@skaile/workspaces 4.8.0 → 4.9.0

package/dist/{chunk-IECSLI55.js → chunk-I7IWIVXY.js}

@@ -1,4 +1,4 @@
-import { globalSettingsPath, mapLegacyFields } from './chunk-BCXZ74DM.js';
+import { globalSettingsPath, mapLegacyFields } from './chunk-5WNQPXEG.js';
 import { rmSync, existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
 import { randomBytes, createHash } from 'crypto';
 import { homedir } from 'os';
@@ -228,5 +228,5 @@ function isStoreAuthenticated() {
 }
 
 export { deviceLogin, getStoreConfig, getStoreIdentity, getStoreToken, hasStoredAuth, isStoreAuthenticated, loadStoreAuthConfig, logout, storeFetch };
-//# sourceMappingURL=chunk-IECSLI55.js.map
-//# sourceMappingURL=chunk-IECSLI55.js.map
+//# sourceMappingURL=chunk-I7IWIVXY.js.map
+//# sourceMappingURL=chunk-I7IWIVXY.js.map

package/dist/{chunk-IECSLI55.js.map → chunk-I7IWIVXY.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-auth.ts","../cli/src/store-client.ts"],"names":["readFileSync"],"mappings":";;;;;;AAsBA,SAAS,YAAA,GAAwD;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AAC1E,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAUA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,MAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,gBAAA,IAAoB,IAAA,CAAK,MAAM,WAAW;AAAA,GAClE;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,gBAAA,CACd,MAAA,GAA0B,mBAAA,EAAoB,EACM;AACpD,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,SAAS,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AAC3E,IAAA,MAAM,WAAW,OAAO,IAAA,CAAK,kBAAA,KAAuB,QAAA,GAAW,KAAK,kBAAA,GAAqB,KAAA,CAAA;AACzF,IAAA,MAAM,cAAc,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,GAAW,KAAK,YAAA,GAAe,KAAA,CAAA;AAChF,IAAA,OAAO,QAAA,IAAY,WAAA,GAAc,EAAE,QAAA,EAAU,aAAY,GAAI,IAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACG;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,YAAA,EAAa;AAE1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,KAAA,EAAO,gBAAA;AAAA,MACP,gBAAgB,IAAA,CAAK,SAAA;AAAA,MACrB,qBAAA,EAAuB;AAAA,KACxB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,IAAA,CAAK;AAAA,OACrB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yBAAyB,KAAA,CAAM,iBAAA,IAAqB,KAAA,CAAM,KAAA,IAAS,IAAI,MAAM,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;AC9PO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAMA,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-IECSLI55.js","sourcesContent":["/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * A PKCE (RFC 7636) `code_verifier` + its S256 `code_challenge`. Keycloak\n * enforces PKCE on the `skaile-store-cli` device flow (the device-authorization\n * request 400s with \"Missing parameter: code_challenge_method\" otherwise), so\n * every `deviceLogin` mints a fresh pair: the challenge goes on the device-auth\n * request, the verifier on the matching token poll. `base64url` (no padding)\n * per the spec.\n */\nfunction makePkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  const challenge = createHash(\"sha256\").update(verifier).digest(\"base64url\");\n  return { verifier, challenge };\n}\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n  keycloakUrl: string;\n  realm: string;\n  clientId: string;\n  authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n  const home = process.env.SKAILE_HOME ?? join(homedir(), \".skaile\");\n  return {\n    keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n    realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n    clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n    authFile: process.env.SKAILE_AUTH_FILE ?? join(home, \"auth.json\"),\n  };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n  const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n  return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n  access_token: string;\n  refresh_token?: string;\n  /** Epoch ms when the access token expires (with a safety margin already applied). */\n  expires_at: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  interval?: number;\n  expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n  fetchImpl?: typeof fetch;\n  sleep?: (ms: number) => Promise<void>;\n  /** Called once with the verification URL + user code (default: write to stderr). */\n  onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n  try {\n    const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n    // Reject a corrupt / hand-edited file rather than treat it as a session.\n    if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The caller's store identity, decoded LOCALLY from the cached token's JWT\n * payload (no network, no signature check — this is an author-side hint, not an\n * authorization decision). Returns `null` when not signed in or the token is\n * unreadable. `githubLogin` is the verified GitHub handle (the preferred\n * publisher namespace); `username` is the Keycloak `preferred_username`.\n */\nexport function getStoreIdentity(\n  config: StoreAuthConfig = loadStoreAuthConfig(),\n): { username?: string; githubLogin?: string } | null {\n  const auth = readAuth(config);\n  if (!auth) return null;\n  try {\n    const payload = auth.access_token.split(\".\")[1];\n    const json = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf-8\"));\n    const username = typeof json.preferred_username === \"string\" ? json.preferred_username : undefined;\n    const githubLogin = typeof json.github_login === \"string\" ? json.github_login : undefined;\n    return username || githubLogin ? { username, githubLogin } : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n  mkdirSync(dirname(config.authFile), { recursive: true });\n  writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n  chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n  try {\n    rmSync(config.authFile);\n  } catch {\n    // already absent — nothing to do\n  }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n  return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n  return {\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n  };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n  process.stderr.write(\n    `\\nTo sign in, open:\\n\\n    ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n  );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<StoredAuth> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const sleep = deps.sleep ?? defaultSleep;\n  const onPrompt = deps.onPrompt ?? defaultPrompt;\n  const endpoints = oidc(config);\n  const pkce = makePkcePair();\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      client_id: config.clientId,\n      scope: \"openid profile\",\n      code_challenge: pkce.challenge,\n      code_challenge_method: \"S256\",\n    }),\n  });\n  if (!deviceRes.ok) {\n    throw new Error(\n      `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n  onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n  const intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n  let waitMs = intervalMs;\n\n  while (Date.now() < deadline) {\n    await sleep(waitMs);\n    const tokenRes = await fetchImpl(endpoints.token, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: device.device_code,\n        client_id: config.clientId,\n        code_verifier: pkce.verifier,\n      }),\n    });\n    const token = (await tokenRes.json()) as TokenResponse;\n    if (tokenRes.ok) {\n      const stored = tokenToStored(token);\n      writeAuth(config, stored);\n      return stored;\n    }\n    // RFC 8628 §3.5 pending / slow-down handling.