@skaile/workspaces 5.14.0 → 5.15.1

package/dist/{chunk-IPN7N2AZ.js → chunk-JUHDED6J.js}

@@ -1,4 +1,4 @@
-import { getStoreConfig, getStoreToken, storeFetch } from './chunk-O3Q3MOAV.js';
+import { getStoreConfig, getStoreToken, storeFetch } from './chunk-VQQCA7BD.js';
 
 // cli/src/store-publisher.ts
 function makeHttpPublisherClient(config = getStoreConfig(), timeoutMs = 2e4) {
@@ -25,5 +25,5 @@ function makeHttpPublisherClient(config = getStoreConfig(), timeoutMs = 2e4) {
 }
 
 export { makeHttpPublisherClient };
-//# sourceMappingURL=chunk-IPN7N2AZ.js.map
-//# sourceMappingURL=chunk-IPN7N2AZ.js.map
+//# sourceMappingURL=chunk-JUHDED6J.js.map
+//# sourceMappingURL=chunk-JUHDED6J.js.map

package/dist/{chunk-IPN7N2AZ.js.map → chunk-JUHDED6J.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-publisher.ts"],"names":[],"mappings":";;;AA+FO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAC3F,qBAAA,EAAuB,CAAC,EAAA,KACtB,IAAA,CAAK,sBAAsB,kBAAA,CAAmB,EAAE,CAAC,CAAA,aAAA,CAAe;AAAA,GACpE;AACF","file":"chunk-IPN7N2AZ.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n  /**\n   * Identity of the caller. `username` is the Keycloak login (personal-tier\n   * namespace); `githubLogin` is the verified GitHub handle when connected —\n   * the namespace to publish under when it differs from the login.\n   */\n  me(): Promise<{ username: string; githubLogin?: string | null }>;\n  /** Register (or re-register) a source; returns the created/existing row id. */\n  sourcesAdd(body: {\n    url: string;\n    ref: string;\n    sidecarUrl?: string;\n    sidecarRef?: string;\n    /**\n     * Target publisher namespace (the manifest's `publisher`). When it differs\n     * from the caller's login username, the store resolves the CLAIMED Publisher\n     * for it (the store must already have the claim). Omitted → the store\n     * defaults to `@<username>` (personal).\n     */\n    namespace?: string;\n  }): Promise<{ id: string }>;\n  /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n  sourcesList(): Promise<Array<{ id: string; url: string }>>;\n  /** Kick off a source sync; returns the async job id to poll. */\n  sourceSync(id: string): Promise<{ jobId: string }>;\n  /** Poll a job's terminal status + per-item results. */\n  jobGet(\n    jobId: string,\n  ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n  /** Discovered publishable candidates for a synced source. */\n  sourceCandidates(id: string): Promise<\n    Array<{\n      id: string;\n      name: string;\n      version: string;\n      kind: string;\n      published: boolean;\n      assetRoot: string;\n    }>\n  >;\n  /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n  assetPreview(id: string): Promise<{\n    discoveredFiles: string[];\n    candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n  }>;\n  /**\n   * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n   * launching a job; the normal path returns `{ jobId }`.\n   */\n  assetPublish(\n    id: string,\n    body: { ref: string; files: string[] },\n    dryRun?: boolean,\n  ): Promise<{ jobId?: string; manifest?: unknown }>;\n  /** Retract a published asset. Response body is ignored. */\n  assetUnpublish(id: string): Promise<unknown>;\n  /**\n   * Read-only \"can I publish under `@<ns>` right now, and if not, what's the\n   * path?\" probe. Backs the `publish --dry-run` namespace status line; its\n   * `message` is store-authored and meant to be surfaced verbatim.\n   */\n  namespaceAvailability(ns: string): Promise<{\n    namespace: string;\n    status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n    claimMethod?: string;\n    message: string;\n  }>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n  config: StoreConfig = getStoreConfig(),\n  timeoutMs = 20_000,\n): PublisherClient {\n  // Acquire a fresh Keycloak token per call (device-flow session in\n  // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n  const call = async <T>(\n    path: string,\n    opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n  ): Promise<T> => {\n    const jwt = await getStoreToken();\n    return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n  };\n  return {\n    me: () => call(\"/api/v1/me\"),\n    sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n    sourcesList: () => call(\"/api/v1/sources\"),\n    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n    assetPublish: (id, body, dryRun) =>\n      call(`/api/v1/assets/${id}/publish`, {\n        method: \"POST\",\n        body,\n        ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n      }),\n    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n    namespaceAvailability: (ns) =>\n      call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`),\n  };\n}\n"]}
+{"version":3,"sources":["../cli/src/store-publisher.ts"],"names":[],"mappings":";;;AA+FO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAC3F,qBAAA,EAAuB,CAAC,EAAA,KACtB,IAAA,CAAK,sBAAsB,kBAAA,CAAmB,EAAE,CAAC,CAAA,aAAA,CAAe;AAAA,GACpE;AACF","file":"chunk-JUHDED6J.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n  /**\n   * Identity of the caller. `username` is the Keycloak login (personal-tier\n   * namespace); `githubLogin` is the verified GitHub handle when connected —\n   * the namespace to publish under when it differs from the login.\n   */\n  me(): Promise<{ username: string; githubLogin?: string | null }>;\n  /** Register (or re-register) a source; returns the created/existing row id. */\n  sourcesAdd(body: {\n    url: string;\n    ref: string;\n    sidecarUrl?: string;\n    sidecarRef?: string;\n    /**\n     * Target publisher namespace (the manifest's `publisher`). When it differs\n     * from the caller's login username, the store resolves the CLAIMED Publisher\n     * for it (the store must already have the claim). Omitted → the store\n     * defaults to `@<username>` (personal).\n     */\n    namespace?: string;\n  }): Promise<{ id: string }>;\n  /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n  sourcesList(): Promise<Array<{ id: string; url: string }>>;\n  /** Kick off a source sync; returns the async job id to poll. */\n  sourceSync(id: string): Promise<{ jobId: string }>;\n  /** Poll a job's terminal status + per-item results. */\n  jobGet(\n    jobId: string,\n  ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n  /** Discovered publishable candidates for a synced source. */\n  sourceCandidates(id: string): Promise<\n    Array<{\n      id: string;\n      name: string;\n      version: string;\n      kind: string;\n      published: boolean;\n      assetRoot: string;\n    }>\n  >;\n  /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n  assetPreview(id: string): Promise<{\n    discoveredFiles: string[];\n    candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n  }>;\n  /**\n   * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n   * launching a job; the normal path returns `{ jobId }`.\n   */\n  assetPublish(\n    id: string,\n    body: { ref: string; files: string[] },\n    dryRun?: boolean,\n  ): Promise<{ jobId?: string; manifest?: unknown }>;\n  /** Retract a published asset. Response body is ignored. */\n  assetUnpublish(id: string): Promise<unknown>;\n  /**\n   * Read-only \"can I publish under `@<ns>` right now, and if not, what's the\n   * path?\" probe. Backs the `publish --dry-run` namespace status line; its\n   * `message` is store-authored and meant to be surfaced verbatim.\n   */\n  namespaceAvailability(ns: string): Promise<{\n    namespace: string;\n    status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n    claimMethod?: string;\n    message: string;\n  }>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n  config: StoreConfig = getStoreConfig(),\n  timeoutMs = 20_000,\n): PublisherClient {\n  // Acquire a fresh Keycloak token per call (device-flow session in\n  // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n  const call = async <T>(\n    path: string,\n    opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n  ): Promise<T> => {\n    const jwt = await getStoreToken();\n    return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n  };\n  return {\n    me: () => call(\"/api/v1/me\"),\n    sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n    sourcesList: () => call(\"/api/v1/sources\"),\n    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n    assetPublish: (id, body, dryRun) =>\n      call(`/api/v1/assets/${id}/publish`, {\n        method: \"POST\",\n        body,\n        ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n      }),\n    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n    namespaceAvailability: (ns) =>\n      call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`),\n  };\n}\n"]}

package/dist/{chunk-PXDWTJ3P.js → chunk-KRRHADE7.js}

@@ -1,5 +1,5 @@
-import { compositeSha256 } from './chunk-IY5E7Y5W.js';
-import { parseAssetRef } from './chunk-J4OYIYFQ.js';
+import { compositeSha256 } from './chunk-ANSZULXH.js';
+import { parseAssetRef } from './chunk-VY6NTFE7.js';
 import { createHash } from 'crypto';
 import { rm, mkdir, writeFile } from 'fs/promises';
 import { isAbsolute, resolve, sep, join, dirname } from 'path';
@@ -35,7 +35,7 @@ function longestCommonDirPrefix(paths) {
 }
 async function installFromManifest(opts) {
   const { manifest, libraryRoot } = opts;
-  const fetcher = opts.fetcher ?? (await import('./source-fetch-github-PIO6EMMF.js')).fetchAssetFilesFromGitHub;
+  const fetcher = opts.fetcher ?? (await import('./source-fetch-github-ST4MFL3D.js')).fetchAssetFilesFromGitHub;
   if (opts.targetDir !== void 0) {
     return installFlat(manifest, opts.targetDir, fetcher);
   }
@@ -123,5 +123,5 @@ async function installFlat(manifest, targetDir, fetcher) {
 }
 
 export { assertSafeManifestPath, installFromManifest, longestCommonDirPrefix };
-//# sourceMappingURL=chunk-PXDWTJ3P.js.map
-//# sourceMappingURL=chunk-PXDWTJ3P.js.map
+//# sourceMappingURL=chunk-KRRHADE7.js.map
+//# sourceMappingURL=chunk-KRRHADE7.js.map

package/dist/{chunk-PXDWTJ3P.js.map → chunk-KRRHADE7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;;AAgDO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,QAAA,CAAS,KAAK,CAAA;AACtD,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AAAA,IACxC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-PXDWTJ3P.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\nimport { compositeSha256 } from \"../../../core/src/publish-manifest.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const actualComposite = compositeSha256(manifest.files);\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n  }\n\n  return { installPath: target };\n}\n"]}
+{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;;AAgDO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,QAAA,CAAS,KAAK,CAAA;AACtD,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AAAA,IACxC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-KRRHADE7.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\nimport { compositeSha256 } from \"../../../core/src/publish-manifest.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const actualComposite = compositeSha256(manifest.files);\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n  }\n\n  return { installPath: target };\n}\n"]}

package/dist/{chunk-ZU24LWBI.js → chunk-LEOXPIC6.js}

@@ -1,4 +1,4 @@
-import { tryWithFsDeadline, withFsDeadline, fsDeadlineMs } from './chunk-M3P4BYRK.js';
+import { tryWithFsDeadline, withFsDeadline, fsDeadlineMs } from './chunk-SP5NGNBV.js';
 import { createLogger } from './chunk-BOFL7GIF.js';
 import { stat, mkdir, cp, writeFile, rm } from 'fs/promises';
 import { resolve, sep, join } from 'path';
@@ -155,5 +155,5 @@ function resolveFlowSkills(flow, allEntries) {
 }
 
 export { WORKSPACE_MOUNT_ENV_VAR, deployAll, deployCatalogEntry, findAiAssetsRoot, isUnderWorkspaceMount, resolveFlowSkills, undeployCatalogEntry, workspaceMountDirs };
-//# sourceMappingURL=chunk-ZU24LWBI.js.map
-//# sourceMappingURL=chunk-ZU24LWBI.js.map
+//# sourceMappingURL=chunk-LEOXPIC6.js.map
+//# sourceMappingURL=chunk-LEOXPIC6.js.map

