@skaile/workspaces 5.10.0 → 5.12.0

package/dist/{chunk-MVQ3Q2HM.js → chunk-UTKENBB6.js}

@@ -1,5 +1,5 @@
-import { compositeSha256 } from './chunk-IXWODEED.js';
-import { parseAssetRef } from './chunk-4OV5DSBB.js';
+import { compositeSha256 } from './chunk-CTP3XBMF.js';
+import { parseAssetRef } from './chunk-PNTXHTBC.js';
 import { createHash } from 'crypto';
 import { rm, mkdir, writeFile } from 'fs/promises';
 import { isAbsolute, resolve, sep, join, dirname } from 'path';
@@ -35,7 +35,7 @@ function longestCommonDirPrefix(paths) {
 }
 async function installFromManifest(opts) {
   const { manifest, libraryRoot } = opts;
-  const fetcher = opts.fetcher ?? (await import('./source-fetch-github-QN4LLTL5.js')).fetchAssetFilesFromGitHub;
+  const fetcher = opts.fetcher ?? (await import('./source-fetch-github-PIO6EMMF.js')).fetchAssetFilesFromGitHub;
   if (opts.targetDir !== void 0) {
     return installFlat(manifest, opts.targetDir, fetcher);
   }
@@ -123,5 +123,5 @@ async function installFlat(manifest, targetDir, fetcher) {
 }
 
 export { assertSafeManifestPath, installFromManifest, longestCommonDirPrefix };
-//# sourceMappingURL=chunk-MVQ3Q2HM.js.map
-//# sourceMappingURL=chunk-MVQ3Q2HM.js.map
+//# sourceMappingURL=chunk-UTKENBB6.js.map
+//# sourceMappingURL=chunk-UTKENBB6.js.map

package/dist/{chunk-MVQ3Q2HM.js.map → chunk-UTKENBB6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;;AAgDO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,QAAA,CAAS,KAAK,CAAA;AACtD,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AAAA,IACxC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-MVQ3Q2HM.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\nimport { compositeSha256 } from \"../../../core/src/publish-manifest.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const actualComposite = compositeSha256(manifest.files);\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n  }\n\n  return { installPath: target };\n}\n"]}
+{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;;AAgDO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,QAAA,CAAS,KAAK,CAAA;AACtD,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AAAA,IACxC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-UTKENBB6.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\nimport { compositeSha256 } from \"../../../core/src/publish-manifest.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const actualComposite = compositeSha256(manifest.files);\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n  }\n\n  return { installPath: target };\n}\n"]}

package/dist/{chunk-TH4CTXHX.js → chunk-VRLKHL74.js}

@@ -1,7 +1,7 @@
-import { SubprocessCliDriver, extractText, extractCost, extractTokens } from './chunk-3KHYGOEY.js';
-import { resolveEnvDriverSession, bindSingleProviderEntry, resolveRegistryBinding } from './chunk-ZGQTS3Y4.js';
-import { getStaticModels, fetchProviderModels } from './chunk-OOWHXOK6.js';
-import { getProviderPreset, BUILTIN_DRIVER_CATALOG, getBridgeLogger, entryCredentialValue, registryDriverConfig } from './chunk-HJ5MCB3L.js';
+import { SubprocessCliDriver, extractText, extractCost, extractTokens } from './chunk-XMAJJPA4.js';
+import { resolveEnvDriverSession, bindSingleProviderEntry, resolveRegistryBinding } from './chunk-NGJIVDDD.js';
+import { getStaticModels, fetchProviderModels } from './chunk-NJXR5OAM.js';
+import { getProviderPreset, BUILTIN_DRIVER_CATALOG, getBridgeLogger, entryCredentialValue, registryDriverConfig } from './chunk-MF54ZHWT.js';
 import * as z from 'zod';
 
 var GOOGLE_DEFAULT_BASE_URL = getProviderPreset("google")?.base_url;
@@ -183,5 +183,5 @@ var geminiDriverTarget = {
 };
 
 export { GeminiDriver, GeminiFamilyDriver, geminiDriverTarget };
-//# sourceMappingURL=chunk-TH4CTXHX.js.map
-//# sourceMappingURL=chunk-TH4CTXHX.js.map
+//# sourceMappingURL=chunk-VRLKHL74.js.map
+//# sourceMappingURL=chunk-VRLKHL74.js.map

package/dist/{chunk-TH4CTXHX.js.map → chunk-VRLKHL74.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/drivers/gemini.ts"],"names":[],"mappings":";;;;;;AAuBA,IAAM,uBAAA,GAA0B,iBAAA,CAAkB,QAAQ,CAAA,EAAG,QAAA;AAWtD,IAAe,kBAAA,GAAf,cAA0C,mBAAA,CAAoB;AAAA,EACzD,WAAW,IAAA,EAAiB;AACpC,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,MAAA;AAAA,MACL,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,eAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAA,IAAc,KAAK,EAAE,CAAA;AAChE,QAAA;AAAA,MAEF,KAAK,SAAA;AAAA,MACL,KAAK,WAAA,EAAa;AAChB,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,SAAS,IAAA,IAAQ,WAAA;AAChD,QAAA,IAAI,SAAS,WAAA,EAAa;AAC1B,QAAA,MAAM,IAAA,GAAO,YAAY,IAAI,CAAA;AAC7B,QAAA,IAAI,IAAA,CAAK,SAAS,IAAA,IAAQ,IAAA,CAAK,UAAU,IAAA,IAAQ,IAAA,CAAK,aAAa,IAAA,EAAM;AACvE,UAAA,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,QAC5B,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,mBAAmB,IAAI,CAAA;AAAA,QAC9B;AACA,QAAA;AAAA,MACF;AAAA,MAEA,KAAK,UAAA;AAAA,MACL,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA,EAAQ,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,IAAA,IAAQ,EAAE,CAAA;AACjF,QAAA;AAAA,MAEF,KAAK,aAAA;AACH,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA;AAAA,UAC1B,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,OAAA;AAAA,UACnC,QAAQ,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,OAAA,IAAW,KAAK,KAAK;AAAA,SACrD;AACA,QAAA;AAAA,MAEF,KAAK,OAAA;AACH,QAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,WAAW,IAAA,CAAK,KAAA,IAAS,OAAO,CAAC,CAAC,CAAA;AAClF,QAAA;AAAA,MAEF,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAU,CAAA;AACrD,QAAA,IAAA,CAAK,UAAA,CAAW;AAAA,UACd,MAAA,EAAQ,cAAc,IAAI,CAAA;AAAA,UAC1B,OAAA,EAAS,YAAY,IAAI,CAAA;AAAA,UACzB,OAAA,EAAS,WAAA,CAAY,IAAI,CAAA,IAAK;AAAA,SAC/B,CAAA;AACD,QAAA;AAAA;AACJ,EACF;AAAA;AAAA,EAIQ,SAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA,GAAkB,KAAA;AAAA;AAAA,EAGhB,eAAA,GAAoC;AAC5C,IAAA,IAAA,CAAK,SAAA,KAAc,uBAAA,CAAwB,IAAA,CAAK,MAAM,CAAA;AACtD,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWU,eAAA,GAAoD;AAC5D,IAAA,IAAI,IAAA,CAAK,eAAA,EAAiB,OAAO,IAAA,CAAK,UAAA;AACtC,IAAA,MAAM,OAAA,GAAU,uBAAA;AAAA,MACd,KAAK,UAAA,CAAW,EAAA;AAAA,MAChB,IAAA,CAAK,WAAA;AAAA,MACL,KAAK,eAAA;AAAgB,KACvB;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,QAAA,IAAY,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,OAAO,CAAA;AACpE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA;AAClB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAe,KAAA,GAAuB;AACpC,IAAA,IAAA,CAAK,eAAA,EAAgB;AACrB,IAAA,MAAM,MAAM,KAAA,EAAM;AAAA,EACpB;AAAA,EAEmB,eAAe,OAAA,EAAmC;AACnE,IAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,MAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AAAA,IACzB;AAAA,EACF;AAAA;AAAA,EAGS,QAAA,GAA+B;AACtC,IAAA,OAAO,uBAAuB,IAAA,CAAK,eAAA,EAAiB,CAAA,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AAAA,EACxF;AACF;AAuBO,IAAM,YAAA,GAAN,cAA2B,kBAAA,CAAmB;AAAA,EAC1C,UAAA,GAAyB;AAAA,IAChC,EAAA,EAAI,QAAA;AAAA,IACJ,IAAA,EAAM,YAAA;AAAA,IACN,aAAA,EAAe,KAAA;AAAA,IACf,mBAAA,EAAqB;AAAA,GACvB;AAAA,EAEmB,GAAA,GAAc,gBAAgB,QAAQ,CAAA;AAAA,EACtC,UAAA,GAAa,QAAA;AAAA,EACb,WAAA,GAAc,YAAA;AAAA,EACd,SAAA,GAAY,QAAA;AAAA,EAErB,SAAA,CAAU,SAAiB,QAAA,EAAwC;AAC3E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,kEAAA,EAAoE;AAAA,QAChF;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,MAAM,IAAA,GAAO,CAAC,IAAA,EAAM,OAAA,EAAS,mBAAmB,aAAa,CAAA;AAC7D,IAAA,MAAM,QAAQ,IAAA,CAAK,eAAA,EAAgB,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AACrE,IAAA,IAAI,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,KAAK,CAAA;AAChC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEU,QAAA,GAAmC;AAC3C,IAAA,MAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,gBAAA,EAAkB,gBAAA,EAAkB,wBAAwB,CAAC,CAAA;AACvF,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,IAAI,CAAC,SAAS,OAAO,GAAA;AAIrB,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,sBAAA;AACX,IAAA,MAAM,GAAA,GAAM,oBAAA,CAAqB,OAAA,CAAQ,UAAA,EAAY,QAAQ,KAAA,EAAO;AAAA,MAClE,GAAA,EAAK,IAAA,CAAK,eAAA,EAAgB,CAAE;AAAA,KAC7B,CAAA;AACD,IAAA,IAAI,GAAA,MAAS,cAAA,GAAiB,GAAA;AAG9B,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,EAAyB;AAClE,MAAA,GAAA,CAAI,yBAAyB,OAAA,CAAQ,OAAA;AAAA,IACvC;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEU,WAAA,GAAsB;AAC9B,IAAA,OAAO,iHAAA;AAAA,EACT;AAAA,EAEmB,YAAA,CAAa,MAAqB,MAAA,EAA+B;AAClF,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,8CAAA;AAAA,QACT,QAAA,EAAU,YAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM;AAAA,OACR;AAAA,IACF;AACA,IAAA,IAAI,IAAA,KAAS,IAAI,OAAO,IAAA;AACxB,IAAA,OAAO,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAe,UAAA,GAAoC;AACjD,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,MAAM,OAAA,GAAU,uBAAuB,OAAO,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,OAAA,GACR,oBAAA,CAAqB,OAAA,CAAQ,YAAY,OAAA,CAAQ,KAAA,EAAO,EAAE,GAAA,EAAK,OAAA,CAAQ,SAAA,EAAW,CAAA,GAClF,QAAQ,SAAA,CAAU,cAAA;AACtB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,eAAA,CAAgB,QAAQ,CAAA;AACzC,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,QAAA;AAAA,MACA,GAAA;AAAA,MACA,OAAA,EAAS,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,GACpC,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAC3B;AAAC,KACP;AACA,IAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,GAAI,MAAA,CAAO,MAAA,GAAS,eAAA,CAAgB,QAAQ,CAAA;AAAA,EACzF;AACF;AAMO,IAAM,kBAAA,GAAgD;AAAA,EAC3D,EAAA,EAAI,QAAA;AAAA,EACJ,WAAA,EAAa,sBAAA,CAAuB,MAAA,EAAQ,IAAA,IAAQ,YAAA;AAAA,EACpD,UAAA,EAAY,CAAA;AAAA,EACZ,YAAA,EAAgB,CAAA,CAAA,MAAA,CAAoB,MAAM,IAAI,CAAA;AAAA,EAC9C,QAAQ,OAAO,MAAA,EAAQ,IAAA,KAAS,IAAI,aAAa,MAAM,CAAA;AAAA,EACvD,UAAA,EAAY,OAAO,QAAA,EAAU,OAAA,KAC3B,IAAI,YAAA,CAAa;AAAA,IACf,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IACjB,SAAA,EAAW,YAAA;AAAA,IACX,GAAG,oBAAA,CAAqB,QAAA,EAAU,OAAO;AAAA,GAC1C,EAAE,UAAA;AACP","file":"chunk-TH4CTXHX.js","sourcesContent":["import type { DriverTarget } from \"@skaile/workspaces/plugin-registry\";\nimport type { Logger } from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nimport { getBridgeLogger } from \"../logger.js\";\nimport { fetchProviderModels, getStaticModels, type ModelEntry } from \"../models.js\";\nimport { getProviderPreset } from \"../provider-catalog.js\";\nimport { entryCredentialValue } from \"../provider-materialize/credential-env.js\";\nimport {\n  bindSingleProviderEntry,\n  type EnvDriverSession,\n  type RegistryModelBinding,\n  resolveEnvDriverSession,\n  resolveRegistryBinding,\n} from \"../provider-materialize/env-drivers.js\";\nimport { registryDriverConfig } from \"../provider-registry-derive.js\";\nimport { BUILTIN_DRIVER_CATALOG } from \"../registry.js\";\nimport type { AgentConfig, DriverInfo, ReconfigureApplied } from \"../types.js\";\nimport { extractCost, extractText, extractTokens, SubprocessCliDriver } from \"./_subprocess-cli.js\";\n\n/**\n * The Gemini API host the CLI talks to unless told otherwise — the catalog's\n * `google` preset, so the two can never drift apart.\n */\nconst GOOGLE_DEFAULT_BASE_URL = getProviderPreset(\"google\")?.base_url;\n\n/**\n * Shared base for the Gemini-CLI event family. Gemini CLI and Qwen Code (a fork\n * of Gemini CLI) emit the same `stream-json` event shape, so both dispatch the\n * same {@link handleJson}: `init`/`system` → session capture, `message`/\n * `assistant` → streamed assistant text, `tool_use` / `tool_result` → tool\n * events, `result` → tokens + cost.\n *\n * @docLink packages/bridge/drivers#gemini-driver\n */\nexport abstract class GeminiFamilyDriver extends SubprocessCliDriver {\n  protected handleJson(json: any): void {\n    switch (json?.type) {\n      case \"init\":\n      case \"system\":\n        this.captureSession(json.sessionId ?? json.session_id ?? json.id);\n        break;\n\n      case \"message\":\n      case \"assistant\": {\n        const role = json.role ?? json.message?.role ?? \"assistant\";\n        if (role !== \"assistant\") break;\n        const text = extractText(json);\n        if (json.done === true || json.final === true || json.finished === true) {\n          this.pushAssistantEnd(text);\n        } else {\n          this.pushAssistantDelta(text);\n        }\n        break;\n      }\n\n      case \"tool_use\":\n      case \"tool_call\":\n        this.pushToolCall(json.name ?? json.tool ?? \"tool\", json.input ?? json.args ?? {});\n        break;\n\n      case \"tool_result\":\n        this.pushToolResult(\n          json.name ?? json.tool ?? \"tool\",\n          json.result ?? json.output ?? json.content,\n          Boolean(json.is_error ?? json.isError ?? json.error),\n        );\n        break;\n\n      case \"error\":\n        this.pushError(this.classifyMessage(String(json.message ?? json.error ?? \"error\")));\n        break;\n\n      case \"result\":\n        this.captureSession(json.sessionId ?? json.session_id);\n        this.pushResult({\n          tokens: extractTokens(json),\n          costUsd: extractCost(json),\n          summary: extractText(json) || \"Task completed\",\n        });\n        break;\n    }\n  }\n\n  // ── Registry binding ──────────────────────────────────────────────────────\n\n  private providers?: EnvDriverSession;\n  private boundEntry?: RegistryModelBinding;\n  private bindingResolved = false;\n\n  /** This session's AI providers, resolved once from the config. */\n  protected providerSession(): EnvDriverSession {\n    this.providers ??= resolveEnvDriverSession(this.config);\n    return this.providers;\n  }\n\n  /**\n   * The AI provider entry this session's model selector names, memoized until\n   * the model changes.\n   *\n   * Gemini CLI and Qwen Code are `single`-plurality harnesses (§2.3): they\n   * address one endpoint, so the bound entry supplies both the credential and\n   * the base URL. Resolving through {@link bindSingleProviderEntry} is what\n   * puts the surface check — which throws — on the start path.\n   */\n  protected registryBinding(): RegistryModelBinding | undefined {\n    if (this.bindingResolved) return this.boundEntry;\n    const binding = bindSingleProviderEntry(\n      this.driverInfo.id,\n      this.productName,\n      this.providerSession(),\n    );\n    for (const warning of binding?.warnings ?? []) this.log.warn(warning);\n    this.boundEntry = binding;\n    this.bindingResolved = true;\n    return binding;\n  }\n\n  /**\n   * Fail before the first spawn when the bound entry speaks a surface this\n   * harness cannot — the error names the surface.\n   */\n  override async start(): Promise<void> {\n    this.registryBinding();\n    await super.start();\n  }\n\n  protected override onReconfigured(applied: ReconfigureApplied): void {\n    if (applied.model !== undefined) {\n      this.providers = undefined;\n      this.bindingResolved = false;\n    }\n  }\n\n  /** The provider-side model id the harness is actually run with. */\n  override getModel(): string | undefined {\n    return resolveRegistryBinding(this.providerSession())?.providerModelId ?? this.config.model;\n  }\n}\n\n/**\n * Agent driver for the Google **Gemini CLI** (`gemini`).\n *\n * Spawns `gemini -p \"<prompt>\" --output-format stream-json` per turn and maps\n * the stream-json events to the unified {@link AgentEvent} stream. Google\n * models only (`surface: google-generative-ai`): the AI provider entry the\n * session's model selector names supplies `GEMINI_API_KEY`, the `-m` model id\n * and — for a non-default endpoint — `GOOGLE_GEMINI_BASE_URL`.\n *\n * @remarks\n * - **Requires Gemini CLI ≥ v0.6.1** — earlier versions reject\n *   `--output-format`. A too-old CLI surfaces as a `process`-category exit error.\n * - **Session resume is not available in headless (`-p`) mode** — the CLI errors\n *   if asked to resume non-interactively, so this driver runs single-turn per\n *   process and logs a warning when a resume id is present.\n * - Exit codes: `42` → input/validation error, `53` → turn-limit (treated as a\n *   completed turn).\n *\n * @see https://github.com/google-gemini/gemini-cli\n * @docLink packages/bridge/drivers#gemini-driver\n */\nexport class GeminiDriver extends GeminiFamilyDriver {\n  readonly driverInfo: DriverInfo = {\n    id: \"gemini\",\n    name: \"Gemini CLI\",\n    modelAgnostic: false,\n    supportsInBandAbort: false,\n  };\n\n  protected readonly log: Logger = getBridgeLogger(\"gemini\");\n  protected readonly defaultBin = \"gemini\";\n  protected readonly productName = \"Gemini CLI\";\n  protected readonly envPrefix = \"GEMINI\";\n\n  protected buildArgs(message: string, resumeId: string | undefined): string[] {\n    if (resumeId) {\n      this.log.warn(\"Gemini CLI cannot resume in headless mode; starting a fresh turn\", {\n        resumeId,\n      });\n    }\n    const args = [\"-p\", message, \"--output-format\", \"stream-json\"];\n    const model = this.registryBinding()?.providerModelId ?? this.config.model;\n    if (model) args.push(\"-m\", model);\n    return args;\n  }\n\n  protected buildEnv(): Record<string, string> {\n    const env = this.baseEnv([\"GEMINI_API_KEY\", \"GOOGLE_API_KEY\", \"GOOGLE_GEMINI_BASE_URL\"]);\n    const binding = this.registryBinding();\n    if (!binding) return env;\n\n    // The entry is the authority: inherited Google carriers are dropped so an\n    // ambient key cannot authenticate a session pointed somewhere else.\n    delete env.GEMINI_API_KEY;\n    delete env.GOOGLE_API_KEY;\n    delete env.GOOGLE_GEMINI_BASE_URL;\n    const key = entryCredentialValue(binding.providerId, binding.entry, {\n      env: this.providerSession().lookupEnv,\n    });\n    if (key) env.GEMINI_API_KEY = key;\n    // Only a non-default endpoint is worth naming: Gemini CLI reads\n    // GOOGLE_GEMINI_BASE_URL as an override of its own default host.\n    if (binding.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL) {\n      env.GOOGLE_GEMINI_BASE_URL = binding.baseUrl;\n    }\n    return env;\n  }\n\n  protected installHint(): string {\n    return \"Gemini CLI is not installed or not on your PATH. Install it with `npm i -g @google/gemini-cli` (≥ v0.6.1).\";\n  }\n\n  protected override classifyExit(code: number | null, signal: NodeJS.Signals | null) {\n    if (code === 42) {\n      return {\n        message: \"Gemini CLI reported an input error (exit 42)\",\n        category: \"validation\" as const,\n        retryable: false,\n        hint: \"The prompt or flags were rejected by Gemini CLI. Check the model name and arguments.\",\n      };\n    }\n    if (code === 53) return null; // turn-limit — the result was already emitted.\n    return super.classifyExit(code, signal);\n  }\n\n  /**\n   * Discovery runs against the bound entry: its credential and, for a\n   * non-default endpoint, its base URL. Without an entry the ambient\n   * `GEMINI_API_KEY` is the last resort, and an unreachable API falls back to\n   * the static Google catalog.\n   */\n  override async listModels(): Promise<ModelEntry[]> {\n    const session = this.providerSession();\n    const binding = resolveRegistryBinding(session);\n    const key = binding\n      ? entryCredentialValue(binding.providerId, binding.entry, { env: session.lookupEnv })\n      : session.lookupEnv.GEMINI_API_KEY;\n    if (!key) return getStaticModels(\"google\");\n    const result = await fetchProviderModels(\n      \"google\",\n      key,\n      binding?.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL\n        ? { baseUrl: binding.baseUrl }\n        : {},\n    );\n    return result.ok && result.models.length > 0 ? result.models : getStaticModels(\"google\");\n  }\n}\n\n/**\n * `DriverTarget` wrapper for the gemini driver. Registered into the plugin\n * registry by `registerBuiltinDrivers()`.\n */\nexport const geminiDriverTarget: DriverTarget<AgentConfig> = {\n  id: \"gemini\",\n  displayName: BUILTIN_DRIVER_CATALOG.gemini?.name ?? \"Gemini CLI\",\n  apiVersion: 1,\n  configSchema: z.custom<AgentConfig>(() => true),\n  create: async (config, _ctx) => new GeminiDriver(config),\n  listModels: async (registry, options) =>\n    new GeminiDriver({\n      cwd: process.cwd(),\n      sessionId: \"model-list\",\n      ...registryDriverConfig(registry, options),\n    }).listModels(),\n};\n"]}
