@skaile/workspaces 4.38.0 → 5.0.0

package/dist/chunk-A5EDMBFG.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../core/src/models.ts"],"names":[],"mappings":";;;AA4BO,IAAM,WAAA,GAAoC;AAAA,EAC/C,OAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF;AAQO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,OAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF;AAwBO,SAAS,SAAS,CAAA,EAAuB;AAC9C,EAAA,MAAM,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACvB,EAAA,IAAI,MAAM,EAAA,EAAI;AACZ,IAAA,MAAM,OAAO,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAC,EAAE,IAAA,EAAK;AAChC,IAAA,MAAM,OAAO,CAAA,CAAE,KAAA,CAAM,CAAA,GAAI,CAAC,EAAE,IAAA,EAAK;AACjC,IAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,EACtB;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,CAAA,CAAE,MAAK,EAAE;AACzC;AASO,SAAS,SAAS,CAAA,EAAuB;AAC9C,EAAA,OAAO,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,CAAA;AAC5B;AA4FO,SAAS,aAAa,CAAA,EAA0C;AACrE,EAAA,MAAM,UAAU,CAAA,CAAE,YAAA;AAClB,EAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,OAAO,IAAK,OAAA,CAAqB,MAAA,CAAO,OAAO,CAAA,GAAI,EAAC;AAC/E,EAAA,MAAM,KAAA,GAAsB;AAAA,IAC1B,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,IACzB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,OAAO,CAAA;AAAA,IAC9B,WAAA,EAAa,MAAA,CAAO,CAAA,CAAE,WAAA,IAAe,EAAE,CAAA;AAAA,IACvC,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA;AAAA,IAC7B,WAAW,CAAA,CAAE,SAAA,IAAa,OAAO,MAAA,CAAO,CAAA,CAAE,SAAS,CAAA,GAAI,MAAA;AAAA;AAAA;AAAA;AAAA,IAIvD,IAAA,EAAM,CAAA,CAAE,IAAA,IAAQ,IAAA,GAAO,OAAO,CAAA,CAAE,IAAI,CAAA,GAAI,CAAA,CAAE,MAAA,IAAU,IAAA,GAAO,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA,GAAI,MAAA;AAAA,IAC9E,YAAY,CAAA,CAAE,UAAA,IAAc,OAAO,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA,GAAI,MAAA;AAAA,IAC1D,OAAA,EAAS,MAAA,CAAO,CAAA,CAAE,OAAA,IAAW,EAAE,CAAA;AAAA,IAC/B,QAAA,EAAU,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,GAC7B,CAAA,CAAE,QAAA,CAAsB,MAAA,CAAO,OAAO,CAAA,CAAE,GAAA,CAAI,QAAQ,IACrD,EAAC;AAAA,IACL,YAAA,EAAc;AAAA,GAChB;AACA,EAAA,IAAI,CAAA,CAAE,QAAA,IAAY,IAAA,IAAQ,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtF,IAAA,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AAAA,EACrB;AACA,EAAA,IAAI,EAAE,QAAA,IAAY,IAAA,QAAY,QAAA,GAAW,MAAA,CAAO,EAAE,QAAQ,CAAA;AAC1D,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,EAAG;AAC7B,IAAA,KAAA,CAAM,QAAA,GAAY,EAAE,QAAA,CAAuB,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,MAAM,QAAQ,CAAA;AAAA,EAC7F;AACA,EAAA,IAAI,EAAE,OAAA,IAAW,IAAA,QAAY,OAAA,GAAU,MAAA,CAAO,EAAE,OAAO,CAAA;AACvD,EAAA,IAAI,EAAE,QAAA,IAAY,IAAA,QAAY,QAAA,GAAW,MAAA,CAAO,EAAE,QAAQ,CAAA;AAC1D,EAAA,OAAO,KAAA;AACT;AASO,SAAS,WAAW,CAAA,EAA0C;AACnE,EAAA,MAAM,GAAA,GAA+B;AAAA,IACnC,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,aAAa,CAAA,CAAE,WAAA;AAAA,IACf,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,WAAW,CAAA,CAAE,SAAA;AAAA,IACb,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE,OAAA;AAAA,IACX,GAAI,EAAE,UAAA,IAAc,IAAA,GAAO,EAAE,UAAA,EAAY,CAAA,CAAE,UAAA,EAAW,GAAI,EAAC;AAAA,IAC3D,QAAA,EAAU,CAAA,CAAE,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAAA,IACjC,cAAc,CAAA,CAAE;AAAA,GAClB;AACA,EAAA,IAAI,CAAA,CAAE,QAAA,EAAU,GAAA,CAAI,QAAA,GAAW,CAAA,CAAE,QAAA;AACjC,EAAA,IAAI,CAAA,CAAE,QAAA,IAAY,IAAA,EAAM,GAAA,CAAI,WAAW,CAAA,CAAE,QAAA;AACzC,EAAA,IAAI,CAAA,CAAE,YAAY,CAAA,CAAE,QAAA,CAAS,SAAS,CAAA,EAAG,GAAA,CAAI,WAAW,CAAA,CAAE,QAAA;AAC1D,EAAA,IAAI,CAAA,CAAE,OAAA,IAAW,IAAA,EAAM,GAAA,CAAI,UAAU,CAAA,CAAE,OAAA;AACvC,EAAA,IAAI,CAAA,CAAE,QAAA,IAAY,IAAA,EAAM,GAAA,CAAI,WAAW,CAAA,CAAE,QAAA;AACzC,EAAA,OAAO,GAAA;AACT;AAwBA,IAAM,MAAA,GAAS,iBAAA;AAQf,IAAM,aAAA,GACJ,kHAAA;AAMF,IAAM,aAAA,GAAgB,4BAAA;AAMtB,IAAM,eAAA,GAAkB,mDAAA;AAGjB,IAAM,eAAA,GACX;AASK,SAAS,iBAAiB,IAAA,EAAuB;AACtD,EAAA,OAAO,aAAA,CAAc,KAAK,IAAI,CAAA;AAChC;AAqBO,SAAS,iBAAiB,GAAA,EAAqB;AACpD,EAAA,MAAM,OAAO,GAAA,CACV,SAAA,CAAU,MAAM,CAAA,CAChB,QAAQ,kBAAA,EAAoB,EAAE,CAAA,CAC9B,WAAA,GACA,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAC1B,OAAA,CAAQ,YAAY,EAAE,CAAA;AACzB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,GAAG,CAAA,SAAA,EAAO,eAAe,CAAA,CAAA,CAAG,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAW,GAAA,EAAsB;AACxC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG,OAAO,IAAA;AAC7B,EAAA,IAAI,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG,OAAO,IAAA;AAC9B,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,GAAG,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,iBAAA,CAAkB,GAAW,GAAA,EAAoB;AACxD,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,mBAAA,EAAsB,GAAG,CAAA,MAAA,EAAS,CAAC,CAAA,8IAAA;AAAA,GAGrC;AACF;AAGA,SAAS,iBAAA,CAAkB,GAAW,IAAA,EAAqB;AACzD,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,oBAAA,EAAuB,IAAI,CAAA,UAAA,EAAa,CAAC,YAAO,eAAe,CAAA,gEAAA;AAAA,GAEjE;AACF;AAuBO,SAAS,cAAc,CAAA,EAAqB;AACjD,EAAA,MAAM,OAAA,GAAU,EAAE,IAAA,EAAK;AACvB,EAAA,MAAM,CAAA,GAAI,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA;AACpC,EAAA,IAAI,CAAA,EAAG;AACL,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,CAAC,CAAA,IAAK,OAAA;AACxB,IAAA,MAAM,IAAA,GAAO,OAAA,KAAY,KAAA,GAAQ,YAAA,GAAe,OAAA;AAChD,IAAA,MAAM,SAAA,GAAY,EAAE,CAAC,CAAA;AACrB,IAAA,MAAM,IAAA,GAAO,EAAE,CAAC,CAAA;AAChB,IAAA,MAAM,GAAA,GAAM,CAAA,CAAE,CAAC,CAAA,EAAG,MAAK,IAAK,MAAA;AAC5B,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAI,CAAA,EAAG,iBAAA,CAAkB,GAAG,IAAI,CAAA;AACtD,IAAA,IAAI,GAAA,KAAQ,UAAa,CAAC,UAAA,CAAW,GAAG,CAAA,EAAG,iBAAA,CAAkB,GAAG,GAAG,CAAA;AACnE,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,GAAA,EAAI;AAAA,EACtC;AAOA,EAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,IAAA,CAAK,OAAO,CAAA;AAC3C,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,CAAC,CAAA,CAAE,IAAA,EAAK;AACjC,IAAA,IAAI,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG,iBAAA,CAAkB,GAAG,SAAS,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,oCAAoC,CAAC,CAAA,uGAAA;AAAA,GAEvC;AACF;AAYO,SAAS,cAAc,GAAA,EAAuB;AACnD,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,SAAA,GAAY,CAAA,CAAA,EAAI,GAAA,CAAI,SAAS,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,CAAA,GAAK,GAAA,CAAI,IAAA;AACpE,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,EAAG,GAAA,CAAI,GAAA,GAAM,CAAA,CAAA,EAAI,GAAA,CAAI,GAAG,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAC5D;AASO,SAAS,cAAc,GAAA,EAA2B;AAEvD,EAAA,OAAO,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,IAAA,EAAM,IAAI,IAAA,EAAK;AAC1C;AAqLO,SAAS,kBAAkB,CAAA,EAAwC;AACxE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,IACzB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,OAAO,CAAA;AAAA,IAC9B,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,IACzB,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,MAAM,CAAA;AAAA,IACjC,UAAU,CAAA,CAAE,QAAA,IAAY,OAAO,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA,GAAI;AAAA,GACtD;AACF;AAUO,SAAS,gBAAgB,CAAA,EAAwC;AACtE,EAAA,MAAM,CAAA,GAA6B;AAAA,IACjC,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,MAAM,CAAA,CAAE;AAAA,GACV;AACA,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,MAAA,EAAQ,CAAA,CAAE,SAAS,CAAA,CAAE,MAAA;AACtC,EAAA,IAAI,CAAA,CAAE,QAAA,IAAY,IAAA,EAAM,CAAA,CAAE,WAAW,CAAA,CAAE,QAAA;AACvC,EAAA,OAAO,CAAA;AACT","file":"chunk-A5EDMBFG.js","sourcesContent":["/**\n * Pure data models — no I/O, no side effects.\n */\n\nimport semver from \"semver\";\n\n/**\n * Discriminator for catalog entries and asset references.\n * Used in asset ref strings (e.g. `'skill:my-skill'`, `'agent:my-agent'`).\n * @docLink packages/core/concepts#asset-kind\n */\nexport type AssetKind =\n  | \"skill\"\n  | \"agent\"\n  | \"prompt\"\n  | \"bundle\"\n  | \"flow\"\n  | \"contract\"\n  | \"mcp-server\"\n  | \"persona\" // identity fragment — replaces SOUL.md in composition\n  | \"ruleset\" // behavioral constraints — replaces RULES.md in composition\n  | \"knowledge\" // knowledge bundle directory\n  | \"connector\"; // connector descriptor (CONNECTOR.md)\n\n/**\n * All valid AssetKind values as a readonly array.\n * @docLink packages/core/concepts#asset-kinds\n */\nexport const ASSET_KINDS: readonly AssetKind[] = [\n  \"skill\",\n  \"agent\",\n  \"prompt\",\n  \"bundle\",\n  \"flow\",\n  \"contract\",\n  \"mcp-server\",\n  \"persona\",\n  \"ruleset\",\n  \"knowledge\",\n  \"connector\",\n];\n/**\n * Asset kinds that represent individually installable assets (excludes \"bundle\").\n * Note: persona, ruleset, and knowledge are valid AssetKind values but are not\n * individually installable — they are resolved at session creation time via the\n * mixin-resolver, not through the install/deploy pipeline.\n * @docLink packages/core/concepts#individual-kinds\n */\nexport const INDIVIDUAL_KINDS = [\n  \"skill\",\n  \"agent\",\n  \"prompt\",\n  \"flow\",\n  \"contract\",\n  \"mcp-server\",\n] as const satisfies AssetKind[];\n\n// ── Dependency ────────────────────────────────────────────────────────────────\n\n/**\n * Declared dependency on another catalog asset.\n * @docLink packages/core/concepts#dependency\n */\nexport interface Dependency {\n  /** Asset kind (e.g. \"skill\", \"agent\", \"contract\"). */\n  kind: string;\n  /** Asset name within that kind. */\n  name: string;\n  /** Canonical publisher namespace (when known). */\n  publisher?: string;\n}\n\n/**\n * Parse a `\"kind:name\"` dependency string, or a bare `\"name\"` (defaults kind to `\"skill\"`).\n *\n * @param s - Dependency string, e.g. `\"skill:use-exa\"` or `\"use-exa\"`\n * @returns Parsed `{ kind, name }` dependency object\n * @docLink packages/core/concepts#parse-dep\n */\nexport function parseDep(s: string): Dependency {\n  const i = s.indexOf(\":\");\n  if (i !== -1) {\n    const kind = s.slice(0, i).trim();\n    const name = s.slice(i + 1).trim();\n    return { kind, name };\n  }\n  return { kind: \"skill\", name: s.trim() };\n}\n\n/**\n * Serialize a Dependency back to its `\"kind:name\"` string form.\n *\n * @param d - Dependency to serialize\n * @returns String in `\"kind:name\"` format\n * @docLink packages/core/concepts#dep-to-str\n */\nexport function depToStr(d: Dependency): string {\n  return `${d.kind}:${d.name}`;\n}\n\n// ── CatalogEntry ──────────────────────────────────────────────────────────────\n\n/**\n * A resolved catalog entry describing an installable asset.\n * Produced by manifest parsers and stored in the catalog YAML.\n * @docLink packages/core/concepts#catalog-entry\n */\nexport interface CatalogEntry {\n  /** Unique asset name within its kind. */\n  name: string;\n  /** Asset kind discriminator. */\n  kind: AssetKind;\n  /** Short description of what this asset does. */\n  description: string;\n  /** Absolute path to manifest file */\n  source: string;\n  /** Canonical publisher namespace this asset belongs to (formerly `repository`). */\n  publisher?: string;\n  /**\n   * `\"<org>/<repo>\"` coordinate the asset came from. Absent → the asset groups\n   * directly under its publisher (local library with no git remote, or a\n   * non-GitHub source). Replaces the former derived `domain` axis.\n   */\n  repo?: string;\n  /**\n   * Navigational domain slug (from a sidecar `DOMAIN.md`), or absent when no\n   * domain claims this asset. Display-only — groups assets under their publisher\n   * in the manage TUI; never part of identity or the install layout.\n   */\n  domainSlug?: string;\n  /** Semantic version string (may be empty if not declared in the manifest). */\n  version: string;\n  /** Skills, agents, or other assets this entry depends on. */\n  requires: Dependency[];\n  /** Bundle dependencies — asset refs to install (bundles only). */\n  dependencies: string[];\n  /**\n   * Kind-specific metadata extracted from the manifest frontmatter.\n   * Used by MCP servers to carry default config (transport, command, args, env, url, headers)\n   * so that `mcp:name` dependency refs resolve to a runnable declaration without\n   * requiring verbose inline config in `skaile.yaml`.\n   */\n  metadata?: Record<string, unknown>;\n  /** Curated facet, surfaced as a badge in the manage TUI (not a tree axis). */\n  category?: string;\n  /** Store-listing keywords (manifest `assets[].keywords`, else frontmatter). */\n  keywords?: string[];\n  /** Store-listing license (manifest `assets[].license`, else repo-level default). */\n  license?: string;\n  /** Store-listing homepage (manifest `assets[].homepage`, else repo-level default). */\n  homepage?: string;\n}\n\n/**\n * How the members of a domain relate — drives display affordances only, never\n * install behaviour. Single canonical spelling shared with the store\n * (`DomainRelation` enum) and forge contract.\n */\nexport type DomainRelation = \"additions\" | \"alternatives\" | \"sequence\";\n\n/**\n * Display-only metadata for a navigational domain (from a sidecar `DOMAIN.md`,\n * surfaced by the store's `catalog.listDomains`). Keyed by {@link CatalogEntry.domainSlug}.\n * A domain groups assets under their publisher for co-discovery; it is never\n * part of asset identity and never bulk-installs.\n */\nexport interface CatalogDomain {\n  /** Stable slug — the join key to {@link CatalogEntry.domainSlug}. */\n  slug: string;\n  /** Human-readable title (may change without breaking the slug join). */\n  title: string;\n  /** Free-text description from the `DOMAIN.md` body. */\n  description?: string;\n  /** How members relate — drives sort + per-asset glyph, not installs. */\n  relation?: DomainRelation;\n  /** Display order among a publisher's domains (ascending). */\n  order?: number;\n  /** `kind:name` ref of the recommended member (alternatives domains). */\n  recommendedRef?: string;\n  /** Sidecar provenance — `\"<org>/<repo>\"` the `DOMAIN.md` was authored in. */\n  sidecarSource?: string;\n}\n\n/**\n * Construct a CatalogEntry from a raw deserialized record (e.g. from catalog.yaml).\n *\n * @param d - Raw object with loosely typed fields\n * @returns Normalized CatalogEntry\n * @docLink packages/core/concepts#entry-from-raw\n */\nexport function entryFromRaw(d: Record<string, unknown>): CatalogEntry {\n  const rawDeps = d.dependencies;\n  const deps = Array.isArray(rawDeps) ? (rawDeps as string[]).filter(Boolean) : [];\n  const entry: CatalogEntry = {\n    name: String(d.name ?? \"\"),\n    kind: String(d.kind ?? \"skill\") as AssetKind,\n    description: String(d.description ?? \"\"),\n    source: String(d.source ?? \"\"),\n    publisher: d.publisher != null ? String(d.publisher) : undefined,\n    // Read `repo`, falling back to the legacy `domain` key so a stale\n    // catalog.yaml cache written before this release still groups sanely.\n    // The cache self-heals on next write (entryToRaw stops writing `domain`).\n    repo: d.repo != null ? String(d.repo) : d.domain != null ? String(d.domain) : undefined,\n    domainSlug: d.domainSlug != null ? String(d.domainSlug) : undefined,\n    version: String(d.version ?? \"\"),\n    requires: Array.isArray(d.requires)\n      ? (d.requires as string[]).filter(Boolean).map(parseDep)\n      : [],\n    dependencies: deps,\n  };\n  if (d.metadata != null && typeof d.metadata === \"object\" && !Array.isArray(d.metadata)) {\n    entry.metadata = d.metadata as Record<string, unknown>;\n  }\n  if (d.category != null) entry.category = String(d.category);\n  if (Array.isArray(d.keywords)) {\n    entry.keywords = (d.keywords as unknown[]).filter((k): k is string => typeof k === \"string\");\n  }\n  if (d.license != null) entry.license = String(d.license);\n  if (d.homepage != null) entry.homepage = String(d.homepage);\n  return entry;\n}\n\n/**\n * Serialize a CatalogEntry to a plain record suitable for YAML/JSON persistence.\n *\n * @param e - CatalogEntry to serialize\n * @returns Plain object with string-serialized requires and dependencies\n * @docLink packages/core/concepts#entry-to-raw\n */\nexport function entryToRaw(e: CatalogEntry): Record<string, unknown> {\n  const raw: Record<string, unknown> = {\n    name: e.name,\n    kind: e.kind,\n    description: e.description,\n    source: e.source,\n    publisher: e.publisher,\n    repo: e.repo,\n    version: e.version,\n    ...(e.domainSlug != null ? { domainSlug: e.domainSlug } : {}),\n    requires: e.requires.map(depToStr),\n    dependencies: e.dependencies,\n  };\n  if (e.metadata) raw.metadata = e.metadata;\n  if (e.category != null) raw.category = e.category;\n  if (e.keywords && e.keywords.length > 0) raw.keywords = e.keywords;\n  if (e.license != null) raw.license = e.license;\n  if (e.homepage != null) raw.homepage = e.homepage;\n  return raw;\n}\n\n// ── AssetRef ─────────────────────────────────────────────────────────────────\n\n/**\n * A parsed asset reference: `kind:@<publisher>/name[#pin]`.\n *\n * `publisher` is the canonical, GitHub-shaped publisher namespace (≤39 chars,\n * alphanumeric+hyphen). `pin` is a SemVer constraint, exact SHA, or absent.\n * Floating refs (`main`, `latest`, `HEAD`) are rejected at parse time.\n *\n * Produced by `parseAssetRef`; consumed by `resolveAsset` and `resolveAll`.\n * @docLink packages/core/concepts#asset-ref\n */\nexport interface AssetRef {\n  kind: string;\n  name: string;\n  /** Canonical publisher namespace. Optional only for ambiguity-resolution\n   *  during migration; new manifests require it. */\n  publisher?: string;\n  /** SemVer constraint (^1.4.0, ~1.4, 1.x, exact 1.4.0), 40-char SHA, or undefined. */\n  pin?: string;\n}\n\nconst SHA_RE = /^[0-9a-f]{40}$/i;\n\n// Scoped grammar: `kind:@publisher/name[#version]`. The publisher sub-pattern is\n// GitHub-shaped (1-39 chars, alphanumeric + single hyphens, no leading/trailing or\n// double hyphen); `@` is the scope sigil and `#` the version sigil. `name` is\n// intentionally permissive (`[^/#\\s]+` — only the structural separators are\n// forbidden); floating-ref rejection stays in `isValidPin`, so `#main`/`#latest`\n// match here and fail there with a clear message.\nconst SCOPED_REF_RE =\n  /^(?:([a-z][a-z0-9-]*):)?@([A-Za-z0-9](?:[A-Za-z0-9]|-(?!-)){0,37}[A-Za-z0-9]|[A-Za-z0-9])\\/([^/#\\s]+)(?:#(.+))?$/;\n\n// Canonical asset-name grammar: lowercase kebab-case (npm-style, scope-free) —\n// `a-z` / `0-9` segments joined by single hyphens, no leading/trailing hyphen,\n// no uppercase, spaces, dots, or underscores. Names become directory names,\n// lock keys, and CLI args, so the constraint is intentionally narrow.\nconst ASSET_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\n// Diagnostic-only matcher: a ref carrying a `kind:@publisher/` scope prefix,\n// capturing whatever follows (sans `#pin`) as the candidate name. Used solely\n// to tell \"missing publisher\" apart from \"malformed name\" when the strict\n// grammar above fails (e.g. a space in the name).\nconst SCOPE_PREFIX_RE = /^(?:[a-z][a-z0-9-]*:)?@[^/\\s]+\\/([^#]+?)(?:#.*)?$/;\n\n/** Human-readable statement of the canonical asset-name rule. */\nexport const ASSET_NAME_HINT =\n  'names must be lowercase kebab-case (a-z, 0-9, single hyphens; e.g. \"cli-concept\")';\n\n/**\n * True when `name` is a canonical asset name: lowercase kebab-case, scope-free.\n *\n * This is the single source of truth for asset-name validity — `parseAssetRef`\n * enforces it, and `skaile validate` reports violations across a repo tree.\n * @docLink packages/core/concepts#is-valid-asset-name\n */\nexport function isValidAssetName(name: string): boolean {\n  return ASSET_NAME_RE.test(name);\n}\n\n/**\n * Coerce an arbitrary string into a canonical asset name (lowercase kebab-case).\n *\n * For **third-party sources we don't control**, an upstream asset may carry a\n * human-styled identity (`\"Complex App\"`, `\"CLI_Concept\"`). The canonical grammar\n * (`isValidAssetName`) rejects those, so the ingestion boundary slugifies them to\n * a valid identity rather than crashing: Unicode is folded to ASCII, the result is\n * lowercased, every run of non-`[a-z0-9]` becomes a single hyphen, and\n * leading/trailing hyphens are trimmed. The transform is idempotent and a no-op on\n * already-canonical names.\n *\n * This is intentionally **lossy** — the pretty original is not part of identity.\n * Callers that want to preserve it for display must stash it themselves (e.g. on\n * `CatalogEntry.metadata.displayName`). Authoring-time validation (`skaile validate`)\n * still uses `isValidAssetName` on raw frontmatter, so first-party typos surface there.\n *\n * @throws When `raw` contains no `[a-z0-9]` character (nothing to slugify).\n * @docLink packages/core/concepts#slugify-asset-name\n */\nexport function slugifyAssetName(raw: string): string {\n  const slug = raw\n    .normalize(\"NFKD\")\n    .replace(/[\\u0300-\\u036f]/g, \"\") // strip combining accents\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  if (!slug) {\n    throw new Error(`cannot derive a canonical asset name from \"${raw}\" — ${ASSET_NAME_HINT}.`);\n  }\n  return slug;\n}\n\n/** True when `pin` is a SemVer constraint, exact SemVer, or 40-char SHA. */\nfunction isValidPin(pin: string): boolean {\n  if (SHA_RE.test(pin)) return true;\n  if (semver.valid(pin)) return true;\n  if (semver.validRange(pin)) return true;\n  return false;\n}\n\n/** Throw the canonical non-canonical-pin error for a ref `s` carrying `pin`. */\nfunction rejectFloatingPin(s: string, pin: string): never {\n  throw new Error(\n    `non-canonical pin \"${pin}\" in \"${s}\" — pin must be a SemVer ` +\n      \"constraint (1.4.0, ^1.4, ~1.4, 1.x), a 40-char SHA, or absent. \" +\n      \"Floating refs (main/latest/HEAD) are not allowed.\",\n  );\n}\n\n/** Throw the canonical malformed-name error for a ref `s` carrying `name`. */\nfunction rejectInvalidName(s: string, name: string): never {\n  throw new Error(\n    `invalid asset name \"${name}\" in ref \"${s}\" — ${ASSET_NAME_HINT}. ` +\n      \"Run the `migrate-skaile-manifest` skill on legacy manifests.\",\n  );\n}\n\n/**\n * Parse a canonical asset reference string into an `AssetRef` object.\n *\n * Grammar: `kind:@<publisher>/name[#version]`\n *   \"skill:@skaile-ai/audit\"          → { kind: \"skill\", name: \"audit\", publisher: \"skaile-ai\" }\n *   \"skill:@skaile-ai/audit#^1.4.0\"   → { …, pin: \"^1.4.0\" }\n *   \"skill:@skaile-ai/audit#<40-sha>\" → { …, pin: \"<40-sha>\" }\n *\n * `@` is the scope sigil and `#` the version sigil. `<publisher>` is GitHub-shaped\n * (≤39 chars, alphanumeric+hyphen, no leading/trailing or double hyphen). `pin`\n * accepts a SemVer constraint (`^`, `~`, `x`, exact), a 40-char SHA, or is absent.