package/dist/{chunk-ZU24LWBI.js.map → chunk-LEOXPIC6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../asset-manager/src/catalog-deployer.ts"],"names":[],"mappings":";;;;;AAyGA,IAAM,uBAAA,GAA0B,CAAA;AAGhC,IAAM,qBAAA,GAAwB,CAAA;AAE9B,IAAI,cAAA;AAEJ,SAAS,GAAA,GAAuC;AAC9C,EAAA,cAAA,KAAmB,aAAa,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,oBAAoB,CAAA;AAC/E,EAAA,OAAO,cAAA;AACT;AAOA,IAAM,2BAAA,GAA8B,mBAAA;AAS7B,IAAM,uBAAA,GAA0B;AAYhC,SAAS,kBAAA,GAA+B;AAC7C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AAC/C,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAW,OAAO,CAAC,2BAA2B,CAAA;AAC1D,EAAA,OAAO,GAAA,CACJ,MAAM,GAAG,CAAA,CACT,IAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,IAAA,EAAM,CAAA,CAC/B,OAAO,CAAC,OAAA,KAAY,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,CACtC,IAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,OAAO,CAAC,CAAA;AACtC;AAYO,SAAS,qBAAA,CACd,SAAA,EACA,SAAA,GAAsB,kBAAA,EAAmB,EAChC;AACT,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAChC,EAAA,OAAO,SAAA,CAAU,IAAA,CAAK,CAAC,GAAA,KAAQ;AAC7B,IAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,IAAA,OAAO,MAAA,KAAW,IAAA,IAAQ,MAAA,CAAO,UAAA,CAAW,OAAO,GAAG,CAAA;AAAA,EACxD,CAAC,CAAA;AACH;AA0BA,eAAsB,gBAAA,CACpB,UACA,IAAA,EACwB;AACxB,EAAA,MAAM,SAAA,GAAY,IAAA,EAAM,SAAA,IAAa,kBAAA,EAAmB;AACxD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,qBAAA;AAC/B,EAAA,IAAI,GAAA,GAAM,QAAQ,QAAQ,CAAA;AAI1B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,EAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA;AACvC,IAAA,IAAI,qBAAA,CAAsB,SAAA,EAAW,SAAS,CAAA,EAAG;AAC/C,MAAA,OAAA,CAAQ,KAAK,SAAS,CAAA;AAAA,IACxB,CAAA,MAAO;AACL,MAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,QAClB,QAAQ,SAAS,CAAA,CAAA;AAAA,QACjB,YAAA,CAAa,MAAM,IAAA,CAAK,SAAS,GAAG,WAAA,EAAY;AAAA,QAChD;AAAA,OACF;AACA,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,SAAS,SAAS,CAAA;AACtD,QAAA,OAAO,SAAA;AAAA,MACT;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA;AAChC,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,SAAS,SAAS,CAAA;AACtD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAA,CAAY,SAAmB,SAAA,EAA2B;AACjE,EAAA,GAAA,EAAI,CAAE,IAAA;AAAA,IACJ,gIAAA;AAAA,IACA,EAAE,SAAS,SAAA;AAAU,GACvB;AACF;AAsBA,eAAsB,kBAAA,CACpB,OACA,OAAA,EAC+C;AAC/C,EAAA,MAAM,EAAE,UAAA,EAAY,SAAA,EAAW,OAAA,EAAQ,GAAI,OAAA;AAE3C,EAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAO,CAAA,cAAA,EAAiB,KAAA,CAAM,IAAI,CAAA,4BAAA,CAAA,EAA0B;AAAA,EACvF;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,EAAY,KAAA,CAAM,WAAW,CAAA;AACrD,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,UAAA,EAAY,UAAU,CAAA;AAE/C,EAAA,MAAM,aAAa,MAAM,iBAAA;AAAA,IACvB,QAAQ,WAAW,CAAA,CAAA;AAAA,IACnB,YAAY;AACV,MAAA,MAAM,KAAK,WAAW,CAAA;AACtB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,sBAAA,EAAyB,WAAW,CAAA,CAAA,EAAG;AAAA,EACzE;AAEA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,EAAW,KAAA,CAAM,IAAI,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,cAAA,CAAe,CAAA,MAAA,EAAS,OAAO,CAAA,CAAA,EAAI,MAAM,KAAA,CAAM,OAAA,EAAS,EAAE,SAAA,EAAW,IAAA,EAAM,CAAC,CAAA;AAGlF,IAAA,MAAM,cAAA;AAAA,MACJ,CAAA,GAAA,EAAM,UAAU,CAAA,IAAA,EAAO,OAAO,CAAA,CAAA;AAAA,MAC9B,MAAM,EAAA,CAAG,UAAA,EAAY,SAAS,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,MACjD,cAAa,GAAI;AAAA,KACnB;AAIA,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAC9C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAM,cAAA;AAAA,QAAe,SAAS,WAAW,CAAA,CAAA;AAAA,QAAI,MAC3C,UAAU,WAAA,EAAa,CAAA;;AAAA,EAA2B,OAAO;AAAA,CAAA,EAAM,MAAM;AAAA,OACvE;AAAA,IACF,CAAA,MAAO;AAIL,MAAA,MAAM,cAAA,CAAe,CAAA,GAAA,EAAM,WAAW,CAAA,CAAA,EAAI,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,IAClF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAA,EAAE;AAAA,EACnF;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAWA,eAAsB,oBAAA,CAAqB,MAAc,SAAA,EAAqC;AAC5F,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,EAAW,IAAI,CAAA;AACpC,EAAA,MAAM,SAAS,MAAM,iBAAA;AAAA,IACnB,QAAQ,OAAO,CAAA,CAAA;AAAA,IACf,YAAY;AACV,MAAA,MAAM,KAAK,OAAO,CAAA;AAClB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,cAAA;AAAA,IACJ,SAAS,OAAO,CAAA,CAAA;AAAA,IAChB,MAAM,GAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IAClD,cAAa,GAAI;AAAA,GACnB;AACA,EAAA,OAAO,IAAA;AACT;AAcA,eAAsB,SAAA,CACpB,SACA,OAAA,EACuB;AACvB,EAAA,MAAM,MAAA,GAAuB,EAAE,QAAA,EAAU,EAAC,EAAG,SAAS,EAAC,EAAG,MAAA,EAAQ,EAAC,EAAE;AAErE,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,MAAA,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,EAAE,CAAA;AAC5B,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,CAAA,GAAI,MAAM,kBAAA,CAAmB,KAAA,EAAO,OAAO,CAAA;AACjD,IAAA,IAAI,EAAE,OAAA,EAAS;AACb,MAAA,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,KAAA,CAAM,EAAE,CAAA;AAAA,IAC/B,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,EAAG,KAAA,CAAM,EAAE,CAAA,EAAA,EAAK,CAAA,CAAE,KAAK,CAAA,CAAE,CAAA;AAAA,IAC9C;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAeO,SAAS,iBAAA,CACd,MACA,UAAA,EAC2F;AAC3F,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAkC;AAC3D,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI,EAAE,IAAA,KAAS,OAAA,eAAsB,GAAA,CAAI,CAAA,CAAE,MAAM,CAAC,CAAA;AAAA,EACpD;AAEA,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,eAAA,IAAmB,EAAC,EAAG;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACnC,IAAA,IAAI,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA;AAAA,SACzB,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EACxB;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,eAAA,IAAmB,EAAC,EAAG;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACnC,IAAA,IAAI,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA;AAAA,EAEhC;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAU,OAAA,EAAQ;AACvC","file":"chunk-ZU24LWBI.js","sourcesContent":["/**\n * Platform-triggered asset deployment.\n *\n * Takes catalog entries (with source_path relative to ai-assets/) and deploys\n * them to a session's .claude/skills/ directory. Handles skill context injection\n * and catalog priority-based name resolution.\n */\n\nimport { cp, mkdir, rm, stat, writeFile } from \"node:fs/promises\";\nimport { join, resolve, sep } from \"node:path\";\nimport { fsDeadlineMs, tryWithFsDeadline, withFsDeadline } from \"@skaile/workspaces/core\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\n// ---------------------------------------------------------------------------\n// Types (formerly in catalog-compiler.ts, inlined after tear-out in Task 1.5)\n// ---------------------------------------------------------------------------\n\n/**\n * A single user-facing input parameter declared in a SKILL.md.\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface InputSpec {\n  /** Input parameter key used in skill invocation. */\n  key: string;\n  /** Whether the input must be provided before running the skill. */\n  required?: boolean;\n  /** Question string shown to the user when collecting this input. */\n  prompt?: string;\n  /** Short display label for UI forms. */\n  label?: string;\n  /** Input data type hint (e.g. `\"string\"`, `\"number\"`, `\"file\"`). */\n  type?: string;\n  /** Additional guidance text shown alongside the input field. */\n  hint?: string;\n}\n\n/**\n * A compiled catalog entry (skill or flow).\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface CatalogEntryCompiled {\n  /** Unique ID in `publisher/name` form (e.g. `skaileup/cf_overview`). */\n  id: string;\n  /** Asset kind. */\n  kind: \"skill\" | \"flow\";\n  /** Human-readable asset name. */\n  name: string;\n  /** One-line description. */\n  description: string;\n  /** Semantic version string. */\n  version: string;\n  /** Maturity stage. */\n  stage: \"alpha\" | \"beta\" | \"stable\";\n  /** Searchable keywords. */\n  keywords: string[];\n  /** User-facing input specifications. */\n  inputs: InputSpec[];\n  /** Asset path relative to assetsRoot. */\n  source_path: string;\n  /** Optional icon identifier. */\n  icon?: string;\n  /** Flow-only: required skill names. */\n  required_skills?: string[];\n  /** Flow-only: optional skill names. */\n  optional_skills?: string[];\n}\n\n/**\n * Options controlling how platform-triggered skill deployment is performed.\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface DeployFromCatalogOptions {\n  /** Root directory of ai-assets (where `source_path` in catalog entries is relative to). */\n  assetsRoot: string;\n  /** Target directory for deployed skills (e.g. `/workspace/.claude/skills/`). */\n  skillsDir: string;\n  /** Optional context markdown appended to the deployed skill directory as `CONTEXT.md`. */\n  context?: string;\n}\n\n/**\n * Result of a platform-triggered batch skill deployment.\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface DeployResult {\n  /** IDs of catalog entries successfully deployed. */\n  deployed: string[];\n  /** IDs of catalog entries skipped (non-skill kinds). */\n  skipped: string[];\n  /** Error messages for entries that could not be deployed. */\n  errors: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Workspace-mount awareness\n// ---------------------------------------------------------------------------\n\n/**\n * Multiplier applied to the base filesystem deadline for whole-tree operations\n * (recursive copy / remove), which legitimately outlast a single `stat`.\n */\nconst TREE_OP_DEADLINE_FACTOR = 4;\n\n/** Default number of parent levels {@link findAiAssetsRoot} inspects. */\nconst AI_ASSETS_WALK_LEVELS = 6;\n\nlet deployerLogger: ReturnType<typeof createLogger> | undefined;\n\nfunction log(): ReturnType<typeof createLogger> {\n  deployerLogger ??= createLogger({ kind: \"runner\", subkind: \"catalog-deployer\" });\n  return deployerLogger;\n}\n\n/**\n * Where the agent container binds its rclone FUSE mount. Nothing under this\n * path is a safe place to read an asset tree from: the mount is remote\n * (SharePoint / OneDrive / WebDAV) and can wedge indefinitely.\n */\nconst DEFAULT_WORKSPACE_MOUNT_DIR = \"/skaile/workspace\";\n\n/**\n * Env override for the workspace-mount path(s), comma-separated.\n *\n * Set it when the runner binds the mount somewhere other than\n * {@link DEFAULT_WORKSPACE_MOUNT_DIR}; set it to the empty string to disable\n * the guard entirely (single-machine dev, where nothing is a network mount).\n */\nexport const WORKSPACE_MOUNT_ENV_VAR = \"SKAILE_WORKSPACE_MOUNT_DIR\";\n\n/**\n * Resolve the directories treated as network mounts.\n *\n * Read per call rather than cached: the runner mutates `process.env` while\n * wiring a session, so a module-load snapshot would pin a pre-configuration\n * value.\n *\n * @returns Absolute mount paths; empty when the guard is disabled.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport function workspaceMountDirs(): string[] {\n  const raw = process.env[WORKSPACE_MOUNT_ENV_VAR];\n  if (raw === undefined) return [DEFAULT_WORKSPACE_MOUNT_DIR];\n  return raw\n    .split(\",\")\n    .map((segment) => segment.trim())\n    .filter((segment) => segment.length > 0)\n    .map((segment) => resolve(segment));\n}\n\n/**\n * Is `candidate` at, or inside, one of the known workspace mount paths?\n *\n * Pure path arithmetic — deliberately no filesystem access, because the whole\n * point is to decide *before* touching a path that might be unresponsive.\n *\n * @param candidate - Path to test.\n * @param mountDirs - Mount roots; defaults to {@link workspaceMountDirs}.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport function isUnderWorkspaceMount(\n  candidate: string,\n  mountDirs: string[] = workspaceMountDirs(),\n): boolean {\n  const target = resolve(candidate);\n  return mountDirs.some((dir) => {\n    const root = resolve(dir);\n    return target === root || target.startsWith(root + sep);\n  });\n}\n\n/**\n * Walk upward from `startDir` looking for an `ai-assets/` directory.\n *\n * Two properties matter beyond \"find the folder\":\n *\n * 1. **Never synchronous.** The walk probes up to six directories; any one of\n *    them can be on a FUSE mount, and the former `existsSync` chain blocked the\n *    event loop on the first unresponsive probe. Each probe is now awaited and\n *    deadline-bounded, so a wedged mount costs one skipped candidate.\n * 2. **Never resolves onto a mount.** A hit under the workspace mount is\n *    skipped with a warning rather than returned: accepting it would wire every\n *    later skill deploy — a recursive copy — to a remote filesystem. The walk\n *    continues upward, so a legitimate `ai-assets/` in a parent still wins.\n *\n * Only a **directory** counts. An `ai-assets` file would otherwise be returned\n * as a root and every later `join(root, source_path)` would fail with ENOTDIR.\n *\n * @param startDir - Directory to start from (typically the project dir).\n * @param opts - `levels` caps the upward walk; `mountDirs` overrides the mount\n *   roots (defaults to {@link workspaceMountDirs}).\n * @returns Absolute path to the `ai-assets/` directory, or `null` if none is\n *   reachable within `levels`.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function findAiAssetsRoot(\n  startDir: string,\n  opts?: { levels?: number; mountDirs?: string[] },\n): Promise<string | null> {\n  const mountDirs = opts?.mountDirs ?? workspaceMountDirs();\n  const levels = opts?.levels ?? AI_ASSETS_WALK_LEVELS;\n  let dir = resolve(startDir);\n  // Every level of a `/skaile/workspace/...` start dir is under the mount, so\n  // an unconditional warn would fire once per level for one lookup. Collect and\n  // report once — the operator needs the fact, not six copies of it.\n  const refused: string[] = [];\n\n  for (let i = 0; i < levels; i++) {\n    const candidate = join(dir, \"ai-assets\");\n    if (isUnderWorkspaceMount(candidate, mountDirs)) {\n      refused.push(candidate);\n    } else {\n      const isDir = await tryWithFsDeadline(\n        `stat ${candidate}`,\n        async () => (await stat(candidate)).isDirectory(),\n        false,\n      );\n      if (isDir) {\n        if (refused.length > 0) warnRefused(refused, mountDirs);\n        return candidate;\n      }\n    }\n    const parent = resolve(dir, \"..\");\n    if (parent === dir) break; // filesystem root — nothing further up\n    dir = parent;\n  }\n  if (refused.length > 0) warnRefused(refused, mountDirs);\n  return null;\n}\n\n/** Single warning for every `ai-assets` candidate skipped for sitting on a mount. */\nfunction warnRefused(refused: string[], mountDirs: string[]): void {\n  log().warn(\n    \"findAiAssetsRoot refused candidates under a workspace mount — deploying skills from a network mount can stall the session\",\n    { refused, mountDirs },\n  );\n}\n\n/**\n * Deploy a single catalog entry to the session skills directory.\n *\n * Copies the entire skill source directory into `skillsDir/<entry.name>/`.\n * If `context` is provided, a separate `CONTEXT.md` is written alongside\n * `SKILL.md` so the source file is never modified.\n *\n * Only `skill` entries are deployable; other kinds return an error.\n *\n * **Async by necessity.** This runs from the `session_init` command handler\n * with the WebSocket live, and both `assetsRoot` and `skillsDir` can sit on a\n * network mount. The former `cpSync`/`rmSync` pair parked the event loop for\n * the whole copy; every call is now awaited and deadline-bounded, so an\n * unresponsive mount fails one deployment instead of the session.\n *\n * @param entry - Compiled catalog entry to deploy.\n * @param options - Deployment target and optional context.\n * @returns `{ success: true }` on success, `{ success: false, error }` on failure.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function deployCatalogEntry(\n  entry: CatalogEntryCompiled,\n  options: DeployFromCatalogOptions,\n): Promise<{ success: boolean; error?: string }> {\n  const { assetsRoot, skillsDir, context } = options;\n\n  if (entry.kind !== \"skill\") {\n    return { success: false, error: `Cannot deploy ${entry.kind} directly — only skills` };\n  }\n\n  const sourcePath = join(assetsRoot, entry.source_path);\n  const skillMdPath = join(sourcePath, \"SKILL.md\");\n\n  const hasSkillMd = await tryWithFsDeadline(\n    `stat ${skillMdPath}`,\n    async () => {\n      await stat(skillMdPath);\n      return true;\n    },\n    false,\n  );\n  if (!hasSkillMd) {\n    return { success: false, error: `SKILL.md not found at ${skillMdPath}` };\n  }\n\n  const destDir = join(skillsDir, entry.name);\n\n  try {\n    await withFsDeadline(`mkdir ${destDir}`, () => mkdir(destDir, { recursive: true }));\n\n    // Copy the entire skill directory\n    await withFsDeadline(\n      `cp ${sourcePath} -> ${destDir}`,\n      () => cp(sourcePath, destDir, { recursive: true }),\n      fsDeadlineMs() * TREE_OP_DEADLINE_FACTOR,\n    );\n\n    // Write context to a separate CONTEXT.md — never modify the original SKILL.md.\n    // The agent discovers both files in the skill directory.\n    const contextPath = join(destDir, \"CONTEXT.md\");\n    if (context) {\n      await withFsDeadline(`write ${contextPath}`, () =>\n        writeFile(contextPath, `# Additional Context\\n\\n${context}\\n`, \"utf8\"),\n      );\n    } else {\n      // `force: true` makes this a single call: a stale CONTEXT.md is removed,\n      // an absent one is a no-op. The former existsSync probe only added a\n      // second trip to the same possibly-wedged mount.\n      await withFsDeadline(`rm ${contextPath}`, () => rm(contextPath, { force: true }));\n    }\n  } catch (err) {\n    return { success: false, error: err instanceof Error ? err.message : String(err) };\n  }\n\n  return { success: true };\n}\n\n/**\n * Remove a deployed skill directory from the session skills directory.\n *\n * @param name - Skill name (directory basename under `skillsDir`).\n * @param skillsDir - Absolute path to the session skills directory.\n * @returns `true` if the skill was found and removed; `false` if it was not\n *   deployed, or if the directory could not be reached within the deadline.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function undeployCatalogEntry(name: string, skillsDir: string): Promise<boolean> {\n  const destDir = join(skillsDir, name);\n  const exists = await tryWithFsDeadline(\n    `stat ${destDir}`,\n    async () => {\n      await stat(destDir);\n      return true;\n    },\n    false,\n  );\n  if (!exists) return false;\n  await withFsDeadline(\n    `rm -r ${destDir}`,\n    () => rm(destDir, { recursive: true, force: true }),\n    fsDeadlineMs() * TREE_OP_DEADLINE_FACTOR,\n  );\n  return true;\n}\n\n/**\n * Deploy multiple catalog entries in a single batch operation.\n *\n * Non-skill entries (flows, agents, etc.) are automatically skipped and\n * recorded in `result.skipped`. Deployment failures are collected in\n * `result.errors` without aborting the rest of the batch.\n *\n * @param entries - Compiled catalog entries to deploy.\n * @param options - Deployment target and optional context.\n * @returns Aggregated {@link DeployResult} with deployed, skipped, and error lists.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function deployAll(\n  entries: CatalogEntryCompiled[],\n  options: DeployFromCatalogOptions,\n): Promise<DeployResult> {\n  const result: DeployResult = { deployed: [], skipped: [], errors: [] };\n\n  for (const entry of entries) {\n    if (entry.kind !== \"skill\") {\n      result.skipped.push(entry.id);\n      continue;\n    }\n\n    // Serial on purpose: concurrent recursive copies onto one mount multiply\n    // the queue depth on the exact resource that is already the bottleneck.\n    const r = await deployCatalogEntry(entry, options);\n    if (r.success) {\n      result.deployed.push(entry.id);\n    } else {\n      result.errors.push(`${entry.id}: ${r.error}`);\n    }\n  }\n\n  return result;\n}\n\n/**\n * Resolve a flow's skill dependencies from the full catalog entry list.\n *\n * Partitions `flow.required_skills` and `flow.optional_skills` into resolved\n * entries and a list of names that could not be found. Missing optional skills\n * are silently ignored (they do not appear in `missing`).\n *\n * @param flow - Compiled flow entry whose skill dependencies should be resolved.\n * @param allEntries - Full set of compiled catalog entries to search.\n * @returns Object containing resolved `required` entries, resolved `optional` entries,\n *   and `missing` skill names that were listed as required but not found.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport function resolveFlowSkills(\n  flow: CatalogEntryCompiled,\n  allEntries: CatalogEntryCompiled[],\n): { required: CatalogEntryCompiled[]; optional: CatalogEntryCompiled[]; missing: string[] } {\n  const skillsByName = new Map<string, CatalogEntryCompiled>();\n  for (const e of allEntries) {\n    if (e.kind === \"skill\") skillsByName.set(e.name, e);\n  }\n\n  const required: CatalogEntryCompiled[] = [];\n  const optional: CatalogEntryCompiled[] = [];\n  const missing: string[] = [];\n\n  for (const name of flow.required_skills ?? []) {\n    const entry = skillsByName.get(name);\n    if (entry) required.push(entry);\n    else missing.push(name);\n  }\n\n  for (const name of flow.optional_skills ?? []) {\n    const entry = skillsByName.get(name);\n    if (entry) optional.push(entry);\n    // Optional skills don't count as missing\n  }\n\n  return { required, optional, missing };\n}\n"]}
+{"version":3,"sources":["../asset-manager/src/catalog-deployer.ts"],"names":[],"mappings":";;;;;AAyGA,IAAM,uBAAA,GAA0B,CAAA;AAGhC,IAAM,qBAAA,GAAwB,CAAA;AAE9B,IAAI,cAAA;AAEJ,SAAS,GAAA,GAAuC;AAC9C,EAAA,cAAA,KAAmB,aAAa,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,oBAAoB,CAAA;AAC/E,EAAA,OAAO,cAAA;AACT;AAOA,IAAM,2BAAA,GAA8B,mBAAA;AAS7B,IAAM,uBAAA,GAA0B;AAYhC,SAAS,kBAAA,GAA+B;AAC7C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AAC/C,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAW,OAAO,CAAC,2BAA2B,CAAA;AAC1D,EAAA,OAAO,GAAA,CACJ,MAAM,GAAG,CAAA,CACT,IAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,IAAA,EAAM,CAAA,CAC/B,OAAO,CAAC,OAAA,KAAY,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,CACtC,IAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,OAAO,CAAC,CAAA;AACtC;AAYO,SAAS,qBAAA,CACd,SAAA,EACA,SAAA,GAAsB,kBAAA,EAAmB,EAChC;AACT,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAChC,EAAA,OAAO,SAAA,CAAU,IAAA,CAAK,CAAC,GAAA,KAAQ;AAC7B,IAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,IAAA,OAAO,MAAA,KAAW,IAAA,IAAQ,MAAA,CAAO,UAAA,CAAW,OAAO,GAAG,CAAA;AAAA,EACxD,CAAC,CAAA;AACH;AA0BA,eAAsB,gBAAA,CACpB,UACA,IAAA,EACwB;AACxB,EAAA,MAAM,SAAA,GAAY,IAAA,EAAM,SAAA,IAAa,kBAAA,EAAmB;AACxD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,qBAAA;AAC/B,EAAA,IAAI,GAAA,GAAM,QAAQ,QAAQ,CAAA;AAI1B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,EAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA;AACvC,IAAA,IAAI,qBAAA,CAAsB,SAAA,EAAW,SAAS,CAAA,EAAG;AAC/C,MAAA,OAAA,CAAQ,KAAK,SAAS,CAAA;AAAA,IACxB,CAAA,MAAO;AACL,MAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,QAClB,QAAQ,SAAS,CAAA,CAAA;AAAA,QACjB,YAAA,CAAa,MAAM,IAAA,CAAK,SAAS,GAAG,WAAA,EAAY;AAAA,QAChD;AAAA,OACF;AACA,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,SAAS,SAAS,CAAA;AACtD,QAAA,OAAO,SAAA;AAAA,MACT;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA;AAChC,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,SAAS,SAAS,CAAA;AACtD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAA,CAAY,SAAmB,SAAA,EAA2B;AACjE,EAAA,GAAA,EAAI,CAAE,IAAA;AAAA,IACJ,gIAAA;AAAA,IACA,EAAE,SAAS,SAAA;AAAU,GACvB;AACF;AAsBA,eAAsB,kBAAA,CACpB,OACA,OAAA,EAC+C;AAC/C,EAAA,MAAM,EAAE,UAAA,EAAY,SAAA,EAAW,OAAA,EAAQ,GAAI,OAAA;AAE3C,EAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAO,CAAA,cAAA,EAAiB,KAAA,CAAM,IAAI,CAAA,4BAAA,CAAA,EAA0B;AAAA,EACvF;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,EAAY,KAAA,CAAM,WAAW,CAAA;AACrD,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,UAAA,EAAY,UAAU,CAAA;AAE/C,EAAA,MAAM,aAAa,MAAM,iBAAA;AAAA,IACvB,QAAQ,WAAW,CAAA,CAAA;AAAA,IACnB,YAAY;AACV,MAAA,MAAM,KAAK,WAAW,CAAA;AACtB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,sBAAA,EAAyB,WAAW,CAAA,CAAA,EAAG;AAAA,EACzE;AAEA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,EAAW,KAAA,CAAM,IAAI,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,cAAA,CAAe,CAAA,MAAA,EAAS,OAAO,CAAA,CAAA,EAAI,MAAM,KAAA,CAAM,OAAA,EAAS,EAAE,SAAA,EAAW,IAAA,EAAM,CAAC,CAAA;AAGlF,IAAA,MAAM,cAAA;AAAA,MACJ,CAAA,GAAA,EAAM,UAAU,CAAA,IAAA,EAAO,OAAO,CAAA,CAAA;AAAA,MAC9B,MAAM,EAAA,CAAG,UAAA,EAAY,SAAS,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,MACjD,cAAa,GAAI;AAAA,KACnB;AAIA,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAC9C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAM,cAAA;AAAA,QAAe,SAAS,WAAW,CAAA,CAAA;AAAA,QAAI,MAC3C,UAAU,WAAA,EAAa,CAAA;;AAAA,EAA2B,OAAO;AAAA,CAAA,EAAM,MAAM;AAAA,OACvE;AAAA,IACF,CAAA,MAAO;AAIL,MAAA,MAAM,cAAA,CAAe,CAAA,GAAA,EAAM,WAAW,CAAA,CAAA,EAAI,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,IAClF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAA,EAAE;AAAA,EACnF;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAWA,eAAsB,oBAAA,CAAqB,MAAc,SAAA,EAAqC;AAC5F,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,EAAW,IAAI,CAAA;AACpC,EAAA,MAAM,SAAS,MAAM,iBAAA;AAAA,IACnB,QAAQ,OAAO,CAAA,CAAA;AAAA,IACf,YAAY;AACV,MAAA,MAAM,KAAK,OAAO,CAAA;AAClB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,cAAA;AAAA,IACJ,SAAS,OAAO,CAAA,CAAA;AAAA,IAChB,MAAM,GAAG,OAAA,EAAS,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IAClD,cAAa,GAAI;AAAA,GACnB;AACA,EAAA,OAAO,IAAA;AACT;AAcA,eAAsB,SAAA,CACpB,SACA,OAAA,EACuB;AACvB,EAAA,MAAM,MAAA,GAAuB,EAAE,QAAA,EAAU,EAAC,EAAG,SAAS,EAAC,EAAG,MAAA,EAAQ,EAAC,EAAE;AAErE,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,MAAA,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,EAAE,CAAA;AAC5B,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,CAAA,GAAI,MAAM,kBAAA,CAAmB,KAAA,EAAO,OAAO,CAAA;AACjD,IAAA,IAAI,EAAE,OAAA,EAAS;AACb,MAAA,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,KAAA,CAAM,EAAE,CAAA;AAAA,IAC/B,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,EAAG,KAAA,CAAM,EAAE,CAAA,EAAA,EAAK,CAAA,CAAE,KAAK,CAAA,CAAE,CAAA;AAAA,IAC9C;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAeO,SAAS,iBAAA,CACd,MACA,UAAA,EAC2F;AAC3F,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAkC;AAC3D,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI,EAAE,IAAA,KAAS,OAAA,eAAsB,GAAA,CAAI,CAAA,CAAE,MAAM,CAAC,CAAA;AAAA,EACpD;AAEA,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,MAAM,WAAmC,EAAC;AAC1C,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,eAAA,IAAmB,EAAC,EAAG;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACnC,IAAA,IAAI,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA;AAAA,SACzB,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EACxB;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,eAAA,IAAmB,EAAC,EAAG;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACnC,IAAA,IAAI,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA;AAAA,EAEhC;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAU,OAAA,EAAQ;AACvC","file":"chunk-LEOXPIC6.js","sourcesContent":["/**\n * Platform-triggered asset deployment.\n *\n * Takes catalog entries (with source_path relative to ai-assets/) and deploys\n * them to a session's .claude/skills/ directory. Handles skill context injection\n * and catalog priority-based name resolution.\n */\n\nimport { cp, mkdir, rm, stat, writeFile } from \"node:fs/promises\";\nimport { join, resolve, sep } from \"node:path\";\nimport { fsDeadlineMs, tryWithFsDeadline, withFsDeadline } from \"@skaile/workspaces/core\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\n\n// ---------------------------------------------------------------------------\n// Types (formerly in catalog-compiler.ts, inlined after tear-out in Task 1.5)\n// ---------------------------------------------------------------------------\n\n/**\n * A single user-facing input parameter declared in a SKILL.md.\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface InputSpec {\n  /** Input parameter key used in skill invocation. */\n  key: string;\n  /** Whether the input must be provided before running the skill. */\n  required?: boolean;\n  /** Question string shown to the user when collecting this input. */\n  prompt?: string;\n  /** Short display label for UI forms. */\n  label?: string;\n  /** Input data type hint (e.g. `\"string\"`, `\"number\"`, `\"file\"`). */\n  type?: string;\n  /** Additional guidance text shown alongside the input field. */\n  hint?: string;\n}\n\n/**\n * A compiled catalog entry (skill or flow).\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface CatalogEntryCompiled {\n  /** Unique ID in `publisher/name` form (e.g. `skaileup/cf_overview`). */\n  id: string;\n  /** Asset kind. */\n  kind: \"skill\" | \"flow\";\n  /** Human-readable asset name. */\n  name: string;\n  /** One-line description. */\n  description: string;\n  /** Semantic version string. */\n  version: string;\n  /** Maturity stage. */\n  stage: \"alpha\" | \"beta\" | \"stable\";\n  /** Searchable keywords. */\n  keywords: string[];\n  /** User-facing input specifications. */\n  inputs: InputSpec[];\n  /** Asset path relative to assetsRoot. */\n  source_path: string;\n  /** Optional icon identifier. */\n  icon?: string;\n  /** Flow-only: required skill names. */\n  required_skills?: string[];\n  /** Flow-only: optional skill names. */\n  optional_skills?: string[];\n}\n\n/**\n * Options controlling how platform-triggered skill deployment is performed.\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface DeployFromCatalogOptions {\n  /** Root directory of ai-assets (where `source_path` in catalog entries is relative to). */\n  assetsRoot: string;\n  /** Target directory for deployed skills (e.g. `/workspace/.claude/skills/`). */\n  skillsDir: string;\n  /** Optional context markdown appended to the deployed skill directory as `CONTEXT.md`. */\n  context?: string;\n}\n\n/**\n * Result of a platform-triggered batch skill deployment.\n *\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport interface DeployResult {\n  /** IDs of catalog entries successfully deployed. */\n  deployed: string[];\n  /** IDs of catalog entries skipped (non-skill kinds). */\n  skipped: string[];\n  /** Error messages for entries that could not be deployed. */\n  errors: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Workspace-mount awareness\n// ---------------------------------------------------------------------------\n\n/**\n * Multiplier applied to the base filesystem deadline for whole-tree operations\n * (recursive copy / remove), which legitimately outlast a single `stat`.\n */\nconst TREE_OP_DEADLINE_FACTOR = 4;\n\n/** Default number of parent levels {@link findAiAssetsRoot} inspects. */\nconst AI_ASSETS_WALK_LEVELS = 6;\n\nlet deployerLogger: ReturnType<typeof createLogger> | undefined;\n\nfunction log(): ReturnType<typeof createLogger> {\n  deployerLogger ??= createLogger({ kind: \"runner\", subkind: \"catalog-deployer\" });\n  return deployerLogger;\n}\n\n/**\n * Where the agent container binds its rclone FUSE mount. Nothing under this\n * path is a safe place to read an asset tree from: the mount is remote\n * (SharePoint / OneDrive / WebDAV) and can wedge indefinitely.\n */\nconst DEFAULT_WORKSPACE_MOUNT_DIR = \"/skaile/workspace\";\n\n/**\n * Env override for the workspace-mount path(s), comma-separated.\n *\n * Set it when the runner binds the mount somewhere other than\n * {@link DEFAULT_WORKSPACE_MOUNT_DIR}; set it to the empty string to disable\n * the guard entirely (single-machine dev, where nothing is a network mount).\n */\nexport const WORKSPACE_MOUNT_ENV_VAR = \"SKAILE_WORKSPACE_MOUNT_DIR\";\n\n/**\n * Resolve the directories treated as network mounts.\n *\n * Read per call rather than cached: the runner mutates `process.env` while\n * wiring a session, so a module-load snapshot would pin a pre-configuration\n * value.\n *\n * @returns Absolute mount paths; empty when the guard is disabled.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport function workspaceMountDirs(): string[] {\n  const raw = process.env[WORKSPACE_MOUNT_ENV_VAR];\n  if (raw === undefined) return [DEFAULT_WORKSPACE_MOUNT_DIR];\n  return raw\n    .split(\",\")\n    .map((segment) => segment.trim())\n    .filter((segment) => segment.length > 0)\n    .map((segment) => resolve(segment));\n}\n\n/**\n * Is `candidate` at, or inside, one of the known workspace mount paths?\n *\n * Pure path arithmetic — deliberately no filesystem access, because the whole\n * point is to decide *before* touching a path that might be unresponsive.\n *\n * @param candidate - Path to test.\n * @param mountDirs - Mount roots; defaults to {@link workspaceMountDirs}.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport function isUnderWorkspaceMount(\n  candidate: string,\n  mountDirs: string[] = workspaceMountDirs(),\n): boolean {\n  const target = resolve(candidate);\n  return mountDirs.some((dir) => {\n    const root = resolve(dir);\n    return target === root || target.startsWith(root + sep);\n  });\n}\n\n/**\n * Walk upward from `startDir` looking for an `ai-assets/` directory.\n *\n * Two properties matter beyond \"find the folder\":\n *\n * 1. **Never synchronous.** The walk probes up to six directories; any one of\n *    them can be on a FUSE mount, and the former `existsSync` chain blocked the\n *    event loop on the first unresponsive probe. Each probe is now awaited and\n *    deadline-bounded, so a wedged mount costs one skipped candidate.\n * 2. **Never resolves onto a mount.** A hit under the workspace mount is\n *    skipped with a warning rather than returned: accepting it would wire every\n *    later skill deploy — a recursive copy — to a remote filesystem. The walk\n *    continues upward, so a legitimate `ai-assets/` in a parent still wins.\n *\n * Only a **directory** counts. An `ai-assets` file would otherwise be returned\n * as a root and every later `join(root, source_path)` would fail with ENOTDIR.\n *\n * @param startDir - Directory to start from (typically the project dir).\n * @param opts - `levels` caps the upward walk; `mountDirs` overrides the mount\n *   roots (defaults to {@link workspaceMountDirs}).\n * @returns Absolute path to the `ai-assets/` directory, or `null` if none is\n *   reachable within `levels`.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function findAiAssetsRoot(\n  startDir: string,\n  opts?: { levels?: number; mountDirs?: string[] },\n): Promise<string | null> {\n  const mountDirs = opts?.mountDirs ?? workspaceMountDirs();\n  const levels = opts?.levels ?? AI_ASSETS_WALK_LEVELS;\n  let dir = resolve(startDir);\n  // Every level of a `/skaile/workspace/...` start dir is under the mount, so\n  // an unconditional warn would fire once per level for one lookup. Collect and\n  // report once — the operator needs the fact, not six copies of it.\n  const refused: string[] = [];\n\n  for (let i = 0; i < levels; i++) {\n    const candidate = join(dir, \"ai-assets\");\n    if (isUnderWorkspaceMount(candidate, mountDirs)) {\n      refused.push(candidate);\n    } else {\n      const isDir = await tryWithFsDeadline(\n        `stat ${candidate}`,\n        async () => (await stat(candidate)).isDirectory(),\n        false,\n      );\n      if (isDir) {\n        if (refused.length > 0) warnRefused(refused, mountDirs);\n        return candidate;\n      }\n    }\n    const parent = resolve(dir, \"..\");\n    if (parent === dir) break; // filesystem root — nothing further up\n    dir = parent;\n  }\n  if (refused.length > 0) warnRefused(refused, mountDirs);\n  return null;\n}\n\n/** Single warning for every `ai-assets` candidate skipped for sitting on a mount. */\nfunction warnRefused(refused: string[], mountDirs: string[]): void {\n  log().warn(\n    \"findAiAssetsRoot refused candidates under a workspace mount — deploying skills from a network mount can stall the session\",\n    { refused, mountDirs },\n  );\n}\n\n/**\n * Deploy a single catalog entry to the session skills directory.\n *\n * Copies the entire skill source directory into `skillsDir/<entry.name>/`.\n * If `context` is provided, a separate `CONTEXT.md` is written alongside\n * `SKILL.md` so the source file is never modified.\n *\n * Only `skill` entries are deployable; other kinds return an error.\n *\n * **Async by necessity.** This runs from the `session_init` command handler\n * with the WebSocket live, and both `assetsRoot` and `skillsDir` can sit on a\n * network mount. The former `cpSync`/`rmSync` pair parked the event loop for\n * the whole copy; every call is now awaited and deadline-bounded, so an\n * unresponsive mount fails one deployment instead of the session.\n *\n * @param entry - Compiled catalog entry to deploy.\n * @param options - Deployment target and optional context.\n * @returns `{ success: true }` on success, `{ success: false, error }` on failure.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function deployCatalogEntry(\n  entry: CatalogEntryCompiled,\n  options: DeployFromCatalogOptions,\n): Promise<{ success: boolean; error?: string }> {\n  const { assetsRoot, skillsDir, context } = options;\n\n  if (entry.kind !== \"skill\") {\n    return { success: false, error: `Cannot deploy ${entry.kind} directly — only skills` };\n  }\n\n  const sourcePath = join(assetsRoot, entry.source_path);\n  const skillMdPath = join(sourcePath, \"SKILL.md\");\n\n  const hasSkillMd = await tryWithFsDeadline(\n    `stat ${skillMdPath}`,\n    async () => {\n      await stat(skillMdPath);\n      return true;\n    },\n    false,\n  );\n  if (!hasSkillMd) {\n    return { success: false, error: `SKILL.md not found at ${skillMdPath}` };\n  }\n\n  const destDir = join(skillsDir, entry.name);\n\n  try {\n    await withFsDeadline(`mkdir ${destDir}`, () => mkdir(destDir, { recursive: true }));\n\n    // Copy the entire skill directory\n    await withFsDeadline(\n      `cp ${sourcePath} -> ${destDir}`,\n      () => cp(sourcePath, destDir, { recursive: true }),\n      fsDeadlineMs() * TREE_OP_DEADLINE_FACTOR,\n    );\n\n    // Write context to a separate CONTEXT.md — never modify the original SKILL.md.\n    // The agent discovers both files in the skill directory.\n    const contextPath = join(destDir, \"CONTEXT.md\");\n    if (context) {\n      await withFsDeadline(`write ${contextPath}`, () =>\n        writeFile(contextPath, `# Additional Context\\n\\n${context}\\n`, \"utf8\"),\n      );\n    } else {\n      // `force: true` makes this a single call: a stale CONTEXT.md is removed,\n      // an absent one is a no-op. The former existsSync probe only added a\n      // second trip to the same possibly-wedged mount.\n      await withFsDeadline(`rm ${contextPath}`, () => rm(contextPath, { force: true }));\n    }\n  } catch (err) {\n    return { success: false, error: err instanceof Error ? err.message : String(err) };\n  }\n\n  return { success: true };\n}\n\n/**\n * Remove a deployed skill directory from the session skills directory.\n *\n * @param name - Skill name (directory basename under `skillsDir`).\n * @param skillsDir - Absolute path to the session skills directory.\n * @returns `true` if the skill was found and removed; `false` if it was not\n *   deployed, or if the directory could not be reached within the deadline.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function undeployCatalogEntry(name: string, skillsDir: string): Promise<boolean> {\n  const destDir = join(skillsDir, name);\n  const exists = await tryWithFsDeadline(\n    `stat ${destDir}`,\n    async () => {\n      await stat(destDir);\n      return true;\n    },\n    false,\n  );\n  if (!exists) return false;\n  await withFsDeadline(\n    `rm -r ${destDir}`,\n    () => rm(destDir, { recursive: true, force: true }),\n    fsDeadlineMs() * TREE_OP_DEADLINE_FACTOR,\n  );\n  return true;\n}\n\n/**\n * Deploy multiple catalog entries in a single batch operation.\n *\n * Non-skill entries (flows, agents, etc.) are automatically skipped and\n * recorded in `result.skipped`. Deployment failures are collected in\n * `result.errors` without aborting the rest of the batch.\n *\n * @param entries - Compiled catalog entries to deploy.\n * @param options - Deployment target and optional context.\n * @returns Aggregated {@link DeployResult} with deployed, skipped, and error lists.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport async function deployAll(\n  entries: CatalogEntryCompiled[],\n  options: DeployFromCatalogOptions,\n): Promise<DeployResult> {\n  const result: DeployResult = { deployed: [], skipped: [], errors: [] };\n\n  for (const entry of entries) {\n    if (entry.kind !== \"skill\") {\n      result.skipped.push(entry.id);\n      continue;\n    }\n\n    // Serial on purpose: concurrent recursive copies onto one mount multiply\n    // the queue depth on the exact resource that is already the bottleneck.\n    const r = await deployCatalogEntry(entry, options);\n    if (r.success) {\n      result.deployed.push(entry.id);\n    } else {\n      result.errors.push(`${entry.id}: ${r.error}`);\n    }\n  }\n\n  return result;\n}\n\n/**\n * Resolve a flow's skill dependencies from the full catalog entry list.\n *\n * Partitions `flow.required_skills` and `flow.optional_skills` into resolved\n * entries and a list of names that could not be found. Missing optional skills\n * are silently ignored (they do not appear in `missing`).\n *\n * @param flow - Compiled flow entry whose skill dependencies should be resolved.\n * @param allEntries - Full set of compiled catalog entries to search.\n * @returns Object containing resolved `required` entries, resolved `optional` entries,\n *   and `missing` skill names that were listed as required but not found.\n * @docLink packages/asset-manager/concepts#catalog-deployer\n */\nexport function resolveFlowSkills(\n  flow: CatalogEntryCompiled,\n  allEntries: CatalogEntryCompiled[],\n): { required: CatalogEntryCompiled[]; optional: CatalogEntryCompiled[]; missing: string[] } {\n  const skillsByName = new Map<string, CatalogEntryCompiled>();\n  for (const e of allEntries) {\n    if (e.kind === \"skill\") skillsByName.set(e.name, e);\n  }\n\n  const required: CatalogEntryCompiled[] = [];\n  const optional: CatalogEntryCompiled[] = [];\n  const missing: string[] = [];\n\n  for (const name of flow.required_skills ?? []) {\n    const entry = skillsByName.get(name);\n    if (entry) required.push(entry);\n    else missing.push(name);\n  }\n\n  for (const name of flow.optional_skills ?? []) {\n    const entry = skillsByName.get(name);\n    if (entry) optional.push(entry);\n    // Optional skills don't count as missing\n  }\n\n  return { required, optional, missing };\n}\n"]}