+{"version":3,"sources":["../bridge/src/drivers/gemini.ts"],"names":[],"mappings":";;;;;;AAuBA,IAAM,uBAAA,GAA0B,iBAAA,CAAkB,QAAQ,CAAA,EAAG,QAAA;AAWtD,IAAe,kBAAA,GAAf,cAA0C,mBAAA,CAAoB;AAAA,EACzD,WAAW,IAAA,EAAiB;AACpC,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,MAAA;AAAA,MACL,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,eAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAA,IAAc,KAAK,EAAE,CAAA;AAChE,QAAA;AAAA,MAEF,KAAK,SAAA;AAAA,MACL,KAAK,WAAA,EAAa;AAChB,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,SAAS,IAAA,IAAQ,WAAA;AAChD,QAAA,IAAI,SAAS,WAAA,EAAa;AAC1B,QAAA,MAAM,IAAA,GAAO,YAAY,IAAI,CAAA;AAC7B,QAAA,IAAI,IAAA,CAAK,SAAS,IAAA,IAAQ,IAAA,CAAK,UAAU,IAAA,IAAQ,IAAA,CAAK,aAAa,IAAA,EAAM;AACvE,UAAA,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,QAC5B,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,mBAAmB,IAAI,CAAA;AAAA,QAC9B;AACA,QAAA;AAAA,MACF;AAAA,MAEA,KAAK,UAAA;AAAA,MACL,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA,EAAQ,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,IAAA,IAAQ,EAAE,CAAA;AACjF,QAAA;AAAA,MAEF,KAAK,aAAA;AACH,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA;AAAA,UAC1B,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,OAAA;AAAA,UACnC,QAAQ,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,OAAA,IAAW,KAAK,KAAK;AAAA,SACrD;AACA,QAAA;AAAA,MAEF,KAAK,OAAA;AACH,QAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,WAAW,IAAA,CAAK,KAAA,IAAS,OAAO,CAAC,CAAC,CAAA;AAClF,QAAA;AAAA,MAEF,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAU,CAAA;AACrD,QAAA,IAAA,CAAK,UAAA,CAAW;AAAA,UACd,MAAA,EAAQ,cAAc,IAAI,CAAA;AAAA,UAC1B,OAAA,EAAS,YAAY,IAAI,CAAA;AAAA,UACzB,OAAA,EAAS,WAAA,CAAY,IAAI,CAAA,IAAK;AAAA,SAC/B,CAAA;AACD,QAAA;AAAA;AACJ,EACF;AAAA;AAAA,EAIQ,SAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA,GAAkB,KAAA;AAAA;AAAA,EAGhB,eAAA,GAAoC;AAC5C,IAAA,IAAA,CAAK,SAAA,KAAc,uBAAA,CAAwB,IAAA,CAAK,MAAM,CAAA;AACtD,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWU,eAAA,GAAoD;AAC5D,IAAA,IAAI,IAAA,CAAK,eAAA,EAAiB,OAAO,IAAA,CAAK,UAAA;AACtC,IAAA,MAAM,OAAA,GAAU,uBAAA;AAAA,MACd,KAAK,UAAA,CAAW,EAAA;AAAA,MAChB,IAAA,CAAK,WAAA;AAAA,MACL,KAAK,eAAA;AAAgB,KACvB;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,QAAA,IAAY,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,OAAO,CAAA;AACpE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA;AAClB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAe,KAAA,GAAuB;AACpC,IAAA,IAAA,CAAK,eAAA,EAAgB;AACrB,IAAA,MAAM,MAAM,KAAA,EAAM;AAAA,EACpB;AAAA,EAEmB,eAAe,OAAA,EAAmC;AACnE,IAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,MAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AAAA,IACzB;AAAA,EACF;AAAA;AAAA,EAGS,QAAA,GAA+B;AACtC,IAAA,OAAO,uBAAuB,IAAA,CAAK,eAAA,EAAiB,CAAA,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AAAA,EACxF;AACF;AAuBO,IAAM,YAAA,GAAN,cAA2B,kBAAA,CAAmB;AAAA,EAC1C,UAAA,GAAyB;AAAA,IAChC,EAAA,EAAI,QAAA;AAAA,IACJ,IAAA,EAAM,YAAA;AAAA,IACN,aAAA,EAAe,KAAA;AAAA,IACf,mBAAA,EAAqB;AAAA,GACvB;AAAA,EAEmB,GAAA,GAAc,gBAAgB,QAAQ,CAAA;AAAA,EACtC,UAAA,GAAa,QAAA;AAAA,EACb,WAAA,GAAc,YAAA;AAAA,EACd,SAAA,GAAY,QAAA;AAAA,EAErB,SAAA,CAAU,SAAiB,QAAA,EAAwC;AAC3E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,kEAAA,EAAoE;AAAA,QAChF;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,MAAM,IAAA,GAAO,CAAC,IAAA,EAAM,OAAA,EAAS,mBAAmB,aAAa,CAAA;AAC7D,IAAA,MAAM,QAAQ,IAAA,CAAK,eAAA,EAAgB,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AACrE,IAAA,IAAI,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,KAAK,CAAA;AAChC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEU,QAAA,GAAmC;AAC3C,IAAA,MAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,gBAAA,EAAkB,gBAAA,EAAkB,wBAAwB,CAAC,CAAA;AACvF,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,IAAI,CAAC,SAAS,OAAO,GAAA;AAIrB,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,sBAAA;AACX,IAAA,MAAM,GAAA,GAAM,oBAAA,CAAqB,OAAA,CAAQ,UAAA,EAAY,QAAQ,KAAA,EAAO;AAAA,MAClE,GAAA,EAAK,IAAA,CAAK,eAAA,EAAgB,CAAE;AAAA,KAC7B,CAAA;AACD,IAAA,IAAI,GAAA,MAAS,cAAA,GAAiB,GAAA;AAG9B,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,EAAyB;AAClE,MAAA,GAAA,CAAI,yBAAyB,OAAA,CAAQ,OAAA;AAAA,IACvC;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEU,WAAA,GAAsB;AAC9B,IAAA,OAAO,iHAAA;AAAA,EACT;AAAA,EAEmB,YAAA,CAAa,MAAqB,MAAA,EAA+B;AAClF,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,8CAAA;AAAA,QACT,QAAA,EAAU,YAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM;AAAA,OACR;AAAA,IACF;AACA,IAAA,IAAI,IAAA,KAAS,IAAI,OAAO,IAAA;AACxB,IAAA,OAAO,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAe,UAAA,GAAoC;AACjD,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,MAAM,OAAA,GAAU,uBAAuB,OAAO,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,OAAA,GACR,oBAAA,CAAqB,OAAA,CAAQ,YAAY,OAAA,CAAQ,KAAA,EAAO,EAAE,GAAA,EAAK,OAAA,CAAQ,SAAA,EAAW,CAAA,GAClF,QAAQ,SAAA,CAAU,cAAA;AACtB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,eAAA,CAAgB,QAAQ,CAAA;AACzC,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,QAAA;AAAA,MACA,GAAA;AAAA,MACA,OAAA,EAAS,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,GACpC,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAC3B;AAAC,KACP;AACA,IAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,GAAI,MAAA,CAAO,MAAA,GAAS,eAAA,CAAgB,QAAQ,CAAA;AAAA,EACzF;AACF;AAMO,IAAM,kBAAA,GAAgD;AAAA,EAC3D,EAAA,EAAI,QAAA;AAAA,EACJ,WAAA,EAAa,sBAAA,CAAuB,MAAA,EAAQ,IAAA,IAAQ,YAAA;AAAA,EACpD,UAAA,EAAY,CAAA;AAAA,EACZ,YAAA,EAAgB,CAAA,CAAA,MAAA,CAAoB,MAAM,IAAI,CAAA;AAAA,EAC9C,QAAQ,OAAO,MAAA,EAAQ,IAAA,KAAS,IAAI,aAAa,MAAM,CAAA;AAAA,EACvD,UAAA,EAAY,OAAO,QAAA,EAAU,OAAA,KAC3B,IAAI,YAAA,CAAa;AAAA,IACf,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IACjB,SAAA,EAAW,YAAA;AAAA,IACX,GAAG,oBAAA,CAAqB,QAAA,EAAU,OAAO;AAAA,GAC1C,EAAE,UAAA;AACP","file":"chunk-VRLKHL74.js","sourcesContent":["import type { DriverTarget } from \"@skaile/workspaces/plugin-registry\";\nimport type { Logger } from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nimport { getBridgeLogger } from \"../logger.js\";\nimport { fetchProviderModels, getStaticModels, type ModelEntry } from \"../models.js\";\nimport { getProviderPreset } from \"../provider-catalog.js\";\nimport { entryCredentialValue } from \"../provider-materialize/credential-env.js\";\nimport {\n  bindSingleProviderEntry,\n  type EnvDriverSession,\n  type RegistryModelBinding,\n  resolveEnvDriverSession,\n  resolveRegistryBinding,\n} from \"../provider-materialize/env-drivers.js\";\nimport { registryDriverConfig } from \"../provider-registry-derive.js\";\nimport { BUILTIN_DRIVER_CATALOG } from \"../registry.js\";\nimport type { AgentConfig, DriverInfo, ReconfigureApplied } from \"../types.js\";\nimport { extractCost, extractText, extractTokens, SubprocessCliDriver } from \"./_subprocess-cli.js\";\n\n/**\n * The Gemini API host the CLI talks to unless told otherwise — the catalog's\n * `google` preset, so the two can never drift apart.\n */\nconst GOOGLE_DEFAULT_BASE_URL = getProviderPreset(\"google\")?.base_url;\n\n/**\n * Shared base for the Gemini-CLI event family. Gemini CLI and Qwen Code (a fork\n * of Gemini CLI) emit the same `stream-json` event shape, so both dispatch the\n * same {@link handleJson}: `init`/`system` → session capture, `message`/\n * `assistant` → streamed assistant text, `tool_use` / `tool_result` → tool\n * events, `result` → tokens + cost.\n *\n * @docLink packages/bridge/drivers#gemini-driver\n */\nexport abstract class GeminiFamilyDriver extends SubprocessCliDriver {\n  protected handleJson(json: any): void {\n    switch (json?.type) {\n      case \"init\":\n      case \"system\":\n        this.captureSession(json.sessionId ?? json.session_id ?? json.id);\n        break;\n\n      case \"message\":\n      case \"assistant\": {\n        const role = json.role ?? json.message?.role ?? \"assistant\";\n        if (role !== \"assistant\") break;\n        const text = extractText(json);\n        if (json.done === true || json.final === true || json.finished === true) {\n          this.pushAssistantEnd(text);\n        } else {\n          this.pushAssistantDelta(text);\n        }\n        break;\n      }\n\n      case \"tool_use\":\n      case \"tool_call\":\n        this.pushToolCall(json.name ?? json.tool ?? \"tool\", json.input ?? json.args ?? {});\n        break;\n\n      case \"tool_result\":\n        this.pushToolResult(\n          json.name ?? json.tool ?? \"tool\",\n          json.result ?? json.output ?? json.content,\n          Boolean(json.is_error ?? json.isError ?? json.error),\n        );\n        break;\n\n      case \"error\":\n        this.pushError(this.classifyMessage(String(json.message ?? json.error ?? \"error\")));\n        break;\n\n      case \"result\":\n        this.captureSession(json.sessionId ?? json.session_id);\n        this.pushResult({\n          tokens: extractTokens(json),\n          costUsd: extractCost(json),\n          summary: extractText(json) || \"Task completed\",\n        });\n        break;\n    }\n  }\n\n  // ── Registry binding ──────────────────────────────────────────────────────\n\n  private providers?: EnvDriverSession;\n  private boundEntry?: RegistryModelBinding;\n  private bindingResolved = false;\n\n  /** This session's AI providers, resolved once from the config. */\n  protected providerSession(): EnvDriverSession {\n    this.providers ??= resolveEnvDriverSession(this.config);\n    return this.providers;\n  }\n\n  /**\n   * The AI provider entry this session's model selector names, memoized until\n   * the model changes.\n   *\n   * Gemini CLI and Qwen Code are `single`-plurality harnesses (§2.3): they\n   * address one endpoint, so the bound entry supplies both the credential and\n   * the base URL. Resolving through {@link bindSingleProviderEntry} is what\n   * puts the surface check — which throws — on the start path.\n   */\n  protected registryBinding(): RegistryModelBinding | undefined {\n    if (this.bindingResolved) return this.boundEntry;\n    const binding = bindSingleProviderEntry(\n      this.driverInfo.id,\n      this.productName,\n      this.providerSession(),\n    );\n    for (const warning of binding?.warnings ?? []) this.log.warn(warning);\n    this.boundEntry = binding;\n    this.bindingResolved = true;\n    return binding;\n  }\n\n  /**\n   * Fail before the first spawn when the bound entry speaks a surface this\n   * harness cannot — the error names the surface.\n   */\n  override async start(): Promise<void> {\n    this.registryBinding();\n    await super.start();\n  }\n\n  protected override onReconfigured(applied: ReconfigureApplied): void {\n    if (applied.model !== undefined) {\n      this.providers = undefined;\n      this.bindingResolved = false;\n    }\n  }\n\n  /** The provider-side model id the harness is actually run with. */\n  override getModel(): string | undefined {\n    return resolveRegistryBinding(this.providerSession())?.providerModelId ?? this.config.model;\n  }\n}\n\n/**\n * Agent driver for the Google **Gemini CLI** (`gemini`).\n *\n * Spawns `gemini -p \"<prompt>\" --output-format stream-json` per turn and maps\n * the stream-json events to the unified {@link AgentEvent} stream. Google\n * models only (`surface: google-generative-ai`): the AI provider entry the\n * session's model selector names supplies `GEMINI_API_KEY`, the `-m` model id\n * and — for a non-default endpoint — `GOOGLE_GEMINI_BASE_URL`.\n *\n * @remarks\n * - **Requires Gemini CLI ≥ v0.6.1** — earlier versions reject\n *   `--output-format`. A too-old CLI surfaces as a `process`-category exit error.\n * - **Session resume is not available in headless (`-p`) mode** — the CLI errors\n *   if asked to resume non-interactively, so this driver runs single-turn per\n *   process and logs a warning when a resume id is present.\n * - Exit codes: `42` → input/validation error, `53` → turn-limit (treated as a\n *   completed turn).\n *\n * @see https://github.com/google-gemini/gemini-cli\n * @docLink packages/bridge/drivers#gemini-driver\n */\nexport class GeminiDriver extends GeminiFamilyDriver {\n  readonly driverInfo: DriverInfo = {\n    id: \"gemini\",\n    name: \"Gemini CLI\",\n    modelAgnostic: false,\n    supportsInBandAbort: false,\n  };\n\n  protected readonly log: Logger = getBridgeLogger(\"gemini\");\n  protected readonly defaultBin = \"gemini\";\n  protected readonly productName = \"Gemini CLI\";\n  protected readonly envPrefix = \"GEMINI\";\n\n  protected buildArgs(message: string, resumeId: string | undefined): string[] {\n    if (resumeId) {\n      this.log.warn(\"Gemini CLI cannot resume in headless mode; starting a fresh turn\", {\n        resumeId,\n      });\n    }\n    const args = [\"-p\", message, \"--output-format\", \"stream-json\"];\n    const model = this.registryBinding()?.providerModelId ?? this.config.model;\n    if (model) args.push(\"-m\", model);\n    return args;\n  }\n\n  protected buildEnv(): Record<string, string> {\n    const env = this.baseEnv([\"GEMINI_API_KEY\", \"GOOGLE_API_KEY\", \"GOOGLE_GEMINI_BASE_URL\"]);\n    const binding = this.registryBinding();\n    if (!binding) return env;\n\n    // The entry is the authority: inherited Google carriers are dropped so an\n    // ambient key cannot authenticate a session pointed somewhere else.\n    delete env.GEMINI_API_KEY;\n    delete env.GOOGLE_API_KEY;\n    delete env.GOOGLE_GEMINI_BASE_URL;\n    const key = entryCredentialValue(binding.providerId, binding.entry, {\n      env: this.providerSession().lookupEnv,\n    });\n    if (key) env.GEMINI_API_KEY = key;\n    // Only a non-default endpoint is worth naming: Gemini CLI reads\n    // GOOGLE_GEMINI_BASE_URL as an override of its own default host.\n    if (binding.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL) {\n      env.GOOGLE_GEMINI_BASE_URL = binding.baseUrl;\n    }\n    return env;\n  }\n\n  protected installHint(): string {\n    return \"Gemini CLI is not installed or not on your PATH. Install it with `npm i -g @google/gemini-cli` (≥ v0.6.1).\";\n  }\n\n  protected override classifyExit(code: number | null, signal: NodeJS.Signals | null) {\n    if (code === 42) {\n      return {\n        message: \"Gemini CLI reported an input error (exit 42)\",\n        category: \"validation\" as const,\n        retryable: false,\n        hint: \"The prompt or flags were rejected by Gemini CLI. Check the model name and arguments.\",\n      };\n    }\n    if (code === 53) return null; // turn-limit — the result was already emitted.\n    return super.classifyExit(code, signal);\n  }\n\n  /**\n   * Discovery runs against the bound entry: its credential and, for a\n   * non-default endpoint, its base URL. Without an entry the ambient\n   * `GEMINI_API_KEY` is the last resort, and an unreachable API falls back to\n   * the static Google catalog.\n   */\n  override async listModels(): Promise<ModelEntry[]> {\n    const session = this.providerSession();\n    const binding = resolveRegistryBinding(session);\n    const key = binding\n      ? entryCredentialValue(binding.providerId, binding.entry, { env: session.lookupEnv })\n      : session.lookupEnv.GEMINI_API_KEY;\n    if (!key) return getStaticModels(\"google\");\n    const result = await fetchProviderModels(\n      \"google\",\n      key,\n      binding?.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL\n        ? { baseUrl: binding.baseUrl }\n        : {},\n    );\n    return result.ok && result.models.length > 0 ? result.models : getStaticModels(\"google\");\n  }\n}\n\n/**\n * `DriverTarget` wrapper for the gemini driver. Registered into the plugin\n * registry by `registerBuiltinDrivers()`.\n */\nexport const geminiDriverTarget: DriverTarget<AgentConfig> = {\n  id: \"gemini\",\n  displayName: BUILTIN_DRIVER_CATALOG.gemini?.name ?? \"Gemini CLI\",\n  apiVersion: 1,\n  configSchema: z.custom<AgentConfig>(() => true),\n  create: async (config, _ctx) => new GeminiDriver(config),\n  listModels: async (registry, options) =>\n    new GeminiDriver({\n      cwd: process.cwd(),\n      sessionId: \"model-list\",\n      ...registryDriverConfig(registry, options),\n    }).listModels(),\n};\n"]}

