@skaile/workspaces 5.11.0 → 5.13.0

package/dist/chunk-FB3NREF7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../cli/src/commands/publish-core.ts","../cli/src/store-auth.ts","../cli/src/commands/library-index.ts"],"names":["parseYaml","stringifyYaml"],"mappings":";;;;;;;;;;;;;;;;;;;AAuBO,SAAS,4BAA4B,CAAA,EAGjC;AACT,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,EAAA,CAAG,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IAClC,KAAK,kBAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IACpC;AACE,MAAA,OAAO,GAAG,CAAA,CAAE,GAAA,CAAI,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA;AAEvC;AAYA,eAAsB,kBAAA,CACpB,QACA,SAAA,EAC4C;AAC5C,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,MAAM,MAAA,CAAO,qBAAA,CAAsB,SAAS,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB;AACA,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,IACpB,KAAK,kBAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EACE,CAAA,CAAA,EAAI,SAAS,CAAA,mDAAA,EACV,CAAA,CAAE,WAAA,GAAc,CAAA,EAAA,EAAK,CAAA,CAAE,WAAW,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,eAAA,EAAkB,EAAE,OAAO,CAAA;AAAA,OAC5E;AAAA,IACF;AACE,MAAA,OAAO,EAAE,IAAI,KAAA,EAAO,OAAA,EAAS,yBAAyB,SAAS,CAAA,QAAA,EAAM,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA;AAEvF;AAaO,SAAS,yBAAA,CACd,YACA,QAAA,EACK;AACL,EAAA,MAAM,SAAS,IAAI,GAAA,CAAA,CAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,IAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AAChF,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AACnE;AAGO,SAAS,MAAA,CAAO,IAAA,EAAc,SAAA,EAAmB,IAAA,EAAc,OAAA,EAA0B;AAC9F,EAAA,MAAM,OAAO,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,SAAS,IAAI,IAAI,CAAA,CAAA;AAC1C,EAAA,OAAO,OAAA,GAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,IAAA;AAC1C;AAGA,IAAM,eAAA,GAAkB,sBAAA;AAQjB,SAAS,cAAA,CACd,OACA,QAAA,EACoB;AACpB,EAAA,OAAO,KAAA,CAAM,aAAa,QAAA,CAAS,SAAA;AACrC;AAOO,SAAS,aAAA,CACd,OACA,QAAA,EACQ;AACR,EAAA,MAAM,EAAA,GAAK,cAAA,CAAe,KAAA,EAAO,QAAQ,CAAA;AACzC,EAAA,OAAO,EAAA,GAAK,MAAA,CAAO,KAAA,CAAM,IAAA,EAAM,EAAA,EAAI,KAAA,CAAM,IAAI,CAAA,GAAI,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAC9E;AAUO,SAAS,8BAAA,CACd,QAAA,EACA,YAAA,EACA,OAAA,EACA,WAAA,EACQ;AACR,EAAA,OACE,CAAA,EAAG,wBAAwB,CAAA,iBAAA,EAAe,QAAQ,sBAAsB,YAAY,CAAA,cAAA,EACpE,OAAO,CAAA,EAAA,EAAK,WAAW,CAAA,wGAAA,CAAA;AAG3C;AAQO,SAAS,kBAAA,CAAmB,UAA6B,SAAA,EAA8B;AAC5F,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAY;AAC5B,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AACrC,IAAA,IAAI,SAAA,IAAa,CAAA,CAAE,IAAA,KAAS,SAAA,EAAW;AACvC,IAAA,MAAM,EAAA,GAAK,cAAA,CAAe,CAAA,EAAG,QAAQ,CAAA;AACrC,IAAA,IAAI,EAAA,EAAI,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAAA,EACpB;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,IAAK,QAAA,CAAS,WAAW,GAAA,CAAI,GAAA,CAAI,SAAS,SAAS,CAAA;AACpE,EAAA,OAAO,CAAC,GAAG,GAAG,CAAA;AAChB;AAMO,SAAS,WAAA,CAAY,UAA6B,SAAA,EAA8B;AACrF,EAAA,OAAA,CAAQ,QAAA,CAAS,MAAA,IAAU,EAAC,EACzB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,SAAA,IAAa,CAAA,CAAE,IAAA,KAAS,SAAS,CAAA,CAChD,GAAA;AAAA,IAAI,CAAC,CAAA,KACJ,MAAA;AAAA,MACE,CAAA,CAAE,IAAA;AAAA,MACF,cAAA,CAAe,CAAA,EAAG,QAAQ,CAAA,IAAK,eAAA;AAAA,MAC/B,CAAA,CAAE,IAAA;AAAA,MACF,CAAA,CAAE,WAAW,QAAA,CAAS;AAAA;AACxB,GACF;AACJ;AAGO,SAAS,SAAS,GAAA,EAAqB;AAC5C,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAAI,GAAA;AACxE,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GACrC,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAC1C,SAAA;AACJ,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA;AAChC;AAMO,SAAS,iBAAiB,KAAA,EAAiC;AAChE,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AAC9C,IAAA,MAAA;AAAA,MACE;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAOA,eAAsB,QACpB,MAAA,EACA,KAAA,EACA,UAAA,GAAa,IAAA,EACb,YAAY,GAAA,EACmF;AAC/F,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAC9B,EAAA,IAAI,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,OAAO,IAAI,MAAA,KAAW,SAAA,IAAa,IAAA,CAAK,GAAA,KAAQ,QAAA,EAAU;AACxD,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,UAAU,CAAC,CAAA;AAClD,IAAA,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,iBAAiB,GAAA,EAAuB;AACtD,EAAA,MAAM,GAAA,GAAA,CAAO,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,GAAG,WAAA,EAAY;AAC3E,EAAA,OAAO,qEAAA,CAAsE,KAAK,GAAG,CAAA;AACvF;AAcA,eAAsB,eAAe,IAAA,EAOA;AACnC,EAAA,MAAM,EAAE,WAAW,GAAA,EAAK,OAAA,EAAS,UAAU,SAAA,EAAW,MAAA,EAAQ,KAAI,GAAI,IAAA;AAEtE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW;AAAA,MACjC,GAAA,EAAK,SAAA;AAAA,MACL,GAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,UAAA,EAAY,OAAA,CAAQ,KAAK,UAAA,EAAY,OAAA,CAAQ,GAAA,EAAI,GAAI,EAAC;AAAA;AAAA;AAAA;AAAA,MAItE,GAAI,SAAS,SAAA,GAAY,EAAE,WAAW,QAAA,CAAS,SAAA,KAAc;AAAC,KAC/D,CAAA;AACD,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI,CAAC,gBAAA,CAAiB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,SAAS,CAAA;AAClD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,OAAA,EAAU,SAAS,CAAA,qDAAA,EACd,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OACvD;AAAA,IACF;AACA,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,GAAA,CAAI,WAAW,QAAQ,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AACpC,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,WAAA,EAAa;AACzD,IAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,KAAA,IAAS,EAAC,EAAG,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,QAAQ,CAAA;AACpE,IAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,MAAA,CAAO,CAAA,MAAA,EAAS,CAAA,CAAE,KAAK,CAAA,EAAA,EAAK,CAAA,CAAE,KAAA,IAAS,QAAQ,CAAA,CAAE,CAAA;AACzE,IAAA,MAAA,CAAO,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACnC,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,IAAA,MAAA,CAAO,sFAAiF,CAAA;AACxF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,aAAa,yBAAA,CAA0B,MAAM,IAAI,gBAAA,CAAiB,QAAQ,GAAG,QAAQ,CAAA;AACzF,EAAA,IAAI,SAAA,eAAwB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,SAAS,CAAA;AACzE,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,wEAAmE,CAAA;AAC3E,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,YAAA,CAAa,EAAE,EAAE,CAAA;AAC3C,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,YAAA,CAAa,CAAA,CAAE,EAAA,EAAI,EAAE,GAAA,EAAK,KAAA,EAAO,OAAA,CAAQ,eAAA,EAAiB,CAAA;AAGhF,MAAA,IAAI,IAAI,KAAA,EAAO;AACb,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,EAAK,IAAI,KAAK,CAAA;AAC3C,QAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,UAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAC,EAC5B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA,CACnC,IAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA,CAClB,OAAO,OAAO,CAAA;AACjB,UAAA,OAAA;AAAA,YACE,cAAc,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,kBAAA,EAAqB,MAAA,CAAO,MAAM,CAAA,CAAA,CAAA,IAC7D,KAAK,MAAA,GAAS,CAAA,EAAA,EAAK,KAAK,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AAAA,WAC5C;AACA,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,SAAA,CAAU,IAAA,CAAK,MAAA,CAAO,CAAA,CAAE,IAAA,EAAM,OAAA,CAAQ,SAAA,CAAU,kBAAA,EAAoB,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAC,CAAA;AAAA,IACxF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA;AAAA,QACE,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OAC5F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,CAAA,UAAA,EAAa,SAAA,CAAU,MAAM,CAAA,UAAA,CAAY,CAAA;AAC/C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAA,EAAW,OAAA,CAAQ,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAC3C,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB;AC5TA,SAAS,YAAA,GAAwD;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrD,EAAA,MAAM,SAAA,GAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AAC1E,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAUA,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAQO,SAAS,mBAAA,GAAuC;AACrD,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAuB,wBAAwB,CAAA;AAAA,IAC1F,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kBAAA,IAAsB,cAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,kBAAA;AAAA,IACjD,UAAU,OAAA,CAAQ,GAAA,CAAI,oBAAoB,IAAA,CAAK,eAAA,IAAmB,WAAW;AAAA,GAC/E;AACF;AAGA,SAAS,KAAK,MAAA,EAAgE;AAC5E,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,QAAA,EAAW,OAAO,KAAK,CAAA,wBAAA,CAAA;AACzD,EAAA,OAAO,EAAE,YAAY,CAAA,EAAG,IAAI,gBAAgB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAS;AACrE;AA2BA,IAAM,gBAAA,GAAmB,GAAA;AAUzB,SAAS,SAAS,MAAA,EAA4C;AAC5D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,aAAa,MAAA,CAAO,QAAA,EAAU,OAAO,CAAC,CAAA;AAEhE,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAU,OAAO,MAAA;AAC9D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,gBAAA,CACd,MAAA,GAA0B,mBAAA,EAAoB,EACM;AACpD,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,SAAS,WAAW,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AAC3E,IAAA,MAAM,WACJ,OAAO,IAAA,CAAK,kBAAA,KAAuB,QAAA,GAAW,KAAK,kBAAA,GAAqB,KAAA,CAAA;AAC1E,IAAA,MAAM,cAAc,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,GAAW,KAAK,YAAA,GAAe,KAAA,CAAA;AAChF,IAAA,OAAO,QAAA,IAAY,WAAA,GAAc,EAAE,QAAA,EAAU,aAAY,GAAI,IAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAA,CAAU,QAAyB,IAAA,EAAwB;AAClE,EAAA,SAAA,CAAU,QAAQ,MAAA,CAAO,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,EAAA,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAC7E,EAAA,SAAA,CAAU,MAAA,CAAO,UAAU,GAAK,CAAA;AAClC;AAGO,SAAS,OAAO,MAAA,EAA+B;AACpD,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAc,MAAA,EAAkC;AAC9D,EAAA,OAAO,QAAA,CAAS,MAAM,CAAA,KAAM,IAAA;AAC9B;AAEA,SAAS,cAAc,KAAA,EAAkC;AACvD,EAAA,OAAO;AAAA,IACL,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,YAAY,IAAA,CAAK,GAAA,MAAS,KAAA,CAAM,UAAA,IAAc,OAAO,GAAA,GAAO;AAAA,GAC9D;AACF;AAEA,IAAM,YAAA,GAAe,CAAC,EAAA,KAA8B,IAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAExF,SAAS,aAAA,CAAc,KAAa,QAAA,EAAwB;AAC1D,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb;AAAA;;AAAA,IAAA,EAA8B,GAAG;;AAAA,oBAAA,EAA2B,QAAQ;;AAAA;AAAA;AAAA,GACtE;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACG;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,YAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,aAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAK,MAAM,CAAA;AAC7B,EAAA,MAAM,OAAO,YAAA,EAAa;AAE1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY;AAAA,IACtD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,KAAA,EAAO,gBAAA;AAAA,MACP,gBAAgB,IAAA,CAAK,SAAA;AAAA,MACrB,qBAAA,EAAuB;AAAA,KACxB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wCAAwC,SAAA,CAAU,MAAM,MAAM,MAAM,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AAErC,EAAA,QAAA,CAAS,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAA,EAAkB,OAAO,SAAS,CAAA;AAEtF,EAAA,MAAM,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAClD,EAAA,IAAI,MAAA,GAAS,UAAA;AAEb,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,MAAM,MAAM,MAAM,CAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,SAAA,CAAU,KAAA,EAAO;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,IAAA,CAAK;AAAA,OACrB;AAAA,KACF,CAAA;AACD,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,MAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAA,CAAM,UAAU,uBAAA,EAAyB;AAC7C,IAAA,IAAI,KAAA,CAAM,UAAU,WAAA,EAAa;AAC/B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,gBAAA,EAAmB,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAA,IAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD;AAGA,eAAe,OAAA,CACb,MAAA,EACA,YAAA,EACA,SAAA,EACqB;AACrB,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,KAAA,EAAO;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,eAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,WAAW,MAAA,CAAO;AAAA,KACnB;AAAA,GACF,CAAA;AACD,EAAA,MAAM,KAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,yBAAyB,KAAA,CAAM,iBAAA,IAAqB,KAAA,CAAM,KAAA,IAAS,IAAI,MAAM,CAAA;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,KAAK,CAAA;AAClC,EAAA,SAAA,CAAU,QAAQ,MAAM,CAAA;AACxB,EAAA,OAAO,MAAA;AACT;AAMA,eAAsB,cAAA,CACpB,MAAA,EACA,IAAA,GAAiB,EAAC,EACD;AACjB,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,KAAA;AACpC,EAAA,MAAM,IAAA,GAAO,SAAS,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,EAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,UAAA,SAAmB,IAAA,CAAK,YAAA;AAC9C,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,EAAe,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAC3F,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,aAAA,EAAe,SAAS,CAAA,EAAG,YAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACF;;;ACzNO,SAAS,yBAAyB,GAAA,EAAwC;AAC/E,EAAA,MAAM,IAAA,GAAY,IAAA,CAAA,IAAA,CAAK,GAAA,EAAK,sBAAsB,CAAA;AAClD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAMA,KAAA,CAAa,EAAA,CAAA,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAChD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,SAAU,GAAA,EAAqC,MAAA;AACrD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,SAAU,EAAC;AACpC,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,EAAU;AACjC,IAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,YAAA,EAAa,GAAI,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,YAAY,CAAA,EAAG;AAClC,IAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA,CAAO,CAAC,CAAE,CAAA;AAC/E,IAAA,KAAA,MAAW,OAAA,IAAW,oBAAA,CAAqB,OAAO,CAAA,EAAG;AACnD,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,KAAA,EAAO,GAAG,MAAA,CAAO,IAAI,CAAC,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAC,CAAA,CAAA;AAAA,QACtC,OAAA,EAAS,0BAA0B,OAAO,CAAA;AAAA,OAC3C,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAQA,eAAe,mBAAmB,GAAA,EAAgD;AAChF,EAAA,MAAM,QAAkC,EAAC;AACzC,EAAA,MAAM,GAAA,GAAM,CAAC,SAAA,EAA+B,IAAA,EAAc,MAAc,OAAA,KAAqB;AAC3F,IAAA,IAAI,CAAC,SAAA,EAAW;AAChB,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,SAAA,CAAU,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAC,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAC1D,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,GAAG,CAAA,IAAK,EAAC;AAChC,IAAA,IAAI,OAAA,IAAW,CAAC,QAAA,CAAS,QAAA,CAAS,OAAO,CAAA,EAAG,QAAA,CAAS,KAAK,OAAO,CAAA;AACjE,IAAA,KAAA,CAAM,GAAG,CAAA,GAAI,QAAA;AAAA,EACf,CAAA;AACA,EAAA,MAAM,WAAA,GAAc,CAAC,OAAA,KAA0B;AAC7C,IAAA,MAAM,QAAA,GAAW,sBAAsB,OAAO,CAAA;AAC9C,IAAA,KAAA,MAAW,CAAA,IAAK,QAAA,EAAU,MAAA,IAAU,EAAC,EAAG;AACtC,MAAA,GAAA,CAAI,CAAA,CAAE,aAAa,QAAA,EAAU,SAAA,EAAW,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAA;AAAA,IACnE;AAAA,EACF,CAAA;AACA,EAAA,WAAA,CAAY,GAAG,CAAA;AACf,EAAA,MAAM,YAAY,gBAAA,EAAiB;AACnC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,KAAA;AACtC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,WAAW,YAAA,EAAc,eAAA,IAAmB,CAAA;AAC3E,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,GAAA,IAAO,MAAM,KAAA,CAAM,aAAA,EAAc;AAC1C,MAAA,GAAA,CAAI,IAAI,SAAA,EAAW,GAAA,CAAI,MAAM,GAAA,CAAI,IAAA,EAAM,IAAI,OAAO,CAAA;AACpD,IAAA,KAAA,MAAW,GAAA,IAAO,MAAM,KAAA,CAAM,WAAA,EAAY,EAAG;AAC3C,MAAA,IAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,KAAW,IAAA,CAAA,OAAA,CAAQ,GAAG,CAAA,IAAQ,EAAA,CAAA,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3E,QAAA,WAAA,CAAY,IAAI,IAAI,CAAA;AAAA,MACtB;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER,CAAA,SAAE;AACA,IAAA,KAAA,CAAM,KAAA,EAAM;AAAA,EACd;AACA,EAAA,OAAO,KAAA;AACT;AASA,eAAsB,+BAA+B,GAAA,EAAgC;AACnF,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAMA,MAAa,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,wBAAwB,CAAA,EAAG,OAAO,CAAC,CAAA;AAAA,EACpF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,SAAU,GAAA,EAAqC,MAAA;AACrD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,SAAU,EAAC;AACpC,EAAA,MAAM,SAAkD,EAAC;AACzD,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,EAAU;AACjC,IAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,YAAA,EAAa,GAAI,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,YAAY,CAAA,EAAG;AAClC,IAAA,KAAA,MAAW,KAAK,YAAA,EAAc;AAC5B,MAAA,MAAM,QAAQ,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,OAAO,CAAC,CAAA;AAClD,MAAA,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAA,CAAE,WAAW,CAAA,EAAG;AAC9C,QAAA,MAAA,CAAO,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,CAAO,IAAI,CAAC,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAC,CAAA,CAAA,EAAI,OAAO,CAAA;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AACjC,EAAA,MAAM,KAAA,GAAQ,MAAM,kBAAA,CAAmB,GAAG,CAAA;AAC1C,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,KAAA,MAAW,EAAE,KAAA,EAAO,KAAA,EAAM,IAAK,MAAA,EAAQ;AACrC,IAAA,MAAM,GAAA,GAAM,SAAS,KAAK,CAAA;AAC1B,IAAA,IAAI,CAAC,IAAI,SAAA,EAAW;AACpB,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,CAAA,EAAG,GAAA,CAAI,SAAS,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,CAAE,CAAA;AACjE,IAAA,MAAM,SAAS,CAAA,EAAG,wBAAwB,CAAA,iBAAA,EAAe,KAAK,iBAAiB,KAAK,CAAA,CAAA,CAAA;AACpF,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,GAAA,CAAI,IAAA;AAAA,QACF,GAAG,MAAM,CAAA,oHAAA;AAAA,OACX;AAAA,IACF,WAAW,GAAA,CAAI,GAAA,IAAO,QAAA,CAAS,MAAA,GAAS,KAAK,CAAC,QAAA,CAAS,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,GAAA,CAAI,GAAA,EAAK,CAAC,CAAC,CAAA,EAAG;AACxF,MAAA,GAAA,CAAI,IAAA;AAAA,QACF,CAAA,EAAG,MAAM,CAAA,0BAAA,EAA6B,GAAA,CAAI,GAAG,CAAA,mCAAA,EAAsC,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAA;AAAA,OACxG;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,wBAAwB,GAAA,EAAqB;AAC3D,EAAA,OAAO,CAAA,mBAAA,EAAsB,GAAG,CAAA,GAAA,EAAM,cAAc,CAAA,CAAA,CAAA;AACtD;AAOO,SAAS,4BAA4B,GAAA,EAAqB;AAC/D,EAAA,MAAM,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,OAAA,CAAQ,MAAM,EAAE,CAAA;AACxC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAA,CAAO,uBAAA,CAAwB,GAAG,CAAC,CAAA;AACnC,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,IAAA;AACT;AAQO,SAAS,0BAA0B,GAAA,EAAuB;AAC/D,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAMA,MAAa,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,wBAAwB,CAAA,EAAG,OAAO,CAAC,CAAA;AAAA,EACpF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,SAAiB,EAAC;AAC7C,EAAA,MAAM,EAAE,SAAA,EAAW,MAAA,EAAO,GAAI,GAAA;AAC9B,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,EAAgB,KAAA,KAAwB;AACrD,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC/B,IAAA,IAAI,CAAC,iBAAiB,KAAA,CAAM,IAAA,GAAO,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAC,CAAA,EAAG;AACrD,MAAA,QAAA,CAAS,IAAA,CAAK,GAAG,wBAAwB,CAAA,CAAA,EAAI,KAAK,CAAA,QAAA,EAAM,uBAAA,CAAwB,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAC1F;AAAA,EACF,CAAA;AACA,EAAA,KAAA,CAAM,WAAW,aAAa,CAAA;AAC9B,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,IAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,MAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,EAAU;AACjC,MAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,gBAAe,GAAI,CAAA;AAClD,MAAA,KAAA,CAAM,cAAA,EAAgB,YAAY,MAAA,CAAO,IAAI,CAAC,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IAClE;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAOO,SAAS,+BAAA,CAAgC,KAAa,OAAA,EAAuB;AAClF,EAAA,MAAM,QAAA,GAAW,0BAA0B,GAAG,CAAA;AAC9C,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AAC3B,EAAA,KAAA,MAAW,OAAA,IAAW,QAAA,EAAU,MAAA,CAAO,OAAO,CAAA;AAC9C,EAAA,MAAA;AAAA,IACE,CAAA,qBAAA,EAAwB,wBAAwB,CAAA,uBAAA,EAA0B,OAAO,CAAA,6DAAA;AAAA,GACnF;AACA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB;AAOO,SAAS,qBAAA,CAAsB,KAAa,IAAA,EAA0C;AAC3F,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,GAAA,EAAK,IAAI,CAAA;AAC3C,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,CAAO,qBAAA,CAAsB,IAAI,CAAC,CAAA;AAC5D,EAAA,OAAO,KAAA,CAAM,MAAA;AACf;AAGO,SAAS,qBAAA,CAAsB,KAAa,IAAA,EAAoB;AACrE,EAAA,MAAM,KAAA,GAAQ,sBAAsB,GAAG,CAAA;AACvC,EAAA,IAAI,UAAU,CAAA,EAAG;AACjB,EAAA,MAAA,CAAO,GAAG,KAAK,CAAA,eAAA,EAAkB,GAAG,CAAA,6BAAA,EAAgC,IAAI,CAAA,GAAA,CAAK,CAAA;AAC7E,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB;AAuBA,eAAsB,YAAA,CACpB,GAAA,EACA,KAAA,EACA,IAAA,GAA0D,EAAC,EAC9B;AAC7B,EAAA,MAAM,EAAE,kBAAA,EAAmB,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACxE,EAAA,MAAM,GAAA,GAAM,KAAA,IAAU,MAAM,WAAA,EAAY;AACxC,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,kBAAA,CAAmB,GAAA,EAAK,IAAI,EAAA,EAAI,GAAA,CAAI,IAAA,EAAM,eAAA,EAAiB,CAAA;AAC9E,IAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,IAAA,CAAK,EAAE,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AACvD,IAAA,IAAI,GAAA,CAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAIzB,MAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,GAAA,CAAI,MAAM,CAAA;AAC/B,MAAA,KAAA,MAAW,KAAA,IAAS,MAAM,GAAA,CAAI,WAAA,EAAY,EAAG;AAC3C,QAAA,IAAI,KAAA,CAAM,OAAO,GAAA,CAAI,EAAA,IAAM,MAAM,OAAA,KAAY,OAAA,IAAW,CAAC,KAAA,CAAM,IAAA,EAAM;AACrE,QAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,IAAI,CAAA,EAAG;AAChC,QAAA,MAAM,IAAI,kBAAA,CAAmB,GAAA,EAAK,KAAA,CAAM,EAAA,EAAI,MAAM,IAAA,EAAM,eAAA,EAAiB,CAAA,CAAE,IAAA,CAAK;AAAA,UAC9E,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,aAAa,GAAA,CAAI,WAAA;AAAA,MACjB,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,QAAQ,GAAA,CAAI;AAAA,KACd;AAAA,EACF,CAAA,SAAE;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM;AAAA,EACxB;AACF;AA2BO,SAAS,+BAAA,CACd,GAAA,EACA,IAAA,EACA,aAAA,EACuD;AACvD,EAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAAe,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,GAAI,CAAA;AAC9D,EAAA,IAAI,IAAA,CAAK,SAAA,EAAW,IAAA,EAAK,SAAU,EAAE,SAAA,EAAW,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,CAAA,EAAG,QAAQ,MAAA,EAAO;AAC5F,EAAA,MAAM,WAAW,qBAAA,CAAsB,GAAA,CAAI,IAAI,CAAA,EAAG,WAAW,IAAA,EAAK;AAClE,EAAA,IAAI,QAAA,SAAiB,EAAE,SAAA,EAAW,KAAK,QAAQ,CAAA,EAAG,QAAQ,UAAA,EAAW;AAGrE,EAAA,MAAM,YAAY,aAAA,EAAe,WAAA,IAAe,eAAe,QAAA,GAAW,IAAA,GAAO,WAAA,EAAY;AAC7F,EAAA,IAAI,QAAA,IAAY,iBAAiB,QAAQ,CAAA,SAAU,EAAE,SAAA,EAAW,QAAA,EAAU,MAAA,EAAQ,UAAA,EAAW;AAG7F,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,GAAA,CAAI,IAAI,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtE,IAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,MAAA,EAAQ,cAAA,EAAe;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,SAAA,EAAW,SAAA,EAAW,MAAA,EAAQ,cAAA,EAAe;AAAA,EACxD;AACF;AAmBO,SAAS,uBAAA,CACd,OAAA,EACA,QAAA,EACA,gBAAA,GAAmB,KAAA,EACb;AACN,EAAA,IAAI,QAAA,CAAS,WAAW,cAAA,EAAgB;AACxC,EAAA,MAAM,QAAA,GAAW,wBAAwB,OAAO,CAAA,mBAAA,CAAA;AAChD,EAAA,OAAA;AAAA,IACE,CAAA,oEAAA,EAAkE,SAAS,SAAS,CAAA,oBAAA,CAAA,IACjF,mBACG,CAAA,4EAAA,EAA+E,QAAQ,CAAA,CAAA,CAAA,GACvF,CAAA,oDAAA,EAAuD,QAAQ,CAAA,CAAA,CAAA;AAAA,GACvE;AACF;AAUA,SAAS,0BAA0B,QAAA,EAAwB;AACzD,EAAA,IAAI,aAAa,CAAC,UAAA,EAAY,YAAY,aAAa,CAAA,CACpD,IAAI,CAAC,CAAA,KAAW,UAAK,QAAA,EAAU,CAAC,CAAC,CAAA,CACjC,IAAA,CAAK,CAAC,CAAA,KAAS,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,UAAA,EAAY;AAGf,IAAA,MAAM,QAAA,GAAc,EAAA,CAAA,WAAA,CAAY,QAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,YAAY,CAAC,CAAA;AAC9E,IAAA,IAAI,QAAA,EAAU,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,QAAA,EAAU,QAAQ,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,CAAC,UAAA,EAAY;AACjB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,MAAM,IAAA,EAAK,GAAI,iBAAoB,EAAA,CAAA,YAAA,CAAa,UAAA,EAAY,MAAM,CAAC,CAAA;AAC3E,IAAA,MAAM,EAAA,GAAKC,SAAA,CAAc,IAAI,CAAA,CAAE,OAAA,EAAQ;AACvC,IAAG,iBAAc,UAAA,EAAY,CAAA;AAAA,EAAQ,EAAE;AAAA;;AAAA,EAAY,IAAI;AAAA,CAAA,EAAM,MAAM,CAAA;AAAA,EACrE,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AA6BA,eAAsB,oBAAA,CACpB,GAAA,EACA,KAAA,EACA,KAAA,EAC6C;AAC7C,EAAA,MAAM,EAAE,SAAA,EAAW,MAAA,EAAO,GAAI,+BAAA;AAAA,IAC5B,GAAA;AAAA,IACA,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU;AAAA,IAC7B,gBAAA;AAAiB,GACnB;AACA,EAAA,uBAAA,CAAwB,IAAI,IAAA,EAAM,EAAE,SAAA,EAAW,MAAA,IAAU,IAAI,CAAA;AAC7D,EAAA,yBAAA,CAA0B,MAAM,QAAQ,CAAA;AACxC,EAAA,sBAAA,CAAuB,GAAA,CAAI,MAAM,SAAS,CAAA;AAC1C,EAAA,mBAAA,CAAoB,IAAI,IAAA,EAAM;AAAA,IAC5B,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,MAAW,IAAA,CAAA,QAAA,CAAS,GAAA,CAAI,MAAM,KAAA,CAAM,QAAQ,KAAK,KAAA,CAAM,IAAA;AAAA,IACvD,SAAS,KAAA,CAAM,OAAA;AAAA,IACf;AAAA,GACD,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,GAAA,EAAK,KAAK,CAAA;AACzC,EAAA,KAAA,MAAW,CAAA,IAAK,GAAA,CAAI,MAAA,EAAQ,OAAA,CAAQ,CAAC,CAAA;AACrC,EAAA,OAAO,EAAE,SAAA,EAAW,GAAA,EAAK,MAAA,CAAO,KAAA,CAAM,IAAA,EAAM,SAAA,EAAW,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA,EAAE;AACpF;AAGO,IAAM,oBAAA,GACX,gHAAA;AAGK,IAAM,mBAAA,GAAsB,qHAAgH,oBAAoB,CAAA;AAGhK,SAAS,mBAAA,GAA8B;AAC5C,EAAA,OAAO,IAAI,MAAA,CAAO,mBAAA,EAAqB,gBAAgB,EAAE,QAAA,EAAS;AACpE;AAGO,SAAS,0BAA0B,IAAA,EAAkC;AAC1E,EAAA,IAAI,IAAA,CAAK,WAAW,MAAA,EAAW;AAC/B,EAAA,MAAA,CAAO,mBAAmB,CAAA;AAC1B,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB;AAGA,SAAS,SAAA,CAAU,MAAc,KAAA,EAA4C;AAC3E,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,KAAsB;AAClC,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAa,EAAA,CAAA,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,QAAA,IAAI,CAAC,MAAM,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IAAK,KAAA,CAAM,SAAS,cAAA,EAAgB;AAChE,UAAA,IAAA,CAAU,IAAA,CAAA,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,QACjC;AAAA,MACF,CAAA,MAAA,IAAW,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,EAAG;AAC5B,QAAA,KAAA,CAAM,IAAA,CAAU,IAAA,CAAA,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,MACvC;AAAA,IACF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,IAAI,CAAA;AACT,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,iBAAiB,IAAA,EAAsB;AACrD,EAAA,OAAO,UAAU,IAAA,EAAM,CAAC,IAAA,KAAS,IAAA,KAAS,WAAW,CAAA,CAAE,MAAA;AACzD;AASO,SAAS,uBAAuB,IAAA,EAAsB;AAC3D,EAAA,MAAM,KAAA,GAAQ,iBAAiB,IAAI,CAAA;AACnC,EAAA,IAAI,QAAQ,CAAA,EAAG;AACb,IAAA,OAAA;AAAA,MACE,CAAA,EAAG,KAAK,CAAA,2IAAA,EACoD,oBAAoB,CAAA;AAAA,KAClF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AASO,SAAS,sBAAsB,IAAA,EAAsB;AAC1D,EAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,EAAM,CAAC,SAAS,IAAA,CAAK,QAAA,CAAS,cAAc,CAAC,CAAA;AACrE,EAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAW,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,CAAC,KAAK,CAAC,CAAA;AACtE,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,MAAA,GAAS,KAAA,CAAM,MAAA,GAAS,MAAM,KAAA,CAAM,MAAA,GAAS,KAAA,CAAM,MAAM,CAAA,KAAA,CAAA,GAAU,EAAA;AACtF,IAAA,OAAA;AAAA,MACE,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,wEAAA,EAA2E,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA,8BAAA,EAChF,IAAI,mDAAmD,oBAAoB,CAAA;AAAA,KAC9G;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,MAAA;AACf","file":"chunk-FB3NREF7.js","sourcesContent":["/**\n * Shared store-interaction core for the two publish front-ends — the curator\n * sidecar flow (`source manifest publish`) and the first-party library flow\n * (`library publish`). Both differ only in their git side-effects + how they\n * resolve the source repo; the store orchestration below (register → sync →\n * candidates → per-asset preview+publish) is identical.\n *\n * The store REST surface is reached through the injectable {@link PublisherClient}\n * so the orchestration stays unit/integration-testable without a live store.\n *\n * @docLink cli/commands/source#manifest-publish\n */\n\nimport { SKAILE_MANIFEST_FILENAME, type SkPublishManifest } from \"@skaile/workspaces/core\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport type { PublisherClient } from \"../store-publisher.ts\";\n\n/**\n * One-line rendering of a namespace-availability probe for a `--dry-run` plan.\n * The `message` is store-authored (identical to what a real publish would echo)\n * — we only prepend a status glyph so the reader sees green/amber/red at a\n * glance without the CLI re-deriving any authorization logic.\n */\nexport function formatNamespaceAvailability(a: {\n  status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n  message: string;\n}): string {\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return `${S.ok(\"✓\")} ${a.message}`;\n    case \"claimable-by-you\":\n      return `${S.warn(\"!\")} ${a.message}`;\n    default:\n      return `${S.err(\"✗\")} ${a.message}`;\n  }\n}\n\n/**\n * Preflight the target namespace against the store's availability probe BEFORE a\n * publish does any irreversible work (a public git push). Returns `{ ok: false }`\n * with a guided message for `reserved` (not yours) and `claimable-by-you` (must\n * claim first) — the two states a real publish would reject — so the caller can\n * abort with actionable guidance instead of a raw 422 after pushing bytes.\n *\n * The probe is advisory: any failure (offline, older store) returns `{ ok: true }`\n * so the store stays the authority and a valid publish is never blocked.\n */\nexport async function preflightNamespace(\n  client: PublisherClient,\n  namespace: string,\n): Promise<{ ok: boolean; message?: string }> {\n  let a: Awaited<ReturnType<PublisherClient[\"namespaceAvailability\"]>>;\n  try {\n    a = await client.namespaceAvailability(namespace);\n  } catch {\n    return { ok: true };\n  }\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return { ok: true };\n    case \"claimable-by-you\":\n      return {\n        ok: false,\n        message:\n          `@${namespace} isn't yours yet — claim it in the store first` +\n          `${a.claimMethod ? ` (${a.claimMethod})` : \"\"}, then re-run. ${a.message}`,\n      };\n    default: // reserved, or any unrecognized future status (fail safe → block)\n      return { ok: false, message: `Cannot publish under @${namespace} — ${a.message}` };\n  }\n}\n\n/** One candidate row shape the matcher operates on (kind + name are the key). */\ninterface CandidateLike {\n  kind: string;\n  name: string;\n}\n\n/**\n * Keep only candidates whose `(kind, name)` pair is declared in the manifest.\n * The backend may merge extra assets from the base repo into the candidate\n * list; a publish only touches what the manifest curated/declared.\n */\nexport function matchCandidatesToManifest<T extends CandidateLike>(\n  candidates: T[],\n  manifest: SkPublishManifest,\n): T[] {\n  const wanted = new Set((manifest.assets ?? []).map((a) => `${a.kind}:${a.name}`));\n  return candidates.filter((c) => wanted.has(`${c.kind}:${c.name}`));\n}\n\n/** A canonical ref string `kind:@publisher/name[#version]` for reporting. */\nexport function refFor(kind: string, publisher: string, name: string, version?: string): string {\n  const base = `${kind}:@${publisher}/${name}`;\n  return version ? `${base}#${version}` : base;\n}\n\n/** Placeholder namespace shown when neither the asset nor the manifest names a publisher. */\nconst UNSET_NAMESPACE = \"<manifest publisher>\";\n\n/**\n * The publisher namespace one manifest asset publishes under:\n * `assets[].publisher` first, else the manifest's top-level `publisher` —\n * the same priority discovery applies when it indexes the asset. `undefined`\n * when neither is declared.\n */\nexport function assetNamespace(\n  asset: { publisher?: string },\n  manifest: SkPublishManifest,\n): string | undefined {\n  return asset.publisher ?? manifest.publisher;\n}\n\n/**\n * The version-less canonical ref of one manifest asset for messages:\n * `kind:@<publisher>/<name>` (`assets[].publisher ?? publisher`), or the bare\n * `kind:name` when the manifest declares no namespace.\n */\nexport function assetEntryRef(\n  asset: { kind: string; name: string; publisher?: string },\n  manifest: SkPublishManifest,\n): string {\n  const ns = assetNamespace(asset, manifest);\n  return ns ? refFor(asset.kind, ns, asset.name) : `${asset.kind}:${asset.name}`;\n}\n\n/**\n * The warning `skaile validate` and the publish plan print when a manifest\n * entry's `version` differs from the one in the asset's own file. The file is\n * the source of truth; `skaile library index` rewrites the entry from it.\n *\n * @param entryRef - {@link assetEntryRef} of the entry.\n * @param relFile - the asset file, relative to the library root (posix).\n */\nexport function manifestVersionMismatchMessage(\n  entryRef: string,\n  entryVersion: string,\n  relFile: string,\n  fileVersion: string,\n): string {\n  return (\n    `${SKAILE_MANIFEST_FILENAME} [assets] — ${entryRef}: manifest version ${entryVersion} ` +\n    `differs from ${relFile} (${fileVersion}). The file is the source of truth: ` +\n    \"bump the version there, then run `skaile library index <library>`.\"\n  );\n}\n\n/**\n * Every distinct namespace the manifest's assets (optionally narrowed to\n * `assetName`) publish under, in first-seen order. A manifest whose assets\n * carry no namespace at all falls back to its top-level `publisher` so an\n * empty inventory still reports the namespace it would claim.\n */\nexport function manifestNamespaces(manifest: SkPublishManifest, assetName?: string): string[] {\n  const out = new Set<string>();\n  for (const a of manifest.assets ?? []) {\n    if (assetName && a.name !== assetName) continue;\n    const ns = assetNamespace(a, manifest);\n    if (ns) out.add(ns);\n  }\n  if (out.size === 0 && manifest.publisher) out.add(manifest.publisher);\n  return [...out];\n}\n\n/**\n * The canonical refs a publish would produce, one per manifest asset (optionally\n * narrowed to `assetName`), each under its own `assets[].publisher ?? publisher`.\n */\nexport function plannedRefs(manifest: SkPublishManifest, assetName?: string): string[] {\n  return (manifest.assets ?? [])\n    .filter((a) => !assetName || a.name === assetName)\n    .map((a) =>\n      refFor(\n        a.kind,\n        assetNamespace(a, manifest) ?? UNSET_NAMESPACE,\n        a.name,\n        a.version ?? manifest.version,\n      ),\n    );\n}\n\n/** The bare asset name from a `kind:@publisher/name#version` ref or a plain name. */\nexport function bareName(ref: string): string {\n  const afterKind = ref.includes(\":\") ? ref.slice(ref.indexOf(\":\") + 1) : ref;\n  const afterScope = afterKind.includes(\"/\")\n    ? afterKind.slice(afterKind.indexOf(\"/\") + 1)\n    : afterKind;\n  return afterScope.split(\"#\")[0];\n}\n\n/**\n * Refuse a present-but-empty `--asset` (`--asset \"$UNSET\"`): an empty string is falsy, so it\n * would silently select every asset of a publish, register or yank.\n */\nexport function exitOnEmptyAsset(asset: string | undefined): void {\n  if (asset !== undefined && asset.trim() === \"\") {\n    logErr(\n      \"--asset needs a ref (`kind:@publisher/name[#version]` or a name); it is empty. Drop the option to select every asset.\",\n    );\n    process.exit(1);\n  }\n}\n\n/**\n * Poll a job until it leaves `running` or the deadline passes. Returns the last\n * observed state — the caller MUST treat a still-`running` result as a timeout\n * (not success), since it means the deadline was hit before the job finished.\n */\nexport async function pollJob(\n  client: PublisherClient,\n  jobId: string,\n  intervalMs = 1_500,\n  timeoutMs = 60_000,\n): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }> {\n  const deadline = Date.now() + timeoutMs;\n  let job = await client.jobGet(jobId);\n  while (job.status === \"running\" && Date.now() < deadline) {\n    await new Promise((r) => setTimeout(r, intervalMs));\n    job = await client.jobGet(jobId);\n  }\n  return job;\n}\n\n/**\n * True when a `sourcesAdd` rejection is a duplicate-URL conflict (the source is\n * already registered) — the only error the publish flow recovers from by looking\n * the existing row up. Every other failure (auth, 5xx, network) must propagate.\n */\nexport function isDupSourceError(err: unknown): boolean {\n  const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();\n  return /\\b409\\b|conflict|duplicate|already exists|already registered|unique/.test(msg);\n}\n\n/**\n * Register + sync the source, then publish its curated/declared candidates —\n * the store-side steps shared by both publish front-ends. Git side-effects (the\n * sidecar push, or the library commit+push) happen in the caller *before* this;\n * this function is purely store interaction.\n *\n * The sidecar front-end passes `sidecar` (so `sourcesAdd` carries the sidecar\n * pin); the library front-end omits it (the source repo IS the manifest host).\n * `assetName`, when set, narrows publication to the single candidate of that\n * name. Fatal store states (`sourcesAdd` non-dup failure) surface; sync failures\n * and empty candidate sets `process.exit(1)` with the same messages as before.\n */\nexport async function publishToStore(opts: {\n  sourceUrl: string;\n  ref: string;\n  sidecar?: { url: string; ref: string };\n  manifest: SkPublishManifest;\n  assetName?: string;\n  client: PublisherClient;\n}): Promise<{ published: string[] }> {\n  const { sourceUrl, ref, sidecar, manifest, assetName, client: pub } = opts;\n\n  let sourceId: string;\n  try {\n    const added = await pub.sourcesAdd({\n      url: sourceUrl,\n      ref,\n      ...(sidecar ? { sidecarUrl: sidecar.url, sidecarRef: sidecar.ref } : {}),\n      // Publish under the manifest's declared namespace; the store resolves a\n      // claimed Publisher when it differs from the caller's login, else defaults\n      // to `@<username>`. Omitted when the manifest carries no publisher.\n      ...(manifest.publisher ? { namespace: manifest.publisher } : {}),\n    });\n    sourceId = added.id;\n  } catch (err) {\n    // Only a duplicate-url conflict is recoverable (source already registered);\n    // auth/5xx/network failures must surface, not silently reuse a stale row.\n    if (!isDupSourceError(err)) throw err;\n    const rows = await pub.sourcesList();\n    const found = rows.find((r) => r.url === sourceUrl);\n    if (!found) {\n      throw new Error(\n        `Source ${sourceUrl} looked already-registered but no owned row matched: ` +\n          `${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n    sourceId = found.id;\n  }\n\n  const { jobId } = await pub.sourceSync(sourceId);\n  const job = await pollJob(pub, jobId);\n  if (job.status === \"failed\" || job.status === \"cancelled\") {\n    const failed = (job.items ?? []).filter((i) => i.status === \"failed\");\n    for (const i of failed) logErr(`sync: ${i.label}: ${i.error ?? \"failed\"}`);\n    logErr(`Source sync ${job.status}.`);\n    process.exit(1);\n  }\n  // A still-`running` job means the poll deadline was hit — do NOT proceed on an\n  // unfinished sync (it would read incomplete candidates).\n  if (job.status === \"running\") {\n    logErr(\"Source sync timed out before completing — re-run `publish`, or check the store.\");\n    process.exit(1);\n  }\n\n  let candidates = matchCandidatesToManifest(await pub.sourceCandidates(sourceId), manifest);\n  if (assetName) candidates = candidates.filter((c) => c.name === assetName);\n  if (candidates.length === 0) {\n    logWarn(\"No candidates discovered — check the manifest and the source ref.\");\n    process.exit(1);\n  }\n\n  const published: string[] = [];\n  for (const c of candidates) {\n    try {\n      const preview = await pub.assetPreview(c.id);\n      const res = await pub.assetPublish(c.id, { ref, files: preview.discoveredFiles });\n      // Publish is async — wait for the job so we only report refs that actually\n      // landed, not ones whose import is still in flight or about to fail.\n      if (res.jobId) {\n        const pubJob = await pollJob(pub, res.jobId);\n        if (pubJob.status !== \"succeeded\") {\n          const errs = (pubJob.items ?? [])\n            .filter((i) => i.status === \"failed\")\n            .map((i) => i.error)\n            .filter(Boolean);\n          logWarn(\n            `Publish of ${c.kind}:${c.name} did not succeed (${pubJob.status})` +\n              (errs.length ? `: ${errs.join(\"; \")}` : \"\"),\n          );\n          continue;\n        }\n      }\n      published.push(refFor(c.kind, preview.candidate.publisherNamespace, c.name, c.version));\n    } catch (err) {\n      logWarn(\n        `Failed to publish ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  logOk(`Published ${published.length} asset(s):`);\n  for (const r of published) logInfo(`  ${r}`);\n  return { published };\n}\n","/**\n * Keycloak Device Authorization Grant (RFC 8628) for the store CLI: a public\n * device-flow client (`skaile-store-cli`) issues a plain realm JWT the store's\n * `AuthGuard` accepts — a CLI can't use the storefront's confidential browser\n * client. Tokens cache at `~/.skaile/auth.json` (0600, shared with `store/cli`);\n * `getAccessToken` refreshes transparently. All targets are env-overridable.