package/dist/{chunk-57SF6W6E.js → chunk-MGM5EJQQ.js}

@@ -685,7 +685,7 @@ var McpServerManifestSchema = z2.looseObject({
     url: z2.string().url().refine((u) => u.startsWith("https://"), { message: "payload url must be https" }),
     sha256: z2.string().regex(/^[a-f0-9]{64}$/),
     // Plain filename, no path separators — schema-level guard against a traversal dest.
-    dest: z2.string().regex(/^[^/\\]+$/, { message: "dest must be a plain filename, not a path" }).optional()
+    dest: z2.string().regex(/^[^/\\]+$/, { message: "dest must be a plain filename, not a path" }).refine((d) => d !== "." && d !== "..", { message: "dest must be a plain filename" }).optional()
   }).optional()
 });
 function validateMcpServer(data) {
@@ -799,5 +799,5 @@ function validateRuleset(data) {
 }
 
 export { AGENT_BODY_PLACEHOLDER, ANTHROPIC_FIRST_PARTY_HOSTS, ANTHROPIC_FULL_ID_PATTERN, ANTHROPIC_MODEL_ALIASES, ANTHROPIC_MODEL_FAMILIES, AgentBindingValues, AgentCapabilityRequirementSchema, AgentComposeItemSchema, AgentIoSchema, AgentLifecycleSchema, AgentLifecycleValues, AgentManifestSchema, AgentMemorySchema, AgentToolsSchema, AgentTriggerSchema, ArtifactRefSchema, BEDROCK_MODEL_ID_PATTERN, BaseFrontmatterSchema, BindingSchema, BindingValues, CONTRACT_BODY_PLACEHOLDER, CommonMetadataSchema, ConnectorManifestSchema, ContentBindingValues, ContractManifestSchema, FieldSchema, FilePrerequisiteSchema, FreeFormModelIdSchema, McpServerManifestSchema, MemoryBlockSchema, MemoryScopeSchema, MemoryScopeValues, ModelIdSchema, ModelSelectorSchema, PRESET_DESCRIPTION_PLACEHOLDER, PRESET_ITEM_PLACEHOLDER_REF, PROMPT_BODY_PLACEHOLDER, PersonaManifestSchema, PlaceholderSchema, PlaceholderTypeSchema, PresetItemSchema, PresetManifestSchema, PresetSourceSchema, PromptManifestSchema, RulesetManifestSchema, SKILL_BODY_PLACEHOLDER, SKILL_DESCRIPTION_PLACEHOLDER, SKILL_DESCRIPTION_PLACEHOLDER_PREFIX, SLOT_ID_PATTERN, SLOT_ID_REQUIRED_KINDS, SkillManifestSchema, UserInputSchema, VERTEX_MODEL_ID_PATTERN, agentDeprecationDiagnostics, composeRefTarget, composeSlotDiagnostics, conventionItems, cronProblem, effectiveComposes, isFirstPartyAnthropicEndpoint, modelIdSchemaForCloud, modelIdSchemaForTarget, normalizeAnthropicModel, requiresAnthropicModelId, validateAgent, validateConnector, validateContract, validateManifest, validateMcpServer, validatePersona, validatePreset, validatePrompt, validateRuleset, validateSkill };
-//# sourceMappingURL=chunk-57SF6W6E.js.map
-//# sourceMappingURL=chunk-57SF6W6E.js.map
+//# sourceMappingURL=chunk-MGM5EJQQ.js.map
+//# sourceMappingURL=chunk-MGM5EJQQ.js.map