\n    if (token.error === \"authorization_pending\") continue;\n    if (token.error === \"slow_down\") {\n      waitMs += 5_000;\n      continue;\n    }\n    throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n  }\n  throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n  config: StoreAuthConfig,\n  refreshToken: string,\n  fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n  const res = await fetchImpl(oidc(config).token, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n      client_id: config.clientId,\n    }),\n  });\n  const token = (await res.json()) as TokenResponse;\n  if (!res.ok) {\n    throw new Error(\n      `Token refresh failed: ${token.error_description ?? token.error ?? res.status}`,\n    );\n  }\n  const stored = tokenToStored(token);\n  writeAuth(config, stored);\n  return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<string> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const auth = readAuth(config);\n  if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n  if (Date.now() < auth.expires_at) return auth.access_token;\n  if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n  try {\n    return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n  } catch {\n    throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n  }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}
+{"version":3,"sources":["../cli/src/store-auth.ts","../cli/src/store-client.ts"],"names":["readFileSync"],"mappings":";;;;;;AAsBA,SAAS,YAAA,GAAwD;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AAC1E,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAUA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,MAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACjE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,gBAAA,IAAoB,IAAA,CAAK,MAAM,WAAW;AAAA,GAClE;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,gBAAA,CACd,MAAA,GAA0B,mBAAA,EAAoB,EACM;AACpD,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,SAAS,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AAC3E,IAAA,MAAM,WAAW,OAAO,IAAA,CAAK,kBAAA,KAAuB,QAAA,GAAW,KAAK,kBAAA,GAAqB,KAAA,CAAA;AACzF,IAAA,MAAM,cAAc,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,GAAW,KAAK,YAAA,GAAe,KAAA,CAAA;AAChF,IAAA,OAAO,QAAA,IAAY,WAAA,GAAc,EAAE,QAAA,EAAU,aAAY,GAAI,IAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACG;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,YAAA,EAAa;AAE1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,KAAA,EAAO,gBAAA;AAAA,MACP,gBAAgB,IAAA,CAAK,SAAA;AAAA,MACrB,qBAAA,EAAuB;AAAA,KACxB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,IAAA,CAAK;AAAA,OACrB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yBAAyB,KAAA,CAAM,iBAAA,IAAqB,KAAA,CAAM,KAAA,IAAS,IAAI,MAAM,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;AC9PO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAMA,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-I7IWIVXY.js","sourcesContent":["/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * A PKCE (RFC 7636) `code_verifier` + its S256 `code_challenge`. Keycloak\n * enforces PKCE on the `skaile-store-cli` device flow (the device-authorization\n * request 400s with \"Missing parameter: code_challenge_method\" otherwise), so\n * every `deviceLogin` mints a fresh pair: the challenge goes on the device-auth\n * request, the verifier on the matching token poll. `base64url` (no padding)\n * per the spec.\n */\nfunction makePkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  const challenge = createHash(\"sha256\").update(verifier).digest(\"base64url\");\n  return { verifier, challenge };\n}\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n  keycloakUrl: string;\n  realm: string;\n  clientId: string;\n  authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n  const home = process.env.SKAILE_HOME ?? join(homedir(), \".skaile\");\n  return {\n    keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n    realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n    clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n    authFile: process.env.SKAILE_AUTH_FILE ?? join(home, \"auth.json\"),\n  };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n  const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n  return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n  access_token: string;\n  refresh_token?: string;\n  /** Epoch ms when the access token expires (with a safety margin already applied). */\n  expires_at: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  interval?: number;\n  expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n  fetchImpl?: typeof fetch;\n  sleep?: (ms: number) => Promise<void>;\n  /** Called once with the verification URL + user code (default: write to stderr). */\n  onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n  try {\n    const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n    // Reject a corrupt / hand-edited file rather than treat it as a session.\n    if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The caller's store identity, decoded LOCALLY from the cached token's JWT\n * payload (no network, no signature check — this is an author-side hint, not an\n * authorization decision). Returns `null` when not signed in or the token is\n * unreadable. `githubLogin` is the verified GitHub handle (the preferred\n * publisher namespace); `username` is the Keycloak `preferred_username`.\n */\nexport function getStoreIdentity(\n  config: StoreAuthConfig = loadStoreAuthConfig(),\n): { username?: string; githubLogin?: string } | null {\n  const auth = readAuth(config);\n  if (!auth) return null;\n  try {\n    const payload = auth.access_token.split(\".\")[1];\n    const json = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf-8\"));\n    const username = typeof json.preferred_username === \"string\" ? json.preferred_username : undefined;\n    const githubLogin = typeof json.github_login === \"string\" ? json.github_login : undefined;\n    return username || githubLogin ? { username, githubLogin } : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n  mkdirSync(dirname(config.authFile), { recursive: true });\n  writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n  chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n  try {\n    rmSync(config.authFile);\n  } catch {\n    // already absent — nothing to do\n  }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n  return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n  return {\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n  };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n  process.stderr.write(\n    `\\nTo sign in, open:\\n\\n    ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n  );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<StoredAuth> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const sleep = deps.sleep ?? defaultSleep;\n  const onPrompt = deps.onPrompt ?? defaultPrompt;\n  const endpoints = oidc(config);\n  const pkce = makePkcePair();\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      client_id: config.clientId,\n      scope: \"openid profile\",\n      code_challenge: pkce.challenge,\n      code_challenge_method: \"S256\",\n    }),\n  });\n  if (!deviceRes.ok) {\n    throw new Error(\n      `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n  onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n  const intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n  let waitMs = intervalMs;\n\n  while (Date.now() < deadline) {\n    await sleep(waitMs);\n    const tokenRes = await fetchImpl(endpoints.token, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: device.device_code,\n        client_id: config.clientId,\n        code_verifier: pkce.verifier,\n      }),\n    });\n    const token = (await tokenRes.json()) as TokenResponse;\n    if (tokenRes.ok) {\n      const stored = tokenToStored(token);\n      writeAuth(config, stored);\n      return stored;\n    }\n    // RFC 8628 §3.5 pending / slow-down handling.