\n *\n * @docLink cli/dev-guide#store-auth\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { globalSkaileDir } from \"@skaile/workspaces/core\";\n\n/**\n * A PKCE (RFC 7636) `code_verifier` + its S256 `code_challenge`. Keycloak\n * enforces PKCE on the `skaile-store-cli` device flow (the device-authorization\n * request 400s with \"Missing parameter: code_challenge_method\" otherwise), so\n * every `deviceLogin` mints a fresh pair: the challenge goes on the device-auth\n * request, the verifier on the matching token poll. `base64url` (no padding)\n * per the spec.\n */\nfunction makePkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  const challenge = createHash(\"sha256\").update(verifier).digest(\"base64url\");\n  return { verifier, challenge };\n}\n\n/** Resolved auth targets — every field has a prod default, all env-overridable. */\nexport interface StoreAuthConfig {\n  keycloakUrl: string;\n  realm: string;\n  clientId: string;\n  authFile: string;\n}\n\nfunction trimTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Load the auth config. Defaults target the production store\n * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);\n * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /\n * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.\n */\nexport function loadStoreAuthConfig(): StoreAuthConfig {\n  return {\n    keycloakUrl: trimTrailingSlash(process.env.SKAILE_KEYCLOAK_URL ?? \"https://auth.skaile.ai\"),\n    realm: process.env.SKAILE_STORE_REALM ?? \"skaile-store\",\n    clientId: process.env.SKAILE_STORE_CLI_CLIENT ?? \"skaile-store-cli\",\n    authFile: process.env.SKAILE_AUTH_FILE ?? join(globalSkaileDir(), \"auth.json\"),\n  };\n}\n\n/** Keycloak OIDC endpoints derived from the realm base. */\nfunction oidc(config: StoreAuthConfig): { deviceAuth: string; token: string } {\n  const base = `${config.keycloakUrl}/realms/${config.realm}/protocol/openid-connect`;\n  return { deviceAuth: `${base}/auth/device`, token: `${base}/token` };\n}\n\nexport interface StoredAuth {\n  access_token: string;\n  refresh_token?: string;\n  /** Epoch ms when the access token expires (with a safety margin already applied). */\n  expires_at: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  error?: string;\n  error_description?: string;\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  interval?: number;\n  expires_in: number;\n}\n\n/** Refresh this many ms before real expiry so an in-flight call never 401s. */\nconst EXPIRY_MARGIN_MS = 30_000;\n\n/** Injectable seams so the poll loop is unit-testable without real time or network. */\nexport interface AuthDeps {\n  fetchImpl?: typeof fetch;\n  sleep?: (ms: number) => Promise<void>;\n  /** Called once with the verification URL + user code (default: write to stderr). */\n  onPrompt?: (url: string, userCode: string) => void;\n}\n\nfunction readAuth(config: StoreAuthConfig): StoredAuth | null {\n  try {\n    const parsed = JSON.parse(readFileSync(config.authFile, \"utf-8\"));\n    // Reject a corrupt / hand-edited file rather than treat it as a session.\n    if (parsed && typeof parsed.access_token === \"string\") return parsed as StoredAuth;\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The caller's store identity, decoded LOCALLY from the cached token's JWT\n * payload (no network, no signature check — this is an author-side hint, not an\n * authorization decision). Returns `null` when not signed in or the token is\n * unreadable. `githubLogin` is the verified GitHub handle (the preferred\n * publisher namespace); `username` is the Keycloak `preferred_username`.\n */\nexport function getStoreIdentity(\n  config: StoreAuthConfig = loadStoreAuthConfig(),\n): { username?: string; githubLogin?: string } | null {\n  const auth = readAuth(config);\n  if (!auth) return null;\n  try {\n    const payload = auth.access_token.split(\".\")[1];\n    const json = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf-8\"));\n    const username =\n      typeof json.preferred_username === \"string\" ? json.preferred_username : undefined;\n    const githubLogin = typeof json.github_login === \"string\" ? json.github_login : undefined;\n    return username || githubLogin ? { username, githubLogin } : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeAuth(config: StoreAuthConfig, auth: StoredAuth): void {\n  mkdirSync(dirname(config.authFile), { recursive: true });\n  writeFileSync(config.authFile, JSON.stringify(auth, null, 2), { mode: 0o600 });\n  chmodSync(config.authFile, 0o600);\n}\n\n/** Remove the cached session (sign out). */\nexport function logout(config: StoreAuthConfig): void {\n  try {\n    rmSync(config.authFile);\n  } catch {\n    // already absent — nothing to do\n  }\n}\n\n/** True when a cached, well-formed session exists (validity/refresh resolved on use). */\nexport function hasStoredAuth(config: StoreAuthConfig): boolean {\n  return readAuth(config) !== null;\n}\n\nfunction tokenToStored(token: TokenResponse): StoredAuth {\n  return {\n    access_token: token.access_token,\n    refresh_token: token.refresh_token,\n    expires_at: Date.now() + (token.expires_in ?? 300) * 1000 - EXPIRY_MARGIN_MS,\n  };\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\nfunction defaultPrompt(url: string, userCode: string): void {\n  process.stderr.write(\n    `\\nTo sign in, open:\\n\\n    ${url}\\n\\nand enter the code: ${userCode}\\n\\nWaiting for approval…\\n`,\n  );\n}\n\n/**\n * Run the device flow to completion, persisting tokens on success. Prints the\n * verification URL + user code for the operator to approve in a browser.\n */\nexport async function deviceLogin(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<StoredAuth> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const sleep = deps.sleep ?? defaultSleep;\n  const onPrompt = deps.onPrompt ?? defaultPrompt;\n  const endpoints = oidc(config);\n  const pkce = makePkcePair();\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuth, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      client_id: config.clientId,\n      scope: \"openid profile\",\n      code_challenge: pkce.challenge,\n      code_challenge_method: \"S256\",\n    }),\n  });\n  if (!deviceRes.ok) {\n    throw new Error(\n      `Device authorization request failed (${deviceRes.status}): ${await deviceRes.text()}`,\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthResponse;\n\n  onPrompt(device.verification_uri_complete ?? device.verification_uri, device.user_code);\n\n  const intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n  let waitMs = intervalMs;\n\n  while (Date.now() < deadline) {\n    await sleep(waitMs);\n    const tokenRes = await fetchImpl(endpoints.token, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: device.device_code,\n        client_id: config.clientId,\n        code_verifier: pkce.verifier,\n      }),\n    });\n    const token = (await tokenRes.json()) as TokenResponse;\n    if (tokenRes.ok) {\n      const stored = tokenToStored(token);\n      writeAuth(config, stored);\n      return stored;\n    }\n    // RFC 8628 §3.5 pending / slow-down handling.\n    if (token.error === \"authorization_pending\") continue;\n    if (token.error === \"slow_down\") {\n      waitMs += 5_000;\n      continue;\n    }\n    throw new Error(`Sign-in failed: ${token.error_description ?? token.error ?? \"unknown error\"}`);\n  }\n  throw new Error(\"Sign-in timed out before approval.\");\n}\n\n/** Exchange a refresh token for a fresh access token; persist on success. */\nasync function refresh(\n  config: StoreAuthConfig,\n  refreshToken: string,\n  fetchImpl: typeof fetch,\n): Promise<StoredAuth> {\n  const res = await fetchImpl(oidc(config).token, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n      client_id: config.clientId,\n    }),\n  });\n  const token = (await res.json()) as TokenResponse;\n  if (!res.ok) {\n    throw new Error(\n      `Token refresh failed: ${token.error_description ?? token.error ?? res.status}`,\n    );\n  }\n  const stored = tokenToStored(token);\n  writeAuth(config, stored);\n  return stored;\n}\n\n/**\n * Return a valid access token, refreshing if it is expired (or about to). Throws\n * a clear \"run `skaile store login`\" error when there is no usable session.\n */\nexport async function getAccessToken(\n  config: StoreAuthConfig,\n  deps: AuthDeps = {},\n): Promise<string> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const auth = readAuth(config);\n  if (!auth) throw new Error(\"Not signed in. Run `skaile store login` first.\");\n  if (Date.now() < auth.expires_at) return auth.access_token;\n  if (!auth.refresh_token) throw new Error(\"Session expired. Run `skaile store login` again.\");\n  try {\n    return (await refresh(config, auth.refresh_token, fetchImpl)).access_token;\n  } catch {\n    throw new Error(\"Session expired and refresh failed. Run `skaile store login` again.\");\n  }\n}\n","/**\n * library-index.ts — index a user library's on-disk assets into the shared\n * `asset_definitions` index so `add` / `asset install` / `search --local` can\n * resolve them, plus publisher resolution for a freshly-created asset.\n *\n * A `library create`d asset is bytes on disk only until it is indexed; the\n * index is what every resolution path reads. Indexing reuses the same\n * `LocalCatalogSource.sync()` engine `source add`/`sync` run — a library is\n * scanned + upserted keyed by `library_id = lib.id`.\n *\n * @docLink cli/commands/library\n */\n\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  isValidPublisher,\n  loadSkPublishManifest,\n  matchPin,\n  parseDep,\n  parseFrontmatter,\n  PUBLISHER_HINT,\n  SKAILE_MANIFEST_FILENAME,\n  slugifyAssetName,\n} from \"@skaile/workspaces/core\";\nimport {\n  librarySymlinkMessage,\n  listLibrarySymlinks,\n} from \"@skaile/workspaces/core/publish-manifest\";\nimport { type DiscoveredAsset, requiresSyntaxErrors } from \"@skaile/workspaces/discovery\";\nimport {\n  type Library,\n  LocalIndex,\n  resolveIndexPath,\n  stampManifestPublisher,\n  upsertManifestAsset,\n} from \"@skaile/workspaces/library\";\nimport { Option } from \"commander\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport { logErr, logWarn } from \"../helpers.ts\";\nimport { openLibrary } from \"../open-library.ts\";\nimport { getKindRegistry } from \"../open-registry.ts\";\nimport { getStoreIdentity } from \"../store-auth.ts\";\nimport { refFor } from \"./publish-core.ts\";\n\n/** One malformed `assets[].dependencies` entry of a library's `skaile.manifest.yaml`. */\nexport interface ManifestRequiresProblem {\n  /** `kind:name` of the manifest asset that declares the entry. */\n  asset: string;\n  /** `ManifestRequiresError: invalid requires entry \"<entry>\"` — the text discovery reports. */\n  message: string;\n}\n\n/**\n * Check every `assets[].dependencies` entry of `<dir>/skaile.manifest.yaml` with\n * the discovery syntax rule. Reads the raw YAML on purpose: `decodeSkaileManifest`\n * drops a malformed dependency (with a warning) before discovery or the index ever\n * sees it, so only the raw text can say which entry is wrong. Shared by\n * `skaile validate` and `skaile library index`, so both fail with the same message.\n */\nexport function manifestRequiresProblems(dir: string): ManifestRequiresProblem[] {\n  const file = path.join(dir, \"skaile.manifest.yaml\");\n  let doc: unknown;\n  try {\n    doc = parseYaml(fs.readFileSync(file, \"utf-8\"));\n  } catch {\n    return []; // absent / unparsable: reported by the loaders that own that failure\n  }\n  const assets = (doc as { assets?: unknown } | null)?.assets;\n  if (!Array.isArray(assets)) return [];\n  const problems: ManifestRequiresProblem[] = [];\n  for (const a of assets) {\n    if (!a || typeof a !== \"object\") continue;\n    const { kind, name, dependencies } = a as Record<string, unknown>;\n    if (!Array.isArray(dependencies)) continue;\n    const entries = dependencies.map((d) => (typeof d === \"string\" ? d : String(d)));\n    for (const message of requiresSyntaxErrors(entries)) {\n      problems.push({\n        asset: `${String(kind)}:${String(name)}`,\n        message: `ManifestRequiresError: ${message}`,\n      });\n    }\n  }\n  return problems;\n}\n\n/**\n * `publisher/kind:name` → the versions registered libraries hold, read offline: the library\n * at `dir` itself (its manifest), the assets in the local index (`index.db`) and the manifest\n * of every library the index lists. The index never gets created for this: no `index.db`\n * means only `dir` counts.\n */\nasync function knownAssetVersions(dir: string): Promise<Record<string, string[]>> {\n  const known: Record<string, string[]> = {};\n  const add = (publisher: string | undefined, kind: string, name: string, version?: string) => {\n    if (!publisher) return;\n    const key = `${publisher.replace(/^@/, \"\")}/${kind}:${name}`;\n    const versions = known[key] ?? [];\n    if (version && !versions.includes(version)) versions.push(version);\n    known[key] = versions;\n  };\n  const addManifest = (libPath: string): void => {\n    const manifest = loadSkPublishManifest(libPath);\n    for (const a of manifest?.assets ?? []) {\n      add(a.publisher ?? manifest?.publisher, a.kind, a.name, a.version);\n    }\n  };\n  addManifest(dir);\n  const indexPath = resolveIndexPath();\n  if (!fs.existsSync(indexPath)) return known;\n  const index = new LocalIndex({ indexPath, kindRegistry: getKindRegistry() });\n  try {\n    for (const def of await index.listAssetDefs())\n      add(def.publisher, def.kind, def.name, def.version);\n    for (const lib of await index.listSources()) {\n      if (path.resolve(lib.path) !== path.resolve(dir) && fs.existsSync(lib.path)) {\n        addManifest(lib.path);\n      }\n    }\n  } catch {\n    // An unreadable index only narrows what counts as known.\n  } finally {\n    index.close();\n  }\n  return known;\n}\n\n/**\n * One warning line per `assets[].dependencies` entry of `<dir>/skaile.manifest.yaml` that no\n * registered library (nor the library itself) holds, or whose `#version` pin matches none of\n * the versions held. Offline: it never asks the store, so a store-only dependency is\n * reported too — the line says what was checked. Entries with invalid syntax are\n * {@link manifestRequiresProblems}' to report. Shared by `skaile validate` and `skaile library index`.\n */\nexport async function unresolvedManifestDependencies(dir: string): Promise<string[]> {\n  let doc: unknown;\n  try {\n    doc = parseYaml(fs.readFileSync(path.join(dir, SKAILE_MANIFEST_FILENAME), \"utf-8\"));\n  } catch {\n    return [];\n  }\n  const assets = (doc as { assets?: unknown } | null)?.assets;\n  if (!Array.isArray(assets)) return [];\n  const wanted: Array<{ asset: string; entry: string }> = [];\n  for (const a of assets) {\n    if (!a || typeof a !== \"object\") continue;\n    const { kind, name, dependencies } = a as Record<string, unknown>;\n    if (!Array.isArray(dependencies)) continue;\n    for (const d of dependencies) {\n      const entry = typeof d === \"string\" ? d : String(d);\n      if (requiresSyntaxErrors([entry]).length === 0) {\n        wanted.push({ asset: `${String(kind)}:${String(name)}`, entry });\n      }\n    }\n  }\n  if (wanted.length === 0) return [];\n  const known = await knownAssetVersions(dir);\n  const out: string[] = [];\n  for (const { asset, entry } of wanted) {\n    const dep = parseDep(entry);\n    if (!dep.publisher) continue; // the syntax check reports a publisher-less entry\n    const versions = known[`${dep.publisher}/${dep.kind}:${dep.name}`];\n    const prefix = `${SKAILE_MANIFEST_FILENAME} [assets] — ${asset}: dependency \"${entry}\"`;\n    if (!versions) {\n      out.push(\n        `${prefix} is not held by any registered library (checked offline: this library and the local index; the store was not asked).`,\n      );\n    } else if (dep.pin && versions.length > 0 && !versions.some((v) => matchPin(dep.pin, v))) {\n      out.push(\n        `${prefix} has no version matching \"${dep.pin}\" in any registered library (held: ${versions.join(\", \")}).`,\n      );\n    }\n  }\n  return out;\n}\n\n/** The one refusal text for a publisher that fails {@link isValidPublisher}. */\nexport function invalidPublisherMessage(raw: string): string {\n  return `Invalid publisher \"${raw}\": ${PUBLISHER_HINT}.`;\n}\n\n/**\n * Validate a publisher typed on the command line (`--publisher`, `library set\n * <lib> publisher=`): strip a leading `@`, and exit 1 with {@link invalidPublisherMessage}\n * when it is not a valid slug. Returns the bare publisher.\n */\nexport function requireValidPublisherOrExit(raw: string): string {\n  const bare = raw.trim().replace(/^@/, \"\");\n  if (!isValidPublisher(bare)) {\n    logErr(invalidPublisherMessage(raw));\n    process.exit(1);\n  }\n  return bare;\n}\n\n/**\n * Every publisher in `<dir>/skaile.manifest.yaml` (top-level and `assets[].publisher`)\n * that is not a valid slug, one message each. Reads the raw YAML like\n * {@link manifestRequiresProblems}. Shared by `skaile validate`, `skaile library index`\n * and the publish plan, so all three refuse a publisher with the same text.\n */\nexport function manifestPublisherProblems(dir: string): string[] {\n  let doc: unknown;\n  try {\n    doc = parseYaml(fs.readFileSync(path.join(dir, SKAILE_MANIFEST_FILENAME), \"utf-8\"));\n  } catch {\n    return []; // absent / unparsable: reported by the loaders that own that failure\n  }\n  if (!doc || typeof doc !== \"object\") return [];\n  const { publisher, assets } = doc as { publisher?: unknown; assets?: unknown };\n  const problems: string[] = [];\n  const check = (value: unknown, where: string): void => {\n    if (typeof value !== \"string\") return;\n    if (!isValidPublisher(value.trim().replace(/^@/, \"\"))) {\n      problems.push(`${SKAILE_MANIFEST_FILENAME} ${where} — ${invalidPublisherMessage(value)}`);\n    }\n  };\n  check(publisher, \"[publisher]\");\n  if (Array.isArray(assets)) {\n    for (const a of assets) {\n      if (!a || typeof a !== \"object\") continue;\n      const { kind, name, publisher: assetPublisher } = a as Record<string, unknown>;\n      check(assetPublisher, `[assets] ${String(kind)}:${String(name)}`);\n    }\n  }\n  return problems;\n}\n\n/**\n * Exit 1 when `<dir>/skaile.manifest.yaml` names a publisher that is not a valid slug\n * ({@link manifestPublisherProblems}); the refusal `library create`, `asset import`,\n * `library index` and the publish plan share. `libName` is the registered library.\n */\nexport function exitOnManifestPublisherProblems(dir: string, libName: string): void {\n  const problems = manifestPublisherProblems(dir);\n  if (problems.length === 0) return;\n  for (const message of problems) logErr(message);\n  logErr(\n    `Fix the publisher in ${SKAILE_MANIFEST_FILENAME} (\\`skaile library set ${libName} publisher=<name>\\` rewrites the library's own), then re-run.`,\n  );\n  process.exit(1);\n}\n\n/**\n * Print the one refusal text ({@link librarySymlinkMessage}) for every symlink a library\n * refuses under `dir` ({@link listLibrarySymlinks}) and return how many there were.\n * `validate`, `library index`, `library publish` and `asset import` share it (p520).\n */\nexport function reportLibrarySymlinks(dir: string, opts?: { rootIsAsset?: boolean }): number {\n  const links = listLibrarySymlinks(dir, opts);\n  for (const link of links) logErr(librarySymlinkMessage(link));\n  return links.length;\n}\n\n/** Exit 1 when `dir` holds a symlink a library refuses; `verb` names the command that stopped. */\nexport function exitOnLibrarySymlinks(dir: string, verb: string): void {\n  const count = reportLibrarySymlinks(dir);\n  if (count === 0) return;\n  logErr(`${count} symlink(s) in ${dir}: remove them, then re-run \\`${verb}\\`.