package/dist/{chunk-Z2K6BGUR.js → chunk-WI4T3KIS.js}

@@ -1,15 +1,15 @@
-import { openLibraryManager } from './chunk-CLTHEKHR.js';
-import { logErr, logInfo, logWarn, logOk, S } from './chunk-TRSQP3JD.js';
-import { getKindRegistry } from './chunk-SBFW3CJH.js';
-import { getStoreManifestsDir, LocalCatalogSource, curatedManifestOverlay, writeCuratedManifest } from './chunk-3BEY4WK3.js';
-import { computeDeterministicHash, discoverAssetsInTree } from './chunk-GEWAIQZ5.js';
-import { WorkspaceYamlEditor } from './chunk-2FMEGSBN.js';
-import { findWorkspaceRoot, workspaceConfigFilename, sourceShortName, sourceCacheKey, storeManifestSlug, getGlobalCacheDir, attachToBranch, legacySourceCacheKey, resolveSourcePublisher } from './chunk-JZCSNEHK.js';
+import { openLibraryManager } from './chunk-JQ3DXNQV.js';
+import { logErr, logInfo, logWarn, logOk, S } from './chunk-POQ6PGNE.js';
+import { getKindRegistry } from './chunk-GWD3QNVS.js';
+import { getStoreManifestsDir, LocalCatalogSource, curatedManifestOverlay, writeCuratedManifest, commitStoreManifest } from './chunk-C3BMXXTN.js';
+import { computeDeterministicHash, discoverAssetsInTree } from './chunk-7CR2OZPA.js';
+import { WorkspaceYamlEditor } from './chunk-T5TSLSRO.js';
+import { findWorkspaceRoot, workspaceConfigFilename, sourceShortName, sourceCacheKey, storeManifestSlug, getGlobalCacheDir, attachToBranch, legacySourceCacheKey, resolveSourcePublisher } from './chunk-PNOGX36L.js';
 import { globalCacheRoot } from './chunk-L5VSIPQD.js';
-import { decodeSkaileManifest, encodeSkaileManifest } from './chunk-IXWODEED.js';
-import { parseAssetRef } from './chunk-4OV5DSBB.js';
+import { decodeSkaileManifest, encodeSkaileManifest } from './chunk-CTP3XBMF.js';
+import { parseAssetRef } from './chunk-PNTXHTBC.js';
 import { spawnSync } from 'child_process';
-import { existsSync, rmSync, renameSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { existsSync, rmSync, renameSync, mkdirSync, readdirSync, rmdirSync, readFileSync, writeFileSync } from 'fs';
 import * as path2 from 'path';
 import * as p from '@clack/prompts';
 import { Command } from 'commander';
@@ -83,9 +83,13 @@ async function runInit(arg, opts) {
     );
     return;
   }
+  commitStoreManifest(
+    target,
+    `manifest init: ${sourceShortName(url)} (${written.assetCount} assets)`
+  );
   logOk(`Wrote curated manifest with ${written.assetCount} assets to ${S.dim(target)}.`);
   logInfo(
-    `Edit it with \`skaile source manifest edit ${arg}\`, then \`skaile source add ${arg}\` to consume it.`
+    `Edit it with \`skaile source manifest edit ${arg}\`, then \`skaile source add ${url}\` to consume it.`
   );
   if (errors.length > 0) {
     logWarn(`${errors.length} discovery error(s) \u2014 inspect the manifest before consuming.`);
@@ -149,6 +153,10 @@ async function runRebuild(arg, opts) {
       force: true,
       inheritPublisher: true
     });
+    commitStoreManifest(
+      target,
+      `manifest rebuild --overwrite: ${slug} (${written.assetCount} assets)`
+    );
     logOk(
       `Rebuilt curated manifest with ${written.assetCount} assets to ${S.dim(target)} (overwrite).`
     );
@@ -197,6 +205,10 @@ async function runRebuild(arg, opts) {
   }
   const merged = { ...existing, assets: kept };
   writeFileSync(target, encodeSkaileManifest(merged), "utf-8");
+  commitStoreManifest(
+    target,
+    `manifest rebuild: ${slug} (kept ${kept.length}, dropped ${dropped.length})`
+  );
   logOk(
     `Rebuilt curated manifest: kept ${kept.length}, dropped ${dropped.length} \u2192 ${S.dim(target)}.`
   );
@@ -294,6 +306,7 @@ function runEdit(arg, opts, spawn = spawnSync) {
     logErr(`Editor exited with status ${res.status}.`);
     process.exit(1);
   }
+  commitStoreManifest(target, `manifest edit: ${slug}`);
   const { diagnostics } = decodeSkaileManifest(readFileSync(target, "utf-8"));
   const errors = diagnostics.filter((d) => d.severity === "error");
   const warnings = diagnostics.filter((d) => d.severity !== "error");
@@ -316,12 +329,12 @@ function addSourceManifestCommands(src) {
   ).option("-C, --project-dir <dir>", "Project directory", process.cwd()).option("--publisher <name>", "Override the publisher (--overwrite only)").option("--dev", "Include assets under the source's dev_paths", false).option("--overwrite", "Discard curation and re-scan the full inventory", false).action((arg, opts) => runRebuild(arg, opts));
   manifest.command("verify <src>").description("Verify hashes, deps, and schema (read-only)").option("-C, --project-dir <dir>", "Project directory", process.cwd()).option("--strict", "Fail on advisory checks (warnings force a nonzero exit)", false).action((arg, opts) => runVerify(arg, opts));
   manifest.command("publish <src>").description("Push the curated sidecar manifest and publish it to the store").option("-C, --project-dir <dir>", "Project directory", process.cwd()).option("--as <namespace>", "Publisher namespace (default: your store username)").option("--sidecar-repo <url>", "Public GitHub repo you own to hold the curated manifest").option("--ref <gitref>", "Foreign source ref to ingest (branch/sha; default: main)").option("--dry-run", "Print the publish plan without pushing or calling the store", false).action(async (arg, opts) => {
-    const { runPublish } = await import('./source-manifest-publish-CLEE6TNH.js');
+    const { runPublish } = await import('./source-manifest-publish-NMRLXWVW.js');
     await runPublish(arg, opts);
   });
   manifest.command("propose <src>").description("Open a PR to upstream with the sidecar manifest").action(() => notWired("propose"));
   manifest.command("yank <src>").description("Retract the source's published assets from the store").option("-C, --project-dir <dir>", "Project directory", process.cwd()).option("--asset <ref>", "Yank only the asset matching this ref/name").action(async (arg, opts) => {
-    const { runYank } = await import('./source-manifest-publish-CLEE6TNH.js');
+    const { runYank } = await import('./source-manifest-publish-NMRLXWVW.js');
     await runYank(arg, opts);
   });
 }
@@ -405,6 +418,18 @@ function readProjectSources(yamlPath) {
     process.exit(1);
   }
 }
+function pruneEmptyCloneParents(dest) {
+  let dir = path2.dirname(dest);
+  while (path2.basename(dir) !== "sources" && dir !== path2.dirname(dir)) {
+    try {
+      if (readdirSync(dir).length > 0) return;
+      rmdirSync(dir);
+    } catch {
+      return;
+    }
+    dir = path2.dirname(dir);
+  }
+}
 function ensureClone(entry, opts = {}) {
   const dest = sourceClonePath(sourceCacheKey(entry.url));
   let backup;
@@ -422,6 +447,9 @@ function ensureClone(entry, opts = {}) {
     if (backup) {
       rmSync(dest, { recursive: true, force: true });
       renameSync(backup, dest);
+    } else {
+      rmSync(dest, { recursive: true, force: true });
+      pruneEmptyCloneParents(dest);
     }
     logErr(`git clone failed for ${entry.url}`);
     process.exit(1);
@@ -569,9 +597,16 @@ function makeSourceCommand() {
     "Manage github sources for the current project (recorded in skaile.yaml)"
   );
   cmd.command("add <source>").description(
-    "Clone a github repo and register it in this project's skaile.yaml. <source> may be a full git URL, an owner/repo shorthand, or a bare name (\u2192 git@github.com:skaile-ai/<name>.git)."
+    "Clone a github repo and register it in this project's skaile.yaml. <source> is a full git URL or an owner/repo shorthand (\u2192 git@github.com:<owner>/<repo>.git)."
   ).option("--name <slug>", "[deprecated] no-op \u2014 the source entry stores only the URL").option("--pin <ref>", "Pin a branch, tag, or 40-char SHA").option("--branch <branch>", "[deprecated] alias for --pin").option("--force", "Remove an existing clone and re-clone", false).option("--dev", "Also index dev-only assets under the source's dev_paths", false).action(
     async (source, opts) => {
+      if (/^[\w.-]+$/.test(source.trim().replace(/\.git$/, ""))) {
+        logErr(
+          `"${source}" is not a git URL or an owner/repo shorthand. Use \`skaile source add <owner>/<repo>\` or the full URL (for a curated manifest: \`skaile source add <the repo URL>\`).`
+        );
+        process.exitCode = 1;
+        return;
+      }
       const url = normalizeSourceUrl(source);
       const yamlPath = requireProjectYamlPath();
       const collision = findCacheKeyCollision(readProjectSources(yamlPath), url);
@@ -773,5 +808,5 @@ function makeSourceCommand() {
 }
 
 export { autoSyncForSearch, divergedSourceClones, ensureClone, findCacheKeyCollision, indexingHadFailures, legacySourceConfigHint, makeSourceCommand, normalizeSourceUrl, pullSourceClone, readProjectSources, resolveSource, resolveSourceArg, sourceClonePath, sourceLabel, sourceMatchesKey, syncProjectSources };
-//# sourceMappingURL=chunk-Z2K6BGUR.js.map
-//# sourceMappingURL=chunk-Z2K6BGUR.js.map
+//# sourceMappingURL=chunk-WI4T3KIS.js.map
+//# sourceMappingURL=chunk-WI4T3KIS.js.map

package/dist/chunk-WI4T3KIS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../cli/src/commands/source-manifest.ts","../cli/src/commands/source.ts"],"names":["path","existsSync","spawnSync","dest"],"mappings":";;;;;;;;;;;;;;;;AAmDA,IAAM,aAAA,GACJ,2IAAA;AAGF,SAAS,SAAS,IAAA,EAAqB;AACrC,EAAA,MAAA,CAAO,CAAA,EAAG,aAAa,CAAA,wBAAA,EAA2B,IAAI,CAAA,CAAA,CAAG,CAAA;AACzD,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB;AAkBO,SAAS,gBAAA,CACd,KACA,UAAA,EACmE;AACnE,EAAA,MAAM,IAAA,GAAO,kBAAkB,UAAU,CAAA;AACzC,EAAA,MAAM,UAAA,GAA4B,OAC9B,kBAAA,CAAwBA,KAAA,CAAA,IAAA,CAAK,MAAM,uBAAA,EAAyB,CAAC,CAAA,GAC7D,EAAC;AACL,EAAA,MAAM,KAAA,GAAQ,WAAW,IAAA,CAAK,CAAC,MAAM,gBAAA,CAAiB,CAAA,EAAG,GAAG,CAAC,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,CAAC,KAAA,GAAQ,kBAAA,CAAmB,GAAG,CAAA,GAAI,MAAA;AAClD,EAAA,MAAM,MAAM,KAAA,GAAQ,KAAA,CAAM,MAAO,MAAA,EAAQ,GAAA,IAAO,mBAAmB,GAAG,CAAA;AACtE,EAAA,MAAM,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAChC,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,GAAG,CAAC,CAAA;AAChD,EAAA,OAAO,EAAE,KAAK,IAAA,EAAM,IAAA,EAAM,cAAc,MAAA,EAAQ,YAAA,IAAgB,iBAAA,CAAkB,GAAG,CAAA,EAAE;AACzF;AAQA,SAAS,mBAAmB,GAAA,EAAgE;AAG1F,EAAA,IAAI,CAAC,oBAAoB,IAAA,CAAK,GAAG,KAAK,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG,OAAO,MAAA;AACjE,EAAA,MAAM,eAAoBA,KAAA,CAAA,IAAA,CAAK,oBAAA,EAAqB,EAAG,CAAA,EAAG,GAAG,CAAA,KAAA,CAAO,CAAA;AACpE,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG,OAAO,MAAA;AAItC,EAAA,MAAM,CAAC,IAAA,EAAM,KAAA,EAAO,IAAI,CAAA,GAAI,GAAA,CAAI,MAAM,IAAI,CAAA;AAC1C,EAAA,MAAM,GAAA,GAAM,IAAA,IAAQ,KAAA,IAAS,IAAA,GAAO,CAAA,QAAA,EAAW,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,GAAA;AACzE,EAAA,OAAO,EAAE,KAAK,YAAA,EAAa;AAC7B;AAOA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAYA,WAAK,oBAAA,EAAqB,EAAG,GAAG,iBAAA,CAAkB,GAAG,CAAC,CAAA,KAAA,CAAO,CAAA;AAC3E;AASA,IAAM,qBAAA,uBAA4B,GAAA,CAAI;AAAA,EACpC,OAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC,CAAA;AASD,SAAS,mBAAmB,YAAA,EAA+B;AACzD,EAAA,MAAM,WAAW,YAAA,CAAa,OAAA,CAAQ,OAAO,GAAG,CAAA,CAAE,MAAM,GAAG,CAAA;AAC3D,EAAA,OAAO,SAAS,IAAA,CAAK,CAAC,MAAM,qBAAA,CAAsB,GAAA,CAAI,CAAC,CAAC,CAAA;AAC1D;AAMA,eAAe,OAAA,CACb,KACA,IAAA,EACe;AACf,EAAA,MAAM,UAAA,GAAkBA,KAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,EAAE,KAAK,IAAA,EAAM,YAAA,EAAc,QAAO,GAAI,gBAAA,CAAiB,KAAK,UAAU,CAAA;AAE5E,EAAA,IAAI,UAAA,CAAW,MAAM,CAAA,IAAK,CAAC,KAAK,KAAA,EAAO;AACrC,IAAA,OAAA;AAAA,MACE,CAAA,qCAAA,EAAwC,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,2JAAA;AAAA,KAGvD;AACA,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAqB,EAAE,GAAA,EAAI;AACjC,EAAA,WAAA,CAAY,KAAK,CAAA;AAEjB,EAAA,MAAM,EAAE,QAAQ,MAAA,EAAO,GAAI,wBAAwB,IAAA,EAAM,IAAA,CAAK,OAAO,KAAK,CAAA;AAE1E,EAAA,MAAM,YAAY,IAAA,CAAK,SAAA,IAAa,uBAAuB,IAAI,CAAA,IAAK,gBAAgB,GAAG,CAAA;AAEvF,EAAA,MAAM,UAAU,oBAAA,CAAqB;AAAA,IACnC,YAAA,EAAc,MAAA;AAAA,IACd,SAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAO,IAAA,CAAK,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMZ,gBAAA,EAAkB;AAAA,GACnB,CAAA;AAED,EAAA,IAAI,CAAC,QAAQ,KAAA,EAAO;AAClB,IAAA,OAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,oDAAA;AAAA,KAErD;AACA,IAAA;AAAA,EACF;AAEA,EAAA,mBAAA;AAAA,IACE,MAAA;AAAA,IACA,kBAAkB,eAAA,CAAgB,GAAG,CAAC,CAAA,EAAA,EAAK,QAAQ,UAAU,CAAA,QAAA;AAAA,GAC/D;AACA,EAAA,KAAA,CAAM,CAAA,4BAAA,EAA+B,QAAQ,UAAU,CAAA,WAAA,EAAc,EAAE,GAAA,CAAI,MAAM,CAAC,CAAA,CAAA,CAAG,CAAA;AAGrF,EAAA,OAAA;AAAA,IACE,CAAA,2CAAA,EAA8C,GAAG,CAAA,6BAAA,EACxB,GAAG,CAAA,iBAAA;AAAA,GAC9B;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,OAAA,CAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iEAAA,CAA8D,CAAA;AAAA,EACxF;AACF;AAOA,SAAS,uBAAA,CACP,MACA,UAAA,EACiF;AACjF,EAAA,MAAM,MAAA,GAAS,qBAAqB,IAAA,EAAM;AAAA,IACxC,UAAU,eAAA,EAAgB;AAAA,IAC1B;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAM,CAAC,kBAAA,CAAmB,CAAA,CAAE,YAAY,CAAC,CAAA;AAC9E,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,CAAO,OAAO,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,KAAK,EAAE,CAAA,EAAE;AAC7E;AAOA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,KAAA,EAAO,CAAC,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,WAAW,CAAA,EAAG,EAAE,KAAA,EAAO,MAAA,EAAQ,CAAA;AACjF,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,OAAA;AAAA,MACE;AAAA,KAEF;AAAA,EACF;AACF;AAQA,SAAS,aAAa,KAAA,EAA2B;AAC/C,EAAA,IAAI,KAAA,CAAM,IAAA,EAAM,OAAO,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACxE,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,EAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,CAAC,CAAA,KAAM,QAAA,GAAW,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA;AACjE,IAAA,MAAM,MAAWA,KAAA,CAAA,KAAA,CAAM,OAAA,CAAQ,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAC,CAAA;AACxD,IAAA,OAAO,GAAA,KAAQ,GAAA,GAAM,KAAA,CAAM,IAAA,GAAO,GAAA;AAAA,EACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA;AACf;AAGA,SAAS,kBAAkB,YAAA,EAA8B;AACvD,EAAA,MAAM,MAAWA,KAAA,CAAA,KAAA,CAAM,OAAA,CAAQ,aAAa,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAC,CAAA;AAC/D,EAAA,OAAO,GAAA,KAAQ,MAAWA,KAAA,CAAA,KAAA,CAAM,QAAA,CAAS,aAAa,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAC,CAAA,GAAI,GAAA;AAC/E;AAGA,SAAS,SAAS,KAAA,EAA2B;AAC3C,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AACpC;AAgBA,eAAe,UAAA,CACb,KACA,IAAA,EACe;AACf,EAAA,MAAM,UAAA,GAAkBA,KAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,EAAE,KAAK,IAAA,EAAM,IAAA,EAAM,cAAc,MAAA,EAAO,GAAI,gBAAA,CAAiB,GAAA,EAAK,UAAU,CAAA;AAElF,EAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG;AACvB,IAAA,MAAA;AAAA,MACE,4BAA4B,IAAI,CAAA,KAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,kDAAA;AAAA,KAEvD;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,MAAM,KAAA,GAAqB,EAAE,GAAA,EAAI;AACjC,EAAA,MAAM,MAAA,GAAS,YAAY,KAAK,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,EAAQ,eAAA,CAAgB,IAAI,CAAA;AAEjC,EAAA,MAAM,EAAE,QAAQ,WAAA,EAAa,MAAA,KAAW,uBAAA,CAAwB,IAAA,EAAM,IAAA,CAAK,GAAA,IAAO,KAAK,CAAA;AAEvF,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,OAAA;AAAA,MACE;AAAA,KAEF;AACA,IAAA,MAAM,YAAY,IAAA,CAAK,SAAA,IAAa,uBAAuB,IAAI,CAAA,IAAK,gBAAgB,GAAG,CAAA;AACvF,IAAA,MAAM,UAAU,oBAAA,CAAqB;AAAA,MACnC,YAAA,EAAc,MAAA;AAAA,MACd,SAAA;AAAA,MACA,MAAA,EAAQ,WAAA;AAAA,MACR,KAAA,EAAO,IAAA;AAAA,MACP,gBAAA,EAAkB;AAAA,KACnB,CAAA;AACD,IAAA,mBAAA;AAAA,MACE,MAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,CAAA,EAAA,EAAK,OAAA,CAAQ,UAAU,CAAA,QAAA;AAAA,KAC9D;AACA,IAAA,KAAA;AAAA,MACE,iCAAiC,OAAA,CAAQ,UAAU,cAAc,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,aAAA;AAAA,KAChF;AACA,IAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,MAAA,OAAA,CAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iEAAA,CAA8D,CAAA;AAAA,IACxF;AACA,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,OAAA;AAAA,MACE;AAAA,KAEF;AAAA,EACF;AAGA,EAAA,MAAM,EAAE,UAAU,QAAA,EAAS,GAAI,qBAAqB,YAAA,CAAa,MAAA,EAAQ,OAAO,CAAC,CAAA;AACjF,EAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,MAAA,IAAU,EAAC;AAG5C,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAA0C;AAClE,EAAA,KAAA,MAAW,CAAA,IAAK,aAAa,WAAA,CAAY,GAAA,CAAI,kBAAkB,CAAA,CAAE,YAAY,GAAG,CAAC,CAAA;AAEjF,EAAA,MAAM,OAAqB,EAAC;AAC5B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,KAAK,eAAA,EAAiB;AAC/B,IAAA,IAAI,WAAA,CAAY,IAAI,YAAA,CAAa,CAAC,CAAC,CAAA,EAAG,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,SAC5C,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,CAAA;AAAA,EAC/B;AAGA,EAAA,MAAM,gBAAgB,IAAI,GAAA,CAAI,eAAA,CAAgB,GAAA,CAAI,YAAY,CAAC,CAAA;AAC/D,EAAA,MAAM,iBAA2B,EAAC;AAClC,EAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,IAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,kBAAkB,CAAA,CAAE,YAAY,CAAC,CAAA,EAAG;AACzD,MAAA,cAAA,CAAe,KAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAAA,IAC3C;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,GAAS,CAAA;AACjC,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,OAAA,CAAQ,4BAA4B,OAAA,CAAQ,IAAA,GAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EACjE;AACA,EAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAC7B,IAAA,OAAA;AAAA,MACE,CAAA,EAAG,cAAA,CAAe,MAAM,CAAA,8CAAA,EACnB,cAAA,CAAe,IAAA,EAAK,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,+CAAA,EAA6C,GAAG,CAAA,YAAA;AAAA,KACvF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,KAAA,CAAM,oBAAoB,CAAA;AAC1B,IAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,MAAA,OAAA,CAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,kEAAA,CAA+D,