@skaile/workspaces 5.10.0 → 5.12.0

package/dist/chunk-NWDSLXOX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../bridge/src/codex/native-policy.ts","../bridge/src/codex/credentials.ts","../bridge/src/codex/instance-state.ts"],"names":["invalid","within","relative","isAbsolute","directory","lstatSync","realpathSync","source"],"mappings":";;;;;;;;AAGA,IAAM,OAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE,IAAM,MAAA,GAAS,CAAC,KAAA,EAAe,MAAA,KAAmB;AAChD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,EAAQ,KAAK,CAAA;AAClC,EAAA,OAAO,GAAA,KAAQ,EAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,IAAK,GAAA,KAAQ,IAAA,IAAQ,CAAC,UAAA,CAAW,GAAG,CAAA;AACjF,CAAA;AACA,IAAM,aAAa,CAAC,IAAA,KAClB,CAAC,GAAG,IAAI,EAAE,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA,IAAM,UAAU,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC/F,IAAM,SAAA,GAAY,CAAC,IAAA,KAAiB;AAClC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,IAAK,WAAW,IAAI,CAAA,QAAS,OAAA,EAAQ;AACzD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,WAAA,EAAY,IAAK,KAAK,cAAA,EAAe,QAAS,OAAA,EAAQ;AAChE,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B,CAAA;AAGO,SAAS,oBAAoB,KAAA,EAKjC;AACD,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,SAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,SAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA;AACzD,EAAA,IACE,OAAO,GAAA,EAAK,WAAW,KACvB,MAAA,CAAO,WAAA,EAAa,GAAG,CAAA,IACvB,CAAC,OAAO,gBAAA,EAAkB,WAAW,KACrC,gBAAA,KAAqB,WAAA,IACpB,MAAM,WAAA,KAAgB,WAAA,IAAe,MAAM,WAAA,KAAgB,iBAAA;AAE5D,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,IAAA,GAAO,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,IAAA,GAAO,EAAA,IAAU,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,GAAA,KAAQ,CAAA,IAAK,IAAA,CAAK,GAAA,KAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,CAAC,GAAG,GAAG,KAAA,CAAM,WAAA,KAAgB,oBAAoB,OAAA,GAAU,MAAA;AAAA,IAC3D,CAAC,WAAW,GAAG;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,mBAAA,EAAqB,SAAA;AAAA,IACrB,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAAA,IACtD,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,MACzB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,QACrB,OAAA,EAAS,YAAA;AAAA,QACT,UAAA;AAAA,QACA,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,OAAO;AAAA,OAC1C;AAAA,KACF;AAAA,GACF,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,CAAA,qDAAA,EAAwD,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAC9F,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA,CAC7E,IAAA,CAAK,IAAI,CAAC,CAAA,qCAAA,CAAA;AACb,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,MACrB,IAAA;AAAA,MACA,+BAAA;AAAA,MACA,IAAA;AAAA,MACA,oCAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAe,OAAO,CAAA;AAAA,KACvB;AAAA,GACF,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,EAAE,GAAA,EAAK,aAAa,QAAA,EAAU,KAAA,CAAM,WAAA,KAAgB,iBAAA,EAAmB,CAAA;AAC5F,EAAA,OAAO,MAAA;AACT;AAIA,IAAM,QAAA,uBAAe,OAAA,EAAyB;AAG9C,IAAM,MAAA,uBAAa,OAAA,EAAqE;AAGjF,SAAS,4BAAA,CACd,MAAA,EACA,QAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IACE,CAAC,OAAA,IACD,MAAA,CAAO,OAAA,IACP,CAAC,OAAO,QAAQ,CAAA,IAChB,CAAC,MAAA,CAAO,SAAS,MAAM,CAAA,IACvB,OAAO,QAAA,CAAS,OAAO,EAAA,KAAO,QAAA,IAC9B,CAAC,QAAA,CAAS,OAAO,EAAA,IACjB,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,OACzB,CAAC,MAAA,CAAO,QAAA,CAAS,uBAAuB,KACxC,QAAA,CAAS,uBAAA,CAAwB,OAAO,SAAA,IACxC,QAAA,CAAS,wBAAwB,OAAA,KAAY,YAAA;AAE7C,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC9B,EAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,UAAU,QAAA,CAAS,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAAA,CACd,QACA,QAAA,EACgC;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,WAAW,CAAC,OAAA,CAAQ,OAAO,OAAA,IAAW,OAAA,CAAQ,aAAa,QAAQ,CAAA;AACpF;AAGO,SAAS,wBAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IACE,CAAC,OAAA,IACD,OAAA,CAAQ,OAAO,OAAA,IACf,CAAC,WAAW,IAAI,CAAA,IAChB,WAAW,IAAI,CAAA,IACd,WAAW,MAAA,IAAU,MAAA,KAAW,WAChC,MAAA,KAAW,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAEhC,IAAA,OAAO,KAAA;AACT,EAAA,IAAI;AACF,IAAA,IAAI,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC3B,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,IAAI;AACF,QAAA,SAAA,CAAU,QAAQ,CAAA;AAClB,QAAA;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,QAAQ,CAAA,KAAM,QAAA;AAC9E,UAAA,OAAO,KAAA;AACT,QAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAC3D,QAAA,QAAA,GAAW,QAAQ,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AACA,IAAA,MAAM,YAAY,OAAA,CAAQ,YAAA,CAAa,QAAQ,CAAA,EAAG,GAAG,MAAM,CAAA;AAC3D,IAAA,OAAO,MAAA,CAAO,WAAW,OAAA,CAAQ,GAAG,KAAK,CAAC,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAAA,EACjF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;ACzIA,IAAM,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA;AAC7C,IAAM,YAAc,CAAA,CAAA,GAAA,CAAI,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AACjD,IAAM,MAAA,GAAS;AAAA,EACb,QAAA,EAAU,UAAA;AAAA,EACV,mBAAqB,CAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACvD,QAAA,EAAU;AACZ,CAAA;AACA,IAAM,eAAiB,CAAA,CAAA,YAAA,CAAa;AAAA,EAClC,GAAG,MAAA;AAAA,EACH,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,EACpC,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA;AAAA,EACxC,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,EACrC,SAAA,EAAW;AACb,CAAC,CAAA;AACD,IAAM,QAAA,GAAa,qBAAmB,MAAA,EAAQ;AAAA,EAC5C,YAAA;AAAA,EACE,CAAA,CAAA,YAAA,CAAa;AAAA,IACb,GAAG,MAAA;AAAA,IACH,IAAA,EAAQ,UAAQ,gBAAgB,CAAA;AAAA,IAChC,QAAU,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK;AAAA,GACpC;AACH,CAAC,CAAA;AAGM,SAAS,oBAAA,CAAqB,KAAA,EAAgB,GAAA,GAAM,IAAA,CAAK,KAAI,EAA4B;AAC9F,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,SAAA,CAAU,KAAK,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACpE,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,QAAQ,CAAA;AAE/C,EAAA,IACE,WAAW,GAAA,GAAM,GAAA,IAChB,UAAA,CAAW,IAAA,KAAS,yBAClB,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,KAAK,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,QAAA,CAAA;AAElF,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC5D,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,sBAAA,CACd,OACA,MAAA,EAC+B;AAC/B,EAAA,MAAM,SACH,CAAA,CAAA,YAAA,CAAa;AAAA,IACZ,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,IACpC,QAAA,EAAU,UAAA;AAAA,IACV,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,QAAU,CAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAC;AAAA,GACnD,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IACE,CAAC,MAAA,CAAO,OAAA,IACR,MAAA,CAAO,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAChC,MAAA,CAAO,IAAA,CAAK,iBAAA,KAAsB,MAAA,CAAO,iBAAA;AAEzC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAGO,SAAS,wBACd,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACiB;AAChC,EAAA,MAAM,MAAA,GACH,qBAAmB,IAAA,EAAM;AAAA,IACtB,CAAA,CAAA,YAAA,CAAa,EAAE,EAAA,EAAM,CAAA,CAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,UAAA,EAAY,cAAc,CAAA;AAAA,IAC9D,CAAA,CAAA,YAAA,CAAa;AAAA,MACb,EAAA,EAAM,UAAQ,KAAK,CAAA;AAAA,MACnB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,kBAAkB,SAAA,EAAW,gBAAA,EAAkB,eAAe,CAAC,CAAA;AAAA,MAC7E,SAAW,CAAA,CAAA,MAAA;AAAO,KACnB;AAAA,GACF,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACxE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAO,EAAE,GAAG,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,qCAAA,EAAsC;AAC7F,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,MAAA,CAAO,IAAA,CAAK,YAAY,GAAG,CAAA;AACnE,EAAA,IACE,UAAA,CAAW,IAAA,KAAS,oBAAA,IACpB,UAAA,CAAW,QAAA,KAAa,MAAA,CAAO,QAAA,IAC/B,UAAA,CAAW,gBAAA,KAAqB,MAAA,CAAO,gBAAA,IACvC,UAAA,CAAW,oBAAoB,MAAA,CAAO,iBAAA;AAEtC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAW;AAChC;AA0BO,SAAS,8BACd,QAAA,EACoB;AACpB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,IAAI,QAAQ,MAAA,GAAS,CAAA;AACnB,IAAA,OAAO,CAAA,iBAAA,EAAoB,QAAQ,MAAM,CAAA,0CAAA,CAAA;AAC3C,EAAA,MAAM,CAAC,EAAA,EAAI,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG,OAAO,UAAU,EAAE,CAAA,aAAA,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO,OAAO,UAAU,EAAE,CAAA,QAAA,EAAW,MAAM,IAAI,CAAA,0BAAA,CAAA;AAClE,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,IAAI,OAAA,KAAY,wBAAA;AACd,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,oBAAA,EAAuB,OAAA,IAAW,MAAM,CAAA,mDAAA,CAAA;AAC7D,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,YAAY,IAAA,KAAS,OAAA;AACvB,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,UAAA,EAAY,QAAQ,MAAM,CAAA,4EAAA,CAAA;AAC/D,EAAA,MAAM,MAAM,UAAA,CAAW,GAAA,GAAM,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA;AAClE,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,IAAA,KAAS,UAAA;AACvB,IAAA,OAAO,UAAU,EAAE,CAAA,sGAAA,CAAA;AACrB,EAAA,OAAO,MAAA;AACT;AClIA,IAAMA,QAAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAMC,OAAAA,GAAS,CAAC,IAAA,EAAc,IAAA,KAAiB;AAC7C,EAAA,MAAM,GAAA,GAAMC,QAAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAC/B,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAACC,UAAAA,CAAW,GAAG,CAAA;AAChE,CAAA;AACA,SAASC,WAAU,IAAA,EAAoB;AACrC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,YAAa,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtD,EAAA,MAAM,IAAA,GAAOC,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,EAAA,EAAO,MAAML,QAAAA,EAAQ;AACvF;AACA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACxD,EAAA,MAAM,IAAA,GAAOK,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,KAAA,EAAO,MAAML,QAAAA,EAAQ;AAChF,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;AAGO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,EACA,UAAA,EACA;AACA,EAAA,IAAI,CAACG,UAAAA,CAAW,OAAA,CAAQ,gBAAgB,CAAA,IAAK,CAACA,UAAAA,CAAW,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA;AAC9E,IAAA,MAAMH,QAAAA,EAAQ;AAChB,EAAAI,UAAAA,CAAU,QAAQ,gBAAgB,CAAA;AAClC,EAAA,MAAM,IAAA,GAAOE,YAAAA,CAAa,OAAA,CAAQ,gBAAgB,CAAA;AAClD,EAAA,MAAM,GAAA,GAAMA,YAAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACnC,EAAA,IAAIL,OAAAA,CAAO,MAAM,GAAG,CAAA,IAAKA,QAAO,GAAA,EAAK,IAAI,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AAC1D,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,SAAS,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,IAAK,CAACK,SAAAA,CAAU,SAAS,CAAA,CAAE,MAAA,EAAO,EAAG,MAAML,QAAAA,EAAQ;AAC3E,EAAA,MAAM,KAAA,GAAQ,WAAW,SAAS,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,KAAK,wCAAwC,CAAA;AACnD,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAE1B,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,aAAA,CAAc,MAAM,QAAA,EAAU,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,EAC3D,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,EAAM;AACZ,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC9B,CAAA,SAAE;AACA,MAAA,KAAA,CAAM,KAAA,EAAM;AAAA,IACd;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAC5B,MAAA;AAAA,MACC,KAAK,SAAA,CAAU;AAAA,QACb,MAAA,EAAQ,qBAAA;AAAA,QACR,SAAS,MAAA,CAAO,SAAA;AAAA,QAChB,QAAQ,UAAA,CAAW,QAAA;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,OAAA,EAAS,UAAA,CAAW,IAAA,KAAS,oBAAA,GAAuB,WAAW,gBAAA,GAAmB;AAAA,OACnF;AAAA,KACH,CACC,OAAO,KAAK,CAAA;AACf,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAClD,IAAAI,WAAU,KAAK,CAAA;AACf,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACjC,IAAAA,WAAU,SAAS,CAAA;AACnB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,kBAAA,EAAoB,aAAa,CAAA;AACnD,MAAA,MAAA,CAAO,KAAK,SAAA,EAAW,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,cAAc,CAAA;AAClD,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AAC9F,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,WAAA,EAAa,IAAI,CAAA;AAC3C,MAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,QAAA,IAAI,OAAA;AACJ,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,QACxC;AACA,QAAA,IACE,CAAC,OAAA,IACD,OAAO,OAAA,KAAY,QAAA,IACnB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IACrB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAAM,qBAAA,IACzC,OAAA,CAAoC,MAAA,KAAW,yBAAA,IAC/C,OAAA,CAAoC,GAAA,KAAQ,GAAA,IAC5C,OAAA,CAAoC,QAAA,KAAa,MAAA,CAAO,eAAA;AAEzD,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,MAC1C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,MAAM,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AACvF,IAAAA,WAAU,IAAI,CAAA;AACd,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,EAAGA,UAAAA,CAAU,IAAA,CAAK,IAAA,EAAM,MAAM,CAAC,CAAA;AAErF,IAAA,IAAI,CAAC,WAAA,EAAa,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAChF,MAAA,MAAMJ,QAAAA,EAAQ;AAChB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,EAAW,iBAAiB,CAAA;AACzD,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA;AAAA,QAAI,CAAC,SACvC,WAAA,CAAY,IAAA,EAAM,OAAO,IAAI,CAAA,CAAE,SAAS,MAAM;AAAA,OAChD;AAAA,MACA,GAAI,MAAA,CAAO,YAAA,GAAe,CAAC,MAAA,CAAO,YAAY,IAAI;AAAC,KACrD,CAAE,KAAK,aAAa,CAAA;AACpB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAW,kBAAkB,CAAA;AACpD,IAAA,aAAA,CAAc,WAAW,YAAA,EAAc,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClE,IAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAClC,IAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,IAAmB,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACtF,IAAA,IAAI,QAAQ,eAAA,EAAiB;AAC3B,MAAA,MAAM,MAAA,GAASM,YAAAA,CAAa,OAAA,CAAQ,eAAe,CAAA;AACnD,MAAA,IAAIL,OAAAA,CAAO,QAAQ,MAAM,CAAA,IAAKA,QAAO,MAAA,EAAQ,MAAM,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AACpE,MAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,MAAM,IAAA,GAAO,CAACO,OAAAA,EAAgB,WAAA,KAAwB;AACpD,QAAA,IAAI,EAAE,OAAA,GAAU,IAAA,EAAM,MAAMP,QAAAA,EAAQ;AACpC,QAAA,IAAIK,UAAUE,OAAM,CAAA,CAAE,cAAA,EAAe,QAASP,QAAAA,EAAQ;AACtD,QAAA,SAAA,CAAU,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtC,QAAA,KAAA,MAAW,SAAS,WAAA,CAAYO,OAAAA,EAAQ,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,UAAA,MAAM,GAAA,GAAM,IAAA,CAAKA,OAAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AACxC,UAAA,IAAI,KAAA,CAAM,cAAA,EAAe,EAAG,MAAMP,QAAAA,EAAQ;AAC1C,UAAA,IAAI,KAAA,CAAM,WAAA,EAAY,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,eACjC;AACH,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,IAAA,GAAO,IAAI,CAAA;AAC5C,YAAA,KAAA,IAAS,OAAA,CAAQ,UAAA;AACjB,YAAA,IAAI,EAAE,QAAQ,GAAA,IAAO,KAAA,GAAQ,IAAI,IAAA,GAAO,IAAA,QAAYA,QAAAA,EAAQ;AAC5D,YAAA,aAAA,CAAc,KAAK,OAAA,EAAS,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,iBAAiB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAAqB;AACvC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,IAAA,QAAYA,QAAAA,EAAQ;AACvD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAC1C,MAAA,aAAA,CAAc,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,yBAAA,EAA2B,GAAA,EAAK,QAAA,EAAU,CAAA,EAAG;AAAA,QACxF,IAAA,EAAM,GAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,UAAA,CAAW,MAAM,WAAW,CAAA;AAAA,IAC9B,CAAA;AACA,IAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,KAAiB;AAC5C,MAAA,aAAA,CAAc,SAAA,EAAW,GAAG,YAAY;;AAAA,EAAO,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClF,MAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AAAA,IACvC,CAAA;AACA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,EAAQ;AACR,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAGO,SAAS,wBAAA,CACd,OACA,IAAA,EACwB;AACxB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IACE,CAAC,KAAA,IACD,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,OAAO,UAAU,QAAQ,CAAA;AAE3F,IAAA,MAAMA,QAAAA,EAAQ;AAChB,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,IAAA;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,eAAA,EAAiB,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAAA,IACpC,cAAA,EAAgB,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAAA,IAClC,aAAA,EAAe,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,KAAK;AAAA,GAC1B;AACF","file":"chunk-NWDSLXOX.js","sourcesContent":["import { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst record = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst within = (child: string, parent: string) => {\n  const rel = relative(parent, child);\n  return rel === \"\" || (!rel.startsWith(\"../\") && rel !== \"..\" && !isAbsolute(rel));\n};\nconst hasControl = (path: string) =>\n  [...path].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);\nconst directory = (path: string) => {\n  if (!isAbsolute(path) || hasControl(path)) throw invalid();\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink()) throw invalid();\n  return realpathSync(path);\n};\n\n/** Fixed pinned-native policy. No caller-supplied profile or sandbox override is admitted. */\nexport function prepareNativePolicy(input: {\n  cwd: string;\n  privateRoot: string;\n  privateDirectory: string;\n  sandboxMode: \"read-only\" | \"workspace-write\";\n}) {\n  const cwd = directory(input.cwd);\n  const privateRoot = directory(input.privateRoot);\n  const privateDirectory = directory(input.privateDirectory);\n  if (\n    within(cwd, privateRoot) ||\n    within(privateRoot, cwd) ||\n    !within(privateDirectory, privateRoot) ||\n    privateDirectory === privateRoot ||\n    (input.sandboxMode !== \"read-only\" && input.sandboxMode !== \"workspace-write\")\n  )\n    throw invalid();\n  const stat = lstatSync(privateRoot);\n  if (stat.mode & 0o077 || (process.getuid && stat.uid !== 0 && stat.uid !== process.getuid()))\n    throw invalid();\n  const filesystem = Object.freeze({\n    [cwd]: input.sandboxMode === \"workspace-write\" ? \"write\" : \"read\",\n    [privateRoot]: \"deny\",\n  });\n  const config = Object.freeze({\n    default_permissions: \"managed\",\n    features: Object.freeze({ use_legacy_landlock: false }),\n    permissions: Object.freeze({\n      managed: Object.freeze({\n        extends: \":read-only\",\n        filesystem,\n        network: Object.freeze({ enabled: false }),\n      }),\n    }),\n  });\n  // Native -c parses TOML, not JSON objects. Quote paths as TOML basic strings.\n  const profile = `{ managed = { extends = \":read-only\", filesystem = { ${Object.entries(filesystem)\n    .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n    .join(\", \")} }, network = { enabled = false } } }`;\n  const policy = Object.freeze({\n    config,\n    cliArgs: Object.freeze([\n      \"-c\",\n      'default_permissions=\"managed\"',\n      \"-c\",\n      \"features.use_legacy_landlock=false\",\n      \"-c\",\n      `permissions=${profile}`,\n    ]),\n  });\n  prepared.set(policy, { cwd, privateRoot, writable: input.sandboxMode === \"workspace-write\" });\n  return policy;\n}\n\ntype PreparedNativePolicy = ReturnType<typeof prepareNativePolicy>;\ntype Binding = { cwd: string; privateRoot: string; writable: boolean };\nconst prepared = new WeakMap<object, Binding>();\ndeclare const admissionBrand: unique symbol;\nexport type NativeApprovalPolicy = { readonly [admissionBrand]: true };\nconst active = new WeakMap<object, Binding & { threadId: string; signal: AbortSignal }>();\n\n/** Confirms composition and native selection, not live OS isolation (G1/G2 remain required). */\nexport function activateNativeApprovalPolicy(\n  policy: PreparedNativePolicy,\n  response: unknown,\n  signal: AbortSignal,\n): NativeApprovalPolicy {\n  const binding = prepared.get(policy);\n  if (\n    !binding ||\n    signal.aborted ||\n    !record(response) ||\n    !record(response.thread) ||\n    typeof response.thread.id !== \"string\" ||\n    !response.thread.id ||\n    response.cwd !== binding.cwd ||\n    !record(response.activePermissionProfile) ||\n    response.activePermissionProfile.id !== \"managed\" ||\n    response.activePermissionProfile.extends !== \":read-only\"\n  )\n    throw invalid();\n  const token = Object.freeze({}) as NativeApprovalPolicy;\n  active.set(token, { ...binding, threadId: response.thread.id, signal });\n  return token;\n}\n\nexport function isNativeApprovalPolicyActive(\n  policy: unknown,\n  threadId: string,\n): policy is NativeApprovalPolicy {\n  if (!record(policy)) return false;\n  const binding = active.get(policy);\n  return Boolean(binding && !binding.signal.aborted && binding.threadId === threadId);\n}\n\n/** Resolve existing ancestors too, so new files cannot escape via a project symlink. */\nexport function allowsNativeApprovalPath(\n  policy: NativeApprovalPolicy | undefined,\n  path: string,\n  access: \"read\" | \"write\",\n): boolean {\n  if (!policy) return false;\n  const binding = active.get(policy);\n  if (\n    !binding ||\n    binding.signal.aborted ||\n    !isAbsolute(path) ||\n    hasControl(path) ||\n    (access !== \"read\" && access !== \"write\") ||\n    (access === \"write\" && !binding.writable)\n  )\n    return false;\n  try {\n    let existing = resolve(path);\n    const suffix: string[] = [];\n    while (true) {\n      try {\n        lstatSync(existing);\n        break;\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== \"ENOENT\" || dirname(existing) === existing)\n          return false;\n        suffix.unshift(existing.slice(dirname(existing).length + 1));\n        existing = dirname(existing);\n      }\n    }\n    const canonical = resolve(realpathSync(existing), ...suffix);\n    return within(canonical, binding.cwd) && !within(canonical, binding.privateRoot);\n  } catch {\n    return false;\n  }\n}\n","import {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseCredentialRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type {\n  CodexCredentialDelivery,\n  CodexSubscriptionRefreshInput,\n  CodexSubscriptionRefreshResult,\n} from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nconst identifier = z.string().min(1).max(4096);\nconst timestamp = z.iso.datetime({ offset: true });\nconst common = {\n  configId: identifier,\n  credentialVersion: z.number().int().nonnegative().safe(),\n  mintedAt: timestamp,\n};\nconst subscription = z.strictObject({\n  ...common,\n  kind: z.literal(\"codex-subscription\"),\n  accessToken: z.string().min(1).max(65536),\n  chatgptAccountId: identifier,\n  chatgptPlanType: identifier.optional(),\n  expiresAt: timestamp,\n});\nconst delivery = z.discriminatedUnion(\"kind\", [\n  subscription,\n  z.strictObject({\n    ...common,\n    kind: z.literal(\"openai-api-key\"),\n    apiKey: z.string().min(1).max(65536),\n  }),\n]);\n\n/** Validate credential shape and provenance without including input values in errors. */\nexport function parseCodexCredential(value: unknown, now = Date.now()): CodexCredentialDelivery {\n  const parsed = delivery.safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI credential\");\n  const credential = parsed.data;\n  const mintedAt = Date.parse(credential.mintedAt);\n  // Issuer and runtime clocks may differ slightly; expiry remains strictly unexpired.\n  if (\n    mintedAt > now + 60_000 ||\n    (credential.kind === \"codex-subscription\" &&\n      (Date.parse(credential.expiresAt) <= now || Date.parse(credential.expiresAt) <= mintedAt))\n  )\n    throw new Error(\"Invalid managed AI credential timestamps\");\n  return credential;\n}\n\n/** Validate runtime-only refresh input against the authenticated session's pinned delivery. */\nexport function parseCodexRefreshInput(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n): CodexSubscriptionRefreshInput {\n  const parsed = z\n    .strictObject({\n      kind: z.literal(\"codex-subscription\"),\n      configId: identifier,\n      credentialVersion: common.credentialVersion,\n      reason: z.enum([\"initial\", \"refresh\", \"retry-401\"]),\n    })\n    .safeParse(value);\n  if (\n    !parsed.success ||\n    parsed.data.configId !== pinned.configId ||\n    parsed.data.credentialVersion !== pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return parsed.data;\n}\n\n/** Accept refreshed subscription credentials only within the existing config/account binding. */\nexport function parseCodexRefreshResult(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n  now = Date.now(),\n): CodexSubscriptionRefreshResult {\n  const parsed = z\n    .discriminatedUnion(\"ok\", [\n      z.strictObject({ ok: z.literal(true), credential: subscription }),\n      z.strictObject({\n        ok: z.literal(false),\n        code: z.enum([\"not-configured\", \"revoked\", \"provider-error\", \"backend-error\"]),\n        message: z.string(),\n      }),\n    ])\n    .safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI refresh result\");\n  if (!parsed.data.ok) return { ...parsed.data, message: \"Managed subscription refresh failed\" };\n  const credential = parseCodexCredential(parsed.data.credential, now);\n  if (\n    credential.kind !