\n    if (token.error === \"authorization_pending\") continue;\n    if (token.error === \"slow_down\") {\n      waitMs += 5_000;\n      continue;\n    }\n    throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n  }\n  throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n  config: StoreAuthConfig,\n  refreshToken: string,\n  fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n  const res = await fetchImpl(oidc(config).token, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n      client_id: config.clientId,\n    }),\n  });\n  const token = (await res.json()) as TokenResponse;\n  if (!res.ok) {\n    throw new Error(\n      `Token refresh failed: ${token.error_description ?? token.error ?? res.status}`,\n    );\n  }\n  const stored = tokenToStored(token);\n  writeAuth(config, stored);\n  return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<string> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const auth = readAuth(config);\n  if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n  if (Date.now() < auth.expires_at) return auth.access_token;\n  if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n  try {\n    return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n  } catch {\n    throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n  }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}

package/dist/{chunk-UKFLK6V2.js → chunk-I7SQIWYX.js}

@@ -1,4 +1,4 @@
-import { flowList, flowShow, flowListSessions, flowGetSession, flowFindFlowForSession } from './chunk-2GCUBS2W.js';
+import { flowList, flowShow, flowListSessions, flowGetSession, flowFindFlowForSession } from './chunk-WLPL7CRM.js';
 import { skillList, skillListDomains, skillShow, skillSearch, skillCheckRequirements, skillGetPreamble } from './chunk-FAI2SMFE.js';
 import { workspaceValidate, workspaceInfo, workspaceTestSecret, workspaceReload } from './chunk-4ZTPYIBE.js';
 import { mountList, mountSync, mountStatus, mountRead, connectorList, connectorRead, connectorWrite, connectorSearch, connectorExec, connectorLoadSkill, connectorDescribe } from './chunk-FUCYTGAE.js';
@@ -251,5 +251,5 @@ async function runMcpServerStdio(plugin) {
 }
 
 export { buildWorkspaceMcpServer, buildWorkspaceMcpStdioServer, buildWorkspaceToolDefs, runMcpServerStdio };
-//# sourceMappingURL=chunk-UKFLK6V2.js.map
-//# sourceMappingURL=chunk-UKFLK6V2.js.map
+//# sourceMappingURL=chunk-I7SQIWYX.js.map
+//# sourceMappingURL=chunk-I7SQIWYX.js.map

package/dist/{chunk-UKFLK6V2.js.map → chunk-I7SQIWYX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../workspace-plugin/src/adapters/mcp.ts"],"names":["z"],"mappings":";;;;;;;;AA4CA,IAAM,OAAA,GAA4B,SAAkB,GAAA,CAAA,OAAA,IAAW,GAAA;AAiCxD,SAAS,uBAAuB,MAAA,EAA6C;AAClF,EAAA,MAAMA,EAAAA,GAAS,OAAA;AAEf,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,KAAA;AAChC,EAAA,MAAM,IAAI,MAAA,CAAO,UAAA;AAEjB,EAAA,OAAO;AAAA;AAAA,IAEL;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,kEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,SAAA,CAAU,MAAA,CAAO,gBAAgB;AAAA,KACxD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,SAAA,CAAU,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KAC/C;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,WAAA,CAAY,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KACjD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,2CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gCAAgC;AAAA,OAC5D;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,IAAA,OAC1B,SAAA,CAAU,MAAA,CAAO,gBAAA,EAAkB,QAAA,EAAU,IAAI;AAAA,KACrD;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,QAAA,CAAS,CAAC;AAAA,KACjC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,0DAAA;AAAA,MACb,WAAA,EAAa,EAAE,OAAA,EAASA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,wBAAwB,CAAA,EAAE;AAAA,MACtE,SAAS,OAAO,EAAE,SAAQ,KAA2B,QAAA,CAAS,GAAG,OAAO;AAAA,KAC1E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,4DAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,gBAAA,CAAiB,CAAC;AAAA,KACzC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,gCAAgC,CAAA,EAAE;AAAA,MAC7E,SAAS,OAAO,EAAE,QAAO,KAA0B,cAAA,CAAe,GAAG,MAAM;AAAA,KAC7E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,4BAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,sBAAA,CAAuB,GAAG,MAAM;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,0EAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,QAAA,CAAS,oBAAoB,CAAA,EAAE;AAAA,MAC5E,SAAS,OAAO,EAAE,QAAO,KAA2B,SAAA,CAAU,GAAG,MAAM;AAAA,KACzE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,uEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,gBAAA,CAAiB,CAAC;AAAA,KACzC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,SAAS,OAAO,EAAE,UAAS,KAA4B,SAAA,CAAU,GAAG,QAAQ;AAAA,KAC9E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,kDAAA;AAAA,MACb,WAAA,EAAa,EAAE,KAAA,EAAOA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACjC,SAAS,OAAO,EAAE,OAAM,KAAyB,WAAA,CAAY,GAAG,KAAK;AAAA,KACvE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,0BAAA;AAAA,MACN,WAAA,EAAa,wEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,YAAYA,EAAAA,CACT,MAAA,GACA,QAAA,EAAS,CACT,SAAS,kDAAkD;AAAA,OAChE;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,UAAA,OAC1B,sBAAA,CAAuB,CAAA,EAAG,QAAA,EAAU,UAAA,IAAc,CAAC;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,SAAS,OAAO,EAAE,UAAS,KAA4B,gBAAA,CAAiB,GAAG,QAAQ;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,2EAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,WAAA,CAAY,CAAC;AAAA,KACpC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,aAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,UAAA,CAAW,GAAG,MAAM;AAAA,KACzE;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EACE,4NAAA;AAAA,MACF,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,aAAA,CAAc,MAAA,CAAO,gBAAgB;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,wCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kCAAkC,CAAA;AAAA,QACpE,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B;AAAA,OACvD;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,IAAA,OAC9B,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,IAAI;AAAA,KAC7D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,iBAAA;AAAA,MACN,WAAA,EAAa,uCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,IAAA,EAAMA,GAAE,MAAA,EAAO;AAAA,QACf,OAAA,EAASA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kBAAkB;AAAA,OACjD;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,YAKI,cAAA,CAAe,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,MAAM,OAAO;AAAA,KAC3E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,KAAA,EAAOA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAAA,OAC3C;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,KAAA,OAC9B,eAAA,CAAgB,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,KAAK;AAAA,KAChE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,SAAA,EAAWA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wCAAwC,CAAA;AAAA,QACvE,IAAA,EAAMA,EAAAA,CAAE,MAAA,CAAOA,EAAAA,CAAE,MAAA,EAAO,EAAGA,EAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,CAAS,qBAAqB;AAAA,OACxE;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,YAKI,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,WAAW,IAAI;AAAA,KAC5E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,sBAAA;AAAA,MACN,WAAA,EAAa,oEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,kBAAA,CAAmB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,qEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC3D;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,sEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,iBAAA,CAAkB,MAAA,EAAQ,MAAM;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,yEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,SAAS,YAAY,aAAA,CAAc,MAAA,EAAQ,MAAA,EAAQ,OAAO,KAAK;AAAA,KACjE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,uBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,GAAA,EAAKA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,uCAAuC,CAAA,EAAE;AAAA,MACjF,SAAS,OAAO,EAAE,GAAA,EAAI,KAAuB,oBAAoB,GAAG;AAAA,KACtE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,mDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,eAAA,CAAgB,MAAM;AAAA;AAC7C,GACF;AACF;AAmBA,eAAsB,wBAAwB,MAAA,EAAkD;AAC9F,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,OAAO,gCAAgC,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAI,kBAAA,CAAmB;AAAA,IAC5B,IAAA,EAAM,kBAAA;AAAA,IACN,KAAA,EAAO,qBAAA,CAAsB,sBAAA,CAAuB,MAAM,GAAG,OAAO;AAAA,GACrE,CAAA;AACH;AAgBA,eAAsB,6BAA6B,MAAA,EAAuC;AACxF,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,yCAAmD,CAAA;AACtF,EAAA,MAAM,MAAA,GAAS,IAAI,SAAA,CAAU,EAAE,MAAM,kBAAA,EAAoB,OAAA,EAAS,SAAS,CAAA;AAC3E,EAAA,KAAA,MAAW,GAAA,IAAO,sBAAA,CAAuB,MAAM,CAAA,EAAG;AAChD,IAAA,MAAA,CAAO,YAAA;AAAA,MACL,GAAA,CAAI,IAAA;AAAA,MACJ,EAAE,WAAA,EAAa,GAAA,CAAI,WAAA,EAAa,WAAA,EAAa,IAAI,WAAA,EAAY;AAAA,MAC7D,GAAA,CAAI;AAAA,KACN;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAaA,eAAsB,kBAAkB,MAAA,EAAwC;AAC9E,EAAA,MAAM,MAAA,GAAS,MAAM,4BAAA,CAA6B,MAAM,CAAA;AACxD,EAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OACrC,2CACF,CAAA;AACA,EAAA,MAAM,MAAA,CAAO,OAAA,CAAQ,IAAI,oBAAA,EAAsB,CAAA;AACjD","file":"chunk-UKFLK6V2.js","sourcesContent":["// Static namespace import so bun --compile bundles zod into the binary.\n// Dynamic import(\"zod\") via a string variable evades bun's static analysis\n// and fails at runtime inside /$bunfs/. The unwrap (zNS.z ?? zNS.default\n// ?? zNS) handles both bun's native ESM and vitest's CJS-interop resolver,\n// which return the zod namespace at different keys.\nimport * as zNS from \"zod\";\nimport { withActivityLabelDefs } from \"@skaile/workspaces/types\";\nimport type { WorkspacePlugin } from \"../plugin.js\";\nimport {\n  connectorDescribe,\n  connectorExec,\n  connectorList,\n  connectorLoadSkill,\n  connectorRead,\n  connectorSearch,\n  connectorWrite,\n  mountList,\n  mountRead,\n  mountStatus,\n  mountSync,\n} from \"../tools/connectors.js\";\nimport {\n  flowFindFlowForSession,\n  flowGetSession,\n  flowList,\n  flowListSessions,\n  flowShow,\n} from \"../tools/flows.js\";\nimport { sessionGet, sessionList } from \"../tools/sessions.js\";\nimport {\n  skillCheckRequirements,\n  skillGetPreamble,\n  skillList,\n  skillListDomains,\n  skillSearch,\n  skillShow,\n} from \"../tools/skills.js\";\nimport {\n  workspaceInfo,\n  workspaceReload,\n  workspaceTestSecret,\n  workspaceValidate,\n} from \"../tools/validator.js\";\n\nconst zStatic: any = (zNS as any).z ?? (zNS as any).default ?? zNS;\n\n/**\n * One workspace plugin tool — name, description, a zod raw-shape input schema,\n * and an async handler returning a `ToolResult`.\n *\n * Carries **zero MCP/SDK dependency**: the same definitions feed both the\n * in-process Claude Agent SDK server ({@link buildWorkspaceMcpServer}) and the\n * raw stdio MCP server ({@link buildWorkspaceMcpStdioServer}).\n */\nexport interface WorkspaceToolDef {\n  name: string;\n  description: string;\n  inputSchema: Record<string, unknown>;\n  handler: (args: any) => Promise<unknown>;\n}\n\n/**\n * Build the 28 workspace plugin tool definitions.\n *\n * Tool groups:\n * - 4 mount tools (`mount_list`, `mount_sync`, `mount_status`, `mount_read`)\n * - 5 flow tools (`flow_list`, `flow_show`, `flow_list_sessions`, `flow_get_session`, `flow_find_flow_for_session`)\n * - 6 skill tools (`skill_list`, `skill_list_domains`, `skill_show`, `skill_search`, `skill_check_requirements`, `skill_get_preamble`)\n * - 2 session tools (`session_list`, `session_get`)\n * - 7 connector tools (`connector_list`, `connector_read`, `connector_write`, `connector_search`, `connector_exec`, `connector_load_skill`, `connector_describe`)\n * - 4 workspace tools (`workspace_validate`, `workspace_info`, `workspace_test_secret`, `workspace_reload`)\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The 28 tool definitions, free of any MCP/SDK coupling.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport function buildWorkspaceToolDefs(plugin: WorkspacePlugin): WorkspaceToolDef[] {\n  const z: any = zStatic;\n\n  const driver = plugin.driver ?? \"omp\";\n  const p = plugin.projectDir;\n\n  return [\n    // Mount tools\n    {\n      name: \"mount_list\",\n      description: \"List all mounts declared in skaile.yaml with their mount status.\",\n      inputSchema: {},\n      handler: async () => mountList(plugin.connectorManager),\n    },\n    {\n      name: \"mount_sync\",\n      description: \"Sync a mount — pull latest from remote (git, S3, WebDAV).\",\n      inputSchema: { mount_id: z.string().describe(\"Mount ID from mount_list\") },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountSync(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_status\",\n      description: \"Get the mount status and last sync time for a mount.\",\n      inputSchema: { mount_id: z.string() },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountStatus(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_read\",\n      description: \"Read a file from a mounted mount by path.\",\n      inputSchema: {\n        mount_id: z.string(),\n        path: z.string().describe(\"Relative path within the mount\"),\n      },\n      handler: async ({ mount_id, path }: { mount_id: string; path: string }) =>\n        mountRead(plugin.connectorManager, mount_id, path),\n    },\n    // Flow tools\n    {\n      name: \"flow_list\",\n      description: \"List all available flow definitions from ai-assets.\",\n      inputSchema: {},\n      handler: async () => flowList(p),\n    },\n    {\n      name: \"flow_show\",\n      description: \"Show full flow definition (nodes + edges) for a flow ID.\",\n      inputSchema: { flow_id: z.string().describe(\"Flow ID from flow_list\") },\n      handler: async ({ flow_id }: { flow_id: string }) => flowShow(p, flow_id),\n    },\n    {\n      name: \"flow_list_sessions\",\n      description: \"List past and active flow run sessions for this workspace.\",\n      inputSchema: {},\n      handler: async () => flowListSessions(p),\n    },\n    {\n      name: \"flow_get_session\",\n      description: \"Get driver metadata for a specific flow run session.\",\n      inputSchema: { run_id: z.string().describe(\"Run ID from flow_list_sessions\") },\n      handler: async ({ run_id }: { run_id: string }) => flowGetSession(p, run_id),\n    },\n    {\n      name: \"flow_find_flow_for_session\",\n      description: \"Resolve and return the flow definition used in a past session.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => flowFindFlowForSession(p, run_id),\n    },\n    // Skill tools\n    {\n      name: \"skill_list\",\n      description: \"List all skills in the ai-assets catalog, optionally filtered by domain.\",\n      inputSchema: { domain: z.string().optional().describe(\"Domain name filter\") },\n      handler: async ({ domain }: { domain?: string }) => skillList(p, domain),\n    },\n    {\n      name: \"skill_list_domains\",\n      description: \"List all skill domains (top-level ai-assets directories with skills).