CAAA;AAAA,IACzF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAA4B,EAAE,GAAG,QAAA,EAAU,QAAQ,IAAA,EAAK;AAC9D,EAAA,aAAA,CAAc,MAAA,EAAQ,oBAAA,CAAqB,MAAM,CAAA,EAAG,OAAO,CAAA;AAC3D,EAAA,mBAAA;AAAA,IACE,MAAA;AAAA,IACA,qBAAqB,IAAI,CAAA,OAAA,EAAU,KAAK,MAAM,CAAA,UAAA,EAAa,QAAQ,MAAM,CAAA,CAAA;AAAA,GAC3E;AACA,EAAA,KAAA;AAAA,IACE,CAAA,+BAAA,EAAkC,IAAA,CAAK,MAAM,CAAA,UAAA,EAAa,OAAA,CAAQ,MAAM,CAAA,QAAA,EAAM,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,CAAA;AAAA,GAC7F;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,OAAA,CAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,kEAAA,CAA+D,CAAA;AAAA,EACzF;AACF;AAaA,eAAe,SAAA,CACb,KACA,IAAA,EACe;AACf,EAAA,MAAM,UAAA,GAAkBA,KAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,EAAE,KAAK,IAAA,EAAM,IAAA,EAAM,cAAc,MAAA,EAAO,GAAI,gBAAA,CAAiB,GAAA,EAAK,UAAU,CAAA;AAElF,EAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG;AACvB,IAAA,MAAA;AAAA,MACE,4BAA4B,IAAI,CAAA,KAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,kDAAA;AAAA,KAEvD;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,WAAA,CAAY,EAAE,KAAK,CAAA;AAEnB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,EAAQ,OAAO,CAAA;AACzC,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,qBAAqB,IAAI,CAAA;AAE3D,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,WAAqB,EAAC;AAG5B,EAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,IAAA,MAAM,OAAO,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,EAAE,OAAO,CAAA,CAAA;AACpC,IAAA,IAAI,CAAA,CAAE,QAAA,KAAa,OAAA,EAAS,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,SACvC,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,MAAA,IAAU,EAAC;AACnC,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,MAAM,GAAA,GAAM,SAAS,KAAK,CAAA;AAG1B,IAAA,MAAM,WAAqB,EAAC;AAC5B,IAAA,IAAI,KAAA,CAAM,IAAA,EAAM,QAAA,CAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AACxC,IAAA,IAAI,MAAM,KAAA,EAAO;AACf,MAAA,KAAA,MAAW,CAAA,IAAK,KAAA,CAAM,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,CAAA,CAAE,IAAI,CAAA;AAAA,IAC/E;AACA,IAAA,IAAI,SAAS,MAAA,KAAW,CAAA,EAAG,QAAA,CAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AACnD,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,IAAI,CAAC,UAAA,CAAgBA,KAAA,CAAA,IAAA,CAAK,IAAA,EAAM,GAAG,CAAC,CAAA,EAAG;AACrC,QAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,2BAAA,EAA8B,GAAG,CAAA,CAAE,CAAA;AAAA,MACvD;AAAA,IACF;AAUA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAI,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,SAAS,CAAA,EAAG;AACzC,QAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,GAAA;AAAA,UAAI,CAAC,CAAA,KAAA,CAChC,OAAO,CAAA,KAAM,QAAA,GAAW,IAAI,CAAA,CAAE,IAAA,EAAM,OAAA,CAAQ,KAAA,EAAO,GAAG;AAAA,SACzD;AACA,QAAA,MAAM,MAAA,GAAS,wBAAA,CAAyB,IAAA,EAAM,SAAS,CAAA;AACvD,QAAA,IAAI,MAAA,KAAW,MAAM,MAAA,EAAQ;AAC3B,UAAA,MAAA,CAAO,IAAA;AAAA,YACL,CAAA,EAAG,GAAG,CAAA,4BAAA,EAA+B,KAAA,CAAM,OAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,YAAA,EAAU,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,OAAA;AAAA,WAC7F;AAAA,QACF;AAAA,MACF,CAAA,MAAO;AACL,QAAA,QAAA,CAAS,IAAA;AAAA,UACP,GAAG,GAAG,CAAA,0HAAA;AAAA,SACR;AAAA,MACF;AAAA,IACF;AAGA,IAAA,KAAA,MAAW,GAAA,IAAO,KAAA,CAAM,YAAA,IAAgB,EAAC,EAAG;AAC1C,MAAA,IAAI;AACF,QAAA,aAAA,CAAc,GAAG,CAAA;AAAA,MACnB,SAAS,GAAA,EAAK;AACZ,QAAA,QAAA,CAAS,IAAA;AAAA,UACP,CAAA,EAAG,GAAG,CAAA,wBAAA,EAA2B,GAAG,CAAA,GAAA,EAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SAC5F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,EAAU,OAAA,CAAQ,CAAC,CAAA;AACnC,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,MAAA,CAAO,CAAC,CAAA;AAEhC,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,KAAA,CAAM,CAAA,SAAA,EAAY,MAAA,CAAO,MAAM,CAAA,UAAA,CAAY,CAAA;AAAA,EAC7C,CAAA,MAAO;AACL,IAAA,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAY,CAAA;AAAA,EACrC;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,IAAU,QAAA,CAAS,MAAA,GAAS,CAAA;AACpD,EAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,UAAA,EAAY,OAAA,CAAQ,KAAK,CAAC,CAAA;AACrD;AAaO,SAAS,oBAAA,CACd,WACA,MAAA,EACqC;AACrC,EAAA,MAAM,KAAA,GAAA,CAAS,aAAa,EAAA,EAAI,IAAA,GAAO,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA;AAClE,EAAA,MAAM,CAAC,OAAA,EAAS,GAAG,IAAI,CAAA,GAAI,MAAM,MAAA,GAAS,CAAA,GAAI,KAAA,GAAQ,CAAC,IAAI,CAAA;AAC3D,EAAA,OAAO,EAAE,OAAA,EAA4B,IAAA,EAAM,CAAC,GAAG,IAAA,EAAM,MAAM,CAAA,EAAE;AAC/D;AAgBO,SAAS,OAAA,CACd,GAAA,EACA,IAAA,EACA,KAAA,GAAmB,SAAA,EACb;AACN,EAAA,MAAM,UAAA,GAAkBA,KAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,EAAE,IAAA,EAAM,YAAA,EAAc,QAAO,GAAI,gBAAA,CAAiB,KAAK,UAAU,CAAA;AAEvE,EAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG;AACvB,IAAA,MAAA;AAAA,MACE,CAAA,yBAAA,EAA4B,IAAI,CAAA,KAAA,EAAQ,MAAM,CAAA,4CAAA;AAAA,KAEhD;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,EAAE,OAAA,EAAS,IAAA,EAAK,GAAI,oBAAA,CAAqB,OAAA,CAAQ,GAAA,CAAI,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AAC/F,EAAA,MAAM,MAAM,KAAA,CAAM,OAAA,EAAS,MAAM,EAAE,KAAA,EAAO,WAAW,CAAA;AACrD,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,IAAK,GAAA,CAAI,WAAW,IAAA,EAAM;AAC3C,IAAA,MAAA,CAAO,CAAA,0BAAA,EAA6B,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACjD,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,mBAAA,CAAoB,MAAA,EAAQ,CAAA,eAAA,EAAkB,IAAI,CAAA,CAAE,CAAA;AAGpD,EAAA,MAAM,EAAE,WAAA,EAAY,GAAI,qBAAqB,YAAA,CAAa,MAAA,EAAQ,OAAO,CAAC,CAAA;AAC1E,EAAA,MAAM,SAAS,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,OAAO,CAAA;AAC/D,EAAA,MAAM,WAAW,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,OAAO,CAAA;AACjE,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,MAAA,CAAO,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACxD,IAAA,OAAA,CAAQ,iFAA4E,CAAA;AAAA,EACtF,CAAA,MAAA,IAAW,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC9B,IAAA,KAAA,MAAW,CAAA,IAAK,UAAU,OAAA,CAAQ,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAC3D,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAAA,EAChC,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,QAAQ,CAAA;AAAA,EAChB;AACF;AAOO,SAAS,0BAA0B,GAAA,EAAoB;AAG5D,EAAA,MAAM,QAAA,GAAW,IACd,OAAA,CAAQ,UAAU,EAClB,WAAA,CAAY,yCAAyC,EACrD,uBAAA,EAAwB;AAE3B,EAAA,QAAA,CACG,OAAA,CAAQ,YAAY,CAAA,CACpB,WAAA,CAAY,8EAA8E,CAAA,CAC1F,MAAA,CAAO,yBAAA,EAA2B,mBAAA,EAAqB,QAAQ,GAAA,EAAK,CAAA,CACpE,MAAA,CAAO,sBAAsB,uDAAuD,CAAA,CACpF,MAAA,CAAO,OAAA,EAAS,6CAAA,EAA+C,KAAK,CAAA,CACpE,MAAA,CAAO,WAAW,wCAAA,EAA0C,KAAK,CAAA,CACjE,MAAA,CAAO,CAAC,GAAA,EAAK,IAAA,KAAS,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAC,CAAA;AAE3C,EAAA,QAAA,CACG,OAAA,CAAQ,YAAY,CAAA,CACpB,WAAA,CAAY,8DAA8D,CAAA,CAC1E,MAAA,CAAO,2BAA2B,mBAAA,EAAqB,OAAA,CAAQ,KAAK,CAAA,CACpE,OAAO,CAAC,GAAA,EAAK,SAAS,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAC,CAAA;AAE3C,EAAA,QAAA,CACG,OAAA,CAAQ,eAAe,CAAA,CACvB,WAAA;AAAA,IACC;AAAA,GAEF,CACC,MAAA,CAAO,yBAAA,EAA2B,mBAAA,EAAqB,OAAA,CAAQ,GAAA,EAAK,CAAA,CACpE,MAAA,CAAO,oBAAA,EAAsB,2CAA2C,CAAA,CACxE,MAAA,CAAO,OAAA,EAAS,6CAAA,EAA+C,KAAK,CAAA,CACpE,MAAA,CAAO,aAAA,EAAe,iDAAA,EAAmD,KAAK,CAAA,CAC9E,MAAA,CAAO,CAAC,GAAA,EAAK,IAAA,KAAS,UAAA,CAAW,GAAA,EAAK,IAAI,CAAC,CAAA;AAE9C,EAAA,QAAA,CACG,OAAA,CAAQ,cAAc,CAAA,CACtB,WAAA,CAAY,6CAA6C,EACzD,MAAA,CAAO,yBAAA,EAA2B,mBAAA,EAAqB,OAAA,CAAQ,GAAA,EAAK,EACpE,MAAA,CAAO,UAAA,EAAY,yDAAA,EAA2D,KAAK,CAAA,CACnF,MAAA,CAAO,CAAC,GAAA,EAAK,IAAA,KAAS,SAAA,CAAU,GAAA,EAAK,IAAI,CAAC,CAAA;AAE7C,EAAA,QAAA,CACG,OAAA,CAAQ,eAAe,CAAA,CACvB,WAAA,CAAY,+DAA+D,CAAA,CAC3E,MAAA,CAAO,yBAAA,EAA2B,mBAAA,EAAqB,OAAA,CAAQ,GAAA,EAAK,CAAA,CACpE,OAAO,kBAAA,EAAoB,oDAAoD,CAAA,CAC/E,MAAA,CAAO,sBAAA,EAAwB,yDAAyD,CAAA,CACxF,MAAA,CAAO,kBAAkB,0DAA0D,CAAA,CACnF,MAAA,CAAO,WAAA,EAAa,+DAA+D,KAAK,CAAA,CACxF,MAAA,CAAO,OAAO,KAAK,IAAA,KAAS;AAC3B,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,uCAA8B,CAAA;AAClE,IAAA,MAAM,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,EAC5B,CAAC,CAAA;AAEH,EAAA,QAAA,CACG,OAAA,CAAQ,eAAe,CAAA,CACvB,WAAA,CAAY,iDAAiD,EAC7D,MAAA,CAAO,MAAM,QAAA,CAAS,SAAS,CAAC,CAAA;AAEnC,EAAA,QAAA,CACG,OAAA,CAAQ,YAAY,CAAA,CACpB,WAAA,CAAY,sDAAsD,CAAA,CAClE,MAAA,CAAO,2BAA2B,mBAAA,EAAqB,OAAA,CAAQ,KAAK,CAAA,CACpE,OAAO,eAAA,EAAiB,4CAA4C,EACpE,MAAA,CAAO,OAAO,KAAK,IAAA,KAAS;AAC3B,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,OAAO,uCAA8B,CAAA;AAC/D,IAAA,MAAM,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EACzB,CAAC,CAAA;AACL;;;ACzmBO,SAAS,gBAAgB,GAAA,EAAqB;AACnD,EAAA,OAAY,KAAA,CAAA,IAAA,CAAK,iBAAA,EAAkB,EAAG,GAAG,CAAA;AAC3C;AAEA,IAAM,wBAAA,GAA2B,sBAAA;AACjC,IAAM,6BAAA,GAAgC,qBAAA;AAU/B,SAAS,oBAAoB,MAAA,EAAuC;AACzE,EAAA,OAAO,MAAA,CAAO,OAAO,MAAA,GAAS,CAAA;AAChC;AAQO,SAAS,uBAAuB,IAAA,EAAkC;AACvE,EAAA,MAAM,SAAA,GAAYC,UAAAA,CAAgB,KAAA,CAAA,IAAA,CAAK,IAAA,EAAM,6BAA6B,CAAC,CAAA;AAC3E,EAAA,MAAM,WAAA,GAAcA,UAAAA,CAAgB,KAAA,CAAA,IAAA,CAAK,IAAA,EAAM,wBAAwB,CAAC,CAAA;AACxE,EAAA,IAAI,SAAA,IAAa,CAAC,WAAA,EAAa;AAC7B,IAAA,OACE,CAAA,2BAAA,EAA8B,6BAA6B,CAAA,QAAA,EACxD,wBAAwB,sGAC4B,wBAAwB,CAAA,4EAAA,CAAA;AAAA,EAGnF;AACA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,mBAAmB,KAAA,EAAuB;AACxD,EAAA,MAAM,CAAA,GAAI,MAAM,IAAA,EAAK;AACrB,EAAA,IAAI,+BAAA,CAAgC,KAAK,CAAC,CAAA,IAAK,QAAQ,IAAA,CAAK,CAAC,GAAG,OAAO,CAAA;AACvE,EAAA,MAAM,IAAA,GAAO,CAAA,CAAE,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAA;AACnC,EAAA,IAAI,qBAAqB,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,kBAAkB,IAAI,CAAA,IAAA,CAAA;AAClE,EAAA,IAAI,YAAY,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,4BAA4B,IAAI,CAAA,IAAA,CAAA;AACnE,EAAA,OAAO,CAAA;AACT;AAQO,SAAS,gBAAA,CAAiB,OAAoB,GAAA,EAAsB;AACzE,EAAA,IAAI,KAAA,CAAM,GAAA,KAAQ,GAAA,EAAK,OAAO,IAAA;AAC9B,EAAA,IAAI,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA,KAAM,GAAA,IAAO,gBAAgB,KAAA,CAAM,GAAG,CAAA,KAAM,GAAA,EAAK,OAAO,IAAA;AACpF,EAAA,OAAO,KAAA,CAAM,GAAA,KAAQ,kBAAA,CAAmB,GAAG,CAAA;AAC7C;AAOO,SAAS,WAAA,CAAY,OAAoB,GAAA,EAAqC;AACnF,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,KAAA,CAAM,GAAA,IAAO,eAAA,CAAgB,CAAA,CAAE,GAAG,MAAM,KAAK,CAAA;AACtF,EAAA,OAAO,MAAA,GAAS,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA,GAAI,KAAA;AAC9C;AAcO,SAAS,aAAA,CAAc,SAAiC,GAAA,EAA+B;AAC5F,EAAA,MAAM,KAAA,GAAyC;AAAA,IAC7C,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAA;AAAA,IACjB,CAAC,CAAA,KAAM,cAAA,CAAe,CAAA,CAAE,GAAG,CAAA,KAAM,GAAA;AAAA,IACjC,CAAC,CAAA,KAAM,eAAA,CAAgB,CAAA,CAAE,GAAG,MAAM,GAAA,IAAO,CAAA,CAAE,GAAA,KAAQ,kBAAA,CAAmB,GAAG;AAAA,GAC3E;AACA,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA;AAChC,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,MAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,CAAC,CAAA,EAAE;AAC5D,IAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,SAAS,IAAA,EAAK;AAAA,EACjE;AACA,EAAA,OAAO,EAAE,MAAM,MAAA,EAAO;AACxB;AAEA,SAAS,mBAAA,CAAoB,KAAa,OAAA,EAAwC;AAChF,EAAA,MAAA,CAAO,CAAA,CAAA,EAAI,GAAG,CAAA,UAAA,EAAa,OAAA,CAAQ,MAAM,CAAA,2CAAA,CAA6C,CAAA;AACtF,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS,OAAA,CAAQ,MAAM,CAAA,IAAA,EAAO,CAAA,CAAE,GAAG,CAAA,CAAE,CAAA;AACrD,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB;AAOA,SAAS,kBAAkB,MAAA,EAAwB;AACjD,EAAA,OAAO,MAAA,CACJ,MAAM,IAAI,CAAA,CACV,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,OAAO,CAAC,CAAA,KAAM,CAAA,KAAM,EAAA,IAAM,CAAC,yBAAA,CAA0B,KAAK,CAAC,CAAC,CAAA,CAC5D,IAAA,CAAK,GAAG,CAAA;AACb;AAUO,SAAS,qBAAA,CACd,SACA,GAAA,EACyB;AACzB,EAAA,MAAM,GAAA,GAAM,eAAe,GAAG,CAAA;AAC9B,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAA,IAAO,cAAA,CAAe,CAAA,CAAE,GAAG,CAAA,KAAM,GAAG,CAAA;AAC3E;AAEA,SAAS,sBAAA,GAAiC;AACxC,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,OAAA,CAAQ,GAAA,EAAK,CAAA;AAC5C,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAA;AAAA,MACE;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,OAAY,KAAA,CAAA,IAAA,CAAK,IAAA,EAAM,uBAAA,EAAyB,CAAA;AAClD;AAEO,SAAS,mBAAmB,QAAA,EAAiC;AAClE,EAAA,IAAI,CAACA,UAAAA,CAAW,QAAQ,CAAA,SAAU,EAAC;AACnC,EAAA,IAAI;AACF,IAAA,OAAO,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA,CAAE,UAAA,EAAW;AAAA,EACvD,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,eAAA,EAAkB,QAAQ,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACxF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAGA,SAAS,uBAAuB,IAAA,EAAoB;AAClD,EAAA,IAAI,GAAA,GAAW,cAAQ,IAAI,CAAA;AAC3B,EAAA,OAAY,eAAS,GAAG,CAAA,KAAM,aAAa,GAAA,KAAa,KAAA,CAAA,OAAA,CAAQ,GAAG,CAAA,EAAG;AACpE,IAAA,IAAI;AACF,MAAA,IAAI,WAAA,CAAY,GAAG,CAAA,CAAE,MAAA,GAAS,CAAA,EAAG;AACjC,MAAA,SAAA,CAAU,GAAG,CAAA;AAAA,IACf,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,GAAA,GAAW,cAAQ,GAAG,CAAA;AAAA,EACxB;AACF;AAWO,SAAS,WAAA,CAAY,KAAA,EAAoB,IAAA,GAA4B,EAAC,EAAY;AACvF,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AACtD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAIA,UAAAA,CAAW,IAAI,CAAA,EAAG;AACpB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,EAAO,OAAO,KAAA;AACxB,IAAA,MAAA,GAAS,GAAG,IAAI,CAAA,IAAA,CAAA;AAChB,IAAA,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,UAAA,CAAW,MAAM,MAAM,CAAA;AAAA,EACzB;AACA,EAAA,SAAA,CAAe,cAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACjD,EAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AAEtC,EAAA,IAAI,KAAA,CAAM,KAAK,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,EAAG,UAAA,EAAY,MAAM,GAAG,CAAA;AACtD,EAAA,MAAM,QAAQC,SAAAA,CAAU,KAAA,EAAO,MAAM,EAAE,KAAA,EAAO,WAAW,CAAA;AACzD,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAA,CAAO,MAAM,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAC7C,MAAA,UAAA,CAAW,QAAQ,IAAI,CAAA;AAAA,IACzB,CAAA,MAAO;AAEL,MAAA,MAAA,CAAO,MAAM,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAC7C,MAAA,sBAAA,CAAuB,IAAI,CAAA;AAAA,IAC7B;AACA,IAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,KAAA,CAAM,GAAG,CAAA,CAAE,CAAA;AAC1C,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,IAAI,MAAA,SAAe,MAAA,EAAQ,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAC3D,EAAA,OAAO,IAAA;AACT;AAUO,SAAS,eAAA,CACd,MACA,KAAA,EAC6C;AAC7C,EAAA,IAAI,CAAC,cAAA,CAAe,IAAA,EAAM,KAAA,CAAM,GAAG,CAAA,IAAK,KAAA,CAAM,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,IAAA,EAAK;AACrE,EAAA,MAAM,OAAOA,SAAAA,CAAU,KAAA,EAAO,CAAC,MAAA,EAAQ,WAAW,CAAA,EAAG;AAAA,IACnD,GAAA,EAAK,IAAA;AAAA,IACL,KAAA,EAAO,MAAA;AAAA,IACP,QAAA,EAAU;AAAA,GACX,CAAA;AACD,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,IAAI,IAAA,EAAK;AACzC,EAAA,MAAM,SAAS,iBAAA,CAAkB,IAAA,CAAK,MAAM,CAAA,IAAK,CAAA,uBAAA,EAA0B,KAAK,MAAM,CAAA,CAAA;AACtF,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,iBAAA,EAAoB,MAAM,CAAA,CAAA,EAAG;AAC1D;AAQA,SAAS,iBAAA,CAAkB,KAAa,IAAA,EAA2C;AACjF,EAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,IAAA,CAAK,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAG7C,EAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAAc,CAAA,CAAE,OAAA,CAAQ,kBAAA,EAAoB,GAAG,CAAA,CAAE,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAA,IAAK,QAAA;AACxF,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,eAAA,CAAgB,GAAG,CAAC,CAAA;AACvC,EAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,GAAG,CAAA,CAAE,MAAM,GAAG,CAAA;AAC3C,EAAA,MAAM,UAAA,GACJ,KAAA,CAAM,MAAA,KAAW,CAAA,GACb,CAAC,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAE,CAAA,EAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,MAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAE,CAAC,IAC7E,EAAC;AACP,EAAA,KAAA,MAAW,CAAA,IAAK,YAAY,IAAI,CAAC,MAAM,GAAA,CAAI,CAAC,GAAG,OAAO,CAAA;AACtD,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,OAAO,MAAM,GAAA,CAAI,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,CAAC,EAAE,CAAA,EAAG,CAAA,EAAA;AACnC,EAAA,OAAO,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AACtB;AAOA,eAAe,oBAAA,CACb,KAAA,EACA,UAAA,GAAa,KAAA,EAMZ;AACD,EAAA,MAAM,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AAC7D,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AACtD,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,aAAA,EAAc;AACzC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAW,KAAA,CAAA,OAAA,CAAQ,CAAA,CAAE,IAAI,CAAA,KAAW,KAAA,CAAA,OAAA,CAAQ,IAAI,CAAC,CAAA;AAI7E,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,KAAA,CAAM,GAAG,CAAA;AAChD,IAAA,MAAM,YAAY,SAAA,GAAiB,KAAA,CAAA,OAAA,CAAQ,eAAA,CAAgB,SAAS,CAAC,CAAA,GAAI,KAAA,CAAA;AACzE,IAAA,MAAM,YACJ,QAAA,IAAY,CAAC,SAAA,GACT,KAAA,CAAA,GACA,KAAK,IAAA,CAAK,CAAC,CAAA,KAAW,KAAA,CAAA,OAAA,CAAQ,EAAE,IAAI,CAAA,KAAM,SAAA,IAAa,CAAA,CAAE,cAAc,QAAQ,CAAA;AACrF,IAAA,IAAI,aAAa,SAAA,EAAW;AAC1B,MAAA,MAAM,QAAQ,aAAA,CAAc,SAAA,CAAU,IAAI,EAAE,IAAA,EAAM,MAAM,CAAA;AACxD,MAAA,OAAA;AAAA,QACE,cAAc,SAAA,CAAU,IAAI,CAAA,2BAAA,EAA8B,IAAI,mBAC3C,SAAS,CAAA,sCAAA;AAAA,OAC9B;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GACJ,QAAA,IACA,SAAA,IACC,MAAM,QAAQ,UAAA,CAAW;AAAA,MACxB,IAAA,EAAM,iBAAA,CAAkB,KAAA,CAAM,GAAA,EAAK,IAAI,CAAA;AAAA,MACvC,IAAA,EAAM,IAAA;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,aAAA,EAAe,EAAE,GAAA,EAAK,KAAA,CAAM,GAAA,EAAK,QAAQ,KAAA,CAAM,GAAA,IAAO,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAM;AAAA,MAC9E,SAAA,EAAW;AAAA,KACZ,CAAA;AAGH,IAAA,MAAM,OAAA,GAAU,IAAI,kBAAA,CAAmB,OAAA,EAAS,IAAI,EAAA,EAAI,IAAA,EAAM,iBAAgB,EAAG;AAAA,MAC/E,mBAAA,EAAqB,sBAAA,CAAuB,KAAA,CAAM,GAAG;AAAA,KACtD,CAAA;AACD,IAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,IAAA,CAAK,EAAE,YAAY,CAAA;AAChD,IAAA,MAAM,OAAA,CAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAC/B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACF;AAaA,eAAsB,kBAAkB,UAAA,EAAsC;AAC5E,EAAA,MAAM,IAAA,GAAO,kBAAkB,UAAU,CAAA;AACzC,EAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,EAAA,IAAI,kBAAA,CAAwB,WAAK,IAAA,EAAM,uBAAA,EAAyB,CAAC,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAExF,EAAA,OAAA,CAAQ,6CAAmC,CAAA;AAC3C,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,mBAAmB,UAAU,CAAA;AACtD,EAAA,OAAO,MAAA,GAAS,CAAA;AAClB;AAeA,eAAsB,kBAAA,CACpB,UAAA,EACA,IAAA,GAA0B,EAAC,EACiC;AAC5D,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA;AAC9C,EAAA,MAAM,UAAU,kBAAA,CAAwB,KAAA,CAAA,IAAA,CAAK,IAAA,EAAM,uBAAA,EAAyB,CAAC,CAAA;AAC7E,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AACtD,IAAA,IAAI;AAGF,MAAA,IAAI,CAACD,UAAAA,CAAW,IAAI,CAAA,EAAG;AACrB,QAAA,SAAA,CAAe,cAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACjD,QAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AACtC,QAAA,IAAI,KAAA,CAAM,KAAK,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,EAAG,UAAA,EAAY,MAAM,GAAG,CAAA;AACtD,QAAA,MAAM,QAAQC,SAAAA,CAAU,KAAA,EAAO,MAAM,EAAE,KAAA,EAAO,UAAU,CAAA;AACxD,QAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,UAAA,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,6BAAA,CAA+B,CAAA;AAC9C,UAAA,MAAA,EAAA;AACA,UAAA;AAAA,QACF;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,IAAA,EAAM,KAAK,CAAA;AACxC,QAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,UAAA,MAAA,CAAO,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAC/B,UAAA,MAAA,EAAA;AACA,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAS,MAAM,oBAAA,CAAqB,KAAA,EAAO,KAAK,GAAG,CAAA;AACzD,MAAA,KAAA,MAAW,GAAA,IAAO,OAAO,MAAA,EAAQ,OAAA,CAAQ,GAAG,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAC1D,MAAA,KAAA,MAAW,QAAA,IAAY,OAAO,UAAA,EAAY,OAAA,CAAQ,GAAG,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAE,CAAA;AACxE,MAAA,MAAA,EAAA;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,qBAAA,EAAmB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACpF,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,MAAA,EAAQ,QAAQ,MAAA,EAAO;AACjD;AAOO,SAAS,qBAAqB,UAAA,EAA8B;AACjE,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA;AAC9C,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,SAAS,kBAAA,CAAwB,KAAA,CAAA,IAAA,CAAK,MAAM,uBAAA,EAAyB,CAAC,CAAA,EAAG;AAClF,IAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AACtD,IAAA,IAAI,CAACD,UAAAA,CAAW,IAAI,CAAA,EAAG;AACvB,IAAA,MAAM,KAAA,GAAQC,UAAU,KAAA,EAAO,CAAC,MAAM,IAAA,EAAM,UAAA,EAAY,SAAA,EAAW,mBAAmB,CAAA,EAAG;AAAA,MACvF,KAAA,EAAO,MAAA;AAAA,MACP,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,IAAK,MAAA,CAAO,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,GAAI,CAAA,EAAG;AACzD,MAAA,QAAA,CAAS,IAAA,CAAK,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,IAC1C;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAGA,eAAe,iBAAA,CAAkB,KAAa,UAAA,EAAoC;AAChF,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,GAAG,CAAC,CAAA;AAChD,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,EAAA,IAAI;AAEF,IAAA,MAAM,QAAA,GAAA,CAAY,MAAM,OAAA,CAAQ,aAAA,EAAc,EAAG,IAAA;AAAA,MAC/C,CAAC,CAAA,KAAW,KAAA,CAAA,OAAA,CAAQ,EAAE,IAAI,CAAA,KAAW,cAAQ,IAAI;AAAA,KACnD;AACA,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAM,QAAQ,aAAA,CAAc,QAAA,CAAS,MAAM,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACA,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAMC,KAAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,GAAG,CAAC,CAAA;AAChD,IAAA,IAAIF,UAAAA,CAAWE,KAAI,CAAA,EAAG,MAAA,CAAOA,KAAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,EACrE;AACF;AAEO,SAAS,iBAAA,GAA6B;AAC3C,EAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,QAAQ,CAAA,CAAE,WAAA;AAAA,IAChC;AAAA,GACF;AAGA,EAAA,GAAA,CACG,OAAA,CAAQ,cAAc,CAAA,CACtB,WAAA;AAAA,IACC;AAAA,GAEF,CACC,OAAO,eAAA,EAAiB,gEAA2D,EACnF,MAAA,CAAO,aAAA,EAAe,mCAAmC,CAAA,CACzD,MAAA,CAAO,mBAAA,EAAqB,8BAA8B,CAAA,CAC1D,MAAA,CAAO,WAAW,uCAAA,EAAyC,KAAK,EAChE,MAAA,CAAO,OAAA,EAAS,yDAAA,EAA2D,KAAK,CAAA,CAChF,MAAA;AAAA,IACC,OACE,QACA,IAAA,KAOG;AAGH,MAAA,IAAI,WAAA,CAAY,KAAK,MAAA,CAAO,IAAA,GAAO,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAC,CAAA,EAAG;AACzD,QAAA,MAAA;AAAA,UACE,IAAI,MAAM,CAAA,uKAAA;AAAA,SAGZ;AACA,QAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AACnB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,GAAA,GAAM,mBAAmB,MAAM,CAAA;AACrC,MAAA,MAAM,WAAW,sBAAA,EAAuB;AAMxC,MAAA,MAAM,SAAA,GAAY,qBAAA,CAAsB,kBAAA,CAAmB,QAAQ,GAAG,GAAG,CAAA;AACzE,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,MAAA;AAAA,UACE,CAAA,CAAA,EAAI,GAAG,CAAA,8BAAA,EAAiC,cAAA,CAAe,GAAG,CAAC,CAAA,yBAAA,EAClC,UAAU,GAAG,CAAA,wFAAA;AAAA,SAExC;AACA,QAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AACnB,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAK,IAAA,EAAM;AACb,QAAA,OAAA;AAAA,UACE;AAAA,SAEF;AAAA,MACF;AACA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,MAAA;AAC7B,MAAA,MAAM,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAChC,MAAA,MAAM,KAAA,GAAqB,EAAE,GAAA,EAAI;AACjC,MAAA,IAAI,GAAA,QAAW,GAAA,GAAM,GAAA;AAErB,MAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,GAAG,CAAC,CAAA;AAChD,MAAA,MAAM,WAAA,GAAcF,WAAW,IAAI,CAAA;AAInC,MAAA,MAAM,SAAS,WAAA,CAAY,KAAA,EAAO,EAAE,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AACvD,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,KAAA,CAAM,CAAA,wBAAA,EAA2B,IAAI,CAAA,CAAE,CAAA;AAAA,MACzC,WAAW,WAAA,EAAa;AACtB,QAAA,KAAA,CAAM,CAAA,UAAA,EAAa,GAAG,CAAA,QAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,MACpC,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,CAAA,OAAA,EAAU,GAAG,CAAA,QAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,MACjC;AAEA,MAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA;AAChD,MAAA,MAAA,CAAO,UAAU,KAAK,CAAA;AACtB,MAAA,MAAA,CAAO,IAAA,EAAK;AAEZ,MAAA,MAAM,MAAA,GAAS,MAAM,oBAAA,CAAqB,KAAA,EAAO,KAAK,GAAG,CAAA;AACzD,MAAA,MAAM,MAAA,GAAS,oBAAoB,MAAM,CAAA;AACzC,MAAA,MAAM,UAAA,GAAa,WAAW,MAAA,CAAO,aAAa,OAAO,MAAA,CAAO,WAAW,mBAAmB,IAAI,CAAA,EAAA,CAAA;AAClG,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,OAAA,CAAQ,UAAU,CAAA;AAAA,MACpB,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,UAAU,CAAA;AAAA,MAClB;AACA,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,MAAA,EAAQ,OAAA,CAAQ,GAAG,CAAA;AAC5C,MAAA,KAAA,MAAW,QAAA,IAAY,MAAA,CAAO,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAE1D,MAAA,MAAM,UAAA,GAAa,uBAAuB,IAAI,CAAA;AAC9C,MAAA,IAAI,UAAA,UAAoB,UAAU,CAAA;AAElC,MAAA,MAAM,KAAA,GAAa,KAAA,CAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,IAAO,QAAQ,CAAA;AACnD,MAAA,IAAI,MAAA,EAAQ;AAGV,QAAA,OAAA;AAAA,UACE,CAAA,QAAA,EAAW,IAAI,CAAA,gBAAA,EAAmB,KAAK,SAAS,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,uFAAA,EAE1C,IAAI,CAAA,GAAA;AAAA,SAChC;AACA,QAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,MACrB,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,CAAA,QAAA,EAAW,IAAI,CAAA,gBAAA,EAAmB,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,MAClD;AAAA,IACF;AAAA,GACF;AAGF,EAAA,GAAA,CACG,OAAA,CAAQ,MAAM,CAAA,CACd,WAAA,CAAY,uDAAuD,CAAA,CACnE,MAAA,CAAO,QAAA,EAAU,gBAAgB,CAAA,CACjC,MAAA,CAAO,OAAO,IAAA,KAA6B;AAC1C,IAAA,MAAM,WAAW,sBAAA,EAAuB;AACxC,IAAA,MAAM,OAAA,GAAU,mBAAmB,QAAQ,CAAA;AAC3C,IAAA,IAAI,IAAA,CAAK,IAAA,EAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,KAAK,SAAA,CAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAC,CAAA;AAClE,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,OAAA,CAAQ,+EAA+E,CAAA;AACvF,MAAA;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAE,OAAA,CAAQ,WAAW,CAAC,CAAA;AAClC,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,IAAA,GAAO,WAAA,CAAY,CAAA,EAAG,OAAO,CAAA;AACnC,MAAA,MAAM,MAAA,GAASA,UAAAA,CAAW,eAAA,CAAgB,cAAA,CAAe,CAAA,CAAE,GAAG,CAAC,CAAC,CAAA,GAC5D,EAAA,GACA,CAAA,CAAE,IAAA,CAAK,eAAe,CAAA;AAC1B,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,GAAA,CAAI,IAAA,CAAK,OAAO,EAAE,CAAC,CAAC,CAAA,EAAA,EAAK,EAAE,GAAA,CAAI,CAAA,CAAE,GAAG,CAAC,CAAA,EAAG,MAAM,CAAA,CAAE,CAAA;AAAA,IACrE;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,EAAA,EAAO,EAAE,GAAA,CAAI,CAAA,EAAG,OAAA,CAAQ,MAAM,YAAY,CAAC;AAAA,CAAI,CAAA;AAAA,EAC7D,CAAC,CAAA;AAGH,EAAA,GAAA,CACG,OAAA,CAAQ,oBAAoB,CAAA,CAC5B,WAAA,CAAY,4DAA4D,CAAA,CACxE,MAAA,CAAO,OAAO,GAAA,KAAgB;AAC7B,IAAA,MAAM,WAAW,sBAAA,EAAuB;AACxC,IAAA,MAAM,GAAA,GAAM,mBAAmB,QAAQ,CAAA;AACvC,IAAA,MAAM,QAAA,GAAW,aAAA,CAAc,GAAA,EAAK,GAAG,CAAA;AACvC,IAAA,IAAI,QAAA,CAAS,SAAS,MAAA,EAAQ;AAC5B,MAAA,MAAA,CAAO,CAAA,oBAAA,EAAuB,GAAG,CAAA,KAAA,EAAQ,QAAQ,CAAA,CAAA,CAAG,CAAA;AACpD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,IAAI,SAAS,IAAA,KAAS,WAAA,EAAa,mBAAA,CAAoB,GAAA,EAAK,SAAS,OAAO,CAAA;AAC5E,IAAA,MAAM,QAAQ,QAAA,CAAS,KAAA;AACvB,IAAA,MAAM,IAAA,GAAO,WAAA,CAAY,KAAA,EAAO,GAAG,CAAA;AACnC,IAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AAC3D,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,IAAA,CAAK,SAAA;AAAA,QACH;AAAA,UACE,GAAG,KAAA;AAAA,UACH,IAAA;AAAA,UACA,SAAA;AAAA,UACA,MAAA,EAAQA,WAAW,SAAS;AAAA,SAC9B;AAAA,QACA,IAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF,CAAC,CAAA;AAGH,EAAA,GAAA,CACG,OAAA,CAAQ,sBAAsB,CAAA,CAC9B,WAAA,CAAY,0EAA0E,CAAA,CACtF,MAAA;AAAA,IACC,SAAA;AAAA,IACA,qCAA0C,KAAA,CAAA,IAAA,CAAK,eAAA,IAAmB,SAAS,CAAC,GAAQ,KAAA,CAAA,GAAG,CAAA,CAAA;AAAA,IACvF;AAAA,GACF,CACC,MAAA,CAAO,OAAO,GAAA,EAAa,IAAA,KAA6B;AACvD,IAAA,MAAM,WAAW,sBAAA,EAAuB;AACxC,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA;AAEhD,IAAA,MAAM,GAAA,GAAM,OAAO,UAAA,EAAW;AAC9B,IAAA,MAAM,QAAA,GAAW,aAAA,CAAc,GAAA,EAAK,GAAG,CAAA;AACvC,IAAA,IAAI,QAAA,CAAS,SAAS,MAAA,EAAQ;AAC5B,MAAA,MAAA,CAAO,CAAA,oBAAA,EAAuB,GAAG,CAAA,KAAA,EAAQ,QAAQ,CAAA,CAAA,CAAG,CAAA;AACpD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,IAAI,SAAS,IAAA,KAAS,WAAA,EAAa,mBAAA,CAAoB,GAAA,EAAK,SAAS,OAAO,CAAA;AAC5E,IAAA,MAAM,QAAQ,QAAA,CAAS,KAAA;AACvB,IAAA,MAAM,IAAA,GAAO,WAAA,CAAY,KAAA,EAAO,GAAG,CAAA;AACnC,IAAA,MAAA,CAAO,YAAA,CAAa,MAAM,GAAG,CAAA;AAC7B,IAAA,MAAA,CAAO,IAAA,EAAK;AACZ,IAAA,MAAM,iBAAA,CAAkB,KAAA,CAAM,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AAC7C,IAAA,KAAA;AAAA,MACE,IAAA,CAAK,KAAA,GACD,CAAA,gBAAA,EAAmB,IAAI,CAAA,uBAAA,CAAA,GACvB,CAAA,gBAAA,EAAmB,IAAI,CAAA,kCAAA,EAA0C,KAAA,CAAA,IAAA,CAAK,eAAA,EAAgB,EAAG,SAAS,CAAC,CAAA,kEAAA;AAAA,KACzG;AAAA,EACF,CAAC,CAAA;AAGH,EAAA,GAAA,CACG,QAAQ,aAAa,CAAA,CACrB,YAAY,sDAAsD,CAAA,CAClE,OAAO,OAAA,EAAS,0DAAA,EAA4D,KAAK,CAAA,CACjF,MAAA,CAAO,SAAS,qCAAA,EAAuC,KAAK,EAC5D,MAAA,CAAO,OAAO,KAAyB,IAAA,KAA2C;AACjF,IAAA,MAAM,WAAW,sBAAA,EAAuB;AACxC,IAAA,MAAM,OAAA,GAAU,mBAAmB,QAAQ,CAAA;AAC3C,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,OAAA,CAAQ,4BAA4B,CAAA;AACpC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,OAAA,GAAU,QAAQ,MAAA,CAAO,CAAC,MAAM,gBAAA,CAAiB,CAAA,EAAG,GAAG,CAAC,CAAA;AACxD,MAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,QAAA,OAAA,CAAQ,CAAA,oBAAA,EAAuB,GAAG,CAAA,EAAA,CAAI,CAAA;AACtC,QAAA;AAAA,MACF;AAAA,IACF,CAAA,MAAA,IAAW,KAAK,GAAA,IAAO,OAAA,CAAQ,WAAW,CAAA,IAAK,CAAC,OAAA,CAAQ,KAAA,CAAM,KAAA,EAAO;AAEnE,MAAA,OAAA,GAAU,OAAA;AAAA,IACZ,CAAA,MAAO;AACL,MAAA,MAAM,QAAA,GAAW,MAAQ,CAAA,CAAA,WAAA,CAAY;AAAA,QACnC,OAAA,EAAS,wBAAA;AAAA,QACT,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,UAC3B,OAAO,CAAA,CAAE,GAAA;AAAA,UACT,KAAA,EAAO,eAAA,CAAgB,CAAA,CAAE,GAAG,CAAA;AAAA,UAC5B,MAAM,CAAA,CAAE;AAAA,SACV,CAAE,CAAA;AAAA,QACF,QAAA,EAAU;AAAA,OACX,CAAA;AACD,MAAA,IAAM,CAAA,CAAA,QAAA,CAAS,QAAQ,CAAA,EAAG;AACxB,QAAE,SAAO,YAAY,CAAA;AACrB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,QAAoB,CAAA;AAC3C,MAAA,OAAA,GAAU,OAAA,CAAQ,OAAO,CAAC,CAAA,KAAM,OAAO,GAAA,CAAI,CAAA,CAAE,GAAG,CAAC,CAAA;AAAA,IACnD;AACA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAM,IAAA,GAAO,WAAA,CAAY,KAAA,EAAO,OAAO,CAAA;AACvC,MAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,CAAM,GAAG,CAAC,CAAA;AACtD,MAAA,IAAI,CAACA,UAAAA,CAAW,IAAI,CAAA,EAAG;AACrB,QAAA,WAAA,CAAY,KAAK,CAAA;AACjB,QAAA,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,YAAA,EAAe,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,MACrC,CAAA,MAAO;AACL,QAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,IAAA,EAAM,KAAK,CAAA;AACxC,QAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,UAAA,MAAA,CAAO,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAC/B,UAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AACnB,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAS,MAAM,oBAAA,CAAqB,KAAA,EAAO,KAAK,GAAG,CAAA;AACzD,MAAA,MAAM,MAAA,GAAS,oBAAoB,MAAM,CAAA;AACzC,MAAA,MAAM,UAAA,GAAa,GAAG,IAAI,CAAA,UAAA,EAAa,OAAO,aAAa,CAAA,IAAA,EAAO,OAAO,WAAW,CAAA,UAAA,CAAA;AACpF,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,OAAA,CAAQ,UAAU,CAAA;AAClB,QAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,MACrB,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,UAAU,CAAA;AAAA,MAClB;AACA,MAAA,KAAA,MAAW,GAAA,IAAO,OAAO,MAAA,EAAQ,OAAA,CAAQ,GAAG,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAC1D,MAAA,KAAA,MAAW,QAAA,IAAY,OAAO,UAAA,EAAY,OAAA,CAAQ,GAAG,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAE,CAAA;AACxE,MAAA,MAAM,UAAA,GAAa,uBAAuB,IAAI,CAAA;AAC9C,MAAA,IAAI,YAAY,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,UAAU,CAAA,CAAE,CAAA;AAAA,IAClD;AAAA,EACF,CAAC,CAAA;AAGH,EAAA,GAAA,CACG,OAAA,CAAQ,aAAa,CAAA,CACrB,WAAA,CAAY,iDAAiD,CAAA,CAC7D,MAAA,CAAO,CAAC,IAAA,KAAiB;AACxB,IAAA,MAAA;AAAA,MACE;AAAA,KAEF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB,CAAC,CAAA;AAEH,EAAA,GAAA,CACG,OAAA,CAAQ,eAAe,CAAA,CACvB,WAAA,CAAY,sDAAsD,CAAA,CAClE,MAAA,CAAO,CAAC,IAAA,KAAiB;AACxB,IAAA,MAAA;AAAA,MACE;AAAA,KAEF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB,CAAC,CAAA;AAGH,EAAA,yBAAA,CAA0B,GAAG,CAAA;AAE7B,EAAA,OAAO,GAAA;AACT","file":"chunk-WI4T3KIS.js","sourcesContent":["/**\n * `skaile source manifest …` — curated `skaile.manifest.yaml` lifecycle for a\n * source you do NOT own. `init` generates a curated manifest from a discovery\n * run and stores it OUTSIDE the source, under the local store catalog\n * (`~/.skaile/store/manifests/<slug>.yaml`); `edit` opens it in `$EDITOR` and\n * re-validates on save. `source add`/`sync` then apply it as a read overlay\n * (see `source.ts` `refreshManifestCache`).\n *\n * `rebuild` refreshes a curated manifest after an upstream change (merge by\n * default — curation is sacred; `--overwrite` re-scans). `verify` is a\n * read-only integrity check (paths, declared hashes, schema, dep refs).\n * `publish`/`propose`/`yank` remain stubs — they need the store publish\n * endpoint (`POST /sources/<id>/manifest`), which lands in a follow-up.\n *\n * @docLink cli/commands/source#manifest\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  type AssetEntry,\n  decodeSkaileManifest,\n  encodeSkaileManifest,\n  findWorkspaceRoot,\n  parseAssetRef,\n  resolveSourcePublisher,\n  type SkPublishManifest,\n  type SourceEntry,\n  sourceCacheKey,\n  sourceShortName,\n  storeManifestSlug,\n  workspaceConfigFilename,\n} from \"@skaile/workspaces/core\";\nimport { computeDeterministicHash, discoverAssetsInTree } from \"@skaile/workspaces/discovery\";\nimport {\n  commitStoreManifest,\n  getStoreManifestsDir,\n  writeCuratedManifest,\n} from \"@skaile/workspaces/library\";\nimport type { Command } from \"commander\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport { getKindRegistry } from \"../open-registry.ts\";\nimport {\n  ensureClone,\n  normalizeSourceUrl,\n  readProjectSources,\n  sourceClonePath,\n  sourceMatchesKey,\n} from \"./source.ts\";\n\nconst NOT_WIRED_MSG =\n  \"`skaile source manifest *` is scaffolded but not yet wired. \" +\n  \"Server-side endpoint (`POST /sources/<id>/manifest`) lands in a follow-up PR.\";\n\nfunction notWired(verb: string): never {\n  logErr(`${NOT_WIRED_MSG} (verb: source manifest ${verb})`);\n  process.exit(2);\n}\n\n/**\n * Resolve a `source manifest` argument into a `{ url, slug, dest }` triple.\n *\n * Resolution order:\n *   1. A key matching an already-registered project source (stored URL, cache\n *      key, or short slug).\n *   2. A collision-free **store slug** (`<host>__<owner>__<repo>`) whose\n *      manifest already exists at `~/.skaile/store/manifests/<arg>.yaml`. This\n *      MUST be tried before bare-name expansion: a bare name like `cli` would\n *      otherwise expand (via `normalizeSourceUrl`) to the skaile-ai org and a\n *      DIFFERENT slug than the one `init` wrote (e.g. `larksuite`). The slug is\n *      the exact identifier `init`'s next-step hint prints back.\n *   3. Otherwise a git URL / `owner/repo` / bare name via `normalizeSourceUrl`.\n *\n * The clone dir is the same URL-keyed cache `source add` uses.\n */\nexport function resolveSourceArg(\n  arg: string,\n  projectDir: string,\n): { url: string; slug: string; dest: string; manifestFile: string } {\n  const root = findWorkspaceRoot(projectDir);\n  const registered: SourceEntry[] = root\n    ? readProjectSources(path.join(root, workspaceConfigFilename()))\n    : [];\n  const match = registered.find((e) => sourceMatchesKey(e, arg));\n  const bySlug = !match ? resolveByStoreSlug(arg) : undefined;\n  const url = match ? match.url : (bySlug?.url ?? normalizeSourceUrl(arg));\n  const slug = sourceShortName(url); // human-facing label\n  const dest = sourceClonePath(sourceCacheKey(url));\n  return { url, slug, dest, manifestFile: bySlug?.manifestFile ?? storeManifestPath(url) };\n}\n\n/**\n * When `arg` is a bare store slug (`<host>__<owner>__<repo>`) whose curated\n * manifest already exists on disk, recover the source URL from the slug and\n * point at that manifest file directly. Returns `undefined` when the arg isn't\n * a slug or has no manifest yet (fall back to URL normalization).\n */\nfunction resolveByStoreSlug(arg: string): { url: string; manifestFile: string } | undefined {\n  // A slug is our own encoding — no path/URL sigils, at least the `<host>__…`\n  // separator. Anything URL/owner-repo shaped is not a slug.\n  if (!/^[\\w.-]+__[\\w.-]+/.test(arg) || /[/:\\\\]/.test(arg)) return undefined;\n  const manifestFile = path.join(getStoreManifestsDir(), `${arg}.yaml`);\n  if (!existsSync(manifestFile)) return undefined;\n  // `<host>__<owner>__<repo>` → `https://<host>/<owner>/<repo>` — good enough to\n  // key the clone dir + re-derive the same slug; the manifest file is what edit\n  // actually opens.\n  const [host, owner, repo] = arg.split(\"__\");\n  const url = host && owner && repo ? `https://${host}/${owner}/${repo}` : arg;\n  return { url, manifestFile };\n}\n\n/**\n * Absolute path to a source's curated store manifest. Keyed by the\n * collision-free {@link storeManifestSlug} (`<host>__<owner>__<repo>`) so\n * `orgA/cli` and `orgB/cli` don't share `cli.yaml`.\n */\nfunction storeManifestPath(url: string): string {\n  return path.join(getStoreManifestsDir(), `${storeManifestSlug(url)}.yaml`);\n}\n\n/**\n * Directory-name segments that mark a test-fixture tree. `init`/`rebuild` drop\n * any asset whose repo-relative root contains one of these as an exact path\n * SEGMENT. Repos routinely ship fixture \"skills\" under such dirs (e.g.