nlet walkLogger: ReturnType<typeof createLogger> | undefined;\n\n/** Default truncation sink — a structured warning naming the bound that was hit. */\nfunction warnTruncation(info: WalkTruncation): void {\n  walkLogger ??= createLogger({ kind: \"runner\", subkind: \"asset-scan\" });\n  walkLogger.warn(`asset scan truncated (${info.reason}) — results are incomplete`, {\n    ...info,\n  });\n}\n\n/** Record a truncation once per reason so a wide tree does not spam the log. */\nfunction truncate(state: WalkState, info: WalkTruncation): void {\n  if (state.reported.has(info.reason)) return;\n  state.reported.add(info.reason);\n  state.onTruncate(info);\n}\n\n/**\n * Stable identity (`dev:ino`) of the directory `path` resolves to, or `null`\n * when it cannot be stat'ed within the deadline. Used to terminate symlink\n * cycles — the pre-#454 walker recursed forever on `a/link -> a`.\n */\nasync function dirIdentity(path: string, timeoutMs: number | undefined): Promise<string | null> {\n  const st = await tryWithFsDeadline(`stat ${path}`, () => stat(path), null, timeoutMs);\n  return st ? `${st.dev}:${st.ino}` : null;\n}\n\n/**\n * Read one directory's entries under a deadline, capped at the walk's remaining\n * entry budget. Uses `opendir` rather than `readdir` so a pathological directory\n * streams instead of materialising in full; entries are collected and sorted\n * because the `scanDirectory` dedup rule (\"alphabetically later source wins\")\n * depends on a deterministic per-level order.\n */\nasync function readDirEntries(\n  dir: string,\n  state: WalkState,\n): Promise<{ entries: Dirent[]; capped: boolean } | null> {\n  const remaining = state.maxEntries - state.examined;\n  if (remaining <= 0) return { entries: [], capped: true };\n  try {\n    return await withFsDeadline(\n      `opendir ${dir}`,\n      async () => {\n        const handle = await opendir(dir);\n        const entries: Dirent[] = [];\n        let capped = false;\n        for await (const e of handle) {\n          // Stop *before* keeping the over-budget entry, so `capped` means \"an\n          // entry was actually dropped\". Breaking after the push instead marked\n          // a directory of exactly `remaining` entries as truncated — and since\n          // `truncate()` reports once per reason for the whole walk, that\n          // spurious first report swallowed a later genuine one.\n          if (entries.length >= remaining) {\n            capped = true;\n            break;\n          }\n          entries.push(e);\n        }\n        entries.sort((a, b) => (a.name < b.name ? -1 : 1));\n        return { entries, capped };\n      },\n      state.opTimeoutMs,\n    );\n  } catch {\n    // Unreadable (permissions, vanished mid-walk) or the mount missed its\n    // deadline. Either way this subtree contributes nothing; keep walking.\n    truncate(state, { reason: \"unreadable\", path: dir });\n    return null;\n  }\n}\n\n/**\n * Recursively yield every file entry under `dir`, sorted alphabetically at each\n * level. Skips `.git` and `node_modules` directories and follows symlinks\n * (resolving to the stat target). `node_modules` is excluded because Bun's\n * `node_modules/.bun/...` layout contains symlink farms that form cycles when\n * packages reference each other transitively.\n *\n * **Async and bounded since #454.** A repo root can resolve onto the rclone FUSE\n * mount, where the previous synchronous `readdirSync`/`statSync` walk parked the\n * whole event loop. Four bounds now hold, and hitting any of them reports a\n * {@link WalkTruncation} — a truncated walk is never presented as a complete one:\n *\n * - **depth** ({@link WalkOptions.maxDepth}) — also the backstop for a cycle no\n *   inode check can see, e.g. a bind mount of the root inside itself.\n * - **entry count** ({@link WalkOptions.maxEntries}) — total directory entries\n *   examined, so an enormous tree cannot run unbounded.\n * - **wall-clock budget** ({@link WalkOptions.budgetMs}) — a wedged mount that\n *   times out one operation at a time cannot add up to an unbounded scan.\n * - **ancestor inodes** — the `dev:ino` of every directory on the path from the\n *   root is held while its subtree is walked, so `a/link -> a` terminates\n *   instead of recursing forever. Two sibling symlinks onto one shared\n *   directory are a diamond, not a cycle: both are walked, at the price of\n *   visiting the shared subtree twice — bounded by the entry and time budgets.\n *\n * @param dir - Absolute path to the directory to walk\n * @param options - Bounds and truncation sink; see {@link WalkOptions}\n * @docLink packages/core/concepts#walk-dir\n */\nexport async function* walkDir(dir: string, options: WalkOptions = {}): AsyncGenerator<WalkEntry> {\n  const state: WalkState = {\n    maxDepth: options.maxDepth ?? envInt(WALK_MAX_DEPTH_ENV_VAR, DEFAULT_WALK_MAX_DEPTH),\n    maxEntries: options.maxEntries ?? envInt(WALK_MAX_ENTRIES_ENV_VAR, DEFAULT_WALK_MAX_ENTRIES),\n    opTimeoutMs: options.opTimeoutMs,\n    deadlineAt:\n      Date.now() + (options.budgetMs ?? envInt(WALK_BUDGET_MS_ENV_VAR, DEFAULT_WALK_BUDGET_MS)),\n    examined: 0,\n    ancestors: new Set<string>(),\n    reported: new Set<WalkTruncation[\"reason\"]>(),\n    onTruncate: options.onTruncate ?? warnTruncation,\n  };\n  // The root is an ancestor of everything, so it is seeded here and never\n  // popped — a self-referential `root/link -> root` is caught on first descent.\n  const rootId = await dirIdentity(dir, state.opTimeoutMs);\n  if (rootId) state.ancestors.add(rootId);\n  yield* walkFrom(dir, 0, state);\n}\n\nasync function* walkFrom(dir: string, depth: number, state: WalkState): AsyncGenerator<WalkEntry> {\n  if (depth > state.maxDepth) {\n    truncate(state, { reason: \"depth\", path: dir, limit: state.maxDepth });\n    return;\n  }\n  if (Date.now() >= state.deadlineAt) {\n    truncate(state, { reason: \"budget\", path: dir });\n    return;\n  }\n\n  const read = await readDirEntries(dir, state);\n  if (!read) return;\n  if (read.capped) truncate(state, { reason: \"entries\", path: dir, limit: state.maxEntries });\n\n  for (const e of read.entries) {\n    if (state.examined >= state.maxEntries) {\n      truncate(state, { reason: \"entries\", path: dir, limit: state.maxEntries });\n      return;\n    }\n    if (Date.now() >= state.deadlineAt) {\n      truncate(state, { reason: \"budget\", path: dir });\n      return;\n    }\n    state.examined++;\n    const full = join(dir, e.name);\n\n    if (e.isSymbolicLink()) {\n      // A symlink is the only way a cycle can enter this walk, so identity is\n      // resolved here and nowhere else — one extra stat per link, none per\n      // ordinary directory.\n      const st = await tryWithFsDeadline(`stat ${full}`, () => stat(full), null, state.opTimeoutMs);\n      if (!st) continue;\n      if (st.isDirectory()) {\n        if (e.name === \".git\" || e.name === \"node_modules\") continue;\n        const id = `${st.dev}:${st.ino}`;\n        // Only an *ancestor* is a cycle. A target already walked elsewhere in\n        // the tree is a diamond (`a/link -> shared`, `b/link -> shared`) and\n        // dropping it would silently lose that subtree from the scan.\n        if (state.ancestors.has(id)) {\n          truncate(state, { reason: \"cycle\", path: full });\n          continue;\n        }\n        state.ancestors.add(id);\n        try {\n          yield* walkFrom(full, depth + 1, state);\n        } finally {\n          // finally, not a trailing delete: an early `return` from the bounds\n          // checks — or an abandoned consumer — would otherwise leave the\n          // ancestor stack holding a directory the walk has already left.\n          state.ancestors.delete(id);\n        }\n      } else {\n        yield { path: full, name: e.name };\n      }\n    } else if (e.isDirectory()) {\n      if (e.name !== \".git\" && e.name !== \"node_modules\") yield* walkFrom(full, depth + 1, state);\n    } else if (e.isFile()) {\n      yield { path: full, name: e.name };\n    }\n  }\n}\n\n// ── Public scanner ────────────────────────────────────────────────────────────\n\n/**\n * Coerce a scanned entry's `name` to a canonical asset name in place. When the\n * raw name is already canonical this is a no-op; otherwise the original is stashed\n * on `metadata.displayName` (only when not already set) so callers keep the pretty\n * label for display while identity uses the slug. A name that slugifies to empty\n * is left untouched — `parseAssetRef` will reject it downstream with its full hint.\n */\nfunction normalizeEntryName(e: CatalogEntry): void {\n  if (isValidAssetName(e.name)) return;\n  let slug: string;\n  try {\n    slug = slugifyAssetName(e.name);\n  } catch {\n    return;\n  }\n  const original = e.name;\n  e.name = slug;\n  if (e.metadata?.displayName === undefined) {\n    e.metadata = { ...e.metadata, displayName: original };\n  }\n}\n\n/**\n * Build a `CatalogEntry` from an already-read manifest, dispatching on filename.\n * Returns `null` when the filename is not a recognized manifest.\n */\nfunction entryFromManifest(\n  name: string,\n  content: string,\n  filePath: string,\n  repoName: string,\n): CatalogEntry | null {\n  if (name === \"SKILL.md\") return fromSkillMdContent(content, repoName, filePath);\n  if (name === \"AGENT.md\") return fromAgentMdContent(content, repoName, filePath);\n  if (name === \"agent.yaml\") return fromAgentYamlContent(content, repoName, filePath);\n  if (name === \"CONTRACT.md\") return fromContractMdContent(content, repoName, filePath);\n  if (name === \"MCP.md\") return fromMcpServerMdContent(content, repoName, filePath);\n  if (name === \"CONNECTOR.md\") return fromConnectorMdContent(content, repoName, filePath);\n  if (name === \"knowledge.yaml\") return fromKnowledgeYamlContent(content, repoName, filePath);\n  if (name.endsWith(\".prompt.md\")) return fromPromptMdContent(content, repoName, filePath);\n  if (name.endsWith(\".bundle.yaml\")) return fromBundleYamlContent(content, repoName, filePath);\n  if (name.endsWith(\".flow.yaml\") || name.endsWith(\".flow.json\"))\n    return fromFlowYamlContent(content, repoName, filePath);\n  return null;\n}\n\n/** Filenames {@link scanDirectory} recognises as asset manifests. */\nfunction isManifestName(name: string): boolean {\n  return (\n    name === \"SKILL.md\" ||\n    name === \"AGENT.md\" ||\n    name === \"agent.yaml\" ||\n    name === \"CONTRACT.md\" ||\n    name === \"MCP.md\" ||\n    name === \"CONNECTOR.md\" ||\n    name === \"knowledge.yaml\" ||\n    name.endsWith(\".prompt.md\") ||\n    name.endsWith(\".bundle.yaml\") ||\n    name.endsWith(\".flow.yaml\") ||\n    name.endsWith(\".flow.json\")\n  );\n}\n\n/**\n * Walk `root` recursively and return a `CatalogEntry` for every recognized asset manifest found.\n *\n * Recognized filenames: `SKILL.md`, `AGENT.md`, `agent.yaml`, `CONTRACT.md`, `MCP.md`,\n * `CONNECTOR.md`, `knowledge.yaml`, `*.prompt.md`, `*.bundle.yaml`, `*.flow.yaml`, `*.flow.json`.\n *\n * When two entries share the same `kind:name` key, the one with the alphabetically\n * later source path wins (consistent with catalog precedence rules).\n *\n * **Async and bounded since #454.** `root` can resolve onto the rclone FUSE mount\n * (a `sources[].path` under `/skaile/workspace`), and the walk follows symlinks, so\n * even an off-mount root can descend into one. Every `opendir`/`stat`/`readFile`\n * is deadline-bounded and the walk is capped by depth, entry count, a wall-clock\n * budget, and an ancestor-inode set — see {@link walkDir}. Hitting any bound reports\n * a {@link WalkTruncation} through {@link WalkOptions.onTruncate} (a `warn` by\n * default); the returned array is then a **partial** scan, never a complete one.\n *\n * A manifest that cannot be read within its deadline is skipped rather than\n * failing the whole scan — one unreachable file must not cost the whole catalog.\n *\n * @param root - Absolute path to the directory tree to scan\n * @param repoName - Repository name attached to every produced entry\n * @param options - Walk bounds and truncation sink; see {@link WalkOptions}\n * @returns Array of deduplicated `CatalogEntry` objects, one per manifest file\n * @docLink packages/core/concepts#scan-directory\n */\nexport async function scanDirectory(\n  root: string,\n  repoName: string,\n  options: WalkOptions = {},\n): Promise<CatalogEntry[]> {\n  const entries = new Map<string, CatalogEntry>();\n  const onTruncate = options.onTruncate ?? warnTruncation;\n  const reported = new Set<WalkTruncation[\"reason\"]>();\n  const relay = (info: WalkTruncation) => {\n    reported.add(info.reason);\n    onTruncate(info);\n  };\n  const opTimeoutMs = options.opTimeoutMs ?? fsDeadlineMs();\n\n  function add(e: CatalogEntry): void {\n    // Boundary normalization: a third-party source we don't control may name an\n    // asset with a human-styled identity (\"Complex App\"). Slugify it to a\n    // canonical name so the ref it produces parses, preserving the original on\n    // `metadata.displayName` for display. No-op for already-canonical names.\n    normalizeEntryName(e);\n    const key = `${e.kind}:${e.name}`;\n    const existing = entries.get(key);\n    if (!existing) {\n      entries.set(key, e);\n      return;\n    }\n    // Among duplicates, alphabetically later source path wins\n    if (e.source > existing.source) entries.set(key, e);\n  }\n\n  for await (const { path: filePath, name } of walkDir(root, {\n    ...options,\n    opTimeoutMs,\n    onTruncate: relay,\n  })) {\n    if (!isManifestName(name)) continue;\n    const content = await tryWithFsDeadline(\n      `readFile ${filePath}`,\n      () => readFile(filePath, \"utf8\"),\n      null,\n      opTimeoutMs,\n    );\n    if (content === null) {\n      // Unreadable or past its deadline — the catalog loses this asset, not the\n      // whole scan. Reported once so a wedged mount is visible in the logs.\n      if (!reported.has(\"unreadable\")) relay({ reason: \"unreadable\", path: filePath });\n      continue;\n    }\n    try {\n      const entry = entryFromManifest(name, content, filePath, repoName);\n      if (entry) add(entry);\n    } catch {}\n  }\n\n  return [...entries.values()];\n}\n"]}