\",\n      inputSchema: {},\n      handler: async () => skillListDomains(p),\n    },\n    {\n      name: \"skill_show\",\n      description: \"Show the full SKILL.md content for a skill ID.\",\n      inputSchema: { skill_id: z.string().describe(\"Skill ID from skill_list\") },\n      handler: async ({ skill_id }: { skill_id: string }) => skillShow(p, skill_id),\n    },\n    {\n      name: \"skill_search\",\n      description: \"Search skills by name, description, or keywords.\",\n      inputSchema: { query: z.string() },\n      handler: async ({ query }: { query: string }) => skillSearch(p, query),\n    },\n    {\n      name: \"skill_check_requirements\",\n      description: \"Validate that all skill prerequisites are met in the target directory.\",\n      inputSchema: {\n        skill_id: z.string(),\n        target_dir: z\n          .string()\n          .optional()\n          .describe(\"Directory to check against (default: projectDir)\"),\n      },\n      handler: async ({ skill_id, target_dir }: { skill_id: string; target_dir?: string }) =>\n        skillCheckRequirements(p, skill_id, target_dir ?? p),\n    },\n    {\n      name: \"skill_get_preamble\",\n      description: \"Get the REQUIRES/INPUT/READS/WRITES DSL preamble for a skill.\",\n      inputSchema: { skill_id: z.string() },\n      handler: async ({ skill_id }: { skill_id: string }) => skillGetPreamble(p, skill_id),\n    },\n    // Session tools\n    {\n      name: \"session_list\",\n      description: \"List all past agent run sessions for this workspace, sorted newest first.\",\n      inputSchema: {},\n      handler: async () => sessionList(p),\n    },\n    {\n      name: \"session_get\",\n      description: \"Get full metadata for a specific session by run ID.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => sessionGet(p, run_id),\n    },\n    // Connector tools\n    {\n      name: \"connector_list\",\n      description:\n        \"List connectors declared in skaile.yaml as {connected, failed}. `failed` holds connectors that did not connect this session, with the failure reason — their mount paths are dead directories, not synced workspaces.\",\n      inputSchema: {},\n      handler: async () => connectorList(plugin.connectorManager),\n    },\n    {\n      name: \"connector_read\",\n      description: \"Read content from a connector by path.\",\n      inputSchema: {\n        connector_id: z.string().describe(\"Connector ID from connector_list\"),\n        path: z.string().describe(\"Path within the connector\"),\n      },\n      handler: async ({ connector_id, path }: { connector_id: string; path: string }) =>\n        connectorRead(plugin.connectorManager, connector_id, path),\n    },\n    {\n      name: \"connector_write\",\n      description: \"Write content to a connector by path.\",\n      inputSchema: {\n        connector_id: z.string(),\n        path: z.string(),\n        content: z.string().describe(\"Content to write\"),\n      },\n      handler: async ({\n        connector_id,\n        path,\n        content,\n      }: {\n        connector_id: string;\n        path: string;\n        content: string;\n      }) => connectorWrite(plugin.connectorManager, connector_id, path, content),\n    },\n    {\n      name: \"connector_search\",\n      description: \"Search within a connector by query string.\",\n      inputSchema: {\n        connector_id: z.string(),\n        query: z.string().describe(\"Search query\"),\n      },\n      handler: async ({ connector_id, query }: { connector_id: string; query: string }) =>\n        connectorSearch(plugin.connectorManager, connector_id, query),\n    },\n    {\n      name: \"connector_exec\",\n      description: \"Execute a custom operation on a connector.\",\n      inputSchema: {\n        connector_id: z.string(),\n        operation: z.string().describe(\"Operation name from connector_describe\"),\n        args: z.record(z.string(), z.unknown()).describe(\"Operation arguments\"),\n      },\n      handler: async ({\n        connector_id,\n        operation,\n        args,\n      }: {\n        connector_id: string;\n        operation: string;\n        args: Record<string, unknown>;\n      }) => connectorExec(plugin.connectorManager, connector_id, operation, args),\n    },\n    {\n      name: \"connector_load_skill\",\n      description: \"Load the rendered skill body for a connector (operations + usage).\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorLoadSkill(plugin.connectorManager, connector_id),\n    },\n    {\n      name: \"connector_describe\",\n      description: \"Describe a connector's capabilities via its RuntimeSkillDescriptor.\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorDescribe(plugin.connectorManager, connector_id),\n    },\n    // Validator tools\n    {\n      name: \"workspace_validate\",\n      description: \"Run a full health check: connectors, mounts, secrets, driver binary.\",\n      inputSchema: {},\n      handler: async () => workspaceValidate(plugin, driver),\n    },\n    {\n      name: \"workspace_info\",\n      description: \"Show workspace configuration: driver, model, provider, resource counts.\",\n      inputSchema: {},\n      handler: async () => workspaceInfo(plugin, driver, plugin.model),\n    },\n    {\n      name: \"workspace_test_secret\",\n      description: \"Test resolution of one secret reference (env:VAR, forge:key).\",\n      inputSchema: { ref: z.string().describe(\"Secret ref e.g. env:ANTHROPIC_API_KEY\") },\n      handler: async ({ ref }: { ref: string }) => workspaceTestSecret(ref),\n    },\n    {\n      name: \"workspace_reload\",\n      description: \"Re-read skaile.yaml and re-sync the plugin state.\",\n      inputSchema: {},\n      handler: async () => workspaceReload(plugin),\n    },\n  ];\n}\n\n/**\n * Build the **in-process** workspace MCP server via the Claude Agent SDK's\n * `createSdkMcpServer`. This shape is what the runner embeds into a Claude\n * Agent SDK `query()` call — the runner *is* the Claude Agent SDK host.\n *\n * Returns `null` when `@anthropic-ai/claude-agent-sdk` is not installed\n * (graceful degradation for non-Claude-Code environments).\n *\n * For the standalone `skaile mcp-server` stdio subprocess use\n * {@link buildWorkspaceMcpStdioServer} / {@link runMcpServerStdio} instead —\n * those carry no Claude Agent SDK dependency.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The SDK MCP server object or `null` if the SDK is unavailable.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpServer(plugin: WorkspacePlugin): Promise<unknown | null> {\n  let sdk: any;\n  try {\n    sdk = await import(\"@anthropic-ai/claude-agent-sdk\");\n  } catch {\n    return null;\n  }\n  return sdk.createSdkMcpServer({\n    name: \"skaile-workspace\",\n    tools: withActivityLabelDefs(buildWorkspaceToolDefs(plugin), zStatic),\n  });\n}\n\n/**\n * Build a **raw stdio** workspace MCP server on `@modelcontextprotocol/sdk` —\n * no Claude Agent SDK. This is the correct shape for the `skaile mcp-server`\n * stdio subprocess that MCP-client agents (Claude Code, Codex, …) spawn.\n * Runs on plain Node.\n *\n * The returned server is not yet connected — call `.connect(transport)` (or\n * use {@link runMcpServerStdio}).\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns A `McpServer` with all 28 workspace tools registered.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpStdioServer(plugin: WorkspacePlugin): Promise<any> {\n  const { McpServer } = await import(\"@modelcontextprotocol/sdk/server/mcp.js\" as string);\n  const server = new McpServer({ name: \"skaile-workspace\", version: \"1.0.0\" });\n  for (const def of buildWorkspaceToolDefs(plugin)) {\n    server.registerTool(\n      def.name,\n      { description: def.description, inputSchema: def.inputSchema },\n      def.handler,\n    );\n  }\n  return server;\n}\n\n/**\n * Start the workspace MCP server over stdio transport.\n *\n * Builds the raw `@modelcontextprotocol/sdk` server via\n * {@link buildWorkspaceMcpStdioServer} and connects a `StdioServerTransport`.\n * No `@anthropic-ai/claude-agent-sdk` dependency anywhere on this path.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function runMcpServerStdio(plugin: WorkspacePlugin): Promise<void> {\n  const server = await buildWorkspaceMcpStdioServer(plugin);\n  const { StdioServerTransport } = await import(\n    \"@modelcontextprotocol/sdk/server/stdio.js\" as string\n  );\n  await server.connect(new StdioServerTransport());\n}\n"]}