`);\n  process.exit(1);\n}\n\n/** Discovery result surfaced by {@link indexLibrary}. */\nexport interface IndexLibraryResult {\n  /** Assets discovered on disk under the library root. */\n  assetsFound: number;\n  /** Assets upserted into `asset_definitions`. */\n  assetsUpdated: number;\n  /** Fatal per-asset errors (never advisories). */\n  errors: string[];\n}\n\n/**\n * Index a library's assets into the shared `asset_definitions` index.\n *\n * Runs `LocalCatalogSource.sync()` against the library's `path` keyed by\n * `library_id = lib.id`. Pass an already-open {@link LocalIndex} (e.g. the one\n * `openLibraryManager()` holds) to reuse the single connection — the caller then\n * owns closing it. With no `index` a fresh handle is opened and closed here.\n * `exclude` leaves matching discovered assets out of the index (`library index`\n * uses it for assets it refused to write into the manifest).\n * Returns the sync counters so a caller can report `Indexed N asset(s)`.\n */\nexport async function indexLibrary(\n  lib: Library,\n  index?: LocalIndex,\n  opts: { exclude?: (asset: DiscoveredAsset) => boolean } = {},\n): Promise<IndexLibraryResult> {\n  const { LocalCatalogSource } = await import(\"@skaile/workspaces/library\");\n  const own = index ?? (await openLibrary());\n  try {\n    const source = new LocalCatalogSource(own, lib.id, lib.path, getKindRegistry());\n    const res = await source.sync({ exclude: opts.exclude });\n    if (res.pruned.length > 0) {\n      // The index keeps one row per ref, so the rows this sync removed may be the\n      // copy another library still holds (a library re-published a ref under a new\n      // publisher). Put them back from that library's own directory.\n      const lost = new Set(res.pruned);\n      for (const other of await own.listSources()) {\n        if (other.id === lib.id || other.backend !== \"local\" || !other.path) continue;\n        if (!fs.existsSync(other.path)) continue;\n        await new LocalCatalogSource(own, other.id, other.path, getKindRegistry()).sync({\n          only: lost,\n        });\n      }\n    }\n    return {\n      assetsFound: res.assetsFound,\n      assetsUpdated: res.assetsUpdated,\n      errors: res.errors,\n    };\n  } finally {\n    if (!index) own.close();\n  }\n}\n\n/** Where {@link resolveLibraryPublisherDetailed} found the publisher. */\nexport type LibraryPublisherSource = \"flag\" | \"manifest\" | \"identity\" | \"library-name\";\n\n/**\n * Resolve the publisher for an asset created inside a library. Never throws.\n *\n * Fallback chain (first hit wins):\n *   1. `opts.publisher` (an explicit `--publisher`),\n *   2. the library manifest's top-level `publisher` (`skaile.manifest.yaml`),\n *   3. the author's verified store identity (`githubLogin`, else `username`)\n *      when signed in — the publisher they can actually publish under,\n *   4. the kebab-cased library name (e.g. `My Lib` → `my-lib`) as a last resort.\n *\n * The publisher is never derived from where the asset sits in the library:\n * every asset inherits the library's publisher unless it sets its own.\n *\n * Identity beats the library name because the library name is almost never a\n * namespace the author can publish; stamping it led to publishes that only\n * failed at the store. Passed in (not read here) to keep this pure + testable.\n *\n * @param lib - The target library.\n * @param opts - Optional explicit `--publisher`.\n * @param storeIdentity - The author's decoded store identity, or null when signed out.\n * @returns The bare publisher and which link of the chain supplied it.\n */\nexport function resolveLibraryPublisherDetailed(\n  lib: Pick<Library, \"name\" | \"path\">,\n  opts: { publisher?: string },\n  storeIdentity?: { username?: string; githubLogin?: string } | null,\n): { publisher: string; source: LibraryPublisherSource } {\n  const bare = (p: string) => (p.startsWith(\"@\") ? p.slice(1) : p);\n  if (opts.publisher?.trim()) return { publisher: bare(opts.publisher.trim()), source: \"flag\" };\n  const declared = loadSkPublishManifest(lib.path)?.publisher?.trim();\n  if (declared) return { publisher: bare(declared), source: \"manifest\" };\n  // A login is case-insensitive on GitHub, so fold it to the lowercase slug; one that\n  // still fails the slug rule falls through to the library name.\n  const identity = (storeIdentity?.githubLogin ?? storeIdentity?.username)?.trim().toLowerCase();\n  if (identity && isValidPublisher(identity)) return { publisher: identity, source: \"identity\" };\n  // slugifyAssetName throws on a name with no [a-z0-9] — keep the chain total. The slug is\n  // cut to 39 characters so the fallback always passes the publisher rule.\n  try {\n    const slug = slugifyAssetName(lib.name).slice(0, 39).replace(/-+$/, \"\");\n    return { publisher: slug, source: \"library-name\" };\n  } catch {\n    return { publisher: \"library\", source: \"library-name\" };\n  }\n}\n\n/** {@link resolveLibraryPublisherDetailed} without the provenance. */\nexport function resolveLibraryPublisher(\n  lib: Pick<Library, \"name\" | \"path\">,\n  opts: { publisher?: string },\n  storeIdentity?: { username?: string; githubLogin?: string } | null,\n): string {\n  return resolveLibraryPublisherDetailed(lib, opts, storeIdentity).publisher;\n}\n\n/**\n * Warn that an asset's publisher fell back to the library name — the one text\n * `library create`, `asset import`, `library index` and the `init` adopt path\n * share. Prints nothing for any other {@link LibraryPublisherSource}.\n *\n * `hasPublisherFlag` is true for the commands that take `--publisher` (`create`,\n * `asset import`); `init` and `index` do not, so they must not advise it.\n */\nexport function warnLibraryNameFallback(\n  libName: string,\n  resolved: { publisher: string; source: LibraryPublisherSource },\n  hasPublisherFlag = false,\n): void {\n  if (resolved.source !== \"library-name\") return;\n  const setLater = `\\`skaile library set ${libName} publisher=<name>\\``;\n  logWarn(\n    `No publisher given and not signed in — using the library name \"${resolved.publisher}\" as the publisher. ` +\n      (hasPublisherFlag\n        ? `Pass --publisher <name> or run \\`skaile store login\\`; change it later with ${setLater}.`\n        : `Run \\`skaile store login\\`, or change it later with ${setLater}.`),\n  );\n}\n\n/**\n * Re-serialise a freshly written asset's markdown marker (SKILL.md / AGENT.md /\n * CONTRACT.md / `*.prompt.md`) so `library create` and `asset import` leave the\n * same canonical frontmatter (`version: 0.1.0`, not the scaffold's quoted\n * `version: \"0.1.0\"`). Never adds or changes a key — the publisher lives in the\n * manifest only. A YAML marker (flow / preset) or an unparsable file is left\n * untouched.\n */\nfunction normalizeAssetFrontmatter(assetDir: string): void {\n  let markerFile = [\"SKILL.md\", \"AGENT.md\", \"CONTRACT.md\"]\n    .map((m) => path.join(assetDir, m))\n    .find((f) => fs.existsSync(f));\n  if (!markerFile) {\n    // Only a `.prompt.md` marker carries asset frontmatter — never a bare `.md`\n    // catch-all, which would rewrite (and corrupt) a template's README/CHANGELOG.\n    const promptMd = fs.readdirSync(assetDir).find((f) => f.endsWith(\".prompt.md\"));\n    if (promptMd) markerFile = path.join(assetDir, promptMd);\n  }\n  if (!markerFile) return;\n  try {\n    const { data, body } = parseFrontmatter(fs.readFileSync(markerFile, \"utf8\"));\n    const fm = stringifyYaml(data).trimEnd();\n    fs.writeFileSync(markerFile, `---\\n${fm}\\n---\\n\\n${body}\\n`, \"utf8\");\n  } catch {\n    // Non-fatal — the file stays as written.\n  }\n}\n\n/** What {@link registerLibraryAsset} needs to know about the asset that just landed in a library. */\nexport interface RegisterLibraryAssetInput {\n  kind: string;\n  name: string;\n  /** Absolute directory of the asset inside the library. */\n  assetDir: string;\n  /** Version written to the manifest entry and the printed ref. */\n  version: string;\n  /** Explicit `--publisher`. */\n  publisher?: string;\n}\n\n/**\n * Make an asset that was just written into a library consumable — the shared\n * tail of `library create` and `asset import`, so both produce the same\n * manifest entry, frontmatter shape and index rows:\n *   1. resolve the publisher ({@link resolveLibraryPublisherDetailed}); when it\n *      came from the library-name fallback, warn once how to set a real one,\n *   2. stamp it into the manifest's top-level `publisher` (first writer wins) —\n *      the manifest is the only place a publisher lives; the asset file is\n *      left untouched,\n *   3. upsert the manifest `assets[]` entry (`library publish` ships only that\n *      inventory),\n *   4. index the library so `add` / `search --local` find the asset at once.\n *\n * @returns the bare publisher and the canonical ref (`kind:@pub/name#version`).\n */\nexport async function registerLibraryAsset(\n  lib: Library,\n  index: LocalIndex,\n  input: RegisterLibraryAssetInput,\n): Promise<{ publisher: string; ref: string }> {\n  const { publisher, source } = resolveLibraryPublisherDetailed(\n    lib,\n    { publisher: input.publisher },\n    getStoreIdentity(),\n  );\n  warnLibraryNameFallback(lib.name, { publisher, source }, true);\n  normalizeAssetFrontmatter(input.assetDir);\n  stampManifestPublisher(lib.path, publisher);\n  upsertManifestAsset(lib.path, {\n    kind: input.kind,\n    name: input.name,\n    root: path.relative(lib.path, input.assetDir) || input.name,\n    version: input.version,\n    publisher,\n  });\n  const idx = await indexLibrary(lib, index);\n  for (const e of idx.errors) logWarn(e);\n  return { publisher, ref: refFor(input.kind, publisher, input.name, input.version) };\n}\n\n/** Where an npm user reads the 4.x → 5.x library upgrade (MIGRATION.md is not in the package). */\nexport const LIBRARY_UPGRADE_DOCS =\n  \"https://github.com/skaile-ai/workspaces/blob/main/docs/sections/cli/commands/library.md#upgrading-a-4x-library\";\n\n/** What replaced `DOMAIN.md`: 5.0 removed domains. */\nexport const DOMAIN_REMOVED_HINT = `Domains were removed in 5.0 — delete DOMAIN.md files; group assets with .claude-plugin/marketplace.json. See ${LIBRARY_UPGRADE_DOCS}`;\n\n/** Hidden `--domain <domain>` option: 4.x muscle memory gets {@link DOMAIN_REMOVED_HINT}, not \"unknown option\". */\nexport function removedDomainOption(): Option {\n  return new Option(\"--domain <domain>\", \"Removed in 5.0\").hideHelp();\n}\n\n/** Exit 1 with {@link DOMAIN_REMOVED_HINT} when the removed `--domain` option was passed. */\nexport function rejectRemovedDomainOption(opts: { domain?: unknown }): void {\n  if (opts.domain === undefined) return;\n  logErr(DOMAIN_REMOVED_HINT);\n  process.exit(1);\n}\n\n/** Collect the files below `root` whose name satisfies `match`, skipping dot-dirs and `node_modules`. */\nfunction findFiles(root: string, match: (name: string) => boolean): string[] {\n  const found: string[] = [];\n  const walk = (dir: string): void => {\n    let entries: fs.Dirent[];\n    try {\n      entries = fs.readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const entry of entries) {\n      if (entry.isDirectory()) {\n        if (!entry.name.startsWith(\".\") && entry.name !== \"node_modules\") {\n          walk(path.join(dir, entry.name));\n        }\n      } else if (match(entry.name)) {\n        found.push(path.join(dir, entry.name));\n      }\n    }\n  };\n  walk(root);\n  return found;\n}\n\n/** Count `DOMAIN.md` files below `root`, skipping dot-dirs and `node_modules`. */\nexport function countDomainFiles(root: string): number {\n  return findFiles(root, (name) => name === \"DOMAIN.md\").length;\n}\n\n/**\n * Print ONE warning when `root` still holds `DOMAIN.md` files: since 5.0 they\n * are ignored silently, so without this an author never learns why grouping\n * stopped working. Warning only - never changes an exit code.\n *\n * @returns the number of `DOMAIN.md` files found.\n */\nexport function warnIgnoredDomainFiles(root: string): number {\n  const count = countDomainFiles(root);\n  if (count > 0) {\n    logWarn(\n      `${count} DOMAIN.md file(s) are ignored since 5.0 (domains were removed) — delete them; ` +\n        `group assets with .claude-plugin/marketplace.json. See ${LIBRARY_UPGRADE_DOCS}`,\n    );\n  }\n  return count;\n}\n\n/**\n * Print ONE warning when `root` still holds `*.bundle.yaml` files: the `bundle`\n * kind is gone (now `preset`), so neither `index` nor `validate` scans them.\n * Warning only - never changes an exit code.\n *\n * @returns the number of `*.bundle.yaml` files found.\n */\nexport function warnLegacyBundleFiles(root: string): number {\n  const files = findFiles(root, (name) => name.endsWith(\".bundle.yaml\"));\n  if (files.length > 0) {\n    const shown = files.slice(0, 5).map((f) => path.relative(root, f) || f);\n    const more = files.length > shown.length ? `, +${files.length - shown.length} more` : \"\";\n    logWarn(\n      `${files.length} *.bundle.yaml file(s) are not scanned (the bundle kind became preset): ${shown.join(\", \")}${more}. ` +\n        `Run \\`skaile migrate assets ${root} --write\\` to rename them to *.preset.yaml. See ${LIBRARY_UPGRADE_DOCS}`,\n    );\n  }\n  return files.length;\n}\n"]}

package/dist/{chunk-QZNJOHN6.js → chunk-FHDK3BFD.js}

@@ -1,4 +1,4 @@
-import { getStoreConfig, getStoreToken, storeFetch } from './chunk-RYYLMBA2.js';
+import { getStoreConfig, getStoreToken, storeFetch } from './chunk-PZOO7L26.js';
 
 // cli/src/store-publisher.ts
 function makeHttpPublisherClient(config = getStoreConfig(), timeoutMs = 2e4) {
@@ -25,5 +25,5 @@ function makeHttpPublisherClient(config = getStoreConfig(), timeoutMs = 2e4) {
 }
 
 export { makeHttpPublisherClient };
-//# sourceMappingURL=chunk-QZNJOHN6.js.map
-//# sourceMappingURL=chunk-QZNJOHN6.js.map
+//# sourceMappingURL=chunk-FHDK3BFD.js.map
+//# sourceMappingURL=chunk-FHDK3BFD.js.map

package/dist/{chunk-QZNJOHN6.js.map → chunk-FHDK3BFD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-publisher.ts"],"names":[],"mappings":";;;AA+FO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAC3F,qBAAA,EAAuB,CAAC,EAAA,KACtB,IAAA,CAAK,sBAAsB,kBAAA,CAAmB,EAAE,CAAC,CAAA,aAAA,CAAe;AAAA,GACpE;AACF","file":"chunk-QZNJOHN6.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n  /**\n   * Identity of the caller. `username` is the Keycloak login (personal-tier\n   * namespace); `githubLogin` is the verified GitHub handle when connected —\n   * the namespace to publish under when it differs from the login.\n   */\n  me(): Promise<{ username: string; githubLogin?: string | null }>;\n  /** Register (or re-register) a source; returns the created/existing row id. */\n  sourcesAdd(body: {\n    url: string;\n    ref: string;\n    sidecarUrl?: string;\n    sidecarRef?: string;\n    /**\n     * Target publisher namespace (the manifest's `publisher`). When it differs\n     * from the caller's login username, the store resolves the CLAIMED Publisher\n     * for it (the store must already have the claim). Omitted → the store\n     * defaults to `@<username>` (personal).\n     */\n    namespace?: string;\n  }): Promise<{ id: string }>;\n  /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n  sourcesList(): Promise<Array<{ id: string; url: string }>>;\n  /** Kick off a source sync; returns the async job id to poll. */\n  sourceSync(id: string): Promise<{ jobId: string }>;\n  /** Poll a job's terminal status + per-item results. */\n  jobGet(\n    jobId: string,\n  ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n  /** Discovered publishable candidates for a synced source. */\n  sourceCandidates(id: string): Promise<\n    Array<{\n      id: string;\n      name: string;\n      version: string;\n      kind: string;\n      published: boolean;\n      assetRoot: string;\n    }>\n  >;\n  /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n  assetPreview(id: string): Promise<{\n    discoveredFiles: string[];\n    candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n  }>;\n  /**\n   * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n   * launching a job; the normal path returns `{ jobId }`.\n   */\n  assetPublish(\n    id: string,\n    body: { ref: string; files: string[] },\n    dryRun?: boolean,\n  ): Promise<{ jobId?: string; manifest?: unknown }>;\n  /** Retract a published asset. Response body is ignored. */\n  assetUnpublish(id: string): Promise<unknown>;\n  /**\n   * Read-only \"can I publish under `@<ns>` right now, and if not, what's the\n   * path?\" probe. Backs the `publish --dry-run` namespace status line; its\n   * `message` is store-authored and meant to be surfaced verbatim.\n   */\n  namespaceAvailability(ns: string): Promise<{\n    namespace: string;\n    status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n    claimMethod?: string;\n    message: string;\n  }>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n  config: StoreConfig = getStoreConfig(),\n  timeoutMs = 20_000,\n): PublisherClient {\n  // Acquire a fresh Keycloak token per call (device-flow session in\n  // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n  const call = async <T>(\n    path: string,\n    opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n  ): Promise<T> => {\n    const jwt = await getStoreToken();\n    return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n  };\n  return {\n    me: () => call(\"/api/v1/me\"),\n    sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n    sourcesList: () => call(\"/api/v1/sources\"),\n    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n    assetPublish: (id, body, dryRun) =>\n      call(`/api/v1/assets/${id}/publish`, {\n        method: \"POST\",\n        body,\n        ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n      }),\n    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n    namespaceAvailability: (ns) =>\n      call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`),\n  };\n}\n"]}