+{"version":3,"sources":["../core/src/fs-deadline.ts","../core/src/manifest.ts"],"names":[],"mappings":";;;;;;;AA4BO,IAAM,sBAAA,GAAyB;AAQ/B,IAAM,mBAAA,GAAsB;AAQ5B,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EAChC,SAAA;AAAA,EACA,SAAA;AAAA,EAET,WAAA,CAAY,WAAmB,SAAA,EAAmB;AAChD,IAAA,KAAA;AAAA,MACE,CAAA,sBAAA,EAAyB,SAAS,CAAA,WAAA,EAAc,SAAS,CAAA,uCAAA;AAAA,KAC3D;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAYO,SAAS,YAAA,CAAa,WAAmB,sBAAA,EAAgC;AAC9E,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC3C,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,QAAA;AAC9B,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,EAAE,CAAA;AAGtC,EAAA,OAAO,OAAO,QAAA,CAAS,MAAM,CAAA,IAAK,MAAA,GAAS,IAAI,MAAA,GAAS,QAAA;AAC1D;AAaA,eAAsB,cAAA,CACpB,SAAA,EACA,EAAA,EACA,SAAA,GAAoB,cAAa,EACrB;AACZ,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,QAAQ,IAAA,CAAK;AAAA,MACxB,EAAA,EAAG;AAAA,MACH,IAAI,OAAA,CAAe,CAAC,QAAA,EAAU,MAAA,KAAW;AACvC,QAAA,KAAA,GAAQ,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,gBAAgB,SAAA,EAAW,SAAS,CAAC,CAAA,EAAG,SAAS,CAAA;AAGrF,QAAA,KAAA,CAAM,KAAA,IAAQ;AAAA,MAChB,CAAC;AAAA,KACF,CAAA;AAAA,EACH,CAAA,SAAE;AACA,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAAA,EAC7C;AACF;AAeA,eAAsB,kBACpB,SAAA,EACA,EAAA,EACA,QAAA,EACA,SAAA,GAAoB,cAAa,EACrB;AACZ,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,cAAA,CAAe,SAAA,EAAW,EAAA,EAAI,SAAS,CAAA;AAAA,EACtD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AACF;;;AClGA,SAAS,gBAAA,CAAiB,UAAkB,SAAA,EAAqC;AAC/E,EAAA,OAAO,cAAA,CAAe,YAAY,QAAQ,CAAA,CAAA,EAAI,MAAM,QAAA,CAAS,QAAA,EAAU,MAAM,CAAA,EAAG,SAAS,CAAA;AAC3F;AAQA,SAAS,uBAAA,CAAwB,UAAkB,SAAA,EAAqC;AACtF,EAAA,OAAO,iBAAA,CAAkB,CAAA,SAAA,EAAY,QAAQ,CAAA,CAAA,EAAI,MAAM,SAAS,QAAA,EAAU,MAAM,CAAA,EAAG,EAAA,EAAI,SAAS,CAAA;AAClG;AAuBO,SAAS,iBAAiB,IAAA,EAAiC;AAChE,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,0BAA0B,CAAA;AAC/C,EAAA,IAAI,CAAC,CAAA,EAAG,OAAO,EAAE,IAAA,EAAM,EAAC,EAAG,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,EAAE;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,OAAQ,KAAA,CAAM,CAAA,CAAE,CAAC,CAAE,KAAiC,EAAC;AAC3D,IAAA,MAAM,IAAA,GAAO,KAAK,KAAA,CAAM,CAAA,CAAE,CAAC,CAAA,CAAE,MAAM,EAAE,IAAA,EAAK;AAC1C,IAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,IAAA,EAAM,IAAI,IAAA,EAAM,IAAA,CAAK,MAAK,EAAE;AAAA,EACvC;AACF;AAGA,SAAS,eAAe,IAAA,EAAuC;AAC7D,EAAA,OAAO,MAAA;AAAA,IACL,IAAA,CAAK,OAAA,IAAY,IAAA,CAAK,QAAA,EAAkD,OAAA,IAAW;AAAA,GACrF;AACF;AAaO,SAAS,cAAc,IAAA,EAA6C;AACzE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,IAAa,IAAA,CAAK,QAAA,EAAkD,QAAA;AACrF,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAClB,EAAA,MAAM,IAAA,GACJ,OAAO,GAAA,KAAQ,QAAA,GACX,IAAI,KAAA,CAAM,GAAG,EAAE,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,GAClC,KAAA,CAAM,QAAQ,GAAG,CAAA,GACd,MACD,EAAC;AACT,EAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,CAAE,IAAI,QAAQ,CAAA;AAC1C;AASA,SAAS,gBAAA,CAAiB,KAAc,GAAA,EAAyB;AAC/D,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzB,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,KAAM,IAAA,IAAQ,UAAU,CAAA,EAAG;AACtD,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,MAAA,CAAQ,CAAA,CAA8B,IAAI,CAAA,EAAG,CAAA;AAAA,IAC/E;AAAA,EACF;AACF;AAMA,SAAS,iBAAA,CAAkB,GAAA,EAAc,IAAA,EAA0B,GAAA,EAAyB;AAC1F,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzB,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,EAAG,GAAA,CAAI,KAAK,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA,EAAG,CAAA;AAAA,EAC5D;AACF;AASA,SAAS,gBAAA,CAAiB,GAAA,EAAc,WAAA,EAAqB,GAAA,EAAyB;AACpF,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzB,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAC,CAAA,EAAG;AACjC,IAAA,IAAI,EAAE,UAAA,CAAW,GAAG,KAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG;AAE5C,IAAA,MAAM,UAAA,GAAa,EAAE,QAAA,CAAS,GAAG,IAAI,CAAA,GAAI,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AAE5D,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,MAAM,OAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,QAAQ,EAAE,IAAA,EAAK;AAChD,IAAA,IAAI,OAAO,UAAA,CAAW,KAAA,CAAM,QAAA,GAAW,CAAC,EAAE,IAAA,EAAK;AAC/C,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAChC,IAAA,IAAI,OAAA,KAAY,IAAI,IAAA,GAAO,IAAA,CAAK,MAAM,CAAA,EAAG,OAAO,EAAE,IAAA,EAAK;AACvD,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AAExB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,MAAA,IAAA,GAAO,QAAA,KAAa,KAAK,IAAA,CAAK,KAAA,CAAM,WAAW,CAAC,CAAA,CAAE,MAAK,GAAI,EAAA;AAAA,IAC7D,CAAA,MAAO;AAEL,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC9B,MAAA,IAAA,GAAO,KAAA,KAAU,KAAK,IAAA,CAAK,KAAA,CAAM,GAAG,KAAK,CAAA,CAAE,MAAK,GAAI,IAAA;AAAA,IACtD;AACA,IAAA,IAAI,MAAM,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EACnC;AACF;AAgBA,eAAsB,WAAA,CAAY,UAAkB,QAAA,EAAyC;AAC3F,EAAA,OAAO,mBAAmB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AAChF;AAGA,SAAS,kBAAA,CAAmB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC7F,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,CAAC,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,WAAW,SAAA,EAAW,WAAW,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA;AAChF,IAAA,IAAA,GAAO,OAAA;AACT,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA;AAAA,IACA,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AAaA,eAAsB,WAAA,CAAY,UAAkB,QAAA,EAAyC;AAC3F,EAAA,OAAO,mBAAmB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AAChF;AAGA,SAAS,kBAAA,CAAmB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC7F,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,OAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AAcA,eAAsB,aAAA,CAAc,UAAkB,QAAA,EAAyC;AAC7F,EAAA,OAAO,qBAAqB,MAAM,uBAAA,CAAwB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACzF;AAGA,SAAS,oBAAA,CAAqB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC/F,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,KAAA,CAAM,OAAO,CAAA,IAAiC,EAAC;AAAA,EACzD,CAAA,CAAA,MAAQ;AAAA,EAAC;AAET,EAAA,MAAM,WAAyB,EAAC;AAGhC,EAAA,gBAAA,CAAiB,IAAA,CAAK,UAAU,QAAQ,CAAA;AAExC,EAAA,gBAAA,CAAiB,IAAA,CAAK,cAAc,QAAQ,CAAA;AAE5C,EAAA,iBAAA,CAAkB,IAAA,CAAK,SAAA,EAAW,OAAA,EAAS,QAAQ,CAAA;AAEnD,EAAA,iBAAA,CAAkB,IAAA,CAAK,SAAA,EAAW,UAAA,EAAY,QAAQ,CAAA;AAItD,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,WAAW,CAAA,IAAK;AAAA,IACjC,CAAC,WAAW,SAAS,CAAA;AAAA,IACrB,CAAC,SAAS,SAAS,CAAA;AAAA,IACnB,CAAC,aAAa,WAAW;AAAA,GAC3B,EAAY;AACV,IAAA,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG,WAAA,EAAa,QAAQ,CAAA;AAAA,EACrD;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,OAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAAA,IAClC,QAAA;AAAA,IACA,cAAc;AAAC,GACjB;AACF;AAcA,eAAsB,YAAA,CAAa,UAAkB,QAAA,EAAyC;AAC5F,EAAA,OAAO,oBAAoB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACjF;AAGA,SAAS,mBAAA,CAAoB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC9F,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,QAAA,CAAS,QAAQ,CAAA,CAAE,OAAA,CAAQ,eAAA,EAAiB,EAAE,CAAC,CAAA;AAChF,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,IAAA,EAAM,QAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AAaA,eAAsB,YAAA,CAAa,UAAkB,QAAA,EAAyC;AAC5F,EAAA,OAAO,oBAAoB,MAAM,uBAAA,CAAwB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACxF;AAGA,SAAS,mBAAA,CAAoB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAC9F,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,KAAA,CAAM,OAAO,CAAA,IAAiC,EAAC;AAAA,EACzD,CAAA,CAAA,MAAQ;AAAA,EAAC;AAET,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,QAAQ,CAAA,CAC3B,OAAA,CAAQ,iBAAiB,EAAE,CAAA,CAC3B,OAAA,CAAQ,eAAA,EAAiB,EAAE,CAAA;AAC9B,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACzC,IAAA,EAAM,MAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAAA,IAClC,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AAcA,eAAsB,cAAA,CAAe,UAAkB,QAAA,EAAyC;AAC9F,EAAA,OAAO,sBAAsB,MAAM,uBAAA,CAAwB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AAC1F;AAGA,SAAS,qBAAA,CAAsB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAChG,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,KAAA,CAAM,OAAO,CAAA,IAAiC,EAAC;AAAA,EACzD,CAAA,CAAA,MAAQ;AAAA,EAAC;AAET,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,QAAA,CAAS,QAAQ,CAAA,CAAE,OAAA,CAAQ,iBAAA,EAAmB,EAAE,CAAC,CAAA;AAElF,EAAA,MAAM,OAAO,IAAA,CAAK,YAAA;AAClB,EAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,IAAI,IAAK,IAAA,CAAkB,MAAA,CAAO,OAAO,CAAA,GAAI,EAAC;AAEjF,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,IAAA,EAAM,QAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAAA,IAClC,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B;AAAA,GACF;AACF;AAmBA,eAAsB,cAAc,QAAA,EAAqC;AACvE,EAAA,OAAO,wBAAA,CAAyB,MAAM,uBAAA,CAAwB,QAAQ,GAAG,QAAQ,CAAA;AACnF;AAGA,SAAS,wBAAA,CAAyB,SAAiB,QAAA,EAA4B;AAI7E,EAAA,MAAM,QAAA,GAAW,yCAAA,CAA0C,IAAA,CAAK,QAAQ,CAAA;AACxE,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,QAAA,GACD,MAAM,OAAO,CAAA,IAAiC,EAAC,GACjD,gBAAA,CAAiB,OAAO,CAAA,CAAE,IAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,OAAA,GAAU,CAAC,CAAA,KAAe;AAC9B,IAAA,IAAI,KAAA,CAAM,QAAQ,CAAC,CAAA,EAAA;AACjB,MAAA,KAAA,MAAW,CAAA,IAAK,CAAA,EAAG,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,IAAA,EAAK,EAAG,GAAA,CAAI,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA;AAAA,IAAA;AAAA,EAC/E,CAAA;AACA,EAAA,OAAA,CAAQ,KAAK,QAAQ,CAAA;AACrB,EAAA,OAAA,CAAS,IAAA,CAAK,UAAkD,QAAQ,CAAA;AACxE,EAAA,OAAA,CAAQ,KAAK,YAAY,CAAA;AACzB,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACzB;AAaA,eAAsB,cAAA,CAAe,UAAkB,QAAA,EAAyC;AAC9F,EAAA,OAAO,sBAAsB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACnF;AAGA,SAAS,qBAAA,CAAsB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AAChG,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,UAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AA+BA,eAAsB,eAAA,CAAgB,UAAkB,QAAA,EAAyC;AAC/F,EAAA,OAAO,uBAAuB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACpF;AAYO,SAAS,sBAAA,CACd,OAAA,EACA,QAAA,EACA,QAAA,EACc;AACd,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAG/C,EAAA,MAAM,WAAoC,EAAC;AAC3C,EAAA,IAAI,KAAK,SAAA,EAAW,QAAA,CAAS,SAAA,GAAY,MAAA,CAAO,KAAK,SAAS,CAAA;AAC9D,EAAA,IAAI,KAAK,OAAA,EAAS,QAAA,CAAS,OAAA,GAAU,MAAA,CAAO,KAAK,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,WAAY,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAClE,EAAA,IAAI,IAAA,CAAK,GAAA,IAAO,OAAO,IAAA,CAAK,GAAA,KAAQ,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AACxE,IAAA,QAAA,CAAS,MAAM,IAAA,CAAK,GAAA;AAAA,EACtB;AACA,EAAA,IAAI,KAAK,GAAA,EAAK,QAAA,CAAS,GAAA,GAAM,MAAA,CAAO,KAAK,GAAG,CAAA;AAC5C,EAAA,IAAI,OAAO,IAAA,CAAK,EAAA,KAAO,QAAA,EAAU,QAAA,CAAS,KAAK,IAAA,CAAK,EAAA;AACpD,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACpF,IAAA,QAAA,CAAS,UAAU,IAAA,CAAK,OAAA;AAAA,EAC1B;AACA,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,OAAO,IAAA,CAAK,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA,EAAG;AACjF,IAAA,QAAA,CAAS,SAAS,IAAA,CAAK,MAAA;AAAA,EACzB;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,YAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc,EAAC;AAAA,IACf,UAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,MAAA,GAAS,IAAI,QAAA,GAAW;AAAA,GAC1D;AACF;AAaA,eAAsB,iBAAA,CAAkB,UAAkB,QAAA,EAAyC;AACjG,EAAA,OAAO,yBAAyB,MAAM,uBAAA,CAAwB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AAC7F;AAGA,SAAS,wBAAA,CACP,OAAA,EACA,QAAA,EACA,QAAA,EACc;AACd,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,KAAA,CAAM,OAAO,CAAA,IAAiC,EAAC;AAAA,EACzD,CAAA,CAAA,MAAQ;AAAA,EAAC;AACT,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAAA,IACrD,IAAA,EAAM,WAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAAA,IAClC,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc;AAAC,GACjB;AACF;AA4BA,eAAsB,eAAA,CAAgB,UAAkB,QAAA,EAAyC;AAC/F,EAAA,OAAO,uBAAuB,MAAM,gBAAA,CAAiB,QAAQ,CAAA,EAAG,UAAU,QAAQ,CAAA;AACpF;AAGA,SAAS,sBAAA,CAAuB,OAAA,EAAiB,QAAA,EAAkB,QAAA,EAAgC;AACjG,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AACrD,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,IAAA,IAAQ,SAAS,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAC5D,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,IAAA,EAAM,WAAA;AAAA,IACN,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,WAAA,IAAe,EAAE,CAAA;AAAA,IAC1C,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,QAAA;AAAA,IACX,OAAA,EAAS,eAAe,IAAI,CAAA;AAAA,IAC5B,QAAA,EAAU,cAAc,IAAI,CAAA;AAAA,IAC5B,cAAc,EAAC;AAAA,IACf,QAAA,EAAU;AAAA,MACR,KAAA,EAAO,KAAK,KAAA,IAAS,cAAA;AAAA,MACrB,QAAA,EAAU,IAAA,CAAK,QAAA,IAAY,EAAC;AAAA,MAC5B,MAAA,EAAQ,IAAA,CAAK,MAAA,IAAU,EAAC;AAAA,MACxB,YAAA,EAAc,KAAK,YAAA,IAAgB,IAAA;AAAA,MACnC;AAAA;AACF,GACF;AACF;AAUO,IAAM,sBAAA,GAAyB;AAG/B,IAAM,wBAAA,GAA2B;AAGjC,IAAM,sBAAA,GAAyB;AAG/B,IAAM,sBAAA,GAAyB;AAG/B,IAAM,wBAAA,GAA2B;AAGjC,IAAM,sBAAA,GAAyB;AAGtC,SAAS,MAAA,CAAO,MAAc,QAAA,EAA0B;AACtD,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAC5B,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,QAAA;AAC9B,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,EAAE,CAAA;AACtC,EAAA,OAAO,OAAO,QAAA,CAAS,MAAM,CAAA,IAAK,MAAA,GAAS,IAAI,MAAA,GAAS,QAAA;AAC1D;AAyDA,IAAI,UAAA;AAGJ,SAAS,eAAe,IAAA,EAA4B;AAClD,EAAA,UAAA,KAAe,aAAa,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAc,CAAA;AACrE,EAAA,UAAA,CAAW,IAAA,CAAK,CAAA,sBAAA,EAAyB,IAAA,CAAK,MAAM,CAAA,+BAAA,CAAA,EAA8B;AAAA,IAChF,GAAG;AAAA,GACJ,CAAA;AACH;AAGA,SAAS,QAAA,CAAS,OAAkB,IAAA,EAA4B;AAC9D,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA,EAAG;AACrC,EAAA,KAAA,CAAM,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AAC9B,EAAA,KAAA,CAAM,WAAW,IAAI,CAAA;AACvB;AAOA,eAAe,WAAA,CAAY,MAAc,SAAA,EAAuD;AAC9F,EAAA,MAAM,EAAA,GAAK,MAAM,iBAAA,CAAkB,CAAA,KAAA,EAAQ,IAAI,CAAA,CAAA,EAAI,MAAM,IAAA,CAAK,IAAI,CAAA,EAAG,IAAA,EAAM,SAAS,CAAA;AACpF,EAAA,OAAO,KAAK,CAAA,EAAG,EAAA,CAAG,GAAG,CAAA,CAAA,EAAI,EAAA,CAAG,GAAG,CAAA,CAAA,GAAK,IAAA;AACtC;AASA,eAAe,cAAA,CACb,KACA,KAAA,EACwD;AACxD,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,UAAA,GAAa,KAAA,CAAM,QAAA;AAC3C,EAAA,IAAI,SAAA,IAAa,GAAG,OAAO,EAAE,SAAS,EAAC,EAAG,QAAQ,IAAA,EAAK;AACvD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,cAAA;AAAA,MACX,WAAW,GAAG,CAAA,CAAA;AAAA,MACd,YAAY;AACV,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAG,CAAA;AAChC,QAAA,MAAM,UAAoB,EAAC;AAC3B,QAAA,IAAI,MAAA,GAAS,KAAA;AACb,QAAA,WAAA,MAAiB,KAAK,MAAA,EAAQ;AAM5B,UAAA,IAAI,OAAA,CAAQ,UAAU,SAAA,EAAW;AAC/B,YAAA,MAAA,GAAS,IAAA;AACT,YAAA;AAAA,UACF;AACA,UAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,QAChB;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAO,EAAE,IAAA,GAAO,CAAA,CAAE,IAAA,GAAO,CAAA,CAAA,GAAK,CAAE,CAAA;AACjD,QAAA,OAAO,EAAE,SAAS,MAAA,EAAO;AAAA,MAC3B,CAAA;AAAA,MACA,KAAA,CAAM;AAAA,KACR;AAAA,EACF,CAAA,CAAA,MAAQ;AAGN,IAAA,QAAA,CAAS,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAc,IAAA,EAAM,KAAK,CAAA;AACnD,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AA8BA,gBAAuB,OAAA,CAAQ,GAAA,EAAa,OAAA,GAAuB,EAAC,EAA8B;AAChG,EAAA,MAAM,KAAA,GAAmB;AAAA,IACvB,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,MAAA,CAAO,wBAAwB,sBAAsB,CAAA;AAAA,IACnF,UAAA,EAAY,OAAA,CAAQ,UAAA,IAAc,MAAA,CAAO,0BAA0B,wBAAwB,CAAA;AAAA,IAC3F,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,UAAA,EACE,KAAK,GAAA,EAAI,IAAK,QAAQ,QAAA,IAAY,MAAA,CAAO,wBAAwB,sBAAsB,CAAA,CAAA;AAAA,IACzF,QAAA,EAAU,CAAA;AAAA,IACV,SAAA,sBAAe,GAAA,EAAY;AAAA,IAC3B,QAAA,sBAAc,GAAA,EAA8B;AAAA,IAC5C,UAAA,EAAY,QAAQ,UAAA,IAAc;AAAA,GACpC;AAGA,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,GAAA,EAAK,MAAM,WAAW,CAAA;AACvD,EAAA,IAAI,MAAA,EAAQ,KAAA,CAAM,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACtC,EAAA,OAAO,QAAA,CAAS,GAAA,EAAK,CAAA,EAAG,KAAK,CAAA;AAC/B;AAEA,gBAAgB,QAAA,CAAS,GAAA,EAAa,KAAA,EAAe,KAAA,EAA6C;AAChG,EAAA,IAAI,KAAA,GAAQ,MAAM,QAAA,EAAU;AAC1B,IAAA,QAAA,CAAS,KAAA,EAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,GAAA,EAAK,KAAA,EAAO,KAAA,CAAM,QAAA,EAAU,CAAA;AACrE,IAAA;AAAA,EACF;AACA,EAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,CAAM,UAAA,EAAY;AAClC,IAAA,QAAA,CAAS,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,KAAK,CAAA;AAC/C,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,KAAK,CAAA;AAC5C,EAAA,IAAI,CAAC,IAAA,EAAM;AACX,EAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,QAAA,CAAS,KAAA,EAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,IAAA,EAAM,GAAA,EAAK,KAAA,EAAO,KAAA,CAAM,UAAA,EAAY,CAAA;AAE1F,EAAA,KAAA,MAAW,CAAA,IAAK,KAAK,OAAA,EAAS;AAC5B,IAAA,IAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,UAAA,EAAY;AACtC,MAAA,QAAA,CAAS,KAAA,EAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,MAAM,GAAA,EAAK,KAAA,EAAO,KAAA,CAAM,UAAA,EAAY,CAAA;AACzE,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,KAAA,CAAM,UAAA,EAAY;AAClC,MAAA,QAAA,CAAS,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,KAAK,CAAA;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,KAAA,CAAM,QAAA,EAAA;AACN,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,CAAA;AAE7B,IAAA,IAAI,CAAA,CAAE,gBAAe,EAAG;AAItB,MAAA,MAAM,EAAA,GAAK,MAAM,iBAAA,CAAkB,CAAA,KAAA,EAAQ,IAAI,CAAA,CAAA,EAAI,MAAM,IAAA,CAAK,IAAI,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,WAAW,CAAA;AAC5F,MAAA,IAAI,CAAC,EAAA,EAAI;AACT,MAAA,IAAI,EAAA,CAAG,aAAY,EAAG;AACpB,QAAA,IAAI,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,SAAS,cAAA,EAAgB;AACpD,QAAA,MAAM,KAAK,CAAA,EAAG,EAAA,CAAG,GAAG,CAAA,CAAA,EAAI,GAAG,GAAG,CAAA,CAAA;AAI9B,QAAA,IAAI,KAAA,CAAM,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA,EAAG;AAC3B,UAAA,QAAA,CAAS,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,MAAM,CAAA;AAC/C,UAAA;AAAA,QACF;AACA,QAAA,KAAA,CAAM,SAAA,CAAU,IAAI,EAAE,CAAA;AACtB,QAAA,IAAI;AACF,UAAA,OAAO,QAAA,CAAS,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,QACxC,CAAA,SAAE;AAIA,UAAA,KAAA,CAAM,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,QAC3B;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,EAAE,IAAA,EAAK;AAAA,MACnC;AAAA,IACF,CAAA,MAAA,IAAW,CAAA,CAAE,WAAA,EAAY,EAAG;AAC1B,MAAA,IAAI,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,cAAA,EAAgB,OAAO,QAAA,CAAS,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,IAC5F,CAAA,MAAA,IAAW,CAAA,CAAE,MAAA,EAAO,EAAG;AACrB,MAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,EAAE,IAAA,EAAK;AAAA,IACnC;AAAA,EACF;AACF;AAWA,SAAS,mBAAmB,CAAA,EAAuB;AACjD,EAAA,IAAI,gBAAA,CAAiB,CAAA,CAAE,IAAI,CAAA,EAAG;AAC9B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,gBAAA,CAAiB,EAAE,IAAI,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,WAAW,CAAA,CAAE,IAAA;AACnB,EAAA,CAAA,CAAE,IAAA,GAAO,IAAA;AACT,EAAA,IAAI,CAAA,CAAE,QAAA,EAAU,WAAA,KAAgB,MAAA,EAAW;AACzC,IAAA,CAAA,CAAE,WAAW,EAAE,GAAG,CAAA,CAAE,QAAA,EAAU,aAAa,QAAA,EAAS;AAAA,EACtD;AACF;AAMA,SAAS,iBAAA,CACP,IAAA,EACA,OAAA,EACA,QAAA,EACA,QAAA,EACqB;AACrB,EAAA,IAAI,SAAS,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAC9E,EAAA,IAAI,SAAS,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAC9E,EAAA,IAAI,SAAS,YAAA,EAAc,OAAO,oBAAA,CAAqB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAClF,EAAA,IAAI,SAAS,aAAA,EAAe,OAAO,qBAAA,CAAsB,OAAA,EAAS,UAAU,QAAQ,CAAA;AACpF,EAAA,IAAI,SAAS,QAAA,EAAU,OAAO,sBAAA,CAAuB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAChF,EAAA,IAAI,SAAS,cAAA,EAAgB,OAAO,sBAAA,CAAuB,OAAA,EAAS,UAAU,QAAQ,CAAA;AACtF,EAAA,IAAI,SAAS,gBAAA,EAAkB,OAAO,wBAAA,CAAyB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAC1F,EAAA,IAAI,IAAA,CAAK,SAAS,YAAY,CAAA,SAAU,mBAAA,CAAoB,OAAA,EAAS,UAAU,QAAQ,CAAA;AACvF,EAAA,IAAI,IAAA,CAAK,SAAS,cAAc,CAAA,SAAU,qBAAA,CAAsB,OAAA,EAAS,UAAU,QAAQ,CAAA;AAC3F,EAAA,IAAI,KAAK,QAAA,CAAS,YAAY,CAAA,IAAK,IAAA,CAAK,SAAS,YAAY,CAAA;AAC3D,IAAA,OAAO,mBAAA,CAAoB,OAAA,EAAS,QAAA,EAAU,QAAQ,CAAA;AACxD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,eAAe,IAAA,EAAuB;AAC7C,EAAA,OACE,IAAA,KAAS,UAAA,IACT,IAAA,KAAS,UAAA,IACT,IAAA,KAAS,YAAA,IACT,IAAA,KAAS,aAAA,IACT,IAAA,KAAS,QAAA,IACT,IAAA,KAAS,cAAA,IACT,IAAA,KAAS,gBAAA,IACT,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,IAC1B,IAAA,CAAK,QAAA,CAAS,cAAc,CAAA,IAC5B,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,IAC1B,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA;AAE9B;AA4BA,eAAsB,aAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,GAAuB,EAAC,EACC;AACzB,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA0B;AAC9C,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,cAAA;AACzC,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA8B;AACnD,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAyB;AACtC,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,MAAM,CAAA;AACxB,IAAA,UAAA,CAAW,IAAI,CAAA;AAAA,EACjB,CAAA;AACA,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,YAAA,EAAa;AAExD,EAAA,SAAS,IAAI,CAAA,EAAuB;AAKlC,IAAA,kBAAA,CAAmB,CAAC,CAAA;AACpB,IAAA,MAAM,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,CAAA;AAC/B,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAC,CAAA;AAClB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,EAAE,MAAA,GAAS,QAAA,CAAS,QAAQ,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACpD;AAEA,EAAA,WAAA,MAAiB,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAK,IAAK,QAAQ,IAAA,EAAM;AAAA,IACzD,GAAG,OAAA;AAAA,IACH,WAAA;AAAA,IACA,UAAA,EAAY;AAAA,GACb,CAAA,EAAG;AACF,IAAA,IAAI,CAAC,cAAA,CAAe,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,UAAU,MAAM,iBAAA;AAAA,MACpB,YAAY,QAAQ,CAAA,CAAA;AAAA,MACpB,MAAM,QAAA,CAAS,QAAA,EAAU,MAAM,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,YAAY,IAAA,EAAM;AAGpB,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,YAAY,CAAA,EAAG,KAAA,CAAM,EAAE,MAAA,EAAQ,YAAA,EAAc,IAAA,EAAM,QAAA,EAAU,CAAA;AAC/E,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,IAAA,EAAM,OAAA,EAAS,UAAU,QAAQ,CAAA;AACjE,MAAA,IAAI,KAAA,MAAW,KAAK,CAAA;AAAA,IACtB,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACX;AAEA,EAAA,OAAO,CAAC,GAAG,OAAA,CAAQ,MAAA,EAAQ,CAAA;AAC7B","file":"chunk-DXUQCMVT.js","sourcesContent":["/**\n * Deadline guards for filesystem work that can land on a network mount.\n *\n * Inside the agent container `/skaile/workspace` **is** an rclone FUSE mount\n * (SharePoint / OneDrive / WebDAV). When the host rclone process wedges, a\n * filesystem call against that path parks in an uninterruptible kernel wait.\n * A **synchronous** call there stops the entire single-threaded event loop —\n * the whole `skaile serve` process stops serving, and the platform reads the\n * session as dead or idle. A hang is not an error, so `try/catch` never fires.\n *\n * Two rules follow, and both matter:\n *\n * 1. **Never touch a mount synchronously.** Async `node:fs/promises` keeps the\n *    loop free, so a wedged mount degrades to one stuck request instead of a\n *    dead session. This is the actual fix.\n * 2. **Bound the wait.** {@link withFsDeadline} converts an unbounded wait into\n *    a bounded failure so the requester gets an error rather than nothing.\n *\n * `withFsDeadline` does **not** cancel the underlying operation — Node cannot\n * abort a syscall already in the kernel. The losing promise stays pending until\n * the mount recovers or the process exits. That is acceptable precisely because\n * rule 1 holds: a pending promise costs one handle, not the event loop.\n *\n * Modelled on `connectors/src/fleet-utils.ts` (`ensureFleetMounted`), which\n * already does async-stat-with-deadline correctly.\n */\n\n/** Default deadline for a single filesystem operation on a possibly-networked mount. */\nexport const DEFAULT_FS_DEADLINE_MS = 15_000;\n\n/**\n * Env override for {@link DEFAULT_FS_DEADLINE_MS}, in milliseconds.\n *\n * A cloud-backed mount over a slow link can legitimately need longer than the\n * default; operators raise this rather than patching call sites.\n */\nexport const FS_DEADLINE_ENV_VAR = \"SKAILE_FS_DEADLINE_MS\";\n\n/**\n * Thrown when a filesystem operation misses its deadline.\n *\n * Distinct from a plain `Error` so callers can tell \"the mount is wedged\" apart\n * from \"the file does not exist\" and surface the right message to the frontend.\n */\nexport class FsDeadlineError extends Error {\n  readonly timeoutMs: number;\n  readonly operation: string;\n\n  constructor(operation: string, timeoutMs: number) {\n    super(\n      `filesystem operation \"${operation}\" exceeded ${timeoutMs}ms — the mount may be unresponsive`,\n    );\n    this.name = \"FsDeadlineError\";\n    this.operation = operation;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Resolve the effective filesystem deadline.\n *\n * Reads {@link FS_DEADLINE_ENV_VAR} on every call rather than caching it: the\n * runner mutates `process.env` while wiring a session, so a module-load-time\n * snapshot would pin the value set before configuration ran.\n *\n * @param fallback - Deadline to use when the env var is absent or unusable.\n * @returns The deadline in milliseconds.\n */\nexport function fsDeadlineMs(fallback: number = DEFAULT_FS_DEADLINE_MS): number {\n  const raw = process.env[FS_DEADLINE_ENV_VAR];\n  if (raw === undefined) return fallback;\n  const parsed = Number.parseInt(raw, 10);\n  // A non-positive or non-numeric override would disable the guard entirely,\n  // which is exactly the failure mode this module exists to prevent.\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\n/**\n * Run an async filesystem operation under a deadline.\n *\n * @param operation - Short label used in the timeout message (e.g. `\"readdir /skaile/workspace\"`).\n * @param fn - Thunk performing the operation. Called immediately.\n * @param timeoutMs - Deadline override; defaults to {@link fsDeadlineMs}.\n * @returns The operation's result.\n * @throws {FsDeadlineError} when the deadline elapses first.\n * @throws Whatever `fn` rejects with, unchanged, when it loses no race.\n * @docLink packages/core/api-reference#with-fs-deadline\n */\nexport async function withFsDeadline<T>(\n  operation: string,\n  fn: () => Promise<T>,\n  timeoutMs: number = fsDeadlineMs(),\n): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      fn(),\n      new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => reject(new FsDeadlineError(operation, timeoutMs)), timeoutMs);\n        // Never hold the process open on the guard alone — without unref a\n        // pending deadline would keep `skaile serve` alive after shutdown.\n        timer.unref?.();\n      }),\n    ]);\n  } finally {\n    if (timer !== undefined) clearTimeout(timer);\n  }\n}\n\n/**\n * Run an async filesystem operation under a deadline, mapping every failure to\n * `fallback`.\n *\n * For best-effort probes that previously used `existsSync` — a missing file, an\n * unreadable file, and a wedged mount are all \"nothing usable here\", and the\n * caller has no better move than to continue without it.\n *\n * @param operation - Short label used in the timeout message.\n * @param fn - Thunk performing the operation.\n * @param fallback - Value returned when `fn` rejects or the deadline elapses.\n * @param timeoutMs - Deadline override; defaults to {@link fsDeadlineMs}.\n */\nexport async function tryWithFsDeadline<T>(\n  operation: string,\n  fn: () => Promise<T>,\n  fallback: T,\n  timeoutMs: number = fsDeadlineMs(),\n): Promise<T> {\n  try {\n    return await withFsDeadline(operation, fn, timeoutMs);\n  } catch {\n    return fallback;\n  }\n}\n","/**\n * Manifest parsing — reads SKILL.md, AGENT.md, agent.yaml, CONTRACT.md,\n * CONNECTOR.md, *.prompt.md, *.flow.yaml, *.bundle.yaml files and\n * produces CatalogEntry objects.\n * Used by @skaile/asset-manager for on-demand repo scanning.\n *\n * **All filesystem access here is async and bounded** (issue #454). A repo root\n * can resolve onto the rclone FUSE mount at `/skaile/workspace` — either\n * directly (a `sources[].path` pointing into the workspace) or indirectly, since\n * the walk follows symlinks and an off-mount tree can link into one. A\n * synchronous `readdirSync`/`statSync`/`readFileSync` there parks the whole\n * `skaile serve` event loop in an uninterruptible kernel wait, and a hang is not\n * an error so `try/catch` never fires. Every call goes through\n * {@link withFsDeadline}/{@link tryWithFsDeadline}, and the walk itself is\n * bounded by depth, entry count, a wall-clock budget, and an ancestor-inode set.\n */\n\nimport type { Dirent } from \"node:fs\";\nimport { opendir, readFile, stat } from \"node:fs/promises\";\nimport { basename, dirname, join } from \"node:path\";\nimport { parse } from \"yaml\";\nimport { fsDeadlineMs, tryWithFsDeadline, withFsDeadline } from \"./fs-deadline.js\";\nimport { createLogger } from \"./logging/create-logger.js\";\nimport type { AssetKind, CatalogEntry, Dependency } from \"./models.js\";\nimport { isValidAssetName, parseDep, slugifyAssetName } from \"./models.js\";\n\n// ── Bounded manifest I/O ──────────────────────────────────────────────────────\n\n/**\n * Read one manifest file under a deadline.\n *\n * @param filePath - Absolute path to the manifest.\n * @param timeoutMs - Per-operation deadline; defaults to {@link fsDeadlineMs}.\n * @throws {import(\"./fs-deadline.js\").FsDeadlineError} when the read outlives the deadline.\n */\nfunction readManifestFile(filePath: string, timeoutMs?: number): Promise<string> {\n  return withFsDeadline(`readFile ${filePath}`, () => readFile(filePath, \"utf8\"), timeoutMs);\n}\n\n/**\n * Read one manifest file under a deadline, degrading an unreadable/slow file to\n * an empty document. Mirrors the pre-#454 `try { readFileSync } catch {}` shape\n * of the YAML parsers: a file we cannot read yields `{}` metadata rather than\n * aborting the caller.\n */\nfunction readManifestFileOrEmpty(filePath: string, timeoutMs?: number): Promise<string> {\n  return tryWithFsDeadline(`readFile ${filePath}`, () => readFile(filePath, \"utf8\"), \"\", timeoutMs);\n}\n\n// ── Frontmatter helpers ───────────────────────────────────────────────────────\n\n/**\n * Result of parsing YAML frontmatter from a markdown file.\n * @docLink packages/core/concepts#frontmatter-result\n */\nexport interface FrontmatterResult {\n  /** Parsed YAML data. Empty object if no frontmatter block is present. */\n  data: Record<string, unknown>;\n  /** Markdown body below the frontmatter block (trimmed). */\n  body: string;\n}\n\n/**\n * Parse YAML frontmatter from a markdown file (`---` delimited).\n * Returns `{ data: {}, body: text }` when no frontmatter block is present.\n *\n * @param text - Raw file contents\n * @returns Parsed frontmatter data and the remaining body text\n * @docLink packages/core/concepts#parse-frontmatter\n */\nexport function parseFrontmatter(text: string): FrontmatterResult {\n  const m = text.match(/^---\\s*\\n([\\s\\S]*?)\\n---/);\n  if (!m) return { data: {}, body: text.trim() };\n  try {\n    const data = (parse(m[1]!) as Record<string, unknown>) ?? {};\n    const body = text.slice(m[0].length).trim();\n    return { data, body };\n  } catch {\n    return { data: {}, body: text.trim() };\n  }\n}\n\n/** Extract version from frontmatter, checking both top-level and metadata.version. */\nfunction extractVersion(meta: Record<string, unknown>): string {\n  return String(\n    meta.version ?? (meta.metadata as Record<string, unknown> | undefined)?.version ?? \"\",\n  );\n}\n\n/**\n * Parse the `requires:` field from manifest frontmatter into typed `Dependency` objects.\n * Accepts a comma-separated string or an array of `\"kind:name\"` strings. Reads from either\n * the root or `metadata.requires` (matching `extractVersion`'s dual-location behavior) so\n * skill authors can follow the agentskills.io convention of placing skaile extensions under\n * `metadata:` while remaining backward-compatible with root-level declarations.\n *\n * @param meta - Parsed frontmatter data object\n * @returns Array of `Dependency` objects (empty when `requires` is absent)\n * @docLink packages/core/concepts#parse-requires\n */\nexport function parseRequires(meta: Record<string, unknown>): Dependency[] {\n  const raw = meta.requires ?? (meta.metadata as Record<string, unknown> | undefined)?.requires;\n  if (!raw) return [];\n  const list =\n    typeof raw === \"string\"\n      ? raw.split(\",\").map((s) => s.trim())\n      : Array.isArray(raw)\n        ? (raw as string[])\n        : [];\n  return list.filter(Boolean).map(parseDep);\n}\n\n// ── agent.yaml dependency collectors ───────────────────────────────────────────\n\n/**\n * Collect named sub-agent dependencies from an `agent.yaml` array field.\n * Each `{name, ...}` object entry becomes an `{kind: \"agent\", name}` dependency.\n * Covers both the new `requires[]` and legacy `dependencies[]` formats.\n */\nfunction collectAgentDeps(raw: unknown, out: Dependency[]): void {\n  if (!Array.isArray(raw)) return;\n  for (const d of raw) {\n    if (typeof d === \"object\" && d !== null && \"name\" in d) {\n      out.push({ kind: \"agent\", name: String((d as Record<string, unknown>).name) });\n    }\n  }\n}\n\n/**\n * Collect string refs from an `agent.yaml` array field (`abilities[]`,\n * `contracts[]`) as `{kind, name}` dependencies, skipping empty entries.\n */\nfunction collectStringRefs(raw: unknown, kind: Dependency[\"kind\"], out: Dependency[]): void {\n  if (!Array.isArray(raw)) return;\n  for (const r of raw) {\n    if (typeof r === \"string\" && r) out.push({ kind, name: r });\n  }\n}\n\n/**\n * Collect catalog refs from an `agent.yaml` mixin field (`persona`, `rules`,\n * `knowledge`) as requires so `skaile install` pulls them automatically. Local\n * paths (`.`/`/`) are skipped — not catalog assets. Refs without a `kind:`\n * prefix get `defaultKind` injected; the publisher scope and `#pin` are stripped\n * so only `kind:name` is tracked.