@skaile/workspaces 5.15.0 → 5.16.0

package/dist/chunk-FWAJUWXQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../cli/src/type-guards.ts","../cli/src/commands/validate-instances.ts","../cli/src/commands/validate.ts"],"names":["path","fs","parseYaml","err","parsed","a","c"],"mappings":";;;;;;;;;;;;;;;;;;;;;AACO,SAAS,SAAS,KAAA,EAAkD;AACzE,EAAA,OAAO,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACqBA,IAAM,mBAAA,GAAsB,YAAA;AAG5B,IAAM,uBAAA,GAAuF;AAAA,EAC3F,QAAA,EAAU,CAAC,MAAA,EAAQ,QAAQ,CAAA;AAAA,EAC3B,OAAA,EAAS,CAAC,QAAQ,CAAA;AAAA,EAClB,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,EAChB,KAAA,EAAO,CAAC,OAAO;AACjB,CAAA;AAEA,IAAM,GAAA,GAAM,CAAC,IAAA,EAAc,OAAA,EAAiB,EAAA,MAA4B;AAAA,EACtE,IAAA;AAAA,EACA,QAAA,EAAU,OAAA;AAAA,EACV,OAAA;AAAA,EACA,IAAA,EAAM;AACR,CAAA,CAAA;AAaA,SAAS,eAAe,QAAA,EAA+C;AACrE,EAAA,MAAM,KAAA,GAAoB;AAAA,IACxB,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,KAAA,EAAO,QAAA,CAAS,EAAA,KAAO,MAAA,IAAa,SAAS,EAAA,KAAO,IAAA;AAAA,IACpD,gBAAgB,EAAC;AAAA,IACjB,YAAY,EAAC;AAAA,IACb,YAAY;AAAC,GACf;AACA,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAM,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA,GAAI,QAAA,CAAS,QAAA,GAAW,EAAC,EAAG;AAC5E,IAAA,IAAI,CAAC,QAAA,CAAS,IAAI,KAAK,OAAO,IAAA,CAAK,OAAO,QAAA,EAAU;AACpD,IAAA,CAAC,IAAA,CAAK,SAAS,WAAA,GAAc,KAAA,CAAM,iBAAiB,KAAA,CAAM,UAAA,EAAY,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA;AAAA,EACpF;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA,GAAI,QAAA,CAAS,QAAA,GAAW,EAAC,EAAG;AACzE,IAAA,IAAI,QAAA,CAAS,CAAC,CAAA,IAAK,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,EAAU,KAAA,CAAM,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,EAAE,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,SAAA,CACP,UAAA,EACA,EAAA,EACA,GAAA,EACoD;AACpD,EAAA,MAAM,EAAA,GAAK,UAAU,EAAE,CAAA,IAAA,CAAA;AACvB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,yBAAA,CAA0B,YAAY,GAAG,CAAA;AAAA,EACjD,SAAS,CAAA,EAAG;AACV,IAAA,IAAI,EAAE,CAAA,YAAa,uBAAA,CAAA,EAA0B,MAAM,CAAA;AACnD,IAAA,OAAO,EAAE,UAAA,EAAY,GAAA,CAAI,sBAAA,EAAwB,CAAA,OAAA,EAAU,EAAE,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAA,EAAI,EAAE,CAAA,EAAE;AAAA,EACrF;AACA,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,GAAA;AAAA,QACV,sBAAA;AAAA,QACA,CAAA,OAAA,EAAU,EAAE,CAAA,OAAA,EAAU,GAAG,CAAA,qEAAA,CAAA;AAAA,QACzB;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GAAeA,KAAA,CAAK,IAAA,CAAK,GAAA,EAAK,mBAAmB,CAAA;AACvD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAOC,GAAA,CAAG,YAAA,CAAa,YAAA,EAAc,OAAO,CAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,GAAA;AAAA,QACV,sBAAA;AAAA,QACA,UAAU,EAAE,CAAA,OAAA,EAAU,GAAG,CAAA,cAAA,EAAiB,GAAG,kBAAkB,mBAAmB,CAAA,CAAA;AAAA,QAClF;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAWC,MAAU,IAAI,CAAA;AAAA,EAC3B,SAAS,CAAA,EAAG;AACV,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,GAAA;AAAA,QACV,wBAAA;AAAA,QACA,CAAA,OAAA,EAAU,EAAE,CAAA,EAAA,EAAK,YAAY,CAAA,oBAAA,EAAuB,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAA;AAAA,QAC9F;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,QAAQ,CAAA,EAAG;AACvB,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,GAAA;AAAA,QACV,wBAAA;AAAA,QACA,CAAA,OAAA,EAAU,EAAE,CAAA,EAAA,EAAK,YAAY,CAAA,iBAAA,CAAA;AAAA,QAC7B;