+{"version":3,"sources":["../cli/src/store-publisher.ts"],"names":[],"mappings":";;;AA+FO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAC3F,qBAAA,EAAuB,CAAC,EAAA,KACtB,IAAA,CAAK,sBAAsB,kBAAA,CAAmB,EAAE,CAAC,CAAA,aAAA,CAAe;AAAA,GACpE;AACF","file":"chunk-FHDK3BFD.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n  /**\n   * Identity of the caller. `username` is the Keycloak login (personal-tier\n   * namespace); `githubLogin` is the verified GitHub handle when connected —\n   * the namespace to publish under when it differs from the login.\n   */\n  me(): Promise<{ username: string; githubLogin?: string | null }>;\n  /** Register (or re-register) a source; returns the created/existing row id. */\n  sourcesAdd(body: {\n    url: string;\n    ref: string;\n    sidecarUrl?: string;\n    sidecarRef?: string;\n    /**\n     * Target publisher namespace (the manifest's `publisher`). When it differs\n     * from the caller's login username, the store resolves the CLAIMED Publisher\n     * for it (the store must already have the claim). Omitted → the store\n     * defaults to `@<username>` (personal).\n     */\n    namespace?: string;\n  }): Promise<{ id: string }>;\n  /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n  sourcesList(): Promise<Array<{ id: string; url: string }>>;\n  /** Kick off a source sync; returns the async job id to poll. */\n  sourceSync(id: string): Promise<{ jobId: string }>;\n  /** Poll a job's terminal status + per-item results. */\n  jobGet(\n    jobId: string,\n  ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n  /** Discovered publishable candidates for a synced source. */\n  sourceCandidates(id: string): Promise<\n    Array<{\n      id: string;\n      name: string;\n      version: string;\n      kind: string;\n      published: boolean;\n      assetRoot: string;\n    }>\n  >;\n  /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n  assetPreview(id: string): Promise<{\n    discoveredFiles: string[];\n    candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n  }>;\n  /**\n   * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n   * launching a job; the normal path returns `{ jobId }`.\n   */\n  assetPublish(\n    id: string,\n    body: { ref: string; files: string[] },\n    dryRun?: boolean,\n  ): Promise<{ jobId?: string; manifest?: unknown }>;\n  /** Retract a published asset. Response body is ignored. */\n  assetUnpublish(id: string): Promise<unknown>;\n  /**\n   * Read-only \"can I publish under `@<ns>` right now, and if not, what's the\n   * path?\" probe. Backs the `publish --dry-run` namespace status line; its\n   * `message` is store-authored and meant to be surfaced verbatim.\n   */\n  namespaceAvailability(ns: string): Promise<{\n    namespace: string;\n    status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n    claimMethod?: string;\n    message: string;\n  }>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n  config: StoreConfig = getStoreConfig(),\n  timeoutMs = 20_000,\n): PublisherClient {\n  // Acquire a fresh Keycloak token per call (device-flow session in\n  // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n  const call = async <T>(\n    path: string,\n    opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n  ): Promise<T> => {\n    const jwt = await getStoreToken();\n    return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n  };\n  return {\n    me: () => call(\"/api/v1/me\"),\n    sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n    sourcesList: () => call(\"/api/v1/sources\"),\n    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n    assetPublish: (id, body, dryRun) =>\n      call(`/api/v1/assets/${id}/publish`, {\n        method: \"POST\",\n        body,\n        ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n      }),\n    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n    namespaceAvailability: (ns) =>\n      call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`),\n  };\n}\n"]}

package/dist/{chunk-3SM2DL2T.js → chunk-GMDSRSGI.js}

@@ -1,13 +1,13 @@
 import { initTelemetry } from './chunk-4R6DROGN.js';
-import { parseSkillFrontmatter, validateFlowVersions } from './chunk-X77SUM4P.js';
-import { FlowAdapter, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn } from './chunk-4A4OD24G.js';
-import { loadFlow, flowLookupRoots, findFlowFileInRoots, FLOW_FILE_EXTENSIONS } from './chunk-TCHRMVTO.js';
+import { parseSkillFrontmatter, validateFlowVersions } from './chunk-USHB5KEY.js';
+import { FlowAdapter, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn } from './chunk-Y4Z7LGSH.js';
+import { loadFlow, flowLookupRoots, findFlowFileInRoots, FLOW_FILE_EXTENSIONS } from './chunk-XBYSURMK.js';
 import { renderStimulusPrompt } from './chunk-M3WPBTGJ.js';
 import { flowSkillVersionPins } from './chunk-7RGTAEG6.js';
-import { resolveSettings } from './chunk-PBBPZYVG.js';
+import { resolveSettings } from './chunk-BF422IDP.js';
 import { findKindDirs } from './chunk-A2ULN3KX.js';
-import { resolveAgentDir, resolveSkWorkspaceConfig } from './chunk-ALEYHUC5.js';
-import { isValidAssetName } from './chunk-BNMZVPYA.js';
+import { resolveAgentDir, resolveSkWorkspaceConfig } from './chunk-L3ZGYSWY.js';
+import { isValidAssetName } from './chunk-J4OYIYFQ.js';
 import { createLogger } from './chunk-BOFL7GIF.js';
 import fs from 'fs';
 import path from 'path';
@@ -102,8 +102,9 @@ async function runFlow(opts) {
       );
       const state = adapter.getExecution(handle);
       const available = Object.values(state.nodes).filter((n) => n.status === "available").map((n) => n.id);
-      log(`[dry-run] Flow: ${flow.name} (${flow.id})`);
-      log(`[dry-run] Available: ${available.join(", ") || "(none)"}`);
+      const printPlan = opts.onLog ?? ((line) => console.log(line));
+      printPlan(`[dry-run] Flow: ${flow.name} (${flow.id})`);
+      printPlan(`[dry-run] Available: ${available.join(", ") || "(none)"}`);
       await adapter.disconnect(handle);
       return;
     }
@@ -296,6 +297,7 @@ async function runFlow(opts) {
       flowName: flow.name,
       runId: session.runId
     });
+    let runError;
     try {
       const initialStimulus = { kind: "flow_started" };
       await stimulusBus.signal(flowConnectorId, {
@@ -314,15 +316,23 @@ async function runFlow(opts) {
           note: "CLI mode does not supply human approval/input decisions"
         });
       }
+    } catch (err) {
+      runError = err;
+      throw err;
     } finally {
       driver.kill();
       const lastState = flowAdapter.getExecution(flowHandle);
+      const failed = runError !== void 0;
+      let status = "paused";
+      if (failed) status = "failed";
+      else if (lastState.status === "complete") status = "complete";
       await saveSession(
         opts.projectDir,
         touchSession({
           ...updatedSession,
           driverSessionId: driver.runtimeSessionId ?? updatedSession.driverSessionId,
-          status: lastState.status === "complete" ? "complete" : "paused"
+          status,
+          ...failed ? { error: runError instanceof Error ? runError.message : String(runError) } : {}
         })
       ).catch(() => {
       });
@@ -520,5 +530,5 @@ function walkForSkill(dir, skillId) {
 }
 
 export { awaitAgentEnd, resolveFlowPath, resumeFlow, runFlow };
-//# sourceMappingURL=chunk-3SM2DL2T.js.map
-//# sourceMappingURL=chunk-3SM2DL2T.js.map
+//# sourceMappingURL=chunk-GMDSRSGI.js.map
+//# sourceMappingURL=chunk-GMDSRSGI.js.map

package/dist/chunk-GMDSRSGI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../factory-assets/connectors/flow/run-flow.ts"],"names":["c"],"mappings":";;;;;;;;;;;;;;;AAiEA,IAAI,aAAA;AAEJ,eAAe,gBAAA,GAAiC;AAC9C,EAAA,IAAI,eAAe,OAAO,aAAA;AAC1B,EAAA,aAAA,GAAgB,MAAM,OAAO,mBAA2B,CAAA;AACxD,EAAA,OAAO,aAAA;AACT;AAMA,IAAM,0BAAA,GAA6B,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,GAAA;AAEjD,IAAM,0BAAA,uBAAiC,GAAA,CAAI;AAAA,EACzC,eAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAC,CAAA;AAuHD,eAAsB,QAAQ,IAAA,EAAiC;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,EAAA,MAAM;AAAA,IACJ,uBAAA;AAAA,IACA,2BAAA;AAAA,IACA,kBAAA;AAAA,IACA,kBAAA;AAAA,IACA,wBAAA;AAAA,IACA,gBAAA;AAAA,IACA,+BAAA;AAAA,IACA,kBAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAA;AAEJ,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA;AACnC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,eAAA,CAAgB,KAAK,UAAU,CAAA;AACjE,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,IAAA,CAAK,UAAA,EAAY;AAAA,IACtD,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AAED,EAAA,MAAM,UAAU,UAAA,CAAW;AAAA,IACzB,QAAQ,IAAA,CAAK,EAAA;AAAA,IACb,YAAY,IAAA,CAAK,UAAA;AAAA,IACjB,QAAA;AAAA,IACA,MAAA,EAAQ,SAAS,MAAA,IAAU,KAAA;AAAA,IAC3B,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AAGD,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,QAAc,WAAA,CAAY,IAAA,CAAK,YAAY,OAAO,CAAA;AAK5D,EAAA,MAAM,aAAA,GAAgB,wBAAA,CAAyB,IAAA,CAAK,UAAU,CAAA;AAC9D,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAgB,GAAI,uBAAA,CAAwB;AAAA,IAC3D,WAAW,OAAA,CAAQ,KAAA;AAAA,IACnB,YAAY,IAAA,CAAK,UAAA;AAAA,IACjB,WAAW,aAAA,CAAc,OAAA;AAAA,IACzB,OAAO,IAAA,CAAK,KAAA;AAAA;AAAA;AAAA,IAGZ,MAAA,EAAQ,KAAK,KAAA,KAAU;AAAA,GACxB,CAAA;AACD,EAAA,MAAM,UAAU,YAAA,CAAa;AAAA,IAC3B,IAAA,EAAM,gBAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,UAAU,OAAA,CAAQ;AAAA,GACnB,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAiB,OAAA,CAAQ,KAAK,IAAI,CAAA;AAC/C,EAAA,MAAM,kBAAA,GAAqB,IAAI,kBAAA,EAAmB;AAClD,EAAA,2BAAA,CAA4B,kBAAkB,CAAA;AAC9C,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,WAAW,OAAA,CAAQ,KAAA;AAAA,IACnB,YAAA,EAAc,MAAM,kBAAA,CAAmB,eAAA,EAAgB;AAAA,IACvD,OAAA,EAAS,CAAC,IAAA,KACR,kBAAA,CAAmB,IAAA,EAAK,CAAE,IAAA,CAAK,CAAC,GAAA,KAA0B,GAAA,CAAI,IAAA,KAAS,IAAI,CAAA,IAAK,IAAA;AAAA,IAClF,MAAA,EAAQ,CAAC,IAAA,EAAc,KAAA,EAAgB,SAAuB,MAAA,KAC5D,kBAAA,CAAmB,MAAA,CAAO,IAAA,EAAM,OAAO,EAAE,SAAA,EAAW,OAAA,CAAQ,KAAA,EAAO,QAAQ;AAAA,GAC/E;AAEA,EAAA,IAAI;AAEF,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,OAAA;AAAA,QAC3B;AAAA,UACE,EAAA,EAAI,MAAA;AAAA,UACJ,MAAA,EAAQ,MAAA;AAAA,UACR,MAAA,EAAQ,WAAA;AAAA,UACR,OAAA,EAAS,EAAE,IAAA,EAAM,IAAA,EAAM,EAAE,OAAO,OAAA,CAAQ,KAAA,EAAO,SAAA,EAAW,KAAA,EAAM;AAAE,SACpE;AAAA,QACA;AAAC;AAAA,OACH;AACA,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,YAAA,CAAa,MAAM,CAAA;AACzC,MAAA,MAAM,YAAY,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,KAAK,EACxC,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,WAAW,CAAA,CACtC,IAAI,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA;AAGlB,MAAA,MAAM,YAAY,IAAA,CAAK,KAAA,KAAU,CAAC,IAAA,KAAiB,OAAA,CAAQ,IAAI,IAAI,CAAA,CAAA;AACnE,MAAA,SAAA,CAAU,mBAAmB,IAAA,CAAK,IAAI,CAAA,EAAA,EAAK,IAAA,CAAK,EAAE,CAAA,CAAA,CAAG,CAAA;AACrD,MAAA,SAAA,CAAU,wBAAwB,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,IAAK,QAAQ,CAAA,CAAE,CAAA;AACpE,MAAA,MAAM,OAAA,CAAQ,WAAW,MAAM,CAAA;AAC/B,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,sBAAA,CAAuB,IAAA,EAAM,IAAA,CAAK,UAAA,EAAY,GAAG,CAAA;AAGvD,IAAA,MAAM,QAAA,GAAW,aAAA;AACjB,IAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,QAAA,CAAS,SAAS,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,UAAU,UAAA,CAAW;AAAA,MACrC,IAAA,EAAM,CAAA,KAAA,EAAQ,IAAA,CAAK,EAAE,CAAA,CAAA;AAAA,MACrB,IAAA,EAAM,UAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,kBAAkB,IAAA,CAAK,EAAA;AAAA,QACvB,sBAAsB,OAAA,CAAQ;AAAA;AAChC,KACD,CAAA;AAGD,IAAA,MAAM,WAAA,GAAc,mBAAmB,QAAQ,CAAA;AAC/C,IAAA,MAAM,YAAA,GAAe,MAAM,kBAAA,CAAmB;AAAA,MAC5C,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,iBAAiB,OAAA,CAAQ,eAAA;AAAA,MACzB,eAAA,EAAiB,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,YAAY,WAAW,CAAA;AAAA,MACvD,YAAY,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,UAAU,CAAA;AAAA,MAC7D,WAAW,OAAA,CAAQ,KAAA;AAAA,MACnB,KAAA,EAAO,GAAA;AAAA,MACP,SAAA;AAAA,MACA,KAAA,EAAO,SAAA;AAAA,MACP,QAAA;AAAA,MACA,YAAA,EAAc,eAAA;AAAA,MACd;AAAA,KACD,CAAA;AACD,IAAA,IAAI,YAAA,CAAa,WAAA,EAAa,mBAAA,CAAoB,MAAA,EAAQ;AACxD,MAAA,+BAAA;AAAA,QACE,kBAAA;AAAA,QACA,aAAa,WAAA,CAAY;AAAA,OAC3B;AAAA,IACF;AACA,IAAA,MAAM,EAAE,QAAO,GAAI,YAAA;AACnB,IAAA,MAAM,eAAe,IAAI,mBAAA,CAAoB,EAAE,YAAA,EAAc,IAAA,CAAK,YAAY,CAAA;AAI9E,IAAA,MAAM,eAAA,GAAkB,IAAI,sBAAA,CAAuB;AAAA,MACjD,YAAY,YAAA,CAAa,UAAA;AAAA,MACzB,cAAc,YAAA,CAAa,KAAA;AAAA,MAC3B,cAAc,IAAA,CAAK,UAAA;AAAA,MACnB,UAAU,YAAA,CAAa,QAAA;AAAA,MACvB,eAAe,YAAA,CAAa,aAAA;AAAA,MAC5B,GAAI,aAAa,QAAA,GAAW,EAAE,UAAU,YAAA,CAAa,QAAA,KAAa;AAAC,KACpE,CAAA;AACD,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,MAAM,cAAA,GAAiB,EAAE,GAAG,OAAA,EAAQ;AAGpC,IAAA,MAAA,CAAO,EAAA,CAAG,eAAe,MAAM;AAC7B,MAAA,MAAM,mBAAmB,MAAA,CAAO,gBAAA;AAChC,MAAA,IAAI,CAAC,gBAAA,IAAoB,gBAAA,KAAqB,cAAA,CAAe,eAAA,EAAiB;AAC9E,MAAA,cAAA,CAAe,eAAA,GAAkB,gBAAA;AACjC,MAAA,KAAK,YAAY,IAAA,CAAK,UAAA,EAAY,cAAc,CAAA,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAAA,IAClE,CAAC,CAAA;AAeD,IAAA,MAAM,eAAA,GAAkB,MAAA;AACxB,IAAA,MAAM,aAAA,GAAgB,KAAK,gBAAA,IAAoB,0BAAA;AAE/C,IAAA,MAAM,sBAAsB,YAA2B;AACrD,MAAA,IAAI,aAAA,EAAe;AACnB,MAAA,MAAM,OAAO,KAAA,EAAM;AACnB,MAAA,aAAA,GAAgB,IAAA;AAAA,IAClB,CAAA;AAKA,IAAA,MAAM,cAAA,GAAiB,CAAC,KAAA,KAAiC;AACvD,MAAA,IAAA,CAAK,UAAU,KAA8B,CAAA;AAAA,IAC/C,CAAA;AAEA,IAAA,MAAM,mBAAA,GAAsB,IAAI,0BAAA,CAA2B;AAAA,MACzD,WAAA,EAAa,CAAC,MAAA,KAAW,QAAA,CAAS,gBAAgB,MAAA,EAAQ,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,MAC1E,YAAA;AAAA,MACA,eAAA;AAAA,MACA,gBAAgB,OAAO,EAAE,MAAM,SAAA,EAAW,SAAA,EAAW,UAAS,KAAM;AAClE,QAAA,MAAM,mBAAA,EAAoB;AAC1B,QAAA,MAAM,qBAAA,CAAsB;AAAA,UAC1B,IAAA,EAAM,SAAA;AAAA,UACN,SAAA;AAAA,UACA,QAAA;AAAA,UACA,IAAA,EAAM,cAAA;AAAA,UACN,OAAA,EAAS,CAAC,MAAA,KAAW,aAAA,CAAc,QAAQ,MAAA,EAAQ,IAAA,CAAK,SAAS,aAAa;AAAA,SAC/E,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAID,IAAA,IAAI,cAAA,GAAqC,IAAA;AACzC,IAAA,IAAI,aAAA,GAAgF,IAAA;AAEpF,IAAA,MAAM,cAAc,wBAAA,CAAyB;AAAA,MAC3C,SAAA,EAAW,OACT,cAAA,EACA,KAAA,KACkB;AAKlB,QAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,EAAG,IAAA;AAC1C,QAAA,IAAI,QAAA;AACJ,QAAA,IAAI,aAAa,cAAA,EAAgB;AAC/B,UAAA,QAAA,GAAW,EAAE,MAAM,cAAA,EAAe;AAAA,QACpC,CAAA,MAAA,IACE,QAAA,KAAa,cAAA,IACb,OAAO,KAAA,CAAM,MAAM,MAAA,GAAS,CAAC,CAAA,EAAG,IAAA,KAAS,QAAA,EACzC;AACA,UAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA;AACnC,UAAA,QAAA,GAAW;AAAA,YACT,IAAA,EAAM,cAAA;AAAA,YACN,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,EAAE,CAAA;AAAA,YAC5B,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAA,IAAY,MAAM;AAAA,WAC1C;AAAA,QACF,CAAA,MAAO;AACL,UAAA,QAAA,GAAW,EAAE,MAAM,eAAA,EAAgB;AAAA,QACrC;AAOA,QAAA,KAAK,cAAA;AACL,QAAA,IAAI,CAAC,cAAA,IAAkB,CAAC,aAAA,EAAe;AACrC,UAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,QAChE;AACA,QAAA,MAAM,cAAA,CAAe,kBAAkB,aAAa,CAAA;AACpD,QAAA,MAAM,SAAA,GAAY,cAAA,CAAe,YAAA,CAAa,aAAa,CAAA;AAC3D,QAAA,IAAI,UAAU,IAAA,IAAQ,SAAA,CAAU,WAAW,QAAA,IAAY,SAAA,CAAU,WAAW,WAAA,EAAa;AACvF,UAAA;AAAA,QACF;AACA,QAAA,IAAI,CAAC,cAAA,CAAe,oBAAA,CAAqB,aAAA,EAAe,QAAQ,CAAA,EAAG;AACnE,QAAA,MAAM,mBAAA,EAAoB;AAC1B,QAAA,MAAM,qBAAA,CAAsB;AAAA,UAC1B,IAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA;AAAA,UACA,IAAA,EAAM,cAAA;AAAA,UACN,OAAA,EAAS,CAAC,MAAA,KAAW,aAAA,CAAc,QAAQ,MAAA,EAAQ,IAAA,CAAK,SAAS,aAAa;AAAA,SAC/E,CAAA;AAAA,MACH,CAAA;AAAA,MACA,GAAA,EAAK;AAAA,KACN,CAAA;AAED,IAAA,MAAM,WAAA,GAAc,IAAI,WAAA,EAAY;AACpC,IAAA,MAAM,UAAA,GAAa,MAAM,WAAA,CAAY,OAAA;AAAA,MACnC;AAAA,QACE,EAAA,EAAI,eAAA;AAAA,QACJ,MAAA,EAAQ,MAAA;AAAA,QACR,MAAA,EAAQ,YAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,IAAA;AAAA,UACA,IAAA,EAAM;AAAA,YACJ,OAAO,OAAA,CAAQ,KAAA;AAAA,YACf,SAAA,EAAW,KAAA;AAAA,YACX,cAAA,EAAgB,KAAK,cAAA,IAAkB;AAAA,WACzC;AAAA,UACA,WAAA;AAAA,UACA,iBAAA,EAAmB,IAAA;AAAA,UACnB,YAAA;AAAA,UACA,eAAA;AAAA,UACA;AAAA;AACF,OACF;AAAA,MACA;AAAC;AAAA,KACH;AACA,IAAA,cAAA,GAAiB,WAAA;AACjB,IAAA,aAAA,GAAgB,UAAA;AAIhB,IAAA,KAAA,MAAW,SAAA,IAAa,WAAA,CAAY,KAAA,CACjC,kBAAA,CAAmB,UAAU,CAAA,CAC7B,MAAA,CAAO,CAAC,EAAE,MAAK,KAAM,0BAAA,CAA2B,GAAA,CAAI,IAAI,CAAC,CAAA,EAAG;AAC7D,MAAA,MAAM,QAAmC,EAAC;AAC1C,MAAA,KAAA,MAAW,GAAA,IAAO,UAAU,IAAA,EAAM;AAChC,QAAA,IAAI,MAAA;AACJ,QAAA,QAAQ,IAAI,IAAA;AAAM,UAChB,KAAK,SAAA;AACH,YAAA,MAAA,GAAW,CAAA,CAAA,OAAA,EAAQ;AACnB,YAAA;AAAA,UACF,KAAK,QAAA;AACH,YAAA,MAAA,GAAW,CAAA,CAAA,MAAA,EAAO;AAClB,YAAA;AAAA,UACF,KAAK,MAAA;AACH,YAAA,MAAA,GAAW,CAAA,CAAA,IAAA,EAAK;AAChB,YAAA;AAAA,UACF;AACE,YAAA,MAAA,GAAW,CAAA,CAAA,MAAA,EAAO;AAAA;AAEtB,QAAA,KAAA,CAAM,IAAI,IAAI,CAAA,GAAI,IAAI,QAAA,GAAW,MAAA,GAAS,OAAO,QAAA,EAAS;AAAA,MAC5D;AACA,MAAA,kBAAA,CAAmB,QAAA;AAAA,QACjB,gBAAA,CAAiB;AAAA,UACf,MAAM,SAAA,CAAU,IAAA;AAAA,UAChB,aAAa,SAAA,CAAU,IAAA;AAAA,UACvB,aAAa,SAAA,CAAU,WAAA;AAAA,UACvB,KAAA,EAAS,SAAO,KAAK,CAAA;AAAA,UACrB,IAAA,EAAM,OAAA;AAAA,UACN,QAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,KAAK,EAAA,EAAG;AAAA,UACxC,KAAA,EAAO,SAAA;AAAA,UACP,QAAA,EAAU,CAAC,KAAK,CAAA;AAAA,UAChB,IAAA,EAAM,SAAA,CAAU,WAAA,KAAgB,MAAA,GAAS,OAAA,GAAU,QAAA;AAAA,UACnD,OAAA,EAAS,OAAO,IAAA,KACd,WAAA,CAAY,UAAU,UAAA,EAAY,SAAA,CAAU,MAAM,IAAI;AAAA,SACzD,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF;AAKA,IAAA,WAAA,CAAY,aAAA,CAAc,UAAA,EAAY,CAAC,KAAA,KAAyB;AAC9D,MAAA,IAAA,CAAK,OAAA,GAAU;AAAA,QACb,IAAA,EAAM,eAAA;AAAA,QACN,KAAA,EAAO,CAAA,KAAA,EAAQ,KAAA,CAAM,KAAK,CAAA,CAAA;AAAA,QAC1B;AAAA,OACwB,CAAA;AAAA,IAC5B,CAAC,CAAA;AAGD,IAAA,OAAA,CAAQ,KAAK,eAAA,EAAiB;AAAA,MAC5B,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,UAAU,IAAA,CAAK,IAAA;AAAA,MACf,OAAO,OAAA,CAAQ;AAAA,KAChB,CAAA;AAED,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AAGF,MAAA,MAAM,eAAA,GAAgC,EAAE,IAAA,EAAM,cAAA,EAAe;AAC7D,MAAA,MAAM,WAAA,CAAY,OAAO,eAAA,EAAiB;AAAA,QACxC,cAAA,EAAgB,qBAAqB,eAAe,CAAA;AAAA,QACpD,IAAA,EAAM,EAAE,IAAA,EAAM,eAAA,CAAgB,IAAA;AAAK,OACpC,CAAA;AAED,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,YAAA,CAAa,UAAU,CAAA;AACtD,MAAA,IAAI,WAAW,IAAA,EAAM;AACnB,QAAA,OAAA,CAAQ,IAAA,CAAK,iBAAiB,EAAE,MAAA,EAAQ,KAAK,EAAA,EAAI,QAAA,EAAU,IAAA,CAAK,IAAA,EAAM,CAAA;AAAA,MACxE,CAAA,MAAA,IAAW,UAAA,CAAW,MAAA,KAAW,QAAA,EAAU;AACzC,QAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,EAAe,KAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,KAAK,EAAA,EAAI,QAAA,EAAU,IAAA,CAAK,IAAA,EAAM,CAAA;AAAA,MAClF,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,KAAK,uCAAA,EAAyC;AAAA,UACpD,QAAQ,IAAA,CAAK,EAAA;AAAA,UACb,QAAQ,UAAA,CAAW,MAAA;AAAA,UACnB,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AAAA,IACF,SAAS,GAAA,EAAK;AAGZ,MAAA,QAAA,GAAW,GAAA;AACX,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,MAAA,CAAO,IAAA,EAAK;AACZ,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,YAAA,CAAa,UAAU,CAAA;AACrD,MAAA,MAAM,SAAS,QAAA,KAAa,KAAA,CAAA;AAC5B,MAAA,IAAI,MAAA,GAA2C,QAAA;AAC/C,MAAA,IAAI,QAAQ,MAAA,GAAS,QAAA;AAAA,WAAA,IACZ,SAAA,CAAU,MAAA,KAAW,UAAA,EAAY,MAAA,GAAS,UAAA;AACnD,MAAA,MAAM,WAAA;AAAA,QACJ,IAAA,CAAK,UAAA;AAAA,QACL,YAAA,CAAa;AAAA,UACX,GAAG,cAAA;AAAA,UACH,eAAA,EAAiB,MAAA,CAAO,gBAAA,IAAoB,cAAA,CAAe,eAAA;AAAA,UAC3D,MAAA;AAAA,UACA,GAAI,MAAA,GACA,EAAE,KAAA,EAAO,QAAA,YAAoB,KAAA,GAAQ,QAAA,CAAS,OAAA,GAAU,MAAA,CAAO,QAAQ,CAAA,EAAE,GACzE;AAAC,SACN;AAAA,OACH,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAChB,MAAA,MAAM,WAAA,CAAY,UAAA,CAAW,UAAU,CAAA,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACvD,MAAA,MAAM,aAAa,OAAA,EAAQ;AAC3B,MAAA,SAAA,CAAU,SAAS,SAAA,EAAW;AAAA,QAC5B,QAAQ,WAAA,CAAY,YAAA,CAAa,UAAU,CAAA,CAAE,MAAA,KAAW,aAAa,IAAA,GAAO;AAAA,OAC7E,CAAA;AACD,MAAA,MAAM,SAAA,CAAU,KAAA,EAAM,CAAE,KAAA,CAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAAA,IACxC;AAAA,EACF,CAAA,SAAE;AACA,IAAA,eAAA,EAAgB;AAAA,EAClB;AACF;AAkBA,eAAsB,WAAW,IAAA,EAAoC;AACnE,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,EAAA,MAAM,EAAE,WAAA,EAAa,eAAA,EAAiB,uBAAA,EAAwB,GAAI,MAAA;AAElE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,GACjB,MAAM,eAAA,CAAgB,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,SAAS,CAAA,GACrD,MAAM,WAAA,CAAY,KAAK,UAAU,CAAA;AAErC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,GACd,CAAA,QAAA,EAAW,KAAK,SAAS,CAAA,CAAA,GACzB,CAAA,mBAAA,EAAsB,IAAA,CAAK,UAAU,CAAA,QAAA,CAAA;AACzC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,IAAI,CAAA,0BAAA,CAAuB,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,OAAA,CAAQ,MAAA,EAAQ,KAAK,UAAU,CAAA;AAKhE,EAAA,MAAM,aAAA,GAAgB,wBAAA,CAAyB,IAAA,CAAK,UAAU,CAAA;AAC9D,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAgB,GAAI,uBAAA,CAAwB;AAAA,IAC3D,WAAW,OAAA,CAAQ,KAAA;AAAA,IACnB,YAAY,IAAA,CAAK,UAAA;AAAA,IACjB,WAAW,aAAA,CAAc,OAAA;AAAA,IACzB,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAA,EAAQ,KAAK,KAAA,KAAU;AAAA,GACxB,CAAA;AACD,EAAA,MAAM,UAAU,YAAA,CAAa;AAAA,IAC3B,IAAA,EAAM,gBAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,UAAU,OAAA,CAAQ;AAAA,GACnB,CAAA;AACD,EAAA,OAAA,CAAQ,KAAK,kBAAA,EAAoB;AAAA,IAC/B,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,CAAQ;AAAA,MACZ,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,QAAA;AAAA,MACA,QAAA,EAAU,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,QAAA;AAAA,MACnC,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,cAAc,OAAA,CAAQ,KAAA;AAAA,MACtB,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,kBAAkB,IAAA,CAAK,gBAAA;AAAA,MACvB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH,CAAA,SAAE;AACA,IAAA,eAAA,EAAgB;AAAA,EAClB;AACF;AAMA,eAAe,sBAAA,CACb,IAAA,EACA,UAAA,EACA,GAAA,EACe;AACf,EAAA,MAAM,WAAA,GAAc,qBAAqB,IAAI,CAAA;AAC7C,EAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAE9B,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAoB;AAC9C,EAAA,MAAM,cAAA,GAAiB,mBAAmB,UAAU,CAAA;AACpD,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,KAAA,MAAW,QAAQ,WAAA,EAAa;AAC9B,MAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,MAAA,IAAI,aAAA,CAAc,GAAA,CAAI,OAAO,CAAA,EAAG;AAChC,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,cAAA,EAAgB,OAAO,CAAA;AACrD,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,MAAM,OAAA,GAAU,EAAA,CAAG,YAAA,CAAa,SAAA,EAAW,OAAO,CAAA;AAClD,QAAA,MAAM,EAAA,GAAK,sBAAsB,OAAO,CAAA;AACxC,QAAA,aAAA,CAAc,IAAI,OAAA,EAAS,EAAA,CAAG,UAAU,OAAA,IAAW,EAAA,CAAG,WAAW,EAAE,CAAA;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,WAAA,EAAa,aAAa,CAAA;AAC9D,EAAA,MAAM,WAAW,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,EAAE,SAAS,CAAA;AAClD,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,QAAQ,QAAA,CAAS,GAAA;AAAA,MACrB,CAAC,CAAA,KAAM,CAAA,EAAA,EAAK,CAAA,CAAE,MAAM,CAAA,QAAA,EAAW,CAAA,CAAE,SAAS,CAAA,QAAA,EAAW,CAAA,CAAE,MAAA,IAAU,QAAQ,CAAA;AAAA,KAC3E;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAA4B,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EAChE;AACA,EAAA,KAAA,MAAW,KAAK,MAAA,CAAO,MAAA,CAAO,CAACA,EAAAA,KAAMA,EAAAA,CAAE,SAAS,CAAA,EAAG;AACjD,IAAA,GAAA,CAAI,CAAA,cAAA,EAAiB,EAAE,OAAO,CAAA,CAAA,EAAI,EAAE,MAAM,CAAA,WAAA,EAAc,CAAA,CAAE,SAAS,CAAA,CAAE,CAAA;AAAA,EACvE;AACF;AAYA,SAAS,wBAAA,CAAyB,KAAA,EAAe,KAAA,EAAiB,MAAA,EAAsB;AACtF,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,CAAC,IAAA,KAAS;AAClC,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA,CAAS,KAAK,OAAA,CAAQ,IAAI,GAAG,QAAQ,CAAA;AAC3D,IAAA,OAAO,CAAC,SAAS,UAAA,CAAW,IAAI,KAAK,CAAC,IAAA,CAAK,WAAW,QAAQ,CAAA;AAAA,EAChE,CAAC,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,KAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,EAChF;AACF;AAGA,SAAS,cAAA,CAAe,QAA0B,OAAA,EAAyB;AACzE,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACzB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG;AACzB,IAAA,IAAA,CAAK,GAAA,CAAI,KAAK,IAAI,CAAA;AAClB,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,IAAA,CAAK,WAAW,aAAA,GACZ,CAAA,EAAA,EAAK,KAAK,IAAI,CAAA,cAAA,EAAiB,KAAK,SAAA,CAAU,IAAA,CAAK,cAAc,EAAE,CAAC,KACpE,CAAA,EAAA,EAAK,IAAA,CAAK,IAAI,CAAA,uBAAA,EAA0B,IAAA,CAAK,SAAS,eAAe,CAAA,CAAA;AAAA,KAC3E;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,SAAS,CAAA,GAAI;AAAA,EAAK,OAAO;AAAA,EAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AAClE;AAWO,SAAS,eAAA,CAAgB,QAAgB,UAAA,EAA4B;AAG1E,EAAA,IAAI,CAAC,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,KAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,EAC9E;AAEA,EAAA,MAAM,KAAA,GAAQ,gBAAgB,UAAU,CAAA;AACxC,EAAA,MAAM,SAA2B,EAAC;AAClC,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,MAAA,EAAQ,KAAA,EAAO,EAAE,MAAA,EAAQ,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA;AAClF,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,wBAAA,CAAyB,KAAA,EAAO,OAAO,MAAM,CAAA;AAC7C,IAAA,OAAO,KAAA;AAAA,EACT;AAKA,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,IAAK,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,aAAa,CAAA,EAAG;AACxE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,KAAA,EAAQ,MAAM,CAAA,mCAAA,CAAA,GAAwC,cAAA,CAAe,QAAQ,aAAa;AAAA,KAC5F;AAAA,EACF;AAEA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,IAAI,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,UAAA,GAAQ,EAAA;AAGxC,EAAA,MAAM,QAAA,GAAW,oBAAA,CAAqB,GAAA,CAAI,CAAC,GAAA,KAAQ,CAAA,EAAG,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,KAAK,CAAA;AAChF,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,mBAAmB,MAAM,CAAA,WAAA,EAAc,KAAA,CAAM,MAAM,aAAa,KAAA,IAAS,MAAM,CAAA,EAAG,IAAI,SAC7E,QAAQ,CAAA,0BAAA,EAAwB,MAAM,CAAA,YAAA,CAAA,GAC7C,cAAA,CAAe,QAAQ,cAAc;AAAA,GACzC;AACF;AAGA,SAAS,mBAAmB,UAAA,EAAmC;AAC7D,EAAA,IAAI,GAAA,GAAM,UAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA;AAC5C,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,SAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAA,CAAY,gBAAwB,OAAA,EAAgC;AAC3E,EAAA,KAAA,MAAW,SAAA,IAAa,YAAA,CAAa,cAAA,EAAgB,QAAQ,CAAA,EAAG;AAC9D,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,SAAA,EAAW,OAAO,CAAA;AAC7C,IAAA,IAAI,OAAO,OAAO,KAAA;AAAA,EACpB;AACA,EAAA,OAAO,IAAA;AACT;AAyBO,SAAS,aAAA,CACd,MAAA,EACA,MAAA,EACA,OAAA,EACA,SAAA,EACe;AACf,EAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,IAAA,IAAI,OAAA,GAAU,KAAA;AAEd,IAAA,MAAM,IAAA,GAAO,CAAC,GAAA,KAAgB;AAC5B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,mBAAmB,aAAa,CAAA;AACvC,MAAA,IAAI,GAAA,SAAY,GAAG,CAAA;AAAA,WACd,OAAA,EAAQ;AAAA,IACf,CAAA;AAEA,IAAA,MAAM,KAAA,GAAQ,UAAA;AAAA,MACZ,MAAM,KAAK,IAAI,KAAA,CAAM,6BAA6B,SAAA,GAAY,GAAI,GAAG,CAAC,CAAA;AAAA,MACtE;AAAA,KACF;AAEA,IAAA,MAAA,CAAO,EAAA,CAAG,aAAA,EAAe,CAAC,KAAA,KAAsB;AAC9C,MAAA,OAAA,GAAU,KAAK,CAAA;AACf,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,WAAA,EAAa,IAAA,EAAK;AAAA,WAAA,IAE5B,KAAA,CAAM,IAAA,KAAS,OAAA,IAAW,KAAA,CAAM,aAAa,IAAA,EAAM;AAC1D,QAAA,MAAM,GAAA,GACH,KAAA,CAA+C,KAAA,IAC/C,KAAA,CAA+B,OAAA,IAChC,aAAA;AACF,QAAA,IAAA,CAAK,IAAI,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,MACrB;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CAAa,KAAa,OAAA,EAAgC;AACjE,EAAA,KAAA,MAAW,KAAA,IAAS,GAAG,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,IAAA,IAAI,CAAC,KAAA,CAAM,WAAA,EAAY,EAAG;AAC1B,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA;AACtC,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AAC1C,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,OAAO,CAAA,EAAG;AAC1B,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,OAAA,EAAS,OAAO,OAAA;AAAA,IACrC,CAAA,MAAO;AACL,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,IAAA,EAAM,OAAO,CAAA;AACxC,MAAA,IAAI,OAAO,OAAO,KAAA;AAAA,IACpB;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-GMDSRSGI.js","sourcesContent":["/**\n * runFlow / resumeFlow — CLI entry helpers for the flow connector.\n *\n * Moved from `runner/src/runner.ts` to `factory-assets/connectors/flow/run-flow.ts`\n * in Phase 3 of the flow-connector extraction (2026-05-08). Behaviour is\n * byte-identical to the previous runner-side implementation; only the log\n * source changes from `runner:flow:<runId>` to `flow-connector:run:<runId>`.\n *\n * The runner re-exports these symbols with a deprecation warning for one\n * release. CLI consumers should switch to\n * `import { runFlow, resumeFlow } from \"@skaile/workspaces/factory-assets/connectors/flow/run-flow\"`.\n *\n * Internal runner helpers (FlowOrchestrator, bootstrapRunnerLogStore,\n * createAgentSession, resolveDriverPaths, session helpers) are loaded lazily\n * via dynamic `await import(\"@skaile/workspaces/runner\")` inside\n * `loadRunnerModule()` below. The lazy load avoids a static package-level\n * cycle (runner → connectors → factory-assets → runner) — the cycle exists at\n * the workspace level but never resolves at module-load time because\n * factory-assets only ever calls `import` from inside an async function body.\n * The string-literal specifier preserves `bun --compile` and tsup static\n * analysis.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { AgentEvent } from \"@skaile/workspaces/bridge\";\nimport {\n  findKindDirs,\n  isValidAssetName,\n  resolveAgentDir,\n  resolveSettings,\n  resolveSkWorkspaceConfig,\n} from \"@skaile/workspaces/core\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\nimport { parseSkillFrontmatter, validateFlowVersions } from \"@skaile/workspaces/resolver\";\nimport { initTelemetry } from \"@skaile/workspaces/telemetry\";\nimport type { FlowExecution, FlowPromptEvent } from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nimport { FlowAdapter } from \"./adapter.js\";\nimport {\n  findFlowFileInRoots,\n  FLOW_FILE_EXTENSIONS,\n  type FlowLookupMiss,\n  flowLookupRoots,\n  loadFlow,\n} from \"./engine/index.js\";\nimport { flowSkillVersionPins } from \"./engine/node-shape.js\";\nimport { SessionInlineSubFlowRunner } from \"./inline-sub-flow-host.js\";\nimport { SessionNodeExecutor } from \"./node-executor.js\";\nimport { driveOrchestratorTurn } from \"./orchestrator-turn.js\";\nimport { renderStimulusPrompt, type TurnStimulus } from \"./prompt-fragments.js\";\nimport { SessionSubpromptRunner } from \"./subprompt-runner.js\";\n\n/**\n * Lazy `import(\"@skaile/workspaces/runner\")` accessor. Cached on first call so\n * subsequent `runFlow` invocations don't re-evaluate the runner module.\n *\n * Dynamic ESM import is used (not `require`) so vitest and other ESM\n * bundlers honour their alias resolution — `require` would side-step the\n * configured aliases and pick up two distinct module instances when run\n * under vitest. The string-literal specifier ensures bun --compile keeps\n * the dependency (per the static-import-or-die rule in\n * connectors/CLAUDE.md).\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nlet _runnerModule: any | undefined;\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nasync function loadRunnerModule(): Promise<any> {\n  if (_runnerModule) return _runnerModule;\n  _runnerModule = await import(\"@skaile/workspaces/runner\");\n  return _runnerModule;\n}\n\n/** Type-only re-export of SessionState so the runner tombstone shim still works. */\nexport type SessionState = import(\"@skaile/workspaces/runner\").SessionState;\n\n/** Maximum agent session duration (4 hours). Configurable via {@link RunOptions.sessionTimeoutMs}. */\nconst DEFAULT_SESSION_TIMEOUT_MS = 4 * 60 * 60 * 1000; // 4 hours\n\nconst FLOW_AGENT_OPERATION_NAMES = new Set([\n  \"get_available\",\n  \"get_state\",\n  \"get_globals\",\n  \"build_handoff\",\n  \"validate_node\",\n  \"start_node\",\n  \"request_approval\",\n  \"request_input\",\n  \"complete_node\",\n  \"skip_node\",\n  \"fail_node\",\n]);\n\n/**\n * Options for {@link runFlow}.\n *\n * Wraps `FlowOrchestrator` with autonomous mode turned on by default. First-class\n * gate nodes remain mandatory human decisions in every mode.\n *\n * @docLink packages/factory-assets/flow#run-flow\n */\nexport interface RunOptions {\n  /** The working directory for the project being orchestrated. */\n  projectDir: string;\n  /** Absolute path to the `.flow.yaml` or `.flow.json` definition file. */\n  flowPath: string;\n  /**\n   * Directory containing `agent.yaml`, `SOUL.md`, `RULES.md`, `knowledge/`.\n   * Resolved from `skaile.yaml` via `resolveAgentDir` when absent.\n   */\n  agentDir?: string;\n  /**\n   * Agent harness. Defaults to `settings.driver` (`\"omp\"` or `\"claude-sdk\"`).\n   */\n  driver?: string;\n  /**\n   */\n  /**\n   * Model name override. Falls back to `settings.model` when absent.\n   */\n  model?: string;\n  /**\n   * Path to a specific `settings.json` to load instead of the default\n   * layered resolution chain (project → parent → global → built-in defaults).\n   */\n  settingsFile?: string;\n  /**\n   * When `true`, prints the initial flow state without starting the agent\n   * and returns immediately.\n   */\n  dryRun?: boolean;\n  /**\n   * Per-session timeout in milliseconds. Defaults to\n   * {@link DEFAULT_SESSION_TIMEOUT_MS} (4 hours).\n   */\n  sessionTimeoutMs?: number;\n  /** Optional human-readable label shown in the session list. */\n  sessionLabel?: string;\n  /** Autonomous mode for CLI runs. Defaults to true; first-class gate nodes are never bypassed. */\n  autonomousMode?: boolean;\n  /**\n   * Called for each {@link AgentEvent} emitted during the run\n   * (e.g. `text`, `tool_call`, `state_changed`).\n   */\n  onEvent?: (event: AgentEvent) => void;\n  /**\n   * Called for each diagnostic log line. Defaults to `process.stdout`.\n   */\n  onLog?: (line: string) => void;\n}\n\n/**\n * Options for resuming an existing CLI session.\n *\n * Reconnects the driver's conversation thread (conversation history is\n * preserved via the stored `driverSessionId`) but restarts flow execution\n * from scratch — flow state is not persisted in CLI mode. For governed,\n * resumable flow runs use a host that persists flow state (e.g. the Skaile\n * platform).\n *\n * @docLink packages/factory-assets/flow#resume-flow\n */\nexport interface ResumeOptions {\n  /** The working directory for the project being orchestrated. */\n  projectDir: string;\n  /**\n   * Specific run ID to resume. When absent, the current session pointer\n   * at `<projectDir>/.skaile/current` is used.\n   */\n  sessionId?: string;\n  /**\n   * Agent definition directory override. Defaults to the directory stored\n   * in the session file.\n   */\n  agentDir?: string;\n  /**\n   * When `true`, prints the initial flow state without starting the agent\n   * and returns immediately.\n   */\n  dryRun?: boolean;\n  /**\n   * Per-session timeout in milliseconds. Defaults to\n   * {@link DEFAULT_SESSION_TIMEOUT_MS} (4 hours).\n   */\n  sessionTimeoutMs?: number;\n  /**\n   * Called for each {@link AgentEvent} emitted during the run.\n   */\n  onEvent?: RunOptions[\"onEvent\"];\n  /**\n   * Called for each diagnostic log line. Defaults to `process.stdout`.\n   */\n  onLog?: RunOptions[\"onLog\"];\n}\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Start a new flow session from the CLI.\n *\n * Wraps `FlowOrchestrator` with autonomous mode turned on by default. The\n * runner remains idle between turns; first-class gates always park for a human\n * decision, including in autonomous mode. Non-CLI hosts (Skaile platform,\n * Pichi) use the orchestrator directly via the serve command surface and drive\n * gates through user actions.\n *\n * @docLink packages/factory-assets/flow#run-flow\n */\nexport async function runFlow(opts: RunOptions): Promise<void> {\n  const runner = await loadRunnerModule();\n  const {\n    bootstrapRunnerLogStore,\n    bootstrapCapabilityRegistry,\n    CapabilityRegistry,\n    createAgentSession,\n    createSessionStimulusBus,\n    defineCapability,\n    registerCompositionCapabilities,\n    resolveDriverPaths,\n    newSession,\n    saveSession,\n    touchSession,\n  } = runner;\n\n  const flow = loadFlow(opts.flowPath);\n  const agentDir = opts.agentDir ?? resolveAgentDir(opts.projectDir);\n  const settings = await resolveSettings(opts.projectDir, {\n    driver: opts.driver,\n    model: opts.model,\n  });\n\n  const session = newSession({\n    flowId: flow.id,\n    projectDir: opts.projectDir,\n    agentDir,\n    driver: settings.driver ?? \"omp\",\n    model: settings.model,\n    label: opts.sessionLabel,\n  });\n\n  // A dry run only prints the plan: it must not leave a `running` session behind.\n  if (!opts.dryRun) await saveSession(opts.projectDir, session);\n\n  // Bootstrap structured logging — registers a process-singleton LogStore.\n  // OnLogBridgeSink mirrors entries to opts.onLog when caller provides one,\n  // preserving back-compat with CLI hosts that consume plain text lines.\n  const wsConfigEarly = resolveSkWorkspaceConfig(opts.projectDir);\n  const { dispose: disposeLogStore } = bootstrapRunnerLogStore({\n    sessionId: session.runId,\n    projectDir: opts.projectDir,\n    yamlBlock: wsConfigEarly.logging,\n    onLog: opts.onLog,\n    // A host that takes lines through `onLog` prints them itself; the stdout\n    // sink would add every record again as a raw JSON line.\n    stdout: opts.onLog === undefined,\n  });\n  const flowLog = createLogger({\n    kind: \"flow-connector\",\n    subkind: \"run\",\n    instance: session.runId,\n  });\n  const log = (line: string) => flowLog.info(line);\n  const capabilityRegistry = new CapabilityRegistry();\n  bootstrapCapabilityRegistry(capabilityRegistry);\n  const capabilityHooks = {\n    sessionId: session.runId,\n    composeTools: () => capabilityRegistry.composeLLMTools(),\n    resolve: (name: string) =>\n      capabilityRegistry.list().find((cap: { name: string }) => cap.name === name) ?? null,\n    invoke: (name: string, input: unknown, _signal?: AbortSignal, callId?: string) =>\n      capabilityRegistry.invoke(name, input, { sessionId: session.runId, callId }),\n  };\n\n  try {\n    // ── Dry run ────────────────────────────────────────────────────────────\n    if (opts.dryRun) {\n      const adapter = new FlowAdapter();\n      const handle = await adapter.connect(\n        {\n          id: \"flow\",\n          driver: \"flow\",\n          access: \"read-only\" as const,\n          options: { flow, seed: { runId: session.runId, startedBy: \"cli\" } },\n        },\n        {}, // flow needs no connect context\n      );\n      const state = adapter.getExecution(handle);\n      const available = Object.values(state.nodes)\n        .filter((n) => n.status === \"available\")\n        .map((n) => n.id);\n      // The plan is the command's output, not a log event: print it as plain lines\n      // (no `[info] [flow-connector:run:…]` prefix from the log formatter).\n      const printPlan = opts.onLog ?? ((line: string) => console.log(line));\n      printPlan(`[dry-run] Flow: ${flow.name} (${flow.id})`);\n      printPlan(`[dry-run] Available: ${available.join(\", \") || \"(none)\"}`);\n      await adapter.disconnect(handle);\n      return;\n    }\n\n    await validatePinnedVersions(flow, opts.projectDir, log);\n\n    // ── Telemetry initialization ────────────────────────────────────────────\n    const wsConfig = wsConfigEarly;\n    const telemetry = await initTelemetry(wsConfig.telemetry);\n    const flowTrace = telemetry.startTrace({\n      name: `flow:${flow.id}`,\n      kind: \"flow_run\",\n      attributes: {\n        \"skaile.flow.id\": flow.id,\n        \"skaile.flow.run_id\": session.runId,\n      },\n    });\n\n    // ── Agent session setup ─────────────────────────────────────────────────\n    const driverPaths = resolveDriverPaths(settings);\n    const agentSession = await createAgentSession({\n      projectDir: opts.projectDir,\n      agentDir: session.agentDir,\n      driver: session.driver,\n      model: session.model,\n      resumeSessionId: session.driverSessionId,\n      projectClaudeMd: path.join(opts.projectDir, \"CLAUDE.md\"),\n      promptsDir: path.join(opts.projectDir, driverPaths.promptsDir),\n      sessionId: session.runId,\n      onLog: log,\n      telemetry,\n      trace: flowTrace,\n      wsConfig,\n      capabilities: capabilityHooks,\n      capabilityRegistry,\n    });\n    if (agentSession.composition?.discoverableEntries.length) {\n      registerCompositionCapabilities(\n        capabilityRegistry,\n        agentSession.composition.discoverableEntries,\n      );\n    }\n    const { driver } = agentSession;\n    const nodeExecutor = new SessionNodeExecutor({ workspaceDir: opts.projectDir });\n    // Same endpoints and credentials the session driver used: the registry\n    // and the credential env `createAgentSession` already resolved — not a\n    // new resolution, not a new secret channel.\n    const subpromptRunner = new SessionSubpromptRunner({\n      driverType: agentSession.driverType,\n      sessionModel: agentSession.model,\n      workspaceDir: opts.projectDir,\n      registry: agentSession.registry,\n      credentialEnv: agentSession.credentialEnv,\n      ...(agentSession.modelRef ? { modelRef: agentSession.modelRef } : {}),\n    });\n    let driverStarted = false;\n    const updatedSession = { ...session };\n\n    // Track driver session ID so future resumes can reconnect the SDK thread.\n    driver.on(\"agent-event\", () => {\n      const runtimeSessionId = driver.runtimeSessionId;\n      if (!runtimeSessionId || runtimeSessionId === updatedSession.driverSessionId) return;\n      updatedSession.driverSessionId = runtimeSessionId;\n      void saveSession(opts.projectDir, updatedSession).catch(() => {});\n    });\n\n    // ── FlowAdapter + stimulus bus ─────────────────────────────────────────\n    //\n    // Phase 4 of the flow-connector extraction: SessionStimulusBus is the sole\n    // turn driver. The legacy FlowOrchestrator + onStateChange subscription\n    // are gone — every turn is initiated either by the bus (after an adapter\n    // mutation observed via `useBusForStimulus: true`) or by an explicit\n    // `bus.signal()` call from this function (the initial flow_started turn).\n    //\n    // The bus's `driveTurn` callback receives the stimulus paragraph the\n    // adapter rendered (not the full orchestrator prompt). It hands the turn to\n    // `driveOrchestratorTurn`, which rebuilds the five-section prompt so the\n    // agent sees the same flow context the legacy orchestrator produced — and\n    // announces it, so a CLI consumer's `onEvent` stream carries the prompt too.