\n */\nfunction collectMixinRefs(raw: unknown, defaultKind: string, out: Dependency[]): void {\n  if (!Array.isArray(raw)) return;\n  for (const r of raw) {\n    if (typeof r !== \"string\" || !r) continue;\n    if (r.startsWith(\".\") || r.startsWith(\"/\")) continue; // local path — skip\n    // Normalize: if no kind: prefix, inject the default kind\n    const normalized = r.includes(\":\") ? r : `${defaultKind}:${r}`;\n    // Only kind:name matters for requires — strip the publisher scope and #pin.\n    const colonIdx = normalized.indexOf(\":\");\n    const kind = normalized.slice(0, colonIdx).trim();\n    let rest = normalized.slice(colonIdx + 1).trim();\n    const hashIdx = rest.indexOf(\"#\");\n    if (hashIdx !== -1) rest = rest.slice(0, hashIdx).trim();\n    let name: string;\n    if (rest.startsWith(\"@\")) {\n      // Scoped form @publisher/name → name is the segment after the slash.\n      const slashIdx = rest.indexOf(\"/\");\n      name = slashIdx !== -1 ? rest.slice(slashIdx + 1).trim() : \"\";\n    } else {\n      // Legacy name@publisher (deprecated) or a bare name.\n      const atIdx = rest.indexOf(\"@\");\n      name = atIdx !== -1 ? rest.slice(0, atIdx).trim() : rest;\n    }\n    if (name) out.push({ kind, name });\n  }\n}\n\n// ── Manifest parsers ──────────────────────────────────────────────────────────\n\n/**\n * Parse a `SKILL.md` file into a `CatalogEntry`.\n * The `kind` field defaults to `\"skill\"` but can be overridden to `\"agent\"` or `\"prompt\"`\n * via the `type:` frontmatter key. Falls back to the parent directory name when `name:` is absent.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `SKILL.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind, name, description, version, and requires\n * @docLink packages/core/concepts#from-skill-md\n */\nexport async function fromSkillMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromSkillMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromSkillMd} core over already-read content (no I/O). */\nfunction fromSkillMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n  let kind = String(meta.type ?? \"skill\") as AssetKind;\n  if (![\"skill\", \"agent\", \"prompt\", \"persona\", \"ruleset\", \"knowledge\"].includes(kind))\n    kind = \"skill\";\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind,\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse an `AGENT.md` file into a `CatalogEntry` with `kind: \"agent\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `AGENT.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"agent\"`\n * @docLink packages/core/concepts#from-agent-md\n */\nexport async function fromAgentMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromAgentMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromAgentMd} core over already-read content (no I/O). */\nfunction fromAgentMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"agent\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse an `agent.yaml` file into a `CatalogEntry` with `kind: \"agent\"`.\n * Collects sub-agent dependencies from `requires[]` (new format) and `dependencies[]`\n * (legacy format), skill abilities from `abilities[]`, and contracts from `contracts[]`.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `agent.yaml` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"agent\"` and full dependency graph\n * @docLink packages/core/concepts#from-agent-yaml\n */\nexport async function fromAgentYaml(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromAgentYamlContent(await readManifestFileOrEmpty(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromAgentYaml} core over already-read content (no I/O). */\nfunction fromAgentYamlContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = (parse(content) as Record<string, unknown>) ?? {};\n  } catch {}\n\n  const requires: Dependency[] = [];\n\n  // Sub-agent dependencies from requires[] (new format: {name, source, ...})\n  collectAgentDeps(meta.requires, requires);\n  // Legacy sub-agent dependencies from dependencies[] (old format: {name, ...})\n  collectAgentDeps(meta.dependencies, requires);\n  // Skill abilities referenced in the system prompt\n  collectStringRefs(meta.abilities, \"skill\", requires);\n  // Contracts referenced in the system prompt (co-located in skills dir)\n  collectStringRefs(meta.contracts, \"contract\", requires);\n\n  // Mixin composition fields — track catalog refs as requires so `skaile install`\n  // automatically pulls them. Local paths (. or /) are skipped — not catalog assets.\n  for (const [field, defaultKind] of [\n    [\"persona\", \"persona\"],\n    [\"rules\", \"ruleset\"],\n    [\"knowledge\", \"knowledge\"],\n  ] as const) {\n    collectMixinRefs(meta[field], defaultKind, requires);\n  }\n\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"agent\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: String(meta.version ?? \"\"),\n    requires,\n    dependencies: [],\n  };\n}\n\n/**\n * Parse a `*.prompt.md` file into a `CatalogEntry` with `kind: \"prompt\"`.\n * The name defaults to the filename stem (without the `.prompt.md` suffix)\n * when no `name:` frontmatter key is present.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `.prompt.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"prompt\"`\n * @docLink packages/core/concepts#from-prompt-md\n */\nexport async function fromPromptMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromPromptMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromPromptMd} core over already-read content (no I/O). */\nfunction fromPromptMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n  const name = String(meta.name ?? basename(filePath).replace(/\\.prompt\\.md$/, \"\"));\n  return {\n    name,\n    kind: \"prompt\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse a `*.flow.yaml` or `*.flow.json` file into a `CatalogEntry` with `kind: \"flow\"`.\n * The name resolves from `name:` or `id:` frontmatter, falling back to the filename stem.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the flow definition file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"flow\"`\n * @docLink packages/core/concepts#from-flow-yaml\n */\nexport async function fromFlowYaml(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromFlowYamlContent(await readManifestFileOrEmpty(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromFlowYaml} core over already-read content (no I/O). */\nfunction fromFlowYamlContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = (parse(content) as Record<string, unknown>) ?? {};\n  } catch {}\n\n  const stem = basename(filePath)\n    .replace(/\\.flow\\.yaml$/, \"\")\n    .replace(/\\.flow\\.json$/, \"\");\n  return {\n    name: String(meta.name ?? meta.id ?? stem),\n    kind: \"flow\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: String(meta.version ?? \"\"),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse a `*.bundle.yaml` file into a `CatalogEntry` with `kind: \"bundle\"`.\n * Bundles declare a flat list of string `dependencies` (asset refs) rather than\n * typed `Dependency` objects; both `requires` and `dependencies` are populated.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the bundle YAML file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"bundle\"`\n * @docLink packages/core/concepts#from-bundle-yaml\n */\nexport async function fromBundleYaml(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromBundleYamlContent(await readManifestFileOrEmpty(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromBundleYaml} core over already-read content (no I/O). */\nfunction fromBundleYamlContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = (parse(content) as Record<string, unknown>) ?? {};\n  } catch {}\n\n  const name = String(meta.name ?? basename(filePath).replace(/\\.bundle\\.yaml$/, \"\"));\n\n  const deps = meta.dependencies;\n  const dependencies = Array.isArray(deps) ? (deps as string[]).filter(Boolean) : [];\n\n  return {\n    name,\n    kind: \"bundle\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: String(meta.version ?? \"\"),\n    requires: parseRequires(meta),\n    dependencies,\n  };\n}\n\n/**\n * Extract a bundle's raw transitive dependency ref strings from its manifest\n * file — the union of its `requires` and `dependencies` lists, kept verbatim\n * (publisher/pin qualifiers preserved, comments dropped by the parser).\n *\n * Supports `*.bundle.yaml` / `*.flow.{yaml,json}` (top-level\n * `requires`/`dependencies`) and the `BUNDLE.md` frontmatter layout\n * (`requires`/`dependencies`, incl. nested under `metadata`). Unlike\n * {@link parseRequires}, refs are returned as-is — the resolver needs the full\n * `kind:name@<publisher>[#pin]` form, not a publisher-stripped {@link Dependency}.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to a `.bundle.yaml`, `.flow.{yaml,json}`, or `BUNDLE.md`.\n * @returns Deduped list of ref strings; `[]` on parse failure or no deps.\n * @docLink packages/core/concepts#bundle-dep-refs\n */\nexport async function bundleDepRefs(filePath: string): Promise<string[]> {\n  return bundleDepRefsFromContent(await readManifestFileOrEmpty(filePath), filePath);\n}\n\n/** Pure {@link bundleDepRefs} core over already-read content (no I/O). */\nfunction bundleDepRefsFromContent(content: string, filePath: string): string[] {\n  // `.bundle.yaml` / `.flow.yaml` / `.flow.json` carry their dep list as a\n  // top-level document key (`requires`/`dependencies`); `BUNDLE.md` carries it\n  // in frontmatter. YAML is a JSON superset, so `parse` reads `.flow.json` too.\n  const wholeDoc = /\\.(bundle\\.yaml|flow\\.yaml|flow\\.json)$/.test(filePath);\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = wholeDoc\n      ? ((parse(content) as Record<string, unknown>) ?? {})\n      : parseFrontmatter(content).data;\n  } catch {\n    return [];\n  }\n  const out: string[] = [];\n  const collect = (v: unknown) => {\n    if (Array.isArray(v))\n      for (const x of v) if (typeof x === \"string\" && x.trim()) out.push(x.trim());\n  };\n  collect(meta.requires);\n  collect((meta.metadata as Record<string, unknown> | undefined)?.requires);\n  collect(meta.dependencies);\n  return [...new Set(out)];\n}\n\n/**\n * Parse a `CONTRACT.md` file into a `CatalogEntry` with `kind: \"contract\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `CONTRACT.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"contract\"`\n * @docLink packages/core/concepts#from-contract-md\n */\nexport async function fromContractMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromContractMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromContractMd} core over already-read content (no I/O). */\nfunction fromContractMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"contract\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse an `MCP.md` file into a `CatalogEntry` with `kind: \"mcp-server\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Frontmatter fields (catalog identity):\n *   - `name`        — server name (default: parent dir name)\n *   - `description` — short description\n *   - `version`     — semver\n *   - `keywords`    — array of discovery tags\n *\n * Frontmatter fields (runtime defaults, stored in `metadata`):\n *   - `transport`   — \"stdio\" | \"sse\" | \"http\" (default: \"stdio\")\n *   - `command`     — command to execute (stdio)\n *   - `args`        — command arguments (stdio)\n *   - `env`         — environment variables (stdio)\n *   - `url`         — server URL (sse/http)\n *   - `headers`     — HTTP headers (sse/http)\n *\n * When `mcp:name` appears in `skaile.yaml` `dependencies`, the runner reads\n * these defaults from `metadata` to build a `McpServerDeclaration` without\n * requiring verbose inline config.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `MCP.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"mcp-server\"`\n * @docLink packages/core/concepts#from-mcp-server-md\n */\nexport async function fromMcpServerMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromMcpServerMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/**\n * Parse pre-read MCP.md content into a `CatalogEntry`.\n * Callers that already hold the file content (e.g. to avoid a second read) use\n * this directly; `fromMcpServerMd` is a thin wrapper that reads then delegates here.\n *\n * @param content  - UTF-8 content of the `MCP.md` file\n * @param repoName - Repository name used as the `publisher` field of the entry\n * @param filePath - Absolute path (used as `source` and for name fallback)\n * @returns Populated `CatalogEntry` with kind `\"mcp-server\"`\n */\nexport function fromMcpServerMdContent(\n  content: string,\n  repoName: string,\n  filePath: string,\n): CatalogEntry {\n  const { data: meta } = parseFrontmatter(content);\n\n  // Extract runtime defaults into metadata\n  const metadata: Record<string, unknown> = {};\n  if (meta.transport) metadata.transport = String(meta.transport);\n  if (meta.command) metadata.command = String(meta.command);\n  if (Array.isArray(meta.args)) metadata.args = meta.args.map(String);\n  if (meta.env && typeof meta.env === \"object\" && !Array.isArray(meta.env)) {\n    metadata.env = meta.env as Record<string, string>;\n  }\n  if (meta.url) metadata.url = String(meta.url);\n  if (typeof meta.ca === \"string\") metadata.ca = meta.ca;\n  if (meta.headers && typeof meta.headers === \"object\" && !Array.isArray(meta.headers)) {\n    metadata.headers = meta.headers as Record<string, string>;\n  }\n  if (meta.recipe && typeof meta.recipe === \"object\" && !Array.isArray(meta.recipe)) {\n    metadata.recipe = meta.recipe;\n  }\n\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"mcp-server\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n    metadata: Object.keys(metadata).length > 0 ? metadata : undefined,\n  };\n}\n\n/**\n * Parse a `knowledge.yaml` file into a `CatalogEntry` with `kind: \"knowledge\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `knowledge.yaml` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"knowledge\"`\n * @docLink packages/core/concepts#from-knowledge-yaml\n */\nexport async function fromKnowledgeYaml(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromKnowledgeYamlContent(await readManifestFileOrEmpty(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromKnowledgeYaml} core over already-read content (no I/O). */\nfunction fromKnowledgeYamlContent(\n  content: string,\n  repoName: string,\n  filePath: string,\n): CatalogEntry {\n  let meta: Record<string, unknown> = {};\n  try {\n    meta = (parse(content) as Record<string, unknown>) ?? {};\n  } catch {}\n  return {\n    name: String(meta.name ?? basename(dirname(filePath))),\n    kind: \"knowledge\",\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: String(meta.version ?? \"\"),\n    requires: parseRequires(meta),\n    dependencies: [],\n  };\n}\n\n/**\n * Parse a `CONNECTOR.md` file into a `CatalogEntry` with `kind: \"connector\"`.\n * Falls back to the parent directory name when `name:` is absent.\n *\n * Frontmatter fields (catalog identity):\n *   - `name`        — connector name (default: parent dir name)\n *   - `description` — short description\n *   - `version`     — semver\n *\n * Frontmatter fields (runtime defaults, stored in `metadata`):\n *   - `entry`        — adapter entry point (default: \"./adapter.ts\")\n *   - `npm_deps`     — npm dependencies required by the adapter\n *   - `fields`       — configuration fields the adapter expects\n *   - `health_check` — whether to run a health check on connect\n *\n * The markdown body (below the frontmatter) is stored in `metadata.body`\n * so the runner can inject the connector's skill description into the\n * system prompt when `expose_as_skill` is enabled.