\n * Floating refs (`main`/`latest`/`HEAD`/anything non-canonical) are parse-time errors.\n *\n * The shorthand `mcp:` is normalized to `mcp-server:`. `kind` defaults to `\"skill\"`.\n *\n * @param s - Asset reference string\n * @returns Parsed `AssetRef`\n * @throws When the ref matches no grammar, the publisher is malformed, or the pin\n *   is a floating ref.\n * @docLink packages/core/concepts#parse-asset-ref\n */\nexport function parseAssetRef(s: string): AssetRef {\n  const trimmed = s.trim();\n  const m = SCOPED_REF_RE.exec(trimmed);\n  if (m) {\n    const kindRaw = m[1] ?? \"skill\";\n    const kind = kindRaw === \"mcp\" ? \"mcp-server\" : kindRaw;\n    const publisher = m[2];\n    const name = m[3];\n    const pin = m[4]?.trim() || undefined;\n    if (!isValidAssetName(name)) rejectInvalidName(s, name);\n    if (pin !== undefined && !isValidPin(pin)) rejectFloatingPin(s, pin);\n    return { kind, name, publisher, pin };\n  }\n\n  // The strict grammar failed. If the ref nonetheless carries a `@publisher/`\n  // scope and the fault is the name (e.g. an embedded space), surface a\n  // name-specific error rather than the misleading \"publisher required\" — the\n  // publisher is plainly present. A *valid* captured name means the publisher\n  // itself is malformed, so fall through to the publisher error below.\n  const scoped = SCOPE_PREFIX_RE.exec(trimmed);\n  if (scoped) {\n    const candidate = scoped[1].trim();\n    if (!isValidAssetName(candidate)) rejectInvalidName(s, candidate);\n  }\n\n  throw new Error(\n    `publisher required in asset ref \"${s}\" — use \\`kind:@<publisher>/name\\`. ` +\n      \"Run the `migrate-skaile-manifest` skill on legacy manifests.\",\n  );\n}\n\n/**\n * Serialize an AssetRef back to its canonical string form.\n *\n * Emits the scope form `kind:@publisher/name[#pin]` when `publisher` is present,\n * and the bare `kind:name[#pin]` form for transitive refs that inherit it.\n *\n * @param ref - AssetRef to serialize\n * @returns String in `\"kind:@publisher/name[#pin]\"` (or bare `\"kind:name[#pin]\"`) format\n * @docLink packages/core/concepts#asset-ref-to-str\n */\nexport function assetRefToStr(ref: AssetRef): string {\n  const scope = ref.publisher ? `@${ref.publisher}/${ref.name}` : ref.name;\n  return `${ref.kind}:${scope}${ref.pin ? `#${ref.pin}` : \"\"}`;\n}\n\n/**\n * Convert an AssetRef to a simple Dependency, dropping the repository and pin qualifiers.\n *\n * @param ref - Full asset reference (may include repository and pin)\n * @returns Dependency with only kind and name\n * @docLink packages/core/concepts#asset-ref-to-dep\n */\nexport function assetRefToDep(ref: AssetRef): Dependency {\n  // Grammar-agnostic — drops publisher/pin, so the scope-sigil change doesn't touch it.\n  return { kind: ref.kind, name: ref.name };\n}\n\n// ── Lock File ────────────────────────────────────────────────────────────────\n\n/** A path/sha256 pair recorded for one file inside a locked asset. */\nexport interface LockFileEntry {\n  path: string;\n  sha256: string;\n}\n\n/**\n * Library-origin marker on a {@link LockEntry}: the asset was resolved from a\n * registered library (a local authoring place) rather than a git source/store.\n */\nexport interface LockLibraryOrigin {\n  /** Name of the library the asset was resolved from. */\n  name: string;\n  /** Library version of the asset at lock time. */\n  version: string;\n  /** Content hash recorded in the library index at lock time; absent when the library was never indexed. */\n  sha256?: string;\n}\n\n/**\n * Per-asset entry in the lock file (v3 schema).\n * Keyed in `LockFile.assets` by canonical ref (`<kind>:@<publisher>/<name>#<version>`).\n * Source-origin entries carry `source` + `files`; library-origin entries carry\n * `library` instead (no `source`, empty `files`). Both fields are additive, so\n * lock files written before library origin existed still load unchanged.\n * @docLink packages/core/api-reference#lock-entry\n */\nexport interface LockEntry {\n  /** Composite sha256 over sorted `<path>:<sha256>\\n` rows (library-origin: the library's hash, `\"\"` when unknown). */\n  sha256: string;\n  /** Resolved upstream source + commit. Absent for library-origin entries. */\n  source?: { url: string; commit: string };\n  /** Files that constitute the asset. Empty for library-origin entries. */\n  files: LockFileEntry[];\n  /** True when an `overrides[]` entry pinned this resolution. */\n  override_applied: boolean;\n  /** Set when the asset was resolved from a registered library. */\n  library?: LockLibraryOrigin;\n}\n\n/** Per-source-URL entry in `LockFile.sources`. */\nexport interface LockSourceEntry {\n  url: string;\n  commit: string;\n}\n\n/**\n * Full skaile.lock.yaml structure (v3 schema).\n * @docLink packages/core/api-reference#lock-file\n */\nexport interface LockFile {\n  /**\n   * Lock file schema version: 3, or 4 when the lock holds a library-origin\n   * entry (no `source`), so CLIs that predate library origin reject it cleanly.\n   */\n  schema_version: 3 | 4;\n  /** ISO timestamp of when the lock was generated. */\n  locked_at: string;\n  /** Resolved assets keyed by canonical ref `<kind>:@<publisher>/<name>#<version>`. */\n  assets: Record<string, LockEntry>;\n  /** Every source URL that contributed at least one resolved asset. */\n  sources: LockSourceEntry[];\n  /**\n   * Resolved plugin packages (from `skaile.yaml` `plugins:`), keyed by package\n   * name. The plugin-store reconciler reads this slice into its reconcile-hash\n   * so a lock change reinstalls even when the manifest list is unchanged.\n   */\n  plugins?: Record<string, LockPluginEntry>;\n}\n\n/** One pinned plugin package in the lock file's `plugins` slice. */\nexport interface LockPluginEntry {\n  /** Resolved exact version (e.g. \"0.1.3\"). */\n  version: string;\n  /** Package integrity hash (e.g. \"sha512-...\"); may be empty until populated from bun's output. */\n  integrity: string;\n}\n\n// ── AgentManifest ────────────────────────────────────────────────────────────\n\n/**\n * Agent package manifest — parsed from `agent.yaml` in an agent directory.\n * Defines the agent's identity, model preferences, capability requirements, and composition mixins.\n * @docLink packages/core/concepts#agent-manifest\n */\nexport interface AgentManifest {\n  spec_version?: string;\n  name?: string;\n  version?: string;\n  description?: string;\n  model?: {\n    preferred?: string;\n    fallback?: string[];\n    constraints?: { temperature?: number; max_tokens?: number };\n  };\n  tools?: {\n    allowed?: string[];\n    denied?: string[];\n  };\n  delegation?: { mode?: string };\n  requires?: Array<{ name: string; source: string; version?: string; mount: string }>;\n  tags?: string[];\n  author?: string;\n  metadata?: Record<string, unknown>;\n  /**\n   * @deprecated Use `persona`, `rules`, and `knowledge` mixin arrays instead.\n   * This field is declared but was never resolved at runtime.\n   */\n  extends?: string;\n  abilities?: string[];\n  /**\n   * Identity fragments to compose into the agent persona.\n   * Each entry is a catalog ref (`persona:name@repo#pin`), a bare name\n   * (defaults to kind \"persona\"), or a local path (`./my.persona.md`).\n   * Resolved in order — concatenated with \\n\\n---\\n\\n separator.\n   */\n  persona?: string[];\n  /**\n   * Behavioral rule sets to compose into the agent's constraints.\n   * Each entry is a catalog ref (`ruleset:name@repo#pin`), bare name,\n   * or local path. All rules apply (union).\n   */\n  rules?: string[];\n  /**\n   * Knowledge bundles to compose into the agent's domain knowledge.\n   * Each entry is a catalog ref (`knowledge:name@repo#pin`), bare name,\n   * or local path to a knowledge directory. Loaded in declaration order.\n   */\n  knowledge?: string[];\n  contracts?: string[];\n  /**\n   * v2 composition items. Each entry references an asset (skill, connector,\n   * soul, ruleset, etc.) with binding semantics (discoverable, inline-live,\n   * inline-snapshot). Resolved at session start via the composition module.\n   */\n  composes?: Array<{\n    kind: string;\n    ref: string;\n    instance?: string;\n    binding?: \"discoverable\" | \"inline-live\" | \"inline-snapshot\";\n  }>;\n  runtime?: {\n    max_turns?: number;\n    timeout?: number;\n    [key: string]: unknown;\n  };\n}\n\n// ── Repository ───────────────────────────────────────────────────────────────\n\ntype RepositoryKind = \"local\" | \"github\";\n\n/**\n * A registered asset repository (local path or cloned GitHub repo).\n * Stored in the catalog; consumed by `repo-manager` for cloning and scanning.\n * @docLink packages/core/concepts#repository\n */\nexport interface Repository {\n  /** Logical repository name. */\n  name: string;\n  /** Storage kind: \"local\" for paths, \"github\" for remote URLs. */\n  kind: RepositoryKind;\n  /** Absolute path (local) or remote URL (github). */\n  path: string;\n  /** Active branch. */\n  branch: string;\n  /** Upstream fork URL (for fork-based workflows). */\n  upstream?: string;\n}\n\n/**\n * Construct a `Repository` from a raw deserialized record.\n *\n * @param d - Raw object from YAML/JSON\n * @returns Normalized `Repository`\n * @docLink packages/core/concepts#repository-from-raw\n */\nexport function repositoryFromRaw(d: Record<string, unknown>): Repository {\n  return {\n    name: String(d.name ?? \"\"),\n    kind: String(d.kind ?? \"local\") as RepositoryKind,\n    path: String(d.path ?? \"\"),\n    branch: String(d.branch ?? \"main\"),\n    upstream: d.upstream != null ? String(d.upstream) : undefined,\n  };\n}\n\n/**\n * Serialize a `Repository` to a plain record for YAML/JSON persistence.\n * Omits the `branch` field when it equals `\"main\"` to keep serialized output clean.\n *\n * @param r - Repository to serialize\n * @returns Plain object suitable for YAML/JSON\n * @docLink packages/core/concepts#repository-to-raw\n */\nexport function repositoryToRaw(r: Repository): Record<string, unknown> {\n  const d: Record<string, unknown> = {\n    name: r.name,\n    kind: r.kind,\n    path: r.path,\n  };\n  if (r.branch !== \"main\") d.branch = r.branch;\n  if (r.upstream != null) d.upstream = r.upstream;\n  return d;\n}\n"]}

package/dist/chunk-CACCIOQL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../cli/src/commands/source-manifest.ts","../cli/src/commands/source.ts"],"names":["path2","existsSync","spawnSync"],"mappings":";;;;;;;;;;;;;;AA+CA,IAAM,aAAA,GACJ,2IAAA;AAGF,SAAS,SAAS,IAAA,EAAqB;AACrC,EAAA,MAAA,CAAO,CAAA,EAAG,aAAa,CAAA,wBAAA,EAA2B,IAAI,CAAA,CAAA,CAAG,CAAA;AACzD,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB;AAkBO,SAAS,gBAAA,CACd,KACA,UAAA,EACmE;AACnE,EAAA,MAAM,IAAA,GAAO,kBAAkB,UAAU,CAAA;AACzC,EAAA,MAAM,UAAA,GAA4B,OAC9B,kBAAA,CAAwB,IAAA,CAAA,IAAA,CAAK,MAAM,uBAAA,EAAyB,CAAC,CAAA,GAC7D,EAAC;AACL,EAAA,MAAM,KAAA,GAAQ,WAAW,IAAA,CAAK,CAAC,MAAM,gBAAA,CAAiB,CAAA,EAAG,GAAG,CAAC,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,CAAC,KAAA,GAAQ,kBAAA,CAAmB,GAAG,CAAA,GAAI,MAAA;AAClD,EAAA,MAAM,MAAM,KAAA,GAAQ,KAAA,CAAM,MAAO,MAAA,EAAQ,GAAA,IAAO,mBAAmB,GAAG,CAAA;AACtE,EAAA,MAAM,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAChC,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,GAAG,CAAC,CAAA;AAChD,EAAA,OAAO,EAAE,KAAK,IAAA,EAAM,IAAA,EAAM,cAAc,MAAA,EAAQ,YAAA,IAAgB,iBAAA,CAAkB,GAAG,CAAA,EAAE;AACzF;AAQA,SAAS,mBAAmB,GAAA,EAAgE;AAG1F,EAAA,IAAI,CAAC,oBAAoB,IAAA,CAAK,GAAG,KAAK,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG,OAAO,MAAA;AACjE,EAAA,MAAM,eAAoB,IAAA,CAAA,IAAA,CAAK,oBAAA,EAAqB,EAAG,CAAA,EAAG,GAAG,CAAA,KAAA,CAAO,CAAA;AACpE,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG,OAAO,MAAA;AAItC,EAAA,MAAM,CAAC,IAAA,EAAM,KAAA,EAAO,IAAI,CAAA,GAAI,GAAA,CAAI,MAAM,IAAI,CAAA;AAC1C,EAAA,MAAM,GAAA,GAAM,IAAA,IAAQ,KAAA,IAAS,IAAA,GAAO,CAAA,QAAA,EAAW,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,GAAA;AACzE,EAAA,OAAO,EAAE,KAAK,YAAA,EAAa;AAC7B;AAOA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAY,UAAK,oBAAA,EAAqB,EAAG,GAAG,iBAAA,CAAkB,GAAG,CAAC,CAAA,KAAA,CAAO,CAAA;AAC3E;AASA,IAAM,qBAAA,uBAA4B,GAAA,CAAI;AAAA,EACpC,OAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC,CAAA;AASD,SAAS,mBAAmB,YAAA,EAA+B;AACzD,EAAA,MAAM,WAAW,YAAA,CAAa,OAAA,CAAQ,OAAO,GAAG,CAAA,CAAE,MAAM,GAAG,CAAA;AAC3D,EAAA,OAAO,SAAS,IAAA,CAAK,CAAC,MAAM,qBAAA,CAAsB,GAAA,CAAI,CAAC,CAAC,CAAA;AAC1D;AAMA,eAAe,OAAA,CACb,KACA,IAAA,EACe;AACf,EAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,EAAE,KAAK,IAAA,EAAM,YAAA,EAAc,QAAO,GAAI,gBAAA,CAAiB,KAAK,UAAU,CAAA;AAE5E,EAAA,IAAI,UAAA,CAAW,MAAM,CAAA,IAAK,CAAC,KAAK,KAAA,EAAO;AACrC,IAAA,OAAA;AAAA,MACE,CAAA,qCAAA,EAAwC,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,2JAAA;AAAA,KAGvD;AACA,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAqB,EAAE,GAAA,EAAI;AACjC,EAAA,WAAA,CAAY,KAAK,CAAA;AAEjB,EAAA,MAAM,EAAE,QAAQ,MAAA,EAAO,GAAI,wBAAwB,IAAA,EAAM,IAAA,CAAK,OAAO,KAAK,CAAA;AAE1E,EAAA,MAAM,YAAY,IAAA,CAAK,SAAA,IAAa,uBAAuB,IAAI,CAAA,IAAK,gBAAgB,GAAG,CAAA;AAEvF,EAAA,MAAM,UAAU,oBAAA,CAAqB;AAAA,IACnC,YAAA,EAAc,MAAA;AAAA,IACd,SAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAO,IAAA,CAAK,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKZ,gBAAA,EAAkB;AAAA,GACnB,CAAA;AAED,EAAA,IAAI,CAAC,QAAQ,KAAA,EAAO;AAClB,IAAA,OAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,oDAAA;AAAA,KAErD;AACA,IAAA;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,CAAA,4BAAA,EAA+B,QAAQ,UAAU,CAAA,WAAA,EAAc,EAAE,GAAA,CAAI,MAAM,CAAC,CAAA,CAAA,CAAG,CAAA;AAKrF,EAAA,OAAA;AAAA,IACE,CAAA,2CAAA,EAA8C,GAAG,CAAA,6BAAA,EACxB,GAAG,CAAA,iBAAA;AAAA,GAC9B;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,OAAA,CAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iEAAA,CAA8D,CAAA;AAAA,EACxF;AACF;AAOA,SAAS,uBAAA,CACP,MACA,UAAA,EACiF;AACjF,EAAA,MAAM,MAAA,GAAS,qBAAqB,IAAA,EAAM;AAAA,IACxC,UAAU,kBAAA,EAAmB;AAAA,IAC7B;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAM,CAAC,kBAAA,CAAmB,CAAA,CAAE,YAAY,CAAC,CAAA;AAC9E,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,CAAO,OAAO,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,KAAK,EAAE,CAAA,EAAE;AAC7E;AAOA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,KAAA,EAAO,CAAC,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,WAAW,CAAA,EAAG,EAAE,KAAA,EAAO,MAAA,EAAQ,CAAA;AACjF,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,OAAA;AAAA,MACE;AAAA,KAEF;AAAA,EACF;AACF;AAQA,SAAS,aAAa,KAAA,EAA2B;AAC/C,EAAA,IAAI,KAAA,CAAM,IAAA,EAAM,OAAO,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACxE,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,CAAC,CAAA,KAAM,QAAA,GAAW,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA;AACjE,IAAA,MAAM,MAAW,IAAA,CAAA,KAAA,CAAM,OAAA,CAAQ,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAC,CAAA;AACxD,IAAA,OAAO,GAAA,KAAQ,GAAA,GAAM,KAAA,CAAM,IAAA,GAAO,GAAA;AAAA,EACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA;AACf;AAGA,SAAS,kBAAkB,YAAA,EAA8B;AACvD,EAAA,MAAM,MAAW,IAAA,CAAA,KAAA,CAAM,OAAA,CAAQ,aAAa,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAC,CAAA;AAC/D,EAAA,OAAO,GAAA,KAAQ,MAAW,IAAA,CAAA,KAAA,CAAM,QAAA,CAAS,aAAa,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAC,CAAA,GAAI,GAAA;AAC/E;AAGA,SAAS,SAAS,KAAA,EAA2B;AAC3C,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AACpC;AAgBA,eAAe,UAAA,CACb,KACA,IAAA,EACe;AACf,EAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,EAAE,KAAK,IAAA,EAAM,IAAA,EAAM,cAAc,MAAA,EAAO,GAAI,gBAAA,CAAiB,GAAA,EAAK,UAAU,CAAA;AAElF,EAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG;AACvB,IAAA,MAAA;AAAA,MACE,4BAA4B,IAAI,CAAA,KAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,kDAAA;AAAA,KAEvD;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,MAAM,KAAA,GAAqB,EAAE,GAAA,EAAI;AACjC,EAAA,MAAM,MAAA,GAAS,YAAY,KAAK,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,EAAQ,eAAA,CAAgB,IAAI,CAAA;AAEjC,EAAA,MAAM,EAAE,QAAQ,WAAA,EAAa,MAAA,KAAW,uBAAA,CAAwB,IAAA,EAAM,IAAA,CAAK,GAAA,IAAO,KAAK,CAAA;AAEvF,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,OAAA;AAAA,MACE;AAAA,KAEF;AACA,IAAA,MAAM,YAAY,IAAA,CAAK,SAAA,IAAa,uBAAuB,IAAI,CAAA,IAAK,gBAAgB,GAAG,CAAA;AACvF,IAAA,MAAM,UAAU,oBAAA,CAAqB;AAAA,MACnC,YAAA,EAAc,MAAA;AAAA,MACd,SAAA;AAAA,MACA,MAAA,EAAQ,WAAA;AAAA,MACR,KAAA,EAAO,IAAA;AAAA,MACP,gBAAA,EAAkB;AAAA,KACnB,CAAA;AACD,IAAA,KAAA;AAAA,MACE,iCAAiC,OAAA,CAAQ,UAAU,cAAc,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,aAAA;AAAA,KAChF;AACA,IAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,MAAA,OAAA,CAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iEAAA,CAA8D,CAAA;AAAA,IACxF;AACA,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,OAAA;AAAA,MACE;AAAA,KAEF;AAAA,EACF;AAGA,EAAA,MAAM,EAAE,UAAU,QAAA,EAAS,GAAI,qBAAqB,YAAA,CAAa,MAAA,EAAQ,OAAO,CAAC,CAAA;AACjF,EAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,MAAA,IAAU,EAAC;AAG5C,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAA0C;AAClE,EAAA,KAAA,MAAW,CAAA,IAAK,aAAa,WAAA,CAAY,GAAA,CAAI,kBAAkB,CAAA,CAAE,YAAY,GAAG,CAAC,CAAA;AAEjF,EAAA,MAAM,OAAqB,EAAC;AAC5B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,KAAK,eAAA,EAAiB;AAC/B,IAAA,IAAI,WAAA,CAAY,IAAI,YAAA,CAAa,CAAC,CAAC,CAAA,EAAG,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,SAC5C,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,CAAA;AAAA,EAC/B;AAGA,EAAA,MAAM,gBAAgB,IAAI,GAAA,CAAI,eAAA,CAAgB,GAAA,CAAI,YAAY,CAAC,CAAA;AAC/D,EAAA,MAAM,iBAA2B,EAAC;AAClC,EAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,IAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,kBAAkB,CAAA,CAAE,YAAY,CAAC,CAAA,EAAG;AACzD,MAAA,cAAA,CAAe,KAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAAA,IAC3C;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,GAAS,CAAA;AACjC,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,OAAA,CAAQ,4BAA4B,OAAA,CAAQ,IAAA,GAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EACjE;AACA,EAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAC7B,IAAA,OAAA;AAAA,MACE,CAAA,EAAG,cAAA,CAAe,MAAM,CAAA,8CAAA,EACnB,cAAA,CAAe,IAAA,EAAK,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,+CAAA,EAA6C,GAAG,CAAA,YAAA;AAAA,KACvF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,KAAA,CAAM,oBAAoB,CAAA;AAC1B,IAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,MAAA,OAAA,CAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,kEAAA,CAA+D,CAAA;AAAA,IACzF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAA4B,EAAE,GAAG,QAAA,EAAU,QAAQ,IAAA,EAAK;AAC9D,EAAA,aAAA,CAAc,MAAA,EAAQ,oBAAA,CAAqB,MAAM,CAAA,EAAG,OAAO,CAAA;AAC3D,EAAA,KAAA;AAAA,IACE,CAAA,+BAAA,EAAkC,IAAA,CAAK,MAAM,CAAA,UAAA,EAAa,OAAA,CAAQ,MAAM,CAAA,QAAA,EAAM,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,CAAA;AAAA,GAC7F;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,OAAA,CAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,kEAAA,CAA+D,CAAA;AAAA,EACzF;AACF;AAaA,eAAe,SAAA,CACb,KACA,IAAA,EACe;AACf,EAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,EAAE,KAAK,IAAA,EAAM,IAAA,EAAM,cAAc,MAAA,EAAO,GAAI,gBAAA,CAAiB,GAAA,EAAK,UAAU,CAAA;AAElF,EAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG;AACvB,IAAA,MAAA;AAAA,MACE,4BAA4B,IAAI,CAAA,KAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,kDAAA;AAAA,KAEvD;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,WAAA,CAAY,EAAE,KAAK,CAAA;AAEnB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,EAAQ,OAAO,CAAA;AACzC,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,qBAAqB,IAAI,CAAA;AAE3D,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,WAAqB,EAAC;AAG5B,EAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,IAAA,MAAM,OAAO,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,EAAE,OAAO,CAAA,CAAA;AACpC,IAAA,IAAI,CAAA,CAAE,QAAA,KAAa,OAAA,EAAS,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,SACvC,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,MAAA,IAAU,EAAC;AACnC,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,MAAM,GAAA,GAAM,SAAS,KAAK,CAAA;AAG1B,IAAA,MAAM,WAAqB,EAAC;AAC5B,IAAA,IAAI,KAAA,CAAM,IAAA,EAAM,QAAA,CAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AACxC,IAAA,IAAI,MAAM,KAAA,EAAO;AACf,MAAA,KAAA,MAAW,CAAA,IAAK,KAAA,CAAM,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,CAAA,CAAE,IAAI,CAAA;AAAA,IAC/E;AACA,IAAA,IAAI,SAAS,MAAA,KAAW,CAAA,EAAG,QAAA,CAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AACnD,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,IAAI,CAAC,UAAA,CAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,EAAM,GAAG,CAAC,CAAA,EAAG;AACrC,QAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,2BAAA,EAA8B,GAAG,CAAA,CAAE,CAAA;AAAA,MACvD;AAAA,IACF;AAUA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAI,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,SAAS,CAAA,EAAG;AACzC,QAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,GAAA;AAAA,UAAI,CAAC,CAAA,KAAA,CAChC,OAAO,CAAA,KAAM,QAAA,GAAW,IAAI,CAAA,CAAE,IAAA,EAAM,OAAA,CAAQ,KAAA,EAAO,GAAG;AAAA,SACzD;AACA,QAAA,MAAM,MAAA,GAAS,wBAAA,CAAyB,IAAA,EAAM,SAAS,CAAA;AACvD,QAAA,IAAI,MAAA,KAAW,MAAM,MAAA,EAAQ;AAC3B,UAAA,MAAA,CAAO,IAAA;AAAA,YACL,CAAA,EAAG,GAAG,CAAA,4BAAA,EAA+B,KAAA,CAAM,OAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,YAAA,EAAU,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,OAAA;AAAA,WAC7F;AAAA,QACF;AAAA,MACF,CAAA,MAAO;AACL,QAAA,QAAA,CAAS,IAAA;AAAA,UACP,GAAG,GAAG,CAAA,0HAAA;AAAA,SACR;AAAA,MACF;AAAA,IACF;AAGA,IAAA,KAAA,MAAW,GAAA,IAAO,KAAA,CAAM,YAAA,IAAgB,EAAC,EAAG;AAC1C,MAAA,IAAI;AACF,QAAA,aAAA,CAAc,GAAG,CAAA;AAAA,MACnB,SAAS,GAAA,EAAK;AACZ,QAAA,QAAA,CAAS,IAAA;AAAA,UACP,CAAA,EAAG,GAAG,CAAA,wBAAA,EAA2B,GAAG,CAAA,GAAA,EAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SAC5F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,EAAU,OAAA,CAAQ,CAAC,CAAA;AACnC,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,MAAA,CAAO,CAAC,CAAA;AAEhC,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,KAAA,CAAM,CAAA,SAAA,EAAY,MAAA,CAAO,MAAM,CAAA,UAAA,CAAY,CAAA;AAAA,EAC7C,CAAA,MAAO;AACL,IAAA,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAY,CAAA;AAAA,EACrC;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,IAAU,QAAA,CAAS,MAAA,GAAS,CAAA;AACpD,EAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,UAAA,EAAY,OAAA,CAAQ,KAAK,CAAC,CAAA;AACrD;AAaO,SAAS,oBAAA,CACd,WACA,MAAA,EACqC;AACrC,EAAA,MAAM,KAAA,GAAA,CAAS,aAAa,EAAA,EAAI,IAAA,GAAO,