+{"version":3,"sources":["../workspace-plugin/src/adapters/mcp.ts"],"names":["z"],"mappings":";;;;;;;;AA4CA,IAAM,OAAA,GAA4B,SAAkB,GAAA,CAAA,OAAA,IAAW,GAAA;AAiCxD,SAAS,uBAAuB,MAAA,EAA6C;AAClF,EAAA,MAAMA,EAAAA,GAAS,OAAA;AAEf,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,KAAA;AAChC,EAAA,MAAM,IAAI,MAAA,CAAO,UAAA;AAEjB,EAAA,OAAO;AAAA;AAAA,IAEL;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,kEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,SAAA,CAAU,MAAA,CAAO,gBAAgB;AAAA,KACxD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,SAAA,CAAU,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KAC/C;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,WAAA,CAAY,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KACjD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,2CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gCAAgC;AAAA,OAC5D;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,IAAA,OAC1B,SAAA,CAAU,MAAA,CAAO,gBAAA,EAAkB,QAAA,EAAU,IAAI;AAAA,KACrD;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,QAAA,CAAS,CAAC;AAAA,KACjC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,0DAAA;AAAA,MACb,WAAA,EAAa,EAAE,OAAA,EAASA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,wBAAwB,CAAA,EAAE;AAAA,MACtE,SAAS,OAAO,EAAE,SAAQ,KAA2B,QAAA,CAAS,GAAG,OAAO;AAAA,KAC1E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,4DAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,gBAAA,CAAiB,CAAC;AAAA,KACzC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,gCAAgC,CAAA,EAAE;AAAA,MAC7E,SAAS,OAAO,EAAE,QAAO,KAA0B,cAAA,CAAe,GAAG,MAAM;AAAA,KAC7E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,4BAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,sBAAA,CAAuB,GAAG,MAAM;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,0EAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,QAAA,CAAS,oBAAoB,CAAA,EAAE;AAAA,MAC5E,SAAS,OAAO,EAAE,QAAO,KAA2B,SAAA,CAAU,GAAG,MAAM;AAAA,KACzE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,uEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,gBAAA,CAAiB,CAAC;AAAA,KACzC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,SAAS,OAAO,EAAE,UAAS,KAA4B,SAAA,CAAU,GAAG,QAAQ;AAAA,KAC9E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,kDAAA;AAAA,MACb,WAAA,EAAa,EAAE,KAAA,EAAOA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACjC,SAAS,OAAO,EAAE,OAAM,KAAyB,WAAA,CAAY,GAAG,KAAK;AAAA,KACvE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,0BAAA;AAAA,MACN,WAAA,EAAa,wEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,YAAYA,EAAAA,CACT,MAAA,GACA,QAAA,EAAS,CACT,SAAS,kDAAkD;AAAA,OAChE;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,UAAA,OAC1B,sBAAA,CAAuB,CAAA,EAAG,QAAA,EAAU,UAAA,IAAc,CAAC;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,SAAS,OAAO,EAAE,UAAS,KAA4B,gBAAA,CAAiB,GAAG,QAAQ;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,2EAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,WAAA,CAAY,CAAC;AAAA,KACpC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,aAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,UAAA,CAAW,GAAG,MAAM;AAAA,KACzE;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EACE,4NAAA;AAAA,MACF,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,aAAA,CAAc,MAAA,CAAO,gBAAgB;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,wCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kCAAkC,CAAA;AAAA,QACpE,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B;AAAA,OACvD;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,IAAA,OAC9B,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,IAAI;AAAA,KAC7D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,iBAAA;AAAA,MACN,WAAA,EAAa,uCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,IAAA,EAAMA,GAAE,MAAA,EAAO;AAAA,QACf,OAAA,EAASA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kBAAkB;AAAA,OACjD;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,YAKI,cAAA,CAAe,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,MAAM,OAAO;AAAA,KAC3E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,KAAA,EAAOA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAAA,OAC3C;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,KAAA,OAC9B,eAAA,CAAgB,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,KAAK;AAAA,KAChE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,SAAA,EAAWA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wCAAwC,CAAA;AAAA,QACvE,IAAA,EAAMA,EAAAA,CAAE,MAAA,CAAOA,EAAAA,CAAE,MAAA,EAAO,EAAGA,EAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,CAAS,qBAAqB;AAAA,OACxE;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,YAKI,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,WAAW,IAAI;AAAA,KAC5E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,sBAAA;AAAA,MACN,WAAA,EAAa,oEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,kBAAA,CAAmB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,qEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC3D;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,sEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,iBAAA,CAAkB,MAAA,EAAQ,MAAM;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,yEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,SAAS,YAAY,aAAA,CAAc,MAAA,EAAQ,MAAA,EAAQ,OAAO,KAAK;AAAA,KACjE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,uBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,GAAA,EAAKA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,uCAAuC,CAAA,EAAE;AAAA,MACjF,SAAS,OAAO,EAAE,GAAA,EAAI,KAAuB,oBAAoB,GAAG;AAAA,KACtE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,mDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,eAAA,CAAgB,MAAM;AAAA;AAC7C,GACF;AACF;AAmBA,eAAsB,wBAAwB,MAAA,EAAkD;AAC9F,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,OAAO,gCAAgC,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAI,kBAAA,CAAmB;AAAA,IAC5B,IAAA,EAAM,kBAAA;AAAA,IACN,KAAA,EAAO,qBAAA,CAAsB,sBAAA,CAAuB,MAAM,GAAG,OAAO;AAAA,GACrE,CAAA;AACH;AAgBA,eAAsB,6BAA6B,MAAA,EAAuC;AACxF,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,yCAAmD,CAAA;AACtF,EAAA,MAAM,MAAA,GAAS,IAAI,SAAA,CAAU,EAAE,MAAM,kBAAA,EAAoB,OAAA,EAAS,SAAS,CAAA;AAC3E,EAAA,KAAA,MAAW,GAAA,IAAO,sBAAA,CAAuB,MAAM,CAAA,EAAG;AAChD,IAAA,MAAA,CAAO,YAAA;AAAA,MACL,GAAA,CAAI,IAAA;AAAA,MACJ,EAAE,WAAA,EAAa,GAAA,CAAI,WAAA,EAAa,WAAA,EAAa,IAAI,WAAA,EAAY;AAAA,MAC7D,GAAA,CAAI;AAAA,KACN;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAaA,eAAsB,kBAAkB,MAAA,EAAwC;AAC9E,EAAA,MAAM,MAAA,GAAS,MAAM,4BAAA,CAA6B,MAAM,CAAA;AACxD,EAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OACrC,2CACF,CAAA;AACA,EAAA,MAAM,MAAA,CAAO,OAAA,CAAQ,IAAI,oBAAA,EAAsB,CAAA;AACjD","file":"chunk-I7SQIWYX.js","sourcesContent":["// Static namespace import so bun --compile bundles zod into the binary.