\n *\n * Async since #454 — the file may live on the FUSE workspace mount.\n *\n * @param filePath - Absolute path to the `CONNECTOR.md` file\n * @param repoName - Repository name used as the `repository` field of the entry\n * @returns Populated `CatalogEntry` with kind `\"connector\"`\n * @docLink packages/core/concepts#from-connector-md\n */\nexport async function fromConnectorMd(filePath: string, repoName: string): Promise<CatalogEntry> {\n  return fromConnectorMdContent(await readManifestFile(filePath), repoName, filePath);\n}\n\n/** Pure {@link fromConnectorMd} core over already-read content (no I/O). */\nfunction fromConnectorMdContent(content: string, repoName: string, filePath: string): CatalogEntry {\n  const { data: meta, body } = parseFrontmatter(content);\n  const name = String(meta.name ?? basename(dirname(filePath)));\n  return {\n    name,\n    kind: \"connector\" as AssetKind,\n    description: String(meta.description ?? \"\"),\n    source: filePath,\n    publisher: repoName,\n    version: extractVersion(meta),\n    requires: parseRequires(meta),\n    dependencies: [],\n    metadata: {\n      entry: meta.entry ?? \"./adapter.ts\",\n      npm_deps: meta.npm_deps ?? {},\n      fields: meta.fields ?? [],\n      health_check: meta.health_check ?? null,\n      body,\n    },\n  };\n}\n\n// ── Recursive walker ──────────────────────────────────────────────────────────\n\ninterface WalkEntry {\n  path: string;\n  name: string;\n}\n\n/** Default maximum directory nesting the walk descends into. */\nexport const DEFAULT_WALK_MAX_DEPTH = 32;\n\n/** Default maximum number of directory entries a single walk may examine. */\nexport const DEFAULT_WALK_MAX_ENTRIES = 50_000;\n\n/** Default wall-clock budget for one whole walk / scan pass, in milliseconds. */\nexport const DEFAULT_WALK_BUDGET_MS = 60_000;\n\n/** Env override for {@link DEFAULT_WALK_MAX_DEPTH}. */\nexport const WALK_MAX_DEPTH_ENV_VAR = \"SKAILE_SCAN_MAX_DEPTH\";\n\n/** Env override for {@link DEFAULT_WALK_MAX_ENTRIES}. */\nexport const WALK_MAX_ENTRIES_ENV_VAR = \"SKAILE_SCAN_MAX_ENTRIES\";\n\n/** Env override for {@link DEFAULT_WALK_BUDGET_MS}. */\nexport const WALK_BUDGET_MS_ENV_VAR = \"SKAILE_SCAN_DEADLINE_MS\";\n\n/** Read a positive-integer env override, falling back when absent or unusable. */\nfunction envInt(name: string, fallback: number): number {\n  const raw = process.env[name];\n  if (raw === undefined) return fallback;\n  const parsed = Number.parseInt(raw, 10);\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\n/**\n * Why a walk stopped early. Every one of these means the returned entries are a\n * **partial** view of the tree — never present a truncated walk as complete.\n *\n * @docLink packages/core/concepts#walk-dir\n */\nexport interface WalkTruncation {\n  reason: \"depth\" | \"entries\" | \"budget\" | \"cycle\" | \"unreadable\";\n  /** Directory (or symlink) at which the bound was hit. */\n  path: string;\n  /** The bound that was hit, when the reason has a numeric limit. */\n  limit?: number;\n}\n\n/**\n * Bounds for {@link walkDir} / {@link scanDirectory}.\n *\n * @docLink packages/core/concepts#walk-dir\n */\nexport interface WalkOptions {\n  /** Maximum nesting depth below the root. Default {@link DEFAULT_WALK_MAX_DEPTH}. */\n  maxDepth?: number;\n  /** Maximum directory entries examined across the whole walk. Default {@link DEFAULT_WALK_MAX_ENTRIES}. */\n  maxEntries?: number;\n  /**\n   * Wall-clock budget for the whole walk. Default {@link DEFAULT_WALK_BUDGET_MS}.\n   * The check is inclusive, so `0` yields no entries at all.\n   */\n  budgetMs?: number;\n  /** Per-`opendir`/`stat`/`readFile` deadline. Default {@link fsDeadlineMs}. */\n  opTimeoutMs?: number;\n  /**\n   * Called once per distinct truncation reason. Defaults to a `warn` on the\n   * core logger — override to route the signal somewhere the caller can act on.\n   */\n  onTruncate?: (info: WalkTruncation) => void;\n}\n\n/** Mutable bookkeeping threaded through one walk. */\ninterface WalkState {\n  maxDepth: number;\n  maxEntries: number;\n  opTimeoutMs: number | undefined;\n  deadlineAt: number;\n  examined: number;\n  /**\n   * `dev:ino` of the directories on the **current path from the root** — an\n   * ancestor stack, not an ever-visited set. Re-entering an ancestor is a cycle;\n   * re-reaching a directory off the current path is a diamond, and must be walked.\n   */\n  ancestors: Set<string>;\n  reported: Set<WalkTruncation[\"reason\"]>;\n  onTruncate: (info: WalkTruncation) => void;\n}\n\nlet walkLogger: ReturnType<typeof createLogger> | undefined;\n\n/** Default truncation sink — a structured warning naming the bound that was hit. */\nfunction warnTruncation(info: WalkTruncation): void {\n  walkLogger ??= createLogger({ kind: \"runner\", subkind: \"asset-scan\" });\n  walkLogger.warn(`asset scan truncated (${info.reason}) — results are incomplete`, {\n    ...info,\n  });\n}\n\n/** Record a truncation once per reason so a wide tree does not spam the log. */\nfunction truncate(state: WalkState, info: WalkTruncation): void {\n  if (state.reported.has(info.reason)) return;\n  state.reported.add(info.reason);\n  state.onTruncate(info);\n}\n\n/**\n * Stable identity (`dev:ino`) of the directory `path` resolves to, or `null`\n * when it cannot be stat'ed within the deadline. Used to terminate symlink\n * cycles — the pre-#454 walker recursed forever on `a/link -> a`.\n */\nasync function dirIdentity(path: string, timeoutMs: number | undefined): Promise<string | null> {\n  const st = await tryWithFsDeadline(`stat ${path}`, () => stat(path), null, timeoutMs);\n  return st ? `${st.dev}:${st.ino}` : null;\n}\n\n/**\n * Read one directory's entries under a deadline, capped at the walk's remaining\n * entry budget. Uses `opendir` rather than `readdir` so a pathological directory\n * streams instead of materialising in full; entries are collected and sorted\n * because the `scanDirectory` dedup rule (\"alphabetically later source wins\")\n * depends on a deterministic per-level order.\n */\nasync function readDirEntries(\n  dir: string,\n  state: WalkState,\n): Promise<{ entries: Dirent[]; capped: boolean } | null> {\n  const remaining = state.maxEntries - state.examined;\n  if (remaining <= 0) return { entries: [], capped: true };\n  try {\n    return await withFsDeadline(\n      `opendir ${dir}`,\n      async () => {\n        const handle = await opendir(dir);\n        const entries: Dirent[] = [];\n        let capped = false;\n        for await (const e of handle) {\n          // Stop *before* keeping the over-budget entry, so `capped` means \"an\n          // entry was actually dropped\". Breaking after the push instead marked\n          // a directory of exactly `remaining` entries as truncated — and since\n          // `truncate()` reports once per reason for the whole walk, that\n          // spurious first report swallowed a later genuine one.\n          if (entries.length >= remaining) {\n            capped = true;\n            break;\n          }\n          entries.push(e);\n        }\n        entries.sort((a, b) => (a.name < b.name ? -1 : 1));\n        return { entries, capped };\n      },\n      state.opTimeoutMs,\n    );\n  } catch {\n    // Unreadable (permissions, vanished mid-walk) or the mount missed its\n    // deadline. Either way this subtree contributes nothing; keep walking.\n    truncate(state, { reason: \"unreadable\", path: dir });\n    return null;\n  }\n}\n\n/**\n * Recursively yield every file entry under `dir`, sorted alphabetically at each\n * level. Skips `.git` and `node_modules` directories and follows symlinks\n * (resolving to the stat target). `node_modules` is excluded because Bun's\n * `node_modules/.bun/...` layout contains symlink farms that form cycles when\n * packages reference each other transitively.\n *\n * **Async and bounded since #454.** A repo root can resolve onto the rclone FUSE\n * mount, where the previous synchronous `readdirSync`/`statSync` walk parked the\n * whole event loop. Four bounds now hold, and hitting any of them reports a\n * {@link WalkTruncation} — a truncated walk is never presented as a complete one:\n *\n * - **depth** ({@link WalkOptions.maxDepth}) — also the backstop for a cycle no\n *   inode check can see, e.g. a bind mount of the root inside itself.\n * - **entry count** ({@link WalkOptions.maxEntries}) — total directory entries\n *   examined, so an enormous tree cannot run unbounded.\n * - **wall-clock budget** ({@link WalkOptions.budgetMs}) — a wedged mount that\n *   times out one operation at a time cannot add up to an unbounded scan.\n * - **ancestor inodes** — the `dev:ino` of every directory on the path from the\n *   root is held while its subtree is walked, so `a/link -> a` terminates\n *   instead of recursing forever. Two sibling symlinks onto one shared\n *   directory are a diamond, not a cycle: both are walked, at the price of\n *   visiting the shared subtree twice — bounded by the entry and time budgets.\n *\n * @param dir - Absolute path to the directory to walk\n * @param options - Bounds and truncation sink; see {@link WalkOptions}\n * @docLink packages/core/concepts#walk-dir\n */\nexport async function* walkDir(dir: string, options: WalkOptions = {}): AsyncGenerator<WalkEntry> {\n  const state: WalkState = {\n    maxDepth: options.maxDepth ?? envInt(WALK_MAX_DEPTH_ENV_VAR, DEFAULT_WALK_MAX_DEPTH),\n    maxEntries: options.maxEntries ?? envInt(WALK_MAX_ENTRIES_ENV_VAR, DEFAULT_WALK_MAX_ENTRIES),\n    opTimeoutMs: options.opTimeoutMs,\n    deadlineAt:\n      Date.now() + (options.budgetMs ?? envInt(WALK_BUDGET_MS_ENV_VAR, DEFAULT_WALK_BUDGET_MS)),\n    examined: 0,\n    ancestors: new Set<string>(),\n    reported: new Set<WalkTruncation[\"reason\"]>(),\n    onTruncate: options.onTruncate ?? warnTruncation,\n  };\n  // The root is an ancestor of everything, so it is seeded here and never\n  // popped — a self-referential `root/link -> root` is caught on first descent.\n  const rootId = await dirIdentity(dir, state.opTimeoutMs);\n  if (rootId) state.ancestors.add(rootId);\n  yield* walkFrom(dir, 0, state);\n}\n\nasync function* walkFrom(dir: string, depth: number, state: WalkState): AsyncGenerator<WalkEntry> {\n  if (depth > state.maxDepth) {\n    truncate(state, { reason: \"depth\", path: dir, limit: state.maxDepth });\n    return;\n  }\n  if (Date.now() >= state.deadlineAt) {\n    truncate(state, { reason: \"budget\", path: dir });\n    return;\n  }\n\n  const read = await readDirEntries(dir, state);\n  if (!read) return;\n  if (read.capped) truncate(state, { reason: \"entries\", path: dir, limit: state.maxEntries });\n\n  for (const e of read.entries) {\n    if (state.examined >= state.maxEntries) {\n      truncate(state, { reason: \"entries\", path: dir, limit: state.maxEntries });\n      return;\n    }\n    if (Date.now() >= state.deadlineAt) {\n      truncate(state, { reason: \"budget\", path: dir });\n      return;\n    }\n    state.examined++;\n    const full = join(dir, e.name);\n\n    if (e.isSymbolicLink()) {\n      // A symlink is the only way a cycle can enter this walk, so identity is\n      // resolved here and nowhere else — one extra stat per link, none per\n      // ordinary directory.\n      const st = await tryWithFsDeadline(`stat ${full}`, () => stat(full), null, state.opTimeoutMs);\n      if (!st) continue;\n      if (st.isDirectory()) {\n        if (e.name === \".git\" || e.name === \"node_modules\") continue;\n        const id = `${st.dev}:${st.ino}`;\n        // Only an *ancestor* is a cycle. A target already walked elsewhere in\n        // the tree is a diamond (`a/link -> shared`, `b/link -> shared`) and\n        // dropping it would silently lose that subtree from the scan.\n        if (state.ancestors.has(id)) {\n          truncate(state, { reason: \"cycle\", path: full });\n          continue;\n        }\n        state.ancestors.add(id);\n        try {\n          yield* walkFrom(full, depth + 1, state);\n        } finally {\n          // finally, not a trailing delete: an early `return` from the bounds\n          // checks — or an abandoned consumer — would otherwise leave the\n          // ancestor stack holding a directory the walk has already left.\n          state.ancestors.delete(id);\n        }\n      } else {\n        yield { path: full, name: e.name };\n      }\n    } else if (e.isDirectory()) {\n      if (e.name !== \".git\" && e.name !== \"node_modules\") yield* walkFrom(full, depth + 1, state);\n    } else if (e.isFile()) {\n      yield { path: full, name: e.name };\n    }\n  }\n}\n\n// ── Public scanner ────────────────────────────────────────────────────────────\n\n/**\n * Coerce a scanned entry's `name` to a canonical asset name in place. When the\n * raw name is already canonical this is a no-op; otherwise the original is stashed\n * on `metadata.displayName` (only when not already set) so callers keep the pretty\n * label for display while identity uses the slug. A name that slugifies to empty\n * is left untouched — `parseAssetRef` will reject it downstream with its full hint.\n */\nfunction normalizeEntryName(e: CatalogEntry): void {\n  if (isValidAssetName(e.name)) return;\n  let slug: string;\n  try {\n    slug = slugifyAssetName(e.name);\n  } catch {\n    return;\n  }\n  const original = e.name;\n  e.name = slug;\n  if (e.metadata?.displayName === undefined) {\n    e.metadata = { ...e.metadata, displayName: original };\n  }\n}\n\n/**\n * Build a `CatalogEntry` from an already-read manifest, dispatching on filename.\n * Returns `null` when the filename is not a recognized manifest.\n */\nfunction entryFromManifest(\n  name: string,\n  content: string,\n  filePath: string,\n  repoName: string,\n): CatalogEntry | null {\n  if (name === \"SKILL.md\") return fromSkillMdContent(content, repoName, filePath);\n  if (name === \"AGENT.md\") return fromAgentMdContent(content, repoName, filePath);\n  if (name === \"agent.yaml\") return fromAgentYamlContent(content, repoName, filePath);\n  if (name === \"CONTRACT.md\") return fromContractMdContent(content, repoName, filePath);\n  if (name === \"MCP.md\") return fromMcpServerMdContent(content, repoName, filePath);\n  if (name === \"CONNECTOR.md\") return fromConnectorMdContent(content, repoName, filePath);\n  if (name === \"knowledge.yaml\") return fromKnowledgeYamlContent(content, repoName, filePath);\n  if (name.endsWith(\".prompt.md\")) return fromPromptMdContent(content, repoName, filePath);\n  if (name.endsWith(\".bundle.yaml\")) return fromBundleYamlContent(content, repoName, filePath);\n  if (name.endsWith(\".flow.yaml\") || name.endsWith(\".flow.json\"))\n    return fromFlowYamlContent(content, repoName, filePath);\n  return null;\n}\n\n/** Filenames {@link scanDirectory} recognises as asset manifests. */\nfunction isManifestName(name: string): boolean {\n  return (\n    name === \"SKILL.md\" ||\n    name === \"AGENT.md\" ||\n    name === \"agent.yaml\" ||\n    name === \"CONTRACT.md\" ||\n    name === \"MCP.md\" ||\n    name === \"CONNECTOR.md\" ||\n    name === \"knowledge.yaml\" ||\n    name.endsWith(\".prompt.md\") ||\n    name.endsWith(\".bundle.yaml\") ||\n    name.endsWith(\".flow.yaml\") ||\n    name.endsWith(\".flow.json\")\n  );\n}\n\n/**\n * Walk `root` recursively and return a `CatalogEntry` for every recognized asset manifest found.\n *\n * Recognized filenames: `SKILL.md`, `AGENT.md`, `agent.yaml`, `CONTRACT.md`, `MCP.md`,\n * `CONNECTOR.md`, `knowledge.yaml`, `*.prompt.md`, `*.bundle.yaml`, `*.flow.yaml`, `*.flow.json`.\n *\n * When two entries share the same `kind:name` key, the one with the alphabetically\n * later source path wins (consistent with catalog precedence rules).