== \"codex-subscription\" ||\n    credential.configId !== pinned.configId ||\n    credential.chatgptAccountId !== pinned.chatgptAccountId ||\n    credential.credentialVersion < pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return { ok: true, credential };\n}\n\n/**\n * The AI provider registry a managed-codex session may carry (plan §2.2).\n *\n * Managed codex runs on a platform-minted, short-lived credential that the\n * host never writes to disk and never puts in the child environment. That\n * isolation is only meaningful if the session cannot *also* be told to talk\n * somewhere else, or to pick a credential up from the environment. Restated\n * on the registry, the admissible shape is exactly one enabled `llm` entry,\n * on codex's own OpenAI surface, whose credential is a platform-injected\n * `oauth` reference. A second entry, a different surface, or an `env:` /\n * `cmd:` / `keyring:` reference is an invalid AI profile.\n *\n * `surface` is read literally — no catalog-preset fallback. No preset\n * declares `openai-codex-responses`, so a preset-shaped entry reaching here\n * is a mis-provisioned session, not a terse one.\n *\n * An absent or empty registry is *not* a violation: nothing was configured,\n * and the credential the platform minted is the only one the session has.\n * Every configured entry is judged, whichever layer it came from — the\n * control-plane session layer, the user/workspace `providers.yml` files, or\n * a runtime override.\n *\n * @returns the reason the registry is inadmissible, or `undefined` when it is.\n */\nexport function managedCodexRegistryViolation(\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined,\n): string | undefined {\n  if (!registry) return undefined;\n  const entries = registryEntries(registry);\n  if (entries.length === 0) return undefined;\n  if (entries.length > 1)\n    return `registry carries ${entries.length} entries; managed codex admits exactly one`;\n  const [id, entry] = entries[0];\n  if (!isEntryEnabled(entry)) return `entry '${id}' is disabled`;\n  if (entry.kind !== \"llm\") return `entry '${id}' is a '${entry.kind}' endpoint, not an llm one`;\n  const surface = (entry as AIProviderLlmEntry).surface;\n  if (surface !== \"openai-codex-responses\")\n    return `entry '${id}' declares surface '${surface ?? \"none\"}'; managed codex admits only openai-codex-responses`;\n  const credential = entry.credential;\n  if (credential?.kind !== \"oauth\")\n    return `entry '${id}' carries a '${credential?.kind ?? \"none\"}' credential; managed codex admits only a platform-injected oauth credential`;\n  const ref = credential.ref ? parseCredentialRef(credential.ref) : undefined;\n  if (!ref || ref.form !== \"platform\")\n    return `entry '${id}' resolves its credential outside the control plane; managed codex admits only a 'platform:' reference`;\n  return undefined;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  chmodSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { isAbsolute, join, relative } from \"node:path\";\nimport { openSqlite } from \"../../../core/src/logging/sinks/sqlite-runtime.js\";\nimport type { CodexCredentialDelivery } from \"@skaile/workspaces/types\";\nimport type { AgentConfig, CodexManagedRuntimeOptions } from \"../types.js\";\n\nimport { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from \"./native-state.js\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst within = (path: string, root: string) => {\n  const rel = relative(root, path);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n};\nfunction directory(path: string): void {\n  if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 0o077) throw invalid();\n}\nfunction readRegular(path: string, limit: number): Buffer {\n  const stat = lstatSync(path);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw invalid();\n  return readFileSync(path);\n}\n\n/** Session-owned state lock and account-bound native resume metadata; never stores credentials. */\nexport function prepareCodexInstance(\n  config: AgentConfig,\n  options: CodexManagedRuntimeOptions,\n  credential: CodexCredentialDelivery,\n) {\n  if (!isAbsolute(options.privateDirectory) || !isAbsolute(config.cwd) || !config.sessionId)\n    throw invalid();\n  directory(options.privateDirectory);\n  const root = realpathSync(options.privateDirectory);\n  const cwd = realpathSync(config.cwd);\n  if (within(root, cwd) || within(cwd, root)) throw invalid();\n  const lock = join(root, \".active\");\n  const leasePath = join(root, \"lease.db\");\n  if (existsSync(leasePath) && !lstatSync(leasePath).isFile()) throw invalid();\n  const lease = openSqlite(leasePath);\n  try {\n    lease.exec(\"PRAGMA busy_timeout=0; BEGIN EXCLUSIVE\");\n    chmodSync(leasePath, 0o600);\n    // The OS releases the database lease on crashes; this marker never owns the lock.\n    rmSync(lock, { force: true });\n    writeFileSync(lock, \"active\", { flag: \"wx\", mode: 0o600 });\n  } catch (error) {\n    lease.close();\n    throw error;\n  }\n  let released = false;\n  const release = () => {\n    if (released) return;\n    released = true;\n    try {\n      rmSync(lock, { force: true });\n    } finally {\n      lease.close();\n    }\n  };\n  try {\n    const key = createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          driver: \"codex-app-server-v1\",\n          session: config.sessionId,\n          config: credential.configId,\n          kind: credential.kind,\n          account: credential.kind === \"codex-subscription\" ? credential.chatgptAccountId : null,\n        }),\n      )\n      .digest(\"hex\");\n    const slots = join(root, CODEX_NATIVE_STATE_FORMAT);\n    directory(slots);\n    const stateRoot = join(slots, key);\n    directory(stateRoot);\n    for (const name of [\"instructions.new\", \"binding.new\"])\n      rmSync(join(stateRoot, name), { force: true });\n    const bindingPath = join(stateRoot, \"binding.json\");\n    if (config.resumeSessionId && !existsSync(bindingPath)) throw new CodexNativeStateUnavailable();\n    if (existsSync(bindingPath)) {\n      // Filesystem authority failures (including symlinks) are fatal, not missing state.\n      const bytes = readRegular(bindingPath, 4096);\n      if (config.resumeSessionId) {\n        let binding: unknown;\n        try {\n          binding = JSON.parse(bytes.toString(\"utf8\"));\n        } catch {\n          throw new CodexNativeStateUnavailable();\n        }\n        if (\n          !binding ||\n          typeof binding !== \"object\" ||\n          Array.isArray(binding) ||\n          Object.keys(binding).sort().join(\",\") !== \"format,key,threadId\" ||\n          (binding as Record<string, unknown>).format !== CODEX_NATIVE_STATE_FORMAT ||\n          (binding as Record<string, unknown>).key !== key ||\n          (binding as Record<string, unknown>).threadId !== config.resumeSessionId\n        )\n          throw new CodexNativeStateUnavailable();\n      }\n    }\n    const home = join(stateRoot, \"home\");\n    if (config.resumeSessionId && !existsSync(home)) throw new CodexNativeStateUnavailable();\n    directory(home);\n    for (const subdir of [\"config\", \"cache\", \"data\", \"tmp\"]) directory(join(home, subdir));\n    // Auth persistence is forbidden even if a previous external process left a carrier here.\n    if ([\"auth.json\", \".credentials.json\"].some((name) => existsSync(join(home, name))))\n      throw invalid();\n    const instructionFile = join(stateRoot, \"instructions.md\");\n    const instructions = [\n      ...(options.instructionFiles ?? []).map((path) =>\n        readRegular(path, 1024 * 1024).toString(\"utf8\"),\n      ),\n      ...(config.systemPrompt ? [config.systemPrompt] : []),\n    ].join(\"\\n\\n---\\n\\n\");\n    const temporary = join(stateRoot, \"instructions.new\");\n    writeFileSync(temporary, instructions, { mode: 0o600, flag: \"wx\" });\n    renameSync(temporary, instructionFile);\n    const target = join(home, \"skills\");\n    if (!options.skillsDirectory && existsSync(target)) rmSync(target, { recursive: true });\n    if (options.skillsDirectory) {\n      const source = realpathSync(options.skillsDirectory);\n      if (within(target, source) || within(source, target)) throw invalid();\n      if (existsSync(target)) rmSync(target, { recursive: true });\n      let files = 0;\n      let entries = 0;\n      let bytes = 0;\n      const copy = (source: string, destination: string) => {\n        if (++entries > 1024) throw invalid();\n        if (lstatSync(source).isSymbolicLink()) throw invalid();\n        mkdirSync(destination, { mode: 0o700 });\n        for (const entry of readdirSync(source, { withFileTypes: true })) {\n          const src = join(source, entry.name);\n          const dst = join(destination, entry.name);\n          if (entry.isSymbolicLink()) throw invalid();\n          if (entry.isDirectory()) copy(src, dst);\n          else {\n            const content = readRegular(src, 1024 * 1024);\n            bytes += content.byteLength;\n            if (++files > 512 || bytes > 8 * 1024 * 1024) throw invalid();\n            writeFileSync(dst, content, { mode: 0o600, flag: \"wx\" });\n          }\n        }\n      };\n      copy(options.skillsDirectory, target);\n    }\n    const bindThread = (threadId: string) => {\n      if (!threadId || threadId.length > 4096) throw invalid();\n      const next = join(stateRoot, \"binding.new\");\n      writeFileSync(next, JSON.stringify({ format: CODEX_NATIVE_STATE_FORMAT, key, threadId }), {\n        mode: 0o600,\n        flag: \"wx\",\n      });\n      renameSync(next, bindingPath);\n    };\n    const setToolInstructions = (text: string) => {\n      writeFileSync(temporary, `${instructions}\\n\\n${text}`, { mode: 0o600, flag: \"wx\" });\n      renameSync(temporary, instructionFile);\n    };\n    return {\n      root,\n      stateRoot,\n      cwd,\n      home,\n      instructionFile,\n      bindThread,\n      release,\n      setToolInstructions,\n    };\n  } catch (error) {\n    release();\n    throw error;\n  }\n}\n\n/** A replacement environment; managed auth never reads or mutates ambient process.env. */\nexport function codexInstanceEnvironment(\n  input: Record<string, string>,\n  home: string,\n): Record<string, string> {\n  const allowed = new Set([\n    \"PATH\",\n    \"LANG\",\n    \"LC_ALL\",\n    \"TZ\",\n    \"SSL_CERT_FILE\",\n    \"SSL_CERT_DIR\",\n    \"HTTPS_PROXY\",\n    \"HTTP_PROXY\",\n    \"NO_PROXY\",\n  ]);\n  if (\n    !input ||\n    Object.entries(input).some(([key, value]) => !allowed.has(key) || typeof value !== \"string\")\n  )\n    throw invalid();\n  return {\n    ...input,\n    HOME: home,\n    CODEX_HOME: home,\n    XDG_CONFIG_HOME: join(home, \"config\"),\n    XDG_CACHE_HOME: join(home, \"cache\"),\n    XDG_DATA_HOME: join(home, \"data\"),\n    TMPDIR: join(home, \"tmp\"),\n  };\n}\n"]}

package/dist/chunk-OBYKJB4U.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../transport/src/ws/client.ts"],"names":[],"mappings":";;;AAUA,IAAM,8BAAA,GAAiC,CAAA;AACvC,IAAM,yBAAA,GAA4B,GAAA;AAClC,IAAM,wBAAA,GAA2B,GAAA;AACjC,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,wBAAA,GAA2B,CAAA;AACjC,IAAM,0BAAA,GAA6B,GAAA;AA6DnC,IAAM,KAAA,GAAQ,OAAQ,UAAA,CAAiC,GAAA,KAAQ,WAAA;AAO/D,eAAe,aAAA,GAAwC;AACrD,EAAA,IAAI,OAAO,YAAY,WAAA,EAAa;AAClC,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,SAAA,GAAY,IAAA;AAClB,EAAA,MAAM,MAAO,MAAM;AAAA;AAAA;AAAA,IAAoD;AAAA,GAAA;AAIvE,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,OAAA;AAClC,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAC5E,EAAA,OAAO,IAAA;AACT;AAoBO,IAAM,2BAAN,MAA0D;AAAA,EACvD,EAAA,GAAuB,IAAA;AAAA,EACd,GAAA;AAAA,EACA,eAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EACA,gBAAA;AAAA,EACA,GAAA;AAAA,EACA,YAAA;AAAA,EACA,GAAA;AAAA;AAAA,EAET,SAAA,GAAkC,IAAA;AAAA,EAElC,cAAA,GAAwD,IAAA;AAAA,EACxD,iBAAA,GAAoB,CAAA;AAAA,EACpB,gBAAA,GAAmB,KAAA;AAAA,EAEV,eAAA,uBAAsB,GAAA,EAAiC;AAAA,EACvD,kBAAA,uBAAyB,GAAA,EAAgB;AAAA,EAE1D,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,MAAM,OAAA,CAAQ,GAAA;AACnB,IAAA,IAAA,CAAK,eAAA,GAAkB;AAAA,MACrB,WAAA,EAAa,OAAA,CAAQ,SAAA,EAAW,WAAA,IAAe,8BAAA;AAAA,MAC/C,MAAA,EAAQ,OAAA,CAAQ,SAAA,EAAW,MAAA,IAAU,yBAAA;AAAA,MACrC,KAAA,EAAO,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS;AAAA,KACrC;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC1C,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,cAAA,IAAkB,wBAAA;AAChD,IAAA,IAAA,CAAK,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,0BAAA;AACpD,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,KAAA,KAAU,MAAM;AAAA,IAAC,CAAA,CAAA;AACpC,IAAA,IAAA,CAAK,YAAA,GAAe,QAAQ,IAAA,GAAO,CAAC,wBAAwB,OAAA,CAAQ,IAAI,CAAC,CAAA,GAAI,EAAC;AAC9E,IAAA,IAAA,CAAK,MAAM,OAAA,CAAQ,GAAA;AAAA,EACrB;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAA,CAAK,gBAAA,GAAmB,KAAA;AACxB,IAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,IAAA,IAAI,IAAA,CAAK,GAAA,IAAO,CAAC,KAAA,IAAS,CAAC,KAAK,SAAA,EAAW,IAAA,CAAK,SAAA,GAAY,MAAM,aAAA,EAAc;AAChF,IAAA,OAAO,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,EAC5B;AAAA,EAEA,MAAM,UAAA,GAA4B;AAChC,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AACxB,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,IAAI,IAAA,CAAK,EAAA,CAAG,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AACzC,QAAA,IAAA,CAAK,EAAA,CAAG,KAAA,CAAM,GAAA,EAAM,mBAAmB,CAAA;AAAA,MACzC;AACA,MAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,KAAK,OAAA,EAA6B;AAChC,IAAA,IAAI,CAAC,IAAA,CAAK,EAAA,IAAM,KAAK,EAAA,CAAG,UAAA,KAAe,UAAU,IAAA,EAAM;AACrD,MAAA,IAAA,CAAK,IAAI,wCAAwC,CAAA;AACjD,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,EAAA,CAAG,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,EACtC;AAAA,EAEA,UAAU,OAAA,EAAkD;AAC1D,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,aAAa,OAAA,EAAiC;AAC5C,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAI,OAAO,CAAA;AACnC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,kBAAA,CAAmB,OAAO,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,EACF;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAA,CAAU,YAAY,KAAA,EAAsB;AAClD,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,MAAA,IAAA,CAAK,GAAA,CAAI,CAAA,0BAAA,EAA6B,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AAEhD,MAAA,MAAM,EAAA,GAAK,KAAK,YAAA,EAAa;AAC7B,MAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AAEV,MAAA,MAAM,QAAA,GAAW,EAAE,MAAA,EAAQ,CAAA,EAAE;AAM7B,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,IAAI,MAAA,GAAS,KAAA;AACb,MAAA,MAAM,WAAA,GAAc,CAAC,OAAA,KAAoB;AACvC,QAAA,IAAI,OAAA,EAAS;AACb,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,MAC3B,CAAA;AAEA,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,IAAI,OAAA,EAAS;AAIb,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,IAAA,CAAK,GAAG,EAAE,CAAC,CAAA;AACrD,QAAA,EAAA,CAAG,KAAA,EAAM;AAAA,MACX,CAAA,EAAG,KAAK,gBAAgB,CAAA;AAExB,MAAA,EAAA,CAAG,gBAAA,CAAiB,QAAQ,MAAM;AAChC,QAAA,YAAA,CAAa,OAAO,CAAA;AACpB,QAAA,MAAA,GAAS,IAAA;AACT,QAAA,IAAA,CAAK,IAAI,uBAAuB,CAAA;AAChC,QAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AAGzB,QAAA,IAAI,IAAA,CAAK,EAAA,KAAO,EAAA,EAAI,IAAA,CAAK,cAAA,CAAe,IAAI,QAAA,EAAU,MAAM,WAAA,CAAY,IAAI,CAAC,CAAA;AAC7E,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,OAAA,GAAU,IAAA;AACV,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,gBAAA,CAAiB,SAAA,EAAW,CAAC,KAAA,KAAU;AACxC,QAAA,QAAA,CAAS,MAAA,GAAS,CAAA;AAClB,QAAA,IAAI;AACF,UAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,KAAA,CAAM,IAAI,CAAC,CAAA;AAC1C,UAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,YAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,UACd;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,IAAA,CAAK,IAAI,qCAAqC,CAAA;AAAA,QAChD;AAAA,MACF,CAAC,CAAA;AAKD,MAAA,IAAI,YAAA,GAAe,KAAA;AACnB,MAAA,MAAM,WAAA,GAAc,CAAC,IAAA,KAAiB;AACpC,QAAA,IAAI,YAAA,EAAc;AAClB,QAAA,YAAA,GAAe,IAAA;AACf,QAAA,YAAA,CAAa,OAAO,CAAA;AACpB,QAAA,IAAI,IAAA,CAAK,EAAA,KAAO,EAAA,EAAI,IAAA,CAAK,cAAA,EAAe;AACxC,QAAA,IAAA,CAAK,GAAA,CAAI,CAAA,+BAAA,EAAkC,IAAI,CAAA,CAAA,CAAG,CAAA;AAElD,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,kBAAA,EAAoB;AAC7C,UAAA,OAAA,EAAQ;AAAA,QACV;AAKA,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,WAAA,CAAY,CAAA,cAAA,EAAiB,IAAA,CAAK,GAAG,CAAA,0BAAA,EAA6B,IAAI,CAAA,CAAA,CAAG,CAAA;AACzE,UAAA,IAAI,CAAC,SAAA,IAAa,CAAC,IAAA,CAAK,gBAAA,IAAoB,SAAS,GAAA,EAAM;AACzD,YAAA,IAAA,CAAK,iBAAA,EAAkB;AAAA,UACzB;AACA,UAAA;AAAA,QACF;AAEA,QAAA,IAAI,CAAC,IAAA,CAAK,gBAAA,IAAoB,IAAA,KAAS,GAAA,EAAM;AAC3C,UAAA,IAAA,CAAK,iBAAA,EAAkB;AAAA,QACzB;AAAA,MACF,CAAA;AACA,MAAA,EAAA,CAAG,iBAAiB,OAAA,EAAS,CAAC,UAAU,WAAA,CAAY,KAAA,CAAM,IAAI,CAAC,CAAA;AAE/D,MAAA,EAAA,CAAG,gBAAA,CAAiB,SAAS,MAAM;AACjC,QAAA,YAAA,CAAa,OAAO,CAAA;AAGpB,QAAA,IAAI,CAAC,MAAA,EAAQ,WAAA,CAAY,CAAA,cAAA,EAAiB,IAAA,CAAK,GAAG,CAAA,mBAAA,CAAqB,CAAA;AAAA,MACzE,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEQ,YAAA,GAA0B;AAChC,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,MAAM,EAAE,EAAA,EAAG,GAAI,IAAA,CAAK,GAAA;AACpB,MAAA,IAAI,KAAA,EAAO;AAET,QAAA,MAAM,IAAA,GAAO,EAAE,SAAA,EAAW,IAAA,CAAK,cAAc,GAAA,EAAK,EAAE,IAAG,EAAE;AACzD,QAAA,OAAO,IAAI,SAAA,CAAU,IAAA,CAAK,GAAA,EAAK,IAA2B,CAAA;AAAA,MAC5D;AACA,MAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,MAAM,IAAI,MAAM,4CAA4C,CAAA;AACjF,MAAA,OAAO,IAAI,KAAK,SAAA,CAAU,IAAA,CAAK,KAAK,IAAA,CAAK,YAAA,EAAc,EAAE,EAAA,EAAI,CAAA;AAAA,IAC/D;AAGA,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,MAAA,GAAS,CAAA,GAC9B,IAAI,SAAA,CAAU,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,YAAY,CAAA,GACzC,IAAI,SAAA,CAAU,KAAK,GAAG,CAAA;AAAA,EAC5B;AAAA,EAEQ,iBAAA,GAA0B;AAChC,IAAA,IAAI,IAAA,CAAK,iBAAA,IAAqB,IAAA,CAAK,eAAA,CAAgB,WAAA,EAAa;AAC9D,MAAA,IAAA,CAAK,GAAA,CAAI,CAAA,sCAAA,EAAyC,IAAA,CAAK,iBAAiB,CAAA,SAAA,CAAW,CAAA;AACnF,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,iBAAA,EAAA;AACL,IAAA,MAAM,QAAQ,IAAA,CAAK,GAAA;AAAA,MACjB,IAAA,CAAK,eAAA,CAAgB,MAAA,GAAS,CAAA,KAAM,KAAK,iBAAA,GAAoB,CAAA,CAAA;AAAA,MAC7D,KAAK,eAAA,CAAgB;AAAA,KACvB;AACA,IAAA,IAAA,CAAK,IAAI,CAAA,4BAAA,EAA+B,KAAK,CAAA,YAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA,CAAA,CAAG,CAAA;AAErF,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,KAAK,gBAAA,EAAkB;AAC3B,MAAA,IAAA,CAAK,SAAA,EAAU,CAAE,KAAA,CAAM,MAAM;AAAA,MAE7B,CAAC,CAAA;AAAA,IACH,GAAG,KAAK,CAAA;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,cAAA,CAAe,EAAA,EAAe,QAAA,EAA8B,MAAA,EAA0B;AAC5F,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,MAAM,MAAA,GAAS,EAAA;AACf,IAAA,MAAM,OAAA,GAAU,OAAO,MAAA,CAAO,IAAA,KAAS,UAAA;AACvC,IAAA,MAAM,YAAY,MAAM;AACtB,MAAA,QAAA,CAAS,MAAA,GAAS,CAAA;AAAA,IACpB,CAAA;AACA,IAAA,IAAI,OAAA,IAAW,OAAO,MAAA,CAAO,EAAA,KAAO,YAAY,MAAA,CAAO,EAAA,CAAG,QAAQ,SAAS,CAAA;AAAA,SAAA,IAClE,OAAA,EAAS,EAAA,CAAG,gBAAA,CAAiB,MAAA,EAAmC,SAAS,CAAA;AAClF,IAAA,MAAM,KAAA,GAAQ,OAAA,IAAW,IAAA,CAAK,cAAA,GAAiB,CAAA;AAE/C,IAAA,IAAA,CAAK,cAAA,GAAiB,YAAY,MAAM;AACtC,MAAA,IAAI,EAAA,CAAG,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AACtC,MAAA,IAAI,KAAA,IAAS,QAAA,CAAS,MAAA,IAAU,IAAA,CAAK,cAAA,EAAgB;AACnD,QAAA,IAAA,CAAK,GAAA;AAAA,UACH,CAAA,wBAAA,EAA2B,SAAS,MAAM,CAAA,eAAA,EAAkB,KAAK,WAAW,CAAA,gBAAA,EAAmB,KAAK,GAAG,CAAA;AAAA,SACzG;AACA,QAAA,IAAA,CAAK,cAAA,EAAe;AACpB,QAAA,IAAI;AACF,UAAA,IAAI,OAAO,MAAA,CAAO,SAAA,KAAc,UAAA,SAAmB,SAAA,EAAU;AAAA,kBACrD,KAAA,EAAM;AAAA,QAChB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,MAAA,EAAO;AACP,QAAA;AAAA,MACF;AACA,MAAA,IAAI;AACF,QAAA,MAAA,CAAO,IAAA,IAAO;AACd,QAAA,IAAI,OAAO,QAAA,CAAS,MAAA,EAAA;AAAA,MACtB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA,EAAG,KAAK,WAAW,CAAA;AAAA,EACrB;AAAA,EAEQ,cAAA,GAAuB;AAC7B,IAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,MAAA,aAAA,CAAc,KAAK,cAAc,CAAA;AACjC,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,IACxB;AAAA,EACF;AACF","file":"chunk-OBYKJB4U.js","sourcesContent":["/**\n * WebSocketClientTransport — connects to a skaile serve WebSocket server.\n *\n * Handles connection, reconnection with exponential backoff, heartbeat,\n * and JSON serialization. Implements ClientTransport from @skaile/workspaces/types.\n */\n\nimport type { AgentCommand, AgentEvent, ClientTransport } from \"@skaile/workspaces/types\";\nimport { encodeBearerSubprotocol } from \"./auth.js\";\n\nconst DEFAULT_RECONNECT_MAX_ATTEMPTS = 5;\nconst DEFAULT_RECONNECT_BASE_MS = 1_000;\nconst DEFAULT_RECONNECT_MAX_MS = 30_000;\nconst DEFAULT_HEARTBEAT_MS = 30_000;\nconst DEFAULT_MAX_MISSED_PONGS = 2;\nconst DEFAULT_CONNECT_TIMEOUT_MS = 10_000;\n\n/**\n * Options for {@link WebSocketClientTransport}.\n *\n * @param url - WebSocket server URL to connect to (e.g. `ws://localhost:8080`).\n * @param reconnect - Exponential-backoff reconnect policy. Defaults: 5 attempts, 1s base, 30s max.\n * @param heartbeatMs - Interval in milliseconds between WebSocket ping frames. Default: 30 000.\n * @param maxMissedPongs - Heartbeat ticks a socket may go without a pong (or any\n *   inbound message) before it is judged dead and terminated, so a half-open\n *   connection reaches the reconnect path. Default: 2, i.e. detection within\n *   3 x `heartbeatMs`. `0` disables the deadline. Only applies where the socket\n *   exposes ping and pong (Bun, and the `ws` package used for a `tls` dial under\n *   Node); Node's global WebSocket and browsers expose neither.\n * @param connectTimeoutMs - Maximum time in milliseconds to wait for the initial handshake. Default: 10 000.\n * @param onLog - Optional callback for internal log lines (connection state, errors).\n * @param auth - Optional bearer token sent via the WebSocket subprotocol; must\n *   match the server's `authToken` or the handshake is rejected with HTTP 401.\n * @param tls - Optional per-connection TLS settings for a `wss://` URL. `ca`\n *   (PEM) replaces the default trust store for this connection only, so the\n *   server certificate must chain to it. Server-side runtimes only: Bun passes\n *   it to its native `WebSocket`, Node dials through the `ws` package (the\n *   global WebSocket takes no CA). Unset, the dial is exactly as before.\n *\n * @docLink packages/transport/dev-guide#websocket-client-transport\n */\nexport interface WebSocketClientOptions {\n  url: string;\n  reconnect?: {\n    maxAttempts?: number;\n    baseMs?: number;\n    maxMs?: number;\n  };\n  heartbeatMs?: number;\n  maxMissedPongs?: number;\n  connectTimeoutMs?: number;\n  onLog?: (line: string) => void;\n  auth?: string;\n  tls?: {\n    ca: string | string[];\n  };\n}\n\n/**\n * Optional members a server-side socket may carry beyond the browser API: Bun's\n * native WebSocket has `ping`/`terminate` and a `pong` event; the `ws` package\n * has `ping`/`terminate` and reports pongs only through `on(\"pong\")`.\n */\ntype PingCapableSocket = WebSocket & {\n  ping?: () => void;\n  terminate?: () => void;\n  on?: (event: \"pong\", listener: () => void) => void;\n};\n\n/** The `ws` package's WebSocket constructor, as far as this client uses it. */\ntype WsPackageCtor = new (\n  url: string,\n  protocols: string[],\n  options: { ca: string | string[] },\n) => WebSocket;\n\nconst isBun = typeof (globalThis as { Bun?: unknown }).Bun !== \"undefined\";\n\n/**\n * Load the `ws` package only when a CA pin needs it under Node, so the client\n * subpath keeps no static `ws` import (browser bundles never reach this). The\n * variable specifier keeps bundlers from inlining it.