\n// Dynamic import(\"zod\") via a string variable evades bun's static analysis\n// and fails at runtime inside /$bunfs/. The unwrap (zNS.z ?? zNS.default\n// ?? zNS) handles both bun's native ESM and vitest's CJS-interop resolver,\n// which return the zod namespace at different keys.\nimport * as zNS from \"zod\";\nimport { withActivityLabelDefs } from \"@skaile/workspaces/types\";\nimport type { WorkspacePlugin } from \"../plugin.js\";\nimport {\n  connectorDescribe,\n  connectorExec,\n  connectorList,\n  connectorLoadSkill,\n  connectorRead,\n  connectorSearch,\n  connectorWrite,\n  mountList,\n  mountRead,\n  mountStatus,\n  mountSync,\n} from \"../tools/connectors.js\";\nimport {\n  flowFindFlowForSession,\n  flowGetSession,\n  flowList,\n  flowListSessions,\n  flowShow,\n} from \"../tools/flows.js\";\nimport { sessionGet, sessionList } from \"../tools/sessions.js\";\nimport {\n  skillCheckRequirements,\n  skillGetPreamble,\n  skillList,\n  skillListDomains,\n  skillSearch,\n  skillShow,\n} from \"../tools/skills.js\";\nimport {\n  workspaceInfo,\n  workspaceReload,\n  workspaceTestSecret,\n  workspaceValidate,\n} from \"../tools/validator.js\";\n\nconst zStatic: any = (zNS as any).z ?? (zNS as any).default ?? zNS;\n\n/**\n * One workspace plugin tool — name, description, a zod raw-shape input schema,\n * and an async handler returning a `ToolResult`.\n *\n * Carries **zero MCP/SDK dependency**: the same definitions feed both the\n * in-process Claude Agent SDK server ({@link buildWorkspaceMcpServer}) and the\n * raw stdio MCP server ({@link buildWorkspaceMcpStdioServer}).\n */\nexport interface WorkspaceToolDef {\n  name: string;\n  description: string;\n  inputSchema: Record<string, unknown>;\n  handler: (args: any) => Promise<unknown>;\n}\n\n/**\n * Build the 28 workspace plugin tool definitions.\n *\n * Tool groups:\n * - 4 mount tools (`mount_list`, `mount_sync`, `mount_status`, `mount_read`)\n * - 5 flow tools (`flow_list`, `flow_show`, `flow_list_sessions`, `flow_get_session`, `flow_find_flow_for_session`)\n * - 6 skill tools (`skill_list`, `skill_list_domains`, `skill_show`, `skill_search`, `skill_check_requirements`, `skill_get_preamble`)\n * - 2 session tools (`session_list`, `session_get`)\n * - 7 connector tools (`connector_list`, `connector_read`, `connector_write`, `connector_search`, `connector_exec`, `connector_load_skill`, `connector_describe`)\n * - 4 workspace tools (`workspace_validate`, `workspace_info`, `workspace_test_secret`, `workspace_reload`)\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The 28 tool definitions, free of any MCP/SDK coupling.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport function buildWorkspaceToolDefs(plugin: WorkspacePlugin): WorkspaceToolDef[] {\n  const z: any = zStatic;\n\n  const driver = plugin.driver ?? \"omp\";\n  const p = plugin.projectDir;\n\n  return [\n    // Mount tools\n    {\n      name: \"mount_list\",\n      description: \"List all mounts declared in skaile.yaml with their mount status.\",\n      inputSchema: {},\n      handler: async () => mountList(plugin.connectorManager),\n    },\n    {\n      name: \"mount_sync\",\n      description: \"Sync a mount — pull latest from remote (git, S3, WebDAV).\",\n      inputSchema: { mount_id: z.string().describe(\"Mount ID from mount_list\") },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountSync(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_status\",\n      description: \"Get the mount status and last sync time for a mount.\",\n      inputSchema: { mount_id: z.string() },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountStatus(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_read\",\n      description: \"Read a file from a mounted mount by path.\",\n      inputSchema: {\n        mount_id: z.string(),\n        path: z.string().describe(\"Relative path within the mount\"),\n      },\n      handler: async ({ mount_id, path }: { mount_id: string; path: string }) =>\n        mountRead(plugin.connectorManager, mount_id, path),\n    },\n    // Flow tools\n    {\n      name: \"flow_list\",\n      description: \"List all available flow definitions from ai-assets.\",\n      inputSchema: {},\n      handler: async () => flowList(p),\n    },\n    {\n      name: \"flow_show\",\n      description: \"Show full flow definition (nodes + edges) for a flow ID.\",\n      inputSchema: { flow_id: z.string().describe(\"Flow ID from flow_list\") },\n      handler: async ({ flow_id }: { flow_id: string }) => flowShow(p, flow_id),\n    },\n    {\n      name: \"flow_list_sessions\",\n      description: \"List past and active flow run sessions for this workspace.\",\n      inputSchema: {},\n      handler: async () => flowListSessions(p),\n    },\n    {\n      name: \"flow_get_session\",\n      description: \"Get driver metadata for a specific flow run session.\",\n      inputSchema: { run_id: z.string().describe(\"Run ID from flow_list_sessions\") },\n      handler: async ({ run_id }: { run_id: string }) => flowGetSession(p, run_id),\n    },\n    {\n      name: \"flow_find_flow_for_session\",\n      description: \"Resolve and return the flow definition used in a past session.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => flowFindFlowForSession(p, run_id),\n    },\n    // Skill tools\n    {\n      name: \"skill_list\",\n      description: \"List all skills in the ai-assets catalog, optionally filtered by domain.\",\n      inputSchema: { domain: z.string().optional().describe(\"Domain name filter\") },\n      handler: async ({ domain }: { domain?: string }) => skillList(p, domain),\n    },\n    {\n      name: \"skill_list_domains\",\n      description: \"List all skill domains (top-level ai-assets directories with skills).\",\n      inputSchema: {},\n      handler: async () => skillListDomains(p),\n    },\n    {\n      name: \"skill_show\",\n      description: \"Show the full SKILL.md content for a skill ID.\",\n      inputSchema: { skill_id: z.string().describe(\"Skill ID from skill_list\") },\n      handler: async ({ skill_id }: { skill_id: string }) => skillShow(p, skill_id),\n    },\n    {\n      name: \"skill_search\",\n      description: \"Search skills by name, description, or keywords.\",\n      inputSchema: { query: z.string() },\n      handler: async ({ query }: { query: string }) => skillSearch(p, query),\n    },\n    {\n      name: \"skill_check_requirements\",\n      description: \"Validate that all skill prerequisites are met in the target directory.\",\n      inputSchema: {\n        skill_id: z.string(),\n        target_dir: z\n          .string()\n          .optional()\n          .describe(\"Directory to check against (default: projectDir)\"),\n      },\n      handler: async ({ skill_id, target_dir }: { skill_id: string; target_dir?: string }) =>\n        skillCheckRequirements(p, skill_id, target_dir ?? p),\n    },\n    {\n      name: \"skill_get_preamble\",\n      description: \"Get the REQUIRES/INPUT/READS/WRITES DSL preamble for a skill.\",\n      inputSchema: { skill_id: z.string() },\n      handler: async ({ skill_id }: { skill_id: string }) => skillGetPreamble(p, skill_id),\n    },\n    // Session tools\n    {\n      name: \"session_list\",\n      description: \"List all past agent run sessions for this workspace, sorted newest first.\",\n      inputSchema: {},\n      handler: async () => sessionList(p),\n    },\n    {\n      name: \"session_get\",\n      description: \"Get full metadata for a specific session by run ID.