\n * `scripts/skill-format-check/tests`, `internal/qualitygate/skillscan/testdata/skills/lark-demo`)\n * that are not real, publishable assets.\n */\nconst TEST_FIXTURE_SEGMENTS = new Set([\n  \"tests\",\n  \"test\",\n  \"__tests__\",\n  \"testdata\",\n  \"fixtures\",\n  \"__fixtures__\",\n]);\n\n/**\n * True when an asset's repo-relative `root` sits under a test-fixture directory\n * (see {@link TEST_FIXTURE_SEGMENTS}). Conservative, not repo-specific — finer\n * curation (keeping a genuine fixture asset) stays the user's job via `edit`.\n * `init`/`rebuild`-path only; the general discovery walk (`source add`) is\n * untouched.\n */\nfunction isTestFixtureAsset(relativePath: string): boolean {\n  const segments = relativePath.replace(/\\\\/g, \"/\").split(\"/\");\n  return segments.some((s) => TEST_FIXTURE_SEGMENTS.has(s));\n}\n\n/**\n * `source manifest init <src>` — clone (if needed), run discovery, and write a\n * curated `skaile.manifest.yaml` to `~/.skaile/store/manifests/<slug>.yaml`.\n */\nasync function runInit(\n  arg: string,\n  opts: { projectDir: string; publisher?: string; dev?: boolean; force?: boolean },\n): Promise<void> {\n  const projectDir = path.resolve(opts.projectDir);\n  const { url, dest, manifestFile: target } = resolveSourceArg(arg, projectDir);\n\n  if (existsSync(target) && !opts.force) {\n    logWarn(\n      `A curated manifest already exists at ${S.dim(target)}. ` +\n        \"Edit it with `skaile source manifest edit`, refresh it after an upstream \" +\n        \"change with `skaile source manifest rebuild`, or pass --force to regenerate.\",\n    );\n    return;\n  }\n\n  const entry: SourceEntry = { url };\n  ensureClone(entry);\n\n  const { assets, errors } = discoverCuratableAssets(dest, opts.dev ?? false);\n\n  const publisher = opts.publisher ?? resolveSourcePublisher(dest) ?? sourceShortName(url);\n\n  const written = writeCuratedManifest({\n    manifestFile: target,\n    publisher,\n    assets,\n    force: opts.force,\n    // Init: every asset inherits the top-level repo `publisher`. Do NOT stamp a\n    // per-asset publisher — glob discovery here runs without the resolved\n    // publisher, so each DiscoveredAsset.publisher is only the clone directory\n    // name, which would clobber the intended org/`--publisher` default with\n    // junk per-asset overrides.\n    inheritPublisher: true,\n  });\n\n  if (!written.wrote) {\n    logWarn(\n      `Curated manifest already exists at ${S.dim(target)} — not overwritten. ` +\n        \"Pass --force to regenerate.\",\n    );\n    return;\n  }\n\n  commitStoreManifest(\n    target,\n    `manifest init: ${sourceShortName(url)} (${written.assetCount} assets)`,\n  );\n  logOk(`Wrote curated manifest with ${written.assetCount} assets to ${S.dim(target)}.`);\n  // `edit` takes the <src> the user passed (`resolveSourceArg` maps it back to this\n  // manifest), but `source add` needs the URL: a bare name there is no source.\n  logInfo(\n    `Edit it with \\`skaile source manifest edit ${arg}\\`, then ` +\n      `\\`skaile source add ${url}\\` to consume it.`,\n  );\n  if (errors.length > 0) {\n    logWarn(`${errors.length} discovery error(s) — inspect the manifest before consuming.`);\n  }\n}\n\n/**\n * Run discovery over a clone and drop the test-fixture assets (see\n * {@link isTestFixtureAsset}). Shared by `init` and `rebuild` so both paths\n * produce an identical inventory from the same tree.\n */\nfunction discoverCuratableAssets(\n  dest: string,\n  includeDev: boolean,\n): { assets: ReturnType<typeof discoverAssetsInTree>[\"assets\"]; errors: string[] } {\n  const result = discoverAssetsInTree(dest, {\n    registry: getKindRegistry(),\n    includeDev,\n  });\n  const assets = result.assets.filter((a) => !isTestFixtureAsset(a.relativePath));\n  return { assets, errors: result.errors.map((e) => `${e.path}: ${e.error}`) };\n}\n\n/**\n * Best-effort `git pull --ff-only` on an existing clone. Never throws: a pull\n * failure (offline, diverged, detached) is warned and the caller continues with\n * the clone as-is.\n */\nfunction pullCloneFfOnly(dest: string): void {\n  const res = spawnSync(\"git\", [\"-C\", dest, \"pull\", \"--ff-only\"], { stdio: \"pipe\" });\n  if (res.status !== 0) {\n    logWarn(\n      \"git pull --ff-only failed — continuing with the existing clone \" +\n        \"(it may be behind upstream).\",\n    );\n  }\n}\n\n/**\n * Repo-relative `root` path for a manifest asset entry — the merge match key\n * between an existing curated entry and a freshly-discovered asset. `root:`\n * entries use their declared path; a `files:`-only entry (rare for a curated\n * sidecar) falls back to the entry's dirname of the first file, else the name.\n */\nfunction entryRootKey(entry: AssetEntry): string {\n  if (entry.root) return entry.root.replace(/\\\\/g, \"/\").replace(/\\/+$/, \"\");\n  const files = entry.files;\n  if (files && files.length > 0) {\n    const first = typeof files[0] === \"string\" ? files[0] : files[0].path;\n    const dir = path.posix.dirname(first.replace(/\\\\/g, \"/\"));\n    return dir === \".\" ? entry.name : dir;\n  }\n  return entry.name;\n}\n\n/** Repo-relative `root` path a discovered asset maps to (matches init's writer). */\nfunction discoveredRootKey(relativePath: string): string {\n  const dir = path.posix.dirname(relativePath.replace(/\\\\/g, \"/\"));\n  return dir === \".\" ? path.posix.basename(relativePath.replace(/\\\\/g, \"/\")) : dir;\n}\n\n/** Human ref for reporting: `kind:name`. */\nfunction entryRef(entry: AssetEntry): string {\n  return `${entry.kind}:${entry.name}`;\n}\n\n/**\n * `source manifest rebuild <src>` — refresh a curated manifest after the\n * upstream repo changed. MERGE is the default (curation is sacred); `--overwrite`\n * re-scans from scratch with `init --force` semantics.\n *\n * Merge algorithm (match by repo-relative `root` path):\n *   - Existing entries whose root is STILL discovered → KEPT verbatim (all\n *     hand-edits preserved).\n *   - Existing entries whose root is GONE upstream → DROPPED (reported).\n *   - Freshly-discovered assets not already in the manifest → NOT auto-added,\n *     only REPORTED (a curated foreign sidecar must not silently absorb new\n *     upstream skills). An asset the curator deliberately dropped stays dropped\n *     because it is neither in the existing manifest nor re-added here.\n */\nasync function runRebuild(\n  arg: string,\n  opts: { projectDir: string; publisher?: string; dev?: boolean; overwrite?: boolean },\n): Promise<void> {\n  const projectDir = path.resolve(opts.projectDir);\n  const { url, dest, slug, manifestFile: target } = resolveSourceArg(arg, projectDir);\n\n  if (!existsSync(target)) {\n    logErr(\n      `No curated manifest for \"${slug}\" at ${S.dim(target)} — ` +\n        \"run `skaile source manifest init` first.\",\n    );\n    process.exit(1);\n  }\n\n  // Update the clone: clone if absent, else pull --ff-only (best-effort).\n  const entry: SourceEntry = { url };\n  const cloned = ensureClone(entry);\n  if (!cloned) pullCloneFfOnly(dest);\n\n  const { assets: freshAssets, errors } = discoverCuratableAssets(dest, opts.dev ?? false);\n\n  if (opts.overwrite) {\n    logWarn(\n      \"--overwrite: replacing the curated manifest with a full fresh inventory. \" +\n        \"All hand-curation (dropped assets, per-asset edits) is discarded.\",\n    );\n    const publisher = opts.publisher ?? resolveSourcePublisher(dest) ?? sourceShortName(url);\n    const written = writeCuratedManifest({\n      manifestFile: target,\n      publisher,\n      assets: freshAssets,\n      force: true,\n      inheritPublisher: true,\n    });\n    commitStoreManifest(\n      target,\n      `manifest rebuild --overwrite: ${slug} (${written.assetCount} assets)`,\n    );\n    logOk(\n      `Rebuilt curated manifest with ${written.assetCount} assets to ${S.dim(target)} (overwrite).`,\n    );\n    if (errors.length > 0) {\n      logWarn(`${errors.length} discovery error(s) — inspect the manifest before consuming.`);\n    }\n    return;\n  }\n\n  // MERGE (default). `--publisher` only applies to the full re-derive path.\n  if (opts.publisher) {\n    logWarn(\n      \"--publisher is ignored in merge mode (the curated publisher is preserved). \" +\n        \"Use --overwrite to re-derive the publisher from a full re-scan.\",\n    );\n  }\n\n  // Read the existing curated manifest and keep it as the base.\n  const { manifest: existing } = decodeSkaileManifest(readFileSync(target, \"utf-8\"));\n  const existingEntries = existing.assets ?? [];\n\n  // Index fresh discovery by repo-relative root path.\n  const freshByRoot = new Map<string, (typeof freshAssets)[number]>();\n  for (const a of freshAssets) freshByRoot.set(discoveredRootKey(a.relativePath), a);\n\n  const kept: AssetEntry[] = [];\n  const dropped: string[] = [];\n  for (const e of existingEntries) {\n    if (freshByRoot.has(entryRootKey(e))) kept.push(e);\n    else dropped.push(entryRef(e));\n  }\n\n  // Fresh assets not already curated → report as available, do NOT add.\n  const existingRoots = new Set(existingEntries.map(entryRootKey));\n  const newlyAvailable: string[] = [];\n  for (const a of freshAssets) {\n    if (!existingRoots.has(discoveredRootKey(a.relativePath))) {\n      newlyAvailable.push(`${a.kind}:${a.name}`);\n    }\n  }\n\n  const changed = dropped.length > 0;\n  if (dropped.length > 0) {\n    logWarn(`removed (gone upstream): ${dropped.sort().join(\", \")}`);\n  }\n  if (newlyAvailable.length > 0) {\n    logInfo(\n      `${newlyAvailable.length} new upstream asset(s) available (not added): ` +\n        `${newlyAvailable.sort().join(\", \")} — add with \\`skaile source manifest edit ${arg}\\` if wanted`,\n    );\n  }\n\n  if (!changed) {\n    logOk(\"already up to date\");\n    if (errors.length > 0) {\n      logWarn(`${errors.length} discovery error(s) — inspect the source before re-consuming.`);\n    }\n    return;\n  }\n\n  const merged: SkPublishManifest = { ...existing, assets: kept };\n  writeFileSync(target, encodeSkaileManifest(merged), \"utf-8\");\n  commitStoreManifest(\n    target,\n    `manifest rebuild: ${slug} (kept ${kept.length}, dropped ${dropped.length})`,\n  );\n  logOk(\n    `Rebuilt curated manifest: kept ${kept.length}, dropped ${dropped.length} → ${S.dim(target)}.`,\n  );\n  if (errors.length > 0) {\n    logWarn(`${errors.length} discovery error(s) — inspect the source before re-consuming.`);\n  }\n}\n\n/**\n * `source manifest verify <src>` — READ-ONLY integrity check of a curated\n * manifest against its clone. Writes nothing. Exit 0 when no errors; with\n * `--strict`, any warning also forces a nonzero exit.\n *\n * Per-asset checks:\n *   - `root`/`files` paths still exist upstream (missing → error).\n *   - A declared `sha256` recomputes to the same deterministic hash (mismatch → error).\n *   - Schema decode diagnostics map to errors/warnings.\n *   - Dependency refs parse via `parseAssetRef` (malformed → warning).\n */\nasync function runVerify(\n  arg: string,\n  opts: { projectDir: string; strict?: boolean },\n): Promise<void> {\n  const projectDir = path.resolve(opts.projectDir);\n  const { url, dest, slug, manifestFile: target } = resolveSourceArg(arg, projectDir);\n\n  if (!existsSync(target)) {\n    logErr(\n      `No curated manifest for \"${slug}\" at ${S.dim(target)} — ` +\n        \"run `skaile source manifest init` first.\",\n    );\n    process.exit(1);\n  }\n\n  // Ensure a clone exists to verify paths/hashes against (best-effort; no pull).\n  ensureClone({ url });\n\n  const text = readFileSync(target, \"utf-8\");\n  const { manifest, diagnostics } = decodeSkaileManifest(text);\n\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  // Schema diagnostics from the decoder.\n  for (const d of diagnostics) {\n    const line = `${d.code}: ${d.message}`;\n    if (d.severity === \"error\") errors.push(line);\n    else warnings.push(line);\n  }\n\n  const assets = manifest.assets ?? [];\n  for (const entry of assets) {\n    const ref = entryRef(entry);\n\n    // Path existence: `root` dir and/or each `files[]` path.\n    const relPaths: string[] = [];\n    if (entry.root) relPaths.push(entry.root);\n    if (entry.files) {\n      for (const f of entry.files) relPaths.push(typeof f === \"string\" ? f : f.path);\n    }\n    if (relPaths.length === 0) relPaths.push(entry.name);\n    for (const rel of relPaths) {\n      if (!existsSync(path.join(dest, rel))) {\n        errors.push(`${ref}: path not found upstream: ${rel}`);\n      }\n    }\n\n    // Declared sha256 → recompute + compare, but ONLY for granular `files:`\n    // entries. Discovery (`discover-manifest.ts`) anchors a `files:`-only entry\n    // at the REPO ROOT and hashes the files VERBATIM as repo-relative strings\n    // (the path is folded into the digest), so verify must hash the same way:\n    // `assetRoot = dest`, files kept repo-relative — NOT rebased onto the root.\n    // A `root:` entry cannot be verified this way (discovery hashes only the\n    // per-kind filtered set, not the whole-dir walk), and the writer never emits\n    // sha256 for `root:` entries, so skip the hash check for them.\n    if (entry.sha256) {\n      if (entry.files && entry.files.length > 0) {\n        const hashFiles = entry.files.map((f) =>\n          (typeof f === \"string\" ? f : f.path).replace(/\\\\/g, \"/\"),\n        );\n        const actual = computeDeterministicHash(dest, hashFiles);\n        if (actual !== entry.sha256) {\n          errors.push(\n            `${ref}: sha256 mismatch (declared ${entry.sha256.slice(0, 12)}…, got ${actual.slice(0, 12)}…)`,\n          );\n        }\n      } else {\n        warnings.push(\n          `${ref}: declared sha256 on a root:-mode entry is not verifiable (discovery hashes only the per-kind filtered set) — skipped`,\n        );\n      }\n    }\n\n    // Dependency refs parse.\n    for (const dep of entry.dependencies ?? []) {\n      try {\n        parseAssetRef(dep);\n      } catch (err) {\n        warnings.push(\n          `${ref}: malformed dependency \"${dep}\": ${err instanceof Error ? err.message : String(err)}`,\n        );\n      }\n    }\n  }\n\n  for (const w of warnings) logWarn(w);\n  for (const e of errors) logErr(e);\n\n  if (errors.length === 0) {\n    logOk(`verified ${assets.length} asset(s).`);\n  } else {\n    logErr(`${errors.length} issue(s).`);\n  }\n\n  const failStrict = opts.strict && warnings.length > 0;\n  if (errors.length > 0 || failStrict) process.exit(1);\n}\n\n/**\n * Split a `$VISUAL`/`$EDITOR` value into `{ command, args }` and append the file\n * as the final arg. The env value is a full command line, not a bare binary —\n * `EDITOR=\"code --wait\"` must spawn `code` with `[\"--wait\", <file>]`, and\n * `EDITOR=code` (which returns before save) is the user's problem, not ours.\n * A whitespace split covers the common editors (`code --wait`, `code -w`,\n * `subl -w`, `vi`); paths with embedded spaces are not supported (rare for an\n * editor binary and out of scope). Falls back to `vi` when unset/empty.\n *\n * @docLink cli/commands/source#manifest-edit\n */\nexport function resolveEditorCommand(\n  editorEnv: string | undefined,\n  target: string,\n): { command: string; args: string[] } {\n  const parts = (editorEnv ?? \"\").trim().split(/\\s+/).filter(Boolean);\n  const [command, ...rest] = parts.length > 0 ? parts : [\"vi\"];\n  return { command: command as string, args: [...rest, target] };\n}\n\n/** Minimal spawn contract runEdit needs — lets tests inject a fake. */\ntype SpawnLike = (\n  command: string,\n  args: string[],\n  opts: { stdio: \"inherit\" },\n) => { status: number | null };\n\n/**\n * `source manifest edit <src>` — open the curated store manifest in `$EDITOR`\n * and re-validate on save. Warnings are surfaced but never hard-fail.\n *\n * `spawn` is injectable so tests can assert the argv without launching a real\n * editor; production passes the default `spawnSync`.\n */\nexport function runEdit(\n  arg: string,\n  opts: { projectDir: string },\n  spawn: SpawnLike = spawnSync as unknown as SpawnLike,\n): void {\n  const projectDir = path.resolve(opts.projectDir);\n  const { slug, manifestFile: target } = resolveSourceArg(arg, projectDir);\n\n  if (!existsSync(target)) {\n    logErr(\n      `No curated manifest for \"${slug}\" at ${target}. ` +\n        \"Run `skaile source manifest init` first.\",\n    );\n    process.exit(1);\n  }\n\n  const { command, args } = resolveEditorCommand(process.env.VISUAL || process.env.EDITOR, target);\n  const res = spawn(command, args, { stdio: \"inherit\" });\n  if (res.status !== 0 && res.status !== null) {\n    logErr(`Editor exited with status ${res.status}.`);\n    process.exit(1);\n  }\n\n  commitStoreManifest(target, `manifest edit: ${slug}`);\n\n  // Re-validate the saved file; surface diagnostics as warnings, don't hard-fail.\n  const { diagnostics } = decodeSkaileManifest(readFileSync(target, \"utf-8\"));\n  const errors = diagnostics.filter((d) => d.severity === \"error\");\n  const warnings = diagnostics.filter((d) => d.severity !== \"error\");\n  if (errors.length > 0) {\n    for (const d of errors) logErr(`${d.code}: ${d.message}`);\n    logWarn(\"Manifest has errors — fix them before `skaile source add` will consume it.\");\n  } else if (warnings.length > 0) {\n    for (const d of warnings) logWarn(`${d.code}: ${d.message}`);\n    logOk(\"Saved (with warnings).\");\n  } else {\n    logOk(\"Saved.\");\n  }\n}\n\n/**\n * Append the `manifest` sub-tree to a `source` command.\n *\n * Called from `makeSourceCommand()` in `source.ts`.