\n *\n * **Async and bounded since #454.** `root` can resolve onto the rclone FUSE mount\n * (a `sources[].path` under `/skaile/workspace`), and the walk follows symlinks, so\n * even an off-mount root can descend into one. Every `opendir`/`stat`/`readFile`\n * is deadline-bounded and the walk is capped by depth, entry count, a wall-clock\n * budget, and an ancestor-inode set — see {@link walkDir}. Hitting any bound reports\n * a {@link WalkTruncation} through {@link WalkOptions.onTruncate} (a `warn` by\n * default); the returned array is then a **partial** scan, never a complete one.\n *\n * A manifest that cannot be read within its deadline is skipped rather than\n * failing the whole scan — one unreachable file must not cost the whole catalog.\n *\n * @param root - Absolute path to the directory tree to scan\n * @param repoName - Repository name attached to every produced entry\n * @param options - Walk bounds and truncation sink; see {@link WalkOptions}\n * @returns Array of deduplicated `CatalogEntry` objects, one per manifest file\n * @docLink packages/core/concepts#scan-directory\n */\nexport async function scanDirectory(\n  root: string,\n  repoName: string,\n  options: WalkOptions = {},\n): Promise<CatalogEntry[]> {\n  const entries = new Map<string, CatalogEntry>();\n  const onTruncate = options.onTruncate ?? warnTruncation;\n  const reported = new Set<WalkTruncation[\"reason\"]>();\n  const relay = (info: WalkTruncation) => {\n    reported.add(info.reason);\n    onTruncate(info);\n  };\n  const opTimeoutMs = options.opTimeoutMs ?? fsDeadlineMs();\n\n  function add(e: CatalogEntry): void {\n    // Boundary normalization: a third-party source we don't control may name an\n    // asset with a human-styled identity (\"Complex App\"). Slugify it to a\n    // canonical name so the ref it produces parses, preserving the original on\n    // `metadata.displayName` for display. No-op for already-canonical names.\n    normalizeEntryName(e);\n    const key = `${e.kind}:${e.name}`;\n    const existing = entries.get(key);\n    if (!existing) {\n      entries.set(key, e);\n      return;\n    }\n    // Among duplicates, alphabetically later source path wins\n    if (e.source > existing.source) entries.set(key, e);\n  }\n\n  for await (const { path: filePath, name } of walkDir(root, {\n    ...options,\n    opTimeoutMs,\n    onTruncate: relay,\n  })) {\n    if (!isManifestName(name)) continue;\n    const content = await tryWithFsDeadline(\n      `readFile ${filePath}`,\n      () => readFile(filePath, \"utf8\"),\n      null,\n      opTimeoutMs,\n    );\n    if (content === null) {\n      // Unreadable or past its deadline — the catalog loses this asset, not the\n      // whole scan. Reported once so a wedged mount is visible in the logs.\n      if (!reported.has(\"unreadable\")) relay({ reason: \"unreadable\", path: filePath });\n      continue;\n    }\n    try {\n      const entry = entryFromManifest(name, content, filePath, repoName);\n      if (entry) add(entry);\n    } catch {}\n  }\n\n  return [...entries.values()];\n}\n"]}

package/dist/{chunk-HUNZYTOS.js → chunk-EB6OPURC.js}

@@ -1,4 +1,4 @@
-import { SecretNotFoundError, SecretAccessDeniedError, SecretsError, ProviderUnavailableError } from './chunk-JXT46QFC.js';
+import { SecretNotFoundError, SecretAccessDeniedError, SecretsError, ProviderUnavailableError } from './chunk-ZDKJHQY2.js';
 import { globalSkaileDir } from './chunk-TLKM4M47.js';
 import * as crypto from 'crypto';
 import * as fs from 'fs';
@@ -532,5 +532,5 @@ var SecretsRouter = class {
 var VERSION = "0.0.0";
 
 export { CredentialLifecycleService, EnvSecretsProvider, LocalSecretsProvider, SecretsRouter, VERSION };
-//# sourceMappingURL=chunk-HUNZYTOS.js.map
-//# sourceMappingURL=chunk-HUNZYTOS.js.map
+//# sourceMappingURL=chunk-EB6OPURC.js.map
+//# sourceMappingURL=chunk-EB6OPURC.js.map

package/dist/chunk-EB6OPURC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../secrets/src/lifecycle.ts","../secrets/src/providers/env.ts","../secrets/src/providers/local.ts","../secrets/src/router.ts","../secrets/src/index.ts"],"names":["provider"],"mappings":";;;;;;;;AAuCO,IAAM,6BAAN,MAAiC;AAAA,EAC9B,MAAA;AAAA;AAAA;AAAA;AAAA,EAKR,WAAA,CAAY,QAAuB,OAAA,EAA8C;AAC/E,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,aAAA,EAA+C;AAGnE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA;AAC3C,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,IACtD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAkB,OAAO,sBAAA,EAAuB;AAAA,IACrF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,aAAA,EAAyC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AACzC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACnDA,IAAM,qBAAA,mBAAwB,IAAI,IAAA,CAAK,CAAC,CAAA;AAEjC,IAAM,qBAAN,MAAqD;AAAA,EACjD,EAAA,GAAK,KAAA;AAAA,EAEd,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvC;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,MAAA,EAAoB,KAAA,EAAyC;AACzF,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,aAAa,IAAA,EAA6B;AAC9C,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAClC,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AAKA,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,qBAAA;AAAA,MACX,SAAA,EAAW,qBAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;AChDA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,aAAA,GAAgB,QAAA;AAEtB,IAAM,gBAAA,GAAmB,gBAAA;AACzB,IAAM,gBAAA,GAAmB,YAAA;AAGzB,IAAM,cAAA,GAAiB,2BAAA;AAoBvB,SAAS,eAAA,CAAgB,YAAoB,IAAA,EAAsB;AACjE,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,iBAAA,EAAmB,YAAY,aAAa,CAAA;AACzF;AAEA,SAAS,oBAAA,GAA+B;AAEtC,EAAA,OAAO,UAAa,EAAA,CAAA,QAAA,EAAU,CAAA,CAAA,EAAO,EAAA,CAAA,QAAA,GAAW,QAAQ,CAAA,CAAA;AAC1D;AAGA,SAAS,eAAe,UAAA,EAA4B;AAClD,EAAA,OAAc,kBAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACpE;AAMA,SAAS,UAAU,GAAA,EAAqB;AACtC,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC1E;AAMA,SAAS,OAAA,CAAQ,MAAkB,GAAA,EAAqB;AACtD,EAAA,MAAM,EAAA,GAAY,mBAAY,SAAS,CAAA;AACvC,EAAA,MAAM,MAAA,GAAgB,sBAAe,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC3F,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,EAAA,EAAI,OAAA,EAAS,SAAS,CAAC,CAAA;AAC/C;AAEA,SAAS,OAAA,CAAQ,MAAc,GAAA,EAAqB;AAClD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,CAAA,EAAG,SAAS,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,YAAY,eAAe,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,QAAA,CAAS,SAAA,GAAY,eAAe,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAkB,wBAAiB,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC/F,EAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACtE;AAMO,IAAM,uBAAN,MAAuD;AAAA,EACnD,EAAA,GAAK,OAAA;AAAA,EACN,UAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAC3B,IAAA,GAAsB,IAAA;AAAA,EACtB,QAAA,GAAwB,SAAA;AAAA,EAEhC,YAAY,UAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA,IAAmB,IAAA,CAAA,IAAA,CAAK,eAAA,IAAmB,SAAS,CAAA;AAAA,EACxE;AAAA;AAAA,EAIQ,SAAA,GAAkB;AACxB,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,EAAG;AACnC,MAAG,EAAA,CAAA,SAAA,CAAU,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,gBAAA,GAA2B;AACjC,IAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,OAAU,gBAAa,QAAQ,CAAA;AAAA,IACjC;AACA,IAAA,MAAM,IAAA,GAAc,mBAAY,WAAW,CAAA;AAC3C,IAAG,iBAAc,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAA,GAA2B;AACvC,IAAA,IAAI,KAAK,SAAA,EAAW;AAEpB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,gBAAA,EAAiB;AAGlC,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,IAAA,CAAK,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,EAAE,IAAA,EAAK;AAAA,IAC9D,CAAA,MAAO;AAEL,MAAA,IAAA,CAAK,QAAA,GAAY,MAAM,IAAA,CAAK,mBAAA,KAAyB,UAAA,GAAa,SAAA;AAClE,MAAG,iBAAc,YAAA,EAAc,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,wBAAA,CAAyB,KAAK,QAAQ,CAAA;AACpE,IAAA,IAAA,CAAK,SAAA,GAAY,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAAA,EACxD;AAAA,EAEA,MAAc,mBAAA,GAAwC;AACpD,IAAA,IAAI;AAGF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AACxE,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,GAAgB,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACjD,QAAA,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAA,EAAkB,gBAAA,EAAkB,MAAM,CAAA;AAAA,MACrE;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,yBAAyB,QAAA,EAAwC;AAC7E,IAAA,QAAQ,QAAA;AAAU,MAChB,KAAK,UAAA,EAAY;AACf,QAAA,IAAI;AAGF,UAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AAC1E,UAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,QACrB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,QAAA,IAAI,aAAA,EAAe;AAEjB,UAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,UAAA,IAAO,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,YAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC7D,YAAA,IAAI,cAAA,CAAe,aAAa,CAAA,KAAM,UAAA,EAAY;AAChD,cAAA,MAAM,IAAI,YAAA;AAAA,gBACR,mBAAmB,cAAc,CAAA,kFAAA,CAAA;AAAA,gBAEjC;AAAA,eACF;AAAA,YACF;AAAA,UACF;AACA,UAAA,OAAO,aAAA;AAAA,QACT;AAIA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,6BAAA,EAAgC,cAAc,CAAA,8CAAA,EACR,cAAc,CAAA,MAAA,CAAA;AAAA,UACpD;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,SAAA;AACH,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AACE,QAAA,OAAO,oBAAA,EAAqB;AAAA;AAChC,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CAAe,QAAA,EAAuB,UAAA,EAAoC;AAC9E,IAAA,IAAA,CAAK,SAAA,EAAU;AAIf,IAAA,MAAM,mBAAA,GAAsB,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEpE,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,sDAAsD,cAAc,CAAA,CAAA,CAAA;AAAA,UACpE;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC/C,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,wBAAA,CAAyB,OAAA,EAAS,2BAA2B,CAAA;AAAA,MACzE;AAAA,IACF;AAOA,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AACnC,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,KAAK,SAAA,EAAU;AACrB,MAAA,MAAM,SAAS,IAAA,CAAK,SAAA;AAGpB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,MAAA,MAAM,aAAA,GACJ,QAAA,KAAa,YAAA,GACT,mBAAA,GACA,QAAA,KAAa,UAAA,GACX,MAAM,IAAA,CAAK,wBAAA,CAAyB,UAAU,CAAA,GAC9C,oBAAA,EAAqB;AAC7B,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,aAAA,EAAe,IAAI,CAAA;AAOlD,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,QAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AACtC,UAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AAC7C,UAAG,iBAAc,QAAA,EAAU,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,QACzD,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,QACrB;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sEACK,MAAA,CAAO,MAAM,eAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,mFAAA;AAAA,SAEpD;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,MAAG,EAAA,CAAA,aAAA,CAAc,YAAY,cAAA,CAAe,mBAAoB,GAAG,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAG,iBAAc,YAAA,EAAc,QAAA,EAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AACxD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,cAAA,GAA8B;AAC5B,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,OAAU,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAA,CAAE,IAAA,EAAK;AAAA,IACrD;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA,EAIQ,YAAY,GAAA,EAAqB;AACvC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,IAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,aAAa,GAAA,EAAqB;AACxC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,UAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,SAAS,GAAA,EAAqB;AACpC,IAAA,OAAY,UAAK,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,YAAA,CAAa,GAAG,CAAC,CAAA;AAAA,EAC1D;AAAA,EAEQ,YAAA,GAAyB;AAC/B,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,SAAU,EAAC;AAC7C,IAAA,OAAU,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACzE;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,IAAA,CAAK,SAAU,CAAA;AAG/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC1D,QAAA,IAAA,CAAK,cAAA,GAAA,iBAAiB,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAC7C,QAAG,EAAA,CAAA,aAAA,CAAc,UAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,MAClE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,WAAW,SAAS,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,EAAO,IAAA,CAAK,SAAU,CAAA;AAChD,IAAG,iBAAc,QAAA,EAAU,SAAA,EAAW,EAAE,IAAA,EAAM,KAAO,CAAA;AAGrD,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,GAAA;AAAA,MACA,SAAA,EAAW,SAAS,SAAA,IAAa,GAAA;AAAA,MACjC,SAAA,EAAW,GAAA;AAAA,MACX,cAAA,EAAgB,GAAA;AAAA,MAChB,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,IAAA,CAAK,QAAA,KAAa,EAAC;AAAA,MACpD,GAAI,IAAA,EAAM,UAAA,GACN,EAAE,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY,KACvE;AAAC,KACP;AACA,IAAG,EAAA,CAAA,aAAA,CAAc,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAG,cAAW,QAAQ,CAAA;AACtB,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAG,cAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAA,CAAK,SAAA,EAAU;AAEf,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,YAAY,CAAC,CAAA;AACxF,IAAA,IAAI,OAAiB,EAAC;AACtB,IAAA,KAAA,MAAW,MAAM,SAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,UAAA,EAAY,EAAE,CAAA,EAAG,OAAO,CAAC,CAAA;AAChF,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,MAClC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,SAAA,EAAU;AAErB,MAAA,MAAM,UAAU,CAAA,OAAA,EAAiB,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AAC/D,MAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,SAAS,CAAA;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,aAAa,OAAO,CAAA;AAC/B,MAAA,IAAI,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACnD;AACA,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAW,IAAA,CAAK,GAAA,KAAQ,KAAA,EAAM;AAAA,IACnD,SAAS,CAAA,EAAG;AACV,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,QACxB,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC;AAAA,OAClD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,GAAA,EAAK,IAAI,GAAA,IAAO,GAAA;AAAA,QAChB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,gBAAgB,GAAA,CAAI,cAAA,GAAiB,IAAI,IAAA,CAAK,GAAA,CAAI,cAAc,CAAA,GAAI,MAAA;AAAA,QACpE,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAU,YAAS,QAAQ,CAAA;AACjC,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,KAAA;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;;;ACzZO,IAAM,gBAAN,MAAoB;AAAA,EACjB,SAAA,uBAAgB,GAAA,EAA8B;AAAA,EAC9C,MAAA;AAAA,EACA,QAAqB,EAAC;AAAA;AAAA,EAG9B,eAAA;AAAA,EACA,cAAA;AAAA,EAEA,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA,EAIA,SAAS,QAAA,EAAkC;AACzC,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC1C;AAAA,EAEA,WAAW,EAAA,EAAkB;AAC3B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,EAC1B;AAAA,EAEA,aAAA,GAA0B;AACxB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAA,EAClC;AAAA;AAAA,EAIA,QAAQ,IAAA,EAAuB;AAC7B,IAAA,IAAA,CAAK,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACtB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,SAAA,EAA4C,UAAA,EAA0B;AAC9F,IAAA,MAAM,KAAA,GAA4B;AAAA,MAChC,cAAA,EAAgB,GAAA;AAAA,MAChB,SAAA;AAAA,MACA,WAAA,EAAa,UAAA;AAAA,MACb,mBAAmB,IAAA,CAAK,eAAA;AAAA,MACxB,kBAAkB,IAAA,CAAK,cAAA;AAAA,MACvB,SAAA,sBAAe,IAAA;AAAK,KACtB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIQ,QAAQ,GAAA,EAA+B;AAE7C,IAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO;AACpC,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,MAAMA,SAAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,KAAK,WAAW,CAAA;AACpD,UAAA,IAAIA,WAAU,OAAOA,SAAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,KAAK,MAAA,CAAO,gBAAA;AAAA,QACZ,CAAA,uCAAA,EAA0C,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,UAAU,GAAG,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,IAAI,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,QAAA,CAAS,EAAE,CAAA;AACpC,IAAA,OAAO,QAAA,CAAS,aAAa,GAAG,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AAIxD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,CAAS,EAAE,CAAA;AAClC,IAAA,OAAO,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAA,EAAY,QAAA,CAAS,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,CAAS,YAAY,GAAG,CAAA;AAAA,EACjC;AAAA,EAEA,gBAAgB,UAAA,EAAkD;AAChE,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,EAAU,iBAAgB,IAAK,IAAA;AAAA,EACxC;AAAA,EAEA,MAAM,eACJ,UAAA,EAC8D;AAC9D,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,UAAA,EAAa,EAAE,CAAA,gBAAA,CAAA,EAAmB;AAAA,IAC/D;AACA,IAAA,OAAO,SAAS,cAAA,EAAe;AAAA,EACjC;AACF;;;ACvNO,IAAM,OAAA,GAAU","file":"chunk-EB6OPURC.js","sourcesContent":["/**\n * CredentialLifecycleService — manages OAuth token refresh outside the SecretsRouter.