package/dist/chunk-MGM5EJQQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../types/src/manifests/_shared.ts","../types/src/manifests/agent-composition.ts","../types/src/manifests/cron.ts","../types/src/manifests/agent.ts","../types/src/manifests/connector.ts","../types/src/manifests/skill.ts","../types/src/manifests/contract.ts","../types/src/manifests/mcp-server.ts","../types/src/manifests/prompt.ts","../types/src/manifests/persona.ts","../types/src/manifests/preset.ts","../types/src/manifests/ruleset.ts"],"names":["z","z3","z4","z5","z6","z7","z8","z9","z10"],"mappings":";;;AAWO,IAAM,oBAAsBA,EAAA,CAAA,MAAA,CAAO;AAAA,EACxC,EAAA,EAAMA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACpB,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,MAAQA,EAAA,CAAA,IAAA,CAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC;AAGM,IAAM,yBAA2BA,EAAA,CAAA,MAAA,CAAO;AAAA,EAC7C,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,MAAQA,EAAA,CAAA,IAAA,CAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAC1B,CAAC;AAGM,IAAM,kBAAoBA,EAAA,CAAA,WAAA,CAAY;AAAA,EAC3C,KAAOA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAChC,IAAMA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAC/B,KAAA,EAASA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,MAAA,EAAUA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,QAAA,EAAYA,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAWA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACtC,MAAA,EAAUA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,KAAA,CAAM,CAAGA,EAAA,CAAA,MAAA,EAAO,EAAKA,EAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC5D,OAAA,EACGA,SAAM,CAAGA,EAAA,CAAA,MAAA,IAAYA,EAAA,CAAA,MAAA,EAAO,EAAKA,YAAQ,EAAKA,EAAA,CAAA,KAAA,CAAQA,SAAM,CAAGA,EAAA,CAAA,MAAA,IAAYA,EAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAC,CAAC,CAAA,CACvF,QAAA,EAAS;AAAA,EACZ,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACnB,CAAC;AAGM,IAAM,cAAgBA,EAAA,CAAA,MAAA,CAAO;AAAA,EAClC,GAAA,EAAOA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,KAAA,EAASA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,QAAA,EAAYA,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,SAAA,EAAaA,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAChC,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,OAAA,EAAWA,EAAA,CAAA,KAAA,CAAM,CAAGA,EAAA,CAAA,MAAA,EAAO,EAAKA,EAAA,CAAA,MAAA,EAAO,EAAKA,EAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA;AAC1D,CAAC;AAMM,IAAM,uBAAyBA,EAAA,CAAA,WAAA,CAAY;AAAA,EAChD,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAUA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAQA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,KAAA,EAASA,QAAK,CAAC,OAAA,EAAS,QAAQ,QAAA,EAAU,YAAY,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAClE,MAAA,EAAUA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,aAAA,EAAiBA,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA;AAC7B,CAAC;AAUM,IAAM,wBAA0BA,EAAA,CAAA,MAAA,CAAO;AAAA,EAC5C,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAG7B,SAAA,EAAaA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,QAAA,EAAYA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA;AAChC,CAAC;AAkBM,SAAS,gBAAA,CACd,QACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA;AACpC,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,OAAO,IAAA,EAAK;AAAA,EACvC;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,QAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,MAC1C,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAAA,MACzB,SAAS,KAAA,CAAM;AAAA,KACjB,CAAE;AAAA,GACJ;AACF;;;AC9FA,IAAM,gBAAA,GAID;AAAA,EACH,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,MAAA,EAAQ,SAAS,iBAAA,EAAkB;AAAA,EAC5D,EAAE,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,SAAA,EAAW,SAAS,aAAA,EAAc;AAAA,EAC5D,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,QAAA,EAAU,SAAS,aAAA;AAChD,CAAA;AAEA,IAAM,aAAA,GAAgB,WAAA;AAEtB,IAAM,aAAA,GAAgB,CAAC,GAAA,KAAwB,GAAA,CAAI,OAAA,CAAQ,SAAS,EAAE,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAYnF,SAAS,gBAAgB,OAAA,EAA+C;AAC7E,EAAA,MAAM,UAAU,CAAC,GAAG,OAAO,CAAA,CAAE,IAAI,aAAa,CAAA;AAC9C,EAAA,MAAM,QAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,EAAE,IAAA,EAAM,IAAA,EAAM,OAAA,MAAa,gBAAA,EAAkB;AACtD,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,GAAA,EAAK,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,EAAI,SAAS,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,aAAA,IAAiB,CAAA,CAAE,UAAA,CAAW,CAAA,EAAG,aAAa,CAAA,CAAA,CAAG,CAAC,CAAA,EAAG;AACjF,IAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,GAAA,EAAK,KAAK,aAAa,CAAA,CAAA,EAAI,OAAA,EAAS,cAAA,EAAgB,CAAA;AAAA,EACtF;AACA,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,iBAAA,CACd,UACA,OAAA,EACoB;AACpB,EAAA,MAAM,QAAA,GAAW,YAAY,EAAC;AAC9B,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAmC,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,EAAK,aAAA,CAAc,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AACxF,EAAA,MAAM,eAAe,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAC,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,OAAO,CAAA,CAAE,MAAA,CAAO,CAAC,IAAA,KAAS,CAAC,YAAA,CAAa,GAAA,CAAI,GAAA,CAAI,IAAI,CAAC,CAAC,CAAA;AACvF,EAAA,OAAO,CAAC,GAAG,QAAA,EAAU,GAAG,QAAQ,CAAA;AAClC;AAMA,IAAM,oBAAA,GAA8E;AAAA,EAClF,EAAE,KAAA,EAAO,QAAA,EAAU,WAAA,EAAa,kCAAA,EAAmC;AAAA,EACnE,EAAE,KAAA,EAAO,WAAA,EAAa,WAAA,EAAa,kCAAA,EAAmC;AAAA,EACtE,EAAE,KAAA,EAAO,WAAA,EAAa,WAAA,EAAa,qCAAA,EAAsC;AAAA,EACzE,EAAE,KAAA,EAAO,SAAA,EAAW,WAAA,EAAa,+CAAA,EAAgD;AAAA,EACjF,EAAE,KAAA,EAAO,OAAA,EAAS,WAAA,EAAa,gDAAA,EAAiD;AAAA,EAChF,EAAE,KAAA,EAAO,WAAA,EAAa,WAAA,EAAa,oDAAA,EAAqD;AAAA,EACxF,EAAE,KAAA,EAAO,UAAA,EAAY,WAAA,EAAa,qDAAA,EAAsD;AAAA,EACxF,EAAE,KAAA,EAAO,cAAA,EAAgB,WAAA,EAAa,2BAAA;AACxC,CAAA;AAEA,IAAM,mBAAA,GAA6E;AAAA,EACjF,EAAE,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAa,+CAAA,EAAgD;AAAA,EAC9E,EAAE,KAAA,EAAO,cAAA,EAAgB,WAAA,EAAa,wCAAA,EAAyC;AAAA,EAC/E,EAAE,KAAA,EAAO,WAAA,EAAa,WAAA,EAAa,qDAAA,EAAsD;AAAA,EACzF,EAAE,KAAA,EAAO,OAAA,EAAS,WAAA,EAAa,sCAAA;AACjC,CAAA;AAQO,SAAS,4BAA4B,MAAA,EAA4C;AACtF,EAAA,IAAI,WAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,SAAiB,EAAC;AAC3D,EAAA,MAAM,QAAA,GAAW,MAAA;AACjB,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,EAAE,KAAA,EAAO,WAAA,EAAY,IAAK,oBAAA,EAAsB;AACzD,IAAA,IAAI,QAAA,CAAS,KAAK,CAAA,KAAM,MAAA,EAAW;AACnC,IAAA,GAAA,CAAI,IAAA,CAAK;AAAA,MACP,IAAA,EAAM,oBAAoB,KAAK,CAAA,CAAA;AAAA,MAC/B,QAAA,EAAU,SAAA;AAAA,MACV,OAAA,EAAS,CAAA,kBAAA,EAAqB,KAAK,CAAA,wCAAA,EAA2C,WAAW,CAAA,CAAA;AAAA,MACzF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,WAAW,QAAA,CAAS,QAAA;AAC1B,EAAA,IAAI,QAAA,KAAa,IAAA,IAAQ,OAAO,QAAA,KAAa,QAAA,EAAU;AACrD,IAAA,KAAA,MAAW,EAAE,KAAA,EAAO,WAAA,EAAY,IAAK,mBAAA,EAAqB;AACxD,MAAA,IAAK,QAAA,CAAqC,KAAK,CAAA,KAAM,MAAA,EAAW;AAChE,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,IAAA,EAAM,6BAA6B,KAAK,CAAA,CAAA;AAAA,QACxC,QAAA,EAAU,SAAA;AAAA,QACV,OAAA,EAAS,CAAA,2BAAA,EAA8B,KAAK,CAAA,wCAAA,EAA2C,WAAW,CAAA,CAAA;AAAA,QAClG,IAAA,EAAM,YAAY,KAAK,CAAA;AAAA,OACxB,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAUO,SAAS,uBAAuB,MAAA,EAA4C;AACjF,EAAA,IAAI,WAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,SAAiB,EAAC;AAC3D,EAAA,MAAM,WAAY,MAAA,CAAmC,QAAA;AACrD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,SAAU,EAAC;AACtC,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAoB;AAC1C,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,IAAA,EAAM,CAAA,KAAM;AAC5B,IAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AAC/C,IAAA,MAAM,KAAM,IAAA,CAAiC,EAAA;AAC7C,IAAA,IAAI,OAAO,OAAO,QAAA,EAAU;AAC5B,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AAC9B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,SAAA,CAAU,GAAA,CAAI,IAAI,CAAC,CAAA;AACnB,MAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,IAAA,CAAK;AAAA,MACP,IAAA,EAAM,sBAAA;AAAA,MACN,QAAA,EAAU,OAAA;AAAA,MACV,OAAA,EAAS,CAAA,kBAAA,EAAqB,EAAE,CAAA,8BAAA,EAAiC,KAAK,CAAA,CAAA,CAAA;AAAA,MACtE,IAAA,EAAM,YAAY,CAAC,CAAA,IAAA;AAAA,KACpB,CAAA;AAAA,EACH,CAAC,CAAA;AACD,EAAA,OAAO,GAAA;AACT;AAiBO,SAAS,iBAAiB,IAAA,EAGA;AAC/B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,IAAA,EAAK;AAC1B,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,GAAA,EAAI;AAClF,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,MAAA;AAChC,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,KAAA,IAAS,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAG,KAAK,CAAA,CAAE,IAAA,EAAK,GAAI,IAAA,CAAK,IAAA;AAC5D,EAAA,IAAI,IAAA,GAAA,CAAQ,SAAS,CAAA,GAAI,GAAA,CAAI,MAAM,KAAA,GAAQ,CAAC,CAAA,GAAI,GAAA,EAAK,IAAA,EAAK;AAC1D,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,EAAA,IAAI,GAAA,IAAO,GAAG,IAAA,GAAO,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AAC7C,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AACxB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC9B,IAAA,IAAI,KAAA,GAAQ,GAAG,OAAO,MAAA;AACtB,IAAA,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AAC/B,IAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,EAAE,IAAA,EAAK;AAAA,EACpC;AACA,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,MAAM,IAAA,GAAO,MAAM,CAAA,GAAI,IAAA,CAAK,MAAM,CAAA,EAAG,EAAE,CAAA,CAAE,IAAA,EAAK,GAAI,IAAA;AAClD,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM,OAAO,MAAA;AAC3B,EAAA,OAAO,EAAE,MAAM,OAAA,EAAS,IAAA,EAAM,SAAS,KAAA,GAAQ,YAAA,GAAe,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU;AACtF;;;ACjMA,IAAM,WAAA,GAAc;AAAA,EAClB,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,SAAA,GAAY,CAAC,KAAA,EAAO,KAAA,EAAO,OAAO,KAAA,EAAO,KAAA,EAAO,OAAO,KAAK,CAAA;AAGlE,IAAM,WAAA,GAAoC;AAAA,EACxC,SAAA,EAAW,IAAA;AAAA,EACX,WAAA,EAAa,IAAA;AAAA,EACb,UAAA,EAAY,IAAA;AAAA,EACZ,SAAA,EAAW,IAAA;AAAA,EACX,QAAA,EAAU,IAAA;AAAA,EACV,WAAA,EAAa,IAAA;AAAA,EACb,SAAA,EAAW;AACb,CAAA;AAYA,IAAM,WAAA,GAAoC;AAAA,EACxC,EAAE,IAAA,EAAM,QAAA,EAAU,GAAA,EAAK,CAAA,EAAG,KAAK,EAAA,EAAG;AAAA,EAClC,EAAE,IAAA,EAAM,MAAA,EAAQ,GAAA,EAAK,CAAA,EAAG,KAAK,EAAA,EAAG;AAAA,EAChC,EAAE,IAAA,EAAM,cAAA,EAAgB,GAAA,EAAK,CAAA,EAAG,KAAK,EAAA,EAAG;AAAA,EACxC,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,CAAA,EAAG,KAAK,EAAA,EAAI,KAAA,EAAO,WAAA,EAAa,QAAA,EAAU,CAAA,EAAE;AAAA;AAAA,EAElE,EAAE,IAAA,EAAM,aAAA,EAAe,GAAA,EAAK,CAAA,EAAG,KAAK,CAAA,EAAG,KAAA,EAAO,SAAA,EAAW,QAAA,EAAU,CAAA;AACrE,CAAA;AAEA,SAAS,UAAA,CAAW,OAAe,KAAA,EAAsC;AACvE,EAAA,IAAI,QAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,OAAO,KAAK,CAAA;AAC5C,EAAA,MAAM,MAAM,KAAA,CAAM,KAAA,EAAO,QAAQ,KAAA,CAAM,WAAA,EAAa,CAAA,IAAK,EAAA;AACzD,EAAA,OAAO,GAAA,IAAO,CAAA,GAAI,GAAA,IAAO,KAAA,CAAM,YAAY,CAAA,CAAA,GAAK,MAAA;AAClD;AAEA,SAAS,YAAA,CAAa,MAAc,KAAA,EAAsC;AACxE,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAG;AAClC,IAAA,MAAM,CAAC,KAAA,EAAO,IAAA,EAAM,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC3C,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,EAAA,IAAM,UAAU,MAAA,EAAW;AAC9D,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,IAAI,CAAA,cAAA,CAAA;AAAA,IAC/B;AACA,IAAA,IAAI,IAAA,KAAS,MAAA,IAAa,EAAE,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,IAAK,MAAA,CAAO,IAAI,CAAA,GAAI,CAAA,CAAA,EAAI;AACnE,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,OAAA,EAAU,IAAI,CAAA,4BAAA,CAAA;AAAA,IACpC;AACA,IAAA,IAAI,UAAU,GAAA,EAAK;AACnB,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC5B,IAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG,OAAO,GAAG,KAAA,CAAM,IAAI,KAAK,IAAI,CAAA,cAAA,CAAA;AAClD,IAAA,MAAM,MAAA,GAAS,KAAK,GAAA,CAAI,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,KAAK,CAAC,CAAA;AACnD,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,MAAA,IAAI,MAAM,MAAA,IAAa,CAAA,GAAI,MAAM,GAAA,IAAO,CAAA,GAAI,MAAM,GAAA,EAAK;AACrD,QAAA,OAAO,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,IAAA,CAAK,CAAC,CAAC,CAAA,kBAAA,EAAqB,KAAA,CAAM,GAAG,CAAA,CAAA,EAAI,KAAA,CAAM,GAAG,CAAA,CAAA;AAAA,MAC7E;AAAA,IACF;AACA,IAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,MAAA;AACjB,IAAA,IAAI,EAAA,KAAO,MAAA,IAAa,EAAA,KAAO,MAAA,IAAa,KAAK,EAAA,EAAI;AACnD,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,QAAA,EAAW,KAAK,CAAA,gBAAA,CAAA;AAAA,IACtC;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AASO,SAAS,YAAY,IAAA,EAAkC;AAC5D,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,EAAK;AACvB,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AACxB,IAAA,OAAO,OAAO,MAAA,CAAO,WAAA,EAAa,IAAA,CAAK,WAAA,EAAa,CAAA,GAChD,MAAA,GACA,CAAA,oBAAA,EAAuB,IAAI,UAAU,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,EAC9E;AACA,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC9B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,WAAA,CAAY,MAAA,EAAQ;AACvC,IAAA,OAAO,CAAA,oEAAA,EAAuE,IAAA,KAAS,EAAA,GAAK,CAAA,GAAI,MAAM,MAAM,CAAA,CAAA;AAAA,EAC9G;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,WAAA,CAAY,QAAQ,CAAA,EAAA,EAAK;AAC3C,IAAA,MAAM,UAAU,YAAA,CAAa,KAAA,CAAM,CAAC,CAAA,EAAa,WAAA,CAAY,CAAC,CAAc,CAAA;AAC5E,IAAA,IAAI,SAAS,OAAO,OAAA;AAAA,EACtB;AACA,EAAA,OAAO,MAAA;AACT;ACvGO,IAAM,sBAAA,GAAyB;AAiB/B,IAAM,uBAAA,GAA0B,CAAC,SAAA,EAAW,MAAA,EAAQ,UAAU,OAAO;AAarE,IAAM,wBAAA,GAA2B,CAAC,MAAA,EAAQ,QAAA,EAAU,SAAS,OAAO;AAG3E,IAAM,UAAA,GAAa,wBAAA,CAAyB,IAAA,CAAK,GAAG,CAAA;AAkBpD,IAAM,mBAAA,GAAsB,CAAA,MAAA,EAAS,UAAU,CAAA,yCAAA,EAA4C,UAAU,CAAA,EAAA,CAAA;AAoB9F,IAAM,4BAA4B,IAAI,MAAA;AAAA,EAC3C,6BAA6B,mBAAmB,CAAA,aAAA;AAClD;AAmBO,IAAM,2BAA2B,IAAI,MAAA;AAAA,EAC1C,oDAAoD,mBAAmB,CAAA,kCAAA;AACzE;AASO,IAAM,uBAAA,GAA0B,IAAI,MAAA,CAAO,CAAA,QAAA,EAAW,mBAAmB,CAAA,QAAA,CAAU;AAoBnF,IAAM,gBAAkB,EAAA,CAAA,KAAA,CAAM;AAAA,EACjC,QAAK,uBAAuB,CAAA;AAAA,EAE3B,WAAO,CACP,KAAA;AAAA,IACC,yBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,EAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,wBAAwB,CAAA;AAAA,EACvC,EAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,uBAAuB;AAC1C,CAAC;AAUM,IAAM,2BAAA,GAAiD,CAAC,mBAAmB;AAkC3E,SAAS,8BAA8B,OAAA,EAA2B;AACvE,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAI,GAAA,CAAI,OAAO,CAAA,CAAE,SAAS,WAAA,EAAY;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,2BAAA,CAA4B,SAAS,IAAI,CAAA;AAClD;AAkBO,SAAS,yBAAyB,MAAA,EAAiC;AACxE,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,oBAAA,EAAsB,OAAO,KAAA;AACpD,EAAA,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,QAAA,MAAc,QAAA,EAAU,OAAO,KAAA;AACxD,EAAA,OAAO,6BAAA,CAA8B,OAAO,QAAQ,CAAA;AACtD;AAQO,IAAM,qBAAA,GACV,EAAA,CAAA,MAAA,EAAO,CACP,KAAA,CAAM,SAAS,yDAAyD;AAQpE,SAAS,uBAAuB,MAAA,EAA2C;AAChF,EAAA,OAAO,wBAAA,CAAyB,MAAM,CAAA,GACjC,aAAA,GACA,qBAAA;AACP;AAgBO,SAAS,sBAAsB,KAAA,EAAmC;AACvE,EAAA,OAAO,CAAC,KAAA,IAAS,KAAA,KAAU,SAAA,GACvB,wBAAuB,GACtB,qBAAA;AACP;AAgBO,SAAS,uBAAA,CACd,KAAA,EACA,QAAA,GAAgC,QAAA,EACxB;AACR,EAAA,IAAI,CAAC,OAAO,OAAO,QAAA;AACnB,EAAA,IAAK,uBAAA,CAA8C,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAC3E,EAAA,IAAI,yBAAA,CAA0B,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AAClD,EAAA,IAAI,wBAAA,CAAyB,KAAK,KAAK,CAAA,IAAK,wBAAwB,IAAA,CAAK,KAAK,GAAG,OAAO,KAAA;AAIxF,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,KAAA,CAAM,6BAA6B,CAAA;AAC7D,EAAA,IAAI,WAAA,EAAa,OAAO,WAAA,CAAY,CAAC,EAAG,WAAA,EAAY;AACpD,EAAA,OAAO,QAAA;AACT;AAiBO,IAAM,mBAAA,GACV,WAAO,CACP,KAAA;AAAA,EACC,OAAA;AAAA,EACA;AACF;AAEF,IAAM,oBAAsB,EAAA,CAAA,WAAA,CAAY;AAAA,EACtC,SAAA,EAAW,oBAAoB,QAAA,EAAS;AAAA,EACxC,QAAA,EAAY,EAAA,CAAA,KAAA,CAAM,mBAAmB,CAAA,CAAE,QAAA,EAAS;AAAA,EAChD,aACG,EAAA,CAAA,WAAA,CAAY;AAAA,IACX,WAAA,EAAe,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACjC,UAAA,EAAc,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,GACjC,EACA,QAAA;AACL,CAAC,CAAA;AAOM,IAAM,oBAAA,GAAuB,CAAC,cAAA,EAAgB,aAAA,EAAe,iBAAiB;AAE9E,IAAM,kBAAA,GAAqB,CAAC,UAAA,EAAY,KAAK;AAC7C,IAAM,aAAA,GAAgB,CAAC,GAAG,oBAAA,EAAsB,GAAG,kBAAkB;AACrE,IAAM,aAAA,GAAkB,QAAK,aAAa;AAI1C,IAAM,eAAA,GAAkB;AAGxB,IAAM,sBAAA,GAAyD;AAAA,EACpE,SAAA,EAAW,IAAA;AAAA,EACX,YAAA,EAAc;AAChB;AAEA,IAAM,YAAA,GACH,EAAA,CAAA,MAAA,EAAO,CACP,KAAA,CAAM,iBAAiB,kEAAkE,CAAA;AAgBrF,IAAM,yBACV,EAAA,CAAA,MAAA,CAAO;AAAA,EACN,IAAA,EAAQ,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,GAAA,EAAO,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,EAAA,EAAI,aAAa,QAAA,EAAS;AAAA,EAC1B,EAAA,EACG,WAAO,CACP,KAAA;AAAA,IACC,eAAA;AAAA,IACA;AAAA,IAED,QAAA,EAAS;AAAA,EACZ,QAAA,EAAY,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,QAAU,EAAA,CAAA,MAAA,CAAS,EAAA,CAAA,MAAA,IAAY,EAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACnD,OAAA,EAAS,cAAc,QAAA;AACzB,CAAC,CAAA,CACA,WAAA,CAAY,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC1B,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,SAAS,SAAA,EAAW;AACrD,IAAA,GAAA,CAAI,QAAA,CAAS;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,CAAC,MAAM,CAAA;AAAA,MACb,OAAA,EAAS,IAAI,IAAA,CAAK,IAAI,qCAAqC,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,QAAA,GAAW,UAAU,CAAA,qBAAA;AAAA,KAC1G,CAAA;AAAA,EACH;AACA,EAAA,IAAI,MAAA,CAAO,OAAO,sBAAA,EAAwB,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,OAAO,MAAA,EAAW;AAC7E,IAAA,GAAA,CAAI,QAAA,CAAS;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,MACX,OAAA,EAAS,CAAA,uBAAA,EAA0B,IAAA,CAAK,IAAI,CAAA,oBAAA;AAAA,KAC7C,CAAA;AAAA,EACH;AACA,EAAA,IAAI,IAAA,CAAK,YAAY,MAAA,EAAW;AAChC,EAAA,MAAM,cAAA,GAAkB,kBAAA,CAAyC,QAAA,CAAS,IAAA,CAAK,OAAO,CAAA;AACtF,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,OAAA,IAAW,CAAC,cAAA,EAAgB;AAC5C,IAAA,GAAA,CAAI,QAAA,CAAS;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,CAAC,SAAS,CAAA;AAAA,MAChB,OAAA,EAAS,CAAA,wEAAA,EAA2E,IAAA,CAAK,OAAO,CAAA,CAAA;AAAA,KACjG,CAAA;AAAA,EACH,CAAA,MAAA,IAAW,IAAA,CAAK,IAAA,KAAS,OAAA,IAAW,cAAA,EAAgB;AAClD,IAAA,GAAA,CAAI,QAAA,CAAS;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,CAAC,SAAS,CAAA;AAAA,MAChB,OAAA,EAAS,CAAA,SAAA,EAAY,IAAA,CAAK,OAAO,CAAA,gCAAA;AAAA,KAClC,CAAA;AAAA,EACH;AACF,CAAC;AA6BI,IAAM,mBAAqB,EAAA,CAAA,WAAA,CAAY;AAAA;AAAA,EAE5C,OAAA,EAAW,SAAQ,EAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAC,EAAE,QAAA,EAAS;AAAA;AAAA,EAE7C,MAAA,EAAU,SAAQ,EAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAC,EAAE,QAAA;AACrC,CAAC;AASM,IAAM,oBAAA,GAAuB,CAAC,UAAA,EAAY,MAAM;AAChD,IAAM,oBAAA,GAAyB,QAAK,oBAAoB;AAI/D,IAAM,gBAAA,GAAqB,EAAA,CAAA,MAAA,CAAS,EAAA,CAAA,MAAA,EAAO,EAAK,YAAS,CAAA;AAGlD,IAAM,gBAAkB,EAAA,CAAA,WAAA,CAAY;AAAA,EACzC,KAAA,EAAO,iBAAiB,QAAA,EAAS;AAAA,EACjC,MAAA,EAAQ,iBAAiB,QAAA;AAC3B,CAAC;AAGM,IAAM,iBAAA,GAAoB,CAAC,UAAA,EAAY,MAAA,EAAQ,WAAW;AAC1D,IAAM,iBAAA,GAAsB,QAAK,iBAAiB;AAIlD,IAAM,oBAAsB,EAAA,CAAA,WAAA,CAAY;AAAA,EAC7C,IAAA,EAAQ,EAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,iBAAiB,wCAAwC,CAAA;AAAA,EAChF,KAAA,EAAO,iBAAA;AAAA,EACP,SAAA,EAAa,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA;AAAA,EAErC,QAAU,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA;AAC5B,CAAC;AAIM,IAAM,oBAAsB,EAAA,CAAA,WAAA,CAAY;AAAA,EAC7C,MAAA,EAAU,EAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAE5C,eACG,EAAA,CAAA,WAAA,CAAY;AAAA,IACX,QAAA,EAAY,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,IAC1B,WAAa,EAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,GAAW,QAAA;AAAS,GACjD,EACA,QAAA;AACL,CAAC;AAGD,IAAM,eAAA,GAAoB,EAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,iBAAiB,wCAAwC,CAAA;AAM3F,IAAM,kBAAA,GAAuB,sBAAmB,MAAA,EAAQ;AAAA,EAC3D,EAAA,CAAA,WAAA,CAAY;AAAA,IACZ,IAAA,EAAQ,WAAQ,UAAU,CAAA;AAAA,IAC1B,EAAA,EAAI,eAAA;AAAA,IACJ,IAAA,EAAQ,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,IACtB,MAAA,EAAU,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,IACxB,UAAY,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,IACrC,OAAA,EAAW,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA;AAAS,GAC/B,CAAA;AAAA,EACC,EAAA,CAAA,WAAA,CAAY;AAAA,IACZ,IAAA,EAAQ,WAAQ,SAAS,CAAA;AAAA,IACzB,EAAA,EAAI,eAAA;AAAA,IACJ,MAAA,EAAU,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,IACxB,OAAA,EAAW,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA;AAAS,GAC/B,CAAA;AAAA,EACC,EAAA,CAAA,WAAA,CAAY;AAAA,IACZ,IAAA,EAAQ,WAAQ,SAAS,CAAA;AAAA,IACzB,EAAA,EAAI,eAAA;AAAA;AAAA,IAEJ,IAAA,EAAQ,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,IACtB,QAAU,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,IACnC,OAAA,EAAW,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA;AAAS,GAC/B,CAAA;AAAA,EACC,EAAA,CAAA,WAAA,CAAY;AAAA,IACZ,IAAA,EAAQ,WAAQ,OAAO,CAAA;AAAA,IACvB,EAAA,EAAI,eAAA;AAAA;AAAA,IAEJ,KAAA,EAAS,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,IACvB,QAAU,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,IACnC,OAAA,EAAW,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA;AAAS,GAC/B;AACH,CAAC;AAIM,IAAM,mCAAqC,EAAA,CAAA,WAAA,CAAY;AAAA,EAC5D,IAAA,EAAQ,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,SAAA,EAAW,aAAa,QAAA,EAAS;AAAA,EACjC,QAAA,EAAY,EAAA,CAAA,OAAA,EAAQ,CAAE,OAAA,CAAQ,KAAK;AACrC,CAAC;AASD,IAAM,+BAAiC,EAAA,CAAA,WAAA,CAAY;AAAA,EACjD,MAAQ,EAAA,CAAA,MAAA,EAAO;AAAA,EACf,MAAA,EAAU,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,OAAA,EAAW,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC,CAAA;AAEM,IAAM,sBACV,EAAA,CAAA,WAAA,CAAY;AAAA,EACX,YAAA,EAAgB,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,IAAA,EAAQ,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,OAAA,EAAW,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,WAAA,EAAe,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAW,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAE7B,KAAA,EAAO,kBAAkB,QAAA,EAAS;AAAA,EAClC,KAAA,EAAO,iBAAiB,QAAA,EAAS;AAAA,EACjC,UAAA,EAAc,eAAY,EAAE,IAAA,EAAQ,WAAO,EAAG,EAAE,QAAA,EAAS;AAAA,EACzD,SACG,EAAA,CAAA,WAAA,CAAY;AAAA,IACX,SAAA,EAAa,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC/B,OAAA,EAAW,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,IAE7B,UAAA,EAAc,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA;AAAS,GAClC,EACA,QAAA,EAAS;AAAA,EAEZ,MAAA,EAAU,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,OAAA,EAAW,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,IAAA,EAAQ,EAAA,CAAA,KAAA,CAAQ,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,QAAA,EAAY,EAAA,CAAA,KAAA,CAAQ,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA;AAAA,EAIvC,SAAA,EAAW,qBAAqB,QAAA,EAAS;AAAA;AAAA,EAEzC,EAAA,EAAI,cAAc,QAAA,EAAS;AAAA,EAC3B,MAAA,EAAQ,kBAAkB,QAAA,EAAS;AAAA,EACnC,QAAA,EAAY,EAAA,CAAA,KAAA,CAAM,kBAAkB,CAAA,CAAE,QAAA,EAAS;AAAA,EAC/C,YAAA,EAAgB,EAAA,CAAA,KAAA,CAAM,gCAAgC,CAAA,CAAE,QAAA,EAAS;AAAA,EACjE,QAAA,EAAY,EAAA,CAAA,KAAA,CAAM,sBAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,EAEnD,UAAY,EAAA,CAAA,MAAA,CAAS,EAAA,CAAA,MAAA,IAAY,EAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA;AAAA;AAAA,EAIrD,MAAA,EAAU,EAAA,CAAA,KAAA,CAAQ,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAErC,SAAA,EAAa,EAAA,CAAA,KAAA,CAAQ,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAExC,SAAA,EAAa,EAAA,CAAA,KAAA,CAAQ,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAExC,OAAA,EAAW,EAAA,CAAA,KAAA,CAAQ,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAEtC,KAAA,EAAS,EAAA,CAAA,KAAA,CAAQ,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAEpC,SAAA,EAAa,EAAA,CAAA,KAAA,CAAQ,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAExC,QAAA,EAAY,EAAA,CAAA,KAAA,CAAM,4BAA4B,CAAA,CAAE,QAAA;AAClD,CAAC,CAAA,CACA,WAAA,CAAY,CAAC,QAAA,EAAU,GAAA,KAAQ;AAC9B,EAAA,IAAI,QAAA,CAAS,SAAA,KAAc,MAAA,IAAU,QAAA,CAAS,OAAO,MAAA,EAAW;AAC9D,IAAA,GAAA,CAAI,QAAA,CAAS;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,MACX,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,EACH;AACA,EAAA,kBAAA;AAAA,IACE,GAAA;AAAA,IACA,UAAA;AAAA,IAAA,CACC,QAAA,CAAS,YAAY,EAAC,EAAG,IAAI,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA;AAAA,IACzC;AAAA,GACF;AACA,EAAA,kBAAA;AAAA,IACE,GAAA;AAAA,IACA,eAAA;AAAA,IAAA,CACC,QAAA,CAAS,QAAQ,MAAA,IAAU,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA;AAAA,IACjD;AAAA,GACF;AACA,EAAA,CAAC,SAAS,QAAA,IAAY,IAAI,OAAA,CAAQ,CAAC,SAAS,CAAA,KAAM;AAChD,IAAA,IAAI,OAAA,CAAQ,SAAS,UAAA,EAAY;AACjC,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,OAAA,CAAQ,IAAI,CAAA;AACxC,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,GAAA,CAAI,QAAA,CAAS;AAAA,QACX,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,UAAA,EAAY,CAAA,EAAG,MAAM,CAAA;AAAA,QAC5B,OAAA,EAAS,CAAA,MAAA,EAAS,OAAA,CAAQ,IAAI,qCAAqC,OAAO,CAAA;AAAA,OAC3E,CAAA;AAAA,IACH;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,CAAS,QAAA,IAAY,EAAC,EAAG;AAC1C,IAAA,IAAI,IAAA,CAAK,OAAO,MAAA,IAAa,MAAA,CAAO,OAAO,sBAAA,EAAwB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7E,MAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,EAAE,CAAA;AAAA,IACrB;AAAA,EACF;AACA,EAAA,CAAC,SAAS,YAAA,IAAgB,IAAI,OAAA,CAAQ,CAAC,KAAK,CAAA,KAAM;AAChD,IAAA,IAAI,IAAI,SAAA,KAAc,MAAA,IAAa,QAAQ,GAAA,CAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AAC/D,IAAA,GAAA,CAAI,QAAA,CAAS;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,CAAC,cAAA,EAAgB,CAAA,EAAG,WAAW,CAAA;AAAA,MACrC,OAAA,EACE,eAAe,GAAA,CAAI,IAAI,2BAA2B,GAAA,CAAI,SAAS,CAAA,gEAAA,EACpB,GAAA,CAAI,SAAS,CAAA,CAAA,CAAA,IACvD,QAAQ,IAAA,GAAO,CAAA,GAAI,qBAAqB,CAAC,GAAG,OAAO,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA,GAAM,EAAA;AAAA,KACzE,CAAA;AAAA,EACH,CAAC,CAAA;AAED,EAAA,CAAC,SAAS,QAAA,IAAY,IAAI,OAAA,CAAQ,CAAC,MAAM,CAAA,KAAM;AAC7C,IAAA,IAAI,IAAA,CAAK,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAM,MAAA,GAAS,iBAAiB,IAAI,CAAA;AACpC,IAAA,IAAI,MAAA,EAAQ,SAAS,OAAA,IAAW,MAAA,CAAO,SAAS,OAAA,IAAW,MAAA,CAAO,IAAA,KAAS,QAAA,CAAS,IAAA,EAAM;AACxF,MAAA;AAAA,IACF;AACA,IAAA,MAAM,YAAa,QAAA,CAAqC,SAAA;AACxD,IAAA,IACE,MAAA,CAAO,cAAc,MAAA,IACrB,OAAO,cAAc,QAAA,IACrB,MAAA,CAAO,cAAc,SAAA,EACrB;AACA,MAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,QAAA,CAAS;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,CAAC,UAAA,EAAY,CAAA,EAAG,KAAK,CAAA;AAAA,MAC3B,SAAS,CAAA,OAAA,EAAU,QAAA,CAAS,IAAI,CAAA,mBAAA,EAAsB,KAAK,GAAG,CAAA,uCAAA;AAAA,KAC/D,CAAA;AAAA,EACH,CAAC,CAAA;AACH,CAAC;AAEH,SAAS,kBAAA,CACP,GAAA,EACA,KAAA,EACA,MAAA,EACA,KAAA,EACM;AACN,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAA,CAAO,OAAA,CAAQ,CAAC,KAAA,EAAO,CAAA,KAAM;AAC3B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA,EAAG;AACnB,MAAA,GAAA,CAAI,QAAA,CAAS;AAAA,QACX,IAAA,EAAM,QAAA;AAAA,QACN,MAAM,CAAC,GAAG,MAAM,KAAA,CAAM,GAAG,GAAG,CAAC,CAAA;AAAA,QAC7B,OAAA,EAAS,CAAA,UAAA,EAAa,KAAK,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA;AAAA,OACtC,CAAA;AAAA,IACH;AACA,IAAA,IAAA,CAAK,IAAI,KAAK,CAAA;AAAA,EAChB,CAAC,CAAA;AACH;AAIO,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;ACxrBO,IAAM,0BAA4BC,EAAA,CAAA,WAAA,CAAY;AAAA,EACnD,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,KAAA,EAASA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACvB,UACGA,EAAA,CAAA,MAAA,CAAO;AAAA,IACN,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACvC,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA;AAAS,GACxC,EACA,QAAA,EAAS;AAAA,EACZ,MAAA,EAAUA,EAAA,CAAA,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA,EAAS;AAAA,EACtC,YAAA,EAAgBA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC7C,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,SAAS,kBAAkB,IAAA,EAA4D;AAC5F,EAAA,OAAO,gBAAA,CAAiB,yBAAyB,IAAI,CAAA;AACvD;ACdA,IAAM,mBAAA,GAAsB,qBAAqB,MAAA,CAAO;AAAA,EACtD,YAAcC,EAAA,CAAA,MAAA,CAASA,EAAA,CAAA,MAAA,IAAYA,EAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACvD,WACGA,EAAA,CAAA,MAAA,CAAO;AAAA,IACN,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA,IAC9C,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA;AAAS,GAC/C,EACA,QAAA,EAAS;AAAA,EACZ,eACGA,EAAA,CAAA,MAAA,CAAO;AAAA,IACN,KAAA,EAASA,EAAA,CAAA,KAAA,CAAM,sBAAsB,CAAA,CAAE,QAAA,EAAS;AAAA,IAChD,eAAA,EAAmBA,EAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA,IACnD,eAAA,EAAmBA,EAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,IAEnD,KAAA,EAASA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,EAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,EAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EAAE,QAAA,EAAS;AAAA,IAC5F,QAAA,EACGA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,EAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,EAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EACxE,QAAA,EAAS;AAAA,IACZ,SAAA,EACGA,EAAA,CAAA,KAAA;AAAA,MACGA,EAAA,CAAA,MAAA,CAAO;AAAA,QACP,IAAMA,EAAA,CAAA,MAAA,EAAO;AAAA,QACb,UAAA,EAAcA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACzC,QAAA,EAAYA,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,QAC/B,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AAAS,OAClC;AAAA,MAEF,QAAA,EAAS;AAAA,IACZ,UAAA,EACGA,EAAA,CAAA,KAAA;AAAA,MACGA,EAAA,CAAA,MAAA,CAAO;AAAA,QACP,QAAUA,EAAA,CAAA,MAAA,EAAO;AAAA,QACjB,QAAUA,EAAA,CAAA,IAAA,CAAK,CAAC,aAAa,YAAY,CAAC,EAAE,QAAA;AAAS,OACtD;AAAA,MAEF,QAAA;AAAS,GACb,EACA,QAAA,EAAS;AAAA,EACZ,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,CAAO,EAAE,MAAQA,EAAA,CAAA,MAAA,EAAO,EAAG,WAAA,EAAeA,EAAA,CAAA,MAAA,GAAS,QAAA,EAAS,EAAG,CAAC,EAAE,QAAA;AACxF,CAAC,CAAA;AAOM,IAAM,oCAAA,GAAuC;AAG7C,IAAM,6BAAA,GAAgC,GAAG,oCAAoC,CAAA,kDAAA;AAG7E,IAAM,sBAAA,GAAyB;AAE/B,IAAM,sBAAwBA,EAAA,CAAA,WAAA,CAAY;AAAA,EAC/C,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EACGA,EAAA,CAAA,MAAA,EAAO,CACP,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,IAAA,EAAK,CAAE,MAAA,GAAS,CAAA,EAAG;AAAA,IAClC,OAAA,EACE;AAAA,GACH,CAAA,CACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAK,CAAE,UAAA,CAAW,oCAAoC,CAAA,EAAG;AAAA,IACzE,OAAA,EAAS,kDAAkD,oCAAoC,CAAA,0DAAA;AAAA,GAChG,CAAA;AAAA,EACH,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,aAAA,EAAiBA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,eAAA,EAAmBA,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAGtC,MAAA,EAAUA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,WAAA,EAAeA,EAAA,CAAA,KAAA,CAAM,eAAe,CAAA,CAAE,QAAA,EAAS;AAAA,EAC/C,UAAA,EAAcA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACzC,SAAA,EAAaA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAExC,QAAA,EAAU,oBAAoB,QAAA;AAChC,CAAC;AAIM,SAAS,cAAc,IAAA,EAAwD;AACpF,EAAA,OAAO,gBAAA,CAAiB,qBAAqB,IAAI,CAAA;AACnD;AC1FO,IAAM,yBAAA,GAA4B;AAElC,IAAM,yBAA2BC,EAAA,CAAA,WAAA,CAAY;AAAA,EAClD,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,iBAAiB,IAAA,EAA2D;AAC1F,EAAA,OAAO,gBAAA,CAAiB,wBAAwB,IAAI,CAAA;AACtD;ACpBO,IAAM,0BAA4BC,EAAA,CAAA,WAAA,CAAY;AAAA,EACnD,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,SAAM,CAAGA,EAAA,CAAA,MAAA,IAAYA,EAAA,CAAA,MAAA,EAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIpD,SAAA,EAAaA,QAAK,CAAC,OAAA,EAAS,OAAO,MAAA,EAAQ,iBAAiB,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACxE,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,IAAA,EAAQA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACnC,KAAOA,EAAA,CAAA,MAAA,CAASA,EAAA,CAAA,MAAA,IAAYA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAC/C,GAAA,EAAOA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,SAAWA,EAAA,CAAA,MAAA,CAASA,EAAA,CAAA,MAAA,IAAYA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAEnD,EAAA,EAAMA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACxB,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7B,SACGA,EAAA,CAAA,MAAA,CAAO;AAAA;AAAA,IAEN,GAAA,EACGA,EAAA,CAAA,MAAA,EAAO,CACP,GAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,UAAU,CAAA,EAAG,EAAE,OAAA,EAAS,6BAA6B,CAAA;AAAA,IACnF,MAAA,EAAUA,EAAA,CAAA,MAAA,EAAO,CAAE,KAAA,CAAM,gBAAgB,CAAA;AAAA;AAAA,IAEzC,IAAA,EACGA,WAAO,CACP,KAAA,CAAM,aAAa,EAAE,OAAA,EAAS,2CAAA,EAA6C,CAAA,CAC3E,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,KAAM,OAAO,CAAA,KAAM,IAAA,EAAM,EAAE,OAAA,EAAS,+BAAA,EAAiC,CAAA,CACnF,QAAA;AAAS,GACb,EACA,QAAA;AACL,CAAC;AAIM,SAAS,kBAAkB,IAAA,EAA4D;AAC5F,EAAA,OAAO,gBAAA,CAAiB,yBAAyB,IAAI,CAAA;AACvD;ACtCO,IAAM,uBAAA,GAA0B;AAEhC,IAAM,uBAAyBC,EAAA,CAAA,WAAA,CAAY;AAAA,EAChD,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,eAAe,IAAA,EAAyD;AACtF,EAAA,OAAO,gBAAA,CAAiB,sBAAsB,IAAI,CAAA;AACpD;AChBO,IAAM,wBAA0BC,EAAA,CAAA,WAAA,CAAY;AAAA,EACjD,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,gBAAgB,IAAA,EAA0D;AACxF,EAAA,OAAO,gBAAA,CAAiB,uBAAuB,IAAI,CAAA;AACrD;ACHA,IAAM,qBAAA,GAAwB;AAAA,EAC5B,MAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,qBAAA,GAA0BC,QAAK,qBAAqB;AAE1D,IAAM,oBAAsBA,EAAA,CAAA,MAAA,CAAO;AAAA,EACxC,GAAA,EAAOA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,MAAA,EAAUA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAM,sBAAsB,QAAA,EAAS;AAAA,EACrC,QAAA,EAAYA,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAWA,EAAA,CAAA,KAAA,CAAM,CAAGA,EAAA,CAAA,MAAA,EAAO,EAAKA,EAAA,CAAA,MAAA,EAAO,EAAKA,EAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACjE,MAAA,EAAUA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,KAAA,CAAM,CAAGA,EAAA,CAAA,MAAA,EAAO,EAAKA,EAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA;AACrD,CAAC;AAMD,IAAM,mBAAqBA,EAAA,CAAA,MAAA,CAAO;AAAA,EAChC,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,GAAA,EAAOA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC;AACvB,CAAC,CAAA;AAMM,IAAM,mBAAqBA,EAAA,CAAA,WAAA,CAAY;AAAA;AAAA,EAE5C,GAAA,EAAOA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA;AAAA,EAErB,EAAA,EAAMA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAExB,QAAUA,EAAA,CAAA,MAAA,CAASA,EAAA,CAAA,MAAA,IAAYA,EAAA,CAAA,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA;AAAA,EAEnD,YAAA,EAAgBA,EAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAElD,aAAeA,EAAA,CAAA,MAAA,CAASA,EAAA,CAAA,MAAA,IAAYA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAEvD,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAM,gBAAgB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAE7C,QAAUA,EAAA,CAAA,MAAA,CAASA,EAAA,CAAA,MAAA,IAAYA,EAAA,CAAA,OAAA,EAAS,EAAE,QAAA;AAC5C,CAAC;AAMD,IAAM,oBAAsBA,EAAA,CAAA,MAAA,CAAO;AAAA,EACjC,GAAA,EAAOA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,IAAA,EAAM,sBAAsB,QAAA,EAAS;AAAA,EACrC,MAAA,EAAUA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,QAAA,EAAYA,EAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,MAAA,EAAUA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,KAAA,CAAM,CAAGA,EAAA,CAAA,MAAA,EAAO,EAAKA,EAAA,CAAA,MAAA,EAAQ,CAAC,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC5D,OAAA,EAAWA,EAAA,CAAA,KAAA,CAAM,CAAGA,EAAA,CAAA,MAAA,EAAO,EAAKA,EAAA,CAAA,MAAA,EAAO,EAAKA,EAAA,CAAA,OAAA,EAAS,CAAC,CAAA,CAAE,QAAA;AAC1D,CAAC,CAAA;AAUM,IAAM,qBAAuBA,EAAA,CAAA,MAAA,CAAO;AAAA,EACzC,GAAA,EAAOA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACrB,GAAA,EAAOA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,SAAA,EAAaA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA;AACxB,CAAC;AAOM,IAAM,8BAAA,GAAiC;AAGvC,IAAM,2BAAA,GAA8B;AAMpC,IAAM,uBAAyBA,EAAA,CAAA,WAAA,CAAY;AAAA,EAChD,SAAA,EAAaA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,OAAA,EAAWA,EAAA,CAAA,KAAA,CAAM,CAAGA,EAAA,CAAA,MAAA,EAAO,EAAKA,WAAQ,CAAC,CAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,EAC1D,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,QAAA,EAAYA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA;AAAA,EAGvC,KAAA,EAASA,EAAA,CAAA,KAAA,CAAM,gBAAgB,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA;AAAA,EAGtC,MAAA,EAAUA,EAAA,CAAA,KAAA,CAAM,iBAAiB,CAAA,CAAE,QAAA,EAAS;AAAA;AAAA,EAG5C,OAAA,EAAWA,EAAA,CAAA,KAAA,CAAM,kBAAkB,CAAA,CAAE,QAAA;AACvC,CAAC;AAOM,SAAS,eAAe,IAAA,EAAyD;AACtF,EAAA,OAAO,gBAAA,CAAiB,sBAAsB,IAAI,CAAA;AACpD;ACjIO,IAAM,wBAA0BC,EAAA,CAAA,WAAA,CAAY;AAAA,EACjD,IAAA,EAAQA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAeA,EAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC7B,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAYA,EAAA,CAAA,KAAA,CAAQA,EAAA,CAAA,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACvC,OAAA,EAAWA,EAAA,CAAA,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,QAAA,EAAU,qBAAqB,QAAA;AACjC,CAAC;AAIM,SAAS,gBAAgB,IAAA,EAA0D;AACxF,EAAA,OAAO,gBAAA,CAAiB,uBAAuB,IAAI,CAAA;AACrD","file":"chunk-MGM5EJQQ.js","sourcesContent":["/**\n * Shared manifest frontmatter schemas and types.\n * Common across all asset kinds + Preset.\n */\nimport * as z from \"zod\";\n\n// ---------------------------------------------------------------------------\n// Shared metadata sub-schemas\n// ---------------------------------------------------------------------------\n\n/** Artifact dependency (requires/produces/consumes in skill metadata). */\nexport const ArtifactRefSchema = z.object({\n  id: z.string().min(1),\n  description: z.string().optional(),\n  gate: z.enum([\"hard\", \"soft\"]).optional(),\n  path: z.string().optional(),\n});\n\n/** File prerequisite for a skill. */\nexport const FilePrerequisiteSchema = z.object({\n  path: z.string().min(1),\n  gate: z.enum([\"hard\", \"soft\"]).optional(),\n  description: z.string().optional(),\n});\n\n/** User input definition (for skill user_inputs or metadata.prerequisites.inputs_*). */\nexport const UserInputSchema = z.looseObject({\n  key: z.string().min(1).optional(),\n  id: z.string().min(1).optional(),\n  label: z.string().optional(),\n  prompt: z.string().optional(),\n  type: z.string().optional(),\n  required: z.boolean().optional(),\n  options: z.array(z.string()).optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n  default: z\n    .union([z.string(), z.number(), z.boolean(), z.array(z.union([z.string(), z.number()]))])\n    .optional(),\n  hint: z.string().optional(),\n});\n\n/** Field definition for connectors/mounts. */\nexport const FieldSchema = z.object({\n  key: z.string().min(1),\n  label: z.string().optional(),\n  required: z.boolean().optional(),\n  sensitive: z.boolean().optional(),\n  type: z.string().optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Common metadata block (appears inside metadata: in most manifest kinds)\n// ---------------------------------------------------------------------------\n\nexport const CommonMetadataSchema = z.looseObject({\n  version: z.string().optional(),\n  author: z.string().optional(),\n  tags: z.array(z.string()).optional(),\n  stage: z.enum([\"alpha\", \"beta\", \"stable\", \"deprecated\"]).optional(),\n  source: z.string().optional(),\n  do_not_invoke: z.boolean().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Common frontmatter fields (top-level, shared across kinds)\n// ---------------------------------------------------------------------------\n\n/**\n * Fields that can appear at the top level of any manifest's frontmatter.\n * Not all are required -- each kind schema intersects with its own specifics.\n */\nexport const BaseFrontmatterSchema = z.object({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n\n  // Catalog identity (populated at discovery or authoring time)\n  publisher: z.string().optional(),\n  category: z.string().optional(),\n  license: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Validation result type\n// ---------------------------------------------------------------------------\n\nexport interface ManifestValidationSuccess<T> {\n  ok: true;\n  data: T;\n}\n\nexport interface ManifestValidationFailure {\n  ok: false;\n  errors: Array<{ path: string; message: string }>;\n}\n\nexport type ManifestValidationResult<T> = ManifestValidationSuccess<T> | ManifestValidationFailure;\n\nexport function validateManifest<T>(\n  schema: z.ZodType<T>,\n  data: unknown,\n): ManifestValidationResult<T> {\n  const result = schema.safeParse(data);\n  if (result.success) {\n    return { ok: true, data: result.data };\n  }\n  return {\n    ok: false,\n    errors: result.error.issues.map((issue) => ({\n      path: issue.path.join(\".\"),\n      message: issue.message,\n    })),\n  };\n}\n","/**\n * Pure helpers over an agent asset's composition surface: the implicit\n * convention-file items, the deprecation diagnostics for 0.1 inputs, and the\n * slot-id conflict check. No I/O — callers pass file listings / parsed YAML.\n */\n\nimport type { AgentComposeItem } from \"./agent.js\";\n\n/** A structured note about an agent manifest; structurally a core `Diagnostic`. */\nexport interface AgentManifestDiagnostic {\n  code: string;\n  severity: \"error\" | \"warning\" | \"info\";\n  message: string;\n  /** Dotted/indexed path into the manifest, e.g. `composes[2].id`. */\n  path?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Convention files → implicit composition items\n// ---------------------------------------------------------------------------\n\nconst CONVENTION_FILES: ReadonlyArray<{\n  file: string;\n  kind: string;\n  binding: NonNullable<AgentComposeItem[\"binding\"]>;\n}> = [\n  { file: \"SOUL.md\", kind: \"soul\", binding: \"inline-snapshot\" },\n  { file: \"RULES.md\", kind: \"ruleset\", binding: \"inline-live\" },\n  { file: \"DUTIES.md\", kind: \"prompt\", binding: \"inline-live\" },\n];\n\nconst KNOWLEDGE_DIR = \"knowledge\";\n\nconst stripDotSlash = (ref: string): string => ref.replace(/^\\.\\//, \"\").replace(/\\/+$/, \"\");\n\n/**\n * The implicit composition items of an agent directory: `SOUL.md` → `soul`\n * (inline-snapshot), `RULES.md` → `ruleset` (inline-live), `DUTIES.md` →\n * `prompt` (inline-live), `knowledge/` → `knowledge` (discoverable). An item\n * exists only when its file/directory does. Refs are `./`-relative to the\n * agent directory; order is soul, ruleset, prompt, knowledge.\n *\n * @param entries - Paths relative to the agent directory (files; directories\n *   may appear as `knowledge` or as the prefix of `knowledge/<file>`).\n */\nexport function conventionItems(entries: Iterable<string>): AgentComposeItem[] {\n  const present = [...entries].map(stripDotSlash);\n  const items: AgentComposeItem[] = [];\n  for (const { file, kind, binding } of CONVENTION_FILES) {\n    if (present.includes(file)) items.push({ kind, ref: `./${file}`, binding });\n  }\n  if (present.some((p) => p === KNOWLEDGE_DIR || p.startsWith(`${KNOWLEDGE_DIR}/`))) {\n    items.push({ kind: \"knowledge\", ref: `./${KNOWLEDGE_DIR}`, binding: \"discoverable\" });\n  }\n  return items;\n}\n\n/**\n * Effective composition: the convention items followed by the declared\n * `composes`. A declared item that repeats a convention item (same kind, same\n * path) replaces it in place — that is how an author changes its `binding`.\n */\nexport function effectiveComposes(\n  composes: readonly AgentComposeItem[] | undefined,\n  entries: Iterable<string>,\n): AgentComposeItem[] {\n  const declared = composes ?? [];\n  const key = (item: AgentComposeItem): string => `${item.kind}\\0${stripDotSlash(item.ref)}`;\n  const declaredKeys = new Set(declared.map(key));\n  const implicit = conventionItems(entries).filter((item) => !declaredKeys.has(key(item)));\n  return [...implicit, ...declared];\n}\n\n// ---------------------------------------------------------------------------\n// Deprecated 0.1 inputs\n// ---------------------------------------------------------------------------\n\nconst DEPRECATED_TOP_LEVEL: ReadonlyArray<{ field: string; replacement: string }> = [\n  { field: \"skills\", replacement: \"composes: [{ kind: skill, ref }]\" },\n  { field: \"abilities\", replacement: \"composes: [{ kind: skill, ref }]\" },\n  { field: \"contracts\", replacement: \"composes: [{ kind: contract, ref }]\" },\n  { field: \"persona\", replacement: \"composes: [{ kind: persona, ref }] or SOUL.md\" },\n  { field: \"rules\", replacement: \"composes: [{ kind: ruleset, ref }] or RULES.md\" },\n  { field: \"knowledge\", replacement: \"composes: [{ kind: knowledge, ref }] or knowledge/\" },\n  { field: \"requires\", replacement: \"composes: [{ kind: agent, ref, binding: delegate }]\" },\n  { field: \"dependencies\", replacement: \"composes: [{ kind, ref }]\" },\n];\n\nconst DEPRECATED_METADATA: ReadonlyArray<{ field: string; replacement: string }> = [\n  { field: \"soul\", replacement: \"SOUL.md or composes: [{ kind: persona, ref }]\" },\n  { field: \"orchestrates\", replacement: \"composes: [{ kind: skill|agent, ref }]\" },\n  { field: \"routes_to\", replacement: \"composes: [{ kind: agent, ref, binding: delegate }]\" },\n  { field: \"knows\", replacement: \"composes: [{ kind: knowledge, ref }]\" },\n];\n\n/**\n * One named `warning` diagnostic per deprecated 0.1 field present on a parsed\n * `agent.yaml`: `deprecated_agent_<field>` for top-level fields and\n * `deprecated_agent_metadata_<field>` for `metadata.*`. Deprecated fields still\n * parse but are not read for composition.\n */\nexport function agentDeprecationDiagnostics(parsed: unknown): AgentManifestDiagnostic[] {\n  if (parsed === null || typeof parsed !== \"object\") return [];\n  const manifest = parsed as Record<string, unknown>;\n  const out: AgentManifestDiagnostic[] = [];\n  for (const { field, replacement } of DEPRECATED_TOP_LEVEL) {\n    if (manifest[field] === undefined) continue;\n    out.push({\n      code: `deprecated_agent_${field}`,\n      severity: \"warning\",\n      message: `agent.yaml field \"${field}\" is deprecated and no longer read; use ${replacement}`,\n      path: field,\n    });\n  }\n  const metadata = manifest.metadata;\n  if (metadata !== null && typeof metadata === \"object\") {\n    for (const { field, replacement } of DEPRECATED_METADATA) {\n      if ((metadata as Record<string, unknown>)[field] === undefined) continue;\n      out.push({\n        code: `deprecated_agent_metadata_${field}`,\n        severity: \"warning\",\n        message: `agent.yaml field \"metadata.${field}\" is deprecated and no longer read; use ${replacement}`,\n        path: `metadata.${field}`,\n      });\n    }\n  }\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Slot ids\n// ---------------------------------------------------------------------------\n\n/**\n * `composition_conflict` error per `composes[].id` already used by an earlier\n * item. Slot ids name connector / mcp-server slots, so two items must not share one.\n */\nexport function composeSlotDiagnostics(parsed: unknown): AgentManifestDiagnostic[] {\n  if (parsed === null || typeof parsed !== \"object\") return [];\n  const composes = (parsed as Record<string, unknown>).composes;\n  if (!Array.isArray(composes)) return [];\n  const firstSeen = new Map<string, number>();\n  const out: AgentManifestDiagnostic[] = [];\n  composes.forEach((item, i) => {\n    if (item === null || typeof item !== \"object\") return;\n    const id = (item as Record<string, unknown>).id;\n    if (typeof id !== \"string\") return;\n    const first = firstSeen.get(id);\n    if (first === undefined) {\n      firstSeen.set(id, i);\n      return;\n    }\n    out.push({\n      code: \"composition_conflict\",\n      severity: \"error\",\n      message: `composes slot id \"${id}\" is already used by composes[${first}]`,\n      path: `composes[${i}].id`,\n    });\n  });\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Compose refs\n// ---------------------------------------------------------------------------\n\n/** What a `composes[].ref` points at: a path next to the agent, or a library asset. */\nexport type ComposeRefTarget =\n  | { type: \"local\"; path: string }\n  | { type: \"asset\"; kind: string; name: string; publisher?: string };\n\n/**\n * Read a `composes[]` item's `ref` the way the dependency walker does: a ref that\n * starts with `.` or `/` is a local path; `scheme://` refs are not library refs\n * (`undefined`); anything else is `[kind:][@publisher/]name[@range][#pin]`, the kind\n * defaulting to the item's own `kind`.\n */\nexport function composeRefTarget(item: {\n  kind: string;\n  ref: string;\n}): ComposeRefTarget | undefined {\n  const ref = item.ref.trim();\n  if (ref.startsWith(\".