\n    const flowConnectorId = \"flow\";\n    const turnTimeoutMs = opts.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;\n\n    const ensureDriverStarted = async (): Promise<void> => {\n      if (driverStarted) return;\n      await driver.start();\n      driverStarted = true;\n    };\n\n    // Same widening the `state_changed` forwarder below performs: `onEvent` is\n    // typed against the bridge's driver-level union, which has no case for a\n    // runtime-level event.\n    const emitFlowPrompt = (event: FlowPromptEvent): void => {\n      opts.onEvent?.(event as unknown as AgentEvent);\n    };\n\n    const inlineSubFlowRunner = new SessionInlineSubFlowRunner({\n      resolveFlow: (flowId) => loadFlow(resolveFlowPath(flowId, opts.projectDir)),\n      nodeExecutor,\n      subpromptRunner,\n      driveAgentTurn: async ({ flow: childFlow, execution, stimulus }) => {\n        await ensureDriverStarted();\n        await driveOrchestratorTurn({\n          flow: childFlow,\n          execution,\n          stimulus,\n          emit: emitFlowPrompt,\n          deliver: (prompt) => awaitAgentEnd(driver, prompt, opts.onEvent, turnTimeoutMs),\n        });\n      },\n    });\n\n    // Forward declaration so `driveTurn` can read the live execution\n    // snapshot. Assigned just below, before the bus can fire.\n    let flowAdapterRef: FlowAdapter | null = null;\n    let flowHandleRef: import(\"@skaile/workspaces/connectors\").ConnectorHandle | null = null;\n\n    const stimulusBus = createSessionStimulusBus({\n      driveTurn: async (\n        promptFragment: string,\n        metas: Array<Record<string, unknown>>,\n      ): Promise<void> => {\n        // The adapter signal carries `meta.kind` per stimulus. Use that to\n        // reconstruct the typed `TurnStimulus`; for compound batches, fall\n        // back to `state_changed` (the union element that means \"look at\n        // current state and continue\").\n        const lastKind = metas[metas.length - 1]?.kind;\n        let stimulus: TurnStimulus;\n        if (lastKind === \"flow_started\") {\n          stimulus = { kind: \"flow_started\" };\n        } else if (\n          lastKind === \"user_message\" &&\n          typeof metas[metas.length - 1]?.text === \"string\"\n        ) {\n          const meta = metas[metas.length - 1] as Record<string, unknown>;\n          stimulus = {\n            kind: \"user_message\",\n            text: String(meta.text ?? \"\"),\n            senderId: String(meta.senderId ?? \"user\"),\n          };\n        } else {\n          stimulus = { kind: \"state_changed\" };\n        }\n        // The fragment passed in by the bus is the adapter's\n        // `renderStimulusPrompt(stim)` joined across coalesced signals. It is\n        // discarded in favour of the structured stimulus, which\n        // `driveOrchestratorTurn` rebuilds the full prompt from; that keeps the\n        // prompt shape stable and the structured form already contains\n        // everything the fragment encoded.\n        void promptFragment;\n        if (!flowAdapterRef || !flowHandleRef) {\n          throw new Error(\"driveTurn fired before FlowAdapter was wired\");\n        }\n        await flowAdapterRef.drainRuntimeNodes(flowHandleRef);\n        const execution = flowAdapterRef.getExecution(flowHandleRef);\n        if (execution.done || execution.status === \"failed\" || execution.status === \"cancelled\") {\n          return;\n        }\n        if (!flowAdapterRef.shouldDriveAgentTurn(flowHandleRef, stimulus)) return;\n        await ensureDriverStarted();\n        await driveOrchestratorTurn({\n          flow,\n          execution,\n          stimulus,\n          emit: emitFlowPrompt,\n          deliver: (prompt) => awaitAgentEnd(driver, prompt, opts.onEvent, turnTimeoutMs),\n        });\n      },\n      log: flowLog,\n    });\n\n    const flowAdapter = new FlowAdapter();\n    const flowHandle = await flowAdapter.connect(\n      {\n        id: flowConnectorId,\n        driver: \"flow\",\n        access: \"read-write\" as const,\n        options: {\n          flow,\n          seed: {\n            runId: session.runId,\n            startedBy: \"cli\",\n            autonomousMode: opts.autonomousMode ?? true,\n          },\n          stimulusBus,\n          useBusForStimulus: true,\n          nodeExecutor,\n          subpromptRunner,\n          inlineSubFlowRunner,\n        },\n      },\n      {}, // flow needs no connect context\n    );\n    flowAdapterRef = flowAdapter;\n    flowHandleRef = flowHandle;\n\n    // Flow operations retain the connector's published bare protocol names;\n    // this is the intentional exception to generic capability namespaces.\n    for (const operation of flowAdapter.tools\n      .describeOperations(flowHandle)\n      .filter(({ name }) => FLOW_AGENT_OPERATION_NAMES.has(name))) {\n      const shape: Record<string, z.ZodType> = {};\n      for (const arg of operation.args) {\n        let schema: z.ZodType;\n        switch (arg.type) {\n          case \"boolean\":\n            schema = z.boolean();\n            break;\n          case \"number\":\n            schema = z.number();\n            break;\n          case \"json\":\n            schema = z.json();\n            break;\n          default:\n            schema = z.string();\n        }\n        shape[arg.name] = arg.required ? schema : schema.optional();\n      }\n      capabilityRegistry.register(\n        defineCapability({\n          name: operation.name,\n          displayName: operation.name,\n          description: operation.description,\n          input: z.object(shape),\n          side: \"agent\",\n          origin: { kind: \"flow\", flowId: flow.id },\n          scope: \"session\",\n          audience: [\"llm\"],\n          kind: operation.accessLevel === \"read\" ? \"query\" : \"effect\",\n          handler: async (args: Record<string, unknown>) =>\n            flowAdapter.executeOp(flowHandle, operation.name, args),\n        }),\n        \"agent\",\n      );\n    }\n\n    // Forward state_changed events to the caller. The bus computes a\n    // turn-kicking stimulus on each adapter mutation; the host-facing\n    // event stream still observes the full snapshot via onChange.\n    flowAdapter.onStateChange(flowHandle, (state: FlowExecution) => {\n      opts.onEvent?.({\n        type: \"state_changed\",\n        store: `flow:${state.runId}`,\n        state: state as unknown as Record<string, unknown>,\n      } as unknown as AgentEvent);\n    });\n\n    // ── Execute ────────────────────────────────────────────────────────────\n    flowLog.info(\"starting flow\", {\n      flowId: flow.id,\n      flowName: flow.name,\n      runId: session.runId,\n    });\n\n    let runError: unknown;\n    try {\n      // Kick the initial flow_started turn explicitly. Subsequent turns are\n      // driven by the bus signaling whenever the adapter mutates.\n      const initialStimulus: TurnStimulus = { kind: \"flow_started\" };\n      await stimulusBus.signal(flowConnectorId, {\n        promptFragment: renderStimulusPrompt(initialStimulus),\n        meta: { kind: initialStimulus.kind },\n      });\n\n      const finalState = flowAdapter.getExecution(flowHandle);\n      if (finalState.done) {\n        flowLog.info(\"flow complete\", { flowId: flow.id, flowName: flow.name });\n      } else if (finalState.status === \"failed\") {\n        flowLog.error(\"flow failed\", undefined, { flowId: flow.id, flowName: flow.name });\n      } else {\n        flowLog.warn(\"flow paused awaiting further stimulus\", {\n          flowId: flow.id,\n          status: finalState.status,\n          note: \"CLI mode does not supply human approval/input decisions\",\n        });\n      }\n    } catch (err) {\n      // The driver could not start (SDK missing, bad credentials, …): no node ran, so the\n      // session is `failed` with the cause, not a `paused` run that `resume` would pick up.\n      runError = err;\n      throw err;\n    } finally {\n      driver.kill();\n      const lastState = flowAdapter.getExecution(flowHandle);\n      const failed = runError !== undefined;\n      let status: \"complete\" | \"failed\" | \"paused\" = \"paused\";\n      if (failed) status = \"failed\";\n      else if (lastState.status === \"complete\") status = \"complete\";\n      await saveSession(\n        opts.projectDir,\n        touchSession({\n          ...updatedSession,\n          driverSessionId: driver.runtimeSessionId ?? updatedSession.driverSessionId,\n          status,\n          ...(failed\n            ? { error: runError instanceof Error ? runError.message : String(runError) }\n            : {}),\n        }),\n      ).catch(() => {});\n      await flowAdapter.disconnect(flowHandle).catch(() => {});\n      await agentSession.dispose();\n      telemetry.endTrace(flowTrace, {\n        status: flowAdapter.getExecution(flowHandle).status === \"complete\" ? \"ok\" : \"error\",\n      });\n      await telemetry.flush().catch(() => {});\n    }\n  } finally {\n    disposeLogStore();\n  }\n}\n\n/**\n * Resume an existing session from the CLI.\n *\n * With the Phase 2 turn-based model, flow state is NOT persisted to\n * local session files — only the driver session ID is kept. The CLI\n * can resume the agent's conversation thread, but the flow execution\n * itself starts from scratch because the runner has no durable store\n * for per-run state.\n *\n * For a governed, resumable flow run, use a host that persists flow\n * state (e.g. the Skaile platform). CLI resume is retained as a\n * driver-level convenience only: we load the session, restart the\n * flow, and the SDK will reconnect to the prior conversation thread.\n *\n * @docLink packages/factory-assets/flow#resume-flow\n */\nexport async function resumeFlow(opts: ResumeOptions): Promise<void> {\n  const runner = await loadRunnerModule();\n  const { loadSession, loadSessionById, bootstrapRunnerLogStore } = runner;\n\n  const session = opts.sessionId\n    ? await loadSessionById(opts.projectDir, opts.sessionId)\n    : await loadSession(opts.projectDir);\n\n  if (!session) {\n    const hint = opts.sessionId\n      ? `session ${opts.sessionId}`\n      : `current session in ${opts.projectDir}/.skaile`;\n    throw new Error(`No session found (${hint}) — run 'start' first`);\n  }\n\n  const flowPath = resolveFlowPath(session.flowId, opts.projectDir);\n\n  // Bootstrap a transient logger for the resume diagnostics. The inner\n  // runFlow() call will register its own LogStore for the new run. Keep\n  // OnLogBridgeSink wiring so callers passing onLog still see this line.\n  const wsConfigEarly = resolveSkWorkspaceConfig(opts.projectDir);\n  const { dispose: disposeLogStore } = bootstrapRunnerLogStore({\n    sessionId: session.runId,\n    projectDir: opts.projectDir,\n    yamlBlock: wsConfigEarly.logging,\n    onLog: opts.onLog,\n    stdout: opts.onLog === undefined,\n  });\n  const flowLog = createLogger({\n    kind: \"flow-connector\",\n    subkind: \"run\",\n    instance: session.runId,\n  });\n  flowLog.info(\"resuming session\", {\n    runId: session.runId,\n    flowId: session.flowId,\n    note: \"CLI mode does not persist flow state — flow restarts from scratch; driver thread resumes\",\n  });\n\n  try {\n    await runFlow({\n      projectDir: opts.projectDir,\n      flowPath,\n      agentDir: opts.agentDir ?? session.agentDir,\n      driver: session.driver,\n      model: session.model,\n      sessionLabel: session.label,\n      dryRun: opts.dryRun,\n      sessionTimeoutMs: opts.sessionTimeoutMs,\n      onEvent: opts.onEvent,\n      onLog: opts.onLog,\n    });\n  } finally {\n    disposeLogStore();\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nasync function validatePinnedVersions(\n  flow: Awaited<ReturnType<typeof loadFlow>>,\n  projectDir: string,\n  log: (line: string) => void,\n): Promise<void> {\n  const pinnedNodes = flowSkillVersionPins(flow);\n  if (pinnedNodes.length === 0) return;\n\n  const skillVersions = new Map<string, string>();\n  const aiResourcesDir = findAiResourcesDir(projectDir);\n  if (aiResourcesDir) {\n    for (const node of pinnedNodes) {\n      const skillId = node.skillId;\n      if (skillVersions.has(skillId)) continue;\n      const skillPath = findSkillMd(aiResourcesDir, skillId);\n      if (skillPath) {\n        const content = fs.readFileSync(skillPath, \"utf-8\");\n        const fm = parseSkillFrontmatter(content);\n        skillVersions.set(skillId, fm.metadata?.version ?? fm.version ?? \"\");\n      }\n    }\n  }\n\n  const checks = validateFlowVersions(pinnedNodes, skillVersions);\n  const failures = checks.filter((c) => !c.satisfied);\n  if (failures.length > 0) {\n    const lines = failures.map(\n      (f) => `  ${f.nodeId}: wants ${f.requested}, found ${f.actual || \"(none)\"}`,\n    );\n    throw new Error(`Skill version mismatch:\\n${lines.join(\"\\n\")}`);\n  }\n  for (const c of checks.filter((c) => c.satisfied)) {\n    log(`  Version OK: ${c.skillId} ${c.actual} satisfies ${c.requested}`);\n  }\n}\n\n/**\n * Assert `found` sits inside one of `roots`.\n *\n * A backstop, not the primary control: `isValidAssetName` already rejects every\n * id containing a separator, and `findFlowFileInRoots` skips any candidate that\n * escapes its search dir. So on today's code this cannot fire — it is here to\n * fail loudly rather than silently if a future lookup stops enforcing\n * containment itself. Widening the accepted extensions must never widen which\n * paths are reachable, and this is the line that keeps that honest.\n */\nfunction assertContainedInAnyRoot(found: string, roots: string[], flowId: string): void {\n  const resolved = path.resolve(found);\n  const inside = roots.some((root) => {\n    const relative = path.relative(path.resolve(root), resolved);\n    return !relative.startsWith(\"..\") && !path.isAbsolute(relative);\n  });\n  if (!inside) {\n    throw new Error(`Flow path escapes its lookup root: ${JSON.stringify(flowId)}`);\n  }\n}\n\n/** One line per near-miss: a file that is right there but was still rejected. */\nfunction describeMisses(misses: FlowLookupMiss[], heading: string): string {\n  const seen = new Set<string>();\n  const lines: string[] = [];\n  for (const miss of misses) {\n    if (seen.has(miss.path)) continue;\n    seen.add(miss.path);\n    lines.push(\n      miss.reason === \"id-mismatch\"\n        ? `  ${miss.path}: declares id ${JSON.stringify(miss.declaredId ?? \"\")}`\n        : `  ${miss.path}: could not be parsed (${miss.error ?? \"unknown error\"})`,\n    );\n  }\n  return lines.length > 0 ? `\\n${heading}\\n${lines.join(\"\\n\")}` : \"\";\n}\n\n/**\n * Resolve one flow identity through the CLI/serve host's normal lookup order —\n * the same roots and filenames `skaile run` and `flow list` use, via\n * {@link flowLookupRoots} / {@link findFlowFileInRoots}. Resolution is by the\n * **declared** `id`, not by filename.\n *\n * @throws {Error} When `flowId` is not a canonical asset name, when no file\n *   declares it, or when a match somehow resolves outside every lookup root.\n */\nexport function resolveFlowPath(flowId: string, projectDir: string): string {\n  // Sub-flow targets and resumed session records are the two callers, so an\n  // identity that is not canonical is a bug in the caller, not a missing file.\n  if (!isValidAssetName(flowId)) {\n    throw new Error(`Invalid canonical flow identity: ${JSON.stringify(flowId)}`);\n  }\n\n  const roots = flowLookupRoots(projectDir);\n  const misses: FlowLookupMiss[] = [];\n  const found = findFlowFileInRoots(flowId, roots, { onMiss: (m) => misses.push(m) });\n  if (found) {\n    assertContainedInAnyRoot(found, roots, flowId);\n    return found;\n  }\n\n  // A file that is present but unparseable is a different problem from a missing\n  // one, and \"not found\" is the wrong headline for it — that exact misdirection\n  // is what this change exists to remove, so don't reintroduce it here.\n  if (misses.length > 0 && misses.every((m) => m.reason === \"unparseable\")) {\n    throw new Error(\n      `Flow ${flowId} was found but could not be loaded.` + describeMisses(misses, \"Candidates:\"),\n    );\n  }\n\n  const shown = roots.slice(0, 3).join(\", \");\n  const more = roots.length > 3 ? \", …\" : \"\";\n  // Spelled from FLOW_FILE_EXTENSIONS so the message cannot drift from the\n  // candidate list the lookup actually probes.\n  const accepted = FLOW_FILE_EXTENSIONS.map((ext) => `${flowId}${ext}`).join(\" | \");\n  throw new Error(\n    `Flow not found: ${flowId}. Searched ${roots.length} root(s) (${shown || \"none\"}${more}) ` +\n      `for ${accepted} — flat, or inside a ${flowId}/ directory.` +\n      describeMisses(misses, \"Near misses:\"),\n  );\n}\n\n/** Walk up from projectDir to find ai-assets/ */\nfunction findAiResourcesDir(projectDir: string): string | null {\n  let dir = projectDir;\n  for (let i = 0; i < 6; i++) {\n    const candidate = path.join(dir, \"ai-assets\");\n    if (fs.existsSync(candidate)) return candidate;\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/** Find SKILL.md for a given skill ID in any `skills/` directory under ai-assets */\nfunction findSkillMd(aiResourcesDir: string, skillId: string): string | null {\n  for (const skillsDir of findKindDirs(aiResourcesDir, \"skills\")) {\n    const found = walkForSkill(skillsDir, skillId);\n    if (found) return found;\n  }\n  return null;\n}\n\n// ---------------------------------------------------------------------------\n// Turn-wait helper\n// ---------------------------------------------------------------------------\n\n/**\n * Minimal driver surface needed by the bus's `driveTurn` callback. Mirrors\n * the slice the legacy `FlowOrchestrator` consumed (`prompt` + `on` +\n * `removeAllListeners`) so we can keep the wait helper private to this\n * module without pulling in a runtime dep on `@skaile/workspaces/bridge`.\n */\ninterface TurnDriverSurface {\n  prompt(message: string): Promise<void>;\n  on(event: \"agent-event\", handler: (event: AgentEvent) => void): void;\n  removeAllListeners(event: \"agent-event\"): void;\n}\n\n/**\n * Send a prompt to the driver and resolve when the agent emits\n * `agent_end` (or reject on an `error` that is not an in-place retry).\n * Identical contract to the legacy `awaitAgentEnd` helper from\n * `flow-orchestrator.ts`. Phase 4 lifts the helper into `run-flow.ts` because\n * the bus now owns turn driving. Exported for tests only.\n */\nexport function awaitAgentEnd(\n  driver: TurnDriverSurface,\n  prompt: string,\n  onEvent: ((event: AgentEvent) => void) | undefined,\n  timeoutMs: number,\n): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    let settled = false;\n\n    const done = (err?: Error) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      driver.removeAllListeners(\"agent-event\");\n      if (err) reject(err);\n      else resolve();\n    };\n\n    const timer = setTimeout(\n      () => done(new Error(`Flow turn timed out after ${timeoutMs / 1000}s`)),\n      timeoutMs,\n    );\n\n    driver.on(\"agent-event\", (event: AgentEvent) => {\n      onEvent?.(event);\n      if (event.type === \"agent_end\") done();\n      // An in-place retry replays this same turn; its own end settles it.\n      else if (event.type === \"error\" && event.retrying !== true) {\n        const msg =\n          (event as { error?: string; message?: string }).error ??\n          (event as { message?: string }).message ??\n          \"Agent error\";\n        done(new Error(msg));\n      }\n    });\n\n    driver.prompt(prompt).catch(done);\n  });\n}\n\nfunction walkForSkill(dir: string, skillId: string): string | null {\n  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n    if (!entry.isDirectory()) continue;\n    const full = path.join(dir, entry.name);\n    const skillMd = path.join(full, \"SKILL.md\");\n    if (fs.existsSync(skillMd)) {\n      if (entry.name === skillId) return skillMd;\n    } else {\n      const found = walkForSkill(full, skillId);\n      if (found) return found;\n    }\n  }\n  return null;\n}\n"]}