\n */\nasync function loadWsPackage(): Promise<WsPackageCtor> {\n  if (typeof process === \"undefined\") {\n    throw new Error(\"WebSocketClientTransport `tls` is supported under Node and Bun only\");\n  }\n  const specifier = \"ws\";\n  const mod = (await import(/* @vite-ignore */ /* webpackIgnore: true */ specifier)) as {\n    WebSocket?: WsPackageCtor;\n    default?: WsPackageCtor;\n  };\n  const ctor = mod.WebSocket ?? mod.default;\n  if (!ctor) throw new Error(\"the ws package exports no WebSocket constructor\");\n  return ctor;\n}\n\n/**\n * `ClientTransport` implementation that connects to a skaile agent server over WebSocket.\n *\n * Uses the browser-standard `WebSocket` API so it works in both Bun and browser\n * environments. On an unintentional disconnect it automatically retries with\n * exponential backoff (default: 5 attempts, 1s base, 30s max). A periodic ping\n * keeps the connection alive through NAT and load-balancer idle timeouts. All\n * `AgentCommand` / `AgentEvent` messages are JSON-serialised on the wire.\n *\n * @example\n * ```ts\n * const transport = new WebSocketClientTransport({ url: 'ws://localhost:8080' });\n * await transport.connect();\n * transport.send({ type: 'prompt', prompt: 'Hello' });\n * ```\n *\n * @docLink packages/transport/dev-guide#websocket-client-transport\n */\nexport class WebSocketClientTransport implements ClientTransport {\n  private ws: WebSocket | null = null;\n  private readonly url: string;\n  private readonly reconnectConfig: Required<NonNullable<WebSocketClientOptions[\"reconnect\"]>>;\n  private readonly heartbeatMs: number;\n  private readonly maxMissedPongs: number;\n  private readonly connectTimeoutMs: number;\n  private readonly log: (line: string) => void;\n  private readonly subprotocols: string[];\n  private readonly tls: WebSocketClientOptions[\"tls\"];\n  /** Loaded on the first connect when {@link tls} is set under Node. */\n  private wsPackage: WsPackageCtor | null = null;\n\n  private heartbeatTimer: ReturnType<typeof setInterval> | null = null;\n  private reconnectAttempts = 0;\n  private intentionalClose = false;\n\n  private readonly messageHandlers = new Set<(event: AgentEvent) => void>();\n  private readonly disconnectHandlers = new Set<() => void>();\n\n  constructor(options: WebSocketClientOptions) {\n    this.url = options.url;\n    this.reconnectConfig = {\n      maxAttempts: options.reconnect?.maxAttempts ?? DEFAULT_RECONNECT_MAX_ATTEMPTS,\n      baseMs: options.reconnect?.baseMs ?? DEFAULT_RECONNECT_BASE_MS,\n      maxMs: options.reconnect?.maxMs ?? DEFAULT_RECONNECT_MAX_MS,\n    };\n    this.heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;\n    this.maxMissedPongs = options.maxMissedPongs ?? DEFAULT_MAX_MISSED_PONGS;\n    this.connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;\n    this.log = options.onLog ?? (() => {});\n    this.subprotocols = options.auth ? [encodeBearerSubprotocol(options.auth)] : [];\n    this.tls = options.tls;\n  }\n\n  async connect(): Promise<void> {\n    this.intentionalClose = false;\n    this.reconnectAttempts = 0;\n    if (this.tls && !isBun && !this.wsPackage) this.wsPackage = await loadWsPackage();\n    return this.doConnect(true);\n  }\n\n  async disconnect(): Promise<void> {\n    this.intentionalClose = true;\n    this.clearHeartbeat();\n    if (this.ws) {\n      if (this.ws.readyState === WebSocket.OPEN) {\n        this.ws.close(1000, \"Client disconnect\");\n      }\n      this.ws = null;\n    }\n  }\n\n  send(command: AgentCommand): void {\n    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {\n      this.log(\"[ws-client] cannot send: not connected\");\n      return;\n    }\n    this.ws.send(JSON.stringify(command));\n  }\n\n  onMessage(handler: (event: AgentEvent) => void): () => void {\n    this.messageHandlers.add(handler);\n    return () => {\n      this.messageHandlers.delete(handler);\n    };\n  }\n\n  onDisconnect(handler: () => void): () => void {\n    this.disconnectHandlers.add(handler);\n    return () => {\n      this.disconnectHandlers.delete(handler);\n    };\n  }\n\n  get connected(): boolean {\n    return this.ws?.readyState === WebSocket.OPEN;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Internal\n  // ---------------------------------------------------------------------------\n\n  private doConnect(isInitial = false): Promise<void> {\n    return new Promise<void>((resolve, reject) => {\n      this.log(`[ws-client] connecting to ${this.url}`);\n\n      const ws = this.createSocket();\n      this.ws = ws;\n      /** Pings this socket sent since its last pong or inbound message. */\n      const liveness = { missed: 0 };\n\n      // Settle the connect promise exactly once. A close or error that arrives\n      // before `open` is a handshake/connect failure (e.g. a rejected auth\n      // upgrade, code 401, or a refused port) — reject so the caller sees it\n      // instead of hanging until the connect timeout.\n      let settled = false;\n      let opened = false;\n      const failConnect = (message: string) => {\n        if (settled) return;\n        settled = true;\n        reject(new Error(message));\n      };\n\n      const timeout = setTimeout(() => {\n        if (settled) return;\n        // Reject with the timeout reason first, then close — closing may\n        // synchronously fire the `close` handler, whose `failConnect` is then a\n        // no-op thanks to the `settled` guard (preserves the timeout message).\n        settled = true;\n        reject(new Error(`Connection timeout to ${this.url}`));\n        ws.close();\n      }, this.connectTimeoutMs);\n\n      ws.addEventListener(\"open\", () => {\n        clearTimeout(timeout);\n        opened = true;\n        this.log(\"[ws-client] connected\");\n        this.reconnectAttempts = 0;\n        // A socket orphaned by disconnect() or a newer dial must not take over\n        // the heartbeat of the current one.\n        if (this.ws === ws) this.startHeartbeat(ws, liveness, () => handleClose(1006));\n        if (!settled) {\n          settled = true;\n          resolve();\n        }\n      });\n\n      ws.addEventListener(\"message\", (event) => {\n        liveness.missed = 0;\n        try {\n          const data = JSON.parse(String(event.data)) as AgentEvent;\n          for (const handler of this.messageHandlers) {\n            handler(data);\n          }\n        } catch {\n          this.log(\"[ws-client] failed to parse message\");\n        }\n      });\n\n      // Runs once per socket, from its `close` event or from the pong deadline,\n      // whichever comes first: `terminate()` closes synchronously in Bun but\n      // later in the `ws` package, so the second caller must be a no-op.\n      let closeHandled = false;\n      const handleClose = (code: number) => {\n        if (closeHandled) return;\n        closeHandled = true;\n        clearTimeout(timeout);\n        if (this.ws === ws) this.clearHeartbeat();\n        this.log(`[ws-client] disconnected (code=${code})`);\n\n        for (const handler of this.disconnectHandlers) {\n          handler();\n        }\n\n        // Closed before ever opening == connect failure. Reject the pending\n        // connect; only background (reconnect) attempts chain another retry —\n        // an initial connect failure is surfaced to the caller, who owns retry.\n        if (!opened) {\n          failConnect(`Connection to ${this.url} closed before open (code=${code})`);\n          if (!isInitial && !this.intentionalClose && code !== 1000) {\n            this.scheduleReconnect();\n          }\n          return;\n        }\n\n        if (!this.intentionalClose && code !== 1000) {\n          this.scheduleReconnect();\n        }\n      };\n      ws.addEventListener(\"close\", (event) => handleClose(event.code));\n\n      ws.addEventListener(\"error\", () => {\n        clearTimeout(timeout);\n        // A pre-open error is a connect failure; reject now. The close event\n        // (which usually follows) is idempotent via the `settled` guard.\n        if (!opened) failConnect(`Connection to ${this.url} failed before open`);\n      });\n    });\n  }\n\n  private createSocket(): WebSocket {\n    if (this.tls) {\n      const { ca } = this.tls;\n      if (isBun) {\n        // Bun's WebSocket takes an options object in place of the protocols.\n        const init = { protocols: this.subprotocols, tls: { ca } };\n        return new WebSocket(this.url, init as unknown as string[]);\n      }\n      if (!this.wsPackage) throw new Error(\"ws package not loaded before a pinned dial\");\n      return new this.wsPackage(this.url, this.subprotocols, { ca });\n    }\n    // Pass the bearer subprotocol when auth is configured; an empty list keeps\n    // the no-auth handshake byte-identical to before.\n    return this.subprotocols.length > 0\n      ? new WebSocket(this.url, this.subprotocols)\n      : new WebSocket(this.url);\n  }\n\n  private scheduleReconnect(): void {\n    if (this.reconnectAttempts >= this.reconnectConfig.maxAttempts) {\n      this.log(`[ws-client] giving up reconnect after ${this.reconnectAttempts} attempts`);\n      return;\n    }\n\n    this.reconnectAttempts++;\n    const delay = Math.min(\n      this.reconnectConfig.baseMs * 2 ** (this.reconnectAttempts - 1),\n      this.reconnectConfig.maxMs,\n    );\n    this.log(`[ws-client] reconnecting in ${delay}ms (attempt ${this.reconnectAttempts})`);\n\n    setTimeout(() => {\n      if (this.intentionalClose) return;\n      this.doConnect().catch(() => {\n        // doConnect rejection triggers another close → scheduleReconnect cycle\n      });\n    }, delay);\n  }\n\n  /**\n   * Ping every {@link heartbeatMs} and, where the socket reports pongs, give up\n   * on it after {@link maxMissedPongs} unanswered ticks. A path that dies\n   * without a FIN leaves the socket OPEN forever; terminating it here is what\n   * lets {@link scheduleReconnect} run. `onDead` settles the close at once\n   * because a terminated socket's own close event can arrive late.\n   */\n  private startHeartbeat(ws: WebSocket, liveness: { missed: number }, onDead: () => void): void {\n    this.clearHeartbeat();\n    const socket = ws as PingCapableSocket;\n    const canPing = typeof socket.ping === \"function\";\n    const markAlive = () => {\n      liveness.missed = 0;\n    };\n    if (canPing && typeof socket.on === \"function\") socket.on(\"pong\", markAlive);\n    else if (canPing) ws.addEventListener(\"pong\" as keyof WebSocketEventMap, markAlive);\n    const judge = canPing && this.maxMissedPongs > 0;\n\n    this.heartbeatTimer = setInterval(() => {\n      if (ws.readyState !== WebSocket.OPEN) return;\n      if (judge && liveness.missed >= this.maxMissedPongs) {\n        this.log(\n          `[ws-client] no pong for ${liveness.missed} heartbeats of ${this.heartbeatMs}ms; terminating ${this.url}`,\n        );\n        this.clearHeartbeat();\n        try {\n          if (typeof socket.terminate === \"function\") socket.terminate();\n          else ws.close();\n        } catch {\n          // already gone\n        }\n        onDead();\n        return;\n      }\n      try {\n        socket.ping?.();\n        if (judge) liveness.missed++;\n      } catch {\n        // A runtime whose ping throws cannot be judged on pongs either.\n      }\n    }, this.heartbeatMs);\n  }\n\n  private clearHeartbeat(): void {\n    if (this.heartbeatTimer) {\n      clearInterval(this.heartbeatTimer);\n      this.heartbeatTimer = null;\n    }\n  }\n}\n"]}

package/dist/chunk-PE36IF2D.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../asset-manager/src/install-agent.ts","../asset-manager/src/installer.ts"],"names":["parseYaml","parseFrontmatter","join","basename","relative","resolve","existsSync","stringifyYaml","deployed"],"mappings":";;;;;;;;;;;;;;;;AA+CA,IAAM,aAAA,GAAgB,UAAA;AAGtB,SAAS,kBAAkB,KAAA,EAAoD;AAC7E,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA,EAAE;AAC9D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,QAAQ,CAAA,CAAE,OAAO,OAAO,CAAA;AACpD,IAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,EAAE,SAAQ,GAAI,MAAA;AAAA,EAC5C;AACA,EAAA,OAAO,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,GAAY,KAAA,GAAmC,MAAA;AAClF;AAOA,SAAS,oBAAoB,QAAA,EAAoE;AAC/F,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,QAAA,EAAU,aAAa,CAAA;AAC3C,EAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,MAAM,IAAA,EAAK,GAAI,iBAAyB,YAAA,CAAa,MAAA,EAAQ,OAAO,CAAC,CAAA;AAC7E,IAAA,MAAM,OAAO,IAAA,CAAK,QAAA;AAClB,IAAA,MAAM,QAAA,GAAoC,EAAE,GAAG,IAAA,EAAK;AACpD,IAAA,IAAI,QAAA,CAAS,OAAA,KAAY,KAAA,CAAA,IAAa,IAAA,EAAM,YAAY,KAAA,CAAA,EAAW;AACjE,MAAA,QAAA,CAAS,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IACxC;AACA,IAAA,IAAI,OAAO,KAAK,KAAA,KAAU,QAAA,WAAmB,KAAA,GAAQ,EAAE,SAAA,EAAW,IAAA,CAAK,KAAA,EAAM;AAC7E,IAAA,IAAI,KAAK,KAAA,KAAU,KAAA,CAAA,WAAoB,KAAA,GAAQ,iBAAA,CAAkB,KAAK,KAAK,CAAA;AAC3E,IAAA,OAAO,EAAE,UAAqC,IAAA,EAAK;AAAA,EACrD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMO,SAAS,aAAa,QAAA,EAAwC;AACnE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,EAAU,YAAY,CAAA;AAC5C,EAAA,IAAI,CAAC,WAAW,QAAQ,CAAA,SAAU,mBAAA,CAAoB,QAAQ,GAAG,QAAA,IAAY,IAAA;AAC7E,EAAA,IAAI;AACF,IAAA,OAAOA,KAAA,CAAU,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,QAAA,CAAS,UAAkB,IAAA,EAA6B;AAC/D,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAC7B,EAAA,IAAI,CAAC,UAAA,CAAW,CAAC,CAAA,EAAG,OAAO,IAAA;AAC3B,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,GAAG,OAAO,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMO,SAAS,SAAS,QAAA,EAAiC;AACxD,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,QAAA,EAAU,SAAS,CAAA;AACzC,EAAA,IAAI,WAAW,IAAA,CAAK,QAAA,EAAU,YAAY,CAAC,GAAG,OAAO,IAAA;AACrD,EAAA,MAAM,IAAA,GAAO,mBAAA,CAAoB,QAAQ,CAAA,EAAG,IAAA;AAC5C,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,OAAO,IAAA,GAAO,GAAG,IAAI;;AAAA,EAAO,IAAI,CAAA,CAAA,GAAK,IAAA;AACvC;AAMA,SAAS,eAAe,IAAA,EAAuB;AAC7C,EAAA,OAAO,IAAA,CAAK,MAAA,GAAS,CAAA,IAAK,IAAA,KAAS,GAAA,IAAO,SAAS,IAAA,IAAQ,CAAC,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AACjF;AAGA,SAASC,kBAAiB,OAAA,EAA0C;AAClE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,uBAAuB,CAAA;AACnD,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAC;AACpB,EAAA,IAAI;AACF,IAAA,OAAQD,KAAA,CAAU,KAAA,CAAM,CAAC,CAAE,KAAiC,EAAC;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAOA,SAAS,cAAA,CAAe,QAAuB,KAAA,EAAqC;AAClF,EAAA,MAAM,MAAA,GAAwB,EAAE,GAAG,MAAA,EAAO;AAC1C,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,GAAG,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAuC;AAChF,IAAA,IAAI,QAAQ,MAAA,EAAW;AACvB,IAAA,MAAM,SAAA,GAAY,OAAO,CAAwB,CAAA;AACjD,IAAA,IAAI,CAAA,KAAM,cAAc,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtE,MAAA,MAAM,MAAA,uBAAa,GAAA,EAA8B;AACjD,MAAA,KAAA,MAAW,QAAQ,CAAC,GAAG,SAAA,EAAW,GAAG,GAAG,CAAA,EAAyB;AAC/D,QAAA,MAAA,CAAO,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,EAAS,IAAA,CAAK,GAAG,CAAA,EAAA,EAAS,IAAA,CAAK,EAAA,IAAM,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA;AAAA,MACxE;AACA,MAAA,MAAA,CAAO,QAAA,GAAW,CAAC,GAAG,MAAA,CAAO,QAAQ,CAAA;AAAA,IACvC,CAAA,MAAA,IAAW,MAAM,OAAA,CAAQ,GAAG,KAAK,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AACzD,MAAC,MAAA,CAAmC,CAAC,CAAA,GAAI,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,SAAA,EAAW,GAAG,GAAG,CAAC,CAAC,CAAA;AAAA,IAC9E,CAAA,MAAO;AACL,MAAC,MAAA,CAAmC,CAAC,CAAA,GAAI,GAAA;AAAA,IAC3C;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAMA,SAAS,iBAAA,CACP,QAAA,EACA,MAAA,EACA,QAAA,EACe;AACf,EAAA,IAAI,CAAC,QAAA,CAAS,OAAA,EAAS,OAAO,QAAA;AAC9B,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,MAAA,EAAQ,QAAA,CAAS,OAAO,CAAA;AAClD,EAAA,MAAM,cAAA,GAAiB,aAAa,SAAS,CAAA;AAC7C,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAO,cAAA,CAAe,gBAAgB,QAAQ,CAAA;AAAA,EAChD;AACA,EAAA,QAAA,CAAS,IAAA;AAAA,IACP,CAAA,oCAAA,EAAuC,QAAA,CAAS,OAAO,CAAA,QAAA,EAAW,MAAM,CAAA,6BAAA;AAAA,GAC1E;AACA,EAAA,OAAO,QAAA;AACT;AAOA,SAAS,sBAAA,CACP,UACA,QAAA,EACwD;AACxD,EAAA,MAAM,SAAA,GAAY,QAAA,EAAU,SAAA,IAAa,QAAA,CAAS,SAAA,IAAa,UAAA;AAC/D,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAE,UAAU,SAAA,EAAU;AAC5C,EAAA,MAAM,SAAA,GAA2B,EAAE,GAAG,QAAA,EAAU,SAAA,EAAU;AAC1D,EAAA,IAAI,SAAS,KAAA,EAAO;AAClB,IAAA,SAAA,CAAU,QAAQ,EAAE,GAAG,SAAS,KAAA,EAAO,GAAG,SAAS,KAAA,EAAM;AAAA,EAC3D;AACA,EAAA,IAAI,QAAA,CAAS,MAAA,EAAQ,SAAA,KAAc,MAAA,EAAW;AAC5C,IAAA,SAAA,CAAU,OAAA,GAAU,EAAE,GAAG,QAAA,CAAS,SAAS,SAAA,EAAW,QAAA,CAAS,OAAO,SAAA,EAAU;AAAA,EAClF;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,SAAA,EAAU;AAC1C;AAOA,SAAS,eAAe,GAAA,EAAqB;AAC3C,EAAA,MAAM,MAAA,GAAS,mBAAmB,GAAG,CAAA;AACrC,EAAA,IAAI,MAAA,SAAe,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,EAAE,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,EAAI,IAAK,GAAA;AACzD,EAAA,OAAO,IAAA,CAAK,QAAQ,WAAA,EAAa,EAAE,EAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,IAAK,GAAA;AAC9D;AAGA,SAAS,aAAA,CAAc,UAAyB,IAAA,EAAwB;AACtE,EAAA,MAAM,SAAS,QAAA,CAAS,QAAA,IAAY,EAAC,EAClC,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,IAAA,KAAS,IAAI,EACnC,GAAA,CAAI,CAAC,SAAS,cAAA,CAAe,IAAA,CAAK,GAAG,CAAC,CAAA;AACzC,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,KAAK,CAAC,CAAA;AAC3B;AAOA,SAAS,eAAA,CACP,UACA,QAAA,EACU;AACV,EAAA,MAAM,KAAA,GAAA,CAAS,QAAA,CAAS,QAAA,IAAY,EAAC,EAClC,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,IAAA,KAAS,YAAY,CAAA,CAC3C,GAAA;AAAA,IACC,CAAC,IAAA,KAAA,CAAU,IAAA,CAAK,EAAA,GAAK,QAAA,EAAU,UAAA,GAAa,IAAA,CAAK,EAAE,CAAA,GAAI,MAAA,KAAc,cAAA,CAAe,IAAA,CAAK,GAAG;AAAA,GAC9F;AACF,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,KAAK,CAAC,CAAA;AAC3B;AAGA,SAAS,kBAAA,CACP,QAAA,EACA,aAAA,EACA,YAAA,EACc;AACd,EAAA,MAAM,cAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,IAAA,IAAQ,aAAA,CAAc,QAAA,EAAU,OAAO,CAAA,EAAG;AACnD,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,aAAA,EAAe,YAAA,EAAc,MAAM,UAAU,CAAA;AACtE,IAAA,IAAI,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,GAAKC,iBAAAA,CAAiB,YAAA,CAAa,WAAA,EAAa,OAAO,CAAC,CAAA;AAC9D,MAAA,MAAM,OAAO,OAAO,EAAA,CAAG,WAAA,KAAgB,QAAA,GAAW,GAAG,WAAA,GAAc,KAAA,CAAA;AACnE,MAAA,IAAI,MAAM,WAAA,CAAY,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,MAAM,CAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,WAAA;AACT;AAGA,SAAS,mBAAA,CACP,QAAA,EACA,aAAA,EACA,YAAA,EACe;AACf,EAAA,MAAM,eAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,aAAA,CAAc,QAAA,EAAU,UAAU,CAAA,EAAG;AACtD,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,aAAA,EAAe,YAAA,EAAc,MAAM,aAAa,CAAA;AAC7E,IAAA,IAAI,CAAC,UAAA,CAAW,eAAe,CAAA,EAAG;AAClC,IAAA,YAAA,CAAa,IAAA,CAAK,EAAE,IAAA,EAAM,YAAA,EAAc,SAAS,aAAA,EAAe,eAAe,GAAG,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,YAAA;AACT;AAqBA,SAAS,gBAAA,CACP,QAAA,EACA,SAAA,EACA,MAAA,EACA,eACA,QAAA,EACoB;AACpB,EAAA,MAAM,YAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,QAAA,IAAY,EAAC,EAAG;AAC1C,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,OAAA,IAAW,IAAA,CAAK,YAAY,KAAA,EAAO;AACrD,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GACE,KAAK,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,IAAA,CAAK,IAAI,UAAA,CAAW,cAAc,CAAA,GAC/D,yBAAA,CAA0B,eAAe,IAAA,CAAK,GAAG,IACjD,OAAA,CAAQ,MAAA,EAAQ,KAAK,GAAG,CAAA;AAAA,IAChC,SAAS,GAAA,EAAK;AACZ,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,CAAA,UAAA,EAAa,IAAA,CAAK,GAAG,CAAA,OAAA,EAAU,SAAS,CAAA,GAAA,EAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OAChG;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,CAAC,MAAA,IAAU,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG;AAClC,MAAA,QAAA,CAAS,KAAK,CAAA,4BAAA,EAA+B,IAAA,CAAK,GAAG,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,CAAG,CAAA;AAC3E,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,aAAa,MAAM,CAAA;AAC/B,IAAA,MAAM,OAAO,IAAA,CAAK,EAAA,IAAM,GAAA,EAAK,IAAA,IAAQ,SAAS,MAAM,CAAA;AAEpD,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,yBAAA,CAA0B,IAAA,CAAK,IAAI,CAAA,EAAG;AACrE,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,CAAA,UAAA,EAAa,IAAA,CAAK,GAAG,CAAA,OAAA,EAAU,SAAS,CAAA,QAAA,EAAW,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA,YAAA,EAAe,yBAAyB,CAAA,eAAA;AAAA,OACjH;AACA,MAAA;AAAA,IACF;AACA,IAAA,SAAA,CAAU,IAAA,CAAK;AAAA,MACb,KAAK,IAAA,CAAK,GAAA;AAAA,MACV,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AACA,EAAA,OAAO,SAAA;AACT;AAGA,SAAS,qBACP,aAAA,EACA,YAAA,EACA,YAAA,EACA,QAAA,EACA,aACA,YAAA,EACiB;AACjB,EAAA,MAAM,cAA8B,QAAA,EAAU,UAAA,IAAc,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,IAC1E,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU;AAAA,GACtB,CAAE,CAAA;AAEF,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,YAA4B,CAAA,EAAG,MAAM,KAAA,IAAS,EAAA;AAElF,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,YAAA;AAAA,IACX,SAAA,EAAW,YAAA;AAAA,IACX,SAAA,EAAW,YAAA;AAAA,IACX,SAAA,EAAW,aAAA;AAAA,IACX,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;AA6BO,SAAS,YAAA,CACd,MAAA,EACA,cAAA,EACA,aAAA,EACA,YAAA,EAEA,YAAA,EACA,YAAA,EACA,gBAAA,EACA,OAAA,EACA,QAAA,EACA,GAAA,EACA,QAAA,EAC8D;AAC9D,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAM,CAAA;AAC9B,EAAA,IAAI,OAAA,CAAQ,IAAI,OAAO,CAAA,SAAU,EAAE,OAAA,EAAS,SAAS,QAAA,EAAS;AAC9D,EAAA,OAAA,CAAQ,IAAI,OAAO,CAAA;AAEnB,EAAA,MAAM,eAAA,GAAkB,aAAa,MAAM,CAAA;AAC3C,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,MAAM,CAAA,qEAAA,CAAkE,CAAA;AACzF,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,EAAS;AAAA,EACtC;AAIA,EAAA,MAAM,EAAE,QAAA,EAAU,SAAA,EAAU,GAAI,sBAAA;AAAA,IAC9B,iBAAA,CAAkB,eAAA,EAAiB,MAAA,EAAQ,QAAQ,CAAA;AAAA,IACnD;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAAY,YAAA,IAAgB,QAAA,CAAS,IAAA,IAAQ,SAAS,MAAM,CAAA;AAClE,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,CAAC,cAAA,CAAe,SAAS,CAAA,EAAG;AAC/D,IAAA,QAAA,CAAS,IAAA;AAAA,MACP,GAAG,MAAM,CAAA,aAAA,EAAgB,IAAA,CAAK,SAAA,CAAU,SAAS,CAAC,CAAA,8DAAA;AAAA,KACpD;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,EAAS;AAAA,EACtC;AAEA,EAAA,GAAA,GAAM,CAAA,sBAAA,EAAyB,SAAS,CAAA,EAAA,EAAK,YAAY,CAAA,CAAA,CAAG,CAAA;AAG5D,EAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,QAAA,EAAU,aAAA,EAAe,YAAY,CAAA;AAG5E,EAAA,MAAM,YAAA,GAAe,mBAAA,CAAoB,QAAA,EAAU,aAAA,EAAe,YAAY,CAAA;AAG9E,EAAA,MAAM,YAAY,gBAAA,CAAiB,QAAA,EAAU,SAAA,EAAW,MAAA,EAAQ,eAAe,QAAQ,CAAA;AACvF,EAAA,MAAM,WAAA,GAAc,oBAAA;AAAA,IAClB,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAAA,IAC3B,YAAA;AAAA,IACA,YAAA;AAAA,IACA,QAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,kBAAA,GAAqB,gBAAA;AAAA,IACzB,WAAA;AAAA,IACA,UAAU,KAAA,EAAO,SAAA;AAAA,IACjB;AAAA,GACF;AACA,EAAA,MAAM,gBAAA,GAAmB,oBAAA;AAAA,IACvB,QAAA,EAAU,QAAQ,mBAAmB,CAAA;AAAA,IACrC;AAAA,GACF;AAEA,EAAA,MAAM,KAAA,GAA0B;AAAA,IAC9B,QAAA;AAAA,IACA,IAAA,EAAM,SAAS,MAAM,CAAA;AAAA,IACrB,KAAA,EAAO,QAAA,CAAS,MAAA,EAAQ,UAAU,CAAA;AAAA,IAClC,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,WAAW,CAAA;AAAA,IACpC,SAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,kBAAA;AAAA,IACA,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA,EAAQ,aAAA,CAAc,QAAA,EAAU,OAAO,CAAA;AAAA,IACvC,UAAA,EAAY,eAAA,CAAgB,QAAA,EAAU,QAAQ;AAAA,GAChD;AAEA,EAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,KAAA,EAAO,YAAA,EAAc,GAAG,CAAA;AAC9D,EAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAA,CAAO,OAAO,CAAA;AAC9B,EAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAA,CAAO,OAAO,CAAA;AAC9B,EAAA,QAAA,CAAS,IAAA,CAAK,GAAG,MAAA,CAAO,QAAQ,CAAA;AAGhC,EAAA,IAAI,gBAAA,EAAkB;AACpB,IAAA,KAAA,MAAW,YAAY,SAAA,EAAW;AAChC,MAAA,MAAM,GAAA,GAAM,YAAA;AAAA,QACV,QAAA,CAAS,MAAA;AAAA,QACT,cAAA;AAAA,QACA,aAAA;AAAA,QACA,YAAA;AAAA,QACA,YAAA;AAAA,QACA,QAAA,CAAS,KAAA;AAAA;AAAA,QACT,gBAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,GAAA,CAAI,OAAO,CAAA;AAC3B,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,GAAA,CAAI,OAAO,CAAA;AAC3B,MAAA,QAAA,CAAS,IAAA,CAAK,GAAG,GAAA,CAAI,QAAQ,CAAA;AAAA,IAC/B;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,EAAS;AACtC;;;ACncA,IAAM,OAAY,MAAM;AAAC,CAAA;AAQlB,SAAS,kBAAkB,KAAA,EAA6B;AAC7D,EAAA,IAAI,KAAA,CAAM,YAAA,EAAc,OAAO,KAAA,CAAM,YAAA;AACrC,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,SAAA,EAAW,OAAA,CAAQ,MAAM,EAAE,CAAA;AACnD,EAAA,IAAI,CAAC,WAAW,OAAO,CAAA,EAAG,MAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAClD,EAAA,OAAO,aAAA,CAAc;AAAA,IACnB,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,SAAA;AAAA,IACA,GAAA,EAAK,MAAM,OAAA,IAAW;AAAA,GACvB,CAAA;AACH;AAIA,SAAS,UAAU,IAAA,EAAoB;AACrC,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,UAAU,IAAI,CAAA;AACxB,IAAA,IAAI,CAAA,CAAE,cAAA,EAAe,EAAG,UAAA,CAAW,IAAI,CAAA;AAAA,gBAC3B,IAAA,EAAM,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AAAA,EAAC;AACX;AAQO,SAAS,eAAA,CACd,UACA,IAAA,EACyB;AACzB,EAAA,OAAO,QAAA,CAAS,WAAA,CAAY,IAAI,CAAA,EAAG,aAAA;AACrC;AAOA,SAAS,cAAA,CAAe,UAA8B,MAAA,EAAoC;AACxF,EAAA,IAAI,CAAC,QAAA,CAAS,MAAM,CAAA,CAAE,WAAA,IAAe,OAAO,MAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,WAAA,CAAY,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,QAAA,CAAS,WAAA,CAAY,CAAC,CAAC,CAAA;AACnE,EAAA,OAAO,GAAA,GAAMC,IAAAA,CAAK,MAAA,EAAQ,GAAG,CAAA,GAAI,MAAA;AACnC;AAsBA,SAAS,SAAA,CACP,QAAA,EACA,KAAA,EACA,IAAA,EACA,gBAAA,EACM;AACN,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AACrB,EAAA,SAAA,CAAU,IAAI,CAAA;AACd,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,QAAA,EAAU,MAAM,CAAA;AACpD,EAAA,IAAI,CAAC,YAAA,EAAc;AAEjB,IAAA,MAAA,CAAO,QAAQ,IAAA,EAAM;AAAA,MACnB,SAAA,EAAW,IAAA;AAAA,MACX,MAAA,EAAQ,CAAC,GAAA,KAAQ;AACf,QAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,IAAA;AAC3B,QAAA,IAAI,aAAA,CAAcC,QAAAA,CAAS,GAAG,CAAC,CAAA,IAAK,eAAeA,QAAAA,CAAS,GAAG,CAAC,CAAA,EAAG,OAAO,KAAA;AAC1E,QAAA,IAAI,SAAA,CAAU,GAAG,CAAA,CAAE,cAAA,EAAe,EAAG;AACnC,UAAA,gBAAA,GAAmB,KAAA,EAAOD,KAAKC,QAAAA,CAAS,MAAM,GAAGC,QAAAA,CAAS,MAAA,EAAQ,GAAG,CAAC,CAAC,CAAA;AACvE,UAAA,OAAO,KAAA;AAAA,QACT;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,iBAAA,CAAkB,YAAY,CAAA;AACtD,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,MAAA,CAAO,KAAA;AACpC,EAAA,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACnC,EAAA,KAAA,MAAW,OAAO,KAAA,EAAO;AACvB,IAAA,MAAM,MAAA,GAASF,IAAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAC7B,IAAA,SAAA,CAAU,QAAQ,MAAM,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAA,CAAOA,IAAAA,CAAK,SAAA,EAAW,GAAG,CAAA,EAAG,MAAM,CAAA;AAAA,EACrC;AAGA,EAAA,IAAI,gBAAA,KAAqB,MAAM,MAAA,GAAS,CAAA,IAAKC,SAAS,SAAS,CAAA,KAAM,MAAM,IAAA,CAAA,EAAO;AAChF,IAAA,KAAA,MAAW,GAAA,IAAO,mBAAA,CAAoB,SAAS,CAAA,EAAG;AAChD,MAAA,gBAAA,CAAiB,OAAOD,IAAAA,CAAKC,QAAAA,CAAS,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,IACxD;AAAA,EACF;AACF;AAOA,SAAS,YAAA,CACP,QAAA,EACA,MAAA,EACA,IAAA,EACA,IAAA,EACM;AACN,EAAA,SAAA,CAAU,IAAI,CAAA;AACd,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,QAAA,EAAU,MAAM,CAAA;AACpD,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,WAAA,CAAYE,OAAAA,CAAQ,MAAM,CAAA,EAAG,IAAI,CAAA;AACjC,IAAA;AAAA,EACF;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,KAAA,EAAM,GAAI,QAAA,CAAS,kBAAkB,YAAY,CAAA;AACpE,EAAA,IAAI,MAAM,MAAA,GAAS,CAAA,IAAKF,QAAAA,CAAS,SAAS,MAAM,IAAA,EAAM;AACpD,IAAA,WAAA,CAAYE,OAAAA,CAAQ,SAAS,CAAA,EAAG,IAAI,CAAA;AAAA,EACtC,CAAA,MAAO;AACL,IAAA,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACnC,IAAA,WAAA,CAAYA,OAAAA,CAAQ,YAAY,CAAA,EAAGH,IAAAA,CAAK,MAAMC,QAAAA,CAAS,YAAY,CAAC,CAAC,CAAA;AAAA,EACvE;AACF;AAyCA,SAAS,sBAAA,CACP,QAAA,EACA,KAAA,EACA,MAAA,EACA,eACA,GAAA,EACM;AACN,EAAA,MAAM,OAAOD,IAAAA,CAAK,mBAAA,CAAoB,aAAa,CAAA,EAAG,MAAM,IAAI,CAAA;AAChE,EAAA,IAAI;AACF,IAAA,SAAA,CAAU,QAAA,EAAU,OAAO,IAAI,CAAA;AAC/B,IAAA,IAAII,UAAAA,CAAWJ,IAAAA,CAAK,IAAA,EAAM,YAAY,CAAC,CAAA,EAAG;AAC1C,IAAA,MAAM,QAAA,GAAW,aAAa,MAAM,CAAA;AACpC,IAAA,IAAI,CAAC,QAAA,EAAU;AACf,IAAA,aAAA;AAAA,MACEA,IAAAA,CAAK,MAAM,YAAY,CAAA;AAAA,MACvBK,SAAA,CAAc,EAAE,GAAG,QAAA,EAAU,MAAM,QAAA,CAAS,IAAA,IAAQ,KAAA,CAAM,IAAA,EAAM,CAAA;AAAA,MAChE;AAAA,KACF;AACA,IAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,IAAA,IAAI,MAAM,aAAA,CAAcL,IAAAA,CAAK,MAAM,SAAS,CAAA,EAAG,GAAG,IAAI;AAAA,CAAA,EAAM,MAAM,CAAA;AAAA,EACpE,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,IAAA,GAAA,CAAI,CAAA,2CAAA,EAA8C,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,CAAA;AAAA,EAC3E;AACF;AAuBO,SAAS,WAAA,CACd,KAAA,EACA,YAAA,EACA,IAAA,EACA,MAAW,IAAA,EACF;AACT,EAAA,OAAO,WAAA,CAAY,KAAA,EAAO,YAAA,EAAc,IAAA,EAAM,GAAG,CAAA,CAAE,QAAA;AACrD;AAOA,SAAS,WAAA,CACP,KAAA,EACA,YAAA,EACA,IAAA,EACA,GAAA,EACyC;AACzC,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,KAAK,MAAA,IAAU,KAAA;AACrC,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AAIjB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,MAAM,IAAI,CAAA;AACrD,EAAA,MAAM,YAAY,QAAA,EAAU,aAAA;AAC5B,EAAA,IAAI,CAAC,YAAY,CAAC,SAAA,SAAkB,EAAE,QAAA,EAAU,IAAA,EAAM,OAAA,EAAS,KAAA,EAAM;AAGrE,EAAA,IAAI,cAAc,OAAA,EAAS;AACzB,IAAA,MAAM,aAAA,GAAgB,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACzC,IAAA,MAAM,cAAA,GAAiB,YAAA;AAAA,MACrB,SAAA;AAAA,MACA,YAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,SAAA,GAAY,eAAe,YAA4B,CAAA;AAC7D,IAAA,MAAM,YAAA,GAAe,SAAA,EAAW,KAAA,CAAM,KAAA,IAAS,EAAA;AAC/C,IAAA,MAAM,QAAA,GAAW,yBAAyB,aAAa,CAAA;AACvD,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,MAAM,CAAA,CAAE,WAAA,EAAY,GAAI,KAAA,CAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA;AACzF,IAAA,MAAM,MAAA,GAAS,YAAA;AAAA,MACb,MAAA;AAAA,MACA,cAAA;AAAA,MACA,aAAA;AAAA,MACA,YAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA,CAAM,IAAA;AAAA;AAAA,MACiB,IAAA;AAAA,0BACnB,GAAA,EAAY;AAAA,MAChB,QAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,KAAA,MAAW,KAAK,MAAA,CAAO,QAAA,EAAU,GAAA,CAAI,CAAA,QAAA,EAAW,CAAC,CAAA,CAAE,CAAA;AACnD,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,IAAI,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,CAAA;AAGtC,MAAA,MAAM,YAAA,GAAeA,IAAAA,CAAK,cAAA,EAAgB,KAAA,CAAM,IAAI,CAAA;AACpD,MAAA,IAAI,YAAA,KAAiB,KAAA,IAASI,UAAAA,CAAW,YAAY,CAAA,EAAG;AACtD,QAAA,SAAA,CAAU,YAAY,CAAA;AACtB,QAAA,OAAA,GAAU,IAAA;AAAA,MACZ;AACA,MAAA,IAAI,CAAC,aAAA,EAAe,sBAAA,CAAuB,UAAU,KAAA,EAAO,MAAA,EAAQ,eAAe,GAAG,CAAA;AACtF,MAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,OAAA,EAAQ;AAAA,IACnC;AAAA,EAEF;AAEA,EAAA,MAAM,OAAO,WAAA,CAAY,SAAA,EAAW,MAAM,IAAA,EAAM,YAAA,EAAc,eAAe,GAAG,CAAA;AAChF,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAM5C,EAAA,MAAM,WAAW,KAAA,CAAM,SAAA,GAAY,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA,GAAI,MAAA;AACnE,EAAA,MAAM,YAAA,GAAe,QAAA,EAAU,IAAA,IAAQ,IAAA,IAAQ,SAAS,OAAA,KAAY,IAAA;AAEpE,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,IAAA,IAAQ,YAAA,EAAc;AACtC,IAAA,YAAA,CAAa,QAAA,EAAU,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAM,MAAM,IAAI,CAAA;AACrD,IAAA,GAAA,CAAI,aAAa,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC7C,CAAA,MAAO;AACL,IAAA,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,gBAAgB,CAAA;AACtD,IAAA,GAAA,CAAI,UAAU,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,OAAA,EAAS,IAAA,EAAK;AACzC;AAoBO,SAAS,UACd,QAAA,EACA,YAAA,EACA,OAAA,EACA,IAAA,EACA,MAAW,IAAA,EACD;AACV,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,KAAK,MAAA,IAAU,KAAA;AACrC,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AAEjB,EAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAG5B,IAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,IAAA,CAAK,QAAA,EAAU,MAAM,IAAI,CAAA;AAC3D,IAAA,IAAI,CAAC,SAAA,EAAW;AAEhB,IAAA,MAAM,MAAM,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAIvC,IAAA,IACE,SAAA,KAAc,WACd,UAAA,CAAW,SAAA,EAAW,MAAM,IAAA,EAAM,YAAA,EAAc,aAAA,EAAe,GAAG,CAAA,EAClE;AAIA,MAAA,MAAM,OAAO,WAAA,CAAY,SAAA,EAAW,MAAM,IAAA,EAAM,YAAA,EAAc,eAAe,GAAG,CAAA;AAIhF,MAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,MAAA,IAAI;AACF,QAAA,aAAA,GAAgB,SAAA,CAAU,IAAI,CAAA,CAAE,cAAA,EAAe;AAAA,MACjD,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,WAAA,GAAc,aAAA,IAAiB,IAAA,CAAK,IAAA,KAAS,IAAA;AAGnD,MAAA,IAAI,WAAA,EAAa,GAAA,CAAI,CAAA,8BAAA,EAA4B,GAAG,CAAA,8BAAA,CAAgC,CAAA;AAEpF,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,MAAM,YAAA,GAAeH,QAAAA,CAAS,KAAA,CAAM,MAAM,CAAA;AAC1C,QAAA,MAAM,gBAAA,GAAmBD,IAAAA,CAAK,IAAA,EAAM,YAAY,CAAA;AAOhD,QAAA,IAAII,UAAAA,CAAW,gBAAgB,CAAA,EAAG;AAChC,UAAA,IAAI,iBAAA;AACJ,UAAA,IAAI;AACF,YAAA,iBAAA,GAAoB,WAAA,CAAY,KAAA,CAAM,MAAM,CAAA,KAAM,YAAY,gBAAgB,CAAA;AAAA,UAChF,CAAA,CAAA,MAAQ;AAEN,YAAA,GAAA,CAAI,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAE,CAAA;AAChC,YAAA;AAAA,UACF;AAKA,UAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA;AACpC,UAAA,MAAM,mBAAA,GAAA,CAAuB,KAAA,CAAM,KAAA,IAAS,EAAC,EAC1C,MAAA,CAAO,CAAC,GAAA,KAAQ,GAAA,KAAQ,YAAY,CAAA,CACpC,KAAA,CAAM,CAAC,GAAA,KAAQ;AACd,YAAA,MAAME,SAAAA,GAAWN,IAAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAC/B,YAAA,IAAI;AACF,cAAA,OACEI,UAAAA,CAAWE,SAAQ,CAAA,IAAK,WAAA,CAAYN,IAAAA,CAAK,SAAS,GAAG,CAAC,CAAA,KAAM,WAAA,CAAYM,SAAQ,CAAA;AAAA,YAEpF,CAAA,CAAA,MAAQ;AACN,cAAA,OAAO,KAAA;AAAA,YACT;AAAA,UACF,CAAC,CAAA;AACH,UAAA,IAAI,qBAAqB,mBAAA,EAAqB;AAC5C,YAAA,GAAA,CAAI,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAE,CAAA;AAChC,YAAA;AAAA,UACF;AACA,UAAA,GAAA,CAAI,CAAA,YAAA,EAAe,GAAG,CAAA,kBAAA,CAAoB,CAAA;AAAA,QAE5C;AAAA,MACF;AAAA,IACF;AAIA,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,YAAY,KAAA,EAAO,YAAA,EAAc,MAAM,GAAG,CAAA;AAC9D,IAAA,IAAI,OAAA,EAAS,QAAA,CAAS,IAAA,CAAK,iBAAA,CAAkB,KAAK,CAAC,CAAA;AAGnD,IAAA,MAAM,SAAA,GAAY,QAAQ,GAAG,CAAA;AAC7B,IAAA,IAAI,SAAA,IAAaF,UAAAA,CAAW,SAAS,CAAA,EAAG;AACtC,MAAA,MAAM,OAAO,WAAA,CAAY,SAAA,EAAW,MAAM,IAAA,EAAM,YAAA,EAAc,eAAe,GAAG,CAAA;AAChF,MAAA,IAAI,UAAA,CAAW,IAAA,EAAM,SAAS,CAAA,EAAG;AAC/B,QAAA,GAAA,CAAI,CAAA,UAAA,EAAa,GAAG,CAAA,CAAE,CAAA;AAAA,MACxB,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,CAAA,mBAAA,EAAsB,GAAG,CAAA,CAAE,CAAA;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,QAAA;AACT;AAeO,SAAS,iBAAA,CAAkB,OAAwB,IAAA,EAAoC;AAC5F,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AAC9C,EAAA,MAAM,cAAA,GAAiB,aAAa,OAAA,EAAS,YAAA,EAAc,KAAK,MAAA,IAAU,KAAA,EAAO,KAAK,GAAG,CAAA;AACzF,EAAA,MAAM,UAAU,WAAA,CAAYJ,IAAAA,CAAK,MAAA,EAAO,EAAG,oBAAoB,CAAC,CAAA;AAChE,EAAA,IAAI;AACF,IAAA,MAAM,cAAA,GAAiBA,IAAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AAC7C,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,MAAM,CAAA,CAAE,WAAA,EAAY,GAAI,KAAA,CAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA;AACzF,IAAA,MAAM,QAAA,GAAW,YAAA;AAAA,MACf,MAAA;AAAA,MACA,cAAA;AAAA,MACA,aAAA;AAAA,MACA,YAAA;AAAA,MACA,cAAA,CAAe,YAAY,CAAA,EAAG,KAAA,CAAM,KAAA,IAAS,EAAA;AAAA,MAC7C,KAAA,CAAM,IAAA;AAAA;AAAA,MACiB,KAAA;AAAA,0BACnB,GAAA,EAAY;AAAA,MAChB,yBAAyB,aAAa;AAAA,KACxC;AACA,IAAA,IAAI,QAAA,CAAS,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAG1C,IAAA,MAAM,QAA2C,EAAC;AAClD,IAAA,KAAA,MAAW,CAAC,YAAA,EAAc,YAAY,CAAA,IAAK;AAAA,MACzC,CAAC,gBAAgB,cAAc,CAAA;AAAA,MAC/B,CAACA,IAAAA,CAAK,OAAA,EAAS,kBAAkB,CAAA,EAAGA,KAAK,OAAA,CAAQ,cAAc,CAAA,EAAG,kBAAkB,CAAC;AAAA,KACvF,EAAY;AACV,MAAA,IAAI,CAACI,UAAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,YAAY,CAAA,EAAG;AAC5C,QAAA,KAAA,CAAM,IAAA,CAAK,CAACJ,IAAAA,CAAK,YAAA,EAAc,IAAI,GAAGA,IAAAA,CAAK,YAAA,EAAc,IAAI,CAAC,CAAC,CAAA;AAAA,MACjE;AAAA,IACF;AACA,IAAA,IAAI,CAAC,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,IAAI,CAAA,KAAMI,UAAAA,CAAW,IAAI,CAAC,CAAA,EAAG,OAAO,IAAA;AAEtD,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,EAAE,CAAA,IAAK,KAAA,EAAO;AAC9B,MAAA,MAAM,CAAA,GAAI,SAAA,CAAU,MAAA,EAAQ,CAAC,MAAA,EAAQ,IAAA,EAAM,EAAE,CAAA,EAAG,EAAE,QAAA,EAAU,MAAA,EAAQ,CAAA;AACpE,MAAA,IAAI,EAAE,MAAA,KAAW,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,EAAE,MAAM,CAAA;AAAA,WAAA,IAC9B,CAAA,CAAE,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,sBAAA,EAAyB,MAAM,IAAI,CAAA,EAAA,EAAK,EAAE,MAAA,IAAU,CAAA,CAAE,KAAA,EAAO,OAAA,IAAW,eAAe,CAAA;AAAA,SACzF;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA,CAAE,MAAM,CAAA,EAAG,OAAO,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,CAAA,QAAA,EAAW,GAAG,CAAA,CAAE,CAAA;AAAA,EACvE,CAAA,SAAE;AACA,IAAA,MAAA,CAAO,SAAS,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,EAClD;AACF;AAaO,SAAS,WAAA,CAAY,IAAA,EAAc,IAAA,EAAc,IAAA,EAA8B;AACpF,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,aAAA;AAC1C,EAAA,MAAM,aAAA,GAAgB,KAAK,MAAA,IAAU,KAAA;AACrC,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AAGjB,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AACrD,EAAA,IAAI,CAAC,WAAW,OAAO,KAAA;AACvB,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,KAAA,MAAW,QAAQ,aAAA,CAAc,SAAA,EAAW,MAAM,YAAA,EAAc,aAAA,EAAe,GAAG,CAAA,EAAG;AACnF,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,UAAU,IAAI,CAAA;AACxB,MAAA,IAAI,CAAA,CAAE,cAAA,EAAe,EAAG,UAAA,CAAW,IAAI,CAAA;AAAA,kBAC3B,IAAA,EAAM,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAClD,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI,cAAc,OAAA,EAAS;AAEzB,IAAA,MAAM,QAAA,GAAW,YAAA,CAAa,SAAA,EAAW,YAAA,EAAc,eAAe,GAAG,CAAA;AACzE,IAAA,MAAM,MAAA,GAAS,CAACJ,IAAAA,CAAK,OAAA,CAAQ,QAAQ,GAAG,kBAAA,EAAoB,CAAA,EAAG,IAAI,CAAA,GAAA,CAAK,CAAC,CAAA;AACzE,IAAA,IAAI,CAAC,aAAA,EAAe,MAAA,CAAO,IAAA,CAAKA,IAAAA,CAAK,mBAAA,CAAoB,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAK,CAAA,EAAG,IAAI,CAAC,CAAA;AACrF,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,IAAII,UAAAA,CAAW,KAAK,CAAA,EAAG;AACrB,QAAA,MAAA,CAAO,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAC9C,QAAA,OAAA,GAAU,IAAA;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAKA,SAAS,gBAAA,CAAiB,IAAA,EAAc,WAAA,EAAqB,IAAA,EAAsB;AAGjF,EAAA,OAAO,CAAA;AAAA,OAAA,EACA,IAAI,CAAA;AAAA,aAAA,EACE,IAAA,CAAK,SAAA,CAAU,WAAW,CAAC;AAAA;AAAA;AAAA;;AAAA,EAAA,EAKtC,IAAI;;AAAA,EAEN,IAAI;AAAA,CAAA;AAEN;AAGA,SAAS,aAAA,CAAc,MAAc,WAAA,EAA6B;AAChE,EAAA,OAAO,CAAA;AAAA,OAAA,EACA,IAAI,CAAA;AAAA;AAAA,aAAA,EAEE,IAAA,CAAK,SAAA,CAAU,WAAW,CAAC;AAAA;AAAA,CAAA;AAG1C;AAEA,SAAS,aAAa,IAAA,EAAsB;AAC1C,EAAA,OAAO,KAAK,IAAI;;AAAA,EAEhB,sBAAsB;AAAA,CAAA;AAExB;AAEA,SAAS,cAAA,CAAe,MAAc,WAAA,EAA6B;AACjE,EAAA,OAAO,SAAS,IAAI;AAAA,aAAA,EACP,IAAA,CAAK,SAAA,CAAU,WAAW,CAAC;AAAA;AAAA;AAAA,SAAA,EAG/B,2BAA2B;AAAA,CAAA;AAEtC;AAEA,SAAS,YAAA,CAAa,MAAc,WAAA,EAA6B;AAC/D,EAAA,OAAO,QAAQ,IAAI,CAAA;AAAA;AAAA,OAAA,EAEZ,IAAI,CAAA;AAAA,aAAA,EACE,IAAA,CAAK,SAAA,CAAU,WAAW,CAAC;;AAAA;AAAA;;AAAA;AAAA,CAAA;AAO1C;AAGO,IAAM,iBAAiB,CAAC,OAAA,EAAS,SAAS,QAAA,EAAU,MAAA,EAAQ,UAAU,UAAU;AA4BhF,SAAS,eACd,IAAA,EACA,IAAA,EACA,OAAA,EACA,IAAA,GAAwB,EAAC,EACM;AAC/B,EAAA,IAAI,CAAE,cAAA,CAAqC,QAAA,CAAS,IAAI,CAAA,EAAG;AACzD,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAM,CAAA,sBAAA,EAAyB,IAAI,gBAAgB,cAAA,CAAe,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,KAC9E;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAOJ,IAAAA,CAAK,OAAA,EAAS,IAAI,CAAA;AAC/B,EAAA,IAAII,UAAAA,CAAW,IAAI,CAAA,EAAG;AACpB,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,IAAA,EAAM,cAAc,IAAI,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,EAAG;AAAA,EAC/E;AACA,EAAA,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAEnC,EAAA,MAAM,aAAA,GACJ,IAAA,CAAK,WAAA,KACJ,CAAC,SAAS,UAAA,EAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,GAC1C,CAAA,EAAG,oCAAoC,CAAA,eAAA,EAAkB,IAAI,CAAA,CAAA,CAAA,GAC7D,6BAAA,CAAA;AAEN,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,aAAA;AAAA,MACEJ,IAAAA,CAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,YAAA,CAAc,CAAA;AAAA,MAChC,cAAA,CAAe,IAAA,EAAM,IAAA,CAAK,WAAA,IAAe,8BAA8B,CAAA;AAAA,MACvE;AAAA,KACF;AAAA,EACF,CAAA,MAAA,IAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,aAAA;AAAA,MACEA,IAAAA,CAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,UAAA,CAAY,CAAA;AAAA,MAC9B,YAAA,CAAa,IAAA,EAAM,IAAA,CAAK,WAAA,IAAe,kBAAkB,CAAA;AAAA,MACzD;AAAA,KACF;AAAA,EACF,CAAA,MAAA,IAAW,SAAS,QAAA,EAAU;AAC5B,IAAA,aAAA;AAAA,MACEA,IAAAA,CAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,UAAA,CAAY,CAAA;AAAA,MAC9B,gBAAA,CAAiB,IAAA,EAAM,aAAA,EAAe,uBAAuB,CAAA;AAAA,MAC7D;AAAA,KACF;AAAA,EACF,CAAA,MAAA,IAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,aAAA,CAAcA,IAAAA,CAAK,MAAM,YAAY,CAAA,EAAG,cAAc,IAAA,EAAM,aAAa,GAAG,MAAM,CAAA;AAClF,IAAA,aAAA,CAAcA,KAAK,IAAA,EAAM,SAAS,GAAG,YAAA,CAAa,IAAI,GAAG,MAAM,CAAA;AAAA,EACjE,CAAA,MAAA,IAAW,SAAS,UAAA,EAAY;AAC9B,IAAA,aAAA;AAAA,MACEA,IAAAA,CAAK,MAAM,aAAa,CAAA;AAAA,MACxB,gBAAA,CAAiB,IAAA,EAAM,aAAA,EAAe,yBAAyB,CAAA;AAAA,MAC/D;AAAA,KACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,aAAA;AAAA,MACEA,IAAAA,CAAK,MAAM,UAAU,CAAA;AAAA,MACrB,gBAAA,CAAiB,IAAA,EAAM,aAAA,EAAe,sBAAsB,CAAA;AAAA,MAC5D;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,IAAA,EAAK;AAChC","file":"chunk-PE36IF2D.js","sourcesContent":["/**\n * Agent installation — renders a GitAgent package (agent.yaml + SOUL.md + RULES.md)\n * into the framework-native format (`.claude/agents/<name>.md`, `.omp/agents/<name>/`,\n * `.codex/agents/<name>.toml`) and resolves abilities, contracts, fragments, and\n * prompt extensions from the workspace config along the way.\n *\n * System prompt phases (per agent):\n *   1. extends merge     — inherit from parent agent.yaml if manifest.extends is set\n *   2. instance overrides — model / budget / lifecycle of the `skaile.yaml` instance\n *   3. ability refs      — read SKILL.md frontmatter of the composed skills\n *   4. contract refs     — locate CONTRACT.md files of the composed contracts\n *   5. fragments         — resolve framework fragments (agent-mode, handoff, etc.)\n *   6. prompt-extensions — load per-project markdown extensions from skaile.yaml\n *\n * Used by `installer.ts` (the asset-install path, one agent asset under its own\n * name) and `install-instances.ts` (`skaile install`, one rendering per\n * `skaile.yaml` agent instance, named by the instance id). Sub-agents composed as\n * `composes: [{ kind: agent }]` (binding `delegate`, the default) are installed\n * flat (no nesting) in the same deploy directory; `binding: run` sub-agents are\n * host-executed and get no native file.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { basename, join, relative, resolve } from \"node:path\";\nimport type { AgentInstanceConfig, DriverTarget, SkWorkspaceConfig } from \"@skaile/workspaces/core\";\nimport {\n  AGENT_INSTANCE_ID_PATTERN,\n  DRIVER_TARGETS,\n  parseFrontmatter as parseMarkdownFrontmatter,\n  parseAssetRefLoose,\n  resolveAgentDefinitionDir,\n} from \"@skaile/workspaces/core\";\nimport type { AgentComposeItem, AgentLifecycle } from \"@skaile/workspaces/types/manifests\";\nimport { parse as parseYaml } from \"yaml\";\nimport {\n  type AbilityRef,\n  type ConnectorRef,\n  type ContractRef,\n  type FragmentContext,\n  loadPromptExtensions,\n  resolveFragments,\n} from \"./fragments.js\";\nimport { type AgentManifest, type AgentRenderInput, renderAgentToFramework } from \"./renderers.js\";\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\n/** Source file of the legacy markdown agent form: frontmatter + the system prompt as body. */\nconst AGENT_MD_FILE = \"AGENT.md\";\n\n/** A Claude-style `tools:` value (`\"Read, Grep\"` or a list) as the manifest's `tools.allowed`. */\nfunction toolsFromMarkdown(value: unknown): AgentManifest[\"tools\"] | undefined {\n  if (Array.isArray(value)) return { allowed: value.map(String) };\n  if (typeof value === \"string\") {\n    const allowed = value.split(/[,\\s]+/).filter(Boolean);\n    return allowed.length > 0 ? { allowed } : undefined;\n  }\n  return value && typeof value === \"object\" ? (value as AgentManifest[\"tools\"]) : undefined;\n}\n\n/**\n * The `AGENT.md` form of an agent as a manifest: the frontmatter, with the\n * Claude-style scalar `model:` / `tools:` shapes mapped to the manifest's\n * `model.preferred` / `tools.allowed`, and `metadata.version` read as `version`.\n */\nfunction readAgentMdManifest(agentDir: string): { manifest: AgentManifest; body: string } | null {\n  const mdPath = join(agentDir, AGENT_MD_FILE);\n  if (!existsSync(mdPath)) return null;\n  try {\n    const { data, body } = parseMarkdownFrontmatter(readFileSync(mdPath, \"utf-8\"));\n    const meta = data.metadata as { version?: unknown } | undefined;\n    const manifest: Record<string, unknown> = { ...data };\n    if (manifest.version === undefined && meta?.version !== undefined) {\n      manifest.version = String(meta.version);\n    }\n    if (typeof data.model === \"string\") manifest.model = { preferred: data.model };\n    if (data.tools !== undefined) manifest.tools = toolsFromMarkdown(data.tools);\n    return { manifest: manifest as AgentManifest, body };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The agent's manifest: `agent.yaml`, else the frontmatter of the legacy\n * `AGENT.md`. `null` when the directory holds neither (or it cannot be parsed).\n */\nexport function readManifest(agentDir: string): AgentManifest | null {\n  const yamlPath = join(agentDir, \"agent.yaml\");\n  if (!existsSync(yamlPath)) return readAgentMdManifest(agentDir)?.manifest ?? null;\n  try {\n    return parseYaml(readFileSync(yamlPath, \"utf-8\")) as AgentManifest;\n  } catch {\n    return null;\n  }\n}\n\nfunction readFile(agentDir: string, name: string): string | null {\n  const p = join(agentDir, name);\n  if (!existsSync(p)) return null;\n  try {\n    return readFileSync(p, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The agent's identity text: `SOUL.md`; for an `AGENT.md` agent the markdown body\n * comes first, so a `SOUL.md` next to it extends the prompt rather than replacing it.\n */\nexport function readSoul(agentDir: string): string | null {\n  const soul = readFile(agentDir, \"SOUL.md\");\n  if (existsSync(join(agentDir, \"agent.yaml\"))) return soul;\n  const body = readAgentMdManifest(agentDir)?.body;\n  if (!body) return soul;\n  return soul ? `${body}\\n\\n${soul}` : body;\n}\n\n/**\n * A name becomes a file or directory name under the deploy dir; one with a path\n * segment (`../x`, `a/b`) would write outside it. Refused, never sanitized.\n */\nfunction isSafeFileName(name: string): boolean {\n  return name.length > 0 && name !== \".\" && name !== \"..\" && !/[\\\\/\\0]/.test(name);\n}\n\n/** Extract YAML frontmatter from a markdown file (content between first two --- delimiters). */\nfunction parseFrontmatter(content: string): Record<string, unknown> {\n  const match = content.match(/^---\\n([\\s\\S]*?)\\n---/);\n  if (!match) return {};\n  try {\n    return (parseYaml(match[1]!) as Record<string, unknown>) ?? {};\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Merge parent and child agent manifests.\n * Scalars: child wins. Arrays: parent + child, deduplicated (`composes` by\n * kind + ref + slot id, other arrays by value).\n */\nfunction mergeManifests(parent: AgentManifest, child: AgentManifest): AgentManifest {\n  const result: AgentManifest = { ...parent };\n  for (const [k, val] of Object.entries(child) as [keyof AgentManifest, unknown][]) {\n    if (val === undefined) continue;\n    const parentVal = result[k as keyof AgentManifest];\n    if (k === \"composes\" && Array.isArray(val) && Array.isArray(parentVal)) {\n      const merged = new Map<string, AgentComposeItem>();\n      for (const item of [...parentVal, ...val] as AgentComposeItem[]) {\n        merged.set(`${item.kind}\\u0000${item.ref}\\u0000${item.id ?? \"\"}`, item);\n      }\n      result.composes = [...merged.values()];\n    } else if (Array.isArray(val) && Array.isArray(parentVal)) {\n      (result as Record<string, unknown>)[k] = [...new Set([...parentVal, ...val])];\n    } else {\n      (result as Record<string, unknown>)[k] = val;\n    }\n  }\n  return result;\n}\n\n/**\n * Phase 1: inherit scalars/arrays from a parent agent when `manifest.extends` is set.\n * Returns the (possibly merged) manifest; pushes a warning when the parent is missing.\n */\nfunction applyExtendsMerge(\n  manifest: AgentManifest,\n  srcDir: string,\n  warnings: string[],\n): AgentManifest {\n  if (!manifest.extends) return manifest;\n  const parentDir = resolve(srcDir, manifest.extends);\n  const parentManifest = readManifest(parentDir);\n  if (parentManifest) {\n    return mergeManifests(parentManifest, manifest);\n  }\n  warnings.push(\n    `extends: parent agent not found at \"${manifest.extends}\" (from ${srcDir}) — skipping inheritance`,\n  );\n  return manifest;\n}\n\n/**\n * Phase 2: apply the instance's overrides to the asset's manifest — the model\n * selector, the turn budget (`budget.max_turns` → `runtime.max_turns`) and the\n * lifecycle. Returns the effective manifest and lifecycle.