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA;AAClE,EAAA,MAAM,CAAC,OAAA,EAAS,GAAG,IAAI,CAAA,GAAI,MAAM,MAAA,GAAS,CAAA,GAAI,KAAA,GAAQ,CAAC,IAAI,CAAA;AAC3D,EAAA,OAAO,EAAE,OAAA,EAA4B,IAAA,EAAM,CAAC,GAAG,IAAA,EAAM,MAAM,CAAA,EAAE;AAC/D;AAgBO,SAAS,OAAA,CACd,GAAA,EACA,IAAA,EACA,KAAA,GAAmB,SAAA,EACb;AACN,EAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,EAAE,IAAA,EAAM,YAAA,EAAc,QAAO,GAAI,gBAAA,CAAiB,KAAK,UAAU,CAAA;AAEvE,EAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG;AACvB,IAAA,MAAA;AAAA,MACE,CAAA,yBAAA,EAA4B,IAAI,CAAA,KAAA,EAAQ,MAAM,CAAA,4CAAA;AAAA,KAEhD;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,EAAE,OAAA,EAAS,IAAA,EAAK,GAAI,oBAAA,CAAqB,OAAA,CAAQ,GAAA,CAAI,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AAC/F,EAAA,MAAM,MAAM,KAAA,CAAM,OAAA,EAAS,MAAM,EAAE,KAAA,EAAO,WAAW,CAAA;AACrD,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,IAAK,GAAA,CAAI,WAAW,IAAA,EAAM;AAC3C,IAAA,MAAA,CAAO,CAAA,0BAAA,EAA6B,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACjD,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,MAAM,EAAE,WAAA,EAAY,GAAI,qBAAqB,YAAA,CAAa,MAAA,EAAQ,OAAO,CAAC,CAAA;AAC1E,EAAA,MAAM,SAAS,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,OAAO,CAAA;AAC/D,EAAA,MAAM,WAAW,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,OAAO,CAAA;AACjE,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,MAAA,CAAO,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACxD,IAAA,OAAA,CAAQ,iFAA4E,CAAA;AAAA,EACtF,CAAA,MAAA,IAAW,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC9B,IAAA,KAAA,MAAW,CAAA,IAAK,UAAU,OAAA,CAAQ,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAC3D,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAAA,EAChC,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,QAAQ,CAAA;AAAA,EAChB;AACF;AAOO,SAAS,0BAA0B,GAAA,EAAoB;AAG5D,EAAA,MAAM,QAAA,GAAW,IACd,OAAA,CAAQ,UAAU,EAClB,WAAA,CAAY,yCAAyC,EACrD,uBAAA,EAAwB;AAE3B,EAAA,QAAA,CACG,OAAA,CAAQ,YAAY,CAAA,CACpB,WAAA,CAAY,8EAA8E,CAAA,CAC1F,MAAA,CAAO,yBAAA,EAA2B,mBAAA,EAAqB,QAAQ,GAAA,EAAK,CAAA,CACpE,MAAA,CAAO,sBAAsB,uDAAuD,CAAA,CACpF,MAAA,CAAO,OAAA,EAAS,6CAAA,EAA+C,KAAK,CAAA,CACpE,MAAA,CAAO,WAAW,wCAAA,EAA0C,KAAK,CAAA,CACjE,MAAA,CAAO,CAAC,GAAA,EAAK,IAAA,KAAS,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAC,CAAA;AAE3C,EAAA,QAAA,CACG,OAAA,CAAQ,YAAY,CAAA,CACpB,WAAA,CAAY,8DAA8D,CAAA,CAC1E,MAAA,CAAO,2BAA2B,mBAAA,EAAqB,OAAA,CAAQ,KAAK,CAAA,CACpE,OAAO,CAAC,GAAA,EAAK,SAAS,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAC,CAAA;AAE3C,EAAA,QAAA,CACG,OAAA,CAAQ,eAAe,CAAA,CACvB,WAAA;AAAA,IACC;AAAA,GAEF,CACC,MAAA,CAAO,yBAAA,EAA2B,mBAAA,EAAqB,OAAA,CAAQ,GAAA,EAAK,CAAA,CACpE,MAAA,CAAO,oBAAA,EAAsB,2CAA2C,CAAA,CACxE,MAAA,CAAO,OAAA,EAAS,6CAAA,EAA+C,KAAK,CAAA,CACpE,MAAA,CAAO,aAAA,EAAe,iDAAA,EAAmD,KAAK,CAAA,CAC9E,MAAA,CAAO,CAAC,GAAA,EAAK,IAAA,KAAS,UAAA,CAAW,GAAA,EAAK,IAAI,CAAC,CAAA;AAE9C,EAAA,QAAA,CACG,OAAA,CAAQ,cAAc,CAAA,CACtB,WAAA,CAAY,6CAA6C,EACzD,MAAA,CAAO,yBAAA,EAA2B,mBAAA,EAAqB,OAAA,CAAQ,GAAA,EAAK,EACpE,MAAA,CAAO,UAAA,EAAY,yDAAA,EAA2D,KAAK,CAAA,CACnF,MAAA,CAAO,CAAC,GAAA,EAAK,IAAA,KAAS,SAAA,CAAU,GAAA,EAAK,IAAI,CAAC,CAAA;AAE7C,EAAA,QAAA,CACG,OAAA,CAAQ,eAAe,CAAA,CACvB,WAAA,CAAY,+DAA+D,CAAA,CAC3E,MAAA,CAAO,yBAAA,EAA2B,mBAAA,EAAqB,OAAA,CAAQ,GAAA,EAAK,CAAA,CACpE,OAAO,kBAAA,EAAoB,oDAAoD,CAAA,CAC/E,MAAA,CAAO,sBAAA,EAAwB,yDAAyD,CAAA,CACxF,MAAA,CAAO,kBAAkB,0DAA0D,CAAA,CACnF,MAAA,CAAO,WAAA,EAAa,+DAA+D,KAAK,CAAA,CACxF,MAAA,CAAO,OAAO,KAAK,IAAA,KAAS;AAC3B,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,uCAA8B,CAAA;AAClE,IAAA,MAAM,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,EAC5B,CAAC,CAAA;AAEH,EAAA,QAAA,CACG,OAAA,CAAQ,eAAe,CAAA,CACvB,WAAA,CAAY,iDAAiD,EAC7D,MAAA,CAAO,MAAM,QAAA,CAAS,SAAS,CAAC,CAAA;AAEnC,EAAA,QAAA,CACG,OAAA,CAAQ,YAAY,CAAA,CACpB,WAAA,CAAY,sDAAsD,CAAA,CAClE,MAAA,CAAO,2BAA2B,mBAAA,EAAqB,OAAA,CAAQ,KAAK,CAAA,CACpE,OAAO,eAAA,EAAiB,4CAA4C,EACpE,MAAA,CAAO,OAAO,KAAK,IAAA,KAAS;AAC3B,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,OAAO,uCAA8B,CAAA;AAC/D,IAAA,MAAM,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EACzB,CAAC,CAAA;AACL;;;AC3lBO,SAAS,gBAAgB,GAAA,EAAqB;AACnD,EAAA,OAAYA,IAAA,CAAA,IAAA,CAAK,iBAAA,EAAkB,EAAG,GAAG,CAAA;AAC3C;AAEA,IAAM,wBAAA,GAA2B,sBAAA;AACjC,IAAM,6BAAA,GAAgC,qBAAA;AAU/B,SAAS,oBAAoB,MAAA,EAAuC;AACzE,EAAA,OAAO,MAAA,CAAO,OAAO,MAAA,GAAS,CAAA;AAChC;AAQO,SAAS,uBAAuB,IAAA,EAAkC;AACvE,EAAA,MAAM,SAAA,GAAYC,UAAAA,CAAgBD,IAAA,CAAA,IAAA,CAAK,IAAA,EAAM,6BAA6B,CAAC,CAAA;AAC3E,EAAA,MAAM,WAAA,GAAcC,UAAAA,CAAgBD,IAAA,CAAA,IAAA,CAAK,IAAA,EAAM,wBAAwB,CAAC,CAAA;AACxE,EAAA,IAAI,SAAA,IAAa,CAAC,WAAA,EAAa;AAC7B,IAAA,OACE,CAAA,2BAAA,EAA8B,6BAA6B,CAAA,QAAA,EACxD,wBAAwB,sGAC4B,wBAAwB,CAAA,4EAAA,CAAA;AAAA,EAGnF;AACA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,mBAAmB,KAAA,EAAuB;AACxD,EAAA,MAAM,CAAA,GAAI,MAAM,IAAA,EAAK;AACrB,EAAA,IAAI,+BAAA,CAAgC,KAAK,CAAC,CAAA,IAAK,QAAQ,IAAA,CAAK,CAAC,GAAG,OAAO,CAAA;AACvE,EAAA,MAAM,IAAA,GAAO,CAAA,CAAE,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAA;AACnC,EAAA,IAAI,qBAAqB,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,kBAAkB,IAAI,CAAA,IAAA,CAAA;AAClE,EAAA,IAAI,YAAY,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,4BAA4B,IAAI,CAAA,IAAA,CAAA;AACnE,EAAA,OAAO,CAAA;AACT;AAQO,SAAS,gBAAA,CAAiB,OAAoB,GAAA,EAAsB;AACzE,EAAA,IAAI,KAAA,CAAM,GAAA,KAAQ,GAAA,EAAK,OAAO,IAAA;AAC9B,EAAA,IAAI,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA,KAAM,GAAA,IAAO,gBAAgB,KAAA,CAAM,GAAG,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA;AACpF,EAAA,OAAO,KAAA,CAAM,GAAA,KAAQ,kBAAA,CAAmB,GAAG,CAAA;AAC7C;AAUO,SAAS,qBAAA,CACd,SACA,GAAA,EACyB;AACzB,EAAA,MAAM,GAAA,GAAM,eAAe,GAAG,CAAA;AAC9B,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAA,IAAO,cAAA,CAAe,CAAA,CAAE,GAAG,CAAA,KAAM,GAAG,CAAA;AAC3E;AAEA,SAAS,sBAAA,GAAiC;AACxC,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,OAAA,CAAQ,GAAA,EAAK,CAAA;AAC5C,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAA;AAAA,MACE;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,OAAYA,IAAA,CAAA,IAAA,CAAK,IAAA,EAAM,uBAAA,EAAyB,CAAA;AAClD;AAEO,SAAS,mBAAmB,QAAA,EAAiC;AAClE,EAAA,IAAI,CAACC,UAAAA,CAAW,QAAQ,CAAA,SAAU,EAAC;AACnC,EAAA,IAAI;AACF,IAAA,OAAO,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA,CAAE,UAAA,EAAW;AAAA,EACvD,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,eAAA,EAAkB,QAAQ,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACxF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAWO,SAAS,WAAA,CAAY,KAAA,EAAoB,IAAA,GAA4B,EAAC,EAAY;AACvF,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AACtD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAIA,UAAAA,CAAW,IAAI,CAAA,EAAG;AACpB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,EAAO,OAAO,KAAA;AACxB,IAAA,MAAA,GAAS,GAAG,IAAI,CAAA,IAAA,CAAA;AAChB,IAAA,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,UAAA,CAAW,MAAM,MAAM,CAAA;AAAA,EACzB;AACA,EAAA,SAAA,CAAeD,aAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACjD,EAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AAEtC,EAAA,IAAI,KAAA,CAAM,KAAK,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,EAAG,UAAA,EAAY,MAAM,GAAG,CAAA;AACtD,EAAA,MAAM,QAAQE,SAAAA,CAAU,KAAA,EAAO,MAAM,EAAE,KAAA,EAAO,WAAW,CAAA;AACzD,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAA,CAAO,MAAM,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAC7C,MAAA,UAAA,CAAW,QAAQ,IAAI,CAAA;AAAA,IACzB;AACA,IAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,KAAA,CAAM,GAAG,CAAA,CAAE,CAAA;AAC1C,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,IAAI,MAAA,SAAe,MAAA,EAAQ,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAC3D,EAAA,OAAO,IAAA;AACT;AAOA,eAAe,oBAAA,CACb,KAAA,EACA,UAAA,GAAa,KAAA,EAMZ;AACD,EAAA,MAAM,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AAC7D,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AACtD,IAAA,MAAM,QAAA,GAAA,CAAY,MAAM,OAAA,CAAQ,aAAA,EAAc,EAAG,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAI,CAAA;AAC5E,IAAA,MAAM,GAAA,GACJ,QAAA,IACC,MAAM,OAAA,CAAQ,UAAA,CAAW;AAAA,MACxB,IAAA;AAAA,MACA,IAAA,EAAM,IAAA;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,aAAA,EAAe,EAAE,GAAA,EAAK,KAAA,CAAM,GAAA,EAAK,QAAQ,KAAA,CAAM,GAAA,IAAO,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAM;AAAA,MAC9E,SAAA,EAAW;AAAA,KACZ,CAAA;AAMH,IAAA,MAAM,WAAA,GAAmBF,UAAK,oBAAA,EAAqB,EAAG,GAAG,iBAAA,CAAkB,KAAA,CAAM,GAAG,CAAC,CAAA,KAAA,CAAO,CAAA;AAC5F,IAAA,MAAM,OAAA,GAAU,IAAI,kBAAA,CAAmB,OAAA,EAAS,IAAI,EAAA,EAAI,IAAA,EAAM,oBAAmB,EAAG;AAAA,MAClF,mBAAA,EAAqBC,UAAAA,CAAW,WAAW,CAAA,GAAI,WAAA,GAAc,KAAA;AAAA,KAC9D,CAAA;AACD,IAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,IAAA,CAAK,EAAE,YAAY,CAAA;AAChD,IAAA,MAAM,OAAA,CAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACF;AAaA,eAAsB,kBAAkB,UAAA,EAAsC;AAC5E,EAAA,MAAM,IAAA,GAAO,kBAAkB,UAAU,CAAA;AACzC,EAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,EAAA,IAAI,kBAAA,CAAwBD,UAAK,IAAA,EAAM,uBAAA,EAAyB,CAAC,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAExF,EAAA,OAAA,CAAQ,6CAAmC,CAAA;AAC3C,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,mBAAmB,UAAU,CAAA;AACtD,EAAA,OAAO,MAAA,GAAS,CAAA;AAClB;AAeA,eAAsB,kBAAA,CACpB,UAAA,EACA,IAAA,GAA0B,EAAC,EACiC;AAC5D,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA;AAC9C,EAAA,MAAM,UAAU,kBAAA,CAAwBA,IAAA,CAAA,IAAA,CAAK,IAAA,EAAM,uBAAA,EAAyB,CAAC,CAAA;AAC7E,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AACtD,IAAA,IAAI;AAGF,MAAA,IAAI,CAACC,UAAAA,CAAW,IAAI,CAAA,EAAG;AACrB,QAAA,SAAA,CAAeD,aAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACjD,QAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AACtC,QAAA,IAAI,KAAA,CAAM,KAAK,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,EAAG,UAAA,EAAY,MAAM,GAAG,CAAA;AACtD,QAAA,MAAM,QAAQE,SAAAA,CAAU,KAAA,EAAO,MAAM,EAAE,KAAA,EAAO,UAAU,CAAA;AACxD,QAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,UAAA,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,6BAAA,CAA+B,CAAA;AAC9C,UAAA,MAAA,EAAA;AACA,UAAA;AAAA,QACF;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,IAAA,GAAOA,SAAAA,CAAU,KAAA,EAAO,CAAC,MAAA,EAAQ,WAAW,CAAA,EAAG,EAAE,GAAA,EAAK,IAAA,EAAM,KAAA,EAAO,QAAA,EAAU,CAAA;AACnF,QAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,UAAA,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,6CAAA,CAA+C,CAAA;AAC9D,UAAA,MAAA,EAAA;AACA,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAS,MAAM,oBAAA,CAAqB,KAAA,EAAO,KAAK,GAAG,CAAA;AACzD,MAAA,KAAA,MAAW,GAAA,IAAO,OAAO,MAAA,EAAQ,OAAA,CAAQ,GAAG,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAC1D,MAAA,KAAA,MAAW,QAAA,IAAY,OAAO,UAAA,EAAY,OAAA,CAAQ,GAAG,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAE,CAAA;AACxE,MAAA,MAAA,EAAA;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,qBAAA,EAAmB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACpF,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,MAAA,EAAQ,QAAQ,MAAA,EAAO;AACjD;AAGA,eAAe,iBAAA,CAAkB,KAAa,UAAA,EAAoC;AAChF,EAAA,MAAM,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAChC,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAA,CAAY,MAAM,OAAA,CAAQ,aAAA,EAAc,EAAG,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAI,CAAA;AAC5E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAM,QAAQ,aAAA,CAAc,IAAA,EAAM,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,IACpD;AAAA,EACF,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACA,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,GAAG,CAAC,CAAA;AAChD,IAAA,IAAID,UAAAA,CAAW,IAAI,CAAA,EAAG,MAAA,CAAO,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,EACrE;AACF;AAEO,SAAS,iBAAA,GAA6B;AAC3C,EAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,QAAQ,CAAA,CAAE,WAAA;AAAA,IAChC;AAAA,GACF;AAGA,EAAA,GAAA,CACG,OAAA,CAAQ,cAAc,CAAA,CACtB,WAAA;AAAA,IACC;AAAA,GAGF,CACC,OAAO,eAAA,EAAiB,gEAA2D,EACnF,MAAA,CAAO,aAAA,EAAe,mCAAmC,CAAA,CACzD,MAAA,CAAO,mBAAA,EAAqB,8BAA8B,CAAA,CAC1D,MAAA,CAAO,WAAW,uCAAA,EAAyC,KAAK,EAChE,MAAA,CAAO,OAAA,EAAS,yDAAA,EAA2D,KAAK,CAAA,CAChF,MAAA;AAAA,IACC,OACE,QACA,IAAA,KAOG;AACH,MAAA,MAAM,GAAA,GAAM,mBAAmB,MAAM,CAAA;AACrC,MAAA,MAAM,WAAW,sBAAA,EAAuB;AAMxC,MAAA,MAAM,SAAA,GAAY,qBAAA,CAAsB,kBAAA,CAAmB,QAAQ,GAAG,GAAG,CAAA;AACzE,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,MAAA;AAAA,UACE,CAAA,CAAA,EAAI,GAAG,CAAA,8BAAA,EAAiC,cAAA,CAAe,GAAG,CAAC,CAAA,yBAAA,EAClC,UAAU,GAAG,CAAA,wFAAA;AAAA,SAExC;AACA,QAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AACnB,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAK,IAAA,EAAM;AACb,QAAA,OAAA;AAAA,UACE;AAAA,SAEF;AAAA,MACF;AACA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,MAAA;AAC7B,MAAA,MAAM,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAChC,MAAA,MAAM,KAAA,GAAqB,EAAE,GAAA,EAAI;AACjC,MAAA,IAAI,GAAA,QAAW,GAAA,GAAM,GAAA;AAErB,MAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,GAAG,CAAC,CAAA;AAChD,MAAA,MAAM,WAAA,GAAcA,WAAW,IAAI,CAAA;AAInC,MAAA,MAAM,SAAS,WAAA,CAAY,KAAA,EAAO,EAAE,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AACvD,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,KAAA,CAAM,CAAA,wBAAA,EAA2B,IAAI,CAAA,CAAE,CAAA;AAAA,MACzC,WAAW,WAAA,EAAa;AACtB,QAAA,KAAA,CAAM,CAAA,UAAA,EAAa,GAAG,CAAA,QAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,MACpC,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,CAAA,OAAA,EAAU,GAAG,CAAA,QAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,MACjC;AAEA,MAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA;AAChD,MAAA,MAAA,CAAO,UAAU,KAAK,CAAA;AACtB,MAAA,MAAA,CAAO,IAAA,EAAK;AAEZ,MAAA,MAAM,MAAA,GAAS,MAAM,oBAAA,CAAqB,KAAA,EAAO,KAAK,GAAG,CAAA;AACzD,MAAA,MAAM,MAAA,GAAS,oBAAoB,MAAM,CAAA;AACzC,MAAA,MAAM,UAAA,GAAa,WAAW,MAAA,CAAO,aAAa,OAAO,MAAA,CAAO,WAAW,mBAAmB,IAAI,CAAA,EAAA,CAAA;AAClG,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,OAAA,CAAQ,UAAU,CAAA;AAAA,MACpB,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,UAAU,CAAA;AAAA,MAClB;AACA,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,MAAA,EAAQ,OAAA,CAAQ,GAAG,CAAA;AAC5C,MAAA,KAAA,MAAW,QAAA,IAAY,MAAA,CAAO,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAE1D,MAAA,MAAM,UAAA,GAAa,uBAAuB,IAAI,CAAA;AAC9C,MAAA,IAAI,UAAA,UAAoB,UAAU,CAAA;AAElC,MAAA,MAAM,KAAA,GAAaD,IAAA,CAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,IAAO,QAAQ,CAAA;AACnD,MAAA,IAAI,MAAA,EAAQ;AAGV,QAAA,OAAA;AAAA,UACE,CAAA,QAAA,EAAW,IAAI,CAAA,gBAAA,EAAmB,KAAK,SAAS,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,uFAAA,EAE1C,IAAI,CAAA,GAAA;AAAA,SAChC;AACA,QAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,MACrB,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,CAAA,QAAA,EAAW,IAAI,CAAA,gBAAA,EAAmB,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,MAClD;AAAA,IACF;AAAA,GACF;AAGF,EAAA,GAAA,CACG,OAAA,CAAQ,MAAM,CAAA,CACd,WAAA,CAAY,uDAAuD,CAAA,CACnE,MAAA,CAAO,QAAA,EAAU,gBAAgB,CAAA,CACjC,MAAA,CAAO,OAAO,IAAA,KAA6B;AAC1C,IAAA,MAAM,WAAW,sBAAA,EAAuB;AACxC,IAAA,MAAM,OAAA,GAAU,mBAAmB,QAAQ,CAAA;AAC3C,IAAA,IAAI,IAAA,CAAK,IAAA,EAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,KAAK,SAAA,CAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAC,CAAA;AAClE,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,OAAA,CAAQ,+EAA+E,CAAA;AACvF,MAAA;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAE,OAAA,CAAQ,WAAW,CAAC,CAAA;AAClC,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,CAAA,CAAE,GAAG,CAAA;AAClC,MAAA,MAAM,MAAA,GAASC,UAAAA,CAAW,eAAA,CAAgB,cAAA,CAAe,CAAA,CAAE,GAAG,CAAC,CAAC,CAAA,GAC5D,EAAA,GACA,CAAA,CAAE,IAAA,CAAK,eAAe,CAAA;AAC1B,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,GAAA,CAAI,IAAA,CAAK,OAAO,EAAE,CAAC,CAAC,CAAA,EAAA,EAAK,EAAE,GAAA,CAAI,CAAA,CAAE,GAAG,CAAC,CAAA,EAAG,MAAM,CAAA,CAAE,CAAA;AAAA,IACrE;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,EAAA,EAAO,EAAE,GAAA,CAAI,CAAA,EAAG,OAAA,CAAQ,MAAM,YAAY,CAAC;AAAA,CAAI,CAAA;AAAA,EAC7D,CAAC,CAAA;AAGH,EAAA,GAAA,CACG,OAAA,CAAQ,oBAAoB,CAAA,CAC5B,WAAA,CAAY,4DAA4D,CAAA,CACxE,MAAA,CAAO,OAAO,GAAA,KAAgB;AAC7B,IAAA,MAAM,WAAW,sBAAA,EAAuB;AACxC,IAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,QAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,gBAAA,CAAiB,CAAA,EAAG,GAAG,CAAC,CAAA;AAC/E,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAA,CAAO,CAAA,oBAAA,EAAuB,GAAG,CAAA,KAAA,EAAQ,QAAQ,CAAA,CAAA,CAAG,CAAA;AACpD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACtC,IAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AAC3D,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,IAAA,CAAK,SAAA;AAAA,QACH;AAAA,UACE,GAAG,KAAA;AAAA,UACH,IAAA;AAAA,UACA,SAAA;AAAA,UACA,MAAA,EAAQA,WAAW,SAAS;AAAA,SAC9B;AAAA,QACA,IAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF,CAAC,CAAA;AAGH,EAAA,GAAA,CACG,OAAA,CAAQ,sBAAsB,CAAA,CAC9B,WAAA,CAAY,0EAA0E,CAAA,CACtF,MAAA,CAAO,SAAA,EAAW,4DAAA,EAA8D,KAAK,CAAA,CACrF,MAAA,CAAO,OAAO,KAAa,IAAA,KAA6B;AACvD,IAAA,MAAM,WAAW,sBAAA,EAAuB;AACxC,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA;AAEhD,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,UAAA,EAAW,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,gBAAA,CAAiB,CAAA,EAAG,GAAG,CAAC,CAAA;AACtE,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAA,CAAO,CAAA,oBAAA,EAAuB,GAAG,CAAA,KAAA,EAAQ,QAAQ,CAAA,CAAA,CAAG,CAAA;AACpD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACtC,IAAA,MAAA,CAAO,YAAA,CAAa,MAAM,GAAG,CAAA;AAC7B,IAAA,MAAA,CAAO,IAAA,EAAK;AACZ,IAAA,MAAM,iBAAA,CAAkB,KAAA,CAAM,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AAC7C,IAAA,KAAA;AAAA,MACE,KAAK,KAAA,GACD,CAAA,gBAAA,EAAmB,IAAI,CAAA,uBAAA,CAAA,GACvB,mBAAmB,IAAI,CAAA,4HAAA;AAAA,KAC7B;AAAA,EACF,CAAC,CAAA;AAGH,EAAA,GAAA,CACG,QAAQ,aAAa,CAAA,CACrB,YAAY,sDAAsD,CAAA,CAClE,OAAO,OAAA,EAAS,0DAAA,EAA4D,KAAK,CAAA,CACjF,MAAA,CAAO,SAAS,qCAAA,EAAuC,KAAK,EAC5D,MAAA,CAAO,OAAO,KAAyB,IAAA,KAA2C;AACjF,IAAA,MAAM,WAAW,sBAAA,EAAuB;AACxC,IAAA,MAAM,OAAA,GAAU,mBAAmB,QAAQ,CAAA;AAC3C,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,OAAA,CAAQ,4BAA4B,CAAA;AACpC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,OAAA,GAAU,QAAQ,MAAA,CAAO,CAAC,MAAM,gBAAA,CAAiB,CAAA,EAAG,GAAG,CAAC,CAAA;AACxD,MAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,QAAA,OAAA,CAAQ,CAAA,oBAAA,EAAuB,GAAG,CAAA,EAAA,CAAI,CAAA;AACtC,QAAA;AAAA,MACF;AAAA,IACF,CAAA,MAAA,IAAW,KAAK,GAAA,IAAO,OAAA,CAAQ,WAAW,CAAA,IAAK,CAAC,OAAA,CAAQ,KAAA,CAAM,KAAA,EAAO;AAEnE,MAAA,OAAA,GAAU,OAAA;AAAA,IACZ,CAAA,MAAO;AACL,MAAA,MAAM,QAAA,GAAW,MAAQ,CAAA,CAAA,WAAA,CAAY;AAAA,QACnC,OAAA,EAAS,wBAAA;AAAA,QACT,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,UAC3B,OAAO,CAAA,CAAE,GAAA;AAAA,UACT,KAAA,EAAO,eAAA,CAAgB,CAAA,CAAE,GAAG,CAAA;AAAA,UAC5B,MAAM,CAAA,CAAE;AAAA,SACV,CAAE,CAAA;AAAA,QACF,QAAA,EAAU;AAAA,OACX,CAAA;AACD,MAAA,IAAM,CAAA,CAAA,QAAA,CAAS,QAAQ,CAAA,EAAG;AACxB,QAAE,SAAO,YAAY,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,QAAoB,CAAA;AAC3C,MAAA,OAAA,GAAU,OAAA,CAAQ,OAAO,CAAC,CAAA,KAAM,OAAO,GAAA,CAAI,CAAA,CAAE,GAAG,CAAC,CAAA;AAAA,IACnD;AACA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACtC,MAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AACtD,MAAA,IAAI,CAACA,UAAAA,CAAW,IAAI,CAAA,EAAG;AACrB,QAAA,WAAA,CAAY,KAAK,CAAA;AACjB,QAAA,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,YAAA,EAAe,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,MACrC,CAAA,MAAO;AACL,QAAA,MAAM,IAAA,GAAOC,SAAAA,CAAU,KAAA,EAAO,CAAC,MAAA,EAAQ,WAAW,CAAA,EAAG,EAAE,GAAA,EAAK,IAAA,EAAM,KAAA,EAAO,SAAA,EAAW,CAAA;AACpF,QAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,UAAA,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,6CAAA,CAA+C,CAAA;AAC9D,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAS,MAAM,oBAAA,CAAqB,KAAA,EAAO,KAAK,GAAG,CAAA;AACzD,MAAA,MAAM,MAAA,GAAS,oBAAoB,MAAM,CAAA;AACzC,MAAA,MAAM,UAAA,GAAa,GAAG,IAAI,CAAA,UAAA,EAAa,OAAO,aAAa,CAAA,IAAA,EAAO,OAAO,WAAW,CAAA,UAAA,CAAA;AACpF,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,OAAA,CAAQ,UAAU,CAAA;AAClB,QAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,MACrB,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,UAAU,CAAA;AAAA,MAClB;AACA,MAAA,KAAA,MAAW,GAAA,IAAO,OAAO,MAAA,EAAQ,OAAA,CAAQ,GAAG,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAC1D,MAAA,KAAA,MAAW,QAAA,IAAY,OAAO,UAAA,EAAY,OAAA,CAAQ,GAAG,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAE,CAAA;AACxE,MAAA,MAAM,UAAA,GAAa,uBAAuB,IAAI,CAAA;AAC9C,MAAA,IAAI,YAAY,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,UAAU,CAAA,CAAE,CAAA;AAAA,IAClD;AAAA,EACF,CAAC,CAAA;AAGH,EAAA,GAAA,CACG,OAAA,CAAQ,aAAa,CAAA,CACrB,WAAA,CAAY,iDAAiD,CAAA,CAC7D,MAAA,CAAO,CAAC,IAAA,KAAiB;AACxB,IAAA,MAAA;AAAA,MACE;AAAA,KAEF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB,CAAC,CAAA;AAEH,EAAA,GAAA,CACG,OAAA,CAAQ,eAAe,CAAA,CACvB,WAAA,CAAY,sDAAsD,CAAA,CAClE,MAAA,CAAO,CAAC,IAAA,KAAiB;AACxB,IAAA,MAAA;AAAA,MACE;AAAA,KAEF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB,CAAC,CAAA;AAGH,EAAA,yBAAA,CAA0B,GAAG,CAAA;AAE7B,EAAA,OAAO,GAAA;AACT","file":"chunk-CACCIOQL.js","sourcesContent":["/**\n * `skaile source manifest …` — curated `skaile.manifest.yaml` lifecycle for a\n * source you do NOT own. `init` generates a curated manifest from a discovery\n * run and stores it OUTSIDE the source, under the local store catalog\n * (`~/.skaile/store/manifests/<slug>.yaml`); `edit` opens it in `$EDITOR` and\n * re-validates on save. `source add`/`sync` then apply it as a read overlay\n * (see `source.ts` `refreshManifestCache`).\n *\n * `rebuild` refreshes a curated manifest after an upstream change (merge by\n * default — curation is sacred; `--overwrite` re-scans). `verify` is a\n * read-only integrity check (paths, declared hashes, schema, dep refs).\n * `publish`/`propose`/`yank` remain stubs — they need the store publish\n * endpoint (`POST /sources/<id>/manifest`), which lands in a follow-up.\n *\n * @docLink cli/commands/source#manifest\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  type AssetEntry,\n  decodeSkaileManifest,\n  encodeSkaileManifest,\n  findWorkspaceRoot,\n  parseAssetRef,\n  resolveSourcePublisher,\n  type SkPublishManifest,\n  type SourceEntry,\n  sourceCacheKey,\n  sourceShortName,\n  storeManifestSlug,\n  workspaceConfigFilename,\n} from \"@skaile/workspaces/core\";\nimport { computeDeterministicHash, discoverAssetsInTree } from \"@skaile/workspaces/discovery\";\nimport { getStoreManifestsDir, writeCuratedManifest } from \"@skaile/workspaces/library\";\nimport type { Command } from \"commander\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport { createFullRegistry } from \"../open-registry.ts\";\nimport {\n  ensureClone,\n  normalizeSourceUrl,\n  readProjectSources,\n  sourceClonePath,\n  sourceMatchesKey,\n} from \"./source.ts\";\n\nconst NOT_WIRED_MSG =\n  \"`skaile source manifest *` is scaffolded but not yet wired. \" +\n  \"Server-side endpoint (`POST /sources/<id>/manifest`) lands in a follow-up PR.