\") || ref.startsWith(\"/\")) return { type: \"local\", path: ref };\n  if (ref.includes(\"://\")) return undefined;\n  const colon = ref.indexOf(\":\");\n  const kind = colon >= 0 ? ref.slice(0, colon).trim() : item.kind;\n  let rest = (colon >= 0 ? ref.slice(colon + 1) : ref).trim();\n  const pin = rest.indexOf(\"#\");\n  if (pin >= 0) rest = rest.slice(0, pin).trim();\n  let publisher: string | undefined;\n  if (rest.startsWith(\"@\")) {\n    const slash = rest.indexOf(\"/\");\n    if (slash < 0) return undefined;\n    publisher = rest.slice(1, slash);\n    rest = rest.slice(slash + 1).trim();\n  }\n  const at = rest.indexOf(\"@\");\n  const name = at >= 0 ? rest.slice(0, at).trim() : rest;\n  if (!kind || !name) return undefined;\n  return { type: \"asset\", kind: kind === \"mcp\" ? \"mcp-server\" : kind, name, publisher };\n}\n","/**\n * Syntax check for the standard 5-field cron expression a `schedule` trigger\n * carries (`minute hour day-of-month month day-of-week`). Pure; the framework\n * never runs a schedule, the host does, so this only refuses what no cron\n * scheduler can read.\n */\n\nconst MONTH_NAMES = [\n  \"jan\",\n  \"feb\",\n  \"mar\",\n  \"apr\",\n  \"may\",\n  \"jun\",\n  \"jul\",\n  \"aug\",\n  \"sep\",\n  \"oct\",\n  \"nov\",\n  \"dec\",\n];\nconst DAY_NAMES = [\"sun\", \"mon\", \"tue\", \"wed\", \"thu\", \"fri\", \"sat\"];\n\n/** The `@`-macros every common cron accepts. */\nconst CRON_MACROS: Record<string, true> = {\n  \"@yearly\": true,\n  \"@annually\": true,\n  \"@monthly\": true,\n  \"@weekly\": true,\n  \"@daily\": true,\n  \"@midnight\": true,\n  \"@hourly\": true,\n};\n\ninterface CronField {\n  name: string;\n  min: number;\n  max: number;\n  /** Lowercase names that stand for `min + index`. */\n  names?: readonly string[];\n  /** First number the names map to (months start at 1, weekdays at 0). */\n  nameBase?: number;\n}\n\nconst CRON_FIELDS: readonly CronField[] = [\n  { name: \"minute\", min: 0, max: 59 },\n  { name: \"hour\", min: 0, max: 23 },\n  { name: \"day-of-month\", min: 1, max: 31 },\n  { name: \"month\", min: 1, max: 12, names: MONTH_NAMES, nameBase: 1 },\n  // 7 is Sunday, as in vixie cron.\n  { name: \"day-of-week\", min: 0, max: 7, names: DAY_NAMES, nameBase: 0 },\n];\n\nfunction fieldValue(token: string, field: CronField): number | undefined {\n  if (/^\\d+$/.test(token)) return Number(token);\n  const idx = field.names?.indexOf(token.toLowerCase()) ?? -1;\n  return idx >= 0 ? idx + (field.nameBase ?? 0) : undefined;\n}\n\nfunction fieldProblem(text: string, field: CronField): string | undefined {\n  for (const part of text.split(\",\")) {\n    const [range, step, extra] = part.split(\"/\");\n    if (range === undefined || range === \"\" || extra !== undefined) {\n      return `${field.name} \"${text}\" is not valid`;\n    }\n    if (step !== undefined && !(/^\\d+$/.test(step) && Number(step) > 0)) {\n      return `${field.name} step \"${step}\" must be a positive integer`;\n    }\n    if (range === \"*\") continue;\n    const ends = range.split(\"-\");\n    if (ends.length > 2) return `${field.name} \"${text}\" is not valid`;\n    const values = ends.map((e) => fieldValue(e, field));\n    for (let i = 0; i < values.length; i++) {\n      const v = values[i];\n      if (v === undefined || v < field.min || v > field.max) {\n        return `${field.name} \"${ends[i]}\" is out of range ${field.min}-${field.max}`;\n      }\n    }\n    const [lo, hi] = values;\n    if (lo !== undefined && hi !== undefined && lo > hi) {\n      return `${field.name} range \"${range}\" runs backwards`;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Why `expr` is not a readable 5-field cron expression, or `undefined` when it is.\n * Accepts `*`, lists (`1,15`), ranges (`1-5`), steps (`*\\/10`, `0-30/5`), month and\n * weekday names (`jan`, `mon-fri`) and the `@daily`-style macros.\n *\n * @param expr The `cron` value of a `schedule` trigger.\n */\nexport function cronProblem(expr: string): string | undefined {\n  const text = expr.trim();\n  if (text.startsWith(\"@\")) {\n    return Object.hasOwn(CRON_MACROS, text.toLowerCase())\n      ? undefined\n      : `unknown cron macro \"${text}\" (use ${Object.keys(CRON_MACROS).join(\", \")})`;\n  }\n  const parts = text.split(/\\s+/);\n  if (parts.length !== CRON_FIELDS.length) {\n    return `expected 5 fields (minute hour day-of-month month day-of-week), got ${text === \"\" ? 0 : parts.length}`;\n  }\n  for (let i = 0; i < CRON_FIELDS.length; i++) {\n    const problem = fieldProblem(parts[i] as string, CRON_FIELDS[i] as CronField);\n    if (problem) return problem;\n  }\n  return undefined;\n}\n","import * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\nimport { composeRefTarget } from \"./agent-composition.js\";\nimport { cronProblem } from \"./cron.js\";\n\n/** Body the scaffold writes into a new agent's `SOUL.md`; an untouched body is a lint warning. */\nexport const AGENT_BODY_PLACEHOLDER = \"Agent prompt goes here.\";\n\n// ---------------------------------------------------------------------------\n// Model identifier validation + normalization\n// ---------------------------------------------------------------------------\n\n/**\n * Anthropic model aliases recognized by Claude Code and the Claude Agent SDK.\n *\n * - `inherit` — use the parent agent's model (Claude Code only).\n * - `opus` / `sonnet` / `haiku` — auto-rolling pointer to the current top model\n *   in that family. Resolved by Claude Code / the Claude SDK at runtime.\n *\n * Use these in `agent.yaml` `model.preferred` for portability across Claude\n * Code and `claude-sdk`. Use a full ID (see {@link ANTHROPIC_FULL_ID_PATTERN})\n * when you need to pin to a specific Anthropic release.\n */\nexport const ANTHROPIC_MODEL_ALIASES = [\"inherit\", \"opus\", \"sonnet\", \"haiku\"] as const;\nexport type AnthropicModelAlias = (typeof ANTHROPIC_MODEL_ALIASES)[number];\n\n/**\n * Anthropic model family segments recognized inside a full model identifier.\n *\n * This is the *ID* vocabulary, deliberately wider than\n * {@link ANTHROPIC_MODEL_ALIASES}: `fable` ships as a real model family\n * (`claude-fable-5`) but has no Claude Code rolling alias, so it belongs here\n * and not there.\n *\n * @since 1.5.0\n */\nexport const ANTHROPIC_MODEL_FAMILIES = [\"opus\", \"sonnet\", \"haiku\", \"fable\"] as const;\nexport type AnthropicModelFamily = (typeof ANTHROPIC_MODEL_FAMILIES)[number];\n\nconst FAMILY_ALT = ANTHROPIC_MODEL_FAMILIES.join(\"|\");\n\n/**\n * Family + version core shared by the full / Bedrock / Vertex patterns.\n *\n * Matches both the Claude 4+ \"family-first\" form (`opus-4-6`, `opus-5`) and the\n * legacy \"version-first\" form used by Claude 3.x and some OpenRouter aliases\n * (`3-5-sonnet`).\n *\n * The version is `\\d+(?:[-.]\\d+)*` — one *or more* numeric components. It used\n * to demand two or more, which rejected every current single-digit-major ID\n * (`claude-opus-5`, `claude-sonnet-5`, `claude-fable-5`). Those are structurally\n * indistinguishable from the older partial IDs the two-component rule was\n * written to catch (`claude-opus-4`), so accepting the current lineup\n * necessarily accepts those too. This validator is structural, not a catalog\n * check — a well-formed ID that no provider serves is caught at dispatch, not\n * here.\n */\nconst FAMILY_VERSION_CORE = `(?:(?:${FAMILY_ALT})-\\\\d+(?:[-.]\\\\d+)*|\\\\d+(?:[-.]\\\\d+)*-(?:${FAMILY_ALT}))`;\n\n/**\n * Regex matching a full Anthropic model identifier, optionally provider-prefixed.\n *\n * Examples that match (family-first):\n * - `claude-opus-5`\n * - `claude-sonnet-5`\n * - `claude-fable-5`\n * - `claude-opus-4-6`\n * - `claude-haiku-4-5-20251001`\n * - `anthropic/claude-sonnet-4.6` (OpenRouter form)\n *\n * Examples that match (version-first / legacy):\n * - `claude-3-5-sonnet-20241022`\n * - `anthropic/claude-3.7-sonnet`\n *\n * Still rejected: a bare family (`claude-opus`), a non-Claude vendor\n * (`gpt-4o`), an unknown family (`claude-turbo-5`).\n */\nexport const ANTHROPIC_FULL_ID_PATTERN = new RegExp(\n  `^(?:[a-z0-9-]+\\\\/)?claude-${FAMILY_VERSION_CORE}(?:-\\\\d{8})?$`,\n);\n\n/**\n * Regex matching an Amazon Bedrock-form Anthropic model identifier: an\n * optional region/scope prefix (`us.` / `eu.` / `apac.` / `global.`), the\n * `anthropic.` vendor segment, the same family/version core as\n * {@link ANTHROPIC_FULL_ID_PATTERN}, plus Bedrock's optional\n * `-v<major>[:<minor>]` suffix.\n *\n * Examples that match:\n * - `anthropic.claude-3-5-sonnet-20241022-v2:0`\n * - `us.anthropic.claude-opus-4-6-v1:0`\n * - `anthropic.claude-sonnet-4-5-20250929-v1:0`\n *\n * Does NOT match `anthropic.gpt-4` (not a Claude family) or a bare\n * `us.claude-…` (the `anthropic.` segment is required).\n *\n * @since 1.3.0\n */\nexport const BEDROCK_MODEL_ID_PATTERN = new RegExp(\n  `^(?:(?:us|eu|apac|global)\\\\.)?anthropic\\\\.claude-${FAMILY_VERSION_CORE}(?:-\\\\d{8})?(?:-v\\\\d+(?::\\\\d+)?)?$`,\n);\n\n/**\n * Regex matching a Google Vertex AI publisher-form Anthropic identifier —\n * a first-party ID pinned with an `@YYYYMMDD` date suffix instead of the\n * native `-YYYYMMDD` (e.g. `claude-sonnet-4-5@20250929`).\n *\n * @since 1.3.0\n */\nexport const VERTEX_MODEL_ID_PATTERN = new RegExp(`^claude-${FAMILY_VERSION_CORE}@\\\\d{8}$`);\n\n/**\n * Zod schema for a **first-party Anthropic** model identifier: a Claude Code\n * alias, a full Anthropic ID, a Bedrock-form ID (see\n * {@link BEDROCK_MODEL_ID_PATTERN}), or a Vertex `@date`-pinned ID (see\n * {@link VERTEX_MODEL_ID_PATTERN}).\n *\n * This is **not** a universal model-id rule. It is the vocabulary of exactly\n * one wire target — `surface: anthropic-messages` on `transport: direct`\n * pointed at Anthropic's own host — because that is the only endpoint whose\n * model namespace this package knows. Every other endpoint names models it\n * cannot enumerate (a Bedrock ARN, an Azure deployment name,\n * `accounts/fireworks/models/…`, `meta-llama/Llama-3.3-70B`, an Ollama tag),\n * and applying this schema there rejected working configurations. Pick between\n * the two vocabularies with {@link modelIdSchemaForTarget}.\n *\n * Use {@link normalizeAnthropicModel} to coerce an unrecognized value to a safe\n * alias instead of failing.\n */\nexport const ModelIdSchema = z.union([\n  z.enum(ANTHROPIC_MODEL_ALIASES),\n  z\n    .string()\n    .regex(\n      ANTHROPIC_FULL_ID_PATTERN,\n      \"Invalid Anthropic model ID. Use an alias (opus | sonnet | haiku | inherit), a full ID (e.g. claude-opus-5, claude-sonnet-4-6), a Bedrock ID (e.g. us.anthropic.claude-opus-4-6-v1:0), or a Vertex ID (e.g. claude-sonnet-4-5@20250929).\",\n    ),\n  z.string().regex(BEDROCK_MODEL_ID_PATTERN),\n  z.string().regex(VERTEX_MODEL_ID_PATTERN),\n]);\n\n/**\n * Hosts that serve the first-party Anthropic Messages API. An\n * `anthropic-messages` entry pointed anywhere else — a gateway, LiteLLM, an\n * Azure AI Foundry deployment — speaks the same wire protocol over its own\n * model namespace.\n *\n * @since 3.21.0\n */\nexport const ANTHROPIC_FIRST_PARTY_HOSTS: readonly string[] = [\"api.anthropic.com\"];\n\n/**\n * The slice of a provider-registry `llm` entry that decides which model-id\n * vocabulary applies.\n *\n * Structurally a subset of `AIProviderLlmEntry`\n * (`@skaile/workspaces/core/provider-registry`), so a registry entry can be\n * passed straight in. The fields are plain strings because this module sits\n * *below* the registry in the dependency graph and must not import it; the\n * enums live in exactly one place, and this is not it.\n *\n * @since 3.21.0\n */\nexport interface ModelIdTarget {\n  /** omp `api` value — `anthropic-messages`, `openai-completions`, … */\n  surface?: string;\n  /** `direct` when absent. */\n  transport?: string;\n  /** Resolved endpoint: `resolveEntryBaseUrl(entry)`, or the preset literal. */\n  base_url?: string;\n}\n\n/**\n * True when `baseUrl` is the first-party Anthropic API.\n *\n * An absent URL counts: an `anthropic-messages` entry with no endpoint of its\n * own is the first-party API (the catalog layer fills in\n * `https://api.anthropic.com` during the merge). A URL that will not parse is\n * treated as *not* first-party — guessing the other way would reject ids that\n * whatever is at the other end serves.\n *\n * @since 3.21.0\n */\nexport function isFirstPartyAnthropicEndpoint(baseUrl?: string): boolean {\n  if (!baseUrl) return true;\n  let host: string;\n  try {\n    host = new URL(baseUrl).hostname.toLowerCase();\n  } catch {\n    return false;\n  }\n  return ANTHROPIC_FIRST_PARTY_HOSTS.includes(host);\n}\n\n/**\n * Whether `target` demands an Anthropic-shaped model id.\n *\n * Exactly one combination does: the Anthropic Messages wire, spoken directly,\n * to Anthropic's own host. Every gateway transport (`bedrock`, `vertex`,\n * `foundry`, `azure-openai`) addresses the same models under a renamed\n * namespace — an inference-profile ARN, a publisher path, a deployment name —\n * and an `anthropic-messages` proxy owns its namespace outright.\n *\n * An absent `target` is the pre-registry default: first-party Anthropic is what\n * the Claude drivers talk to when nothing says otherwise, so the strict\n * vocabulary still applies there and nothing that validates today stops\n * validating.\n *\n * @since 3.21.0\n */\nexport function requiresAnthropicModelId(target?: ModelIdTarget): boolean {\n  if (!target) return true;\n  if (target.surface !== \"anthropic-messages\") return false;\n  if ((target.transport ?? \"direct\") !== \"direct\") return false;\n  return isFirstPartyAnthropicEndpoint(target.base_url);\n}\n\n/**\n * Any non-empty, whitespace-free model id — the vocabulary of every endpoint\n * whose model namespace belongs to the operator rather than to us.\n *\n * @since 3.21.0\n */\nexport const FreeFormModelIdSchema = z\n  .string()\n  .regex(/^\\S+$/, \"Model ID must be a non-empty string with no whitespace.\");\n\n/**\n * The model-id schema a given wire target enforces: {@link ModelIdSchema} for\n * first-party Anthropic, {@link FreeFormModelIdSchema} everywhere else.\n *\n * @since 3.21.0\n */\nexport function modelIdSchemaForTarget(target?: ModelIdTarget): z.ZodType<string> {\n  return requiresAnthropicModelId(target)\n    ? (ModelIdSchema as z.ZodType<string>)\n    : (FreeFormModelIdSchema as z.ZodType<string>);\n}\n\n/**\n * Contextual model-ID schema for the legacy `cloud` dimension.\n *\n * `default` (or absent) is the first-party Anthropic API, so the strict\n * vocabulary applies. Every other value either renames the namespace\n * (`bedrock` ARNs, `vertex` publisher paths, `azure` deployments) or is an\n * unknowable proxy (`gateway`) — all free-form, the same answer\n * {@link modelIdSchemaForTarget} gives for the equivalent registry entry.\n *\n * Superseded by {@link modelIdSchemaForTarget}; it goes when the rest of the\n * `cloud` surface does.\n *\n * @since 1.3.0\n */\nexport function modelIdSchemaForCloud(cloud?: string): z.ZodType<string> {\n  return !cloud || cloud === \"default\"\n    ? modelIdSchemaForTarget()\n    : (FreeFormModelIdSchema as z.ZodType<string>);\n}\n\n/**\n * Normalize an arbitrary model string to a safe Claude Code value.\n *\n * - If `input` is a recognized alias or a full / Bedrock-form / Vertex-form ID,\n *   returns it unchanged.\n * - If `input` looks like `claude-<family>-...` but doesn't match any full-ID\n *   regex (e.g. the broken `claude-opus-4`), returns the family alias.\n * - Otherwise returns `fallback` (default `\"sonnet\"` — Claude Code's default).\n *\n * Used by renderers that target Claude Code / the Claude SDK to coerce stale\n * or malformed model fields into a working alias rather than propagating a\n * silent runtime failure. All full-pattern checks run BEFORE the family\n * fallback so a valid Bedrock/Vertex ID is never downgraded to an alias.\n */\nexport function normalizeAnthropicModel(\n  input: string | undefined | null,\n  fallback: AnthropicModelAlias = \"sonnet\",\n): string {\n  if (!input) return fallback;\n  if ((ANTHROPIC_MODEL_ALIASES as readonly string[]).includes(input)) return input;\n  if (ANTHROPIC_FULL_ID_PATTERN.test(input)) return input;\n  if (BEDROCK_MODEL_ID_PATTERN.test(input) || VERTEX_MODEL_ID_PATTERN.test(input)) return input;\n  // Family fallback is restricted to the rolling *aliases* — `fable` has no\n  // Claude Code alias, so a malformed `claude-fable-*` falls through to\n  // `fallback` rather than to an alias the runtime would reject.\n  const familyMatch = input.match(/claude-(opus|sonnet|haiku)/i);\n  if (familyMatch) return familyMatch[1]!.toLowerCase() as AnthropicModelAlias;\n  return fallback;\n}\n\n/**\n * A model *selector* as a manifest writes it: `@role`,\n * `<providerId>/<modelId>`, a bare provider-side id, or an Anthropic alias.\n * Resolved against the provider registry — and only then checked against the\n * selected entry's own vocabulary — by `resolveManifestModel`\n * (`@skaile/workspaces/bridge`).\n *\n * Structural on purpose. An agent manifest is portable across providers: it\n * cannot know which registry entry will serve it, so an id-vocabulary check\n * here would enforce one endpoint's namespace on every other one. That check\n * belongs to {@link modelIdSchemaForTarget}, at the point where the endpoint is\n * known.\n *\n * @since 3.21.0\n */\nexport const ModelSelectorSchema = z\n  .string()\n  .regex(\n    /^\\S+$/,\n    'Model selector must be a non-empty string with no whitespace: \"@role\", \"provider/model\", a model ID, or an Anthropic alias.',\n  );\n\nconst ModelConfigSchema = z.looseObject({\n  preferred: ModelSelectorSchema.optional(),\n  fallback: z.array(ModelSelectorSchema).optional(),\n  constraints: z\n    .looseObject({\n      temperature: z.number().optional(),\n      max_tokens: z.number().optional(),\n    })\n    .optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Composition binding types (Task 1.7)\n// ---------------------------------------------------------------------------\n\n/** Bindings for content items: how the asset's bytes reach the prompt / tool surface. */\nexport const ContentBindingValues = [\"discoverable\", \"inline-live\", \"inline-snapshot\"] as const;\n/** Bindings for `kind: agent` items: how the sub-agent is invoked. */\nexport const AgentBindingValues = [\"delegate\", \"run\"] as const;\nexport const BindingValues = [...ContentBindingValues, ...AgentBindingValues] as const;\nexport const BindingSchema = z.enum(BindingValues);\nexport type Binding = z.infer<typeof BindingSchema>;\n\n/** Slot ids name a composed connector / mcp-server inside one agent: `composition.<id>`, `<id>.<operation>`. */\nexport const SLOT_ID_PATTERN = /^[a-z][a-z0-9_-]*$/;\n\n/** Kinds whose compose item MUST carry a slot `id`. */\nexport const SLOT_ID_REQUIRED_KINDS: Readonly<Record<string, true>> = {\n  connector: true,\n  \"mcp-server\": true,\n};\n\nconst SlotIdSchema = z\n  .string()\n  .regex(SLOT_ID_PATTERN, \"id must match [a-z][a-z0-9_-]* (lowercase, starts with a letter)\");\n\n/**\n * A single composition item within an agent's `composes:` field.\n *\n * - `kind`: the asset kind being composed. Any string here; `skaile validate`\n *   checks it against the kind registry (plus the `soul` pseudo-kind).\n * - `ref`: asset ref (e.g. '@skaile/gmail@^1') or a local path.\n * - `id`: slot id; required for `connector` and `mcp-server` items.\n * - `as`: local alias under which the item is exposed (e.g. a sub-agent name); also the rendered\n *   file name, so it must match `[a-z][a-z0-9_-]*`.\n * - `instance`: optional Library Instance ref to reuse (e.g. 'library://personal/instances/uuid')\n * - `config`: free-form per-item configuration.\n * - `binding`: how the asset integrates into the agent runtime; defaults per-kind.\n *   `delegate | run` apply to `kind: agent` only.\n */\nexport const AgentComposeItemSchema = z\n  .object({\n    kind: z.string().min(1),\n    ref: z.string().min(1),\n    id: SlotIdSchema.optional(),\n    as: z\n      .string()\n      .regex(\n        SLOT_ID_PATTERN,\n        \"as must match [a-z][a-z0-9_-]* (it names a rendered file: no path separators or dots)\",\n      )\n      .optional(),\n    instance: z.string().optional(),\n    config: z.record(z.string(), z.unknown()).optional(),\n    binding: BindingSchema.optional(),\n  })\n  .superRefine((item, ctx) => {\n    if (item.kind === \"memory\" || item.kind === \"trigger\") {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"kind\"],\n        message: `\"${item.kind}\" is not a composes kind; declare ${item.kind === \"memory\" ? \"memory\" : \"triggers\"} as a top-level field`,\n      });\n    }\n    if (Object.hasOwn(SLOT_ID_REQUIRED_KINDS, item.kind) && item.id === undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"id\"],\n        message: `composes item of kind \"${item.kind}\" requires a slot id`,\n      });\n    }\n    if (item.binding === undefined) return;\n    const isAgentBinding = (AgentBindingValues as readonly string[]).includes(item.binding);\n    if (item.kind === \"agent\" && !isAgentBinding) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"binding\"],\n        message: `composes item of kind \"agent\" accepts binding \"delegate\" or \"run\", not \"${item.binding}\"`,\n      });\n    } else if (item.kind !== \"agent\" && isAgentBinding) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"binding\"],\n        message: `binding \"${item.binding}\" is only valid for kind \"agent\"`,\n      });\n    }\n  });\n\nexport type AgentComposeItem = z.infer<typeof AgentComposeItemSchema>;\n\n// ---------------------------------------------------------------------------\n// Agent manifest\n// ---------------------------------------------------------------------------\n\n/**\n * Declared tool restrictions for an agent.\n *\n * `allowed` is an allowlist: when non-empty, the agent may invoke only these\n * tools. `denied` is a denylist applied on top. An absent block (or two empty\n * arrays) means \"no restriction\" — the harness's full default toolset.\n *\n * Tool names are written in the canonical Claude Code vocabulary (`Read`,\n * `Write`, `Bash`, `WebSearch`, …). Each driver maps them onto its own\n * runtime: `claude-sdk` passes them through as `allowedTools` /\n * `disallowedTools`; the omp driver translates them to omp's built-in tool\n * names and passes `--tools`. A name a harness does not recognize is dropped\n * for that harness rather than failing the manifest, because the same manifest\n * is expected to run on more than one harness.\n *\n * This was previously an undeclared field that survived only because\n * {@link AgentManifestSchema} is a loose object — so `AgentManifest.tools` was\n * typed `unknown` and every consumer read it through a cast.