package/dist/chunk-H5U7LNTJ.js

@@ -0,0 +1,122 @@
+import { Octokit } from '@octokit/rest';
+
+// library/src/install/source-fetch-github.ts
+var GITHUB_PAT_ENV = "SKAILE_GITHUB_PAT";
+function parseRepo(url) {
+  const m = url.match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?(?:[/#?].*)?$/i);
+  if (!m) throw new Error(`unsupported source URL: ${url}`);
+  return { owner: m[1], repo: m[2] };
+}
+async function fetchAssetFilesFromGitHub(opts) {
+  if (!/^[0-9a-f]{40}$/i.test(opts.commitSha)) {
+    throw new Error(
+      `pinned commit must be a 40-character hex SHA, got '${opts.commitSha}' \u2014 a branch or tag would make the install mutable`
+    );
+  }
+  const { owner, repo } = parseRepo(opts.url);
+  const hasPat = Boolean(process.env[GITHUB_PAT_ENV]);
+  if (!opts.octokit && !hasPat) {
+    return fetchFromRawHost({ owner, repo, commitSha: opts.commitSha, paths: opts.paths });
+  }
+  const octo = opts.octokit ?? new Octokit({ auth: process.env[GITHUB_PAT_ENV] });
+  let tree;
+  try {
+    tree = await octo.rest.git.getTree({
+      owner,
+      repo,
+      tree_sha: opts.commitSha,
+      recursive: "true"
+    });
+  } catch (e) {
+    throw new Error(
+      `unreachable: cannot read tree at ${opts.commitSha}: ${describeGitHubError(e, hasPat)}`
+    );
+  }
+  const byPath = /* @__PURE__ */ new Map();
+  for (const node of tree.data.tree) {
+    if (node.type === "blob" && node.path && node.sha) {
+      byPath.set(node.path, node.sha);
+    }
+  }
+  const result = {};
+  for (const path of opts.paths) {
+    const blobSha = byPath.get(path);
+    if (!blobSha) {
+      if (tree.data.truncated) {
+        throw new Error(
+          `tree truncated \u2014 repo too large for recursive listing at ${opts.commitSha}`
+        );
+      }
+      throw new Error(`unreachable: path not in tree: ${path}`);
+    }
+    let blob;
+    try {
+      blob = await octo.rest.git.getBlob({ owner, repo, file_sha: blobSha });
+    } catch (e) {
+      throw new Error(`unreachable: cannot read ${path}: ${describeGitHubError(e, hasPat)}`);
+    }
+    if (blob.data.encoding !== "base64") {
+      throw new Error(
+        `unreachable: blob ${path} has unsupported encoding '${blob.data.encoding}' (likely too large)`
+      );
+    }
+    result[path] = Buffer.from(blob.data.content, "base64");
+  }
+  return result;
+}
+var RAW_REQUEST_TIMEOUT_MS = 3e4;
+var RAW_CONCURRENCY = 8;
+function describeGitHubError(e, hasPat) {
+  const err = e;
+  const headers = err.response?.headers ?? {};
+  const exhausted = String(headers["x-ratelimit-remaining"]) === "0";
+  if (err.status === 429 || err.status === 403 && (exhausted || /rate limit/i.test(err.message ?? ""))) {
+    return rateLimitMessage(headers["x-ratelimit-reset"], hasPat);
+  }
+  return err.message ?? String(e);
+}
+function rateLimitMessage(reset, hasPat) {
+  const at = Number(reset);
+  const when = Number.isFinite(at) && at > 0 ? ` (resets ${new Date(at * 1e3).toISOString()})` : "";
+  return hasPat ? `GitHub rate limit exceeded${when}; wait for the reset` : `GitHub rate limit exceeded${when}; set ${GITHUB_PAT_ENV} to a GitHub token to raise it`;
+}
+async function fetchFromRawHost(args) {
+  const result = {};
+  const queue = [...args.paths];
+  const worker = async () => {
+    for (let path = queue.shift(); path !== void 0; path = queue.shift()) {
+      const url = `https://raw.githubusercontent.com/${args.owner}/${args.repo}/${args.commitSha}/` + path.split("/").map(encodeURIComponent).join("/");
+      let res;
+      try {
+        res = await fetch(url, { signal: AbortSignal.timeout(RAW_REQUEST_TIMEOUT_MS) });
+      } catch (e) {
+        const cause = e.cause?.code ?? e.message;
+        throw new Error(
+          `unreachable: cannot read ${path} from raw.githubusercontent.com: ${cause}`
+        );
+      }
+      if (res.status === 404) {
+        throw new Error(
+          `unreachable: path not in tree: ${path} (not at ${args.commitSha} in ${args.owner}/${args.repo}; a private repo needs ${GITHUB_PAT_ENV})`
+        );
+      }
+      if (res.status === 429 || res.status === 403) {
+        const retry = Number(res.headers.get("retry-after"));
+        const when = Number.isFinite(retry) && retry > 0 ? ` (retry in ${retry} s)` : "";
+        throw new Error(
+          `unreachable: GitHub refused ${path} with ${res.status}${when}; set ${GITHUB_PAT_ENV} to a GitHub token`
+        );
+      }
+      if (!res.ok) {
+        throw new Error(`unreachable: cannot read ${path}: GitHub answered ${res.status}`);
+      }
+      result[path] = Buffer.from(await res.arrayBuffer());
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(RAW_CONCURRENCY, queue.length) }, worker));
+  return result;
+}
+
+export { GITHUB_PAT_ENV, fetchAssetFilesFromGitHub };
+//# sourceMappingURL=chunk-H5U7LNTJ.js.map
+//# sourceMappingURL=chunk-H5U7LNTJ.js.map

package/dist/chunk-H5U7LNTJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../library/src/install/source-fetch-github.ts"],"names":[],"mappings":";;;AAmBO,IAAM,cAAA,GAAiB;AAsB9B,SAAS,UAAU,GAAA,EAA8C;AAI/D,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,0DAA0D,CAAA;AAC9E,EAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AACxD,EAAA,OAAO,EAAE,OAAO,CAAA,CAAE,CAAC,GAAI,IAAA,EAAM,CAAA,CAAE,CAAC,CAAA,EAAG;AACrC;AAYA,eAAsB,0BAA0B,IAAA,EAAkD;AAMhG,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mDAAA,EAAsD,KAAK,SAAS,CAAA,uDAAA;AAAA,KAEtE;AAAA,EACF;AACA,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,SAAA,CAAU,KAAK,GAAG,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAC,CAAA;AAKlD,EAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,MAAA,EAAQ;AAC5B,IAAA,OAAO,gBAAA,CAAiB,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,IAAW,IAAI,OAAA,CAAQ,EAAE,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAAG,CAAA;AAE9E,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ;AAAA,MACjC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAU,IAAA,CAAK,SAAA;AAAA,MACf,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oCAAoC,IAAA,CAAK,SAAS,KAAK,mBAAA,CAAoB,CAAA,EAAG,MAAM,CAAC,CAAA;AAAA,KACvF;AAAA,EACF;AAGA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM;AACjC,IAAA,IAAI,KAAK,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,IAAA,IAAQ,KAAK,GAAA,EAAK;AACjD,MAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,GAAG,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,OAAA,EAAS;AAKZ,MAAA,IAAI,IAAA,CAAK,KAAK,SAAA,EAAW;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,8DAAA,EAA4D,KAAK,SAAS,CAAA;AAAA,SAC5E;AAAA,MACF;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+BAAA,EAAkC,IAAI,CAAA,CAAE,CAAA;AAAA,IAC1D;AACA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,EAAE,KAAA,EAAO,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,CAAA;AAAA,IACvE,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,yBAAA,EAA4B,IAAI,KAAK,mBAAA,CAAoB,CAAA,EAAG,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,IACvF;AAGA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,QAAA,KAAa,QAAA,EAAU;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kBAAA,EAAqB,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAK,QAAQ,CAAA,oBAAA;AAAA,OAC3E;AAAA,IACF;AACA,IAAA,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA,CAAO,KAAK,IAAA,CAAK,IAAA,CAAK,SAAS,QAAQ,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,MAAA;AACT;AAGA,IAAM,sBAAA,GAAyB,GAAA;AAE/B,IAAM,eAAA,GAAkB,CAAA;AAMxB,SAAS,mBAAA,CAAoB,GAAY,MAAA,EAAyB;AAChE,EAAA,MAAM,GAAA,GAAM,CAAA;AAKZ,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,QAAA,EAAU,OAAA,IAAW,EAAC;AAC1C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,OAAA,CAAQ,uBAAuB,CAAC,CAAA,KAAM,GAAA;AAC/D,EAAA,IACE,GAAA,CAAI,MAAA,KAAW,GAAA,IACd,GAAA,CAAI,MAAA,KAAW,GAAA,KAAQ,SAAA,IAAa,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,CAAA,EACzE;AACA,IAAA,OAAO,gBAAA,CAAiB,OAAA,CAAQ,mBAAmB,CAAA,EAAG,MAAM,CAAA;AAAA,EAC9D;AACA,EAAA,OAAO,GAAA,CAAI,OAAA,IAAW,MAAA,CAAO,CAAC,CAAA;AAChC;AAEA,SAAS,gBAAA,CAAiB,OAAoC,MAAA,EAAyB;AACrF,EAAA,MAAM,EAAA,GAAK,OAAO,KAAK,CAAA;AACvB,EAAA,MAAM,IAAA,GACJ,MAAA,CAAO,QAAA,CAAS,EAAE,KAAK,EAAA,GAAK,CAAA,GAAI,CAAA,SAAA,EAAY,IAAI,KAAK,EAAA,GAAK,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,CAAA,GAAM,EAAA;AACrF,EAAA,OAAO,SACH,CAAA,0BAAA,EAA6B,IAAI,yBACjC,CAAA,0BAAA,EAA6B,IAAI,SAAS,cAAc,CAAA,8BAAA,CAAA;AAC9D;AAOA,eAAe,iBAAiB,IAAA,EAKI;AAClC,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,IAAA,CAAK,KAAK,CAAA;AAC5B,EAAA,MAAM,SAAS,YAA2B;AACxC,IAAA,KAAA,IAAS,IAAA,GAAO,MAAM,KAAA,EAAM,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,KAAA,CAAM,KAAA,EAAM,EAAG;AACvE,MAAA,MAAM,MACJ,CAAA,kCAAA,EAAqC,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,CAAA,CAAA,GAC9E,IAAA,CAAK,MAAM,GAAG,CAAA,CAAE,IAAI,kBAAkB,CAAA,CAAE,KAAK,GAAG,CAAA;AAClD,MAAA,IAAI,GAAA;AACJ,MAAA,IAAI;AACF,QAAA,GAAA,GAAM,MAAM,MAAM,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,sBAAsB,CAAA,EAAG,CAAA;AAAA,MAChF,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,KAAA,GAAS,CAAA,CAAoC,KAAA,EAAO,IAAA,IAAS,CAAA,CAAY,OAAA;AAC/E,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,yBAAA,EAA4B,IAAI,CAAA,iCAAA,EAAoC,KAAK,CAAA;AAAA,SAC3E;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,+BAAA,EAAkC,IAAI,CAAA,SAAA,EAAY,IAAA,CAAK,SAAS,CAAA,IAAA,EAAO,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,uBAAA,EACpE,cAAc,CAAA,CAAA;AAAA,SAC1C;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,QAAA,MAAM,QAAQ,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AACnD,QAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,KAAK,KAAK,KAAA,GAAQ,CAAA,GAAI,CAAA,WAAA,EAAc,KAAK,CAAA,GAAA,CAAA,GAAQ,EAAA;AAC9E,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,4BAAA,EAA+B,IAAI,CAAA,MAAA,EAAS,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,SAAS,cAAc,CAAA,kBAAA;AAAA,SACtF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,IAAI,CAAA,kBAAA,EAAqB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACnF;AACA,MAAA,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA,CAAO,KAAK,MAAM,GAAA,CAAI,aAAa,CAAA;AAAA,IACpD;AAAA,EACF,CAAA;AACA,EAAA,MAAM,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,KAAA,CAAM,MAAM,CAAA,EAAE,EAAG,MAAM,CAAC,CAAA;AACzF,EAAA,OAAO,MAAA;AACT","file":"chunk-H5U7LNTJ.js","sourcesContent":["/**\n * GitHub asset-byte fetcher for the pointer-only install path.\n *\n * Given an upstream repo URL and a pinned commit SHA, walks the recursive\n * git tree at that commit and fetches the blob bytes for each requested path.\n * The Catalog never serves asset bytes — it only hands clients the Pointer\n * Triple (`source.url` + `source.commitSha` + per-file `{path, sha256}`),\n * and `installFromManifest` verifies every byte against those hashes.\n *\n * Authentication: an optional GitHub PAT is read from the `SKAILE_GITHUB_PAT`\n * environment variable when no `octokit` instance is injected. Public repos\n * work unauthenticated (subject to GitHub's anonymous rate limit).\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { Octokit } from \"@octokit/rest\";\n\n/** GitHub PAT environment variable used when no Octokit is injected. */\nexport const GITHUB_PAT_ENV = \"SKAILE_GITHUB_PAT\";\n\n/**\n * Options for {@link fetchAssetFilesFromGitHub}.\n */\nexport interface FetchOpts {\n  /** Upstream repo URL (e.g. `https://github.com/skaile-ai/skaile-ai-assets`). */\n  url: string;\n  /** Immutable 40-char git commit SHA the asset version was pinned at. */\n  commitSha: string;\n  /** Repo-relative paths to fetch. */\n  paths: string[];\n  /** Optional Octokit instance — injectable for tests. */\n  octokit?: Octokit;\n}\n\n/**\n * Parse `{ owner, repo }` out of a GitHub repo URL.\n *\n * Accepts both HTTPS (`https://github.com/owner/repo[.git]`) and SCP-style\n * SSH (`git@github.com:owner/repo[.git]`) forms.\n */\nfunction parseRepo(url: string): { owner: string; repo: string } {\n  // Repo names may contain dots (e.g. `skaile-ai/www.skaile.ai`). Capture the\n  // full repo segment up to a path separator / end-of-string, and strip an\n  // optional trailing `.git` suffix only.\n  const m = url.match(/github\\.com[/:]([^/]+)\\/([^/]+?)(?:\\.git)?(?:[/#?].*)?$/i);\n  if (!m) throw new Error(`unsupported source URL: ${url}`);\n  return { owner: m[1]!, repo: m[2]! };\n}\n\n/**\n * Fetch the bytes of each requested path from a GitHub repo at a pinned commit.\n *\n * Reads the recursive git tree at `commitSha`, maps each blob path to its blob\n * SHA, then fetches each requested path's blob and base64-decodes it.\n *\n * @returns A `{ path → Buffer }` map covering every requested path.\n * @throws An error whose message matches `/unreachable/i` if the tree cannot\n *   be read or any requested path is absent from the tree.\n */\nexport async function fetchAssetFilesFromGitHub(opts: FetchOpts): Promise<Record<string, Buffer>> {\n  // The pointer-only integrity model depends on `commitSha` being an immutable\n  // git commit SHA. GitHub's tree API also accepts branch/tag names, which\n  // would produce a mutable fetch and a non-pinned `Instance.sourceCommitSha` —\n  // silently breaking the auditable/re-verifiable guarantee. Reject anything\n  // that is not exactly 40 hex characters.\n  if (!/^[0-9a-f]{40}$/i.test(opts.commitSha)) {\n    throw new Error(\n      `pinned commit must be a 40-character hex SHA, got '${opts.commitSha}' — ` +\n        \"a branch or tag would make the install mutable\",\n    );\n  }\n  const { owner, repo } = parseRepo(opts.url);\n  const hasPat = Boolean(process.env[GITHUB_PAT_ENV]);\n  // Anonymous reads of a public repo go to the raw-content host: one request per file, and\n  // none counts against the 60-calls-per-hour anonymous limit of the REST API (the tree +\n  // blob route spent about six API calls per skill). A token, or an injected Octokit, uses\n  // the API (a private repo is only readable there).\n  if (!opts.octokit && !hasPat) {\n    return fetchFromRawHost({ owner, repo, commitSha: opts.commitSha, paths: opts.paths });\n  }\n  const octo = opts.octokit ?? new Octokit({ auth: process.env[GITHUB_PAT_ENV] });\n\n  let tree: Awaited<ReturnType<typeof octo.rest.git.getTree>>;\n  try {\n    tree = await octo.rest.git.getTree({\n      owner,\n      repo,\n      tree_sha: opts.commitSha,\n      recursive: \"true\",\n    });\n  } catch (e) {\n    throw new Error(\n      `unreachable: cannot read tree at ${opts.commitSha}: ${describeGitHubError(e, hasPat)}`,\n    );\n  }\n\n  // path → blob SHA\n  const byPath = new Map<string, string>();\n  for (const node of tree.data.tree) {\n    if (node.type === \"blob\" && node.path && node.sha) {\n      byPath.set(node.path, node.sha);\n    }\n  }\n\n  const result: Record<string, Buffer> = {};\n  for (const path of opts.paths) {\n    const blobSha = byPath.get(path);\n    if (!blobSha) {\n      // [H1] A recursive tree listing is truncated for large repos\n      // (`data.truncated: true`). A path missing from a truncated listing is\n      // not necessarily absent from the repo — surface a distinct, accurate\n      // error rather than the misleading \"path not in tree\".\n      if (tree.data.truncated) {\n        throw new Error(\n          `tree truncated — repo too large for recursive listing at ${opts.commitSha}`,\n        );\n      }\n      throw new Error(`unreachable: path not in tree: ${path}`);\n    }\n    let blob: Awaited<ReturnType<typeof octo.rest.git.getBlob>>;\n    try {\n      blob = await octo.rest.git.getBlob({ owner, repo, file_sha: blobSha });\n    } catch (e) {\n      throw new Error(`unreachable: cannot read ${path}: ${describeGitHubError(e, hasPat)}`);\n    }\n    // [L2] GitHub returns `encoding: \"none\"` (with empty content) for blobs\n    // larger than ~1MB. Only base64 is decodable here — fail loudly otherwise.\n    if (blob.data.encoding !== \"base64\") {\n      throw new Error(\n        `unreachable: blob ${path} has unsupported encoding '${blob.data.encoding}' (likely too large)`,\n      );\n    }\n    result[path] = Buffer.from(blob.data.content, \"base64\");\n  }\n  return result;\n}\n\n/** Per-request ceiling for the raw-content host. */\nconst RAW_REQUEST_TIMEOUT_MS = 30_000;\n/** Files fetched at once from the raw-content host. */\nconst RAW_CONCURRENCY = 8;\n\n/**\n * The text for a failed GitHub API call. An exhausted rate limit names the fix\n * (`SKAILE_GITHUB_PAT`) and when the window resets; any other error keeps GitHub's message.\n */\nfunction describeGitHubError(e: unknown, hasPat: boolean): string {\n  const err = e as {\n    status?: number;\n    message?: string;\n    response?: { headers?: Record<string, string | number | undefined> };\n  };\n  const headers = err.response?.headers ?? {};\n  const exhausted = String(headers[\"x-ratelimit-remaining\"]) === \"0\";\n  if (\n    err.status === 429 ||\n    (err.status === 403 && (exhausted || /rate limit/i.test(err.message ?? \"\")))\n  ) {\n    return rateLimitMessage(headers[\"x-ratelimit-reset\"], hasPat);\n  }\n  return err.message ?? String(e);\n}\n\nfunction rateLimitMessage(reset: string | number | undefined, hasPat: boolean): string {\n  const at = Number(reset);\n  const when =\n    Number.isFinite(at) && at > 0 ? ` (resets ${new Date(at * 1000).toISOString()})` : \"\";\n  return hasPat\n    ? `GitHub rate limit exceeded${when}; wait for the reset`\n    : `GitHub rate limit exceeded${when}; set ${GITHUB_PAT_ENV} to a GitHub token to raise it`;\n}\n\n/**\n * Read each path from `raw.githubusercontent.com/<owner>/<repo>/<sha>/<path>`. The commit\n * is a full SHA, so the bytes are as immutable as through the API; `installFromManifest`\n * still verifies every file against the pinned hashes.\n */\nasync function fetchFromRawHost(args: {\n  owner: string;\n  repo: string;\n  commitSha: string;\n  paths: string[];\n}): Promise<Record<string, Buffer>> {\n  const result: Record<string, Buffer> = {};\n  const queue = [...args.paths];\n  const worker = async (): Promise<void> => {\n    for (let path = queue.shift(); path !== undefined; path = queue.shift()) {\n      const url =\n        `https://raw.githubusercontent.com/${args.owner}/${args.repo}/${args.commitSha}/` +\n        path.split(\"/\").map(encodeURIComponent).join(\"/\");\n      let res: Response;\n      try {\n        res = await fetch(url, { signal: AbortSignal.timeout(RAW_REQUEST_TIMEOUT_MS) });\n      } catch (e) {\n        const cause = (e as { cause?: { code?: string } }).cause?.code ?? (e as Error).message;\n        throw new Error(\n          `unreachable: cannot read ${path} from raw.githubusercontent.com: ${cause}`,\n        );\n      }\n      if (res.status === 404) {\n        throw new Error(\n          `unreachable: path not in tree: ${path} (not at ${args.commitSha} in ${args.owner}/${args.repo}; ` +\n            `a private repo needs ${GITHUB_PAT_ENV})`,\n        );\n      }\n      if (res.status === 429 || res.status === 403) {\n        const retry = Number(res.headers.get(\"retry-after\"));\n        const when = Number.isFinite(retry) && retry > 0 ? ` (retry in ${retry} s)` : \"\";\n        throw new Error(\n          `unreachable: GitHub refused ${path} with ${res.status}${when}; set ${GITHUB_PAT_ENV} to a GitHub token`,\n        );\n      }\n      if (!res.ok) {\n        throw new Error(`unreachable: cannot read ${path}: GitHub answered ${res.status}`);\n      }\n      result[path] = Buffer.from(await res.arrayBuffer());\n    }\n  };\n  await Promise.all(Array.from({ length: Math.min(RAW_CONCURRENCY, queue.length) }, worker));\n  return result;\n}\n"]}