\n */\nexport function addSourceManifestCommands(src: Command): void {\n  // enablePositionalOptions so options on the leaf verb (`source manifest init\n  // --publisher …`) route to that verb instead of being rejected by `manifest`.\n  const manifest = src\n    .command(\"manifest\")\n    .description(\"Curated manifest lifecycle for a source\")\n    .enablePositionalOptions();\n\n  manifest\n    .command(\"init <src>\")\n    .description(\"Generate a curated manifest for a source (stored in the local store catalog)\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--publisher <name>\", \"Override the publisher (default: source's GitHub org)\")\n    .option(\"--dev\", \"Include assets under the source's dev_paths\", false)\n    .option(\"--force\", \"Overwrite an existing curated manifest\", false)\n    .action((arg, opts) => runInit(arg, opts));\n\n  manifest\n    .command(\"edit <src>\")\n    .description(\"Open the curated manifest in $EDITOR and re-validate on save\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .action((arg, opts) => runEdit(arg, opts));\n\n  manifest\n    .command(\"rebuild <src>\")\n    .description(\n      \"Refresh a curated manifest after an upstream change (merge by default: \" +\n        \"keeps curation, drops assets gone upstream, reports new ones without adding)\",\n    )\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--publisher <name>\", \"Override the publisher (--overwrite only)\")\n    .option(\"--dev\", \"Include assets under the source's dev_paths\", false)\n    .option(\"--overwrite\", \"Discard curation and re-scan the full inventory\", false)\n    .action((arg, opts) => runRebuild(arg, opts));\n\n  manifest\n    .command(\"verify <src>\")\n    .description(\"Verify hashes, deps, and schema (read-only)\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--strict\", \"Fail on advisory checks (warnings force a nonzero exit)\", false)\n    .action((arg, opts) => runVerify(arg, opts));\n\n  manifest\n    .command(\"publish <src>\")\n    .description(\"Push the curated sidecar manifest and publish it to the store\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--as <namespace>\", \"Publisher namespace (default: your store username)\")\n    .option(\"--sidecar-repo <url>\", \"Public GitHub repo you own to hold the curated manifest\")\n    .option(\"--ref <gitref>\", \"Foreign source ref to ingest (branch/sha; default: main)\")\n    .option(\"--dry-run\", \"Print the publish plan without pushing or calling the store\", false)\n    .action(async (arg, opts) => {\n      const { runPublish } = await import(\"./source-manifest-publish.ts\");\n      await runPublish(arg, opts);\n    });\n\n  manifest\n    .command(\"propose <src>\")\n    .description(\"Open a PR to upstream with the sidecar manifest\")\n    .action(() => notWired(\"propose\"));\n\n  manifest\n    .command(\"yank <src>\")\n    .description(\"Retract the source's published assets from the store\")\n    .option(\"-C, --project-dir <dir>\", \"Project directory\", process.cwd())\n    .option(\"--asset <ref>\", \"Yank only the asset matching this ref/name\")\n    .action(async (arg, opts) => {\n      const { runYank } = await import(\"./source-manifest-publish.ts\");\n      await runYank(arg, opts);\n    });\n}\n","/**\n * `skaile source …` — manage github sources for the current project.\n *\n * A *source* is a third-party github repo of AI assets. The project's\n * `skaile.yaml` `sources:` array is the source of truth for which sources\n * this project uses. The clone itself lives at\n * `<cache root>/sources/<host>/<owner>/<repo>/` (`~/.skaile/cache` unless `SKAILE_HOME` or\n * `SKAILE_CACHE_DIR` moves it; machine-global cache, shared across projects, URL-keyed so\n * cross-org repos never collide), and the manifest is mirrored into `<skaile home>/index.db`\n * (machine-global manifest cache).\n *\n * @docLink cli/commands/source\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync, mkdirSync, readdirSync, renameSync, rmdirSync, rmSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  attachToBranch,\n  findWorkspaceRoot,\n  getGlobalCacheDir,\n  globalCacheRoot,\n  legacySourceCacheKey,\n  type SourceEntry,\n  sourceCacheKey,\n  sourceShortName,\n  WorkspaceYamlEditor,\n  workspaceConfigFilename,\n} from \"@skaile/workspaces/core\";\nimport { curatedManifestOverlay, LocalCatalogSource } from \"@skaile/workspaces/library\";\nimport * as p from \"@clack/prompts\";\nimport { Command } from \"commander\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport { openLibraryManager } from \"../open-library.ts\";\nimport { getKindRegistry } from \"../open-registry.ts\";\nimport { addSourceManifestCommands } from \"./source-manifest.ts\";\n\n/**\n * Clone dir for one source cache key (`<host>/<owner>/<repo>`). Exported for the\n * cache-path regression test. Callers pass `sourceCacheKey(url)`.\n */\nexport function sourceClonePath(key: string): string {\n  return path.join(getGlobalCacheDir(), key);\n}\n\nconst SKAILE_MANIFEST_FILENAME = \"skaile.manifest.yaml\";\nconst LEGACY_SOURCE_CONFIG_FILENAME = \".skaile-source.yaml\";\n\n/**\n * Whether a manifest-cache refresh actually failed to index something. Keyed on\n * `errors`, NOT on `assetsUpdated < assetsFound`: the discovery walk counts\n * presets (and other intentionally-not-cataloged kinds) toward `assetsFound` but\n * never upserts them, so a source shipping a `.preset.yaml` would otherwise read\n * as a partial failure — false `! N asset(s) failed to index` + exit 1 — with\n * zero real errors.\n */\nexport function indexingHadFailures(result: { errors: string[] }): boolean {\n  return result.errors.length > 0;\n}\n\n/**\n * A clone that ships only the legacy `.skaile-source.yaml` (no\n * `skaile.manifest.yaml`) has its declared `publisher_default` silently ignored\n * — discovery only reads `skaile.manifest.yaml`, so publisher resolution falls\n * back to the first path segment. Surface a hint so the author can fix it.\n */\nexport function legacySourceConfigHint(dest: string): string | undefined {\n  const hasLegacy = existsSync(path.join(dest, LEGACY_SOURCE_CONFIG_FILENAME));\n  const hasManifest = existsSync(path.join(dest, SKAILE_MANIFEST_FILENAME));\n  if (hasLegacy && !hasManifest) {\n    return (\n      `This source ships a legacy ${LEGACY_SOURCE_CONFIG_FILENAME} but no ` +\n      `${SKAILE_MANIFEST_FILENAME}; its declared publisher is ignored and assets ` +\n      `are published under their first path segment. Add a ${SKAILE_MANIFEST_FILENAME} ` +\n      `(\\`skaile source manifest init\\`) to set the publisher and asset inventory.`\n    );\n  }\n  return undefined;\n}\n\n/**\n * Normalize a `source add` argument into a clonable git URL. Full URLs and\n * scp-style (`git@host:…`) specs pass through unchanged; an `owner/repo`\n * shorthand and a bare repo name expand to GitHub over SSH — a bare name\n * defaults to the `skaile-ai` org (`git@github.com:skaile-ai/<name>.git`).\n */\nexport function normalizeSourceUrl(input: string): string {\n  const s = input.trim();\n  if (/^(?:https?|git|ssh|file):\\/\\//.test(s) || /^git@/.test(s)) return s;\n  const repo = s.replace(/\\.git$/, \"\");\n  if (/^[\\w.-]+\\/[\\w.-]+$/.test(repo)) return `git@github.com:${repo}.git`;\n  if (/^[\\w.-]+$/.test(repo)) return `git@github.com:skaile-ai/${repo}.git`;\n  return s;\n}\n\n/**\n * Match a stored source against a user-supplied key. Mirrors the shortcut\n * expansion `source add` applies (`normalizeSourceUrl`) so any form that `add`\n * accepted — bare name, `owner/repo`, `.git`-suffixed, full URL — also resolves\n * at `sync`/`show`/`remove` time, not just the raw stored URL or derived slug.\n */\nexport function sourceMatchesKey(entry: SourceEntry, key: string): boolean {\n  if (entry.url === key) return true;\n  if (sourceCacheKey(entry.url) === key || sourceShortName(entry.url) === key) return true;\n  return entry.url === normalizeSourceUrl(key);\n}\n\n/**\n * Name a source in output: its repo short name, or its clone-cache key when\n * another source in the project shares that short name (two `skillz` repos of\n * different owners). The key is unique per URL and `source show`/`remove` accept it.\n */\nexport function sourceLabel(entry: SourceEntry, all: readonly SourceEntry[]): string {\n  const short = sourceShortName(entry.url);\n  const shared = all.some((s) => s.url !== entry.url && sourceShortName(s.url) === short);\n  return shared ? sourceCacheKey(entry.url) : short;\n}\n\n/** Outcome of {@link resolveSource}. */\nexport type SourceResolution =\n  | { kind: \"one\"; entry: SourceEntry }\n  | { kind: \"ambiguous\"; entries: SourceEntry[] }\n  | { kind: \"none\" };\n\n/**\n * Pick the one source `key` names. Exact forms win over names: the stored URL,\n * then the cache key, then the repo short name or a `source add` shortcut. A\n * name that several sources share (`skillz` from two owners) is `ambiguous`\n * instead of silently picking the first.\n */\nexport function resolveSource(sources: readonly SourceEntry[], key: string): SourceResolution {\n  const tiers: ((s: SourceEntry) => boolean)[] = [\n    (s) => s.url === key,\n    (s) => sourceCacheKey(s.url) === key,\n    (s) => sourceShortName(s.url) === key || s.url === normalizeSourceUrl(key),\n  ];\n  for (const tier of tiers) {\n    const hits = sources.filter(tier);\n    if (hits.length === 1) return { kind: \"one\", entry: hits[0] };\n    if (hits.length > 1) return { kind: \"ambiguous\", entries: hits };\n  }\n  return { kind: \"none\" };\n}\n\nfunction exitAmbiguousSource(key: string, entries: readonly SourceEntry[]): never {\n  logErr(`\"${key}\" matches ${entries.length} sources; pass the URL of the one you mean:`);\n  for (const e of entries) console.error(`    ${e.url}`);\n  process.exit(1);\n}\n\n/**\n * git's stderr as one line: every line but the `hint:` advice and the\n * `From <url>` / ` * branch …` fetch progress, joined by spaces. Keeps the\n * cause (`fatal: '<path>' does not appear to be a git repository`).\n */\nfunction pullFailureReason(stderr: string): string {\n  return stderr\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l !== \"\" && !/^(hint:|From |[*+=!-] )/.test(l))\n    .join(\" \");\n}\n\n/**\n * Find an already-registered source that maps to the same cache key as `url`\n * but is stored under a *different* URL string (e.g. the `.git`-suffixed or\n * scp form of the same remote). Two such entries would fight over one clone\n * dir, so `source add` rejects the ambiguity. Returns the colliding entry, or\n * `undefined` when the URL is unique or only matches an exact-string duplicate\n * (which `setSource` updates in place).\n */\nexport function findCacheKeyCollision(\n  sources: SourceEntry[],\n  url: string,\n): SourceEntry | undefined {\n  const key = sourceCacheKey(url);\n  return sources.find((s) => s.url !== url && sourceCacheKey(s.url) === key);\n}\n\nfunction requireProjectYamlPath(): string {\n  const root = findWorkspaceRoot(process.cwd());\n  if (!root) {\n    logErr(\n      \"No skaile.yaml found in the current directory or any parent. \" + \"Run `skaile init` first.\",\n    );\n    process.exit(1);\n  }\n  return path.join(root, workspaceConfigFilename());\n}\n\nexport function readProjectSources(yamlPath: string): SourceEntry[] {\n  if (!existsSync(yamlPath)) return [];\n  try {\n    return WorkspaceYamlEditor.load(yamlPath).getSources();\n  } catch (err) {\n    logErr(`Could not read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/** Remove the empty `<owner>` / `<host>` directories a failed clone left under `sources/`. */\nfunction pruneEmptyCloneParents(dest: string): void {\n  let dir = path.dirname(dest);\n  while (path.basename(dir) !== \"sources\" && dir !== path.dirname(dir)) {\n    try {\n      if (readdirSync(dir).length > 0) return;\n      rmdirSync(dir);\n    } catch {\n      return;\n    }\n    dir = path.dirname(dir);\n  }\n}\n\n/**\n * Clone the source if its clone directory does not yet exist. When `force` is\n * set, the existing clone is replaced by a fresh checkout. Returns true when a\n * clone happened. The cache slug is derived from the URL.\n *\n * A `--force` re-clone moves the old clone aside first and only deletes it once\n * the fresh clone succeeds — so a failed re-clone restores the previous clone\n * rather than leaving the source registered with no cache behind it.\n */\nexport function ensureClone(entry: SourceEntry, opts: { force?: boolean } = {}): boolean {\n  const dest = sourceClonePath(sourceCacheKey(entry.url));\n  let backup: string | undefined;\n  if (existsSync(dest)) {\n    if (!opts.force) return false;\n    backup = `${dest}.bak`;\n    rmSync(backup, { recursive: true, force: true });\n    renameSync(dest, backup);\n  }\n  mkdirSync(path.dirname(dest), { recursive: true });\n  const args = [\"clone\", entry.url, dest];\n  // `pin` may be a branch/tag; pass it as the clone branch when present.\n  if (entry.pin) args.splice(1, 0, \"--branch\", entry.pin);\n  const clone = spawnSync(\"git\", args, { stdio: \"inherit\" });\n  if (clone.status !== 0) {\n    if (backup) {\n      rmSync(dest, { recursive: true, force: true });\n      renameSync(backup, dest);\n    } else {\n      // Nothing was there before: leave no empty `<host>/<owner>/` directories behind.\n      rmSync(dest, { recursive: true, force: true });\n      pruneEmptyCloneParents(dest);\n    }\n    logErr(`git clone failed for ${entry.url}`);\n    process.exit(1);\n  }\n  if (backup) rmSync(backup, { recursive: true, force: true });\n  return true;\n}\n\n/**\n * Advance an existing clone with `git pull --ff-only`. `add` and\n * `install --locked` leave the shared clone on a detached HEAD at the locked\n * commit, where `git pull` refuses to run, so a detached clone is put back on\n * its branch first (the pin when it is a branch, else the remote's default).\n * An entry pinned to a tag or SHA has nothing to pull and counts as synced.\n * On failure `error` is one line: git's whole stderr minus `hint:` advice and fetch progress.\n */\nexport function pullSourceClone(\n  dest: string,\n  entry: SourceEntry,\n): { ok: true } | { ok: false; error: string } {\n  if (!attachToBranch(dest, entry.pin) && entry.pin) return { ok: true };\n  const pull = spawnSync(\"git\", [\"pull\", \"--ff-only\"], {\n    cwd: dest,\n    stdio: \"pipe\",\n    encoding: \"utf8\",\n  });\n  if (pull.status === 0) return { ok: true };\n  const reason = pullFailureReason(pull.stderr) || `git exited with status ${pull.status}`;\n  return { ok: false, error: `git pull failed: ${reason}` };\n}\n\n/**\n * Library name for a new source row: the repo short name, or `<owner>-<repo>`\n * (then `<host>-<owner>-<repo>`) when another library already holds that name.\n * Rows are found by clone path, never by this name: `orgA/repo` and\n * `orgB/repo` share the short name `repo`.\n */\nfunction sourceLibraryName(url: string, libs: readonly { name: string }[]): string {\n  const taken = new Set(libs.map((l) => l.name));\n  // A repo may be named `my.repo`; `addLibrary` only accepts `[A-Za-z0-9_-]`\n  // starting with a letter or digit, so every candidate is slugged first.\n  const flat = (s: string) => s.replace(/[^A-Za-z0-9_-]+/g, \"-\").replace(/^[-_]+/, \"\") || \"source\";\n  const short = flat(sourceShortName(url));\n  if (!taken.has(short)) return short;\n  const parts = sourceCacheKey(url).split(\"/\");\n  const candidates =\n    parts.length === 3\n      ? [flat(`${parts[1]}-${parts[2]}`), flat(`${parts[0]}-${parts[1]}-${parts[2]}`)]\n      : [];\n  for (const c of candidates) if (!taken.has(c)) return c;\n  let n = 2;\n  while (taken.has(`${short}-${n}`)) n++;\n  return `${short}-${n}`;\n}\n\n/**\n * Refresh the machine-global manifest cache for `entry` by running discovery\n * and upserting AssetDefinitions into `<skaile home>/index.db`. Creates the\n * libraries-table cache row if missing (ownership: reader = cache state).\n */\nasync function refreshManifestCache(\n  entry: SourceEntry,\n  includeDev = false,\n): Promise<{\n  assetsFound: number;\n  assetsUpdated: number;\n  errors: string[];\n  advisories: string[];\n}> {\n  const { manager, library, close } = await openLibraryManager();\n  try {\n    const dest = sourceClonePath(sourceCacheKey(entry.url));\n    const libs = await manager.listLibraries();\n    const existing = libs.find((l) => path.resolve(l.path) === path.resolve(dest));\n    // A clone made before the cache key gained its url hash sits at `<last segment>`.\n    // Its library row is this source's: point it at the new clone instead of adding a\n    // second row for the same source (`add` would warn \"exists in 2 libraries\").\n    const legacyKey = legacySourceCacheKey(entry.url);\n    const legacyDir = legacyKey ? path.resolve(sourceClonePath(legacyKey)) : undefined;\n    const legacyRow =\n      existing || !legacyDir\n        ? undefined\n        : libs.find((l) => path.resolve(l.path) === legacyDir && l.ownership === \"reader\");\n    if (legacyRow && legacyDir) {\n      await manager.updateLibrary(legacyRow.id, { path: dest });\n      logInfo(\n        `Moved the \"${legacyRow.name}\" library to the new clone ${dest}. ` +\n          `The old clone ${legacyDir} is no longer used and can be deleted.`,\n      );\n    }\n    const lib =\n      existing ??\n      legacyRow ??\n      (await manager.addLibrary({\n        name: sourceLibraryName(entry.url, libs),\n        path: dest,\n        backend: \"git\",\n        backendConfig: { url: entry.url, branch: entry.pin ?? \"main\", authHint: \"ssh\" },\n        ownership: \"reader\",\n      }));\n    // A `skaile source manifest init` curated manifest overrides the upstream repo's\n    // raw glob discovery; `asset install` rescans with the same overlay.