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,KAAA,EAAO,cAAA,CAAe,QAAQ,CAAA,EAAE;AAC3C;AAOA,SAAS,aAAA,CACP,EAAA,EACA,QAAA,EACA,eAAA,EACc;AACd,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,OAAA,EAAS,CAAA,KAAM;AAC/B,IAAA,MAAM,EAAA,GAAK,CAAA,OAAA,EAAU,EAAE,CAAA,UAAA,EAAa,CAAC,CAAA,CAAA,CAAA;AACrC,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,EAAE,CAAA,EAAG;AACxB,MAAA,GAAA,CAAI,IAAA;AAAA,QACF,GAAA;AAAA,UACE,yBAAA;AAAA,UACA,CAAA,OAAA,EAAU,EAAE,CAAA,cAAA,EAAiB,OAAA,CAAQ,EAAE,CAAA,mBAAA,CAAA;AAAA,UACvC,GAAG,EAAE,CAAA,GAAA;AAAA;AACP,OACF;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,QAAQ,EAAE,CAAA;AACnB,IAAA,IAAI,CAAC,eAAA,IAAmB,eAAA,CAAgB,QAAA,CAAS,OAAA,CAAQ,EAAE,CAAA,EAAG;AAC9D,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,GAAA,CAAI,IAAA;AAAA,QACF,GAAA;AAAA,UACE,uBAAA;AAAA,UACA,CAAA,OAAA,EAAU,EAAE,CAAA,WAAA,EAAc,OAAA,CAAQ,EAAE,CAAA,sCAAA,EAAyC,eAAA,CAAgB,MAAA,GAAS,CAAA,GAAI,QAAQ,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAC,KAAK,yBAAyB,CAAA,mEAAA,CAAA;AAAA,UAC1K,GAAG,EAAE,CAAA,GAAA;AAAA;AACP,OACF;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,uBAAA,CAAwB,OAAA,CAAQ,IAAI,CAAA,CAAE,MAAA;AAAA,MACpD,CAAC,KAAA,KAAW,OAAA,CAA+C,KAAK,CAAA,KAAM;AAAA,KACxE;AACA,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,GAAA,CAAI,IAAA;AAAA,QACF,GAAA;AAAA,UACE,0BAAA;AAAA,UACA,CAAA,OAAA,EAAU,EAAE,CAAA,WAAA,EAAc,OAAA,CAAQ,EAAE,CAAA,QAAA,EAAW,OAAA,CAAQ,IAAI,CAAA,0CAAA,EAA6C,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,UAC1H;AAAA;AACF,OACF;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACD,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,eAAA,CACP,EAAA,EACA,QAAA,EACA,KAAA,EACA,YAAA,EACc;AACd,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,WAAW,CAAA,IAAK,MAAA,CAAO,QAAQ,QAAA,CAAS,UAAA,IAAc,EAAE,CAAA,EAAG;AAC3E,IAAA,MAAM,EAAA,GAAK,CAAA,OAAA,EAAU,EAAE,CAAA,YAAA,EAAe,IAAI,CAAA,CAAA;AAC1C,IAAA,IAAI,CAAC,KAAA,CAAM,cAAA,CAAe,QAAA,CAAS,IAAI,CAAA,EAAG;AACxC,MAAA,MAAM,OAAO,KAAA,CAAM,UAAA,CAAW,SAAS,IAAI,CAAA,GACvC,IAAI,IAAI,CAAA,mCAAA,CAAA,GACR,MAAM,cAAA,CAAe,MAAA,GAAS,IAC5B,CAAA,iCAAA,EAAoC,KAAA,CAAM,eAAe,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GACnE,uCAAA;AACN,MAAA,GAAA,CAAI,IAAA;AAAA,QACF,GAAA;AAAA,UACE,8BAAA;AAAA,UACA,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,IAAI,mDAAmD,IAAI,CAAA,CAAA,CAAA;AAAA,UACvF;AAAA;AACF,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,WAAW,CAAA,EAAG;AACvC,MAAA,GAAA,CAAI,IAAA;AAAA,QACF,GAAA;AAAA,UACE,yBAAA;AAAA,UACA,UAAU,EAAE,CAAA,aAAA,EAAgB,IAAI,CAAA,YAAA,EAAe,WAAW,CAAA,2CAAA,EAA8C,YAAA,CAAa,MAAA,GAAS,CAAA,GAAI,UAAU,YAAA,CAAa,IAAA,CAAK,IAAI,CAAC,MAAM,EAAE,CAAA,CAAA;AAAA,UAC3K;AAAA;AACF,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,mBAAA,CACd,YACA,MAAA,EACc;AACd,EAAA,MAAM,cAA4B,EAAC;AACnC,EAAA,MAAM,SAAA,GAAY,uBAAA,CAAwB,MAAA,CAAO,MAAA,EAAQ,WAAW,CAAA;AACpE,EAAA,MAAM,QAAQ,QAAA,CAAS,MAAA,CAAO,KAAK,CAAA,GAAI,OAAO,KAAA,GAAQ,MAAA;AACtD,EAAA,WAAA,CAAY,IAAA,CAAK,GAAG,wBAAA,CAAyB,MAAA,CAAO,KAAK,CAAC,CAAA;AAC1D,EAAA,IAAI,KAAA,EAAO,cAAc,MAAA,EAAW;AAClC,IAAA,WAAA,CAAY,IAAA;AAAA,MACV,GAAA;AAAA,QACE,yBAAA;AAAA,QACA,iIAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,IAAI,KAAA,EAAO,cAAc,MAAA,EAAW;AAClC,IAAA,WAAA,CAAY,IAAA;AAAA,MACV,GAAA;AAAA,QACE,2BAAA;AAAA,QACA,0FAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,WAAA,CAAY,IAAA;AAAA,IACV,GAAG,wBAAA,CAAyB;AAAA,MAC1B,KAAA,EAAO;AAAA,QACL,YAAY,OAAO,KAAA,EAAO,UAAA,KAAe,QAAA,GAAW,MAAM,UAAA,GAAa,MAAA;AAAA,QACvE;AAAA;AACF,KACD;AAAA,GACH;AACA,EAAA,IAAI,CAAC,WAAW,OAAO,WAAA;AAEvB,EAAA,MAAM,YAAA,GAAA,CAAgB,MAAM,OAAA,CAAQ,MAAA,CAAO,UAAU,CAAA,GAAI,MAAA,CAAO,UAAA,GAAa,EAAC,EAAG,OAAA;AAAA,IAAQ,CAAC,CAAA,KACxF,QAAA,CAAS,CAAC,CAAA,IAAK,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,GAAW,CAAC,CAAA,CAAE,EAAE,IAAI;AAAC,GACtD;AAEA,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtD,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,UAAA,EAAY,EAAA,EAAI,SAAS,GAAG,CAAA;AACrD,IAAA,IAAI,gBAAgB,MAAA,EAAQ;AAE1B,MAAA,WAAA,CAAY,IAAA,CAAK,MAAA,CAAO,UAAA,EAAY,GAAG,aAAA,CAAc,EAAA,EAAI,QAAA,CAAS,QAAA,IAAY,EAAC,EAAG,MAAS,CAAC,CAAA;AAC5F,MAAA;AAAA,IACF;AACA,IAAA,MAAM,EAAE,OAAM,GAAI,MAAA;AAClB,IAAA,MAAM,SAAA,GAAY,QAAA,CAAS,SAAA,IAAa,KAAA,CAAM,SAAA,IAAa,UAAA;AAC3D,IAAA,IAAI,SAAA,KAAc,MAAA,IAAU,CAAC,KAAA,CAAM,KAAA,EAAO;AACxC,MAAA,WAAA,CAAY,IAAA;AAAA,QACV,GAAA;AAAA,UACE,uBAAA;AAAA,UACA,UAAU,EAAE,CAAA,2FAAA,CAAA;AAAA,UACZ,UAAU,EAAE,CAAA,UAAA;AAAA;AACd,OACF;AAAA,IACF;AACA,IAAA,WAAA,CAAY,KAAK,GAAG,eAAA,CAAgB,IAAI,QAAA,EAAU,KAAA,EAAO,YAAY,CAAC,CAAA;AACtE,IAAA,WAAA,CAAY,IAAA,CAAK,GAAG,aAAA,CAAc,EAAA,EAAI,QAAA,CAAS,YAAY,EAAC,EAAG,KAAA,CAAM,UAAU,CAAC,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,WAAA;AACT;;;AC/NA,IAAM,cAAA,GAA2D;AAAA,EAC/D,EAAE,OAAA,EAAS,cAAA,EAAgB,IAAA,EAAM,OAAA,EAAQ;AAAA,EACzC,EAAE,OAAA,EAAS,gBAAA,EAAkB,IAAA,EAAM,OAAA,EAAQ;AAAA,EAC3C,EAAE,OAAA,EAAS,cAAA,EAAgB,IAAA,EAAM,OAAA,EAAQ;AAAA,EACzC,EAAE,OAAA,EAAS,iBAAA,EAAmB,IAAA,EAAM,UAAA,EAAW;AAAA,EAC/C,EAAE,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,MAAA,EAAO;AAAA,EACzC,EAAE,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,MAAA,EAAO;AAAA,EACzC,EAAE,OAAA,EAAS,kBAAA,EAAoB,IAAA,EAAM,WAAA,EAAY;AAAA,EACjD,EAAE,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,QAAA,EAAS;AAAA,EAC3C,EAAE,OAAA,EAAS,YAAA,EAAc,IAAA,EAAM,YAAA,EAAa;AAAA,EAC5C,EAAE,OAAA,EAAS,oBAAA,EAAsB,IAAA,EAAM,WAAA,EAAY;AAAA,EACnD,EAAE,OAAA,EAAS,2BAAA,EAA6B,IAAA,EAAM,WAAA,EAAY;AAAA,EAC1D,EAAE,OAAA,EAAS,iBAAA,EAAmB,IAAA,EAAM,QAAA;AACtC,CAAA;AAOA,IAAM,+BAAoC,IAAI,GAAA,CAAI,CAAC,SAAA,EAAW,QAAA,EAAU,MAAM,CAAC,CAAA;AAE/E,IAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EACxB,cAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,aAAA;AAAA,EACA,GAAG;AACL,CAAC,CAAA;AAQD,SAAS,uBAAuB,QAAA,EAAuC;AACrE,EAAA,MAAM,aAAkC,EAAC;AAEzC,EAAA,SAAS,KAAK,GAAA,EAAmB;AAC/B,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAUD,IAAG,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAM,QAAA,GAAWD,KAAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA;AAC1C,MAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,QAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,MAAM,IAAI,CAAA,OAAQ,QAAQ,CAAA;AAAA,MAC/C,CAAA,MAAA,IAAW,KAAA,CAAM,MAAA,EAAO,EAAG;AACzB,QAAA,KAAA,MAAW,QAAQ,cAAA,EAAgB;AACjC,UAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC/B,YAAA,UAAA,CAAW,KAAK,EAAE,QAAA,EAAU,UAAU,IAAA,EAAM,IAAA,CAAK,MAAM,CAAA;AACvD,YAAA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAA,CAAK,QAAQ,CAAA;AACb,EAAA,OAAO,UAAA;AACT;AAQA,SAAS,sBAAA,CACP,GACA,OAAA,EACuE;AACvE,EAAA,MAAM,OAAA,GAAUC,GAAAA,CAAG,YAAA,CAAa,CAAA,CAAE,UAAU,OAAO,CAAA;AACnD,EAAA,MAAM,GAAA,GAAM,iBAAA,CAAkB,CAAA,CAAE,QAAA,EAAU,OAAO,CAAA;AACjD,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAA,CAAO,CAAA,EAAGD,KAAAA,CAAK,QAAA,CAAS,OAAA,EAAS,CAAA,CAAE,QAAQ,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,IAAI,CAAA,sBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACvF,IAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AAAA,EACzB;AACA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,QAAQ,GAAA,CAAI,IAAA;AAAA,IACZ,IAAA,EAAM,aAAA,CAAc,CAAA,CAAE,QAAA,EAAU,OAAO;AAAA,GACzC;AACF;AAMA,SAAS,cAAc,OAAA,EAAyB;AAC9C,EAAA,KAAA,IAAS,MAAM,OAAA,IAAW,GAAA,GAAMA,KAAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,EAAG;AACjD,IAAA,IAAIC,GAAAA,CAAG,WAAWD,KAAAA,CAAK,IAAA,CAAK,KAAK,wBAAwB,CAAC,GAAG,OAAO,GAAA;AACpE,IAAA,IAAIA,KAAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,KAAK,OAAO,OAAA;AAAA,EACxC;AACF;AAMA,SAAS,0BACP,CAAA,EACA,MAAA,EACA,MACA,OAAA,EACA,QAAA,EACA,mBACA,WAAA,EACsC;AACtC,EAAA,MAAM,OAAA,GAAUA,KAAAA,CAAK,QAAA,CAAS,OAAA,EAAS,EAAE,QAAQ,CAAA;AACjD,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI,QAAA,GAAW,CAAA;AAKf,EAAA,MAAM,UAAUA,KAAAA,CAAK,QAAA,CAASA,MAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAC,CAAA;AACtD,EAAA,MAAM,OAAA,GAAU,UAAA;AAAA,IACd,CAAA,CAAE,IAAA;AAAA,IACD,UAAU,EAAC;AAAA,IACZ,IAAA;AAAA,IACA,OAAA;AAAA,IACA,QAAA;AAAA,IACAC,GAAAA,CAAG,YAAA,CAAa,CAAA,CAAE,QAAA,EAAU,OAAO,CAAA;AAAA,IACnCD,KAAAA,CAAK,QAAA,CAAS,CAAA,CAAE,QAAQ,CAAA;AAAA,IACxB,EAAE,GAAA,EAAKA,KAAAA,CAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,EAAG,WAAA,EAAa,aAAA,CAAc,OAAO,CAAA,EAAG,WAAA;AAAY,GACpF;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,MAAA,EAAQ;AAC9B,IAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,CAAA,CAAE,GAAG,CAAA,SAAA,EAAO,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAC1C,IAAA,MAAA,EAAA;AAAA,EACF;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,UAAA,EAAY;AAClC,IAAA,MAAM,IAAA,GAAO,GAAG,OAAO,CAAA,EAAA,EAAK,EAAE,GAAG,CAAA,SAAA,EAAO,EAAE,IAAI,CAAA,CAAA;AAE9C,IAAA,IAAK,CAAA,CAAE,WAAA,IAAe,iBAAA,IAAsB,CAAA,CAAE,YAAA,EAAc;AAC1D,MAAA,MAAA,CAAO,IAAI,CAAA;AACX,MAAA,MAAA,EAAA;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA,QAAA,EAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC5B;AAMO,SAAS,eAAe,IAAA,EAA2B;AACxD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,KAAA,MAAW,CAAA,IAAK,sBAAA,CAAuB,IAAI,CAAA,EAAG;AAC5C,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,kBAAkB,CAAA,CAAE,QAAA,EAAUC,IAAG,YAAA,CAAa,CAAA,CAAE,QAAA,EAAU,OAAO,CAAC,CAAA;AAC9E,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACb,MAAA,MAAA,GAAS,GAAA,CAAI,IAAA;AAAA,IACf,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,EAAU;AACnD,IAAA,MAAM,WAAY,MAAA,CAAmC,CAAA,CAAE,IAAA,KAAS,MAAA,GAAS,OAAO,MAAM,CAAA;AACtF,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,CAAA;AACpD,MAAA,UAAA,CAAW,IAAI,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,kBACd,QAAA,EACA,iBAAA,EACA,gBAAA,mBAAwC,IAAI,KAAI,EACK;AACrD,EAAA,MAAM,OAAA,GAAUD,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,IAAI,CAACC,GAAAA,CAAG,UAAA,CAAW,OAAO,CAAA,EAAG;AAC3B,IAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,OAAO,CAAA,CAAE,CAAA;AACxC,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAQ,CAAA,EAAG,UAAU,CAAA,EAAE;AAAA,EAC5C;AAEA,EAAA,MAAM,WAA+B,eAAA,EAAgB;AACrD,EAAA,MAAM,UAAA,GAAa,uBAAuB,OAAO,CAAA;AAIjD,EAAA,MAAM,YAAYA,GAAAA,CAAG,UAAA,CAAWD,MAAK,IAAA,CAAK,OAAA,EAAS,wBAAwB,CAAC,CAAA;AAG5E,EAAA,IAAI,MAAA,GAAS,sBAAsB,OAAA,EAAS;AAAA,IAC1C,SAAA,EAAW,SAAA;AAAA,IACX,QAAA,EAAU,YAAY,MAAA,GAAY;AAAA,GACnC,CAAA;AACD,EAAA,IAAI,QAAA,GAAW,CAAA;AAIf,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAoB;AAI7C,EAAA,MAAM,WAAA,GAAc,cAAc,OAAO,CAAA;AACzC,EAAA,MAAM,WAAA,GAAc,iBAAA;AAAA,IAClB,eAAe,WAAW,CAAA;AAAA,IAC1B,gBAAA;AAAA,IACA,qBAAA,CAAsB,WAAW,CAAA,EAAG;AAAA,GACtC;AACA,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,MAAM,WAAA,GAAc,sBAAA,CAAuB,CAAA,EAAG,OAAO,CAAA;AACrD,IAAA,IAAI,WAAA,CAAY,SAAS,OAAA,EAAS;AAChC,MAAA,MAAA,EAAA;AACA,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,KAAA,GAAQ,yBAAA;AAAA,MACZ,CAAA;AAAA,MACA,WAAA,CAAY,MAAA;AAAA,MACZ,WAAA,CAAY,IAAA;AAAA,MACZ,OAAA;AAAA,MACA,QAAA;AAAA,MACA,iBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAA,IAAU,KAAA,CAAM,MAAA;AAChB,IAAA,QAAA,IAAY,KAAA,CAAM,QAAA;AAClB,IAAA,MAAM,MAAM,WAAA,CAAY,MAAA;AACxB,IAAA,MAAM,QAAA,GAAW,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,CAAI,CAAA,CAAE,IAAA,KAAS,MAAA,GAAS,IAAA,GAAO,MAAM,CAAA,GAAI,IAAA;AAC3F,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,CAAS,SAAS,CAAA,EAAG;AACvD,MAAA,MAAM,GAAA,GAAMA,KAAAA,CAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA;AACnC,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,CAAA,CAAE,IAAI,IAAI,QAAQ,CAAA,CAAA;AACjC,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AAClC,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,YAAA,CAAa,GAAA,CAAI,KAAK,GAAG,CAAA;AAAA,MAC3B,CAAA,MAAA,IAAW,UAAU,GAAA,EAAK;AACxB,QAAA,MAAA;AAAA,UACE,GAAGA,KAAAA,CAAK,QAAA,CAAS,SAAS,CAAA,CAAE,QAAQ,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,IAAI,CAAA,SAAA,EAAO,GAAG,CAAA,oBAAA,EAAuBA,KAAAA,CAAK,SAAS,OAAA,EAAS,KAAK,KAAK,GAAG,CAAA,+FAAA;AAAA,SAEvH;AACA,QAAA,MAAA,EAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,UAAA,CAAW,MAAA,EAAQ,QAAQ,QAAA,EAAS;AACtD;AAGA,SAAS,uBAAuB,QAAA,EAA4B;AAC1D,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,SAAS,KAAK,GAAA,EAAmB;AAC/B,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAUC,IAAG,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAM,IAAA,GAAOD,KAAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA;AACtC,MAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,QAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,MAAM,IAAI,CAAA,OAAQ,IAAI,CAAA;AAAA,MAC3C,CAAA,MAAA,IAAW,MAAM,MAAA,EAAO,IAAK,sBAAsB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG;AACnE,QAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAA,CAAK,QAAQ,CAAA;AACb,EAAA,OAAO,GAAA;AACT;AAcA,SAAS,0BAA0B,MAAA,EAA0D;AAC3F,EAAA,MAAM,YAAqC,EAAC;AAC5C,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAA,EAAG;AACtC,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,YAAA,EAAc;AACnC,MAAA,IAAI,OAAO,MAAM,QAAA,EAAU,SAAA,CAAU,KAAK,CAAC,cAAA,EAAgB,CAAC,CAAC,CAAA;AAAA,IAC/D;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AACnC,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,SAAA,EAAW;AAChC,MAAA,MAAM,MAAO,CAAA,EAA+B,GAAA;AAC5C,MAAA,IAAI,OAAO,QAAQ,QAAA,EAAU,SAAA,CAAU,KAAK,CAAC,eAAA,EAAiB,GAAG,CAAC,CAAA;AAAA,IACpE;AAAA,EACF;AACA,EAAA,OAAO,SAAA;AACT;AAGA,SAAS,qBAAA,CAAsB,WAAoC,OAAA,EAAyB;AAC1F,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAG,CAAA,IAAK,SAAA,EAAW;AACpC,IAAA,IAAI;AACF,MAAA,aAAA,CAAc,GAAG,CAAA;AAAA,IACnB,SAAS,CAAA,EAAG;AACV,MAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,KAAK,CAAA,SAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAC9E,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,uBAAA,CAAwB,QAAiC,OAAA,EAAyB;AACzF,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,MAAM,GAAG,OAAO,CAAA;AAC1C,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,MAAM,eAAe,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,GAAW,OAAO,SAAA,GAAY,MAAA;AAC/E,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,MAAA,EAAQ;AAC7B,IAAA,MAAM,KAAA,GAAQ,CAAA;AACd,IAAA,MAAM,OAAO,KAAA,EAAO,IAAA;AACpB,IAAA,MAAM,OAAO,OAAO,KAAA,EAAO,IAAA,KAAS,QAAA,GAAW,MAAM,IAAA,GAAO,OAAA;AAC5D,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,WAAW,CAAA,EAAG;AACnD,IAAA,MAAM,YAAY,OAAO,KAAA,EAAO,SAAA,KAAc,QAAA,GAAW,MAAM,SAAA,GAAY,YAAA;AAC3E,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,aAAA,CAAc,GAAG,IAAI,CAAA,EAAA,EAAK,SAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAAA,MAC/C,SAAS,CAAA,EAAG;AACV,QAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,iBAAA,EAAe,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAC5E,QAAA,MAAA,EAAA;AAAA,MACF;AAAA,IACF,CAAA,MAAA,IAAW,CAAC,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAClC,MAAA,MAAA,CAAO,GAAG,OAAO,CAAA,qCAAA,EAAmC,IAAI,CAAA,SAAA,EAAO,eAAe,CAAA,CAAE,CAAA;AAChF,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGA,IAAM,qBAAA,GAA2C;AAAA,EAC/C,0BAAA;AAAA,EACA,sBAAA;AAAA,EACA,wBAAA;AAAA,EACA;AACF,CAAA;AAMA,SAAS,gCAAA,CACP,UAAA,EACA,OAAA,EACA,UAAA,EACQ;AACR,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI,CAAA,CAAE,MAAA,KAAW,OAAA,IAAW,CAAA,CAAE,KAAA,EAAO;AACrC,IAAA,MAAM,GAAA,GAAM,sBAAA,CAAuB,CAAA,EAAG,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,GAAA,EAAK;AACV,IAAA,IAAI,CAACC,GAAAA,CAAG,UAAA,CAAW,GAAG,CAAA,EAAG;AACvB,MAAA,MAAA;AAAA,QACE,GAAG,OAAO,CAAA,8DAAA,EAA4D,CAAA,CAAE,EAAE,eAAe,GAAG,CAAA,qDAAA;AAAA,OAC9F;AACA,MAAA,MAAA,EAAA;AAAA,IACF,CAAA,MAAA,IAAW,CAAC,eAAA,CAAgB,GAAA,EAAK,UAAU,CAAA,EAAG;AAC5C,MAAA,OAAA;AAAA,QACE,CAAA,EAAG,OAAO,CAAA,gCAAA,EAA8B,CAAA,CAAE,EAAE,CAAA,YAAA,EAAe,GAAG,CAAA,wBAAA,EAA2B,UAAU,CAAA,iBAAA,EAAoB,CAAA,CAAE,MAAA,KAAW,YAAA,GAAe,gBAAgB,EAAE,CAAA,MAAA;AAAA,OACvK;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,2BAA2B,QAAA,EAGvC;AACD,EAAA,MAAM,OAAA,GAAUD,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,uBAAuB,OAAO,CAAA;AAC5C,EAAA,IAAI,MAAA,GAAS,CAAA;AAEb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAUA,KAAAA,CAAK,QAAA,CAAS,OAAA,EAAS,IAAI,CAAA;AAC3C,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAUE,MAAUD,GAAAA,CAAG,YAAA,CAAa,MAAM,OAAO,CAAC,KAAK,EAAC;AAAA,IAC1D,SAAS,CAAA,EAAG;AACV,MAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,qBAAA,EAAmB,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAChF,MAAA,MAAA,EAAA;AACA,MAAA;AAAA,IACF;AAEA,IAAA,MAAA,IAAU,qBAAA,CAAsB,yBAAA,CAA0B,MAAM,CAAA,EAAG,OAAO,CAAA;AAC1E,IAAA,MAAA,IAAU,uBAAA,CAAwB,QAAQ,OAAO,CAAA;AACjD,IAAA,KAAA,MAAW,KAAK,mBAAA,CAAoBD,KAAAA,CAAK,QAAQ,IAAI,CAAA,EAAG,MAAM,