\";\n\nfunction notWired(verb: string): never {\n  logErr(`${NOT_WIRED_MSG} (verb: source manifest ${verb})`);\n  process.exit(2);\n}\n\n/**\n * Resolve a `source manifest` argument into a `{ url, slug, dest }` triple.\n *\n * Resolution order:\n *   1. A key matching an already-registered project source (stored URL, cache\n *      key, or short slug).\n *   2. A collision-free **store slug** (`<host>__<owner>__<repo>`) whose\n *      manifest already exists at `~/.skaile/store/manifests/<arg>.yaml`. This\n *      MUST be tried before bare-name expansion: a bare name like `cli` would\n *      otherwise expand (via `normalizeSourceUrl`) to the skaile-ai org and a\n *      DIFFERENT slug than the one `init` wrote (e.g. `larksuite`). The slug is\n *      the exact identifier `init`'s next-step hint prints back.\n *   3. Otherwise a git URL / `owner/repo` / bare name via `normalizeSourceUrl`.\n *\n * The clone dir is the same URL-keyed cache `source add` uses.\n */\nexport function resolveSourceArg(\n  arg: string,\n  projectDir: string,\n): { url: string; slug: string; dest: string; manifestFile: string } {\n  const root = findWorkspaceRoot(projectDir);\n  const registered: SourceEntry[] = root\n    ? readProjectSources(path.join(root, workspaceConfigFilename()))\n    : [];\n  const match = registered.find((e) => sourceMatchesKey(e, arg));\n  const bySlug = !match ? resolveByStoreSlug(arg) : undefined;\n  const url = match ? match.url : (bySlug?.url ?? normalizeSourceUrl(arg));\n  const slug = sourceShortName(url); // human-facing label\n  const dest = sourceClonePath(sourceCacheKey(url));\n  return { url, slug, dest, manifestFile: bySlug?.manifestFile ?? storeManifestPath(url) };\n}\n\n/**\n * When `arg` is a bare store slug (`<host>__<owner>__<repo>`) whose curated\n * manifest already exists on disk, recover the source URL from the slug and\n * point at that manifest file directly. Returns `undefined` when the arg isn't\n * a slug or has no manifest yet (fall back to URL normalization).\n */\nfunction resolveByStoreSlug(arg: string): { url: string; manifestFile: string } | undefined {\n  // A slug is our own encoding — no path/URL sigils, at least the `<host>__…`\n  // separator. Anything URL/owner-repo shaped is not a slug.\n  if (!/^[\\w.-]+__[\\w.-]+/.test(arg) || /[/:\\\\]/.test(arg)) return undefined;\n  const manifestFile = path.join(getStoreManifestsDir(), `${arg}.yaml`);\n  if (!existsSync(manifestFile)) return undefined;\n  // `<host>__<owner>__<repo>` → `https://<host>/<owner>/<repo>` — good enough to\n  // key the clone dir + re-derive the same slug; the manifest file is what edit\n  // actually opens.\n  const [host, owner, repo] = arg.split(\"__\");\n  const url = host && owner && repo ? `https://${host}/${owner}/${repo}` : arg;\n  return { url, manifestFile };\n}\n\n/**\n * Absolute path to a source's curated store manifest. Keyed by the\n * collision-free {@link storeManifestSlug} (`<host>__<owner>__<repo>`) so\n * `orgA/cli` and `orgB/cli` don't share `cli.yaml`.\n */\nfunction storeManifestPath(url: string): string {\n  return path.join(getStoreManifestsDir(), `${storeManifestSlug(url)}.yaml`);\n}\n\n/**\n * Directory-name segments that mark a test-fixture tree. `init`/`rebuild` drop\n * any asset whose repo-relative root contains one of these as an exact path\n * SEGMENT. Repos routinely ship fixture \"skills\" under such dirs (e.g.\n * `scripts/skill-format-check/tests`, `internal/qualitygate/skillscan/testdata/skills/lark-demo`)\n * that are not real, publishable assets.\n */\nconst TEST_FIXTURE_SEGMENTS = new Set([\n  \"tests\",\n  \"test\",\n  \"__tests__\",\n  \"testdata\",\n  \"fixtures\",\n  \"__fixtures__\",\n]);\n\n/**\n * True when an asset's repo-relative `root` sits under a test-fixture directory\n * (see {@link TEST_FIXTURE_SEGMENTS}). Conservative, not repo-specific — finer\n * curation (keeping a genuine fixture asset) stays the user's job via `edit`.\n * `init`/`rebuild`-path only; the general discovery walk (`source add`) is\n * untouched.\n */\nfunction isTestFixtureAsset(relativePath: string): boolean {\n  const segments = relativePath.replace(/\\\\/g, \"/\").split(\"/\");\n  return segments.some((s) => TEST_FIXTURE_SEGMENTS.has(s));\n}\n\n/**\n * `source manifest init <src>` — clone (if needed), run discovery, and write a\n * curated `skaile.manifest.yaml` to `~/.skaile/store/manifests/<slug>.yaml`.\n */\nasync function runInit(\n  arg: string,\n  opts: { projectDir: string; publisher?: string; dev?: boolean; force?: boolean },\n): Promise<void> {\n  const projectDir = path.resolve(opts.projectDir);\n  const { url, dest, manifestFile: target } = resolveSourceArg(arg, projectDir);\n\n  if (existsSync(target) && !opts.force) {\n    logWarn(\n      `A curated manifest already exists at ${S.dim(target)}. ` +\n        \"Edit it with `skaile source manifest edit`, refresh it after an upstream \" +\n        \"change with `skaile source manifest rebuild`, or pass --force to regenerate.\",\n    );\n    return;\n  }\n\n  const entry: SourceEntry = { url };\n  ensureClone(entry);\n\n  const { assets, errors } = discoverCuratableAssets(dest, opts.dev ?? false);\n\n  const publisher = opts.publisher ?? resolveSourcePublisher(dest) ?? sourceShortName(url);\n\n  const written = writeCuratedManifest({\n    manifestFile: target,\n    publisher,\n    assets,\n    force: opts.force,\n    // Init: every asset inherits the top-level repo `publisher`. Do NOT stamp a\n    // per-asset publisher — on the glob path each DiscoveredAsset.publisher is\n    // the bare first path segment (`scripts`/`skills`/…), which would clobber\n    // the intended org/`--publisher` default with junk per-asset overrides.\n    inheritPublisher: true,\n  });\n\n  if (!written.wrote) {\n    logWarn(\n      `Curated manifest already exists at ${S.dim(target)} — not overwritten. ` +\n        \"Pass --force to regenerate.\",\n    );\n    return;\n  }\n\n  logOk(`Wrote curated manifest with ${written.assetCount} assets to ${S.dim(target)}.`);\n  // Echo the EXACT <src> the user passed so the printed commands actually run.\n  // A bare short name would mis-resolve through `normalizeSourceUrl` (→ the\n  // skaile-ai org, wrong slug); the original arg is what `resolveSourceArg`\n  // maps back to this same manifest.\n  logInfo(\n    `Edit it with \\`skaile source manifest edit ${arg}\\`, then ` +\n      `\\`skaile source add ${arg}\\` to consume it.`,\n  );\n  if (errors.length > 0) {\n    logWarn(`${errors.length} discovery error(s) — inspect the manifest before consuming.`);\n  }\n}\n\n/**\n * Run discovery over a clone and drop the test-fixture assets (see\n * {@link isTestFixtureAsset}). Shared by `init` and `rebuild` so both paths\n * produce an identical inventory from the same tree.\n */\nfunction discoverCuratableAssets(\n  dest: string,\n  includeDev: boolean,\n): { assets: ReturnType<typeof discoverAssetsInTree>[\"assets\"]; errors: string[] } {\n  const result = discoverAssetsInTree(dest, {\n    registry: createFullRegistry(),\n    includeDev,\n  });\n  const assets = result.assets.filter((a) => !isTestFixtureAsset(a.relativePath));\n  return { assets, errors: result.errors.map((e) => `${e.path}: ${e.error}`) };\n}\n\n/**\n * Best-effort `git pull --ff-only` on an existing clone. Never throws: a pull\n * failure (offline, diverged, detached) is warned and the caller continues with\n * the clone as-is.\n */\nfunction pullCloneFfOnly(dest: string): void {\n  const res = spawnSync(\"git\", [\"-C\", dest, \"pull\", \"--ff-only\"], { stdio: \"pipe\" });\n  if (res.status !== 0) {\n    logWarn(\n      \"git pull --ff-only failed — continuing with the existing clone \" +\n        \"(it may be behind upstream).\",\n    );\n  }\n}\n\n/**\n * Repo-relative `root` path for a manifest asset entry — the merge match key\n * between an existing curated entry and a freshly-discovered asset. `root:`\n * entries use their declared path; a `files:`-only entry (rare for a curated\n * sidecar) falls back to the entry's dirname of the first file, else the name.\n */\nfunction entryRootKey(entry: AssetEntry): string {\n  if (entry.root) return entry.root.replace(/\\\\/g, \"/\").replace(/\\/+$/, \"\");\n  const files = entry.files;\n  if (files && files.length > 0) {\n    const first = typeof files[0] === \"string\" ? files[0] : files[0].path;\n    const dir = path.posix.dirname(first.replace(/\\\\/g, \"/\"));\n    return dir === \".\" ? entry.name : dir;\n  }\n  return entry.name;\n}\n\n/** Repo-relative `root` path a discovered asset maps to (matches init's writer). */\nfunction discoveredRootKey(relativePath: string): string {\n  const dir = path.posix.dirname(relativePath.replace(/\\\\/g, \"/\"));\n  return dir === \".\" ? path.posix.basename(relativePath.replace(/\\\\/g, \"/\")) : dir;\n}\n\n/** Human ref for reporting: `kind:name`. */\nfunction entryRef(entry: AssetEntry): string {\n  return `${entry.kind}:${entry.name}`;\n}\n\n/**\n * `source manifest rebuild <src>` — refresh a curated manifest after the\n * upstream repo changed. MERGE is the default (curation is sacred); `--overwrite`\n * re-scans from scratch with `init --force` semantics.\n *\n * Merge algorithm (match by repo-relative `root` path):\n *   - Existing entries whose root is STILL discovered → KEPT verbatim (all\n *     hand-edits preserved).\n *   - Existing entries whose root is GONE upstream → DROPPED (reported).\n *   - Freshly-discovered assets not already in the manifest → NOT auto-added,\n *     only REPORTED (a curated foreign sidecar must not silently absorb new\n *     upstream skills). An asset the curator deliberately dropped stays dropped\n *     because it is neither in the existing manifest nor re-added here.\n */\nasync function runRebuild(\n  arg: string,\n  opts: { projectDir: string; publisher?: string; dev?: boolean; overwrite?: boolean },\n): Promise<void> {\n  const projectDir = path.resolve(opts.projectDir);\n  const { url, dest, slug, manifestFile: target } = resolveSourceArg(arg, projectDir);\n\n  if (!existsSync(target)) {\n    logErr(\n      `No curated manifest for \"${slug}\" at ${S.dim(target)} — ` +\n        \"run `skaile source manifest init` first.\",\n    );\n    process.exit(1);\n  }\n\n  // Update the clone: clone if absent, else pull --ff-only (best-effort).\n  const entry: SourceEntry = { url };\n  const cloned = ensureClone(entry);\n  if (!cloned) pullCloneFfOnly(dest);\n\n  const { assets: freshAssets, errors } = discoverCuratableAssets(dest, opts.dev ?? false);\n\n  if (opts.overwrite) {\n    logWarn(\n      \"--overwrite: replacing the curated manifest with a full fresh inventory. \" +\n        \"All hand-curation (dropped assets, per-asset edits) is discarded.\",\n    );\n    const publisher = opts.publisher ?? resolveSourcePublisher(dest) ?? sourceShortName(url);\n    const written = writeCuratedManifest({\n      manifestFile: target,\n      publisher,\n      assets: freshAssets,\n      force: true,\n      inheritPublisher: true,\n    });\n    logOk(\n      `Rebuilt curated manifest with ${written.assetCount} assets to ${S.dim(target)} (overwrite).`,\n    );\n    if (errors.length > 0) {\n      logWarn(`${errors.length} discovery error(s) — inspect the manifest before consuming.`);\n    }\n    return;\n  }\n\n  // MERGE (default). `--publisher` only applies to the full re-derive path.\n  if (opts.publisher) {\n    logWarn(\n      \"--publisher is ignored in merge mode (the curated publisher is preserved). \" +\n        \"Use --overwrite to re-derive the publisher from a full re-scan.\",\n    );\n  }\n\n  // Read the existing curated manifest and keep it as the base.\n  const { manifest: existing } = decodeSkaileManifest(readFileSync(target, \"utf-8\"));\n  const existingEntries = existing.assets ?? [];\n\n  // Index fresh discovery by repo-relative root path.\n  const freshByRoot = new Map<string, (typeof freshAssets)[number]>();\n  for (const a of freshAssets) freshByRoot.set(discoveredRootKey(a.relativePath), a);\n\n  const kept: AssetEntry[] = [];\n  const dropped: string[] = [];\n  for (const e of existingEntries) {\n    if (freshByRoot.has(entryRootKey(e))) kept.push(e);\n    else dropped.push(entryRef(e));\n  }\n\n  // Fresh assets not already curated → report as available, do NOT add.\n  const existingRoots = new Set(existingEntries.map(entryRootKey));\n  const newlyAvailable: string[] = [];\n  for (const a of freshAssets) {\n    if (!existingRoots.has(discoveredRootKey(a.relativePath))) {\n      newlyAvailable.push(`${a.kind}:${a.name}`);\n    }\n  }\n\n  const changed = dropped.length > 0;\n  if (dropped.length > 0) {\n    logWarn(`removed (gone upstream): ${dropped.sort().join(\", \")}`);\n  }\n  if (newlyAvailable.length > 0) {\n    logInfo(\n      `${newlyAvailable.length} new upstream asset(s) available (not added): ` +\n        `${newlyAvailable.sort().join(\", \")} — add with \\`skaile source manifest edit ${arg}\\` if wanted`,\n    );\n  }\n\n  if (!changed) {\n    logOk(\"already up to date\");\n    if (errors.length > 0) {\n      logWarn(`${errors.length} discovery error(s) — inspect the source before re-consuming.`);\n    }\n    return;\n  }\n\n  const merged: SkPublishManifest = { ...existing, assets: kept };\n  writeFileSync(target, encodeSkaileManifest(merged), \"utf-8\");\n  logOk(\n    `Rebuilt curated manifest: kept ${kept.length}, dropped ${dropped.length} → ${S.dim(target)}.`,\n  );\n  if (errors.length > 0) {\n    logWarn(`${errors.length} discovery error(s) — inspect the source before re-consuming.`);\n  }\n}\n\n/**\n * `source manifest verify <src>` — READ-ONLY integrity check of a curated\n * manifest against its clone. Writes nothing. Exit 0 when no errors; with\n * `--strict`, any warning also forces a nonzero exit.\n *\n * Per-asset checks:\n *   - `root`/`files` paths still exist upstream (missing → error).\n *   - A declared `sha256` recomputes to the same deterministic hash (mismatch → error).\n *   - Schema decode diagnostics map to errors/warnings.\n *   - Dependency refs parse via `parseAssetRef` (malformed → warning).\n */\nasync function runVerify(\n  arg: string,\n  opts: { projectDir: string; strict?: boolean },\n): Promise<void> {\n  const projectDir = path.resolve(opts.projectDir);\n  const { url, dest, slug, manifestFile: target } = resolveSourceArg(arg, projectDir);\n\n  if (!existsSync(target)) {\n    logErr(\n      `No curated manifest for \"${slug}\" at ${S.dim(target)} — ` +\n        \"run `skaile source manifest init` first.\",\n    );\n    process.exit(1);\n  }\n\n  // Ensure a clone exists to verify paths/hashes against (best-effort; no pull).\n  ensureClone({ url });\n\n  const text = readFileSync(target, \"utf-8\");\n  const { manifest, diagnostics } = decodeSkaileManifest(text);\n\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  // Schema diagnostics from the decoder.\n  for (const d of diagnostics) {\n    const line = `${d.code}: ${d.message}`;\n    if (d.severity === \"error\") errors.push(line);\n    else warnings.push(line);\n  }\n\n  const assets = manifest.assets ?? [];\n  for (const entry of assets) {\n    const ref = entryRef(entry);\n\n    // Path existence: `root` dir and/or each `files[]` path.\n    const relPaths: string[] = [];\n    if (entry.root) relPaths.push(entry.root);\n    if (entry.files) {\n      for (const f of entry.files) relPaths.push(typeof f === \"string\" ? f : f.path);\n    }\n    if (relPaths.length === 0) relPaths.push(entry.name);\n    for (const rel of relPaths) {\n      if (!existsSync(path.join(dest, rel))) {\n        errors.push(`${ref}: path not found upstream: ${rel}`);\n      }\n    }\n\n    // Declared sha256 → recompute + compare, but ONLY for granular `files:`\n    // entries. Discovery (`discover-manifest.ts`) anchors a `files:`-only entry\n    // at the REPO ROOT and hashes the files VERBATIM as repo-relative strings\n    // (the path is folded into the digest), so verify must hash the same way:\n    // `assetRoot = dest`, files kept repo-relative — NOT rebased onto the root.\n    // A `root:` entry cannot be verified this way (discovery hashes only the\n    // per-kind filtered set, not the whole-dir walk), and the writer never emits\n    // sha256 for `root:` entries, so skip the hash check for them.\n    if (entry.sha256) {\n      if (entry.files && entry.files.length > 0) {\n        const hashFiles = entry.files.map((f) =>\n          (typeof f === \"string\" ? f : f.path).replace(/\\\\/g, \"/\"),\n        );\n        const actual = computeDeterministicHash(dest, hashFiles);\n        if (actual !== entry.sha256) {\n          errors.push(\n            `${ref}: sha256 mismatch (declared ${entry.sha256.slice(0, 12)}…, got ${actual.slice(0, 12)}…)`,\n          );\n        }\n      } else {\n        warnings.push(\n          `${ref}: declared sha256 on a root:-mode entry is not verifiable (discovery hashes only the per-kind filtered set) — skipped`,\n        );\n      }\n    }\n\n    // Dependency refs parse.\n    for (const dep of entry.dependencies ?? []) {\n      try {\n        parseAssetRef(dep);\n      } catch (err) {\n        warnings.push(\n          `${ref}: malformed dependency \"${dep}\": ${err instanceof Error ? err.message : String(err)}`,\n        );\n      }\n    }\n  }\n\n  for (const w of warnings) logWarn(w);\n  for (const e of errors) logErr(e);\n\n  if (errors.length === 0) {\n    logOk(`verified ${assets.length} asset(s).`);\n  } else {\n    logErr(`${errors.length} issue(s).`);\n  }\n\n  const failStrict = opts.strict && warnings.length > 0;\n  if (errors.length > 0 || failStrict) process.exit(1);\n}\n\n/**\n * Split a `$VISUAL`/`$EDITOR` value into `{ command, args }` and append the file\n * as the final arg. The env value is a full command line, not a bare binary —\n * `EDITOR=\"code --wait\"` must spawn `code` with `[\"--wait\", <file>]`, and\n * `EDITOR=code` (which returns before save) is the user's problem, not ours.\n * A whitespace split covers the common editors (`code --wait`, `code -w`,\n * `subl -w`, `vi`); paths with embedded spaces are not supported (rare for an\n * editor binary and out of scope). Falls back to `vi` when unset/empty.\n *\n * @docLink cli/commands/source#manifest-edit\n */\nexport function resolveEditorCommand(\n  editorEnv: string | undefined,\n  target: string,\n): { command: string; args: string[] } {\n  const parts = (editorEnv ?? \"\").trim().split(/\\s+/).filter(Boolean);\n  const [command, ...rest] = parts.length > 0 ? parts : [\"vi\"];\n  return { command: command as string, args: [...rest, target] };\n}\n\n/** Minimal spawn contract runEdit needs — lets tests inject a fake. */\ntype SpawnLike = (\n  command: string,\n  args: string[],\n  opts: { stdio: \"inherit\" },\n) => { status: number | null };\n\n/**\n * `source manifest edit <src>` — open the curated store manifest in `$EDITOR`\n * and re-validate on save. Warnings are surfaced but never hard-fail.\n *\n * `spawn` is injectable so tests can assert the argv without launching a real\n * editor; production passes the default `spawnSync`.\n */\nexport function runEdit(\n  arg: string,\n  opts: { projectDir: string },\n  spawn: SpawnLike = spawnSync as unknown as SpawnLike,\n): void {\n  const projectDir = path.resolve(opts.projectDir);\n  const { slug, manifestFile: target } = resolveSourceArg(arg, projectDir);\n\n  if (!existsSync(target)) {\n    logErr(\n      `No curated manifest for \"${slug}\" at ${target}. ` +\n        \"Run `skaile source manifest init` first.\",\n    );\n    process.exit(1);\n  }\n\n  const { command, args } = resolveEditorCommand(process.env.VISUAL || process.env.EDITOR, target);\n  const res = spawn(command, args, { stdio: \"inherit\" });\n  if (res.status !== 0 && res.status !== null) {\n    logErr(`Editor exited with status ${res.status}.`);\n    process.exit(1);\n  }\n\n  // Re-validate the saved file; surface diagnostics as warnings, don't hard-fail.\n  const { diagnostics } = decodeSkaileManifest(readFileSync(target, \"utf-8\"));\n  const errors = diagnostics.filter((d) => d.severity === \"error\");\n  const warnings = diagnostics.filter((d) => d.severity !== \"error\");\n  if (errors.length > 0) {\n    for (const d of errors) logErr(`${d.code}: ${d.message}`);\n    logWarn(\"Manifest has errors — fix them before `skaile source add` will consume it.\");\n  } else if (warnings.length > 0) {\n    for (const d of warnings) logWarn(`${d.code}: ${d.message}`);\n    logOk(\"Saved (with warnings).\");\n  } else {\n    logOk(\"Saved.\");\n  }\n}\n\n/**\n * Append the `manifest` sub-tree to a `source` command.\n *\n * Called from `makeSourceCommand()` in `source.ts`.\n */\nexport function addSourceManifestCommands(src: Command): void {\n  // enablePositionalOptions so options on the leaf verb (`source manifest init\n  // --publisher …`) route to that verb instead of being rejected by `manifest`.