\n *\n * Works with opaque token blobs stored via the {@link SecretsRouter}; providers remain\n * OAuth-unaware. Phase 1 ships non-OAuth paths (always returns `not_applicable`).\n * Full proactive OAuth refresh with expiry checking ships in Phase 3.4.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\n\nimport type { SecretsRouter } from \"./router.js\";\n\n/**\n * Configuration for {@link CredentialLifecycleService}.\n *\n * Controls how aggressively the service proactively refreshes credentials before they expire.\n * The default lead time is 300 seconds (5 minutes).\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface CredentialLifecycleConfig {\n  /** How far before expiry to trigger a proactive refresh (seconds). */\n  refreshLeadTimeSec: number;\n}\n\n/**\n * Result returned by {@link CredentialLifecycleService.refreshIfNeeded}.\n *\n * The `reason` discriminant indicates why a refresh did or did not occur.\n * An `error` string is present only when `reason` is `refresh_failed`.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface RefreshResult {\n  refreshed: boolean;\n  reason: \"not_applicable\" | \"still_valid\" | \"refreshed\" | \"refresh_failed\";\n  error?: string;\n}\n\nexport class CredentialLifecycleService {\n  private router: SecretsRouter;\n\n  // `_config` is accepted for signature stability but not stored yet: Phase 1\n  // ships no OAuth refresh, so there is nothing to configure. Phase 3.4 will\n  // store and read `refreshLeadTimeSec` when proactive refresh lands.\n  constructor(router: SecretsRouter, _config?: Partial<CredentialLifecycleConfig>) {\n    this.router = router;\n  }\n\n  /**\n   * Attempt to refresh a credential if needed.\n   * Phase 1: always returns not_applicable (no OAuth support yet).\n   */\n  async refreshIfNeeded(credentialRef: string): Promise<RefreshResult> {\n    // Phase 1: no OAuth refresh implemented.\n    // The credential exists and is valid as-is (static secrets, env vars, etc.)\n    try {\n      await this.router.getMetadata(credentialRef);\n      return { refreshed: false, reason: \"not_applicable\" };\n    } catch {\n      return { refreshed: false, reason: \"refresh_failed\", error: \"Credential not found\" };\n    }\n  }\n\n  /**\n   * Check if a credential is still valid (not expired).\n   * Phase 1: always returns true for non-OAuth credentials.\n   */\n  async isValid(credentialRef: string): Promise<boolean> {\n    try {\n      await this.router.getSecret(credentialRef);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","/**\n * EnvSecretsProvider — read-only provider that resolves secrets from environment variables.\n *\n * Refs are expected to be plain env var names (e.g. `DATABASE_URL`). The provider is\n * always available with zero configuration and requires no encryption or keychain access.\n * `setSecret` and `deleteSecret` always throw `SecretAccessDeniedError` because\n * environment variables are managed externally to the running process.\n *\n * @docLink packages/secrets/concepts#env-secrets-provider\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { SecretAccessDeniedError, SecretNotFoundError } from \"@skaile/workspaces/plugins\";\n\n/**\n * Sentinel timestamp for env secrets, which have no real created/updated time.\n * The Unix epoch is unambiguously not \"now\", so consumers can recognise it as\n * \"unknown\" rather than treating it as a genuine recent timestamp.\n */\nconst ENV_UNKNOWN_TIMESTAMP = new Date(0);\n\nexport class EnvSecretsProvider implements ISecretsProvider {\n  readonly id = \"env\";\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    return new TextEncoder().encode(value);\n  }\n\n  async setSecret(_ref: string, _value: Uint8Array, _opts?: SetSecretOptions): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async deleteSecret(_ref: string): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    let keys = Object.keys(process.env);\n    if (filter?.prefix) {\n      keys = keys.filter((k) => k.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      keys = keys.slice(0, filter.limit);\n    }\n    return keys;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    return { ok: true, latencyMs: 0 };\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    // Env vars carry no creation/modification time. `SecretMetadata` requires\n    // both fields, so use the Unix epoch as a documented \"unknown\" sentinel\n    // rather than `new Date()`, which would falsely imply the secret was just\n    // created/updated. The read-only scope summary already signals the source.\n    return {\n      ref,\n      createdAt: ENV_UNKNOWN_TIMESTAMP,\n      updatedAt: ENV_UNKNOWN_TIMESTAMP,\n      scopeSummary: \"environment variable (read-only)\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * LocalSecretsProvider — AES-256-GCM encrypted file-blob storage at `~/.skaile/secrets/`.\n *\n * Each secret is stored as a separate `.enc` file named by the SHA-256 hash of the ref\n * (collision-free, filesystem-safe). A companion `.meta.json` stores the original ref,\n * timestamps, and optional user metadata. The master key is derived via PBKDF2-SHA-512\n * from one of three {@link KeyStrategy} sources: OS keychain (keytar), a passphrase from\n * `SKAILE_SECRETS_PASSPHRASE`, or a machine-derived passphrase as last resort.\n * Switching strategies re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\n// The narrow module, not the `core` barrel: the barrel's chunks use `import.meta`,\n// which CommonJS-transpiling consumers (ts-jest) cannot load.\nimport { globalSkaileDir } from \"../../../core/src/cache-paths.js\";\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport {\n  ProviderUnavailableError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\nconst KEY_LENGTH = 32;\nconst PBKDF2_ITERATIONS = 100_000;\nconst PBKDF2_DIGEST = \"sha512\";\n\nconst KEYCHAIN_SERVICE = \"skaile-secrets\";\nconst KEYCHAIN_ACCOUNT = \"master-key\";\n\n/** Env var that provides the passphrase at runtime (never stored on disk). */\nconst PASSPHRASE_ENV = \"SKAILE_SECRETS_PASSPHRASE\";\n\n/**\n * Master key derivation strategy used by {@link LocalSecretsProvider}.\n *\n * - `keychain` — OS keychain (via keytar); most secure, requires keytar to be installed.\n * - `passphrase` — PBKDF2 from `SKAILE_SECRETS_PASSPHRASE` env var; portable across machines.\n * - `machine` — deterministic from hostname + username; least secure, last-resort fallback.\n *\n * The active strategy is persisted in `~/.skaile/secrets/.key-strategy`. Switching strategies\n * re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\nexport type KeyStrategy = \"keychain\" | \"passphrase\" | \"machine\";\n\n// ---------------------------------------------------------------------------\n// Key derivation\n// ---------------------------------------------------------------------------\n\nfunction deriveMasterKey(passphrase: string, salt: Buffer): Buffer {\n  return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);\n}\n\nfunction getMachinePassphrase(): string {\n  // Deterministic but not secret -- last resort only.\n  return `skaile:${os.hostname()}:${os.userInfo().username}`;\n}\n\n/** Hash a passphrase for verification (stored in .master). */\nfunction hashPassphrase(passphrase: string): string {\n  return crypto.createHash(\"sha256\").update(passphrase).digest(\"hex\");\n}\n\n// ---------------------------------------------------------------------------\n// Filename hashing (injective: sha256 of ref)\n// ---------------------------------------------------------------------------\n\nfunction refToHash(ref: string): string {\n  return crypto.createHash(\"sha256\").update(ref).digest(\"hex\").slice(0, 40);\n}\n\n// ---------------------------------------------------------------------------\n// Encryption / decryption\n// ---------------------------------------------------------------------------\n\nfunction encrypt(data: Uint8Array, key: Buffer): Buffer {\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);\n  const authTag = cipher.getAuthTag();\n  // Format: [iv (12)] [authTag (16)] [ciphertext (...)]\n  return Buffer.concat([iv, authTag, encrypted]);\n}\n\nfunction decrypt(blob: Buffer, key: Buffer): Buffer {\n  const iv = blob.subarray(0, IV_LENGTH);\n  const authTag = blob.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);\n  const ciphertext = blob.subarray(IV_LENGTH + AUTH_TAG_LENGTH);\n  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  decipher.setAuthTag(authTag);\n  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n}\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport class LocalSecretsProvider implements ISecretsProvider {\n  readonly id = \"local\";\n  private secretsDir: string;\n  private masterKey: Buffer | null = null;\n  private salt: Buffer | null = null;\n  private strategy: KeyStrategy = \"machine\";\n\n  constructor(secretsDir?: string) {\n    this.secretsDir = secretsDir ?? path.join(globalSkaileDir(), \"secrets\");\n  }\n\n  // -- Initialization --------------------------------------------------------\n\n  private ensureDir(): void {\n    if (!fs.existsSync(this.secretsDir)) {\n      fs.mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });\n    }\n  }\n\n  private loadOrCreateSalt(): Buffer {\n    const saltPath = path.join(this.secretsDir, \".salt\");\n    if (fs.existsSync(saltPath)) {\n      return fs.readFileSync(saltPath);\n    }\n    const salt = crypto.randomBytes(SALT_LENGTH);\n    fs.writeFileSync(saltPath, salt, { mode: 0o600 });\n    return salt;\n  }\n\n  private async ensureKey(): Promise<void> {\n    if (this.masterKey) return;\n\n    this.ensureDir();\n    this.salt = this.loadOrCreateSalt();\n\n    // Determine strategy\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      this.strategy = fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    } else {\n      // Auto-detect: try keychain, fall back to machine\n      this.strategy = (await this.tryKeychainStrategy()) ? \"keychain\" : \"machine\";\n      fs.writeFileSync(strategyPath, this.strategy, { mode: 0o600 });\n    }\n\n    // Derive key from strategy\n    const passphrase = await this.getPassphraseForStrategy(this.strategy);\n    this.masterKey = deriveMasterKey(passphrase, this.salt);\n  }\n\n  private async tryKeychainStrategy(): Promise<boolean> {\n    try {\n      // `keytar` is an optional OS-keychain native module the user installs\n      // themselves; the `as string` specifier keeps it out of tsc resolution.\n      const keytar = await import(\"keytar\" as string);\n      let stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n      if (!stored) {\n        stored = crypto.randomBytes(32).toString(\"base64\");\n        await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, stored);\n      }\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private async getPassphraseForStrategy(strategy: KeyStrategy): Promise<string> {\n    switch (strategy) {\n      case \"keychain\": {\n        try {\n          // `keytar` is an optional OS-keychain native module the user installs\n          // themselves; the `as string` specifier keeps it out of tsc resolution.\n          const keytar = await import(\"keytar\" as string);\n          const stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n          if (stored) return stored;\n        } catch {\n          // Keychain failed; fall through to machine\n        }\n        return getMachinePassphrase();\n      }\n      case \"passphrase\": {\n        const envPassphrase = process.env[PASSPHRASE_ENV];\n        if (envPassphrase) {\n          // Verify against stored hash if it exists\n          const masterPath = path.join(this.secretsDir, \".master\");\n          if (fs.existsSync(masterPath)) {\n            const storedHash = fs.readFileSync(masterPath, \"utf-8\").trim();\n            if (hashPassphrase(envPassphrase) !== storedHash) {\n              throw new SecretsError(\n                `Passphrase from ${PASSPHRASE_ENV} does not match stored hash. ` +\n                  \"Use skaile auth set-key-strategy passphrase to reset.\",\n                \"PASSPHRASE_MISMATCH\",\n              );\n            }\n          }\n          return envPassphrase;\n        }\n        // No env var -- hard error. Silent fallback to machine would\n        // produce a different key, causing AES-GCM auth-tag failures\n        // on secrets encrypted with the real passphrase.\n        throw new SecretsError(\n          `Strategy is \"passphrase\" but ${PASSPHRASE_ENV} is not set. ` +\n            `Export it before running: export ${PASSPHRASE_ENV}='...'`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n      case \"machine\":\n        return getMachinePassphrase();\n      default:\n        return getMachinePassphrase();\n    }\n  }\n\n  // -- Strategy management ---------------------------------------------------\n\n  /**\n   * Set the key strategy explicitly. Called by `skaile auth set-key-strategy`.\n   *\n   * When existing secrets are present, they are re-encrypted with the new key\n   * to prevent data loss from key mismatch.\n   */\n  async setKeyStrategy(strategy: KeyStrategy, passphrase?: string): Promise<void> {\n    this.ensureDir();\n\n    // --- 1. Validate new strategy prerequisites -------------------------\n\n    const effectivePassphrase = passphrase ?? process.env[PASSPHRASE_ENV];\n\n    if (strategy === \"passphrase\") {\n      if (!effectivePassphrase) {\n        throw new SecretsError(\n          `Passphrase required. Pass it as an argument or set ${PASSPHRASE_ENV}.`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n    }\n\n    if (strategy === \"keychain\") {\n      const success = await this.tryKeychainStrategy();\n      if (!success) {\n        throw new ProviderUnavailableError(\"local\", \"OS keychain not available\");\n      }\n    }\n\n    // --- 2. Load the OLD key under the current strategy -----------------\n    // ensureKey() reads the current strategy file and derives the key\n    // that was used to encrypt existing secrets. This is critical for\n    // cross-process scenarios where masterKey starts as null.\n\n    const encFiles = this.listEncFiles();\n    if (encFiles.length > 0) {\n      await this.ensureKey();\n      const oldKey = this.masterKey!;\n\n      // Derive the new key\n      const salt = this.salt!;\n      const newPassphrase =\n        strategy === \"passphrase\"\n          ? effectivePassphrase!\n          : strategy === \"keychain\"\n            ? await this.getPassphraseForStrategy(\"keychain\")\n            : getMachinePassphrase();\n      const newKey = deriveMasterKey(newPassphrase, salt);\n\n      // Re-encrypt each secret with the new key. A single failure must abort the\n      // whole switch: committing the new strategy while a secret is still under\n      // the old key orphans that secret (the registry advertises a key that no\n      // longer decrypts it). Collect failures and throw before the commit below,\n      // leaving `.key-strategy`/`.master` — and every secret — on the old key.