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => sessionGet(p, run_id),\n    },\n    // Connector tools\n    {\n      name: \"connector_list\",\n      description:\n        \"List connectors declared in skaile.yaml as {connected, failed}. `failed` holds connectors that did not connect this session, with the failure reason — their mount paths are dead directories, not synced workspaces.\",\n      inputSchema: {},\n      handler: async () => connectorList(plugin.connectorManager),\n    },\n    {\n      name: \"connector_read\",\n      description: \"Read content from a connector by path.\",\n      inputSchema: {\n        connector_id: z.string().describe(\"Connector ID from connector_list\"),\n        path: z.string().describe(\"Path within the connector\"),\n      },\n      handler: async ({ connector_id, path }: { connector_id: string; path: string }) =>\n        connectorRead(plugin.connectorManager, connector_id, path),\n    },\n    {\n      name: \"connector_write\",\n      description: \"Write content to a connector by path.\",\n      inputSchema: {\n        connector_id: z.string(),\n        path: z.string(),\n        content: z.string().describe(\"Content to write\"),\n      },\n      handler: async ({\n        connector_id,\n        path,\n        content,\n      }: {\n        connector_id: string;\n        path: string;\n        content: string;\n      }) => connectorWrite(plugin.connectorManager, connector_id, path, content),\n    },\n    {\n      name: \"connector_search\",\n      description: \"Search within a connector by query string.\",\n      inputSchema: {\n        connector_id: z.string(),\n        query: z.string().describe(\"Search query\"),\n      },\n      handler: async ({ connector_id, query }: { connector_id: string; query: string }) =>\n        connectorSearch(plugin.connectorManager, connector_id, query),\n    },\n    {\n      name: \"connector_exec\",\n      description: \"Execute a custom operation on a connector.\",\n      inputSchema: {\n        connector_id: z.string(),\n        operation: z.string().describe(\"Operation name from connector_describe\"),\n        args: z.record(z.string(), z.unknown()).describe(\"Operation arguments\"),\n      },\n      handler: async ({\n        connector_id,\n        operation,\n        args,\n      }: {\n        connector_id: string;\n        operation: string;\n        args: Record<string, unknown>;\n      }) => connectorExec(plugin.connectorManager, connector_id, operation, args),\n    },\n    {\n      name: \"connector_load_skill\",\n      description: \"Load the rendered skill body for a connector (operations + usage).\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorLoadSkill(plugin.connectorManager, connector_id),\n    },\n    {\n      name: \"connector_describe\",\n      description: \"Describe a connector's capabilities via its RuntimeSkillDescriptor.\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorDescribe(plugin.connectorManager, connector_id),\n    },\n    // Validator tools\n    {\n      name: \"workspace_validate\",\n      description: \"Run a full health check: connectors, mounts, secrets, driver binary.\",\n      inputSchema: {},\n      handler: async () => workspaceValidate(plugin, driver),\n    },\n    {\n      name: \"workspace_info\",\n      description: \"Show workspace configuration: driver, model, provider, resource counts.\",\n      inputSchema: {},\n      handler: async () => workspaceInfo(plugin, driver, plugin.model),\n    },\n    {\n      name: \"workspace_test_secret\",\n      description: \"Test resolution of one secret reference (env:VAR, forge:key).\",\n      inputSchema: { ref: z.string().describe(\"Secret ref e.g. env:ANTHROPIC_API_KEY\") },\n      handler: async ({ ref }: { ref: string }) => workspaceTestSecret(ref),\n    },\n    {\n      name: \"workspace_reload\",\n      description: \"Re-read skaile.yaml and re-sync the plugin state.\",\n      inputSchema: {},\n      handler: async () => workspaceReload(plugin),\n    },\n  ];\n}\n\n/**\n * Build the **in-process** workspace MCP server via the Claude Agent SDK's\n * `createSdkMcpServer`. This shape is what the runner embeds into a Claude\n * Agent SDK `query()` call — the runner *is* the Claude Agent SDK host.\n *\n * Returns `null` when `@anthropic-ai/claude-agent-sdk` is not installed\n * (graceful degradation for non-Claude-Code environments).\n *\n * For the standalone `skaile mcp-server` stdio subprocess use\n * {@link buildWorkspaceMcpStdioServer} / {@link runMcpServerStdio} instead —\n * those carry no Claude Agent SDK dependency.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The SDK MCP server object or `null` if the SDK is unavailable.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpServer(plugin: WorkspacePlugin): Promise<unknown | null> {\n  let sdk: any;\n  try {\n    sdk = await import(\"@anthropic-ai/claude-agent-sdk\");\n  } catch {\n    return null;\n  }\n  return sdk.createSdkMcpServer({\n    name: \"skaile-workspace\",\n    tools: withActivityLabelDefs(buildWorkspaceToolDefs(plugin), zStatic),\n  });\n}\n\n/**\n * Build a **raw stdio** workspace MCP server on `@modelcontextprotocol/sdk` —\n * no Claude Agent SDK. This is the correct shape for the `skaile mcp-server`\n * stdio subprocess that MCP-client agents (Claude Code, Codex, …) spawn.\n * Runs on plain Node.\n *\n * The returned server is not yet connected — call `.connect(transport)` (or\n * use {@link runMcpServerStdio}).\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns A `McpServer` with all 28 workspace tools registered.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpStdioServer(plugin: WorkspacePlugin): Promise<any> {\n  const { McpServer } = await import(\"@modelcontextprotocol/sdk/server/mcp.js\" as string);\n  const server = new McpServer({ name: \"skaile-workspace\", version: \"1.0.0\" });\n  for (const def of buildWorkspaceToolDefs(plugin)) {\n    server.registerTool(\n      def.name,\n      { description: def.description, inputSchema: def.inputSchema },\n      def.handler,\n    );\n  }\n  return server;\n}\n\n/**\n * Start the workspace MCP server over stdio transport.\n *\n * Builds the raw `@modelcontextprotocol/sdk` server via\n * {@link buildWorkspaceMcpStdioServer} and connects a `StdioServerTransport`.\n * No `@anthropic-ai/claude-agent-sdk` dependency anywhere on this path.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function runMcpServerStdio(plugin: WorkspacePlugin): Promise<void> {\n  const server = await buildWorkspaceMcpStdioServer(plugin);\n  const { StdioServerTransport } = await import(\n    \"@modelcontextprotocol/sdk/server/stdio.js\" as string\n  );\n  await server.connect(new StdioServerTransport());\n}\n"]}

package/dist/{chunk-DYT3AQBM.js → chunk-JUZJUKWM.js}

@@ -1,4 +1,4 @@
-import { resolveSkWorkspaceConfig } from './chunk-HKOC273F.js';
+import { resolveSkWorkspaceConfig } from './chunk-P2G6XSJ3.js';
 import { parseFrontmatter } from './chunk-MKZOK4JU.js';
 import { createLogger } from './chunk-W4IPN3DD.js';
 import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
@@ -486,5 +486,5 @@ function resolveAuthRef(auth, mountId) {
 }
 
 export { ConnectorFieldMissingError, ConnectorStartupError, EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, deriveSingleMaterializedConnectorDeclaration, fromMaterializedConnectorMd, isKnownSecretRef, loadConnectorDeclarations, loadMaterializedConnectorDeclarations, readUnavailableMarker, resolveAuthRef, resolveBackendAuthFor, resolvedConfigToDeclarations };
-//# sourceMappingURL=chunk-DYT3AQBM.js.map
-//# sourceMappingURL=chunk-DYT3AQBM.js.map
+//# sourceMappingURL=chunk-JUZJUKWM.js.map
+//# sourceMappingURL=chunk-JUZJUKWM.js.map