\n */\nfunction applyInstanceOverrides(\n  manifest: AgentManifest,\n  instance: AgentInstanceConfig | undefined,\n): { manifest: AgentManifest; lifecycle: AgentLifecycle } {\n  const lifecycle = instance?.lifecycle ?? manifest.lifecycle ?? \"standing\";\n  if (!instance) return { manifest, lifecycle };\n  const effective: AgentManifest = { ...manifest, lifecycle };\n  if (instance.model) {\n    effective.model = { ...manifest.model, ...instance.model } as AgentManifest[\"model\"];\n  }\n  if (instance.budget?.max_turns !== undefined) {\n    effective.runtime = { ...manifest.runtime, max_turns: instance.budget.max_turns };\n  }\n  return { manifest: effective, lifecycle };\n}\n\n/**\n * The name a composed asset is installed under: the asset name of a canonical\n * ref (`skill:@pub/name#1.0.0` → `name`), else the last path segment\n * (`./skills/name` → `name`).\n */\nfunction composeRefName(ref: string): string {\n  const parsed = parseAssetRefLoose(ref);\n  if (parsed) return parsed.name;\n  const tail = ref.replace(/\\/+$/, \"\").split(\"/\").pop() ?? ref;\n  return tail.replace(/^[a-z-]+:/, \"\").replace(/#.*$/, \"\") || ref;\n}\n\n/** Names of the composed items of `kind`, in declaration order, de-duplicated. */\nfunction composedNames(manifest: AgentManifest, kind: string): string[] {\n  const names = (manifest.composes ?? [])\n    .filter((item) => item.kind === kind)\n    .map((item) => composeRefName(item.ref));\n  return [...new Set(names)];\n}\n\n/**\n * The MCP servers an agent's `mcp-server` slots are bound to: the server the\n * instance's `connectors` map binds the slot id to, else the composed asset's\n * own name (the id its server is rendered under).\n */\nfunction boundMcpServers(\n  manifest: AgentManifest,\n  instance: AgentInstanceConfig | undefined,\n): string[] {\n  const names = (manifest.composes ?? [])\n    .filter((item) => item.kind === \"mcp-server\")\n    .map(\n      (item) => (item.id ? instance?.connectors?.[item.id] : undefined) ?? composeRefName(item.ref),\n    );\n  return [...new Set(names)];\n}\n\n/** Phase 3: resolve ability refs — read description from the installed SKILL.md of each composed skill. */\nfunction resolveAbilityRefs(\n  manifest: AgentManifest,\n  workspaceRoot: string,\n  skillsRelDir: string,\n): AbilityRef[] {\n  const abilityRefs: AbilityRef[] = [];\n  for (const name of composedNames(manifest, \"skill\")) {\n    const skillMdPath = join(workspaceRoot, skillsRelDir, name, \"SKILL.md\");\n    if (!existsSync(skillMdPath)) continue;\n    try {\n      const fm = parseFrontmatter(readFileSync(skillMdPath, \"utf-8\"));\n      const desc = typeof fm.description === \"string\" ? fm.description : undefined;\n      if (desc) abilityRefs.push({ name, description: desc });\n    } catch {\n      // skip unreadable SKILL.md\n    }\n  }\n  return abilityRefs;\n}\n\n/** Phase 4: resolve contract refs — locate the CONTRACT.md of each composed contract in the skills dir. */\nfunction resolveContractRefs(\n  manifest: AgentManifest,\n  workspaceRoot: string,\n  skillsRelDir: string,\n): ContractRef[] {\n  const contractRefs: ContractRef[] = [];\n  for (const name of composedNames(manifest, \"contract\")) {\n    const contractAbsPath = join(workspaceRoot, skillsRelDir, name, \"CONTRACT.md\");\n    if (!existsSync(contractAbsPath)) continue;\n    contractRefs.push({ name, relativePath: relative(workspaceRoot, contractAbsPath) });\n  }\n  return contractRefs;\n}\n\n/** A `kind: agent` composition item rendered as its own native sub-agent file. */\ninterface DelegateSubAgent {\n  /** `composes[].ref` as written. */\n  ref: string;\n  /** Absolute path of the sub-agent's source directory. */\n  srcDir: string;\n  /** File name: the item's `as`, else the sub-agent's own `name`. */\n  name: string;\n  /** `composes[].as`, forwarded as the install name override. */\n  alias: string | undefined;\n}\n\n/**\n * Phase 5a: the `delegate` sub-agents of an agent — its `kind: agent` items\n * whose binding is not `run` (`delegate` is the default for the harnesses that\n * render native agent files). Catalog refs resolve like `agents.<id>.ref`;\n * anything else is a path relative to the composing agent's directory. An\n * unresolvable item is skipped with a warning.\n */\nfunction resolveDelegates(\n  manifest: AgentManifest,\n  agentName: string,\n  srcDir: string,\n  workspaceRoot: string,\n  warnings: string[],\n): DelegateSubAgent[] {\n  const delegates: DelegateSubAgent[] = [];\n  for (const item of manifest.composes ?? []) {\n    if (item.kind !== \"agent\" || item.binding === \"run\") continue;\n    let subSrc: string | undefined;\n    try {\n      subSrc =\n        item.ref.startsWith(\"agent:\") || item.ref.startsWith(\"ai-assets://\")\n          ? resolveAgentDefinitionDir(workspaceRoot, item.ref)\n          : resolve(srcDir, item.ref);\n    } catch (err) {\n      warnings.push(\n        `Sub-agent ${item.ref} (from ${agentName}): ${err instanceof Error ? err.message : String(err)}`,\n      );\n      continue;\n    }\n    if (!subSrc || !existsSync(subSrc)) {\n      warnings.push(`Sub-agent source not found: ${item.ref} (from ${agentName})`);\n      continue;\n    }\n    const sub = readManifest(subSrc);\n    const name = item.as ?? sub?.name ?? basename(subSrc);\n    // The name is a file name under the deploy dir: refuse anything that is not a plain id.\n    if (typeof name !== \"string\" || !AGENT_INSTANCE_ID_PATTERN.test(name)) {\n      warnings.push(\n        `Sub-agent ${item.ref} (from ${agentName}): name ${JSON.stringify(name)} must match ${AGENT_INSTANCE_ID_PATTERN} — skipped`,\n      );\n      continue;\n    }\n    delegates.push({\n      ref: item.ref,\n      srcDir: subSrc,\n      name,\n      alias: item.as,\n    });\n  }\n  return delegates;\n}\n\n/** Phase 5b: assemble the fragment context from the manifest, workspace config, and resolved refs. */\nfunction buildFragmentContext(\n  subAgentNames: string[],\n  driverTarget: string,\n  skillsRelDir: string,\n  wsConfig: SkWorkspaceConfig | undefined,\n  abilityRefs: AbilityRef[],\n  contractRefs: ContractRef[],\n): FragmentContext {\n  const connectors: ConnectorRef[] = (wsConfig?.connectors ?? []).map((c) => ({\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-write\",\n  }));\n\n  const agentsRelDir = DRIVER_TARGETS[driverTarget as DriverTarget]?.local.agent ?? \"\";\n\n  return {\n    framework: driverTarget,\n    skillsDir: skillsRelDir,\n    agentsDir: agentsRelDir,\n    subAgents: subAgentNames,\n    connectors,\n    abilityRefs,\n    contractRefs,\n  };\n}\n\n// ── Core installation ─────────────────────────────────────────────────────────\n\n/**\n * Install a single GitAgent source directory using the appropriate renderer.\n *\n * When `includeSubAgents` is `true`, recursively installs the `delegate`\n * sub-agents (`composes: [{ kind: agent }]`) as separate flat agents in the\n * same deploy directory (no nesting). Tracks visited directories to prevent\n * infinite loops in sub-agent cycles.\n *\n * @param srcDir - Absolute path to the GitAgent source directory (contains `agent.yaml`).\n * @param agentDeployDir - Absolute path to the framework's agent deploy directory.\n * @param workspaceRoot - Absolute path to the workspace root.\n * @param driverTarget - Agent framework ID used to select the renderer.\n * @param skillsRelDir - Relative path to the installed skills dir (e.g. `\".claude/skills\"`).\n * @param nameOverride - Override name for the installed agent. Defaults to `manifest.name`;\n *   an instance render passes the instance id.\n * @param includeSubAgents - When `true`, recursively install `delegate` sub-agents.\n * @param visited - Set of resolved source paths already processed (cycle guard).\n * @param wsConfig - Workspace config from `skaile.yaml` (fragments, connectors, extensions).\n * @param log - Optional logger callback for progress messages.\n * @param instance - The `skaile.yaml` instance being rendered; its model / budget / lifecycle\n *   override the asset's and its `connectors` map binds the `mcp-server` slots.\n * @returns Object with `created` file paths (every rendered file), `changed` (the subset whose\n *   bytes differ from what was deployed before) and `warnings` list.\n * @docLink packages/asset-manager/concepts#install-agent\n */\nexport function installAgent(\n  srcDir: string,\n  agentDeployDir: string,\n  workspaceRoot: string,\n  driverTarget: string,\n  /** Relative path to the installed skills dir (e.g. \".claude/skills\") */\n  skillsRelDir: string,\n  nameOverride: string | undefined,\n  includeSubAgents: boolean,\n  visited: Set<string>,\n  wsConfig: SkWorkspaceConfig | undefined,\n  log?: (msg: string) => void,\n  instance?: AgentInstanceConfig,\n): { created: string[]; changed: string[]; warnings: string[] } {\n  const created: string[] = [];\n  const changed: string[] = [];\n  const warnings: string[] = [];\n\n  const realSrc = resolve(srcDir);\n  if (visited.has(realSrc)) return { created, changed, warnings };\n  visited.add(realSrc);\n\n  const initialManifest = readManifest(srcDir);\n  if (!initialManifest) {\n    warnings.push(`${srcDir} has no agent.yaml or AGENT.md — skipping (not an agent package)`);\n    return { created, changed, warnings };\n  }\n\n  // Phase 1: extends merge — inherit scalars/arrays from parent agent\n  // Phase 2: instance overrides — model / budget / lifecycle\n  const { manifest, lifecycle } = applyInstanceOverrides(\n    applyExtendsMerge(initialManifest, srcDir, warnings),\n    instance,\n  );\n\n  const agentName = nameOverride ?? manifest.name ?? basename(srcDir);\n  if (typeof agentName !== \"string\" || !isSafeFileName(agentName)) {\n    warnings.push(\n      `${srcDir}: agent name ${JSON.stringify(agentName)} is not a valid file name (no path separators) — skipping`,\n    );\n    return { created, changed, warnings };\n  }\n\n  log?.(`Installing git-agent: ${agentName} (${driverTarget})`);\n\n  // Phase 3: resolve ability refs — read description from installed SKILL.md files\n  const abilityRefs = resolveAbilityRefs(manifest, workspaceRoot, skillsRelDir);\n\n  // Phase 4: resolve contract refs — locate CONTRACT.md files in the skills dir\n  const contractRefs = resolveContractRefs(manifest, workspaceRoot, skillsRelDir);\n\n  // Phase 5: delegate sub-agents, fragment context, framework fragments + prompt extensions\n  const delegates = resolveDelegates(manifest, agentName, srcDir, workspaceRoot, warnings);\n  const fragmentCtx = buildFragmentContext(\n    delegates.map((d) => d.name),\n    driverTarget,\n    skillsRelDir,\n    wsConfig,\n    abilityRefs,\n    contractRefs,\n  );\n\n  const frameworkFragments = resolveFragments(\n    fragmentCtx,\n    wsConfig?.agent?.fragments,\n    workspaceRoot,\n  );\n  const promptExtensions = loadPromptExtensions(\n    wsConfig?.agent?.[\"prompt-extensions\"],\n    workspaceRoot,\n  );\n\n  const input: AgentRenderInput = {\n    manifest,\n    soul: readSoul(srcDir),\n    rules: readFile(srcDir, \"RULES.md\"),\n    duties: readFile(srcDir, \"DUTIES.md\"),\n    agentName,\n    agentDeployDir,\n    workspaceRoot,\n    abilityRefs,\n    contractRefs,\n    frameworkFragments,\n    promptExtensions,\n    lifecycle,\n    skills: composedNames(manifest, \"skill\"),\n    mcpServers: boundMcpServers(manifest, instance),\n  };\n\n  const result = renderAgentToFramework(input, driverTarget, log);\n  created.push(...result.created);\n  changed.push(...result.changed);\n  warnings.push(...result.warnings);\n\n  // Recursively install delegate sub-agents as flat top-level agents\n  if (includeSubAgents) {\n    for (const delegate of delegates) {\n      const sub = installAgent(\n        delegate.srcDir,\n        agentDeployDir,\n        workspaceRoot,\n        driverTarget,\n        skillsRelDir,\n        delegate.alias, // undefined → the sub-agent's own name from its agent.yaml\n        includeSubAgents,\n        visited,\n        wsConfig,\n        log,\n      );\n      created.push(...sub.created);\n      changed.push(...sub.changed);\n      warnings.push(...sub.warnings);\n    }\n  }\n\n  return { created, changed, warnings };\n}\n","/**\n * Asset deployment — copies assets into framework dirs by default (self-contained,\n * cache-safe, portable); `--link` opts into a symlink for the local-path dev loop.\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport {\n  cpSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  mkdtempSync,\n  readdirSync,\n  rmSync,\n  statSync,\n  symlinkSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { basename, dirname, join, relative, resolve, sep } from \"node:path\";\nimport type {\n  AiComponent,\n  CatalogEntry,\n  DriverTarget,\n  SourceDeclaration,\n} from \"@skaile/workspaces/core\";\nimport {\n  agentSourceCacheDir,\n  applyPatch,\n  assetRefToStr,\n  computeHash,\n  DRIVER_TARGETS,\n  deployedBase,\n  deployedDir,\n  deployedPaths,\n  isDeployed,\n  resolveSkWorkspaceConfig,\n} from \"@skaile/workspaces/core\";\nimport {\n  isNonAssetDir,\n  isNonAssetFile,\n  listSkippedSymlinks,\n} from \"@skaile/workspaces/core/publish-manifest\";\nimport {\n  AGENT_BODY_PLACEHOLDER,\n  CONTRACT_BODY_PLACEHOLDER,\n  PRESET_DESCRIPTION_PLACEHOLDER,\n  PRESET_ITEM_PLACEHOLDER_REF,\n  PROMPT_BODY_PLACEHOLDER,\n  SKILL_BODY_PLACEHOLDER,\n  SKILL_DESCRIPTION_PLACEHOLDER,\n  SKILL_DESCRIPTION_PLACEHOLDER_PREFIX,\n} from \"@skaile/workspaces/types/manifests\";\nimport type { IAssetKindProvider, IAssetKindRegistry } from \"@skaile/workspaces/plugins\";\nimport { stringify as stringifyYaml } from \"yaml\";\nimport { installAgent, readManifest, readSoul } from \"./install-agent.js\";\nimport { CODEX_IDENTITY_DIR, type Log } from \"./renderers.js\";\n\nexport type { Log } from \"./renderers.js\";\n\nconst noop: Log = () => {};\n\n/**\n * The printable canonical ref of a resolved entry — `kind:@publisher/name#version`,\n * the one ref grammar the CLI shows. An entry whose `publisher` is a clone key\n * carries the real ref in `canonicalRef`; with neither a `canonicalRef` nor a\n * publisher there is nothing to namespace it by, so it falls back to `kind:name`.\n */\nexport function canonicalEntryRef(entry: CatalogEntry): string {\n  if (entry.canonicalRef) return entry.canonicalRef;\n  const publisher = entry.publisher?.replace(/^@/, \"\");\n  if (!publisher) return `${entry.kind}:${entry.name}`;\n  return assetRefToStr({\n    kind: entry.kind,\n    name: entry.name,\n    publisher,\n    pin: entry.version || undefined,\n  });\n}\n\n// ── Filesystem helpers ────────────────────────────────────────────────────────\n\nfunction clearDest(dest: string): void {\n  try {\n    const s = lstatSync(dest);\n    if (s.isSymbolicLink()) unlinkSync(dest);\n    else rmSync(dest, { recursive: true, force: true });\n  } catch {}\n}\n\n/**\n * The harness component directory a kind installs into — the provider's\n * `installTarget` — or `undefined` for composition-only kinds (connector,\n * mcp-server, knowledge, persona, ruleset, preset) and unregistered kinds.\n * The registry is the only authority: there is no static list of deployable kinds.\n */\nexport function installTargetOf(\n  registry: IAssetKindRegistry,\n  kind: string,\n): AiComponent | undefined {\n  return registry.getProvider(kind)?.installTarget;\n}\n\n/**\n * The manifest file of a resolved entry. `source` is normally the manifest file\n * itself; a directory source is searched for the provider's manifest.\n * `undefined` when `source` is a directory holding none.\n */\nfunction manifestFileOf(provider: IAssetKindProvider, source: string): string | undefined {\n  if (!statSync(source).isDirectory()) return source;\n  const hit = readdirSync(source).find((f) => provider.matchesPath(f));\n  return hit ? join(source, hit) : undefined;\n}\n\n/**\n * A resolved entry ready to deploy: a {@link CatalogEntry} that may carry the\n * asset's authoritative file list.\n */\nexport interface DeployableEntry extends CatalogEntry {\n  /**\n   * Asset files relative to the manifest's directory. Set for store-staged\n   * assets, whose verified pointer (not the provider's default filter) defines\n   * what the asset is — a manifest-mode publish may list files the default filter\n   * would not pick. Absent → the provider's `defaultFileFilter`.\n   */\n  files?: readonly string[];\n}\n\n/**\n * Copy an asset into `dest`: the entry's explicit `files` when it has them, else\n * exactly the files the provider's `defaultFileFilter` selects (the same set the\n * store publishes and hashes). A directory source without a recognisable\n * manifest is copied whole.\n */\nfunction copyAsset(\n  provider: IAssetKindProvider,\n  entry: DeployableEntry,\n  dest: string,\n  onSkippedSymlink?: (entry: DeployableEntry, path: string) => void,\n): void {\n  const source = entry.source;\n  clearDest(dest);\n  const manifestPath = manifestFileOf(provider, source);\n  if (!manifestPath) {\n    // Same ignore list as the content hash: leftovers and symlinks are not part of the asset.\n    cpSync(source, dest, {\n      recursive: true,\n      filter: (src) => {\n        if (src === source) return true;\n        if (isNonAssetDir(basename(src)) || isNonAssetFile(basename(src))) return false;\n        if (lstatSync(src).isSymbolicLink()) {\n          onSkippedSymlink?.(entry, join(basename(source), relative(source, src)));\n          return false;\n        }\n        return true;\n      },\n    });\n    return;\n  }\n  const filter = provider.defaultFileFilter(manifestPath);\n  const assetRoot = filter.assetRoot;\n  const files = entry.files ?? filter.files;\n  mkdirSync(dest, { recursive: true });\n  for (const rel of files) {\n    const target = join(dest, rel);\n    mkdirSync(dirname(target), { recursive: true });\n    cpSync(join(assetRoot, rel), target);\n  }\n  // A lone manifest file shares its directory with other assets: only an asset that owns its\n  // directory (several files, or a directory named after it) can say which links it drops.\n  if (onSkippedSymlink && (files.length > 1 || basename(assetRoot) === entry.name)) {\n    for (const rel of listSkippedSymlinks(assetRoot)) {\n      onSkippedSymlink(entry, join(basename(assetRoot), rel));\n    }\n  }\n}\n\n/**\n * Symlink an asset (the `--link` dev-loop). A multi-file asset, or one living in\n * a directory named after it, links its whole directory; a lone manifest file\n * links into `dest/`.\n */\nfunction symlinkAsset(\n  provider: IAssetKindProvider,\n  source: string,\n  dest: string,\n  name: string,\n): void {\n  clearDest(dest);\n  mkdirSync(dirname(dest), { recursive: true });\n  const manifestPath = manifestFileOf(provider, source);\n  if (!manifestPath) {\n    symlinkSync(resolve(source), dest);\n    return;\n  }\n  const { assetRoot, files } = provider.defaultFileFilter(manifestPath);\n  if (files.length > 1 || basename(assetRoot) === name) {\n    symlinkSync(resolve(assetRoot), dest);\n  } else {\n    mkdirSync(dest, { recursive: true });\n    symlinkSync(resolve(manifestPath), join(dest, basename(manifestPath)));\n  }\n}\n\n// ── Deploy options ───────────────────────────────────────────────────────────\n\n/**\n * Options controlling where and how assets are deployed.\n *\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport interface DeployOptions {\n  /** Asset-kind registry — decides, per kind, the harness install target and file set. */\n  registry: IAssetKindRegistry;\n  /** Agent framework to target (determines framework-specific directory layout). Defaults to `\"claude-code\"`. */\n  driverTarget?: DriverTarget;\n  /** When `true`, deploy into the global Skaile cache rather than a project workspace. */\n  global?: boolean;\n  /** Absolute path to the workspace root. Defaults to `process.cwd()`. */\n  cwd?: string;\n  /**\n   * Opt into a symlink (the author dev-loop) instead of a copy — honoured only\n   * when the source has a real local path. Machine-local / not for committing;\n   * for store/factory sources (no stable local path) it is a no-op (still copy).\n   */\n  link?: boolean;\n  /**\n   * Called once per symlink inside an asset's own directory that a copy deploy\n   * leaves out (symlinks are not part of an asset), with the asset entry and the\n   * path of the link relative to the asset directory's parent (`<dir>/<rel>`).\n   */\n  onSkippedSymlink?: (entry: DeployableEntry, path: string) => void;\n}\n\n/**\n * Keep the agent's source (`agent.yaml`, `SOUL.md`, …) under\n * `<project>/.skaile/cache/agents/<name>/`, the one place `agents.<id>.ref:\n * agent:@pub/name` resolves an added library / source / store agent from: the\n * deployed copy is a rendering (`.claude/agents/<name>.md`) that has lost the\n * composition, triggers and slots an instance needs. An `AGENT.md` agent is stored\n * in the `agent.yaml` + `SOUL.md` form so every instance consumer reads one shape.\n * A failure is logged, never fatal: the rendered agent is deployed either way.\n */\nfunction materializeAgentSource(\n  provider: IAssetKindProvider,\n  entry: DeployableEntry,\n  srcDir: string,\n  workspaceRoot: string,\n  log: Log,\n): void {\n  const dest = join(agentSourceCacheDir(workspaceRoot), entry.name);\n  try {\n    copyAsset(provider, entry, dest);\n    if (existsSync(join(dest, \"agent.yaml\"))) return;\n    const manifest = readManifest(srcDir);\n    if (!manifest) return;\n    writeFileSync(\n      join(dest, \"agent.yaml\"),\n      stringifyYaml({ ...manifest, name: manifest.name ?? entry.name }),\n      \"utf8\",\n    );\n    const soul = readSoul(srcDir);\n    if (soul) writeFileSync(join(dest, \"SOUL.md\"), `${soul}\\n`, \"utf8\");\n  } catch (err) {\n    const reason = err instanceof Error ? err.message : String(err);\n    log(`  warn: could not keep the source of agent ${entry.name}: ${reason}`);\n  }\n}\n\n// ── Deploy / remove ──────────────────────────────────────────────────────────\n\n/**\n * Deploy a single asset to the framework-specific directory.\n *\n * Copies by default — self-contained, cache-safe, and portable, so a deployed\n * asset survives a `cache clean` of its source and a committed `.claude/` stays\n * machine-independent. `opts.link` opts into a symlink (the live dev-loop), but\n * only when the source has a real local path; store/factory sources (no stable\n * local path) ignore it and still copy. Agents are rendered via the enriched\n * `installAgent` path which resolves abilities, contracts, and framework\n * fragments before writing the native agent file.\n *\n * @param entry - Catalog entry describing the asset to deploy.\n * @param repositories - Repository declarations from `skaile.yaml` (used to\n *   determine whether the source is a local path or a remote clone).\n * @param opts - Deployment target options.\n * @param log - Optional logger callback for progress messages.\n * @returns `true` when the asset was deployed successfully.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function deployAsset(\n  entry: DeployableEntry,\n  repositories: Record<string, SourceDeclaration>,\n  opts: DeployOptions,\n  log: Log = noop,\n): boolean {\n  return deployEntry(entry, repositories, opts, log).deployed;\n}\n\n/**\n * {@link deployAsset} plus whether the deploy altered anything on disk. A copied asset always\n * counts as changed; an agent is re-rendered every time but counts as changed only when a\n * rendered file's bytes differ from the deployed one (an unchanged agent is left untouched).