\n  const manifest = src\n    .command(\"manifest\")\n    .description(\"Curated manifest lifecycle for a source\")\n    .enablePositionalOptions();\n\n  manifest\n    .command(\"init <src>\")\n    .description(\"Generate a curated manifest for a source (stored in the local store catalog)\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--publisher <name>\", \"Override the publisher (default: source's GitHub org)\")\n    .option(\"--dev\", \"Include assets under the source's dev_paths\", false)\n    .option(\"--force\", \"Overwrite an existing curated manifest\", false)\n    .action((arg, opts) => runInit(arg, opts));\n\n  manifest\n    .command(\"edit <src>\")\n    .description(\"Open the curated manifest in $EDITOR and re-validate on save\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .action((arg, opts) => runEdit(arg, opts));\n\n  manifest\n    .command(\"rebuild <src>\")\n    .description(\n      \"Refresh a curated manifest after an upstream change (merge by default: \" +\n        \"keeps curation, drops assets gone upstream, reports new ones without adding)\",\n    )\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--publisher <name>\", \"Override the publisher (--overwrite only)\")\n    .option(\"--dev\", \"Include assets under the source's dev_paths\", false)\n    .option(\"--overwrite\", \"Discard curation and re-scan the full inventory\", false)\n    .action((arg, opts) => runRebuild(arg, opts));\n\n  manifest\n    .command(\"verify <src>\")\n    .description(\"Verify hashes, deps, and schema (read-only)\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--strict\", \"Fail on advisory checks (warnings force a nonzero exit)\", false)\n    .action((arg, opts) => runVerify(arg, opts));\n\n  manifest\n    .command(\"publish <src>\")\n    .description(\"Push the curated sidecar manifest and publish it to the store\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--as <namespace>\", \"Publisher namespace (default: your store username)\")\n    .option(\"--sidecar-repo <url>\", \"Public GitHub repo you own to hold the curated manifest\")\n    .option(\"--ref <gitref>\", \"Foreign source ref to ingest (branch/sha; default: main)\")\n    .option(\"--dry-run\", \"Print the publish plan without pushing or calling the store\", false)\n    .action(async (arg, opts) => {\n      const { runPublish } = await import(\"./source-manifest-publish.ts\");\n      await runPublish(arg, opts);\n    });\n\n  manifest\n    .command(\"propose <src>\")\n    .description(\"Open a PR to upstream with the sidecar manifest\")\n    .action(() => notWired(\"propose\"));\n\n  manifest\n    .command(\"yank <src>\")\n    .description(\"Retract the source's published assets from the store\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--asset <ref>\", \"Yank only the asset matching this ref/name\")\n    .action(async (arg, opts) => {\n      const { runYank } = await import(\"./source-manifest-publish.ts\");\n      await runYank(arg, opts);\n    });\n}\n","/**\n * `skaile source …` — manage github sources for the current project.\n *\n * A *source* is a third-party github repo of AI assets. The project's\n * `skaile.yaml` `sources:` array is the source of truth for which sources\n * this project uses. The clone itself lives at\n * `~/.skaile/cache/sources/<host>/<owner>/<repo>/` (machine-global cache, shared\n * across projects, URL-keyed so cross-org repos never collide), and the manifest is\n * mirrored into `~/.skaile/index.db` (machine-global manifest cache).\n *\n * @docLink cli/commands/source\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync, mkdirSync, renameSync, rmSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  findWorkspaceRoot,\n  getGlobalCacheDir,\n  type SourceEntry,\n  sourceCacheKey,\n  sourceShortName,\n  storeManifestSlug,\n  WorkspaceYamlEditor,\n  workspaceConfigFilename,\n} from \"@skaile/workspaces/core\";\nimport { getStoreManifestsDir, LocalCatalogSource } from \"@skaile/workspaces/library\";\nimport * as p from \"@clack/prompts\";\nimport { Command } from \"commander\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport { openLibraryManager } from \"../open-library.ts\";\nimport { createFullRegistry } from \"../open-registry.ts\";\nimport { addSourceManifestCommands } from \"./source-manifest.ts\";\n\n/**\n * Clone dir for one source cache key (`<host>/<owner>/<repo>`). Exported for the\n * cache-path regression test. Callers pass `sourceCacheKey(url)`.\n */\nexport function sourceClonePath(key: string): string {\n  return path.join(getGlobalCacheDir(), key);\n}\n\nconst SKAILE_MANIFEST_FILENAME = \"skaile.manifest.yaml\";\nconst LEGACY_SOURCE_CONFIG_FILENAME = \".skaile-source.yaml\";\n\n/**\n * Whether a manifest-cache refresh actually failed to index something. Keyed on\n * `errors`, NOT on `assetsUpdated < assetsFound`: the discovery walk counts\n * presets (and other intentionally-not-cataloged kinds) toward `assetsFound` but\n * never upserts them, so a source shipping a `.preset.yaml` would otherwise read\n * as a partial failure — false `! N asset(s) failed to index` + exit 1 — with\n * zero real errors.\n */\nexport function indexingHadFailures(result: { errors: string[] }): boolean {\n  return result.errors.length > 0;\n}\n\n/**\n * A clone that ships only the legacy `.skaile-source.yaml` (no\n * `skaile.manifest.yaml`) has its declared `publisher_default` silently ignored\n * — discovery only reads `skaile.manifest.yaml`, so publisher resolution falls\n * back to the first path segment. Surface a hint so the author can fix it.\n */\nexport function legacySourceConfigHint(dest: string): string | undefined {\n  const hasLegacy = existsSync(path.join(dest, LEGACY_SOURCE_CONFIG_FILENAME));\n  const hasManifest = existsSync(path.join(dest, SKAILE_MANIFEST_FILENAME));\n  if (hasLegacy && !hasManifest) {\n    return (\n      `This source ships a legacy ${LEGACY_SOURCE_CONFIG_FILENAME} but no ` +\n      `${SKAILE_MANIFEST_FILENAME}; its declared publisher is ignored and assets ` +\n      `are published under their first path segment. Add a ${SKAILE_MANIFEST_FILENAME} ` +\n      `(\\`skaile source manifest init\\`) to set the publisher and asset inventory.`\n    );\n  }\n  return undefined;\n}\n\n/**\n * Normalize a `source add` argument into a clonable git URL. Full URLs and\n * scp-style (`git@host:…`) specs pass through unchanged; an `owner/repo`\n * shorthand and a bare repo name expand to GitHub over SSH — a bare name\n * defaults to the `skaile-ai` org (`git@github.com:skaile-ai/<name>.git`).\n */\nexport function normalizeSourceUrl(input: string): string {\n  const s = input.trim();\n  if (/^(?:https?|git|ssh|file):\\/\\//.test(s) || /^git@/.test(s)) return s;\n  const repo = s.replace(/\\.git$/, \"\");\n  if (/^[\\w.-]+\\/[\\w.-]+$/.test(repo)) return `git@github.com:${repo}.git`;\n  if (/^[\\w.-]+$/.test(repo)) return `git@github.com:skaile-ai/${repo}.git`;\n  return s;\n}\n\n/**\n * Match a stored source against a user-supplied key. Mirrors the shortcut\n * expansion `source add` applies (`normalizeSourceUrl`) so any form that `add`\n * accepted — bare name, `owner/repo`, `.git`-suffixed, full URL — also resolves\n * at `sync`/`show`/`remove` time, not just the raw stored URL or derived slug.\n */\nexport function sourceMatchesKey(entry: SourceEntry, key: string): boolean {\n  if (entry.url === key) return true;\n  if (sourceCacheKey(entry.url) === key || sourceShortName(entry.url) === key) return true;\n  return entry.url === normalizeSourceUrl(key);\n}\n\n/**\n * Find an already-registered source that maps to the same cache key as `url`\n * but is stored under a *different* URL string (e.g. the `.git`-suffixed or\n * scp form of the same remote). Two such entries would fight over one clone\n * dir, so `source add` rejects the ambiguity. Returns the colliding entry, or\n * `undefined` when the URL is unique or only matches an exact-string duplicate\n * (which `setSource` updates in place).\n */\nexport function findCacheKeyCollision(\n  sources: SourceEntry[],\n  url: string,\n): SourceEntry | undefined {\n  const key = sourceCacheKey(url);\n  return sources.find((s) => s.url !== url && sourceCacheKey(s.url) === key);\n}\n\nfunction requireProjectYamlPath(): string {\n  const root = findWorkspaceRoot(process.cwd());\n  if (!root) {\n    logErr(\n      \"No skaile.yaml found in the current directory or any parent. \" + \"Run `skaile init` first.\",\n    );\n    process.exit(1);\n  }\n  return path.join(root, workspaceConfigFilename());\n}\n\nexport function readProjectSources(yamlPath: string): SourceEntry[] {\n  if (!existsSync(yamlPath)) return [];\n  try {\n    return WorkspaceYamlEditor.load(yamlPath).getSources();\n  } catch (err) {\n    logErr(`Could not read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Clone the source if its clone directory does not yet exist. When `force` is\n * set, the existing clone is replaced by a fresh checkout. Returns true when a\n * clone happened. The cache slug is derived from the URL.\n *\n * A `--force` re-clone moves the old clone aside first and only deletes it once\n * the fresh clone succeeds — so a failed re-clone restores the previous clone\n * rather than leaving the source registered with no cache behind it.\n */\nexport function ensureClone(entry: SourceEntry, opts: { force?: boolean } = {}): boolean {\n  const dest = sourceClonePath(sourceCacheKey(entry.url));\n  let backup: string | undefined;\n  if (existsSync(dest)) {\n    if (!opts.force) return false;\n    backup = `${dest}.bak`;\n    rmSync(backup, { recursive: true, force: true });\n    renameSync(dest, backup);\n  }\n  mkdirSync(path.dirname(dest), { recursive: true });\n  const args = [\"clone\", entry.url, dest];\n  // `pin` may be a branch/tag; pass it as the clone branch when present.\n  if (entry.pin) args.splice(1, 0, \"--branch\", entry.pin);\n  const clone = spawnSync(\"git\", args, { stdio: \"inherit\" });\n  if (clone.status !== 0) {\n    if (backup) {\n      rmSync(dest, { recursive: true, force: true });\n      renameSync(backup, dest);\n    }\n    logErr(`git clone failed for ${entry.url}`);\n    process.exit(1);\n  }\n  if (backup) rmSync(backup, { recursive: true, force: true });\n  return true;\n}\n\n/**\n * Refresh the machine-global manifest cache for `entry` by running discovery\n * and upserting AssetDefinitions into `~/.skaile/index.db`. Creates the\n * libraries-table cache row if missing (ownership: reader = cache state).\n */\nasync function refreshManifestCache(\n  entry: SourceEntry,\n  includeDev = false,\n): Promise<{\n  assetsFound: number;\n  assetsUpdated: number;\n  errors: string[];\n  advisories: string[];\n}> {\n  const { manager, library, close } = await openLibraryManager();\n  try {\n    const name = sourceShortName(entry.url);\n    const dest = sourceClonePath(sourceCacheKey(entry.url));\n    const existing = (await manager.listLibraries()).find((l) => l.name === name);\n    const lib =\n      existing ??\n      (await manager.addLibrary({\n        name,\n        path: dest,\n        backend: \"git\",\n        backendConfig: { url: entry.url, branch: entry.pin ?? \"main\", authHint: \"ssh\" },\n        ownership: \"reader\",\n      }));\n    // Curated overlay: a `skaile source manifest init` writes a curated\n    // manifest to the local store at `~/.skaile/store/manifests/<slug>.yaml`.\n    // When present, route discovery through it so the curated publisher +\n    // asset inventory win over the upstream repo's raw glob discovery. Keyed by\n    // the collision-free `storeManifestSlug` (matches the init writer + resolver).\n    const overlayFile = path.join(getStoreManifestsDir(), `${storeManifestSlug(entry.url)}.yaml`);\n    const catalog = new LocalCatalogSource(library, lib.id, dest, createFullRegistry(), {\n      sidecarManifestFile: existsSync(overlayFile) ? overlayFile : undefined,\n    });\n    const result = await catalog.sync({ includeDev });\n    await library.syncSource(lib.id);\n    return result;\n  } finally {\n    close();\n  }\n}\n\n/**\n * Auto-sync hook for `skaile search` on an unsynced workspace. Clones/pulls and\n * re-indexes every source declared in the project's `skaile.yaml`, then returns\n * whether the manifest cache may have changed (caller re-queries on `true`).\n *\n * Unlike `source sync`, this degrades gracefully — a clone/pull/index failure is\n * logged and skipped (never `process.exit`) so a failed auto-sync falls back to\n * the \"run sync first\" hint rather than killing the search. Returns `false`\n * (silently, no announce) when no sources are declared. Callers must guard\n * air-gapped mode themselves — this always touches the network.\n */\nexport async function autoSyncForSearch(projectDir: string): Promise<boolean> {\n  const root = findWorkspaceRoot(projectDir);\n  if (!root) return false;\n  if (readProjectSources(path.join(root, workspaceConfigFilename())).length === 0) return false;\n\n  logInfo(\"sources not synced — syncing now…\");\n  const { synced } = await syncProjectSources(projectDir);\n  return synced > 0;\n}\n\n/**\n * Clone-or-pull every source declared in the project's `skaile.yaml`, then\n * refresh its manifest cache. Shared by `autoSyncForSearch` and `skaile update`\n * (the latter offers it behind a confirm) so a re-deploy can see upstream\n * commits — `update` re-deploys against the local source cache, which is\n * otherwise frozen at the commit captured when the source was first cloned.\n *\n * Graceful by design: a clone/pull/index failure for one source is logged and\n * skipped (never `process.exit`), so a single bad remote can't abort the run.\n * Existing clones are advanced with `git pull --ff-only` (no `--depth=1`, unlike\n * the installer's `pullRepo`, so it fast-forwards instead of tripping the\n * shallow-divergence path). Returns a count summary for the caller to report.\n */\nexport async function syncProjectSources(\n  projectDir: string,\n  opts: { dev?: boolean } = {},\n): Promise<{ total: number; synced: number; failed: number }> {\n  const root = findWorkspaceRoot(projectDir) ?? projectDir;\n  const sources = readProjectSources(path.join(root, workspaceConfigFilename()));\n  let synced = 0;\n  let failed = 0;\n  for (const entry of sources) {\n    const slug = sourceShortName(entry.url);\n    const dest = sourceClonePath(sourceCacheKey(entry.url));\n    try {\n      // Quiet git — the sync is a preparatory step; keep progress bars out of\n      // the foreground output (spinner / install result).\n      if (!existsSync(dest)) {\n        mkdirSync(path.dirname(dest), { recursive: true });\n        const args = [\"clone\", entry.url, dest];\n        if (entry.pin) args.splice(1, 0, \"--branch\", entry.pin);\n        const clone = spawnSync(\"git\", args, { stdio: \"ignore\" });\n        if (clone.status !== 0) {\n          logWarn(`${slug}: git clone failed, skipping.`);\n          failed++;\n          continue;\n        }\n      } else {\n        const pull = spawnSync(\"git\", [\"pull\", \"--ff-only\"], { cwd: dest, stdio: \"ignore\" });\n        if (pull.status !== 0) {\n          logWarn(`${slug}: git pull failed, skipping manifest refresh.`);\n          failed++;\n          continue;\n        }\n      }\n      const result = await refreshManifestCache(entry, opts.dev);\n      for (const err of result.errors) logWarn(`${slug}: ${err}`);\n      for (const advisory of result.advisories) logInfo(`${slug}: ${advisory}`);\n      synced++;\n    } catch (err) {\n      logWarn(`${slug}: sync failed — ${err instanceof Error ? err.message : String(err)}`);\n      failed++;\n    }\n  }\n  return { total: sources.length, synced, failed };\n}\n\n/** Remove the libraries-table cache row and (optionally) the clone bytes. */\nasync function dropManifestCache(url: string, purgeClone: boolean): Promise<void> {\n  const name = sourceShortName(url);\n  const { manager, close } = await openLibraryManager();\n  try {\n    const existing = (await manager.listLibraries()).find((l) => l.name === name);\n    if (existing) {\n      await manager.removeLibrary(name, { purge: false });\n    }\n  } finally {\n    close();\n  }\n  if (purgeClone) {\n    const dest = sourceClonePath(sourceCacheKey(url));\n    if (existsSync(dest)) rmSync(dest, { recursive: true, force: true });\n  }\n}\n\nexport function makeSourceCommand(): Command {\n  const cmd = new Command(\"source\").description(\n    \"Manage github sources for the current project (recorded in skaile.yaml)\",\n  );\n\n  // ── source add ──────────────────────────────────────────────────────────\n  cmd\n    .command(\"add <source>\")\n    .description(\n      \"Clone a github repo and register it in this project's skaile.yaml. \" +\n        \"<source> may be a full git URL, an owner/repo shorthand, or a bare \" +\n        \"name (→ git@github.com:skaile-ai/<name>.git).\",\n    )\n    .option(\"--name <slug>\", \"[deprecated] no-op — the source entry stores only the URL\")\n    .option(\"--pin <ref>\", \"Pin a branch, tag, or 40-char SHA\")\n    .option(\"--branch <branch>\", \"[deprecated] alias for --pin\")\n    .option(\"--force\", \"Remove an existing clone and re-clone\", false)\n    .option(\"--dev\", \"Also index dev-only assets under the source's dev_paths\", false)\n    .action(\n      async (\n        source: string,\n        opts: {\n          name?: string;\n          pin?: string;\n          branch?: string;\n          force?: boolean;\n          dev?: boolean;\n        },\n      ) => {\n        const url = normalizeSourceUrl(source);\n        const yamlPath = requireProjectYamlPath();\n\n        // A different URL string that maps to the same cache key (e.g. the\n        // `.git`-suffixed or scp form of an already-registered remote) would\n        // fight over one clone dir. setSource only dedupes exact strings, so\n        // reject the ambiguous collision here instead of silently shadowing.\n        const collision = findCacheKeyCollision(readProjectSources(yamlPath), url);\n        if (collision) {\n          logErr(\n            `\"${url}\" maps to the same cache key (${sourceCacheKey(url)}) as ` +\n              `already-registered \"${collision.url}\". Remove that source first ` +\n              `(skaile source remove) or re-use its exact URL to update it.`,\n          );\n          process.exitCode = 1;\n          return;\n        }\n\n        if (opts.name) {\n          logWarn(\n            \"the --name flag is deprecated; the source entry now stores only the URL \" +\n              \"(the cache slug is derived from it).\",\n          );\n        }\n        const pin = opts.pin ?? opts.branch;\n        const slug = sourceShortName(url);\n        const entry: SourceEntry = { url };\n        if (pin) entry.pin = pin;\n\n        const dest = sourceClonePath(sourceCacheKey(url));\n        const preexisting = existsSync(dest);\n        // Clone/validate the repo BEFORE touching skaile.yaml — a failed clone\n        // (repo not found, bad URL, network error) hard-exits in ensureClone, so\n        // the entry is only ever recorded once the source is known-good.\n        const cloned = ensureClone(entry, { force: opts.force });\n        if (!cloned) {\n          logOk(`Reusing cached clone at ${dest}`);\n        } else if (preexisting) {\n          logOk(`Re-cloned ${url} → ${dest}`);\n        } else {\n          logOk(`Cloned ${url} → ${dest}`);\n        }\n\n        const editor = WorkspaceYamlEditor.load(yamlPath);\n        editor.setSource(entry);\n        editor.save();\n\n        const result = await refreshManifestCache(entry, opts.dev);\n        const failed = indexingHadFailures(result);\n        const indexedMsg = `Indexed ${result.assetsUpdated} of ${result.assetsFound} asset(s) from \"${slug}\".`;\n        if (failed) {\n          logWarn(indexedMsg);\n        } else {\n          logOk(indexedMsg);\n        }\n        for (const err of result.errors) logWarn(err);\n        for (const advisory of result.advisories) logInfo(advisory);\n\n        const legacyHint = legacySourceConfigHint(dest);\n        if (legacyHint) logWarn(legacyHint);\n\n        const where = path.relative(process.cwd(), yamlPath);\n        if (failed) {\n          // The entry IS recorded in skaile.yaml, but indexing did not fully\n          // succeed — don't present it as a clean success.\n          logWarn(\n            `Source \"${slug}\" registered in ${where}, but ${result.errors.length} ` +\n              `asset(s) failed to index (see above). Fix the cause, then re-run ` +\n              `\\`skaile source sync ${slug}\\`.`,\n          );\n          process.exitCode = 1;\n        } else {\n          logOk(`Source \"${slug}\" registered in ${where}.`);\n        }\n      },\n    );\n\n  // ── source list ─────────────────────────────────────────────────────────\n  cmd\n    .command(\"list\")\n    .description(\"List sources registered in this project's skaile.yaml\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (opts: { json?: boolean }) => {\n      const yamlPath = requireProjectYamlPath();\n      const sources = readProjectSources(yamlPath);\n      if (opts.json) return console.log(JSON.stringify(sources, null, 2));\n      if (sources.length === 0) {\n        logInfo(\"No sources in skaile.yaml. Run `skaile source add <git-url>` to register one.\");\n        return;\n      }\n      console.log();\n      console.log(S.heading(\"  Sources\"));\n      for (const s of sources) {\n        const slug = sourceShortName(s.url);\n        const cached = existsSync(sourceClonePath(sourceCacheKey(s.url)))\n          ? \"\"\n          : S.warn(\" (not cached)\");\n        console.log(`  ${S.cmd(slug.padEnd(24))}  ${S.dim(s.url)}${cached}`);\n      }\n      console.log(`\\n  ${S.dim(`${sources.length} source(s)`)}\\n`);\n    });\n\n  // ── source show ─────────────────────────────────────────────────────────\n  cmd\n    .command(\"show <name-or-url>\")\n    .description(\"Show details for a source (matched by URL or derived slug)\")\n    .action(async (key: string) => {\n      const yamlPath = requireProjectYamlPath();\n      const entry = readProjectSources(yamlPath).find((s) => sourceMatchesKey(s, key));\n      if (!entry) {\n        logErr(`No source matching \"${key}\" in ${yamlPath}.`);\n        process.exit(1);\n      }\n      const slug = sourceShortName(entry.url);\n      const clonePath = sourceClonePath(sourceCacheKey(entry.url));\n      console.log(\n        JSON.stringify(\n          {\n            ...entry,\n            slug,\n            clonePath,\n            cached: existsSync(clonePath),\n          },\n          null,\n          2,\n        ),\n      );\n    });\n\n  // ── source remove ───────────────────────────────────────────────────────\n  cmd\n    .command(\"remove <name-or-url>\")\n    .description(\"Remove a source from this project's skaile.yaml (matched by URL or slug)\")\n    .option(\"--purge\", \"Also delete the cached clone from ~/.skaile/cache/sources/\", false)\n    .action(async (key: string, opts: { purge: boolean }) => {\n      const yamlPath = requireProjectYamlPath();\n      const editor = WorkspaceYamlEditor.load(yamlPath);\n      // Resolve to the stored URL (entries are keyed by url in the editor).\n      const match = editor.getSources().find((s) => sourceMatchesKey(s, key));\n      if (!match) {\n        logErr(`No source matching \"${key}\" in ${yamlPath}.