CAAA,EAAG;AAC/D,MAAA,MAAM,OAAO,CAAA,EAAG,OAAO,CAAA,iBAAA,EAAe,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,IAAA,GAAO,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,CAAA,GAAO,EAAE,CAAA,EAAG,EAAE,OAAO,CAAA,CAAA;AACxF,MAAA,IAAI,CAAA,CAAE,aAAa,OAAA,EAAS;AAC1B,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA,MAAA,EAAA;AAAA,MACF,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,MACd;AAAA,IACF;AAGA,IAAA,MAAM,UAAU,gBAAA,CAAiBC,GAAAA,CAAG,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AAC/D,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,WAAA,EAAa;AACnC,MAAA,IAAI,CAAC,qBAAA,CAAsB,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA,EAAG;AAC7C,MAAA,MAAA,CAAO,GAAG,OAAO,CAAA,qBAAA,EAAmB,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA,GAAO,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,CAAA,GAAO,EAAE,CAAA,EAAG,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACxF,MAAA,MAAA,EAAA;AAAA,IACF;AACA,IAAA,MAAA,IAAU,gCAAA;AAAA,MACRD,KAAAA,CAAK,QAAQ,IAAI,CAAA;AAAA,MACjB,OAAA;AAAA,MACA,OAAA,CAAQ,MAAA,EAAQ,UAAA,IAAc;AAAC,KACjC;AAIA,IAAA,IAAA,CAAK,QAAQ,MAAA,EAAQ,UAAA,IAAc,EAAC,EAAG,SAAS,CAAA,EAAG;AACjD,MAAA,MAAM,SAAS,MAAM,oBAAA,CAAqBA,KAAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AAC5D,MAAA,IAAI,CAAC,OAAO,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,kBAAkB,CAAA,EAAG;AAC/D,QAAA,KAAA,MAAW,CAAA,IAAK,OAAO,QAAA,EAAU;AAC/B,UAAA,IAAI,CAAA,CAAE,IAAA,KAAS,gBAAA,IAAoB,CAAC,EAAE,IAAA,EAAM;AAC5C,UAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,qBAAA,EAAmB,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAC1D,UAAA,MAAA,EAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,CAAM,MAAA,EAAQ,MAAA,EAAO;AACvC;AAQA,SAAS,6BAA6B,QAAA,EAA0B;AAC9D,EAAA,MAAM,OAAA,GAAUA,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,sBAAsB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,UAAU,OAAO,CAAA;AACtB,EAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,OAAA,EAAS,QAAQ,CAAA;AACnD,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,MAAA;AAAA,MACE,CAAA,EAAG,wBAAwB,CAAA,iBAAA,EAAe,aAAA,CAAc,GAAG,QAAQ,CAAC,CAAA,QAAA,EAAW,CAAA,CAAE,IAAI,CAAA,qGAAA;AAAA,KAEvF;AAAA,EACF;AACA,EAAA,OAAO,OAAA,CAAQ,MAAA;AACjB;AAOA,SAAS,gCAAgC,QAAA,EAA0B;AACjE,EAAA,MAAM,QAAA,GAAW,wBAAA,CAAyBA,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAChE,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,MAAA;AAAA,MACE,GAAG,wBAAwB,CAAA,iBAAA,EAAe,EAAE,KAAK,CAAA,EAAA,EAAK,EAAE,OAAO,CAAA,oDAAA;AAAA,KAEjE;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,MAAA;AAClB;AAOA,SAAS,sCAAsC,QAAA,EAA0B;AACvE,EAAA,MAAM,QAAA,GAAW,yBAAA,CAA0BA,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA;AACjE,EAAA,KAAA,MAAW,OAAA,IAAW,QAAA,EAAU,MAAA,CAAO,OAAO,CAAA;AAC9C,EAAA,OAAO,QAAA,CAAS,MAAA;AAClB;AAOA,SAAS,iCAAiC,QAAA,EAA0B;AAClE,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,GAAG,oBAAA,CAAqBA,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,IAC9C,GAAG,yBAAA,CAA0BA,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC;AAAA,GACrD;AACA,EAAA,KAAA,MAAW,OAAA,IAAW,QAAA,EAAU,MAAA,CAAO,OAAO,CAAA;AAC9C,EAAA,OAAO,QAAA,CAAS,MAAA;AAClB;AAOA,SAAS,8BAA8B,QAAA,EAA0B;AAC/D,EAAA,IAAI;AACF,IAAA,sBAAA,CAAuBA,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAC7C,IAAA,