\n */\nfunction deployEntry(\n  entry: DeployableEntry,\n  repositories: Record<string, SourceDeclaration>,\n  opts: DeployOptions,\n  log: Log,\n): { deployed: boolean; changed: boolean } {\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const globalInstall = opts.global ?? false;\n  const cwd = opts.cwd;\n\n  // Composition-only kinds (no `installTarget`) never land in a harness dir:\n  // they are fetched + verified into the store cache and composed at session start.\n  const provider = opts.registry.getProvider(entry.kind);\n  const component = provider?.installTarget;\n  if (!provider || !component) return { deployed: true, changed: false };\n\n  // Agents need framework-specific rendering via the enriched installAgent path\n  if (component === \"agent\") {\n    const workspaceRoot = cwd ?? process.cwd();\n    const agentDeployDir = deployedBase(\n      component,\n      driverTarget as DriverTarget,\n      globalInstall,\n      cwd,\n    );\n    const targetMap = DRIVER_TARGETS[driverTarget as DriverTarget];\n    const skillsRelDir = targetMap?.local.skill ?? \"\";\n    const wsConfig = resolveSkWorkspaceConfig(workspaceRoot);\n    const srcDir = statSync(entry.source).isDirectory() ? entry.source : dirname(entry.source);\n    const result = installAgent(\n      srcDir,\n      agentDeployDir,\n      workspaceRoot,\n      driverTarget,\n      skillsRelDir,\n      entry.name,\n      /* includeSubAgents */ true,\n      new Set<string>(),\n      wsConfig,\n      log,\n    );\n    for (const w of result.warnings) log(`  warn: ${w}`);\n    if (result.created.length > 0) {\n      let changed = result.changed.length > 0;\n      // An `AGENT.md` agent used to deploy raw into `<base>/<name>/AGENT.md`, which no\n      // harness but omp (whose rendering is that directory) reads: drop the stale copy.\n      const staleRawCopy = join(agentDeployDir, entry.name);\n      if (driverTarget !== \"omp\" && existsSync(staleRawCopy)) {\n        clearDest(staleRawCopy);\n        changed = true;\n      }\n      if (!globalInstall) materializeAgentSource(provider, entry, srcDir, workspaceRoot, log);\n      return { deployed: true, changed };\n    }\n    // Fall through to raw deploy if renderer produces no files (unsupported framework, etc.)\n  }\n\n  const dest = deployedDir(component, entry.name, driverTarget, globalInstall, cwd);\n  mkdirSync(dirname(dest), { recursive: true });\n\n  // Symlink only on explicit opt-in AND when the source has a real local path.\n  // Factory sources have a `path` (the bundled dir under node_modules, replaced\n  // on every upgrade) but no stable dev-loop, so they always copy. Default copy\n  // keeps deploys cache-safe and portable.\n  const repoDecl = entry.publisher ? repositories[entry.publisher] : undefined;\n  const hasLocalPath = repoDecl?.path != null && repoDecl.factory !== true;\n\n  if (opts.link === true && hasLocalPath) {\n    symlinkAsset(provider, entry.source, dest, entry.name);\n    log(`  symlink ${entry.kind}:${entry.name}`);\n  } else {\n    copyAsset(provider, entry, dest, opts.onSkippedSymlink);\n    log(`  copy ${entry.kind}:${entry.name}`);\n  }\n  return { deployed: true, changed: true };\n}\n\n/**\n * Deploy all resolved assets, applying patches where configured.\n *\n * Already-deployed assets are skipped unless their deployed manifest content differs\n * from the source. This handles copies that have gone stale after a source update.\n * In copy mode (the default, `!opts.link`) an existing **symlink** dest is healed:\n * it is removed and re-deployed as a real copy, so an old/legacy symlink deploy is\n * silently upgraded. With `opts.link` an existing symlink is left alone.\n *\n * @param resolved - Catalog entries to deploy (output of `resolveAll`).\n * @param repositories - Repository declarations from `skaile.yaml`.\n * @param patches - Map of `kind:name` → patch file path for patch application.\n * @param opts - Deployment target options.\n * @param log - Optional logger callback for progress messages.\n * @returns Canonical refs (`kind:@publisher/name[#version]`; bare `kind:name`\n *   when the entry carries no publisher) of the assets newly deployed in this call.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function deployAll(\n  resolved: DeployableEntry[],\n  repositories: Record<string, SourceDeclaration>,\n  patches: Record<string, string>,\n  opts: DeployOptions,\n  log: Log = noop,\n): string[] {\n  const deployed: string[] = [];\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const globalInstall = opts.global ?? false;\n  const cwd = opts.cwd;\n\n  for (const entry of resolved) {\n    // Skip composition-only kinds (no `installTarget`) — they live in the store\n    // cache and are composed at session start, never copied into a harness dir.\n    const component = installTargetOf(opts.registry, entry.kind);\n    if (!component) continue;\n\n    const ref = `${entry.kind}:${entry.name}`;\n\n    // Agents are compiled artifacts: always re-rendered, never skipped on a manifest hash\n    // (and a stale raw `<name>/AGENT.md` copy of the old layout must be replaced, not kept).\n    if (\n      component !== \"agent\" &&\n      isDeployed(component, entry.name, driverTarget, globalInstall, cwd)\n    ) {\n      // Compare the deployed manifest file against the source to detect stale copies.\n      // For symlinks the deployed path resolves through to the source file, so hashes\n      // always match — symlinked installs are never needlessly re-linked.\n      const dest = deployedDir(component, entry.name, driverTarget, globalInstall, cwd);\n      // Heal: in copy mode an existing symlink dest is left to fall through to a\n      // real copy below (cache-safe + portable) — bypass the hash skip entirely.\n      // With --link a symlink dest is intentional, so it takes the normal skip path.\n      let destIsSymlink = false;\n      try {\n        destIsSymlink = lstatSync(dest).isSymbolicLink();\n      } catch {}\n      const healSymlink = destIsSymlink && opts.link !== true;\n      // Surface the one-time symlink→copy migration so an author who relied on a\n      // live symlink dev-loop knows why edits stopped reflecting.\n      if (healSymlink) log(`  healed symlink → copy: ${ref} (use --link for the dev-loop)`);\n\n      if (!healSymlink) {\n        const manifestName = basename(entry.source);\n        const deployedManifest = join(dest, manifestName);\n        // isDeployed() only lstats the dir, so a present-but-empty dir (manifest\n        // file deleted) reads as deployed. A missing manifest must never count as\n        // \"already deployed\" — fall through to re-deploy instead of skipping.\n        // (existsSync follows symlinks, so for symlinked installs the manifest\n        // resolves through to the live source and the hash check below still\n        // skips them.)\n        if (existsSync(deployedManifest)) {\n          let manifestUnchanged: boolean;\n          try {\n            manifestUnchanged = computeHash(entry.source) === computeHash(deployedManifest);\n          } catch {\n            // Deployed manifest unreadable (e.g. agent rendered to a different path) — skip\n            log(`  already deployed: ${ref}`);\n            continue;\n          }\n          // Every other file the deploy writes must be present and identical too —\n          // the manifest alone misses a deleted or stale companion (`.gitignore`,\n          // `resources/`, `scripts/`) the copy below would restore. A companion\n          // that cannot be compared counts as changed, so it is healed, not skipped.\n          const srcRoot = dirname(entry.source);\n          const companionsUnchanged = (entry.files ?? [])\n            .filter((rel) => rel !== manifestName)\n            .every((rel) => {\n              const deployed = join(dest, rel);\n              try {\n                return (\n                  existsSync(deployed) && computeHash(join(srcRoot, rel)) === computeHash(deployed)\n                );\n              } catch {\n                return false;\n              }\n            });\n          if (manifestUnchanged && companionsUnchanged) {\n            log(`  already deployed: ${ref}`);\n            continue;\n          }\n          log(`  updating: ${ref} (content changed)`);\n          // fall through to redeploy\n        }\n      }\n    }\n\n    // An agent is re-rendered every time; it is reported as deployed only when a rendered file\n    // changed, so a repeat install leaves it (and the report) alone.\n    const { changed } = deployEntry(entry, repositories, opts, log);\n    if (changed) deployed.push(canonicalEntryRef(entry));\n\n    // Apply patch if configured\n    const patchFile = patches[ref];\n    if (patchFile && existsSync(patchFile)) {\n      const dest = deployedDir(component, entry.name, driverTarget, globalInstall, cwd);\n      if (applyPatch(dest, patchFile)) {\n        log(`  patched ${ref}`);\n      } else {\n        log(`  patch failed for ${ref}`);\n      }\n    }\n  }\n\n  return deployed;\n}\n\n/**\n * Unified diff from a deployed agent to its source, `-` lines in the deployed copy only and `+`\n * lines in the source only. An agent is a rendering, not a copy, so the source is rendered the way\n * {@link deployAsset} renders it (same renderer, same workspace context) into a scratch directory\n * and that is compared with what the harness holds: `<name>.md` for claude-code, `<name>.toml`\n * plus the `skaile-agents/<name>.md` identity for codex, the `<name>/` directory for omp.\n *\n * @param entry - The agent's catalog entry (`source` is its `agent.yaml` / `AGENT.md`).\n * @param opts - Deployment target options (must match the options used at install time).\n * @returns `null` when none of the agent's rendered files is deployed, else the diff text\n *   (`\"\"` when the deployed agent matches its source).\n * @throws When `diff(1)` itself fails (exit status other than 0/1).\n */\nexport function diffDeployedAgent(entry: DeployableEntry, opts: DeployOptions): string | null {\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const workspaceRoot = opts.cwd ?? process.cwd();\n  const deployedAgents = deployedBase(\"agent\", driverTarget, opts.global ?? false, opts.cwd);\n  const scratch = mkdtempSync(join(tmpdir(), \"skaile-diff-agent-\"));\n  try {\n    const renderedAgents = join(scratch, \"agents\");\n    const srcDir = statSync(entry.source).isDirectory() ? entry.source : dirname(entry.source);\n    const rendered = installAgent(\n      srcDir,\n      renderedAgents,\n      workspaceRoot,\n      driverTarget,\n      DRIVER_TARGETS[driverTarget]?.local.skill ?? \"\",\n      entry.name,\n      /* includeSubAgents */ false,\n      new Set<string>(),\n      resolveSkWorkspaceConfig(workspaceRoot),\n    );\n    if (rendered.created.length === 0) return null;\n\n    // Each rendered top-level item pairs with the deployed item of the same name.\n    const pairs: Array<[from: string, to: string]> = [];\n    for (const [renderedRoot, deployedRoot] of [\n      [renderedAgents, deployedAgents],\n      [join(scratch, CODEX_IDENTITY_DIR), join(dirname(deployedAgents), CODEX_IDENTITY_DIR)],\n    ] as const) {\n      if (!existsSync(renderedRoot)) continue;\n      for (const item of readdirSync(renderedRoot)) {\n        pairs.push([join(deployedRoot, item), join(renderedRoot, item)]);\n      }\n    }\n    if (!pairs.some(([from]) => existsSync(from))) return null;\n\n    const diffs: string[] = [];\n    for (const [from, to] of pairs) {\n      const r = spawnSync(\"diff\", [\"-ruN\", from, to], { encoding: \"utf8\" });\n      if (r.status === 1) diffs.push(r.stdout);\n      else if (r.status !== 0) {\n        throw new Error(\n          `diff failed for agent:${entry.name}: ${r.stderr || r.error?.message || \"unknown error\"}`,\n        );\n      }\n    }\n    return diffs.join(\"\").split(`${scratch}${sep}`).join(`rendered${sep}`);\n  } finally {\n    rmSync(scratch, { recursive: true, force: true });\n  }\n}\n\n/**\n * Remove a deployed asset from the framework directory.\n *\n * Removes symlinks with `unlink`; removes copied directories with `rm -rf`.\n *\n * @param kind - Asset kind (`skill`, `agent`, `prompt`, `flow`, `contract`).\n * @param name - Asset name as registered in the catalog.\n * @param opts - Deployment target options (must match the options used at install time).\n * @returns `true` if the asset existed and was removed; `false` if it was not deployed.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function removeAsset(kind: string, name: string, opts: DeployOptions): boolean {\n  const driverTarget = opts.driverTarget ?? \"claude-code\";\n  const globalInstall = opts.global ?? false;\n  const cwd = opts.cwd;\n\n  // Composition-only kinds have no harness dir — never resolve (and delete) one.\n  const component = installTargetOf(opts.registry, kind);\n  if (!component) return false;\n  let removed = false;\n  for (const dest of deployedPaths(component, name, driverTarget, globalInstall, cwd)) {\n    try {\n      const s = lstatSync(dest);\n      if (s.isSymbolicLink()) unlinkSync(dest);\n      else rmSync(dest, { recursive: true, force: true });\n      removed = true;\n    } catch {\n      // not deployed at this path\n    }\n  }\n  if (component === \"agent\") {\n    // The Codex identity file and the kept source live beside the deployed agent.\n    const agentDir = deployedBase(component, driverTarget, globalInstall, cwd);\n    const extras = [join(dirname(agentDir), CODEX_IDENTITY_DIR, `${name}.md`)];\n    if (!globalInstall) extras.push(join(agentSourceCacheDir(cwd ?? process.cwd()), name));\n    for (const extra of extras) {\n      if (existsSync(extra)) {\n        rmSync(extra, { recursive: true, force: true });\n        removed = true;\n      }\n    }\n  }\n  return removed;\n}\n\n// ── Scaffold ─────────────────────────────────────────────────────────────────\n\n/** Markdown-marker scaffold (SKILL.md / CONTRACT.md / `*.prompt.md`); `body` is the kind's placeholder. */\nfunction markdownTemplate(name: string, description: string, body: string): string {\n  // JSON.stringify yields a valid YAML double-quoted scalar, so any\n  // user-supplied description (colons, quotes, `#`) survives the round-trip.\n  return `---\nname: \"${name}\"\ndescription: ${JSON.stringify(description)}\nmetadata:\n  version: \"0.1.0\"\n---\n\n# ${name}\n\n${body}\n`;\n}\n\n/** `agent.yaml` (spec 0.2) scaffold; the system prompt lives in the `SOUL.md` next to it. */\nfunction agentTemplate(name: string, description: string): string {\n  return `spec_version: \"0.2\"\nname: \"${name}\"\nversion: 0.1.0\ndescription: ${JSON.stringify(description)}\nlifecycle: standing\n`;\n}\n\nfunction soulTemplate(name: string): string {\n  return `# ${name}\n\n${AGENT_BODY_PLACEHOLDER}\n`;\n}\n\nfunction presetTemplate(name: string, description: string): string {\n  return `name: ${name}\ndescription: ${JSON.stringify(description)}\nversion: 0.1.0\nitems:\n  - ref: ${PRESET_ITEM_PLACEHOLDER_REF}\n`;\n}\n\nfunction flowTemplate(name: string, description: string): string {\n  return `id: \"${name}\"\nversion: \"0.1.0\"\nname: \"${name}\"\ndescription: ${JSON.stringify(description)}\n\nglobals:\n  approval_mode: checkpoint\n\nnodes: []\n`;\n}\n\n/** Asset kinds {@link createScaffold} has a real template for. */\nexport const SCAFFOLD_KINDS = [\"skill\", \"agent\", \"prompt\", \"flow\", \"preset\", \"contract\"] as const;\n\n/** Options for {@link createScaffold}. */\nexport interface ScaffoldOptions {\n  /**\n   * Description written into the manifest. Omitted: markdown kinds get a\n   * `TODO:` placeholder that `skaile validate` rejects until it is replaced;\n   * presets and flows keep their generic default.\n   */\n  description?: string;\n}\n\n/**\n * Create a minimal scaffold directory for a new asset.\n *\n * Writes the appropriate manifest file (`SKILL.md`, `agent.yaml` + `SOUL.md`, `CONTRACT.md`,\n * `<name>.preset.yaml`, `<name>.flow.yaml`, or `<name>.prompt.md`) inside a\n * new `<destDir>/<name>/` directory.\n *\n * @param name - Asset name (also used as the directory name).\n * @param kind - Asset kind: `skill` | `agent` | `preset` | `flow` | `prompt` | `contract`.\n * @param destDir - Parent directory to create the asset in.\n * @param opts - Optional scaffold content ({@link ScaffoldOptions}).\n * @returns `{ ok: true, path }` on success, `{ ok: false, path: errorMessage }` if the\n *   directory already exists or `kind` is not one of {@link SCAFFOLD_KINDS}\n *   (`Cannot scaffold kind \"<kind>\". Expected: ...`); nothing is created then.\n * @docLink packages/asset-manager/api-reference#installer\n */\nexport function createScaffold(\n  name: string,\n  kind: string,\n  destDir: string,\n  opts: ScaffoldOptions = {},\n): { ok: boolean; path: string } {\n  if (!(SCAFFOLD_KINDS as readonly string[]).includes(kind)) {\n    return {\n      ok: false,\n      path: `Cannot scaffold kind \"${kind}\". Expected: ${SCAFFOLD_KINDS.join(\", \")}.`,\n    };\n  }\n  const dest = join(destDir, name);\n  if (existsSync(dest)) {\n    return { ok: false, path: `Directory '${name}' already exists in ${destDir}` };\n  }\n  mkdirSync(dest, { recursive: true });\n\n  const mdDescription =\n    opts.description ??\n    ([\"agent\", \"contract\", \"prompt\"].includes(kind)\n      ? `${SKILL_DESCRIPTION_PLACEHOLDER_PREFIX} describe this ${kind}.`\n      : SKILL_DESCRIPTION_PLACEHOLDER);\n\n  if (kind === \"preset\") {\n    writeFileSync(\n      join(dest, `${name}.preset.yaml`),\n      presetTemplate(name, opts.description ?? PRESET_DESCRIPTION_PLACEHOLDER),\n      \"utf8\",\n    );\n  } else if (kind === \"flow\") {\n    writeFileSync(\n      join(dest, `${name}.flow.yaml`),\n      flowTemplate(name, opts.description ?? \"Flow description\"),\n      \"utf8\",\n    );\n  } else if (kind === \"prompt\") {\n    writeFileSync(\n      join(dest, `${name}.prompt.md`),\n      markdownTemplate(name, mdDescription, PROMPT_BODY_PLACEHOLDER),\n      \"utf8\",\n    );\n  } else if (kind === \"agent\") {\n    writeFileSync(join(dest, \"agent.yaml\"), agentTemplate(name, mdDescription), \"utf8\");\n    writeFileSync(join(dest, \"SOUL.md\"), soulTemplate(name), \"utf8\");\n  } else if (kind === \"contract\") {\n    writeFileSync(\n      join(dest, \"CONTRACT.md\"),\n      markdownTemplate(name, mdDescription, CONTRACT_BODY_PLACEHOLDER),\n      \"utf8\",\n    );\n  } else {\n    writeFileSync(\n      join(dest, \"SKILL.md\"),\n      markdownTemplate(name, mdDescription, SKILL_BODY_PLACEHOLDER),\n      \"utf8\",\n    );\n  }\n\n  return { ok: true, path: dest };\n}\n"]}

package/dist/chunk-R7FOF242.js

@@ -1,59 +0,0 @@
-import { Octokit } from '@octokit/rest';
-
-// library/src/install/source-fetch-github.ts
-var GITHUB_PAT_ENV = "SKAILE_GITHUB_PAT";
-function parseRepo(url) {
-  const m = url.match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?(?:[/#?].*)?$/i);
-  if (!m) throw new Error(`unsupported source URL: ${url}`);
-  return { owner: m[1], repo: m[2] };
-}
-async function fetchAssetFilesFromGitHub(opts) {
-  if (!/^[0-9a-f]{40}$/i.test(opts.commitSha)) {
-    throw new Error(
-      `pinned commit must be a 40-character hex SHA, got '${opts.commitSha}' \u2014 a branch or tag would make the install mutable`
-    );
-  }
-  const octo = opts.octokit ?? new Octokit({ auth: process.env[GITHUB_PAT_ENV] });
-  const { owner, repo } = parseRepo(opts.url);
-  let tree;
-  try {
-    tree = await octo.rest.git.getTree({
-      owner,
-      repo,
-      tree_sha: opts.commitSha,
-      recursive: "true"
-    });
-  } catch (e) {
-    throw new Error(`unreachable: cannot read tree at ${opts.commitSha}: ${e.message}`);
-  }
-  const byPath = /* @__PURE__ */ new Map();
-  for (const node of tree.data.tree) {
-    if (node.type === "blob" && node.path && node.sha) {
-      byPath.set(node.path, node.sha);
-    }
-  }
-  const result = {};
-  for (const path of opts.paths) {
-    const blobSha = byPath.get(path);
-    if (!blobSha) {
-      if (tree.data.truncated) {
-        throw new Error(
-          `tree truncated \u2014 repo too large for recursive listing at ${opts.commitSha}`
-        );
-      }
-      throw new Error(`unreachable: path not in tree: ${path}`);
-    }
-    const blob = await octo.rest.git.getBlob({ owner, repo, file_sha: blobSha });
-    if (blob.data.encoding !== "base64") {
-      throw new Error(
-        `unreachable: blob ${path} has unsupported encoding '${blob.data.encoding}' (likely too large)`
-      );
-    }
-    result[path] = Buffer.from(blob.data.content, "base64");
-  }
-  return result;
-}
-
-export { GITHUB_PAT_ENV, fetchAssetFilesFromGitHub };
-//# sourceMappingURL=chunk-R7FOF242.js.map
-//# sourceMappingURL=chunk-R7FOF242.js.map