\n *\n * @since 1.5.0\n */\nexport const AgentToolsSchema = z.looseObject({\n  /** Tool names the agent may invoke. Empty or absent means \"no allowlist\". */\n  allowed: z.array(z.string().min(1)).optional(),\n  /** Tool names the agent must not invoke. Applied after `allowed`. */\n  denied: z.array(z.string().min(1)).optional(),\n});\n\nexport type AgentTools = z.infer<typeof AgentToolsSchema>;\n\n// ---------------------------------------------------------------------------\n// Spec 0.2: lifecycle, io, memory, triggers, capabilities\n// ---------------------------------------------------------------------------\n\n/** `standing` = long-running identity; `role` = short-lived, callable with typed I/O. */\nexport const AgentLifecycleValues = [\"standing\", \"role\"] as const;\nexport const AgentLifecycleSchema = z.enum(AgentLifecycleValues);\nexport type AgentLifecycle = z.infer<typeof AgentLifecycleSchema>;\n\n/** JSON Schema (object form) describing a role's input or output. */\nconst JsonSchemaObject = z.record(z.string(), z.unknown());\n\n/** Typed I/O of a role agent, validated by `agent.run`. */\nexport const AgentIoSchema = z.looseObject({\n  input: JsonSchemaObject.optional(),\n  output: JsonSchemaObject.optional(),\n});\nexport type AgentIo = z.infer<typeof AgentIoSchema>;\n\nexport const MemoryScopeValues = [\"instance\", \"user\", \"workspace\"] as const;\nexport const MemoryScopeSchema = z.enum(MemoryScopeValues);\nexport type MemoryScope = z.infer<typeof MemoryScopeSchema>;\n\n/** A named, scoped, bounded text block the host stores and the runner renders. */\nexport const MemoryBlockSchema = z.looseObject({\n  name: z.string().regex(SLOT_ID_PATTERN, \"block name must match [a-z][a-z0-9_-]*\"),\n  scope: MemoryScopeSchema,\n  max_chars: z.number().int().positive(),\n  /** Convention file the block is seeded from (e.g. `SOUL.md`). */\n  source: z.string().min(1).optional(),\n});\nexport type MemoryBlock = z.infer<typeof MemoryBlockSchema>;\n\n/** Top-level memory declaration. Memory is never a `composes:` kind. */\nexport const AgentMemorySchema = z.looseObject({\n  blocks: z.array(MemoryBlockSchema).optional(),\n  /** Hint only; the host decides. */\n  consolidation: z\n    .looseObject({\n      strategy: z.string().min(1),\n      threshold: z.number().int().positive().optional(),\n    })\n    .optional(),\n});\nexport type AgentMemory = z.infer<typeof AgentMemorySchema>;\n\nconst TriggerIdSchema = z.string().regex(SLOT_ID_PATTERN, \"trigger id must match [a-z][a-z0-9_-]*\");\n\n/**\n * Default triggers declared on the asset; an instance may override or extend\n * them by `id`. Triggers are never a `composes:` kind.\n */\nexport const AgentTriggerSchema = z.discriminatedUnion(\"kind\", [\n  z.looseObject({\n    kind: z.literal(\"schedule\"),\n    id: TriggerIdSchema,\n    cron: z.string().min(1),\n    prompt: z.string().min(1),\n    timezone: z.string().min(1).optional(),\n    enabled: z.boolean().optional(),\n  }),\n  z.looseObject({\n    kind: z.literal(\"webhook\"),\n    id: TriggerIdSchema,\n    prompt: z.string().min(1),\n    enabled: z.boolean().optional(),\n  }),\n  z.looseObject({\n    kind: z.literal(\"channel\"),\n    id: TriggerIdSchema,\n    /** Which channel messages fire the trigger (e.g. `mention`). */\n    when: z.string().min(1),\n    prompt: z.string().min(1).optional(),\n    enabled: z.boolean().optional(),\n  }),\n  z.looseObject({\n    kind: z.literal(\"event\"),\n    id: TriggerIdSchema,\n    /** Protocol / host event name (e.g. `session_error`). */\n    event: z.string().min(1),\n    prompt: z.string().min(1).optional(),\n    enabled: z.boolean().optional(),\n  }),\n]);\nexport type AgentTrigger = z.infer<typeof AgentTriggerSchema>;\n\n/** A capability the agent needs at runtime; `connector` is a compose slot id. */\nexport const AgentCapabilityRequirementSchema = z.looseObject({\n  name: z.string().min(1),\n  connector: SlotIdSchema.optional(),\n  required: z.boolean().default(false),\n});\nexport type AgentCapabilityRequirement = z.infer<typeof AgentCapabilityRequirementSchema>;\n\n// ---------------------------------------------------------------------------\n// Deprecated 0.1 inputs — still parsed, each yields a diagnostic\n// (see `agentDeprecationDiagnostics`); none is read for composition.\n// ---------------------------------------------------------------------------\n\n/** @deprecated 0.1 `requires[]` entry; replaced by `composes[{kind: agent}]`. */\nconst DeprecatedRequiresItemSchema = z.looseObject({\n  name: z.string(),\n  source: z.string().optional(),\n  version: z.string().optional(),\n});\n\nexport const AgentManifestSchema = z\n  .looseObject({\n    spec_version: z.string().optional(),\n    name: z.string().min(1),\n    version: z.string().optional(),\n    description: z.string().min(1),\n    extends: z.string().optional(),\n\n    model: ModelConfigSchema.optional(),\n    tools: AgentToolsSchema.optional(),\n    delegation: z.looseObject({ mode: z.string() }).optional(),\n    runtime: z\n      .looseObject({\n        max_turns: z.number().optional(),\n        timeout: z.number().optional(),\n        /** Role instances only: render the harness sub-agent as a background agent. */\n        background: z.boolean().optional(),\n      })\n      .optional(),\n\n    author: z.string().optional(),\n    license: z.string().optional(),\n    tags: z.array(z.string()).optional(),\n    keywords: z.array(z.string()).optional(),\n\n    // spec 0.2\n    /** Default `standing`. */\n    lifecycle: AgentLifecycleSchema.optional(),\n    /** Required when `lifecycle: role`. */\n    io: AgentIoSchema.optional(),\n    memory: AgentMemorySchema.optional(),\n    triggers: z.array(AgentTriggerSchema).optional(),\n    capabilities: z.array(AgentCapabilityRequirementSchema).optional(),\n    composes: z.array(AgentComposeItemSchema).optional(),\n\n    metadata: z.record(z.string(), z.unknown()).optional(),\n\n    // Deprecated 0.1 inputs.\n    /** @deprecated Use `composes[{kind: skill}]`. */\n    skills: z.array(z.string()).optional(),\n    /** @deprecated Use `composes[{kind: skill}]`. */\n    abilities: z.array(z.string()).optional(),\n    /** @deprecated Use `composes[{kind: contract}]`. */\n    contracts: z.array(z.string()).optional(),\n    /** @deprecated Use `composes[{kind: persona}]`. */\n    persona: z.array(z.string()).optional(),\n    /** @deprecated Use `composes[{kind: ruleset}]`. */\n    rules: z.array(z.string()).optional(),\n    /** @deprecated Use `composes[{kind: knowledge}]`. */\n    knowledge: z.array(z.string()).optional(),\n    /** @deprecated Use `composes[{kind: agent}]`. */\n    requires: z.array(DeprecatedRequiresItemSchema).optional(),\n  })\n  .superRefine((manifest, ctx) => {\n    if (manifest.lifecycle === \"role\" && manifest.io === undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"io\"],\n        message: 'lifecycle \"role\" requires an io block ({ input, output } JSON Schemas)',\n      });\n    }\n    addDuplicateIssues(\n      ctx,\n      \"triggers\",\n      (manifest.triggers ?? []).map((t) => t.id),\n      \"trigger id\",\n    );\n    addDuplicateIssues(\n      ctx,\n      \"memory.blocks\",\n      (manifest.memory?.blocks ?? []).map((b) => b.name),\n      \"memory block name\",\n    );\n    (manifest.triggers ?? []).forEach((trigger, i) => {\n      if (trigger.kind !== \"schedule\") return;\n      const problem = cronProblem(trigger.cron);\n      if (problem) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"triggers\", i, \"cron\"],\n          message: `cron \"${trigger.cron}\" is not a valid cron expression: ${problem}`,\n        });\n      }\n    });\n    // A capability's `connector` names a slot some composes item declares by `id`.\n    const slotIds = new Set<string>();\n    for (const item of manifest.composes ?? []) {\n      if (item.id !== undefined && Object.hasOwn(SLOT_ID_REQUIRED_KINDS, item.kind)) {\n        slotIds.add(item.id);\n      }\n    }\n    (manifest.capabilities ?? []).forEach((cap, i) => {\n      if (cap.connector === undefined || slotIds.has(cap.connector)) return;\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"capabilities\", i, \"connector\"],\n        message:\n          `capability \"${cap.name}\" names connector slot \"${cap.connector}\", but no composes item ` +\n          `of kind connector or mcp-server has id \"${cap.connector}\"` +\n          (slotIds.size > 0 ? ` (declared slots: ${[...slotIds].join(\", \")})` : \"\"),\n      });\n    });\n    // An agent cannot compose itself: it would resolve to its own sub-agent forever.\n    (manifest.composes ?? []).forEach((item, i) => {\n      if (item.kind !== \"agent\") return;\n      const target = composeRefTarget(item);\n      if (target?.type !== \"asset\" || target.kind !== \"agent\" || target.name !== manifest.name) {\n        return;\n      }\n      const publisher = (manifest as Record<string, unknown>).publisher;\n      if (\n        target.publisher !== undefined &&\n        typeof publisher === \"string\" &&\n        target.publisher !== publisher\n      ) {\n        return;\n      }\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"composes\", i, \"ref\"],\n        message: `agent \"${manifest.name}\" composes itself (${item.ref}); an agent cannot be its own sub-agent`,\n      });\n    });\n  });\n\nfunction addDuplicateIssues(\n  ctx: z.RefinementCtx,\n  field: string,\n  values: readonly string[],\n  label: string,\n): void {\n  const seen = new Set<string>();\n  values.forEach((value, i) => {\n    if (seen.has(value)) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [...field.split(\".\"), i],\n        message: `duplicate ${label} \"${value}\"`,\n      });\n    }\n    seen.add(value);\n  });\n}\n\nexport type AgentManifest = z.infer<typeof AgentManifestSchema>;\n\nexport function validateAgent(data: unknown): ManifestValidationResult<AgentManifest> {\n  return validateManifest(AgentManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { FieldSchema, type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const ConnectorManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  entry: z.string().min(1),\n  npm_deps: z\n    .object({\n      required: z.array(z.string()).optional(),\n      optional: z.array(z.string()).optional(),\n    })\n    .optional(),\n  fields: z.array(FieldSchema).optional(),\n  health_check: z.string().nullable().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n});\n\nexport type ConnectorManifest = z.infer<typeof ConnectorManifestSchema>;\n\nexport function validateConnector(data: unknown): ManifestValidationResult<ConnectorManifest> {\n  return validateManifest(ConnectorManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  ArtifactRefSchema,\n  CommonMetadataSchema,\n  FilePrerequisiteSchema,\n  type ManifestValidationResult,\n  UserInputSchema,\n  validateManifest,\n} from \"./_shared.js\";\n\nconst SkillMetadataSchema = CommonMetadataSchema.extend({\n  parameters: z.record(z.string(), z.unknown()).optional(),\n  artifacts: z\n    .object({\n      requires: z.array(ArtifactRefSchema).optional(),\n      produces: z.array(ArtifactRefSchema).optional(),\n      consumes: z.array(ArtifactRefSchema).optional(),\n    })\n    .optional(),\n  prerequisites: z\n    .object({\n      files: z.array(FilePrerequisiteSchema).optional(),\n      inputs_required: z.array(UserInputSchema).optional(),\n      inputs_optional: z.array(UserInputSchema).optional(),\n      // Parsed by the resolver's parseSkillRequirements; Zod would strip them otherwise.\n      reads: z.array(z.object({ path: z.string(), description: z.string().optional() })).optional(),\n      produces: z\n        .array(z.object({ path: z.string(), description: z.string().optional() }))\n        .optional(),\n      resources: z\n        .array(\n          z.object({\n            id: z.string(),\n            operations: z.array(z.string()).optional(),\n            optional: z.boolean().optional(),\n            description: z.string().optional(),\n          }),\n        )\n        .optional(),\n      connectors: z\n        .array(\n          z.object({\n            driver: z.string(),\n            access: z.enum([\"read-only\", \"read-write\"]).optional(),\n          }),\n        )\n        .optional(),\n    })\n    .optional(),\n  produces: z.array(z.object({ path: z.string(), description: z.string().optional() })).optional(),\n});\n\n/**\n * Prefix `skaile library create` writes into a new skill's `description`. The\n * Agent Skills spec requires a real description (what the skill does and when\n * to use it), so a description that still starts with this marker is rejected.\n */\nexport const SKILL_DESCRIPTION_PLACEHOLDER_PREFIX = \"TODO:\";\n\n/** Full placeholder description the scaffold writes when `--description` is omitted. */\nexport const SKILL_DESCRIPTION_PLACEHOLDER = `${SKILL_DESCRIPTION_PLACEHOLDER_PREFIX} describe what this skill does and when to use it.`;\n\n/** Body the scaffold writes into a new SKILL.md; an untouched body is a lint warning. */\nexport const SKILL_BODY_PLACEHOLDER = \"Skill prompt goes here.\";\n\nexport const SkillManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z\n    .string()\n    .refine((d) => d.trim().length > 0, {\n      message:\n        \"description is empty — say what the skill does and when to use it (Agent Skills spec: 1–1024 chars)\",\n    })\n    .refine((d) => !d.trim().startsWith(SKILL_DESCRIPTION_PLACEHOLDER_PREFIX), {\n      message: `description is still the scaffold placeholder (${SKILL_DESCRIPTION_PLACEHOLDER_PREFIX} …) — say what the skill does and when to use it`,\n    }),\n  version: z.string().optional(),\n  license: z.string().optional(),\n  compatibility: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  // agentskills.io standard field. Kept as `unknown` (not `string`) so a legacy\n  // array form never hard-fails validateSkill — the string-typing rule is\n  // advisory, owned by checkAgentSkillConformance (warn, not error).\n  \"allowed-tools\": z.unknown().optional(),\n\n  // Legacy fields (SKILL.md convention)\n  source: z.string().optional(),\n  user_inputs: z.array(UserInputSchema).optional(),\n  reads_from: z.array(z.string()).optional(),\n  writes_to: z.array(z.string()).optional(),\n\n  metadata: SkillMetadataSchema.optional(),\n});\n\nexport type SkillManifest = z.infer<typeof SkillManifestSchema>;\n\nexport function validateSkill(data: unknown): ManifestValidationResult<SkillManifest> {\n  return validateManifest(SkillManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\n/** Body the scaffold writes into a new `CONTRACT.md`; an untouched body is a lint warning. */\nexport const CONTRACT_BODY_PLACEHOLDER = \"Contract goes here.\";\n\nexport const ContractManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type ContractManifest = z.infer<typeof ContractManifestSchema>;\n\nexport function validateContract(data: unknown): ManifestValidationResult<ContractManifest> {\n  return validateManifest(ContractManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\nexport const McpServerManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.union([z.string(), z.number()]).optional(),\n  // \"http\" is the runtime literal the runner honours (StreamableHTTPClientTransport);\n  // \"streamable-http\" is accepted as an MCP-spec-aligned alias and normalized to\n  // \"http\" in mcpDeclFromCatalogEntry. Keep both until the alias is retired.\n  transport: z.enum([\"stdio\", \"sse\", \"http\", \"streamable-http\"]).optional(),\n  command: z.string().optional(),\n  args: z.array(z.string()).optional(),\n  env: z.record(z.string(), z.string()).optional(),\n  url: z.string().optional(),\n  headers: z.record(z.string(), z.string()).optional(),\n  /** Remote only: PEM CA certificate (or a secret ref to one) pinned for this server's TLS. */\n  ca: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  // Optional runnable payload fetched + sha256-verified by the platform\n  // session-materializer into the asset dir at materialize time (e.g. a bundled\n  // server.js shipped as a GitHub release asset). `dest` defaults to the URL\n  // basename.\n  payload: z\n    .object({\n      // https only — bare `z.string().url()` also accepts file:/data:/javascript: schemes.\n      url: z\n        .string()\n        .url()\n        .refine((u) => u.startsWith(\"https://\"), { message: \"payload url must be https\" }),\n      sha256: z.string().regex(/^[a-f0-9]{64}$/),\n      // Plain filename, no path separators — schema-level guard against a traversal dest.\n      dest: z\n        .string()\n        .regex(/^[^/\\\\]+$/, { message: \"dest must be a plain filename, not a path\" })\n        .refine((d) => d !== \".\" && d !== \"..\", { message: \"dest must be a plain filename\" })\n        .optional(),\n    })\n    .optional(),\n});\n\nexport type McpServerManifest = z.infer<typeof McpServerManifestSchema>;\n\nexport function validateMcpServer(data: unknown): ManifestValidationResult<McpServerManifest> {\n  return validateManifest(McpServerManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\n/** Body the scaffold writes into a new `<name>.prompt.md`; an untouched body is a lint warning. */\nexport const PROMPT_BODY_PLACEHOLDER = \"Prompt goes here.\";\n\nexport const PromptManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type PromptManifest = z.infer<typeof PromptManifestSchema>;\n\nexport function validatePrompt(data: unknown): ManifestValidationResult<PromptManifest> {\n  return validateManifest(PromptManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const PersonaManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type PersonaManifest = z.infer<typeof PersonaManifestSchema>;\n\nexport function validatePersona(data: unknown): ManifestValidationResult<PersonaManifest> {\n  return validateManifest(PersonaManifestSchema, data);\n}\n","/**\n * Polymorphic Preset manifest schema.\n *\n * A Preset is the unified composition + configuration primitive. Items can be:\n * - Asset ref (plain or with inline config + placeholders)\n * - Library Instance ref (`library://tier/instances/id`)\n * - Nested Preset ref (resolved recursively, max depth 3)\n *\n * Apply semantics derive from ref type, not an explicit mode field.\n */\nimport * as z from \"zod\";\nimport { type ManifestValidationResult, validateManifest } from \"./_shared.js\";\n\n// ---------------------------------------------------------------------------\n// Placeholder types\n// ---------------------------------------------------------------------------\n\nconst PlaceholderTypeValues = [\n  \"text\",\n  \"multiline\",\n  \"secret\",\n  \"number\",\n  \"boolean\",\n  \"enum\",\n  \"oauth\",\n  \"instance-picker\",\n] as const;\n\nexport const PlaceholderTypeSchema = z.enum(PlaceholderTypeValues);\n\nexport const PlaceholderSchema = z.object({\n  key: z.string().min(1),\n  prompt: z.string().optional(),\n  type: PlaceholderTypeSchema.optional(),\n  required: z.boolean().optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Compose item (for agents within presets)\n// ---------------------------------------------------------------------------\n\nconst ComposeRefSchema = z.object({\n  kind: z.string().min(1),\n  ref: z.string().min(1),\n});\n\n// ---------------------------------------------------------------------------\n// Preset item\n// ---------------------------------------------------------------------------\n\nexport const PresetItemSchema = z.looseObject({\n  /** Asset ref, Library Instance ref, or nested Preset ref. */\n  ref: z.string().min(1),\n  /** Local item ID for cross-item references (#item-id). */\n  id: z.string().optional(),\n  /** Author-prefilled non-secret config values. */\n  config: z.record(z.string(), z.unknown()).optional(),\n  /** User/secret values prompted at install. */\n  placeholders: z.array(PlaceholderSchema).optional(),\n  /** How placeholder values fold into the Instance config. */\n  materialize: z.record(z.string(), z.string()).optional(),\n  /** Composition for agent items. */\n  composes: z.array(ComposeRefSchema).optional(),\n  /** Outer-Preset-author-supplied placeholder values for nested Presets. */\n  inputs: z.record(z.string(), z.unknown()).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Preset-level input (rare, shared across items)\n// ---------------------------------------------------------------------------\n\nconst PresetInputSchema = z.object({\n  key: z.string().min(1),\n  type: PlaceholderTypeSchema.optional(),\n  prompt: z.string().optional(),\n  required: z.boolean().optional(),\n  values: z.array(z.union([z.string(), z.number()])).optional(),\n  default: z.union([z.string(), z.number(), z.boolean()]).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Source (git repo backing non-factory dependencies)\n// ---------------------------------------------------------------------------\n\n/**\n * A `{url, pin?, publisher?}` source the preset's dependencies resolve from (mirrors\n * `SourceEntry`); `publisher` is the one a non-GitHub source needs.\n */\nexport const PresetSourceSchema = z.object({\n  url: z.string().min(1),\n  pin: z.string().optional(),\n  publisher: z.string().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Scaffold placeholders (`library create preset`)\n// ---------------------------------------------------------------------------\n\n/** The `description:` `library create preset` writes when `--description` is omitted. */\nexport const PRESET_DESCRIPTION_PLACEHOLDER = \"A curated set of assets\";\n\n/** The single item ref `library create preset` writes; it names no real publisher or skill. */\nexport const PRESET_ITEM_PLACEHOLDER_REF = \"skill:@your-publisher/example-skill\";\n\n// ---------------------------------------------------------------------------\n// Preset manifest\n// ---------------------------------------------------------------------------\n\nexport const PresetManifestSchema = z.looseObject({\n  publisher: z.string().optional(),\n  name: z.string().min(1),\n  version: z.union([z.string(), z.number()]).default(\"0.1.0\"),\n  description: z.string().min(1),\n  category: z.string().optional(),\n  license: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n\n  /** 1+ polymorphic items. */\n  items: z.array(PresetItemSchema).min(1),\n\n  /** Preset-level inputs shared across items (rare). */\n  inputs: z.array(PresetInputSchema).optional(),\n\n  /** Git sources the dependency items resolve from; `apply` registers these first. */\n  sources: z.array(PresetSourceSchema).optional(),\n});\n\nexport type PresetManifest = z.infer<typeof PresetManifestSchema>;\nexport type PresetItem = z.infer<typeof PresetItemSchema>;\nexport type PresetSource = z.infer<typeof PresetSourceSchema>;\nexport type Placeholder = z.infer<typeof PlaceholderSchema>;\n\nexport function validatePreset(data: unknown): ManifestValidationResult<PresetManifest> {\n  return validateManifest(PresetManifestSchema, data);\n}\n","import * as z from \"zod\";\nimport {\n  CommonMetadataSchema,\n  type ManifestValidationResult,\n  validateManifest,\n} from \"./_shared.js\";\n\nexport const RulesetManifestSchema = z.looseObject({\n  name: z.string().min(1),\n  description: z.string().min(1),\n  version: z.string().optional(),\n  keywords: z.array(z.string()).optional(),\n  license: z.string().optional(),\n  metadata: CommonMetadataSchema.optional(),\n});\n\nexport type RulesetManifest = z.infer<typeof RulesetManifestSchema>;\n\nexport function validateRuleset(data: unknown): ManifestValidationResult<RulesetManifest> {\n  return validateManifest(RulesetManifestSchema, data);\n}\n"]}