`);\n        process.exit(1);\n      }\n      const slug = sourceShortName(match.url);\n      editor.removeSource(match.url);\n      editor.save();\n      await dropManifestCache(match.url, opts.purge);\n      logOk(\n        opts.purge\n          ? `Removed source \"${slug}\" and purged its clone.`\n          : `Removed source \"${slug}\" from skaile.yaml (clone left in ~/.skaile/cache/sources/ — pass --purge to remove it, or run \\`skaile cache clean\\`).`,\n      );\n    });\n\n  // ── source sync ─────────────────────────────────────────────────────────\n  cmd\n    .command(\"sync [name]\")\n    .description(\"Pull upstream changes and refresh the manifest cache\")\n    .option(\"--dev\", \"Also index dev-only assets under each source's dev_paths\", false)\n    .option(\"--all\", \"Sync every source without prompting\", false)\n    .action(async (key: string | undefined, opts: { dev?: boolean; all?: boolean }) => {\n      const yamlPath = requireProjectYamlPath();\n      const sources = readProjectSources(yamlPath);\n      if (sources.length === 0) {\n        logInfo(\"No sources in skaile.yaml.\");\n        return;\n      }\n\n      let targets: SourceEntry[];\n      if (key) {\n        targets = sources.filter((s) => sourceMatchesKey(s, key));\n        if (targets.length === 0) {\n          logInfo(`No source matching \"${key}\".`);\n          return;\n        }\n      } else if (opts.all || sources.length === 1 || !process.stdin.isTTY) {\n        // --all, a single source, or a non-interactive shell: sync everything.\n        targets = sources;\n      } else {\n        const selected = await p.multiselect({\n          message: \"Select sources to sync\",\n          options: sources.map((s) => ({\n            value: s.url,\n            label: sourceShortName(s.url),\n            hint: s.url,\n          })),\n          required: true,\n        });\n        if (p.isCancel(selected)) {\n          p.cancel(\"Cancelled.\");\n          return;\n        }\n        const picked = new Set(selected as string[]);\n        targets = sources.filter((s) => picked.has(s.url));\n      }\n      for (const entry of targets) {\n        const slug = sourceShortName(entry.url);\n        const dest = sourceClonePath(sourceCacheKey(entry.url));\n        if (!existsSync(dest)) {\n          ensureClone(entry);\n          logOk(`${slug}: cloned to ${dest}.`);\n        } else {\n          const pull = spawnSync(\"git\", [\"pull\", \"--ff-only\"], { cwd: dest, stdio: \"inherit\" });\n          if (pull.status !== 0) {\n            logWarn(`${slug}: git pull failed, skipping manifest refresh.`);\n            continue;\n          }\n        }\n        const result = await refreshManifestCache(entry, opts.dev);\n        const failed = indexingHadFailures(result);\n        const indexedMsg = `${slug}: indexed ${result.assetsUpdated} of ${result.assetsFound} asset(s).`;\n        if (failed) {\n          logWarn(indexedMsg);\n          process.exitCode = 1;\n        } else {\n          logOk(indexedMsg);\n        }\n        for (const err of result.errors) logWarn(`${slug}: ${err}`);\n        for (const advisory of result.advisories) logInfo(`${slug}: ${advisory}`);\n        const legacyHint = legacySourceConfigHint(dest);\n        if (legacyHint) logWarn(`${slug}: ${legacyHint}`);\n      }\n    });\n\n  // ── source patch / propose (stubs) ──────────────────────────────────────\n  cmd\n    .command(\"patch <ref>\")\n    .description(\"Extract an asset for editing against the source\")\n    .action((_ref: string) => {\n      logErr(\n        \"`skaile source patch` is scaffolded but not yet wired. \" +\n          \"The patch flow lands in a follow-up PR.\",\n      );\n      process.exit(2);\n    });\n\n  cmd\n    .command(\"propose <ref>\")\n    .description(\"Open a PR with the patch against the source upstream\")\n    .action((_ref: string) => {\n      logErr(\n        \"`skaile source propose` is scaffolded but not yet wired. \" +\n          \"The propose flow lands in a follow-up PR.\",\n      );\n      process.exit(2);\n    });\n\n  // ── source manifest * ───────────────────────────────────────────────────\n  addSourceManifestCommands(cmd);\n\n  return cmd;\n}\n"]}

package/dist/chunk-DOVURNRK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../asset-manager/src/catalog-deployer.ts"],"names":[],"mappings":";;;;;AA2GA,IAAM,uBAAA,GAA0B,CAAA;AAGhC,IAAM,qBAAA,GAAwB,CAAA;AAE9B,IAAI,cAAA;AAEJ,SAAS,GAAA,GAAuC;AAC9C,EAAA,cAAA,KAAmB,aAAa,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,oBAAoB,CAAA;AAC/E,EAAA,OAAO,cAAA;AACT;AAOA,IAAM,2BAAA,GAA8B,mBAAA;AAS7B,IAAM,uBAAA,GAA0B;AAYhC,SAAS,kBAAA,GAA+B;AAC7C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AAC/C,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAW,OAAO,CAAC,2BAA2B,CAAA;AAC1D,EAAA,OAAO,GAAA,CACJ,MAAM,GAAG,CAAA,CACT,IAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,IAAA,EAAM,CAAA,CAC/B,OAAO,CAAC,OAAA,KAAY,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,CACtC,IAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,OAAO,CAAC,CAAA;AACtC;AAYO,SAAS,qBAAA,CACd,SAAA,EACA,SAAA,GAAsB,kBAAA,EAAmB,EAChC;AACT,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAChC,EAAA,OAAO,SAAA,CAAU,IAAA,CAAK,CAAC,GAAA,KAAQ;AAC7B,IAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,IAAA,OAAO,MAAA,KAAW,IAAA,IAAQ,MAAA,CAAO,UAAA,CAAW,OAAO,GAAG,CAAA;AAAA,EACxD,CAAC,CAAA;AACH;AA0BA,eAAsB,gBAAA,CACpB,UACA,IAAA,EACwB;AACxB,EAAA,MAAM,SAAA,GAAY,IAAA,EAAM,SAAA,IAAa,kBAAA,EAAmB;AACxD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,qBAAA;AAC/B,EAAA,IAAI,GAAA,GAAM,QAAQ,QAAQ,CAAA;AAI1B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,EAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA;AACvC,IAAA,IAAI,qBAAA,CAAsB,SAAA,EAAW,SAAS,CAAA,EAAG;AAC/C,MAAA,OAAA,CAAQ,KAAK,SAAS,CAAA;AAAA,IACxB,CAAA,MAAO;AACL,MAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,QAClB,QAAQ,SAAS,CAAA,CAAA;AAAA,QACjB,YAAA,CAAa,MAAM,IAAA,CAAK,SAAS,GAAG,WAAA,EAAY;AAAA,QAChD;AAAA,OACF;AACA,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,SAAS,SAAS,CAAA;AACtD,QAAA,OAAO,SAAA;AAAA,MACT;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA;AAChC,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,SAAS,SAAS,CAAA;AACtD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAA,CAAY,SAAmB,SAAA,EAA2B;AACjE,EAAA,GAAA,EAAI,CAAE,IAAA;AAAA,IACJ,gIAAA;AAAA,IACA,EAAE,SAAS,SAAA;AAAU,GACvB;AACF;AAsBA,eAAsB,kBAAA,CACpB,OACA,OAAA,EAC+C;AAC/C,EAAA,MAAM,EAAE,UAAA,EAAY,SAAA,EAAW,OAAA,EAAQ,GAAI,OAAA;AAE3C,EAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAO,CAAA,cAAA,EAAiB,KAAA,CAAM,IAAI,CAAA,4BAAA,CAAA,EAA0B;AAAA,EACvF;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,EAAY,KAAA,CAAM,WAAW,CAAA;AACrD,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,UAAA,EAAY,UAAU,CAAA;AAE/C,EAAA,MAAM,aAAa,MAAM,iBAAA;AAAA,IACvB,QAAQ,WAAW,CAAA,CAAA;AAAA,IACnB,YAAY;AACV,MAAA,MAAM,KAAK,WAAW,CAAA;AACtB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,sBAAA,EAAyB,WAAW,CAAA,CAAA,EAAG;AAAA,EACzE;AAEA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,EAAW,KAAA,CAAM,IAAI,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,cAAA,CAAe,CAAA,MAAA,EAAS,OAAO,CAAA,CAAA,EAAI,MAAM,KAAA,CAAM,OAAA,EAAS,EAAE,SAAA,EAAW,IAAA,EAAM,CAAC,CAAA;AAGlF,IAAA,MAAM,cAAA;AAAA,MACJ,CAAA,GAAA,EAAM,UAAU,CAAA,IAAA,EAAO,OAAO,CAAA,CAAA;AAAA,MAC9B,MAAM,EAAA,CAAG,UAAA,EAAY,SAAS,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,MACjD,cAAa,GAAI;AAAA,KACnB;AAIA,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAC9C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAM,cAAA;AAAA,QAAe,SAAS,WAAW,CAAA,CAAA;AAAA,QAAI,MAC3C,UAAU,WAAA,EAAa,CAAA;;AAAA,EAA2B,OAAO;AAAA,CAAA,EAAM,MAAM;AAAA,OACvE;AAAA,IACF,CAAA,MAAO;AAIL,MAAA,MAAM,cAAA,CAAe,CAAA,GAAA,EAAM,WAAW,CAAA,CAAA,EAAI,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,IAClF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAA,EAAE;AAAA,EACnF;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAWA,eAAsB,oBAAA,CAAqB,MAAc,SAAA,EAAqC;AAC5F,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,EAAW,IAAI,CAAA;AACpC,EAAA,MAAM,SAAS,MAAM,iBAAA;AAAA,IACnB,QAAQ,OAAO,CAAA,CAAA;AAAA,IACf,YAAY;AACV,MAAA,MAAM,KAAK,OAAO,CAAA;AAClB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,cAAA;AAAA,IACJ,SAAS,OAAO,CAAA,CAAA;AAAA,IAChB,MAAM,GAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IAClD,cAAa,GAAI;AAAA,GACnB;AACA,EAAA,OAAO,IAAA;AACT;AAcA,eAAsB,SAAA,CACpB,SACA,OAAA,EACuB;AACvB,EAAA,MAAM,MAAA,GAAuB,EAAE,QAAA,EAAU,EAAC,EAAG,SAAS,EAAC,EAAG,MAAA,EAAQ,EAAC,EAAE;AAErE,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,MAAA,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,EAAE,CAAA;AAC5B,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,CAAA,GAAI,MAAM,kBAAA,CAAmB,KAAA,EAAO,OAAO,CAAA;AACjD,IAAA,IAAI,EAAE,OAAA,EAAS;AACb,MAAA,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,KAAA,CAAM,EAAE,CAAA;AAAA,IAC/B,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,EAAG,KAAA,CAAM,EAAE,CAAA,EAAA,EAAK,CAAA,CAAE,KAAK,CAAA,CAAE,CAAA;AAAA,IAC9C;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAeO,SAAS,iBAAA,CACd,MACA,UAAA,EAC2F;AAC3F,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAkC;AAC3D,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI,EAAE,IAAA,KAAS,OAAA,eAAsB,GAAA,CAAI,CAAA,CAAE,MAAM,CAAC,CAAA;AAAA,EACpD;AAEA,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,eAAA,IAAmB,EAAC,EAAG;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACnC,IAAA,IAAI,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA;AAAA,SACzB,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EACxB;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,eAAA,IAAmB,EAAC,EAAG;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACnC,IAAA,IAAI,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA;AAAA,EAEhC;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAU,OAAA,EAAQ;AACvC","file":"chunk-DOVURNRK.js","sourcesContent":["/**\n * Platform-triggered asset deployment.\n *\n * Takes catalog entries (with source_path relative to ai-assets/) and deploys\n * them to a session's .claude/skills/ directory. Handles skill context injection\n * and catalog priority-based name resolution.\n */\n\nimport { cp, mkdir, rm, stat, writeFile } from \"node:fs/promises\";\nimport { join, resolve, sep } from \"node:path\";\nimport { fsDeadlineMs, tryWithFsDeadline, withFsDeadline } from \"@skaile/workspaces/core\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\n// ---------------------------------------------------------------------------\n// Types (formerly in catalog-compiler.ts, inlined after tear-out in Task 1.5)\n// ---------------------------------------------------------------------------\n\n/**\n * A single user-facing input parameter declared in a SKILL.md.\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface InputSpec {\n  /** Input parameter key used in skill invocation. */\n  key: string;\n  /** Whether the input must be provided before running the skill. */\n  required?: boolean;\n  /** Question string shown to the user when collecting this input. */\n  prompt?: string;\n  /** Short display label for UI forms. */\n  label?: string;\n  /** Input data type hint (e.g. `\"string\"`, `\"number\"`, `\"file\"`). */\n  type?: string;\n  /** Additional guidance text shown alongside the input field. */\n  hint?: string;\n}\n\n/**\n * A compiled catalog entry (skill or flow).\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface CatalogEntryCompiled {\n  /** Unique ID in `domain/name` form (e.g. `skaileup-conceptualization/cf_overview`). */\n  id: string;\n  /** Asset kind. */\n  kind: \"skill\" | \"flow\";\n  /** Human-readable asset name. */\n  name: string;\n  /** One-line description. */\n  description: string;\n  /** Semantic version string. */\n  version: string;\n  /** Maturity stage. */\n  stage: \"alpha\" | \"beta\" | \"stable\";\n  /** Searchable keywords. */\n  keywords: string[];\n  /** User-facing input specifications. */\n  inputs: InputSpec[];\n  /** Domain directory name. */\n  source_domain: string;\n  /** Asset path relative to assetsRoot. */\n  source_path: string;\n  /** Optional icon identifier. */\n  icon?: string;\n  /** Flow-only: required skill names. */\n  required_skills?: string[];\n  /** Flow-only: optional skill names. */\n  optional_skills?: string[];\n}\n\n/**\n * Options controlling how platform-triggered skill deployment is performed.\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface DeployFromCatalogOptions {\n  /** Root directory of ai-assets (where `source_path` in catalog entries is relative to). */\n  assetsRoot: string;\n  /** Target directory for deployed skills (e.g. `/workspace/.claude/skills/`). */\n  skillsDir: string;\n  /** Optional context markdown appended to the deployed skill directory as `CONTEXT.md`. */\n  context?: string;\n}\n\n/**\n * Result of a platform-triggered batch skill deployment.\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface DeployResult {\n  /** IDs of catalog entries successfully deployed. */\n  deployed: string[];\n  /** IDs of catalog entries skipped (non-skill kinds). */\n  skipped: string[];\n  /** Error messages for entries that could not be deployed. */\n  errors: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Workspace-mount awareness\n// ---------------------------------------------------------------------------\n\n/**\n * Multiplier applied to the base filesystem deadline for whole-tree operations\n * (recursive copy / remove), which legitimately outlast a single `stat`.\n */\nconst TREE_OP_DEADLINE_FACTOR = 4;\n\n/** Default number of parent levels {@link findAiAssetsRoot} inspects. */\nconst AI_ASSETS_WALK_LEVELS = 6;\n\nlet deployerLogger: ReturnType<typeof createLogger> | undefined;\n\nfunction log(): ReturnType<typeof createLogger> {\n  deployerLogger ??= createLogger({ kind: \"runner\", subkind: \"catalog-deployer\" });\n  return deployerLogger;\n}\n\n/**\n * Where the agent container binds its rclone FUSE mount. Nothing under this\n * path is a safe place to read an asset tree from: the mount is remote\n * (SharePoint / OneDrive / WebDAV) and can wedge indefinitely.\n */\nconst DEFAULT_WORKSPACE_MOUNT_DIR = \"/skaile/workspace\";\n\n/**\n * Env override for the workspace-mount path(s), comma-separated.\n *\n * Set it when the runner binds the mount somewhere other than\n * {@link DEFAULT_WORKSPACE_MOUNT_DIR}; set it to the empty string to disable\n * the guard entirely (single-machine dev, where nothing is a network mount).\n */\nexport const WORKSPACE_MOUNT_ENV_VAR = \"SKAILE_WORKSPACE_MOUNT_DIR\";\n\n/**\n * Resolve the directories treated as network mounts.\n *\n * Read per call rather than cached: the runner mutates `process.env` while\n * wiring a session, so a module-load snapshot would pin a pre-configuration\n * value.\n *\n * @returns Absolute mount paths; empty when the guard is disabled.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport function workspaceMountDirs(): string[] {\n  const raw = process.env[WORKSPACE_MOUNT_ENV_VAR];\n  if (raw === undefined) return [DEFAULT_WORKSPACE_MOUNT_DIR];\n  return raw\n    .split(\",\")\n    .map((segment) => segment.trim())\n    .filter((segment) => segment.length > 0)\n    .map((segment) => resolve(segment));\n}\n\n/**\n * Is `candidate` at, or inside, one of the known workspace mount paths?\n *\n * Pure path arithmetic — deliberately no filesystem access, because the whole\n * point is to decide *before* touching a path that might be unresponsive.\n *\n * @param candidate - Path to test.\n * @param mountDirs - Mount roots; defaults to {@link workspaceMountDirs}.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport function isUnderWorkspaceMount(\n  candidate: string,\n  mountDirs: string[] = workspaceMountDirs(),\n): boolean {\n  const target = resolve(candidate);\n  return mountDirs.some((dir) => {\n    const root = resolve(dir);\n    return target === root || target.startsWith(root + sep);\n  });\n}\n\n/**\n * Walk upward from `startDir` looking for an `ai-assets/` directory.\n *\n * Two properties matter beyond \"find the folder\":\n *\n * 1. **Never synchronous.** The walk probes up to six directories; any one of\n *    them can be on a FUSE mount, and the former `existsSync` chain blocked the\n *    event loop on the first unresponsive probe. Each probe is now awaited and\n *    deadline-bounded, so a wedged mount costs one skipped candidate.\n * 2. **Never resolves onto a mount.** A hit under the workspace mount is\n *    skipped with a warning rather than returned: accepting it would wire every\n *    later skill deploy — a recursive copy — to a remote filesystem. The walk\n *    continues upward, so a legitimate `ai-assets/` in a parent still wins.\n *\n * Only a **directory** counts. An `ai-assets` file would otherwise be returned\n * as a root and every later `join(root, source_path)` would fail with ENOTDIR.\n *\n * @param startDir - Directory to start from (typically the project dir).\n * @param opts - `levels` caps the upward walk; `mountDirs` overrides the mount\n *   roots (defaults to {@link workspaceMountDirs}).\n * @returns Absolute path to the `ai-assets/` directory, or `null` if none is\n *   reachable within `levels`.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function findAiAssetsRoot(\n  startDir: string,\n  opts?: { levels?: number; mountDirs?: string[] },\n): Promise<string | null> {\n  const mountDirs = opts?.mountDirs ?? workspaceMountDirs();\n  const levels = opts?.levels ?? AI_ASSETS_WALK_LEVELS;\n  let dir = resolve(startDir);\n  // Every level of a `/skaile/workspace/...` start dir is under the mount, so\n  // an unconditional warn would fire once per level for one lookup. Collect and\n  // report once — the operator needs the fact, not six copies of it.\n  const refused: string[] = [];\n\n  for (let i = 0; i < levels; i++) {\n    const candidate = join(dir, \"ai-assets\");\n    if (isUnderWorkspaceMount(candidate, mountDirs)) {\n      refused.push(candidate);\n    } else {\n      const isDir = await tryWithFsDeadline(\n        `stat ${candidate}`,\n        async () => (await stat(candidate)).isDirectory(),\n        false,\n      );\n      if (isDir) {\n        if (refused.length > 0) warnRefused(refused, mountDirs);\n        return candidate;\n      }\n    }\n    const parent = resolve(dir, \"..\");\n    if (parent === dir) break; // filesystem root — nothing further up\n    dir = parent;\n  }\n  if (refused.length > 0) warnRefused(refused, mountDirs);\n  return null;\n}\n\n/** Single warning for every `ai-assets` candidate skipped for sitting on a mount. */\nfunction warnRefused(refused: string[], mountDirs: string[]): void {\n  log().warn(\n    \"findAiAssetsRoot refused candidates under a workspace mount — deploying skills from a network mount can stall the session\",\n    { refused, mountDirs },\n  );\n}\n\n/**\n * Deploy a single catalog entry to the session skills directory.\n *\n * Copies the entire skill source directory into `skillsDir/<entry.name>/`.\n * If `context` is provided, a separate `CONTEXT.md` is written alongside\n * `SKILL.md` so the source file is never modified.\n *\n * Only `skill` entries are deployable; other kinds return an error.\n *\n * **Async by necessity.** This runs from the `session_init` command handler\n * with the WebSocket live, and both `assetsRoot` and `skillsDir` can sit on a\n * network mount. The former `cpSync`/`rmSync` pair parked the event loop for\n * the whole copy; every call is now awaited and deadline-bounded, so an\n * unresponsive mount fails one deployment instead of the session.\n *\n * @param entry - Compiled catalog entry to deploy.\n * @param options - Deployment target and optional context.\n * @returns `{ success: true }` on success, `{ success: false, error }` on failure.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function deployCatalogEntry(\n  entry: CatalogEntryCompiled,\n  options: DeployFromCatalogOptions,\n): Promise<{ success: boolean; error?: string }> {\n  const { assetsRoot, skillsDir, context } = options;\n\n  if (entry.kind !== \"skill\") {\n    return { success: false, error: `Cannot deploy ${entry.kind} directly — only skills` };\n  }\n\n  const sourcePath = join(assetsRoot, entry.source_path);\n  const skillMdPath = join(sourcePath, \"SKILL.md\");\n\n  const hasSkillMd = await tryWithFsDeadline(\n    `stat ${skillMdPath}`,\n    async () => {\n      await stat(skillMdPath);\n      return true;\n    },\n    false,\n  );\n  if (!hasSkillMd) {\n    return { success: false, error: `SKILL.md not found at ${skillMdPath}` };\n  }\n\n  const destDir = join(skillsDir, entry.name);\n\n  try {\n    await withFsDeadline(`mkdir ${destDir}`, () => mkdir(destDir, { recursive: true }));\n\n    // Copy the entire skill directory\n    await withFsDeadline(\n      `cp ${sourcePath} -> ${destDir}`,\n      () => cp(sourcePath, destDir, { recursive: true }),\n      fsDeadlineMs() * TREE_OP_DEADLINE_FACTOR,\n    );\n\n    // Write context to a separate CONTEXT.md — never modify the original SKILL.md.\n    // The agent discovers both files in the skill directory.\n    const contextPath = join(destDir, \"CONTEXT.md\");\n    if (context) {\n      await withFsDeadline(`write ${contextPath}`, () =>\n        writeFile(contextPath, `# Additional Context\\n\\n${context}\\n`, \"utf8\"),\n      );\n    } else {\n      // `force: true` makes this a single call: a stale CONTEXT.md is removed,\n      // an absent one is a no-op. The former existsSync probe only added a\n      // second trip to the same possibly-wedged mount.\n      await withFsDeadline(`rm ${contextPath}`, () => rm(contextPath, { force: true }));\n    }\n  } catch (err) {\n    return { success: false, error: err instanceof Error ? err.message : String(err) };\n  }\n\n  return { success: true };\n}\n\n/**\n * Remove a deployed skill directory from the session skills directory.\n *\n * @param name - Skill name (directory basename under `skillsDir`).\n * @param skillsDir - Absolute path to the session skills directory.\n * @returns `true` if the skill was found and removed; `false` if it was not\n *   deployed, or if the directory could not be reached within the deadline.