\n      const failed: string[] = [];\n      for (const encFile of encFiles) {\n        const filePath = path.join(this.secretsDir, encFile);\n        const blob = fs.readFileSync(filePath);\n        try {\n          const plaintext = decrypt(blob, oldKey);\n          const reEncrypted = encrypt(plaintext, newKey);\n          fs.writeFileSync(filePath, reEncrypted, { mode: 0o600 });\n        } catch {\n          failed.push(encFile);\n        }\n      }\n      if (failed.length > 0) {\n        throw new Error(\n          `[skaile/secrets] Key-strategy switch aborted: could not re-encrypt ` +\n            `${failed.length} secret(s) (${failed.join(\", \")}). The previous strategy ` +\n            \"is unchanged; resolve the failing secrets before retrying.\",\n        );\n      }\n    }\n\n    // --- 3. Commit the new strategy (last write -- failure above leaves\n    //        the old strategy intact) ------------------------------------\n\n    if (strategy === \"passphrase\") {\n      const masterPath = path.join(this.secretsDir, \".master\");\n      fs.writeFileSync(masterPath, hashPassphrase(effectivePassphrase!), { mode: 0o600 });\n    }\n\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    fs.writeFileSync(strategyPath, strategy, { mode: 0o600 });\n    this.masterKey = null;\n    this.strategy = strategy;\n  }\n\n  getKeyStrategy(): KeyStrategy {\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      return fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    }\n    return \"machine\";\n  }\n\n  // -- File helpers ----------------------------------------------------------\n\n  private encFilename(ref: string): string {\n    return `${refToHash(ref)}.enc`;\n  }\n\n  private metaFilename(ref: string): string {\n    return `${refToHash(ref)}.meta.json`;\n  }\n\n  private metaPath(ref: string): string {\n    return path.join(this.secretsDir, this.metaFilename(ref));\n  }\n\n  private listEncFiles(): string[] {\n    if (!fs.existsSync(this.secretsDir)) return [];\n    return fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".enc\"));\n  }\n\n  // -- ISecretsProvider implementation ----------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    await this.ensureKey();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    const blob = fs.readFileSync(filePath);\n    const decrypted = decrypt(blob, this.masterKey!);\n\n    // Update lastAccessedAt\n    const metaFile = this.metaPath(ref);\n    if (fs.existsSync(metaFile)) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n        meta.lastAccessedAt = new Date().toISOString();\n        fs.writeFileSync(metaFile, JSON.stringify(meta), { mode: 0o600 });\n      } catch {\n        // Non-fatal\n      }\n    }\n\n    return new Uint8Array(decrypted);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    await this.ensureKey();\n    this.ensureDir();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const encrypted = encrypt(value, this.masterKey!);\n    fs.writeFileSync(filePath, encrypted, { mode: 0o600 });\n\n    // Write metadata (stores the original ref for reverse lookup)\n    const now = new Date().toISOString();\n    const metaFile = this.metaPath(ref);\n    let existing: Record<string, unknown> = {};\n    if (fs.existsSync(metaFile)) {\n      try {\n        existing = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      } catch {\n        // Overwrite corrupt meta\n      }\n    }\n    const meta = {\n      ref,\n      createdAt: existing.createdAt ?? now,\n      updatedAt: now,\n      lastAccessedAt: now,\n      ...(opts?.metadata ? { userMeta: opts.metadata } : {}),\n      ...(opts?.ttlSeconds\n        ? { expiresAt: new Date(Date.now() + opts.ttlSeconds * 1000).toISOString() }\n        : {}),\n    };\n    fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2), { mode: 0o600 });\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const metaFile = this.metaPath(ref);\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    fs.unlinkSync(filePath);\n    if (fs.existsSync(metaFile)) {\n      fs.unlinkSync(metaFile);\n    }\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    this.ensureDir();\n    // Read refs from meta files (the .enc filenames are hashes, not refs)\n    const metaFiles = fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".meta.json\"));\n    let refs: string[] = [];\n    for (const mf of metaFiles) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(path.join(this.secretsDir, mf), \"utf-8\"));\n        if (meta.ref) refs.push(meta.ref);\n      } catch {\n        // Skip corrupt meta files\n      }\n    }\n    if (filter?.prefix) {\n      refs = refs.filter((r) => r.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      refs = refs.slice(0, filter.limit);\n    }\n    return refs;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const start = Date.now();\n    try {\n      await this.ensureKey();\n      // Write + read + delete a test secret\n      const testRef = `__test_${crypto.randomBytes(4).toString(\"hex\")}`;\n      const testValue = new TextEncoder().encode(\"test\");\n      await this.setSecret(testRef, testValue);\n      const read = await this.getSecret(testRef);\n      await this.deleteSecret(testRef);\n      if (new TextDecoder().decode(read) !== \"test\") {\n        return { ok: false, error: \"Round-trip mismatch\" };\n      }\n      return { ok: true, latencyMs: Date.now() - start };\n    } catch (e) {\n      return {\n        ok: false,\n        latencyMs: Date.now() - start,\n        error: e instanceof Error ? e.message : String(e),\n      };\n    }\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const metaFile = this.metaPath(ref);\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    if (fs.existsSync(metaFile)) {\n      const raw = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      return {\n        ref: raw.ref ?? ref,\n        createdAt: new Date(raw.createdAt),\n        updatedAt: new Date(raw.updatedAt),\n        lastAccessedAt: raw.lastAccessedAt ? new Date(raw.lastAccessedAt) : undefined,\n        owner: raw.owner,\n        scopeSummary: \"local encrypted file\",\n      };\n    }\n    // Fallback: derive from file stat\n    const stat = fs.statSync(filePath);\n    return {\n      ref,\n      createdAt: stat.birthtime,\n      updatedAt: stat.mtime,\n      scopeSummary: \"local encrypted file\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * SecretsRouter — audit chokepoint for all secret operations.\n *\n * Registers {@link ISecretsProvider} implementations by id, routes credential refs by\n * prefix or via routing config, and emits {@link CredentialAccessed} events for every\n * get, set, delete, list, and metadata operation. Routing rules are evaluated top-to-bottom;\n * the first matching prefix wins and falls back to the configured default provider.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { ProviderUnavailableError } from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Audit event\n// ---------------------------------------------------------------------------\n\n/**\n * Audit event emitted by {@link SecretsRouter} after every secret operation.\n *\n * Delivered synchronously to all registered {@link AuditSink} functions. Errors thrown\n * by sinks are swallowed to ensure they never break the underlying secret operation.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface CredentialAccessed {\n  credential_ref: string;\n  operation: \"get\" | \"set\" | \"delete\" | \"list\" | \"metadata\";\n  provider_id: string;\n  caller_session_id?: string;\n  caller_tool_call?: string;\n  timestamp: Date;\n}\n\n/**\n * Callback function that receives {@link CredentialAccessed} audit events from {@link SecretsRouter}.\n *\n * Register sinks via `SecretsRouter.addSink()`. Sinks run synchronously after each operation;\n * exceptions are caught and suppressed so they cannot interrupt credential resolution.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport type AuditSink = (event: CredentialAccessed) => void;\n\n// ---------------------------------------------------------------------------\n// Routing config\n// ---------------------------------------------------------------------------\n\n/**\n * A single routing rule that maps a credential ref prefix to a provider.\n *\n * Rules in {@link SecretsRouterConfig.rules} are evaluated top-to-bottom;\n * the first rule whose `prefix` matches the start of the credential ref wins.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface RoutingRule {\n  /** Prefix match on credential_ref. First match wins. */\n  prefix: string;\n  /** Provider id to route to. */\n  provider_id: string;\n}\n\n/**\n * Configuration object for {@link SecretsRouter}.\n *\n * Specifies the default provider id used when no routing rule matches, and an optional\n * ordered list of {@link RoutingRule} entries for prefix-based routing.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface SecretsRouterConfig {\n  /** Default provider id when no routing rule matches. */\n  default_provider: string;\n  /** Ordered routing rules. Evaluated top-to-bottom; first prefix match wins. */\n  rules?: RoutingRule[];\n}\n\n// ---------------------------------------------------------------------------\n// Router\n// ---------------------------------------------------------------------------\n\nexport class SecretsRouter {\n  private providers = new Map<string, ISecretsProvider>();\n  private config: SecretsRouterConfig;\n  private sinks: AuditSink[] = [];\n\n  /** Caller context for audit events (set per-request by the runner). */\n  callerSessionId?: string;\n  callerToolCall?: string;\n\n  constructor(config: SecretsRouterConfig) {\n    this.config = config;\n  }\n\n  // -- Provider registration ------------------------------------------------\n\n  register(provider: ISecretsProvider): void {\n    this.providers.set(provider.id, provider);\n  }\n\n  unregister(id: string): void {\n    this.providers.delete(id);\n  }\n\n  listProviders(): string[] {\n    return [...this.providers.keys()];\n  }\n\n  // -- Audit sinks -----------------------------------------------------------\n\n  addSink(sink: AuditSink): void {\n    this.sinks.push(sink);\n  }\n\n  private emit(ref: string, operation: CredentialAccessed[\"operation\"], providerId: string): void {\n    const event: CredentialAccessed = {\n      credential_ref: ref,\n      operation,\n      provider_id: providerId,\n      caller_session_id: this.callerSessionId,\n      caller_tool_call: this.callerToolCall,\n      timestamp: new Date(),\n    };\n    for (const sink of this.sinks) {\n      try {\n        sink(event);\n      } catch {\n        // Audit sink errors must not break the secret operation.\n      }\n    }\n  }\n\n  // -- Routing ---------------------------------------------------------------\n\n  private resolve(ref: string): ISecretsProvider {\n    // Check routing rules first\n    if (this.config.rules) {\n      for (const rule of this.config.rules) {\n        if (ref.startsWith(rule.prefix)) {\n          const provider = this.providers.get(rule.provider_id);\n          if (provider) return provider;\n        }\n      }\n    }\n\n    // Fall back to default\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) {\n      throw new ProviderUnavailableError(\n        this.config.default_provider,\n        `No provider registered for default id \"${this.config.default_provider}\"`,\n      );\n    }\n    return provider;\n  }\n\n  // -- Delegated operations --------------------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"get\", provider.id);\n    return provider.getSecret(ref);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"set\", provider.id);\n    return provider.setSecret(ref, value, opts);\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"delete\", provider.id);\n    return provider.deleteSecret(ref);\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    // List aggregates from the default provider only (per-provider listing\n    // would require iterating all providers; deferred to Phase 3 with\n    // federated catalogs).\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) return [];\n    this.emit(\"*\", \"list\", provider.id);\n    return provider.listSecrets(filter);\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"metadata\", provider.id);\n    return provider.getMetadata(ref);\n  }\n\n  getCapabilities(providerId?: string): ProviderCapabilities | null {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    return provider?.getCapabilities() ?? null;\n  }\n\n  async testConnection(\n    providerId?: string,\n  ): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    if (!provider) {\n      return { ok: false, error: `Provider \"${id}\" not registered` };\n    }\n    return provider.testConnection();\n  }\n}\n","/** Package version of `@skaile/secrets`. */\nexport const VERSION = \"0.0.0\";\n\n// Re-export interface + errors from plugins (convenience for consumers)\nexport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nexport {\n  ProviderUnavailableError,\n  SecretAccessDeniedError,\n  SecretExpiredError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\nexport type { CredentialLifecycleConfig, RefreshResult } from \"./lifecycle.js\";\n// Lifecycle\nexport { CredentialLifecycleService } from \"./lifecycle.js\";\nexport { EnvSecretsProvider } from \"./providers/env.js\";\nexport type { KeyStrategy } from \"./providers/local.js\";\n// Built-in providers\nexport { LocalSecretsProvider } from \"./providers/local.js\";\nexport type { AuditSink, CredentialAccessed, RoutingRule, SecretsRouterConfig } from \"./router.js\";\n// Router\nexport { SecretsRouter } from \"./router.js\";\n"]}

package/dist/{chunk-27DN4DZD.js → chunk-GFPG27HK.js}

@@ -1,12 +1,13 @@
 import { initTelemetry } from './chunk-4R6DROGN.js';
-import { parseSkillFrontmatter, validateFlowVersions } from './chunk-OQRB7JUS.js';
-import { FlowAdapter, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn } from './chunk-J5UF3OOS.js';
-import { loadFlow, flowLookupRoots, findFlowFileInRoots, FLOW_FILE_EXTENSIONS } from './chunk-7RC37XFW.js';
-import { renderStimulusPrompt } from './chunk-K3IBZ2UZ.js';
-import { flowSkillVersionPins } from './chunk-UDFWBALP.js';
-import { resolveSettings } from './chunk-YV3YI3TA.js';
-import { resolveAgentDir, resolveSkWorkspaceConfig } from './chunk-JEPSP6XK.js';
-import { isValidAssetName } from './chunk-A5EDMBFG.js';
+import { parseSkillFrontmatter, validateFlowVersions } from './chunk-YV4J7V53.js';
+import { FlowAdapter, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn } from './chunk-53WMBXSL.js';
+import { loadFlow, flowLookupRoots, findFlowFileInRoots, FLOW_FILE_EXTENSIONS } from './chunk-22DN3DB2.js';
+import { renderStimulusPrompt } from './chunk-XUUYAS3Z.js';
+import { flowSkillVersionPins } from './chunk-NFGRW3L7.js';
+import { resolveSettings } from './chunk-MBVNMPG7.js';
+import { findKindDirs } from './chunk-A2ULN3KX.js';
+import { resolveAgentDir, resolveSkWorkspaceConfig } from './chunk-HWE3FXF4.js';
+import { isValidAssetName } from './chunk-43ZBF3WH.js';
 import { createLogger } from './chunk-BOFL7GIF.js';
 import fs from 'fs';
 import path from 'path';
@@ -467,10 +468,7 @@ function findAiResourcesDir(projectDir) {
   return null;
 }
 function findSkillMd(aiResourcesDir, skillId) {
-  for (const domain of fs.readdirSync(aiResourcesDir, { withFileTypes: true })) {
-    if (!domain.isDirectory()) continue;
-    const skillsDir = path.join(aiResourcesDir, domain.name, "skills");
-    if (!fs.existsSync(skillsDir)) continue;
+  for (const skillsDir of findKindDirs(aiResourcesDir, "skills")) {
     const found = walkForSkill(skillsDir, skillId);
     if (found) return found;
   }
@@ -518,5 +516,5 @@ function walkForSkill(dir, skillId) {
 }
 
 export { awaitAgentEnd, resolveFlowPath, resumeFlow, runFlow };
-//# sourceMappingURL=chunk-27DN4DZD.js.map
-//# sourceMappingURL=chunk-27DN4DZD.js.map
+//# sourceMappingURL=chunk-GFPG27HK.js.map
+//# sourceMappingURL=chunk-GFPG27HK.js.map