package/dist/chunk-R7FOF242.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../library/src/install/source-fetch-github.ts"],"names":[],"mappings":";;;AAmBO,IAAM,cAAA,GAAiB;AAsB9B,SAAS,UAAU,GAAA,EAA8C;AAI/D,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,0DAA0D,CAAA;AAC9E,EAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AACxD,EAAA,OAAO,EAAE,OAAO,CAAA,CAAE,CAAC,GAAI,IAAA,EAAM,CAAA,CAAE,CAAC,CAAA,EAAG;AACrC;AAYA,eAAsB,0BAA0B,IAAA,EAAkD;AAMhG,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mDAAA,EAAsD,KAAK,SAAS,CAAA,uDAAA;AAAA,KAEtE;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,IAAW,IAAI,OAAA,CAAQ,EAAE,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAAG,CAAA;AAC9E,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,SAAA,CAAU,KAAK,GAAG,CAAA;AAE1C,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ;AAAA,MACjC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAU,IAAA,CAAK,SAAA;AAAA,MACf,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,MAAM,CAAA,iCAAA,EAAoC,IAAA,CAAK,SAAS,CAAA,EAAA,EAAM,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,EAC/F;AAGA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM;AACjC,IAAA,IAAI,KAAK,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,IAAA,IAAQ,KAAK,GAAA,EAAK;AACjD,MAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,GAAG,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,OAAA,EAAS;AAKZ,MAAA,IAAI,IAAA,CAAK,KAAK,SAAA,EAAW;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,8DAAA,EAA4D,KAAK,SAAS,CAAA;AAAA,SAC5E;AAAA,MACF;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+BAAA,EAAkC,IAAI,CAAA,CAAE,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,EAAE,KAAA,EAAO,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,CAAA;AAG3E,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,QAAA,KAAa,QAAA,EAAU;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kBAAA,EAAqB,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAK,QAAQ,CAAA,oBAAA;AAAA,OAC3E;AAAA,IACF;AACA,IAAA,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA,CAAO,KAAK,IAAA,CAAK,IAAA,CAAK,SAAS,QAAQ,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,MAAA;AACT","file":"chunk-R7FOF242.js","sourcesContent":["/**\n * GitHub asset-byte fetcher for the pointer-only install path.\n *\n * Given an upstream repo URL and a pinned commit SHA, walks the recursive\n * git tree at that commit and fetches the blob bytes for each requested path.\n * The Catalog never serves asset bytes — it only hands clients the Pointer\n * Triple (`source.url` + `source.commitSha` + per-file `{path, sha256}`),\n * and `installFromManifest` verifies every byte against those hashes.\n *\n * Authentication: an optional GitHub PAT is read from the `SKAILE_GITHUB_PAT`\n * environment variable when no `octokit` instance is injected. Public repos\n * work unauthenticated (subject to GitHub's anonymous rate limit).\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { Octokit } from \"@octokit/rest\";\n\n/** GitHub PAT environment variable used when no Octokit is injected. */\nexport const GITHUB_PAT_ENV = \"SKAILE_GITHUB_PAT\";\n\n/**\n * Options for {@link fetchAssetFilesFromGitHub}.\n */\nexport interface FetchOpts {\n  /** Upstream repo URL (e.g. `https://github.com/skaile-ai/skaile-ai-assets`). */\n  url: string;\n  /** Immutable 40-char git commit SHA the asset version was pinned at. */\n  commitSha: string;\n  /** Repo-relative paths to fetch. */\n  paths: string[];\n  /** Optional Octokit instance — injectable for tests. */\n  octokit?: Octokit;\n}\n\n/**\n * Parse `{ owner, repo }` out of a GitHub repo URL.\n *\n * Accepts both HTTPS (`https://github.com/owner/repo[.git]`) and SCP-style\n * SSH (`git@github.com:owner/repo[.git]`) forms.\n */\nfunction parseRepo(url: string): { owner: string; repo: string } {\n  // Repo names may contain dots (e.g. `skaile-ai/www.skaile.ai`). Capture the\n  // full repo segment up to a path separator / end-of-string, and strip an\n  // optional trailing `.git` suffix only.\n  const m = url.match(/github\\.com[/:]([^/]+)\\/([^/]+?)(?:\\.git)?(?:[/#?].*)?$/i);\n  if (!m) throw new Error(`unsupported source URL: ${url}`);\n  return { owner: m[1]!, repo: m[2]! };\n}\n\n/**\n * Fetch the bytes of each requested path from a GitHub repo at a pinned commit.\n *\n * Reads the recursive git tree at `commitSha`, maps each blob path to its blob\n * SHA, then fetches each requested path's blob and base64-decodes it.\n *\n * @returns A `{ path → Buffer }` map covering every requested path.\n * @throws An error whose message matches `/unreachable/i` if the tree cannot\n *   be read or any requested path is absent from the tree.\n */\nexport async function fetchAssetFilesFromGitHub(opts: FetchOpts): Promise<Record<string, Buffer>> {\n  // The pointer-only integrity model depends on `commitSha` being an immutable\n  // git commit SHA. GitHub's tree API also accepts branch/tag names, which\n  // would produce a mutable fetch and a non-pinned `Instance.sourceCommitSha` —\n  // silently breaking the auditable/re-verifiable guarantee. Reject anything\n  // that is not exactly 40 hex characters.\n  if (!/^[0-9a-f]{40}$/i.test(opts.commitSha)) {\n    throw new Error(\n      `pinned commit must be a 40-character hex SHA, got '${opts.commitSha}' — ` +\n        \"a branch or tag would make the install mutable\",\n    );\n  }\n  const octo = opts.octokit ?? new Octokit({ auth: process.env[GITHUB_PAT_ENV] });\n  const { owner, repo } = parseRepo(opts.url);\n\n  let tree: Awaited<ReturnType<typeof octo.rest.git.getTree>>;\n  try {\n    tree = await octo.rest.git.getTree({\n      owner,\n      repo,\n      tree_sha: opts.commitSha,\n      recursive: \"true\",\n    });\n  } catch (e) {\n    throw new Error(`unreachable: cannot read tree at ${opts.commitSha}: ${(e as Error).message}`);\n  }\n\n  // path → blob SHA\n  const byPath = new Map<string, string>();\n  for (const node of tree.data.tree) {\n    if (node.type === \"blob\" && node.path && node.sha) {\n      byPath.set(node.path, node.sha);\n    }\n  }\n\n  const result: Record<string, Buffer> = {};\n  for (const path of opts.paths) {\n    const blobSha = byPath.get(path);\n    if (!blobSha) {\n      // [H1] A recursive tree listing is truncated for large repos\n      // (`data.truncated: true`). A path missing from a truncated listing is\n      // not necessarily absent from the repo — surface a distinct, accurate\n      // error rather than the misleading \"path not in tree\".\n      if (tree.data.truncated) {\n        throw new Error(\n          `tree truncated — repo too large for recursive listing at ${opts.commitSha}`,\n        );\n      }\n      throw new Error(`unreachable: path not in tree: ${path}`);\n    }\n    const blob = await octo.rest.git.getBlob({ owner, repo, file_sha: blobSha });\n    // [L2] GitHub returns `encoding: \"none\"` (with empty content) for blobs\n    // larger than ~1MB. Only base64 is decodable here — fail loudly otherwise.\n    if (blob.data.encoding !== \"base64\") {\n      throw new Error(\n        `unreachable: blob ${path} has unsupported encoding '${blob.data.encoding}' (likely too large)`,\n      );\n    }\n    result[path] = Buffer.from(blob.data.content, \"base64\");\n  }\n  return result;\n}\n"]}

package/dist/chunk-TRSQP3JD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../cli/src/helpers.ts"],"names":[],"mappings":";;;;AASO,IAAM,CAAA,GAAI;AAAA,EACf,KAAA,EAAO,CAAC,CAAA,KAAc,EAAA,CAAG,KAAK,EAAA,CAAG,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,EACxC,GAAA,EAAK,CAAC,CAAA,KAAc,EAAA,CAAG,KAAK,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAS,CAAC,CAAA,KAAc,EAAA,CAAG,KAAK,CAAC,CAAA;AAAA,EACjC,IAAA,EAAM,CAAC,CAAA,KAAc,EAAA,CAAG,KAAK,CAAC,CAAA;AAAA,EAC9B,GAAA,EAAK,CAAC,CAAA,KAAc,EAAA,CAAG,IAAI,CAAC,CAAA;AAAA,EAC5B,EAAA,EAAI,CAAC,CAAA,KAAc,EAAA,CAAG,MAAM,CAAC,CAAA;AAAA,EAC7B,IAAA,EAAM,CAAC,CAAA,KAAc,EAAA,CAAG,OAAO,CAAC,CAAA;AAAA,EAChC,GAAA,EAAK,CAAC,CAAA,KAAc,EAAA,CAAG,IAAI,CAAC,CAAA;AAAA,EAC5B,KAAA,EAAO,CAAC,CAAA,KAAc,EAAA,CAAG,IAAI,CAAC,CAAA;AAAA,EAC9B,IAAA,EAAM,CAAC,CAAA,GAAI,EAAA,KAAO,GAAG,GAAA,CAAI,QAAA,CAAI,MAAA,CAAO,CAAC,CAAC;AACxC;AAEA,IAAM,WAAA,GAAqD;AAAA,EACzD,OAAO,EAAA,CAAG,IAAA;AAAA,EACV,OAAO,EAAA,CAAG,OAAA;AAAA,EACV,QAAQ,EAAA,CAAG,MAAA;AAAA,EACX,MAAM,EAAA,CAAG,KAAA;AAAA,EACT,QAAQ,EAAA,CAAG,IAAA;AAAA,EACX,UAAU,EAAA,CAAG,GAAA;AAAA,EACb,WAAW,EAAA,CAAG,KAAA;AAAA,EACd,WAAW,EAAA,CAAG,IAAA;AAAA,EACd,SAAS,EAAA,CAAG,IAAA;AAAA,EACZ,SAAS,EAAA,CAAG,IAAA;AAAA,EACZ,cAAc,EAAA,CAAG;AACnB,CAAA;AAQO,SAAS,QAAA,CAAS,GAAW,KAAA,EAAuB;AACzD,EAAA,IAAI,KAAA,IAAS,GAAG,OAAO,EAAA;AACvB,EAAA,IAAI,CAAA,CAAE,MAAA,GAAS,KAAA,EAAO,OAAO,KAAA,KAAU,CAAA,GAAI,QAAA,GAAM,CAAA,EAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,KAAA,GAAQ,CAAC,CAAC,CAAA,MAAA,CAAA;AACzE,EAAA,OAAO,CAAA,CAAE,OAAO,KAAK,CAAA;AACvB;AAGO,SAAS,UAAU,IAAA,EAAsB;AAC9C,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,IAAI,CAAA,IAAK,EAAA,CAAG,GAAA;AACxC,EAAA,OAAO,QAAQ,IAAI,CAAA;AACrB;AAMO,IAAM,cAAA,GAAiB;AAOvB,IAAM,mBAAA,GAAsB;AAO5B,SAAS,YAAA,CAAa,IAAA,EAAc,KAAA,GAAQ,cAAA,EAAwB;AACzE,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,IAAI,CAAA,IAAK,EAAA,CAAG,GAAA;AACxC,EAAA,OAAO,OAAA,CAAQ,QAAA,CAAS,IAAA,EAAM,KAAK,CAAC,CAAA;AACtC;AAGO,SAAS,SAAS,GAAA,EAAqB;AAC5C,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAChC,EAAA,IAAI,QAAA,KAAa,IAAI,OAAO,GAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,QAAQ,CAAA;AAClC,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AAC/B,EAAA,OAAO,CAAA,EAAG,SAAA,CAAU,IAAI,CAAC,GAAG,IAAI,CAAA,CAAA;AAClC;AAQO,SAAS,MAAM,GAAA,EAAa;AACjC,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,EAAA,CAAG,KAAA,CAAM,QAAG,CAAC,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AACzC;AAOO,SAAS,OAAO,GAAA,EAAa;AAClC,EAAA,OAAA,CAAQ,KAAA,CAAM,KAAK,EAAA,CAAG,GAAA,CAAI,QAAG,CAAC,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AACzC;AAOO,SAAS,QAAQ,GAAA,EAAa;AACnC,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,EAAA,CAAG,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AAC1C;AAOO,SAAS,QAAQ,GAAA,EAAa;AACnC,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,EAAA,CAAG,GAAA,CAAI,MAAG,CAAC,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AACvC;AAQO,SAAS,gBAAA,GAAuE;AACrF,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,IAAI,IAAA,GAAO,KAAA;AACX,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,CAAC,GAAA,KAAQ;AACb,MAAA,IAAI,IAAA,UAAc,GAAG,CAAA;AAAA,WAChB,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,IACpB,CAAA;AAAA,IACA,OAAO,MAAM;AACX,MAAA,KAAA,MAAW,OAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,UAAW,GAAG,CAAA;AAC7C,MAAA,IAAA,GAAO,IAAA;AAAA,IACT;AAAA,GACF;AACF;AAGA,IAAM,oBAAA,GAAuB,CAAA;AAQtB,SAAS,uBAAuB,EAAA,EAI9B;AACP,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,GAAG,wBAAA,EAAyB;AAAA,EACvC,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACzB,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,UAAA,EAAY,CAAA,CAAE,IAAI,CAAC,CAAA;AAClE,EAAA,MAAM,QAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,oBAAoB,CAAA,CAAE,KAAK,IAAI,CAAA;AAC1D,EAAA,MAAM,IAAA,GACJ,IAAI,MAAA,GAAS,oBAAA,GAAuB,MAAM,GAAA,CAAI,MAAA,GAAS,oBAAoB,CAAA,KAAA,CAAA,GAAU,EAAA;AACvF,EAAA,OAAA;AAAA,IACE,CAAA,MAAA,EAAS,CAAA,CAAE,GAAA,CAAI,UAAU,CAAC,2CAA2C,EAAA,CAAG,YAAY,CAAA,GAAA,EAAM,KAAK,CAAA,EAAG,IAAI,sBAChF,CAAA,CAAE,GAAA,CAAI,gBAAgB,CAAC,CAAA,iBAAA,EAAoB,EAAA,CAAG,YAAY,CAAA,UAAA,EAAa,CAAA,CAAE,GAAA,CAAI,sBAAsB,CAAC,CAAA,wBAAA;AAAA,GAC5H;AACF;AAOO,SAAS,gBAAgB,GAAA,EAAqB;AACnD,EAAA,OAAO,YAAY,GAAG,CAAA;AACxB;AAOO,SAAS,kBAAkB,IAAA,EAA4D;AAC5F,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,GAAQ,CAAA,yBAAA,EAAuB,IAAA,CAAK,KAAK,CAAA,iBAAA,CAAA,GAAsB,EAAA;AACnF,EAAA,OAAO,CAAA,EAAG,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAC,CAAA,YAAA,EAAe,eAAA,CAAgB,IAAA,CAAK,EAAE,CAAC,CAAA,kBAAA,EAAqB,MAAM,CAAA,CAAA;AACxG;AAQO,SAAS,qBAAqB,OAAA,EAA6B;AAChE,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAClC,EAAA,MAAM,MAAM,CAAC,CAAA,EAAA,EAAK,EAAE,KAAA,CAAM,8BAA8B,CAAC,CAAA,CAAA,CAAG,CAAA;AAC5D,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS,GAAA,CAAI,IAAA,CAAK,CAAA,IAAA,EAAO,EAAE,GAAA,CAAI,MAAG,CAAC,CAAA,EAAA,EAAK,CAAC,CAAA,CAAA,EAAI,CAAA,CAAE,GAAA,CAAI,QAAQ,CAAC,CAAA,CAAE,CAAA;AAC9E,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,uBAAA,CAAwB,MAAc,OAAA,EAA2B;AAC/E,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AACjC,EAAA,OAAO,CAAA,CAAE,IAAI,CAAA,EAAG,IAAI,eAAe,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,2BAAA,CAA6B,CAAA;AACpF;AAOO,SAAS,0BAAA,CAA2B,MAAc,OAAA,EAA2B;AAClF,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AACjC,EAAA,OAAO,CAAA,CAAE,IAAI,CAAA,SAAA,EAAY,IAAI,iBAAiB,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,WAAA,CAAa,CAAA;AAC/E;AAGO,SAAS,mBAAmB,IAAA,EAAoB;AACrD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,OAAA,EAAQ;AACvC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,GAAI,CAAA;AACtC,EAAA,IAAI,OAAA,GAAU,IAAI,OAAO,UAAA;AACzB,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,OAAA,GAAU,EAAE,CAAA;AACvC,EAAA,IAAI,OAAA,GAAU,EAAA,EAAI,OAAO,CAAA,EAAG,OAAO,CAAA,KAAA,CAAA;AACnC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,OAAA,GAAU,EAAE,CAAA;AACrC,EAAA,IAAI,KAAA,GAAQ,EAAA,EAAI,OAAO,CAAA,EAAG,KAAK,CAAA,KAAA,CAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,EAAE,CAAA;AAClC,EAAA,OAAO,GAAG,IAAI,CAAA,KAAA,CAAA;AAChB","file":"chunk-TRSQP3JD.js","sourcesContent":["import path from \"node:path\";\nimport { softDepName } from \"@skaile/workspaces/asset-manager\";\nimport pc from \"picocolors\";\n\n/**\n * Terminal styling helpers used across all CLI commands.\n *\n * @docLink cli/dev-guide#helpers\n */\nexport const S = {\n  brand: (s: string) => pc.cyan(pc.bold(s)),\n  cmd: (s: string) => pc.cyan(s),\n  heading: (s: string) => pc.bold(s),\n  bold: (s: string) => pc.bold(s),\n  dim: (s: string) => pc.dim(s),\n  ok: (s: string) => pc.green(s),\n  warn: (s: string) => pc.yellow(s),\n  err: (s: string) => pc.red(s),\n  label: (s: string) => pc.dim(s),\n  rule: (w = 40) => pc.dim(\"─\".repeat(w)),\n};\n\nconst KIND_COLORS: Record<string, (s: string) => string> = {\n  skill: pc.blue,\n  agent: pc.magenta,\n  prompt: pc.yellow,\n  flow: pc.green,\n  preset: pc.cyan,\n  contract: pc.red,\n  connector: pc.green,\n  knowledge: pc.cyan,\n  persona: pc.cyan,\n  ruleset: pc.cyan,\n  \"mcp-server\": pc.magenta,\n};\n\n/**\n * Fit a plain (ANSI-free) string into exactly `width` columns: truncate with a\n * trailing `…` when too long, pad with spaces when too short. Keeps fixed-width\n * columns from overflowing the row when a value (e.g. an asset name) is wider\n * than its budget.\n */\nexport function fitWidth(s: string, width: number): string {\n  if (width <= 0) return \"\";\n  if (s.length > width) return width === 1 ? \"…\" : `${s.slice(0, width - 1)}…`;\n  return s.padEnd(width);\n}\n\n/** Color-code an asset kind string. */\nexport function kindColor(kind: string): string {\n  const colorFn = KIND_COLORS[kind] ?? pc.dim;\n  return colorFn(kind);\n}\n\n/**\n * Widest kind label (`mcp-server`); the default kind-column width fits it so\n * long kinds don't shove the rest of the row out of alignment.\n */\nexport const KIND_COL_WIDTH = 10;\n\n/**\n * Shared `--target` help suffix: with no flag, the manager deploys into the\n * harness the project is configured for (the driver `skaile config show`\n * resolves), and only then falls back to `claude-code`.\n */\nexport const TARGET_DEFAULT_HINT = \"default: the project's configured harness, else claude-code\";\n\n/**\n * Color-code an asset kind string fit to exactly `width` columns — pads short\n * kinds, truncates over-long ones (via {@link fitWidth}) so the column can never\n * overflow and break row alignment.\n */\nexport function kindColorPad(kind: string, width = KIND_COL_WIDTH): string {\n  const colorFn = KIND_COLORS[kind] ?? pc.dim;\n  return colorFn(fitWidth(kind, width));\n}\n\n/** Color-code a \"kind:name\" reference string. */\nexport function colorRef(ref: string): string {\n  const colonIdx = ref.indexOf(\":\");\n  if (colonIdx === -1) return ref;\n  const kind = ref.slice(0, colonIdx);\n  const rest = ref.slice(colonIdx);\n  return `${kindColor(kind)}${rest}`;\n}\n\n/**\n * Print a success line prefixed with a green check mark.\n *\n * @param msg - Message to display.\n * @docLink cli/dev-guide#helpers\n */\nexport function logOk(msg: string) {\n  console.log(`  ${pc.green(\"✓\")} ${msg}`);\n}\n/**\n * Print an error line prefixed with a red cross to stderr.\n *\n * @param msg - Message to display.\n * @docLink cli/dev-guide#helpers\n */\nexport function logErr(msg: string) {\n  console.error(`  ${pc.red(\"✗\")} ${msg}`);\n}\n/**\n * Print a warning line prefixed with a yellow exclamation mark.\n *\n * @param msg - Message to display.\n * @docLink cli/dev-guide#helpers\n */\nexport function logWarn(msg: string) {\n  console.log(`  ${pc.yellow(\"!\")} ${msg}`);\n}\n/**\n * Print an info line prefixed with a dim dot.\n *\n * @param msg - Message to display.\n * @docLink cli/dev-guide#helpers\n */\nexport function logInfo(msg: string) {\n  console.log(`  ${pc.dim(\"·\")} ${msg}`);\n}\n\n/**\n * Hold warnings raised while a spinner animates and print them once it stops:\n * on a TTY a line written mid-spin is overwritten by the next frame. Pass\n * `push` as `AssetManager`'s `onLibraryCollision`, call `flush()` after\n * `spinner.stop(...)`. Warnings pushed after `flush()` print immediately.\n */\nexport function deferredWarnings(): { push: (msg: string) => void; flush: () => void } {\n  const held: string[] = [];\n  let live = false;\n  return {\n    push: (msg) => {\n      if (live) logWarn(msg);\n      else held.push(msg);\n    },\n    flush: () => {\n      for (const msg of held.splice(0)) logWarn(msg);\n      live = true;\n    },\n  };\n}\n\n/** Max stale `.claude/` copies named inline by {@link warnLegacyClaudeCopies}. */\nconst LEGACY_COPY_LIST_MAX = 5;\n\n/**\n * Print ONE warning when tracked assets still have a copy in `.claude/` although\n * the project deploys to another harness (the old default target, see\n * MIGRATION.md). Those copies are orphans: `remove` / `clean` / `list` only look\n * in the active harness dir. Nothing is deleted. Silent when there are none.\n */\nexport function warnLegacyClaudeCopies(am: {\n  projectDir: string;\n  driverTarget: string;\n  listLegacyClaudeDeployed(): Array<{ path: string }>;\n}): void {\n  let legacy: Array<{ path: string }>;\n  try {\n    legacy = am.listLegacyClaudeDeployed();\n  } catch {\n    return; // advisory only — never fail the command\n  }\n  if (legacy.length === 0) return;\n  const rel = legacy.map((l) => path.relative(am.projectDir, l.path));\n  const shown = rel.slice(0, LEGACY_COPY_LIST_MAX).join(\", \");\n  const more =\n    rel.length > LEGACY_COPY_LIST_MAX ? `, +${rel.length - LEGACY_COPY_LIST_MAX} more` : \"\";\n  logWarn(\n    `Stale ${S.cmd(\".claude/\")} copies no longer managed (deploying to ${am.driverTarget}): ${shown}${more}. ` +\n      `Delete them once ${S.cmd(\"skaile install\")} has deployed to ${am.driverTarget}, or pass ${S.cmd(\"--target claude-code\")} to keep using .claude/.`,\n  );\n}\n\n/**\n * Bare asset name of a canonical soft-dep target ref (`@pub/name@ver` → `name`),\n * for compact rendering in `info` / `tree` / `why`. Delegates to the asset-manager\n * parser (the soft-dep read surface) so the two never diverge.\n */\nexport function bareSoftDepName(ref: string): string {\n  return softDepName(ref);\n}\n\n/**\n * The report-only soft-dep hint line shared by the `add` no-TTY branch and the\n * `install` surface, so the two user-facing wordings can't drift. Appends a\n * runnable `skaile add` suffix only when the target has a parseable ref.\n */\nexport function formatSoftDepHint(edge: { from: string; to: string; toRef?: string }): string {\n  const suffix = edge.toRef ? ` — run \\`skaile add ${edge.toRef}\\` to include it.` : \"\";\n  return `${bareSoftDepName(edge.from)} references ${bareSoftDepName(edge.to)} (soft dependency)${suffix}`;\n}\n\n/**\n * Build the \"Soft dependencies (inferred)\" section for `skaile info`. Returns one\n * header line plus one line per soft-dep target, each marked `(soft)` to read\n * differently from a typed `requires`. Empty array when there are no soft deps,\n * so the caller prints nothing.\n */\nexport function formatSoftDepSection(targets: string[]): string[] {\n  if (targets.length === 0) return [];\n  const out = [`  ${S.label(\"Soft dependencies (inferred)\")}:`];\n  for (const t of targets) out.push(`    ${S.dim(\"·\")}  ${t} ${S.dim(\"(soft)\")}`);\n  return out;\n}\n\n/**\n * Footer line previewing the soft deps that *adding* the highlighted asset would\n * reference (manage TUI). \"references\" + \"not auto-added\" makes clear the pull is\n * report-only. Empty string when there are no targets, so the caller clears.\n */\nexport function formatSoftDepAddPreview(name: string, targets: string[]): string {\n  if (targets.length === 0) return \"\";\n  return S.dim(`${name} references ${targets.join(\", \")} (soft dep, not auto-added)`);\n}\n\n/**\n * Footer line previewing the soft deps that *removing* the highlighted asset\n * would orphan (manage TUI) — symmetric with {@link formatSoftDepAddPreview}.\n * Empty string when nothing would be orphaned, so the caller clears.\n */\nexport function formatSoftDepRemovePreview(name: string, targets: string[]): string {\n  if (targets.length === 0) return \"\";\n  return S.dim(`removing ${name} would orphan ${targets.join(\", \")} (soft dep)`);\n}\n\n/** Format a Date as a human-readable relative time string (e.g. \"5m ago\"). */\nexport function formatRelativeTime(date: Date): string {\n  const diff = Date.now() - date.getTime();\n  const seconds = Math.floor(diff / 1000);\n  if (seconds < 60) return \"just now\";\n  const minutes = Math.floor(seconds / 60);\n  if (minutes < 60) return `${minutes}m ago`;\n  const hours = Math.floor(minutes / 60);\n  if (hours < 24) return `${hours}h ago`;\n  const days = Math.floor(hours / 24);\n  return `${days}d ago`;\n}\n"]}

package/dist/chunk-V7PQZOBR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../cli/src/store-auth.ts","../cli/src/store-client.ts","../cli/src/commands/publish-core.ts"],"names":["readFileSync"],"mappings":";;;;;;;;AAsBA,SAAS,YAAA,GAAwD;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AAC1E,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAUA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,oBAAoB,IAAA,CAAK,eAAA,IAAmB,WAAW;AAAA,GAC/E;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,gBAAA,CACd,MAAA,GAA0B,mBAAA,EAAoB,EACM;AACpD,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,SAAS,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AAC3E,IAAA,MAAM,WACJ,OAAO,IAAA,CAAK,kBAAA,KAAuB,QAAA,GAAW,KAAK,kBAAA,GAAqB,KAAA,CAAA;AAC1E,IAAA,MAAM,cAAc,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,GAAW,KAAK,YAAA,GAAe,KAAA,CAAA;AAChF,IAAA,OAAO,QAAA,IAAY,WAAA,GAAc,EAAE,QAAA,EAAU,aAAY,GAAI,IAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACG;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,YAAA,EAAa;AAE1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,KAAA,EAAO,gBAAA;AAAA,MACP,gBAAgB,IAAA,CAAK,SAAA;AAAA,MACrB,qBAAA,EAAuB;AAAA,KACxB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,IAAA,CAAK;AAAA,OACrB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yBAAyB,KAAA,CAAM,iBAAA,IAAqB,KAAA,CAAM,KAAA,IAAS,IAAI,MAAM,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;AC9PO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAMA,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C;;;ACjGO,SAAS,4BAA4B,CAAA,EAGjC;AACT,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,EAAA,CAAG,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IAClC,KAAK,kBAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IACpC;AACE,MAAA,OAAO,GAAG,CAAA,CAAE,GAAA,CAAI,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA;AAEvC;AAYA,eAAsB,kBAAA,CACpB,QACA,SAAA,EAC4C;AAC5C,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,MAAM,MAAA,CAAO,qBAAA,CAAsB,SAAS,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB;AACA,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,IACpB,KAAK,kBAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EACE,CAAA,CAAA,EAAI,SAAS,CAAA,mDAAA,EACV,CAAA,CAAE,WAAA,GAAc,CAAA,EAAA,EAAK,CAAA,CAAE,WAAW,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,eAAA,EAAkB,EAAE,OAAO,CAAA;AAAA,OAC5E;AAAA,IACF;AACE,MAAA,OAAO,EAAE,IAAI,KAAA,EAAO,OAAA,EAAS,yBAAyB,SAAS,CAAA,QAAA,EAAM,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA;AAEvF;AAaO,SAAS,yBAAA,CACd,YACA,QAAA,EACK;AACL,EAAA,MAAM,SAAS,IAAI,GAAA,CAAA,CAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,IAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AAChF,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AACnE;AAGO,SAAS,MAAA,CAAO,IAAA,EAAc,SAAA,EAAmB,IAAA,EAAc,OAAA,EAA0B;AAC9F,EAAA,MAAM,OAAO,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,SAAS,IAAI,IAAI,CAAA,CAAA;AAC1C,EAAA,OAAO,OAAA,GAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,IAAA;AAC1C;AAGA,IAAM,eAAA,GAAkB,sBAAA;AAQjB,SAAS,cAAA,CACd,OACA,QAAA,EACoB;AACpB,EAAA,OAAO,KAAA,CAAM,aAAa,QAAA,CAAS,SAAA;AACrC;AAOO,SAAS,aAAA,CACd,OACA,QAAA,EACQ;AACR,EAAA,MAAM,EAAA,GAAK,cAAA,CAAe,KAAA,EAAO,QAAQ,CAAA;AACzC,EAAA,OAAO,EAAA,GAAK,MAAA,CAAO,KAAA,CAAM,IAAA,EAAM,EAAA,EAAI,KAAA,CAAM,IAAI,CAAA,GAAI,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAC9E;AAUO,SAAS,8BAAA,CACd,QAAA,EACA,YAAA,EACA,OAAA,EACA,WAAA,EACQ;AACR,EAAA,OACE,CAAA,EAAG,wBAAwB,CAAA,iBAAA,EAAe,QAAQ,sBAAsB,YAAY,CAAA,cAAA,EACpE,OAAO,CAAA,EAAA,EAAK,WAAW,CAAA,wGAAA,CAAA;AAG3C;AAQO,SAAS,kBAAA,CAAmB,UAA6B,SAAA,EAA8B;AAC5F,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAY;AAC5B,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AACrC,IAAA,IAAI,SAAA,IAAa,CAAA,CAAE,IAAA,KAAS,SAAA,EAAW;AACvC,IAAA,MAAM,EAAA,GAAK,cAAA,CAAe,CAAA,EAAG,QAAQ,CAAA;AACrC,IAAA,IAAI,EAAA,EAAI,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAAA,EACpB;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,IAAK,QAAA,CAAS,WAAW,GAAA,CAAI,GAAA,CAAI,SAAS,SAAS,CAAA;AACpE,EAAA,OAAO,CAAC,GAAG,GAAG,CAAA;AAChB;AAMO,SAAS,WAAA,CAAY,UAA6B,SAAA,EAA8B;AACrF,EAAA,OAAA,CAAQ,QAAA,CAAS,MAAA,IAAU,EAAC,EACzB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,SAAA,IAAa,CAAA,CAAE,IAAA,KAAS,SAAS,CAAA