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function undeployCatalogEntry(name: string, skillsDir: string): Promise<boolean> {\n  const destDir = join(skillsDir, name);\n  const exists = await tryWithFsDeadline(\n    `stat ${destDir}`,\n    async () => {\n      await stat(destDir);\n      return true;\n    },\n    false,\n  );\n  if (!exists) return false;\n  await withFsDeadline(\n    `rm -r ${destDir}`,\n    () => rm(destDir, { recursive: true, force: true }),\n    fsDeadlineMs() * TREE_OP_DEADLINE_FACTOR,\n  );\n  return true;\n}\n\n/**\n * Deploy multiple catalog entries in a single batch operation.\n *\n * Non-skill entries (flows, agents, etc.) are automatically skipped and\n * recorded in `result.skipped`. Deployment failures are collected in\n * `result.errors` without aborting the rest of the batch.\n *\n * @param entries - Compiled catalog entries to deploy.\n * @param options - Deployment target and optional context.\n * @returns Aggregated {@link DeployResult} with deployed, skipped, and error lists.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function deployAll(\n  entries: CatalogEntryCompiled[],\n  options: DeployFromCatalogOptions,\n): Promise<DeployResult> {\n  const result: DeployResult = { deployed: [], skipped: [], errors: [] };\n\n  for (const entry of entries) {\n    if (entry.kind !== \"skill\") {\n      result.skipped.push(entry.id);\n      continue;\n    }\n\n    // Serial on purpose: concurrent recursive copies onto one mount multiply\n    // the queue depth on the exact resource that is already the bottleneck.\n    const r = await deployCatalogEntry(entry, options);\n    if (r.success) {\n      result.deployed.push(entry.id);\n    } else {\n      result.errors.push(`${entry.id}: ${r.error}`);\n    }\n  }\n\n  return result;\n}\n\n/**\n * Resolve a flow's skill dependencies from the full catalog entry list.\n *\n * Partitions `flow.required_skills` and `flow.optional_skills` into resolved\n * entries and a list of names that could not be found. Missing optional skills\n * are silently ignored (they do not appear in `missing`).\n *\n * @param flow - Compiled flow entry whose skill dependencies should be resolved.\n * @param allEntries - Full set of compiled catalog entries to search.\n * @returns Object containing resolved `required` entries, resolved `optional` entries,\n *   and `missing` skill names that were listed as required but not found.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport function resolveFlowSkills(\n  flow: CatalogEntryCompiled,\n  allEntries: CatalogEntryCompiled[],\n): { required: CatalogEntryCompiled[]; optional: CatalogEntryCompiled[]; missing: string[] } {\n  const skillsByName = new Map<string, CatalogEntryCompiled>();\n  for (const e of allEntries) {\n    if (e.kind === \"skill\") skillsByName.set(e.name, e);\n  }\n\n  const required: CatalogEntryCompiled[] = [];\n  const optional: CatalogEntryCompiled[] = [];\n  const missing: string[] = [];\n\n  for (const name of flow.required_skills ?? []) {\n    const entry = skillsByName.get(name);\n    if (entry) required.push(entry);\n    else missing.push(name);\n  }\n\n  for (const name of flow.optional_skills ?? []) {\n    const entry = skillsByName.get(name);\n    if (entry) optional.push(entry);\n    // Optional skills don't count as missing\n  }\n\n  return { required, optional, missing };\n}\n"]}

package/dist/chunk-HUNZYTOS.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../secrets/src/lifecycle.ts","../secrets/src/providers/env.ts","../secrets/src/providers/local.ts","../secrets/src/router.ts","../secrets/src/index.ts"],"names":["provider"],"mappings":";;;;;;;;AAuCO,IAAM,6BAAN,MAAiC;AAAA,EAC9B,MAAA;AAAA;AAAA;AAAA;AAAA,EAKR,WAAA,CAAY,QAAuB,OAAA,EAA8C;AAC/E,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,aAAA,EAA+C;AAGnE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA;AAC3C,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,IACtD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAkB,OAAO,sBAAA,EAAuB;AAAA,IACrF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,aAAA,EAAyC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AACzC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACnDA,IAAM,qBAAA,mBAAwB,IAAI,IAAA,CAAK,CAAC,CAAA;AAEjC,IAAM,qBAAN,MAAqD;AAAA,EACjD,EAAA,GAAK,KAAA;AAAA,EAEd,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvC;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,MAAA,EAAoB,KAAA,EAAyC;AACzF,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,aAAa,IAAA,EAA6B;AAC9C,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAClC,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AAKA,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,qBAAA;AAAA,MACX,SAAA,EAAW,qBAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;AClDA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,aAAA,GAAgB,QAAA;AAEtB,IAAM,gBAAA,GAAmB,gBAAA;AACzB,IAAM,gBAAA,GAAmB,YAAA;AAGzB,IAAM,cAAA,GAAiB,2BAAA;AAoBvB,SAAS,eAAA,CAAgB,YAAoB,IAAA,EAAsB;AACjE,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,iBAAA,EAAmB,YAAY,aAAa,CAAA;AACzF;AAEA,SAAS,oBAAA,GAA+B;AAEtC,EAAA,OAAO,UAAa,EAAA,CAAA,QAAA,EAAU,CAAA,CAAA,EAAO,EAAA,CAAA,QAAA,GAAW,QAAQ,CAAA,CAAA;AAC1D;AAGA,SAAS,eAAe,UAAA,EAA4B;AAClD,EAAA,OAAc,kBAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACpE;AAMA,SAAS,UAAU,GAAA,EAAqB;AACtC,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC1E;AAMA,SAAS,OAAA,CAAQ,MAAkB,GAAA,EAAqB;AACtD,EAAA,MAAM,EAAA,GAAY,mBAAY,SAAS,CAAA;AACvC,EAAA,MAAM,MAAA,GAAgB,sBAAe,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC3F,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,EAAA,EAAI,OAAA,EAAS,SAAS,CAAC,CAAA;AAC/C;AAEA,SAAS,OAAA,CAAQ,MAAc,GAAA,EAAqB;AAClD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,CAAA,EAAG,SAAS,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,YAAY,eAAe,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,QAAA,CAAS,SAAA,GAAY,eAAe,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAkB,wBAAiB,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC/F,EAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACtE;AAMO,IAAM,uBAAN,MAAuD;AAAA,EACnD,EAAA,GAAK,OAAA;AAAA,EACN,UAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAC3B,IAAA,GAAsB,IAAA;AAAA,EACtB,QAAA,GAAwB,SAAA;AAAA,EAEhC,YAAY,UAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA,IAAmB,IAAA,CAAA,IAAA,CAAK,eAAA,IAAmB,SAAS,CAAA;AAAA,EACxE;AAAA;AAAA,EAIQ,SAAA,GAAkB;AACxB,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,EAAG;AACnC,MAAG,EAAA,CAAA,SAAA,CAAU,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,gBAAA,GAA2B;AACjC,IAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,OAAU,gBAAa,QAAQ,CAAA;AAAA,IACjC;AACA,IAAA,MAAM,IAAA,GAAc,mBAAY,WAAW,CAAA;AAC3C,IAAG,iBAAc,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAA,GAA2B;AACvC,IAAA,IAAI,KAAK,SAAA,EAAW;AAEpB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,gBAAA,EAAiB;AAGlC,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,IAAA,CAAK,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,EAAE,IAAA,EAAK;AAAA,IAC9D,CAAA,MAAO;AAEL,MAAA,IAAA,CAAK,QAAA,GAAY,MAAM,IAAA,CAAK,mBAAA,KAAyB,UAAA,GAAa,SAAA;AAClE,MAAG,iBAAc,YAAA,EAAc,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,wBAAA,CAAyB,KAAK,QAAQ,CAAA;AACpE,IAAA,IAAA,CAAK,SAAA,GAAY,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAAA,EACxD;AAAA,EAEA,MAAc,mBAAA,GAAwC;AACpD,IAAA,IAAI;AAGF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AACxE,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,GAAgB,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACjD,QAAA,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAA,EAAkB,gBAAA,EAAkB,MAAM,CAAA;AAAA,MACrE;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,yBAAyB,QAAA,EAAwC;AAC7E,IAAA,QAAQ,QAAA;AAAU,MAChB,KAAK,UAAA,EAAY;AACf,QAAA,IAAI;AAGF,UAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AAC1E,UAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,QACrB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,QAAA,IAAI,aAAA,EAAe;AAEjB,UAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,UAAA,IAAO,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,YAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC7D,YAAA,IAAI,cAAA,CAAe,aAAa,CAAA,KAAM,UAAA,EAAY;AAChD,cAAA,MAAM,IAAI,YAAA;AAAA,gBACR,mBAAmB,cAAc,CAAA,kFAAA,CAAA;AAAA,gBAEjC;AAAA,eACF;AAAA,YACF;AAAA,UACF;AACA,UAAA,OAAO,aAAA;AAAA,QACT;AAIA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,6BAAA,EAAgC,cAAc,CAAA,8CAAA,EACR,cAAc,CAAA,MAAA,CAAA;AAAA,UACpD;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,SAAA;AACH,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AACE,QAAA,OAAO,oBAAA,EAAqB;AAAA;AAChC,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CAAe,QAAA,EAAuB,UAAA,EAAoC;AAC9E,IAAA,IAAA,CAAK,SAAA,EAAU;AAIf,IAAA,MAAM,mBAAA,GAAsB,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEpE,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,sDAAsD,cAAc,CAAA,CAAA,CAAA;AAAA,UACpE;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC/C,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,wBAAA,CAAyB,OAAA,EAAS,2BAA2B,CAAA;AAAA,MACzE;AAAA,IACF;AAOA,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AACnC,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,KAAK,SAAA,EAAU;AACrB,MAAA,MAAM,SAAS,IAAA,CAAK,SAAA;AAGpB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,MAAA,MAAM,aAAA,GACJ,QAAA,KAAa,YAAA,GACT,mBAAA,GACA,QAAA,KAAa,UAAA,GACX,MAAM,IAAA,CAAK,wBAAA,CAAyB,UAAU,CAAA,GAC9C,oBAAA,EAAqB;AAC7B,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,aAAA,EAAe,IAAI,CAAA;AAOlD,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,QAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AACtC,UAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AAC7C,UAAG,iBAAc,QAAA,EAAU,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,QACzD,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,QACrB;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sEACK,MAAA,CAAO,MAAM,eAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,mFAAA;AAAA,SAEpD;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,MAAG,EAAA,CAAA,aAAA,CAAc,YAAY,cAAA,CAAe,mBAAoB,GAAG,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAG,iBAAc,YAAA,EAAc,QAAA,EAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AACxD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,cAAA,GAA8B;AAC5B,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,OAAU,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAA,CAAE,IAAA,EAAK;AAAA,IACrD;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA,EAIQ,YAAY,GAAA,EAAqB;AACvC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,IAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,aAAa,GAAA,EAAqB;AACxC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,UAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,SAAS,GAAA,EAAqB;AACpC,IAAA,OAAY,UAAK,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,YAAA,CAAa,GAAG,CAAC,CAAA;AAAA,EAC1D;AAAA,EAEQ,YAAA,GAAyB;AAC/B,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,SAAU,EAAC;AAC7C,IAAA,OAAU,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACzE;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,IAAA,CAAK,SAAU,CAAA;AAG/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC1D,QAAA,IAAA,CAAK,cAAA,GAAA,iBAAiB,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAC7C,QAAG,EAAA,CAAA,aAAA,CAAc,UAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,MAClE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,WAAW,SAAS,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,EAAO,IAAA,CAAK,SAAU,CAAA;AAChD,IAAG,iBAAc,QAAA,EAAU,SAAA,EAAW,EAAE,IAAA,EAAM,KAAO,CAAA;AAGrD,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,GAAA;AAAA,MACA,SAAA,EAAW,SAAS,SAAA,IAAa,GAAA;AAAA,MACjC,SAAA,EAAW,GAAA;AAAA,MACX,cAAA,EAAgB,GAAA;AAAA,MAChB,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,IAAA,CAAK,QAAA,KAAa,EAAC;AAAA,MACpD,GAAI,IAAA,EAAM,UAAA,GACN,EAAE,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY,KACvE;AAAC,KACP;AACA,IAAG,EAAA,CAAA,aAAA,CAAc,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAG,cAAW,QAAQ,CAAA;AACtB,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAG,cAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAA,CAAK,SAAA,EAAU;AAEf,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,YAAY,CAAC,CAAA;AACxF,IAAA,IAAI,OAAiB,EAAC;AACtB,IAAA,KAAA,MAAW,MAAM,SAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,UAAA,EAAY,EAAE,CAAA,EAAG,OAAO,CAAC,CAAA;AAChF,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,MAClC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,SAAA,EAAU;AAErB,MAAA,MAAM,UAAU,CAAA,OAAA,EAAiB,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AAC/D,MAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,SAAS,CAAA;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,aAAa,OAAO,CAAA;AAC/B,MAAA,IAAI,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACnD;AACA,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAW,IAAA,CAAK,GAAA,KAAQ,KAAA,EAAM;AAAA,IACnD,SAAS,CAAA,EAAG;AACV,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,QACxB,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC;AAAA,OAClD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,GAAA,EAAK,IAAI,GAAA,IAAO,GAAA;AAAA,QAChB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,gBAAgB,GAAA,CAAI,cAAA,GAAiB,IAAI,IAAA,CAAK,GAAA,CAAI,cAAc,CAAA,GAAI,MAAA;AAAA,QACpE,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAU,YAAS,QAAQ,CAAA;AACjC,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,KAAA;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;;;ACvZO,IAAM,gBAAN,MAAoB;AAAA,EACjB,SAAA,uBAAgB,GAAA,EAA8B;AAAA,EAC9C,MAAA;AAAA,EACA,QAAqB,EAAC;AAAA;AAAA,EAG9B,eAAA;AAAA,EACA,cAAA;AAAA,EAEA,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA,EAIA,SAAS,QAAA,EAAkC;AACzC,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC1C;AAAA,EAEA,WAAW,EAAA,EAAkB;AAC3B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,EAC1B;AAAA,EAEA,aAAA,GAA0B;AACxB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAA,EAClC;AAAA;AAAA,EAIA,QAAQ,IAAA,EAAuB;AAC7B,IAAA,IAAA,CAAK,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACtB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,SAAA,EAA4C,UAAA,EAA0B;AAC9F,IAAA,MAAM,KAAA,GAA4B;AAAA,MAChC,cAAA,EAAgB,GAAA;AAAA,MAChB,SAAA;AAAA,MACA,WAAA,EAAa,UAAA;AAAA,MACb,mBAAmB,IAAA,CAAK,eAAA;AAAA,MACxB,kBAAkB,IAAA,CAAK,cAAA;AAAA,MACvB,SAAA,sBAAe,IAAA;AAAK,KACtB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIQ,QAAQ,GAAA,EAA+B;AAE7C,IAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO;AACpC,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,MAAMA,SAAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,KAAK,WAAW,CAAA;AACpD,UAAA,IAAIA,WAAU,OAAOA,SAAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,KAAK,MAAA,CAAO,gBAAA;AAAA,QACZ,CAAA,uCAAA,EAA0C,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,UAAU,GAAG,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,IAAI,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,QAAA,CAAS,EAAE,CAAA;AACpC,IAAA,OAAO,QAAA,CAAS,aAAa,GAAG,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AAIxD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,CAAS,EAAE,CAAA;AAClC,IAAA,OAAO,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAA,EAAY,QAAA,CAAS,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,CAAS,YAAY,GAAG,CAAA;AAAA,EACjC;AAAA,EAEA,gBAAgB,UAAA,EAAkD;AAChE,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,EAAU,iBAAgB,IAAK,IAAA;AAAA,EACxC;AAAA,EAEA,MAAM,eACJ,UAAA,EAC8D;AAC9D,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,UAAA,EAAa,EAAE,CAAA,gBAAA,CAAA,EAAmB;AAAA,IAC/D;AACA,IAAA,OAAO,SAAS,cAAA,EAAe;AAAA,EACjC;AACF;;;ACvNO,IAAM,OAAA,GAAU","file":"chunk-HUNZYTOS.js","sourcesContent":["/**\n * CredentialLifecycleService — manages OAuth token refresh outside the SecretsRouter.\n *\n * Works with opaque token blobs stored via the {@link SecretsRouter}; providers remain\n * OAuth-unaware. Phase 1 ships non-OAuth paths (always returns `not_applicable`).\n * Full proactive OAuth refresh with expiry checking ships in Phase 3.4.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\n\nimport type { SecretsRouter } from \"./router.js\";\n\n/**\n * Configuration for {@link CredentialLifecycleService}.\n *\n * Controls how aggressively the service proactively refreshes credentials before they expire.\n * The default lead time is 300 seconds (5 minutes).\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface CredentialLifecycleConfig {\n  /** How far before expiry to trigger a proactive refresh (seconds). */\n  refreshLeadTimeSec: number;\n}\n\n/**\n * Result returned by {@link CredentialLifecycleService.refreshIfNeeded}.\n *\n * The `reason` discriminant indicates why a refresh did or did not occur.\n * An `error` string is present only when `reason` is `refresh_failed`.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface RefreshResult {\n  refreshed: boolean;\n  reason: \"not_applicable\" | \"still_valid\" | \"refreshed\" | \"refresh_failed\";\n  error?: string;\n}\n\nexport class CredentialLifecycleService {\n  private router: SecretsRouter;\n\n  // `_config` is accepted for signature stability but not stored yet: Phase 1\n  // ships no OAuth refresh, so there is nothing to configure. Phase 3.4 will\n  // store and read `refreshLeadTimeSec` when proactive refresh lands.\n  constructor(router: SecretsRouter, _config?: Partial<CredentialLifecycleConfig>) {\n    this.router = router;\n  }\n\n  /**\n   * Attempt to refresh a credential if needed.\n   * Phase 1: always returns not_applicable (no OAuth support yet).\n   */\n  async refreshIfNeeded(credentialRef: string): Promise<RefreshResult> {\n    // Phase 1: no OAuth refresh implemented.\n    // The credential exists and is valid as-is (static secrets, env vars, etc.)\n    try {\n      await this.router.getMetadata(credentialRef);\n      return { refreshed: false, reason: \"not_applicable\" };\n    } catch {\n      return { refreshed: false, reason: \"refresh_failed\", error: \"Credential not found\" };\n    }\n  }\n\n  /**\n   * Check if a credential is still valid (not expired).\n   * Phase 1: always returns true for non-OAuth credentials.\n   */\n  async isValid(credentialRef: string): Promise<boolean> {\n    try {\n      await this.router.getSecret(credentialRef);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","/**\n * EnvSecretsProvider — read-only provider that resolves secrets from environment variables.\n *\n * Refs are expected to be plain env var names (e.g. `DATABASE_URL`). The provider is\n * always available with zero configuration and requires no encryption or keychain access.\n * `setSecret` and `deleteSecret` always throw `SecretAccessDeniedError` because\n * environment variables are managed externally to the running process.\n *\n * @docLink packages/secrets/concepts#env-secrets-provider\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { SecretAccessDeniedError, SecretNotFoundError } from \"@skaile/workspaces/plugins\";\n\n/**\n * Sentinel timestamp for env secrets, which have no real created/updated time.\n * The Unix epoch is unambiguously not \"now\", so consumers can recognise it as\n * \"unknown\" rather than treating it as a genuine recent timestamp.\n */\nconst ENV_UNKNOWN_TIMESTAMP = new Date(0);\n\nexport class EnvSecretsProvider implements ISecretsProvider {\n  readonly id = \"env\";\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    return new TextEncoder().encode(value);\n  }\n\n  async setSecret(_ref: string, _value: Uint8Array, _opts?: SetSecretOptions): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async deleteSecret(_ref: string): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    let keys = Object.keys(process.env);\n    if (filter?.prefix) {\n      keys = keys.filter((k) => k.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      keys = keys.slice(0, filter.limit);\n    }\n    return keys;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    return { ok: true, latencyMs: 0 };\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    // Env vars carry no creation/modification time. `SecretMetadata` requires\n    // both fields, so use the Unix epoch as a documented \"unknown\" sentinel\n    // rather than `new Date()`, which would falsely imply the secret was just\n    // created/updated. The read-only scope summary already signals the source.\n    return {\n      ref,\n      createdAt: ENV_UNKNOWN_TIMESTAMP,\n      updatedAt: ENV_UNKNOWN_TIMESTAMP,\n      scopeSummary: \"environment variable (read-only)\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * LocalSecretsProvider — AES-256-GCM encrypted file-blob storage at `~/.skaile/secrets/`.\n *\n * Each secret is stored as a separate `.enc` file named by the SHA-256 hash of the ref\n * (collision-free, filesystem-safe). A companion `.meta.json` stores the original ref,\n * timestamps, and optional user metadata. The master key is derived via PBKDF2-SHA-512\n * from one of three {@link KeyStrategy} sources: OS keychain (keytar), a passphrase from\n * `SKAILE_SECRETS_PASSPHRASE`, or a machine-derived passphrase as last resort.\n * Switching strategies re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\nimport { globalSkaileDir } from \"@skaile/workspaces/core\";\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport {\n  ProviderUnavailableError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\nconst KEY_LENGTH = 32;\nconst PBKDF2_ITERATIONS = 100_000;\nconst PBKDF2_DIGEST = \"sha512\";\n\nconst KEYCHAIN_SERVICE = \"skaile-secrets\";\nconst KEYCHAIN_ACCOUNT = \"master-key\";\n\n/** Env var that provides the passphrase at runtime (never stored on disk). */\nconst PASSPHRASE_ENV = \"SKAILE_SECRETS_PASSPHRASE\";\n\n/**\n * Master key derivation strategy used by {@link LocalSecretsProvider}.\n *\n * - `keychain` — OS keychain (via keytar); most secure, requires keytar to be installed.\n * - `passphrase` — PBKDF2 from `SKAILE_SECRETS_PASSPHRASE` env var; portable across machines.\n * - `machine` — deterministic from hostname + username; least secure, last-resort fallback.