\n    const catalog = new LocalCatalogSource(library, lib.id, dest, getKindRegistry(), {\n      sidecarManifestFile: curatedManifestOverlay(entry.url),\n    });\n    const result = await catalog.sync({ includeDev });\n    await library.syncSource(lib.id);\n    return result;\n  } finally {\n    close();\n  }\n}\n\n/**\n * Auto-sync hook for `skaile search` on an unsynced workspace. Clones/pulls and\n * re-indexes every source declared in the project's `skaile.yaml`, then returns\n * whether the manifest cache may have changed (caller re-queries on `true`).\n *\n * Unlike `source sync`, this degrades gracefully — a clone/pull/index failure is\n * logged and skipped (never `process.exit`) so a failed auto-sync falls back to\n * the \"run sync first\" hint rather than killing the search. Returns `false`\n * (silently, no announce) when no sources are declared. Callers must guard\n * air-gapped mode themselves — this always touches the network.\n */\nexport async function autoSyncForSearch(projectDir: string): Promise<boolean> {\n  const root = findWorkspaceRoot(projectDir);\n  if (!root) return false;\n  if (readProjectSources(path.join(root, workspaceConfigFilename())).length === 0) return false;\n\n  logInfo(\"sources not synced — syncing now…\");\n  const { synced } = await syncProjectSources(projectDir);\n  return synced > 0;\n}\n\n/**\n * Clone-or-pull every source declared in the project's `skaile.yaml`, then\n * refresh its manifest cache. Shared by `autoSyncForSearch` and `skaile update`\n * (the latter offers it behind a confirm) so a re-deploy can see upstream\n * commits — `update` re-deploys against the local source cache, which is\n * otherwise frozen at the commit captured when the source was first cloned.\n *\n * Graceful by design: a clone/pull/index failure for one source is logged and\n * skipped (never `process.exit`), so a single bad remote can't abort the run.\n * Existing clones are advanced with `git pull --ff-only` (no `--depth=1`, unlike\n * the installer's `pullRepo`, so it fast-forwards instead of tripping the\n * shallow-divergence path). Returns a count summary for the caller to report.\n */\nexport async function syncProjectSources(\n  projectDir: string,\n  opts: { dev?: boolean } = {},\n): Promise<{ total: number; synced: number; failed: number }> {\n  const root = findWorkspaceRoot(projectDir) ?? projectDir;\n  const sources = readProjectSources(path.join(root, workspaceConfigFilename()));\n  let synced = 0;\n  let failed = 0;\n  for (const entry of sources) {\n    const slug = sourceShortName(entry.url);\n    const dest = sourceClonePath(sourceCacheKey(entry.url));\n    try {\n      // Quiet git — the sync is a preparatory step; keep progress bars out of\n      // the foreground output (spinner / install result).\n      if (!existsSync(dest)) {\n        mkdirSync(path.dirname(dest), { recursive: true });\n        const args = [\"clone\", entry.url, dest];\n        if (entry.pin) args.splice(1, 0, \"--branch\", entry.pin);\n        const clone = spawnSync(\"git\", args, { stdio: \"ignore\" });\n        if (clone.status !== 0) {\n          logWarn(`${slug}: git clone failed, skipping.`);\n          failed++;\n          continue;\n        }\n      } else {\n        const pull = pullSourceClone(dest, entry);\n        if (!pull.ok) {\n          logErr(`${slug}: ${pull.error}`);\n          failed++;\n          continue;\n        }\n      }\n      const result = await refreshManifestCache(entry, opts.dev);\n      for (const err of result.errors) logWarn(`${slug}: ${err}`);\n      for (const advisory of result.advisories) logInfo(`${slug}: ${advisory}`);\n      synced++;\n    } catch (err) {\n      logWarn(`${slug}: sync failed — ${err instanceof Error ? err.message : String(err)}`);\n      failed++;\n    }\n  }\n  return { total: sources.length, synced, failed };\n}\n\n/**\n * Short names of the project's source clones that hold commits their upstream lacks.\n * `update --no-sync` still re-deploys from such a clone, so it reports them the way\n * `source sync` does. A clone without an upstream (detached at a pin) never counts.\n */\nexport function divergedSourceClones(projectDir: string): string[] {\n  const root = findWorkspaceRoot(projectDir) ?? projectDir;\n  const diverged: string[] = [];\n  for (const entry of readProjectSources(path.join(root, workspaceConfigFilename()))) {\n    const dest = sourceClonePath(sourceCacheKey(entry.url));\n    if (!existsSync(dest)) continue;\n    const ahead = spawnSync(\"git\", [\"-C\", dest, \"rev-list\", \"--count\", \"@{upstream}..HEAD\"], {\n      stdio: \"pipe\",\n      encoding: \"utf8\",\n    });\n    if (ahead.status === 0 && Number(ahead.stdout.trim()) > 0) {\n      diverged.push(sourceShortName(entry.url));\n    }\n  }\n  return diverged;\n}\n\n/** Remove the libraries-table cache row and (optionally) the clone bytes. */\nasync function dropManifestCache(url: string, purgeClone: boolean): Promise<void> {\n  const dest = sourceClonePath(sourceCacheKey(url));\n  const { manager, close } = await openLibraryManager();\n  try {\n    // By clone path, not short name: another org's repo of the same name keeps its row.\n    const existing = (await manager.listLibraries()).find(\n      (l) => path.resolve(l.path) === path.resolve(dest),\n    );\n    if (existing) {\n      await manager.removeLibrary(existing.name, { purge: false });\n    }\n  } finally {\n    close();\n  }\n  if (purgeClone) {\n    const dest = sourceClonePath(sourceCacheKey(url));\n    if (existsSync(dest)) rmSync(dest, { recursive: true, force: true });\n  }\n}\n\nexport function makeSourceCommand(): Command {\n  const cmd = new Command(\"source\").description(\n    \"Manage github sources for the current project (recorded in skaile.yaml)\",\n  );\n\n  // ── source add ──────────────────────────────────────────────────────────\n  cmd\n    .command(\"add <source>\")\n    .description(\n      \"Clone a github repo and register it in this project's skaile.yaml. \" +\n        \"<source> is a full git URL or an owner/repo shorthand (→ git@github.com:<owner>/<repo>.git).\",\n    )\n    .option(\"--name <slug>\", \"[deprecated] no-op — the source entry stores only the URL\")\n    .option(\"--pin <ref>\", \"Pin a branch, tag, or 40-char SHA\")\n    .option(\"--branch <branch>\", \"[deprecated] alias for --pin\")\n    .option(\"--force\", \"Remove an existing clone and re-clone\", false)\n    .option(\"--dev\", \"Also index dev-only assets under the source's dev_paths\", false)\n    .action(\n      async (\n        source: string,\n        opts: {\n          name?: string;\n          pin?: string;\n          branch?: string;\n          force?: boolean;\n          dev?: boolean;\n        },\n      ) => {\n        // A bare name used to expand to the `skaile-ai` org over SSH: a typo (or the slug\n        // `source manifest init` printed) cloned a made-up repo. Say what to give instead.\n        if (/^[\\w.-]+$/.test(source.trim().replace(/\\.git$/, \"\"))) {\n          logErr(\n            `\"${source}\" is not a git URL or an owner/repo shorthand. ` +\n              \"Use `skaile source add <owner>/<repo>` or the full URL \" +\n              \"(for a curated manifest: `skaile source add <the repo URL>`).\",\n          );\n          process.exitCode = 1;\n          return;\n        }\n        const url = normalizeSourceUrl(source);\n        const yamlPath = requireProjectYamlPath();\n\n        // A different URL string that maps to the same cache key (e.g. the\n        // `.git`-suffixed or scp form of an already-registered remote) would\n        // fight over one clone dir. setSource only dedupes exact strings, so\n        // reject the ambiguous collision here instead of silently shadowing.\n        const collision = findCacheKeyCollision(readProjectSources(yamlPath), url);\n        if (collision) {\n          logErr(\n            `\"${url}\" maps to the same cache key (${sourceCacheKey(url)}) as ` +\n              `already-registered \"${collision.url}\". Remove that source first ` +\n              `(skaile source remove) or re-use its exact URL to update it.`,\n          );\n          process.exitCode = 1;\n          return;\n        }\n\n        if (opts.name) {\n          logWarn(\n            \"the --name flag is deprecated; the source entry now stores only the URL \" +\n              \"(the cache slug is derived from it).\",\n          );\n        }\n        const pin = opts.pin ?? opts.branch;\n        const slug = sourceShortName(url);\n        const entry: SourceEntry = { url };\n        if (pin) entry.pin = pin;\n\n        const dest = sourceClonePath(sourceCacheKey(url));\n        const preexisting = existsSync(dest);\n        // Clone/validate the repo BEFORE touching skaile.yaml — a failed clone\n        // (repo not found, bad URL, network error) hard-exits in ensureClone, so\n        // the entry is only ever recorded once the source is known-good.\n        const cloned = ensureClone(entry, { force: opts.force });\n        if (!cloned) {\n          logOk(`Reusing cached clone at ${dest}`);\n        } else if (preexisting) {\n          logOk(`Re-cloned ${url} → ${dest}`);\n        } else {\n          logOk(`Cloned ${url} → ${dest}`);\n        }\n\n        const editor = WorkspaceYamlEditor.load(yamlPath);\n        editor.setSource(entry);\n        editor.save();\n\n        const result = await refreshManifestCache(entry, opts.dev);\n        const failed = indexingHadFailures(result);\n        const indexedMsg = `Indexed ${result.assetsUpdated} of ${result.assetsFound} asset(s) from \"${slug}\".`;\n        if (failed) {\n          logWarn(indexedMsg);\n        } else {\n          logOk(indexedMsg);\n        }\n        for (const err of result.errors) logWarn(err);\n        for (const advisory of result.advisories) logInfo(advisory);\n\n        const legacyHint = legacySourceConfigHint(dest);\n        if (legacyHint) logWarn(legacyHint);\n\n        const where = path.relative(process.cwd(), yamlPath);\n        if (failed) {\n          // The entry IS recorded in skaile.yaml, but indexing did not fully\n          // succeed — don't present it as a clean success.\n          logWarn(\n            `Source \"${slug}\" registered in ${where}, but ${result.errors.length} ` +\n              `asset(s) failed to index (see above). Fix the cause, then re-run ` +\n              `\\`skaile source sync ${slug}\\`.`,\n          );\n          process.exitCode = 1;\n        } else {\n          logOk(`Source \"${slug}\" registered in ${where}.`);\n        }\n      },\n    );\n\n  // ── source list ─────────────────────────────────────────────────────────\n  cmd\n    .command(\"list\")\n    .description(\"List sources registered in this project's skaile.yaml\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (opts: { json?: boolean }) => {\n      const yamlPath = requireProjectYamlPath();\n      const sources = readProjectSources(yamlPath);\n      if (opts.json) return console.log(JSON.stringify(sources, null, 2));\n      if (sources.length === 0) {\n        logInfo(\"No sources in skaile.yaml. Run `skaile source add <git-url>` to register one.\");\n        return;\n      }\n      console.log();\n      console.log(S.heading(\"  Sources\"));\n      for (const s of sources) {\n        const slug = sourceLabel(s, sources);\n        const cached = existsSync(sourceClonePath(sourceCacheKey(s.url)))\n          ? \"\"\n          : S.warn(\" (not cached)\");\n        console.log(`  ${S.cmd(slug.padEnd(24))}  ${S.dim(s.url)}${cached}`);\n      }\n      console.log(`\\n  ${S.dim(`${sources.length} source(s)`)}\\n`);\n    });\n\n  // ── source show ─────────────────────────────────────────────────────────\n  cmd\n    .command(\"show <name-or-url>\")\n    .description(\"Show details for a source (matched by URL or derived slug)\")\n    .action(async (key: string) => {\n      const yamlPath = requireProjectYamlPath();\n      const all = readProjectSources(yamlPath);\n      const resolved = resolveSource(all, key);\n      if (resolved.kind === \"none\") {\n        logErr(`No source matching \"${key}\" in ${yamlPath}.`);\n        process.exit(1);\n      }\n      if (resolved.kind === \"ambiguous\") exitAmbiguousSource(key, resolved.entries);\n      const entry = resolved.entry;\n      const slug = sourceLabel(entry, all);\n      const clonePath = sourceClonePath(sourceCacheKey(entry.url));\n      console.log(\n        JSON.stringify(\n          {\n            ...entry,\n            slug,\n            clonePath,\n            cached: existsSync(clonePath),\n          },\n          null,\n          2,\n        ),\n      );\n    });\n\n  // ── source remove ───────────────────────────────────────────────────────\n  cmd\n    .command(\"remove <name-or-url>\")\n    .description(\"Remove a source from this project's skaile.yaml (matched by URL or slug)\")\n    .option(\n      \"--purge\",\n      `Also delete the cached clone from ${path.join(globalCacheRoot(), \"sources\")}${path.sep}`,\n      false,\n    )\n    .action(async (key: string, opts: { purge: boolean }) => {\n      const yamlPath = requireProjectYamlPath();\n      const editor = WorkspaceYamlEditor.load(yamlPath);\n      // Resolve to the stored URL (entries are keyed by url in the editor).\n      const all = editor.getSources();\n      const resolved = resolveSource(all, key);\n      if (resolved.kind === \"none\") {\n        logErr(`No source matching \"${key}\" in ${yamlPath}.`);\n        process.exit(1);\n      }\n      if (resolved.kind === \"ambiguous\") exitAmbiguousSource(key, resolved.entries);\n      const match = resolved.entry;\n      const slug = sourceLabel(match, all);\n      editor.removeSource(match.url);\n      editor.save();\n      await dropManifestCache(match.url, opts.purge);\n      logOk(\n        opts.purge\n          ? `Removed source \"${slug}\" and purged its clone.`\n          : `Removed source \"${slug}\" from skaile.yaml (clone left in ${path.join(globalCacheRoot(), \"sources\")} — pass --purge to remove it, or run \\`skaile cache clean\\`).`,\n      );\n    });\n\n  // ── source sync ─────────────────────────────────────────────────────────\n  cmd\n    .command(\"sync [name]\")\n    .description(\"Pull upstream changes and refresh the manifest cache\")\n    .option(\"--dev\", \"Also index dev-only assets under each source's dev_paths\", false)\n    .option(\"--all\", \"Sync every source without prompting\", false)\n    .action(async (key: string | undefined, opts: { dev?: boolean; all?: boolean }) => {\n      const yamlPath = requireProjectYamlPath();\n      const sources = readProjectSources(yamlPath);\n      if (sources.length === 0) {\n        logInfo(\"No sources in skaile.yaml.\");\n        return;\n      }\n\n      let targets: SourceEntry[];\n      if (key) {\n        targets = sources.filter((s) => sourceMatchesKey(s, key));\n        if (targets.length === 0) {\n          logInfo(`No source matching \"${key}\".`);\n          return;\n        }\n      } else if (opts.all || sources.length === 1 || !process.stdin.isTTY) {\n        // --all, a single source, or a non-interactive shell: sync everything.\n        targets = sources;\n      } else {\n        const selected = await p.multiselect({\n          message: \"Select sources to sync\",\n          options: sources.map((s) => ({\n            value: s.url,\n            label: sourceShortName(s.url),\n            hint: s.url,\n          })),\n          required: true,\n        });\n        if (p.isCancel(selected)) {\n          p.cancel(\"Cancelled.\");\n          return;\n        }\n        const picked = new Set(selected as string[]);\n        targets = sources.filter((s) => picked.has(s.url));\n      }\n      for (const entry of targets) {\n        const slug = sourceLabel(entry, sources);\n        const dest = sourceClonePath(sourceCacheKey(entry.url));\n        if (!existsSync(dest)) {\n          ensureClone(entry);\n          logOk(`${slug}: cloned to ${dest}.`);\n        } else {\n          const pull = pullSourceClone(dest, entry);\n          if (!pull.ok) {\n            logErr(`${slug}: ${pull.error}`);\n            process.exitCode = 1;\n            continue;\n          }\n        }\n        const result = await refreshManifestCache(entry, opts.dev);\n        const failed = indexingHadFailures(result);\n        const indexedMsg = `${slug}: indexed ${result.assetsUpdated} of ${result.assetsFound} asset(s).`;\n        if (failed) {\n          logWarn(indexedMsg);\n          process.exitCode = 1;\n        } else {\n          logOk(indexedMsg);\n        }\n        for (const err of result.errors) logWarn(`${slug}: ${err}`);\n        for (const advisory of result.advisories) logInfo(`${slug}: ${advisory}`);\n        const legacyHint = legacySourceConfigHint(dest);\n        if (legacyHint) logWarn(`${slug}: ${legacyHint}`);\n      }\n    });\n\n  // ── source patch / propose (stubs) ──────────────────────────────────────\n  cmd\n    .command(\"patch <ref>\")\n    .description(\"Extract an asset for editing against the source\")\n    .action((_ref: string) => {\n      logErr(\n        \"`skaile source patch` is scaffolded but not yet wired. \" +\n          \"The patch flow lands in a follow-up PR.\",\n      );\n      process.exit(2);\n    });\n\n  cmd\n    .command(\"propose <ref>\")\n    .description(\"Open a PR with the patch against the source upstream\")\n    .action((_ref: string) => {\n      logErr(\n        \"`skaile source propose` is scaffolded but not yet wired. \" +\n          \"The propose flow lands in a follow-up PR.\",\n      );\n      process.exit(2);\n    });\n\n  // ── source manifest * ───────────────────────────────────────────────────\n  addSourceManifestCommands(cmd);\n\n  return cmd;\n}\n"]}