,CAChD,GAAA;AAAA,IAAI,CAAC,CAAA,KACJ,MAAA;AAAA,MACE,CAAA,CAAE,IAAA;AAAA,MACF,cAAA,CAAe,CAAA,EAAG,QAAQ,CAAA,IAAK,eAAA;AAAA,MAC/B,CAAA,CAAE,IAAA;AAAA,MACF,CAAA,CAAE,WAAW,QAAA,CAAS;AAAA;AACxB,GACF;AACJ;AAGO,SAAS,SAAS,GAAA,EAAqB;AAC5C,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAAI,GAAA;AACxE,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GACrC,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAC1C,SAAA;AACJ,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA;AAChC;AAOA,eAAsB,QACpB,MAAA,EACA,KAAA,EACA,UAAA,GAAa,IAAA,EACb,YAAY,GAAA,EACmF;AAC/F,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAC9B,EAAA,IAAI,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,OAAO,IAAI,MAAA,KAAW,SAAA,IAAa,IAAA,CAAK,GAAA,KAAQ,QAAA,EAAU;AACxD,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,UAAU,CAAC,CAAA;AAClD,IAAA,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,iBAAiB,GAAA,EAAuB;AACtD,EAAA,MAAM,GAAA,GAAA,CAAO,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,GAAG,WAAA,EAAY;AAC3E,EAAA,OAAO,qEAAA,CAAsE,KAAK,GAAG,CAAA;AACvF;AAcA,eAAsB,eAAe,IAAA,EAOA;AACnC,EAAA,MAAM,EAAE,WAAW,GAAA,EAAK,OAAA,EAAS,UAAU,SAAA,EAAW,MAAA,EAAQ,KAAI,GAAI,IAAA;AAEtE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW;AAAA,MACjC,GAAA,EAAK,SAAA;AAAA,MACL,GAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,UAAA,EAAY,OAAA,CAAQ,KAAK,UAAA,EAAY,OAAA,CAAQ,GAAA,EAAI,GAAI,EAAC;AAAA;AAAA;AAAA;AAAA,MAItE,GAAI,SAAS,SAAA,GAAY,EAAE,WAAW,QAAA,CAAS,SAAA,KAAc;AAAC,KAC/D,CAAA;AACD,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI,CAAC,gBAAA,CAAiB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,SAAS,CAAA;AAClD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,OAAA,EAAU,SAAS,CAAA,qDAAA,EACd,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OACvD;AAAA,IACF;AACA,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,GAAA,CAAI,WAAW,QAAQ,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AACpC,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,WAAA,EAAa;AACzD,IAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,KAAA,IAAS,EAAC,EAAG,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,QAAQ,CAAA;AACpE,IAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,MAAA,CAAO,CAAA,MAAA,EAAS,CAAA,CAAE,KAAK,CAAA,EAAA,EAAK,CAAA,CAAE,KAAA,IAAS,QAAQ,CAAA,CAAE,CAAA;AACzE,IAAA,MAAA,CAAO,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACnC,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,IAAA,MAAA,CAAO,sFAAiF,CAAA;AACxF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,aAAa,yBAAA,CAA0B,MAAM,IAAI,gBAAA,CAAiB,QAAQ,GAAG,QAAQ,CAAA;AACzF,EAAA,IAAI,SAAA,eAAwB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,SAAS,CAAA;AACzE,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,wEAAmE,CAAA;AAC3E,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,YAAA,CAAa,EAAE,EAAE,CAAA;AAC3C,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,YAAA,CAAa,CAAA,CAAE,EAAA,EAAI,EAAE,GAAA,EAAK,KAAA,EAAO,OAAA,CAAQ,eAAA,EAAiB,CAAA;AAGhF,MAAA,IAAI,IAAI,KAAA,EAAO;AACb,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,EAAK,IAAI,KAAK,CAAA;AAC3C,QAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,UAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAC,EAC5B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA,CACnC,IAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA,CAClB,OAAO,OAAO,CAAA;AACjB,UAAA,OAAA;AAAA,YACE,cAAc,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,kBAAA,EAAqB,MAAA,CAAO,MAAM,CAAA,CAAA,CAAA,IAC7D,KAAK,MAAA,GAAS,CAAA,EAAA,EAAK,KAAK,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AAAA,WAC5C;AACA,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,SAAA,CAAU,IAAA,CAAK,MAAA,CAAO,CAAA,CAAE,IAAA,EAAM,OAAA,CAAQ,SAAA,CAAU,kBAAA,EAAoB,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAC,CAAA;AAAA,IACxF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA;AAAA,QACE,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OAC5F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,CAAA,UAAA,EAAa,SAAA,CAAU,MAAM,CAAA,UAAA,CAAY,CAAA;AAC/C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAA,EAAW,OAAA,CAAQ,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAC3C,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB","file":"chunk-V7PQZOBR.js","sourcesContent":["/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { globalSkaileDir } from \"@skaile/workspaces/core\";\n\n/**\n * A PKCE (RFC 7636) `code_verifier` + its S256 `code_challenge`. Keycloak\n * enforces PKCE on the `skaile-store-cli` device flow (the device-authorization\n * request 400s with \"Missing parameter: code_challenge_method\" otherwise), so\n * every `deviceLogin` mints a fresh pair: the challenge goes on the device-auth\n * request, the verifier on the matching token poll. `base64url` (no padding)\n * per the spec.\n */\nfunction makePkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  const challenge = createHash(\"sha256\").update(verifier).digest(\"base64url\");\n  return { verifier, challenge };\n}\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n  keycloakUrl: string;\n  realm: string;\n  clientId: string;\n  authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n  return {\n    keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n    realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n    clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n    authFile: process.env.SKAILE_AUTH_FILE ?? join(globalSkaileDir(), \"auth.json\"),\n  };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n  const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n  return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n  access_token: string;\n  refresh_token?: string;\n  /** Epoch ms when the access token expires (with a safety margin already applied). */\n  expires_at: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  interval?: number;\n  expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n  fetchImpl?: typeof fetch;\n  sleep?: (ms: number) => Promise<void>;\n  /** Called once with the verification URL + user code (default: write to stderr). */\n  onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n  try {\n    const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n    // Reject a corrupt / hand-edited file rather than treat it as a session.\n    if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The caller's store identity, decoded LOCALLY from the cached token's JWT\n * payload (no network, no signature check — this is an author-side hint, not an\n * authorization decision). Returns `null` when not signed in or the token is\n * unreadable. `githubLogin` is the verified GitHub handle (the preferred\n * publisher namespace); `username` is the Keycloak `preferred_username`.\n */\nexport function getStoreIdentity(\n  config: StoreAuthConfig = loadStoreAuthConfig(),\n): { username?: string; githubLogin?: string } | null {\n  const auth = readAuth(config);\n  if (!auth) return null;\n  try {\n    const payload = auth.access_token.split(\".\")[1];\n    const json = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf-8\"));\n    const username =\n      typeof json.preferred_username === \"string\" ? json.preferred_username : undefined;\n    const githubLogin = typeof json.github_login === \"string\" ? json.github_login : undefined;\n    return username || githubLogin ? { username, githubLogin } : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n  mkdirSync(dirname(config.authFile), { recursive: true });\n  writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n  chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n  try {\n    rmSync(config.authFile);\n  } catch {\n    // already absent — nothing to do\n  }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n  return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n  return {\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n  };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n  process.stderr.write(\n    `\\nTo sign in, open:\\n\\n    ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n  );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<StoredAuth> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const sleep = deps.sleep ?? defaultSleep;\n  const onPrompt = deps.onPrompt ?? defaultPrompt;\n  const endpoints = oidc(config);\n  const pkce = makePkcePair();\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      client_id: config.clientId,\n      scope: \"openid profile\",\n      code_challenge: pkce.challenge,\n      code_challenge_method: \"S256\",\n    }),\n  });\n  if (!deviceRes.ok) {\n    throw new Error(\n      `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n  onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n  const intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n  let waitMs = intervalMs;\n\n  while (Date.now() < deadline) {\n    await sleep(waitMs);\n    const tokenRes = await fetchImpl(endpoints.token, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: device.device_code,\n        client_id: config.clientId,\n        code_verifier: pkce.verifier,\n      }),\n    });\n    const token = (await tokenRes.json()) as TokenResponse;\n    if (tokenRes.ok) {\n      const stored = tokenToStored(token);\n      writeAuth(config, stored);\n      return stored;\n    }\n    // RFC 8628 §3.5 pending / slow-down handling.\n    if (token.error === \"authorization_pending\") continue;\n    if (token.error === \"slow_down\") {\n      waitMs += 5_000;\n      continue;\n    }\n    throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n  }\n  throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n  config: StoreAuthConfig,\n  refreshToken: string,\n  fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n  const res = await fetchImpl(oidc(config).token, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n      client_id: config.clientId,\n    }),\n  });\n  const token = (await res.json()) as TokenResponse;\n  if (!res.ok) {\n    throw new Error(\n      `Token refresh failed: ${token.error_description ?? token.error ?? res.status}`,\n    );\n  }\n  const stored = tokenToStored(token);\n  writeAuth(config, stored);\n  return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<string> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const auth = readAuth(config);\n  if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n  if (Date.now() < auth.expires_at) return auth.access_token;\n  if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n  try {\n    return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n  } catch {\n    throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n  }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n","/**\n * Shared store-interaction core for the two publish front-ends — the curator\n * sidecar flow (`source manifest publish`) and the first-party library flow\n * (`library publish`). Both differ only in their git side-effects + how they\n * resolve the source repo; the store orchestration below (register → sync →\n * candidates → per-asset preview+publish) is identical.\n *\n * The store REST surface is reached through the injectable {@link PublisherClient}\n * so the orchestration stays unit/integration-testable without a live store.\n *\n * @docLink cli/commands/source#manifest-publish\n */\n\nimport { SKAILE_MANIFEST_FILENAME, type SkPublishManifest } from \"@skaile/workspaces/core\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport type { PublisherClient } from \"../store-publisher.ts\";\n\n/**\n * One-line rendering of a namespace-availability probe for a `--dry-run` plan.\n * The `message` is store-authored (identical to what a real publish would echo)\n * — we only prepend a status glyph so the reader sees green/amber/red at a\n * glance without the CLI re-deriving any authorization logic.\n */\nexport function formatNamespaceAvailability(a: {\n  status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n  message: string;\n}): string {\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return `${S.ok(\"✓\")} ${a.message}`;\n    case \"claimable-by-you\":\n      return `${S.warn(\"!\")} ${a.message}`;\n    default:\n      return `${S.err(\"✗\")} ${a.message}`;\n  }\n}\n\n/**\n * Preflight the target namespace against the store's availability probe BEFORE a\n * publish does any irreversible work (a public git push). Returns `{ ok: false }`\n * with a guided message for `reserved` (not yours) and `claimable-by-you` (must\n * claim first) — the two states a real publish would reject — so the caller can\n * abort with actionable guidance instead of a raw 422 after pushing bytes.\n *\n * The probe is advisory: any failure (offline, older store) returns `{ ok: true }`\n * so the store stays the authority and a valid publish is never blocked.\n */\nexport async function preflightNamespace(\n  client: PublisherClient,\n  namespace: string,\n): Promise<{ ok: boolean; message?: string }> {\n  let a: Awaited<ReturnType<PublisherClient[\"namespaceAvailability\"]>>;\n  try {\n    a = await client.namespaceAvailability(namespace);\n  } catch {\n    return { ok: true };\n  }\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return { ok: true };\n    case \"claimable-by-you\":\n      return {\n        ok: false,\n        message:\n          `@${namespace} isn't yours yet — claim it in the store first` +\n          `${a.claimMethod ? ` (${a.claimMethod})` : \"\"}, then re-run. ${a.message}`,\n      };\n    default: // reserved, or any unrecognized future status (fail safe → block)\n      return { ok: false, message: `Cannot publish under @${namespace} — ${a.message}` };\n  }\n}\n\n/** One candidate row shape the matcher operates on (kind + name are the key). */\ninterface CandidateLike {\n  kind: string;\n  name: string;\n}\n\n/**\n * Keep only candidates whose `(kind, name)` pair is declared in the manifest.\n * The backend may merge extra assets from the base repo into the candidate\n * list; a publish only touches what the manifest curated/declared.\n */\nexport function matchCandidatesToManifest<T extends CandidateLike>(\n  candidates: T[],\n  manifest: SkPublishManifest,\n): T[] {\n  const wanted = new Set((manifest.assets ?? []).map((a) => `${a.kind}:${a.name}`));\n  return candidates.filter((c) => wanted.has(`${c.kind}:${c.name}`));\n}\n\n/** A canonical ref string `kind:@publisher/name[#version]` for reporting. */\nexport function refFor(kind: string, publisher: string, name: string, version?: string): string {\n  const base = `${kind}:@${publisher}/${name}`;\n  return version ? `${base}#${version}` : base;\n}\n\n/** Placeholder namespace shown when neither the asset nor the manifest names a publisher. */\nconst UNSET_NAMESPACE = \"<manifest publisher>\";\n\n/**\n * The publisher namespace one manifest asset publishes under:\n * `assets[].publisher` first, else the manifest's top-level `publisher` —\n * the same priority discovery applies when it indexes the asset. `undefined`\n * when neither is declared.\n */\nexport function assetNamespace(\n  asset: { publisher?: string },\n  manifest: SkPublishManifest,\n): string | undefined {\n  return asset.publisher ?? manifest.publisher;\n}\n\n/**\n * The version-less canonical ref of one manifest asset for messages:\n * `kind:@<publisher>/<name>` (`assets[].publisher ?? publisher`), or the bare\n * `kind:name` when the manifest declares no namespace.\n */\nexport function assetEntryRef(\n  asset: { kind: string; name: string; publisher?: string },\n  manifest: SkPublishManifest,\n): string {\n  const ns = assetNamespace(asset, manifest);\n  return ns ? refFor(asset.kind, ns, asset.name) : `${asset.kind}:${asset.name}`;\n}\n\n/**\n * The warning `skaile validate` and the publish plan print when a manifest\n * entry's `version` differs from the one in the asset's own file. The file is\n * the source of truth; `skaile library index` rewrites the entry from it.\n *\n * @param entryRef - {@link assetEntryRef} of the entry.\n * @param relFile - the asset file, relative to the library root (posix).\n */\nexport function manifestVersionMismatchMessage(\n  entryRef: string,\n  entryVersion: string,\n  relFile: string,\n  fileVersion: string,\n): string {\n  return (\n    `${SKAILE_MANIFEST_FILENAME} [assets] — ${entryRef}: manifest version ${entryVersion} ` +\n    `differs from ${relFile} (${fileVersion}). The file is the source of truth: ` +\n    \"bump the version there, then run `skaile library index <library>`.\"\n  );\n}\n\n/**\n * Every distinct namespace the manifest's assets (optionally narrowed to\n * `assetName`) publish under, in first-seen order. A manifest whose assets\n * carry no namespace at all falls back to its top-level `publisher` so an\n * empty inventory still reports the namespace it would claim.\n */\nexport function manifestNamespaces(manifest: SkPublishManifest, assetName?: string): string[] {\n  const out = new Set<string>();\n  for (const a of manifest.assets ?? []) {\n    if (assetName && a.name !== assetName) continue;\n    const ns = assetNamespace(a, manifest);\n    if (ns) out.add(ns);\n  }\n  if (out.size === 0 && manifest.publisher) out.add(manifest.publisher);\n  return [...out];\n}\n\n/**\n * The canonical refs a publish would produce, one per manifest asset (optionally\n * narrowed to `assetName`), each under its own `assets[].publisher ?? publisher`.\n */\nexport function plannedRefs(manifest: SkPublishManifest, assetName?: string): string[] {\n  return (manifest.assets ?? [])\n    .filter((a) => !assetName || a.name === assetName)\n    .map((a) =>\n      refFor(\n        a.kind,\n        assetNamespace(a, manifest) ?? UNSET_NAMESPACE,\n        a.name,\n        a.version ?? manifest.version,\n      ),\n    );\n}\n\n/** The bare asset name from a `kind:@publisher/name#version` ref or a plain name. */\nexport function bareName(ref: string): string {\n  const afterKind = ref.includes(\":\") ? ref.slice(ref.indexOf(\":\") + 1) : ref;\n  const afterScope = afterKind.includes(\"/\")\n    ? afterKind.slice(afterKind.indexOf(\"/\") + 1)\n    : afterKind;\n  return afterScope.split(\"#\")[0];\n}\n\n/**\n * Poll a job until it leaves `running` or the deadline passes. Returns the last\n * observed state — the caller MUST treat a still-`running` result as a timeout\n * (not success), since it means the deadline was hit before the job finished.\n */\nexport async function pollJob(\n  client: PublisherClient,\n  jobId: string,\n  intervalMs = 1_500,\n  timeoutMs = 60_000,\n): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }> {\n  const deadline = Date.now() + timeoutMs;\n  let job = await client.jobGet(jobId);\n  while (job.status === \"running\" && Date.now() < deadline) {\n    await new Promise((r) => setTimeout(r, intervalMs));\n    job = await client.jobGet(jobId);\n  }\n  return job;\n}\n\n/**\n * True when a `sourcesAdd` rejection is a duplicate-URL conflict (the source is\n * already registered) — the only error the publish flow recovers from by looking\n * the existing row up. Every other failure (auth, 5xx, network) must propagate.\n */\nexport function isDupSourceError(err: unknown): boolean {\n  const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();\n  return /\\b409\\b|conflict|duplicate|already exists|already registered|unique/.test(msg);\n}\n\n/**\n * Register + sync the source, then publish its curated/declared candidates —\n * the store-side steps shared by both publish front-ends. Git side-effects (the\n * sidecar push, or the library commit+push) happen in the caller *before* this;\n * this function is purely store interaction.\n *\n * The sidecar front-end passes `sidecar` (so `sourcesAdd` carries the sidecar\n * pin); the library front-end omits it (the source repo IS the manifest host).\n * `assetName`, when set, narrows publication to the single candidate of that\n * name. Fatal store states (`sourcesAdd` non-dup failure) surface; sync failures\n * and empty candidate sets `process.exit(1)` with the same messages as before.\n */\nexport async function publishToStore(opts: {\n  sourceUrl: string;\n  ref: string;\n  sidecar?: { url: string; ref: string };\n  manifest: SkPublishManifest;\n  assetName?: string;\n  client: PublisherClient;\n}): Promise<{ published: string[] }> {\n  const { sourceUrl, ref, sidecar, manifest, assetName, client: pub } = opts;\n\n  let sourceId: string;\n  try {\n    const added = await pub.sourcesAdd({\n      url: sourceUrl,\n      ref,\n      ...(sidecar ? { sidecarUrl: sidecar.url, sidecarRef: sidecar.ref } : {}),\n      // Publish under the manifest's declared namespace; the store resolves a\n      // claimed Publisher when it differs from the caller's login, else defaults\n      // to `@<username>`. Omitted when the manifest carries no publisher.\n      ...(manifest.publisher ? { namespace: manifest.publisher } : {}),\n    });\n    sourceId = added.id;\n  } catch (err) {\n    // Only a duplicate-url conflict is recoverable (source already registered);\n    // auth/5xx/network failures must surface, not silently reuse a stale row.\n    if (!isDupSourceError(err)) throw err;\n    const rows = await pub.sourcesList();\n    const found = rows.find((r) => r.url === sourceUrl);\n    if (!found) {\n      throw new Error(\n        `Source ${sourceUrl} looked already-registered but no owned row matched: ` +\n          `${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n    sourceId = found.id;\n  }\n\n  const { jobId } = await pub.sourceSync(sourceId);\n  const job = await pollJob(pub, jobId);\n  if (job.status === \"failed\" || job.status === \"cancelled\") {\n    const failed = (job.items ?? []).filter((i) => i.status === \"failed\");\n    for (const i of failed) logErr(`sync: ${i.label}: ${i.error ?? \"failed\"}`);\n    logErr(`Source sync ${job.status}.`);\n    process.exit(1);\n  }\n  // A still-`running` job means the poll deadline was hit — do NOT proceed on an\n  // unfinished sync (it would read incomplete candidates).\n  if (job.status === \"running\") {\n    logErr(\"Source sync timed out before completing — re-run `publish`, or check the store.\");\n    process.exit(1);\n  }\n\n  let candidates = matchCandidatesToManifest(await pub.sourceCandidates(sourceId), manifest);\n  if (assetName) candidates = candidates.filter((c) => c.name === assetName);\n  if (candidates.length === 0) {\n    logWarn(\"No candidates discovered — check the manifest and the source ref.\");\n    process.exit(1);\n  }\n\n  const published: string[] = [];\n  for (const c of candidates) {\n    try {\n      const preview = await pub.assetPreview(c.id);\n      const res = await pub.assetPublish(c.id, { ref, files: preview.discoveredFiles });\n      // Publish is async — wait for the job so we only report refs that actually\n      // landed, not ones whose import is still in flight or about to fail.\n      if (res.jobId) {\n        const pubJob = await pollJob(pub, res.jobId);\n        if (pubJob.status !== \"succeeded\") {\n          const errs = (pubJob.items ?? [])\n            .filter((i) => i.status === \"failed\")\n            .map((i) => i.error)\n            .filter(Boolean);\n          logWarn(\n            `Publish of ${c.kind}:${c.name} did not succeed (${pubJob.status})` +\n              (errs.length ? `: ${errs.join(\"; \")}` : \"\"),\n          );\n          continue;\n        }\n      }\n      published.push(refFor(c.kind, preview.candidate.publisherNamespace, c.name, c.version));\n    } catch (err) {\n      logWarn(\n        `Failed to publish ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  logOk(`Published ${published.length} asset(s):`);\n  for (const r of published) logInfo(`  ${r}`);\n  return { published };\n}\n"]}