package/dist/{chunk-UK3LRPJ5.js → chunk-MKTJZLQM.js}

@@ -1,8 +1,8 @@
-import { resolveSkWorkspaceConfig } from './chunk-CAPKENNF.js';
-import { parseFrontmatter } from './chunk-M3P4BYRK.js';
+import { resolveSkWorkspaceConfig, localConnectorMountDir } from './chunk-J76LDUDS.js';
+import { parseFrontmatter } from './chunk-SP5NGNBV.js';
 import { createLogger } from './chunk-BOFL7GIF.js';
-import { join, resolve } from 'path';
 import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
+import { join } from 'path';
 
 // connectors/src/connector-types.ts
 function readUnavailableMarker(value) {
@@ -377,11 +377,6 @@ function withMaterializedConnectorDeclarations(base, projectDir) {
   }
   return [...byId.values()];
 }
-function localMountDir(c, projectDir) {
-  const raw = c.mountPath ?? c.params?.mountPath;
-  if (typeof raw !== "string" || raw.trim() === "") return void 0;
-  return resolve(projectDir, raw.trim().replaceAll("${project}", projectDir));
-}
 function workspaceConnectorToDeclaration(c, projectDir) {
   const decl = {
     id: c.id,
@@ -403,7 +398,7 @@ function workspaceConnectorToDeclaration(c, projectDir) {
       accessTokenTTL: c.mount.accessTokenTTL
     };
   } else if (c.driver === "local") {
-    const source = localMountDir(c, projectDir);
+    const source = localConnectorMountDir(c, projectDir);
     if (source) decl.mount = { source };
   }
   return decl;
@@ -504,5 +499,5 @@ function resolveAuthRef(auth, mountId) {
 }
 
 export { ConnectorFieldMissingError, ConnectorStartupError, EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, deriveSingleMaterializedConnectorDeclaration, fromMaterializedConnectorMd, isKnownSecretRef, loadConnectorDeclarations, loadMaterializedConnectorDeclarations, loadYamlConnectorDeclarations, readUnavailableMarker, resolveAuthRef, resolveBackendAuthFor, resolvedConfigToDeclarations, withMaterializedConnectorDeclarations };
-//# sourceMappingURL=chunk-UK3LRPJ5.js.map
-//# sourceMappingURL=chunk-UK3LRPJ5.js.map
+//# sourceMappingURL=chunk-MKTJZLQM.js.map
+//# sourceMappingURL=chunk-MKTJZLQM.js.map