\n *\n * The active strategy is persisted in `~/.skaile/secrets/.key-strategy`. Switching strategies\n * re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\nexport type KeyStrategy = \"keychain\" | \"passphrase\" | \"machine\";\n\n// ---------------------------------------------------------------------------\n// Key derivation\n// ---------------------------------------------------------------------------\n\nfunction deriveMasterKey(passphrase: string, salt: Buffer): Buffer {\n  return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);\n}\n\nfunction getMachinePassphrase(): string {\n  // Deterministic but not secret -- last resort only.\n  return `skaile:${os.hostname()}:${os.userInfo().username}`;\n}\n\n/** Hash a passphrase for verification (stored in .master). */\nfunction hashPassphrase(passphrase: string): string {\n  return crypto.createHash(\"sha256\").update(passphrase).digest(\"hex\");\n}\n\n// ---------------------------------------------------------------------------\n// Filename hashing (injective: sha256 of ref)\n// ---------------------------------------------------------------------------\n\nfunction refToHash(ref: string): string {\n  return crypto.createHash(\"sha256\").update(ref).digest(\"hex\").slice(0, 40);\n}\n\n// ---------------------------------------------------------------------------\n// Encryption / decryption\n// ---------------------------------------------------------------------------\n\nfunction encrypt(data: Uint8Array, key: Buffer): Buffer {\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);\n  const authTag = cipher.getAuthTag();\n  // Format: [iv (12)] [authTag (16)] [ciphertext (...)]\n  return Buffer.concat([iv, authTag, encrypted]);\n}\n\nfunction decrypt(blob: Buffer, key: Buffer): Buffer {\n  const iv = blob.subarray(0, IV_LENGTH);\n  const authTag = blob.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);\n  const ciphertext = blob.subarray(IV_LENGTH + AUTH_TAG_LENGTH);\n  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  decipher.setAuthTag(authTag);\n  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n}\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport class LocalSecretsProvider implements ISecretsProvider {\n  readonly id = \"local\";\n  private secretsDir: string;\n  private masterKey: Buffer | null = null;\n  private salt: Buffer | null = null;\n  private strategy: KeyStrategy = \"machine\";\n\n  constructor(secretsDir?: string) {\n    this.secretsDir = secretsDir ?? path.join(globalSkaileDir(), \"secrets\");\n  }\n\n  // -- Initialization --------------------------------------------------------\n\n  private ensureDir(): void {\n    if (!fs.existsSync(this.secretsDir)) {\n      fs.mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });\n    }\n  }\n\n  private loadOrCreateSalt(): Buffer {\n    const saltPath = path.join(this.secretsDir, \".salt\");\n    if (fs.existsSync(saltPath)) {\n      return fs.readFileSync(saltPath);\n    }\n    const salt = crypto.randomBytes(SALT_LENGTH);\n    fs.writeFileSync(saltPath, salt, { mode: 0o600 });\n    return salt;\n  }\n\n  private async ensureKey(): Promise<void> {\n    if (this.masterKey) return;\n\n    this.ensureDir();\n    this.salt = this.loadOrCreateSalt();\n\n    // Determine strategy\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      this.strategy = fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    } else {\n      // Auto-detect: try keychain, fall back to machine\n      this.strategy = (await this.tryKeychainStrategy()) ? \"keychain\" : \"machine\";\n      fs.writeFileSync(strategyPath, this.strategy, { mode: 0o600 });\n    }\n\n    // Derive key from strategy\n    const passphrase = await this.getPassphraseForStrategy(this.strategy);\n    this.masterKey = deriveMasterKey(passphrase, this.salt);\n  }\n\n  private async tryKeychainStrategy(): Promise<boolean> {\n    try {\n      // `keytar` is an optional OS-keychain native module the user installs\n      // themselves; the `as string` specifier keeps it out of tsc resolution.\n      const keytar = await import(\"keytar\" as string);\n      let stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n      if (!stored) {\n        stored = crypto.randomBytes(32).toString(\"base64\");\n        await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, stored);\n      }\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private async getPassphraseForStrategy(strategy: KeyStrategy): Promise<string> {\n    switch (strategy) {\n      case \"keychain\": {\n        try {\n          // `keytar` is an optional OS-keychain native module the user installs\n          // themselves; the `as string` specifier keeps it out of tsc resolution.\n          const keytar = await import(\"keytar\" as string);\n          const stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n          if (stored) return stored;\n        } catch {\n          // Keychain failed; fall through to machine\n        }\n        return getMachinePassphrase();\n      }\n      case \"passphrase\": {\n        const envPassphrase = process.env[PASSPHRASE_ENV];\n        if (envPassphrase) {\n          // Verify against stored hash if it exists\n          const masterPath = path.join(this.secretsDir, \".master\");\n          if (fs.existsSync(masterPath)) {\n            const storedHash = fs.readFileSync(masterPath, \"utf-8\").trim();\n            if (hashPassphrase(envPassphrase) !== storedHash) {\n              throw new SecretsError(\n                `Passphrase from ${PASSPHRASE_ENV} does not match stored hash. ` +\n                  \"Use skaile auth set-key-strategy passphrase to reset.\",\n                \"PASSPHRASE_MISMATCH\",\n              );\n            }\n          }\n          return envPassphrase;\n        }\n        // No env var -- hard error. Silent fallback to machine would\n        // produce a different key, causing AES-GCM auth-tag failures\n        // on secrets encrypted with the real passphrase.\n        throw new SecretsError(\n          `Strategy is \"passphrase\" but ${PASSPHRASE_ENV} is not set. ` +\n            `Export it before running: export ${PASSPHRASE_ENV}='...'`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n      case \"machine\":\n        return getMachinePassphrase();\n      default:\n        return getMachinePassphrase();\n    }\n  }\n\n  // -- Strategy management ---------------------------------------------------\n\n  /**\n   * Set the key strategy explicitly. Called by `skaile auth set-key-strategy`.\n   *\n   * When existing secrets are present, they are re-encrypted with the new key\n   * to prevent data loss from key mismatch.\n   */\n  async setKeyStrategy(strategy: KeyStrategy, passphrase?: string): Promise<void> {\n    this.ensureDir();\n\n    // --- 1. Validate new strategy prerequisites -------------------------\n\n    const effectivePassphrase = passphrase ?? process.env[PASSPHRASE_ENV];\n\n    if (strategy === \"passphrase\") {\n      if (!effectivePassphrase) {\n        throw new SecretsError(\n          `Passphrase required. Pass it as an argument or set ${PASSPHRASE_ENV}.`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n    }\n\n    if (strategy === \"keychain\") {\n      const success = await this.tryKeychainStrategy();\n      if (!success) {\n        throw new ProviderUnavailableError(\"local\", \"OS keychain not available\");\n      }\n    }\n\n    // --- 2. Load the OLD key under the current strategy -----------------\n    // ensureKey() reads the current strategy file and derives the key\n    // that was used to encrypt existing secrets. This is critical for\n    // cross-process scenarios where masterKey starts as null.\n\n    const encFiles = this.listEncFiles();\n    if (encFiles.length > 0) {\n      await this.ensureKey();\n      const oldKey = this.masterKey!;\n\n      // Derive the new key\n      const salt = this.salt!;\n      const newPassphrase =\n        strategy === \"passphrase\"\n          ? effectivePassphrase!\n          : strategy === \"keychain\"\n            ? await this.getPassphraseForStrategy(\"keychain\")\n            : getMachinePassphrase();\n      const newKey = deriveMasterKey(newPassphrase, salt);\n\n      // Re-encrypt each secret with the new key. A single failure must abort the\n      // whole switch: committing the new strategy while a secret is still under\n      // the old key orphans that secret (the registry advertises a key that no\n      // longer decrypts it). Collect failures and throw before the commit below,\n      // leaving `.key-strategy`/`.master` — and every secret — on the old key.\n      const failed: string[] = [];\n      for (const encFile of encFiles) {\n        const filePath = path.join(this.secretsDir, encFile);\n        const blob = fs.readFileSync(filePath);\n        try {\n          const plaintext = decrypt(blob, oldKey);\n          const reEncrypted = encrypt(plaintext, newKey);\n          fs.writeFileSync(filePath, reEncrypted, { mode: 0o600 });\n        } catch {\n          failed.push(encFile);\n        }\n      }\n      if (failed.length > 0) {\n        throw new Error(\n          `[skaile/secrets] Key-strategy switch aborted: could not re-encrypt ` +\n            `${failed.length} secret(s) (${failed.join(\", \")}). The previous strategy ` +\n            \"is unchanged; resolve the failing secrets before retrying.\",\n        );\n      }\n    }\n\n    // --- 3. Commit the new strategy (last write -- failure above leaves\n    //        the old strategy intact) ------------------------------------\n\n    if (strategy === \"passphrase\") {\n      const masterPath = path.join(this.secretsDir, \".master\");\n      fs.writeFileSync(masterPath, hashPassphrase(effectivePassphrase!), { mode: 0o600 });\n    }\n\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    fs.writeFileSync(strategyPath, strategy, { mode: 0o600 });\n    this.masterKey = null;\n    this.strategy = strategy;\n  }\n\n  getKeyStrategy(): KeyStrategy {\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      return fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    }\n    return \"machine\";\n  }\n\n  // -- File helpers ----------------------------------------------------------\n\n  private encFilename(ref: string): string {\n    return `${refToHash(ref)}.enc`;\n  }\n\n  private metaFilename(ref: string): string {\n    return `${refToHash(ref)}.meta.json`;\n  }\n\n  private metaPath(ref: string): string {\n    return path.join(this.secretsDir, this.metaFilename(ref));\n  }\n\n  private listEncFiles(): string[] {\n    if (!fs.existsSync(this.secretsDir)) return [];\n    return fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".enc\"));\n  }\n\n  // -- ISecretsProvider implementation ----------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    await this.ensureKey();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    const blob = fs.readFileSync(filePath);\n    const decrypted = decrypt(blob, this.masterKey!);\n\n    // Update lastAccessedAt\n    const metaFile = this.metaPath(ref);\n    if (fs.existsSync(metaFile)) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n        meta.lastAccessedAt = new Date().toISOString();\n        fs.writeFileSync(metaFile, JSON.stringify(meta), { mode: 0o600 });\n      } catch {\n        // Non-fatal\n      }\n    }\n\n    return new Uint8Array(decrypted);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    await this.ensureKey();\n    this.ensureDir();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const encrypted = encrypt(value, this.masterKey!);\n    fs.writeFileSync(filePath, encrypted, { mode: 0o600 });\n\n    // Write metadata (stores the original ref for reverse lookup)\n    const now = new Date().toISOString();\n    const metaFile = this.metaPath(ref);\n    let existing: Record<string, unknown> = {};\n    if (fs.existsSync(metaFile)) {\n      try {\n        existing = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      } catch {\n        // Overwrite corrupt meta\n      }\n    }\n    const meta = {\n      ref,\n      createdAt: existing.createdAt ?? now,\n      updatedAt: now,\n      lastAccessedAt: now,\n      ...(opts?.metadata ? { userMeta: opts.metadata } : {}),\n      ...(opts?.ttlSeconds\n        ? { expiresAt: new Date(Date.now() + opts.ttlSeconds * 1000).toISOString() }\n        : {}),\n    };\n    fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2), { mode: 0o600 });\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const metaFile = this.metaPath(ref);\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    fs.unlinkSync(filePath);\n    if (fs.existsSync(metaFile)) {\n      fs.unlinkSync(metaFile);\n    }\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    this.ensureDir();\n    // Read refs from meta files (the .enc filenames are hashes, not refs)\n    const metaFiles = fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".meta.json\"));\n    let refs: string[] = [];\n    for (const mf of metaFiles) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(path.join(this.secretsDir, mf), \"utf-8\"));\n        if (meta.ref) refs.push(meta.ref);\n      } catch {\n        // Skip corrupt meta files\n      }\n    }\n    if (filter?.prefix) {\n      refs = refs.filter((r) => r.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      refs = refs.slice(0, filter.limit);\n    }\n    return refs;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const start = Date.now();\n    try {\n      await this.ensureKey();\n      // Write + read + delete a test secret\n      const testRef = `__test_${crypto.randomBytes(4).toString(\"hex\")}`;\n      const testValue = new TextEncoder().encode(\"test\");\n      await this.setSecret(testRef, testValue);\n      const read = await this.getSecret(testRef);\n      await this.deleteSecret(testRef);\n      if (new TextDecoder().decode(read) !== \"test\") {\n        return { ok: false, error: \"Round-trip mismatch\" };\n      }\n      return { ok: true, latencyMs: Date.now() - start };\n    } catch (e) {\n      return {\n        ok: false,\n        latencyMs: Date.now() - start,\n        error: e instanceof Error ? e.message : String(e),\n      };\n    }\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const metaFile = this.metaPath(ref);\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    if (fs.existsSync(metaFile)) {\n      const raw = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      return {\n        ref: raw.ref ?? ref,\n        createdAt: new Date(raw.createdAt),\n        updatedAt: new Date(raw.updatedAt),\n        lastAccessedAt: raw.lastAccessedAt ? new Date(raw.lastAccessedAt) : undefined,\n        owner: raw.owner,\n        scopeSummary: \"local encrypted file\",\n      };\n    }\n    // Fallback: derive from file stat\n    const stat = fs.statSync(filePath);\n    return {\n      ref,\n      createdAt: stat.birthtime,\n      updatedAt: stat.mtime,\n      scopeSummary: \"local encrypted file\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * SecretsRouter — audit chokepoint for all secret operations.\n *\n * Registers {@link ISecretsProvider} implementations by id, routes credential refs by\n * prefix or via routing config, and emits {@link CredentialAccessed} events for every\n * get, set, delete, list, and metadata operation. Routing rules are evaluated top-to-bottom;\n * the first matching prefix wins and falls back to the configured default provider.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { ProviderUnavailableError } from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Audit event\n// ---------------------------------------------------------------------------\n\n/**\n * Audit event emitted by {@link SecretsRouter} after every secret operation.\n *\n * Delivered synchronously to all registered {@link AuditSink} functions. Errors thrown\n * by sinks are swallowed to ensure they never break the underlying secret operation.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface CredentialAccessed {\n  credential_ref: string;\n  operation: \"get\" | \"set\" | \"delete\" | \"list\" | \"metadata\";\n  provider_id: string;\n  caller_session_id?: string;\n  caller_tool_call?: string;\n  timestamp: Date;\n}\n\n/**\n * Callback function that receives {@link CredentialAccessed} audit events from {@link SecretsRouter}.\n *\n * Register sinks via `SecretsRouter.addSink()`. Sinks run synchronously after each operation;\n * exceptions are caught and suppressed so they cannot interrupt credential resolution.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport type AuditSink = (event: CredentialAccessed) => void;\n\n// ---------------------------------------------------------------------------\n// Routing config\n// ---------------------------------------------------------------------------\n\n/**\n * A single routing rule that maps a credential ref prefix to a provider.\n *\n * Rules in {@link SecretsRouterConfig.rules} are evaluated top-to-bottom;\n * the first rule whose `prefix` matches the start of the credential ref wins.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface RoutingRule {\n  /** Prefix match on credential_ref. First match wins. */\n  prefix: string;\n  /** Provider id to route to. */\n  provider_id: string;\n}\n\n/**\n * Configuration object for {@link SecretsRouter}.\n *\n * Specifies the default provider id used when no routing rule matches, and an optional\n * ordered list of {@link RoutingRule} entries for prefix-based routing.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface SecretsRouterConfig {\n  /** Default provider id when no routing rule matches. */\n  default_provider: string;\n  /** Ordered routing rules. Evaluated top-to-bottom; first prefix match wins. */\n  rules?: RoutingRule[];\n}\n\n// ---------------------------------------------------------------------------\n// Router\n// ---------------------------------------------------------------------------\n\nexport class SecretsRouter {\n  private providers = new Map<string, ISecretsProvider>();\n  private config: SecretsRouterConfig;\n  private sinks: AuditSink[] = [];\n\n  /** Caller context for audit events (set per-request by the runner). */\n  callerSessionId?: string;\n  callerToolCall?: string;\n\n  constructor(config: SecretsRouterConfig) {\n    this.config = config;\n  }\n\n  // -- Provider registration ------------------------------------------------\n\n  register(provider: ISecretsProvider): void {\n    this.providers.set(provider.id, provider);\n  }\n\n  unregister(id: string): void {\n    this.providers.delete(id);\n  }\n\n  listProviders(): string[] {\n    return [...this.providers.keys()];\n  }\n\n  // -- Audit sinks -----------------------------------------------------------\n\n  addSink(sink: AuditSink): void {\n    this.sinks.push(sink);\n  }\n\n  private emit(ref: string, operation: CredentialAccessed[\"operation\"], providerId: string): void {\n    const event: CredentialAccessed = {\n      credential_ref: ref,\n      operation,\n      provider_id: providerId,\n      caller_session_id: this.callerSessionId,\n      caller_tool_call: this.callerToolCall,\n      timestamp: new Date(),\n    };\n    for (const sink of this.sinks) {\n      try {\n        sink(event);\n      } catch {\n        // Audit sink errors must not break the secret operation.\n      }\n    }\n  }\n\n  // -- Routing ---------------------------------------------------------------\n\n  private resolve(ref: string): ISecretsProvider {\n    // Check routing rules first\n    if (this.config.rules) {\n      for (const rule of this.config.rules) {\n        if (ref.startsWith(rule.prefix)) {\n          const provider = this.providers.get(rule.provider_id);\n          if (provider) return provider;\n        }\n      }\n    }\n\n    // Fall back to default\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) {\n      throw new ProviderUnavailableError(\n        this.config.default_provider,\n        `No provider registered for default id \"${this.config.default_provider}\"`,\n      );\n    }\n    return provider;\n  }\n\n  // -- Delegated operations --------------------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"get\", provider.id);\n    return provider.getSecret(ref);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"set\", provider.id);\n    return provider.setSecret(ref, value, opts);\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"delete\", provider.id);\n    return provider.deleteSecret(ref);\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    // List aggregates from the default provider only (per-provider listing\n    // would require iterating all providers; deferred to Phase 3 with\n    // federated catalogs).\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) return [];\n    this.emit(\"*\", \"list\", provider.id);\n    return provider.listSecrets(filter);\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"metadata\", provider.id);\n    return provider.getMetadata(ref);\n  }\n\n  getCapabilities(providerId?: string): ProviderCapabilities | null {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    return provider?.getCapabilities() ?? null;\n  }\n\n  async testConnection(\n    providerId?: string,\n  ): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    if (!provider) {\n      return { ok: false, error: `Provider \"${id}\" not registered` };\n    }\n    return provider.testConnection();\n  }\n}\n","/** Package version of `@skaile/secrets`. */\nexport const VERSION = \"0.0.0\";\n\n// Re-export interface + errors from plugins (convenience for consumers)\nexport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nexport {\n  ProviderUnavailableError,\n  SecretAccessDeniedError,\n  SecretExpiredError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\nexport type { CredentialLifecycleConfig, RefreshResult } from \"./lifecycle.js\";\n// Lifecycle\nexport { CredentialLifecycleService } from \"./lifecycle.js\";\nexport { EnvSecretsProvider } from \"./providers/env.js\";\nexport type { KeyStrategy } from \"./providers/local.js\";\n// Built-in providers\nexport { LocalSecretsProvider } from \"./providers/local.js\";\nexport type { AuditSink, CredentialAccessed, RoutingRule, SecretsRouterConfig } from \"./router.js\";\n// Router\nexport { SecretsRouter } from \"./router.js\";\n"]}