OAAO,CAAA;AAAA,EACT,SAASG,IAAAA,EAAK;AACZ,IAAA,MAAA,CAAOA,gBAAe,KAAA,GAAQA,IAAAA,CAAI,OAAA,GAAU,MAAA,CAAOA,IAAG,CAAC,CAAA;AACvD,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAQA,SAAS,gCAAgC,QAAA,EAA0B;AACjE,EAAA,MAAM,OAAA,GAAUH,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,sBAAsB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACzC,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AACrC,IAAA,IAAI,CAAC,CAAA,CAAE,IAAA,IAAQ,EAAE,MAAA,IAAU,CAAC,EAAE,OAAA,EAAS;AACvC,IAAA,MAAM,IAAA,GAAO,qBAAA,CAAsBA,KAAAA,CAAK,IAAA,CAAK,OAAA,EAAS,CAAA,CAAE,IAAI,CAAA,EAAG,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,IAAI,CAAA;AAC7E,IAAA,IAAI,CAAC,IAAA,EAAM;AACX,IAAA,MAAM,MAAM,iBAAA,CAAkB,IAAA,EAAMC,IAAG,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AAClE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACb,IAAA,MAAM,WAAA,GAAc,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA;AAC5C,IAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,CAAA,CAAE,OAAA,EAAS;AAC5D,IAAA,OAAA;AAAA,MACE,8BAAA;AAAA,QACE,aAAA,CAAc,GAAG,QAAQ,CAAA;AAAA,QACzB,CAAA,CAAE,OAAA;AAAA,QACF,OAAA,CAAQD,KAAAA,CAAK,QAAA,CAAS,OAAA,EAAS,IAAI,CAAC,CAAA;AAAA,QACpC;AAAA;AACF,KACF;AACA,IAAA,QAAA,EAAA;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AASA,SAAS,kCAAkC,QAAA,EAA0B;AACnE,EAAA,MAAM,OAAA,GAAUA,KAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,sBAAsB,OAAO,CAAA;AAC9C,EAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAAc,CAAA,CAAE,MAAK,CAAE,OAAA,CAAQ,MAAM,EAAE,CAAA;AACrD,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AACrC,IAAA,MAAM,QAAA,GAAW,CAAA,CAAE,SAAA,IAAa,QAAA,CAAS,SAAA;AACzC,IAAA,IAAI,CAAC,CAAA,CAAE,IAAA,IAAQ,CAAA,CAAE,MAAA,IAAU,CAAC,QAAA,EAAU;AACtC,IAAA,MAAM,IAAA,GAAO,qBAAA,CAAsBA,KAAAA,CAAK,IAAA,CAAK,OAAA,EAAS,CAAA,CAAE,IAAI,CAAA,EAAG,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,IAAI,CAAA;AAC7E,IAAA,IAAI,CAAC,IAAA,EAAM;AACX,IAAA,MAAM,MAAM,iBAAA,CAAkB,IAAA,EAAMC,IAAG,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AAClE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACb,IAAA,MAAM,IAAA,GAAQ,IAAI,IAAA,CAAiC,QAAA;AACnD,IAAA,MAAM,WACJ,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,GAC5B,KAAiC,SAAA,GAClC,IAAA;AACN,IAAA,IAAI,OAAO,aAAa,QAAA,IAAY,IAAA,CAAK,QAAQ,CAAA,KAAM,IAAA,CAAK,QAAQ,CAAA,EAAG;AACvE,IAAA,OAAA;AAAA,MACE,CAAA,EAAG,QAAQD,KAAAA,CAAK,QAAA,CAAS,SAAS,IAAI,CAAC,CAAC,CAAA,wCAAA,EAAsC,IAAA,CAAK,QAAQ,CAAC,CAAA,uCAAA,EAC/D,IAAA,CAAK,QAAQ,CAAC,CAAA,MAAA,EAAS,cAAc,CAAA,EAAG,QAAQ,CAAC,CAAA,wHAAA,EAEzE,wBAAwB,CAAA,CAAA;AAAA,KAC/B;AACA,IAAA,QAAA,EAAA;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAGA,IAAM,cAAA,GAAiB,CAAC,kBAAA,EAAoB,WAAA,EAAa,OAAO,CAAA;AAGhE,SAAS,QAAQ,CAAA,EAAmB;AAClC,EAAA,OAAO,EAAE,KAAA,CAAMA,KAAAA,CAAK,GAAG,CAAA,CAAE,KAAK,GAAG,CAAA;AACnC;AAGA,SAAS,eAAe,OAAA,EAA0B;AAChD,EAAA,MAAM,GAAA,GAAM,QAAQ,OAAO,CAAA;AAC3B,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,WAAW,GAAA,CAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAC/D;AAUA,IAAM,eAAA,GAAwC;AAAA,EAC5C,KAAA,EAAO,IAAA;AAAA,EACP,KAAA,EAAO,IAAA;AAAA,EACP,IAAA,EAAM,IAAA;AAAA,EACN,MAAA,EAAQ,IAAA;AAAA,EACR,MAAA,EAAQ,IAAA;AAAA,EACR,QAAA,EAAU;AACZ,CAAA;AAGA,SAAS,iBAAiB,CAAA,EAAoC;AAC5D,EAAA,MAAM,OAAO,CAAA,CAAE,IAAA;AACf,EAAA,MAAM,QAAA,GAAWA,KAAAA,CAAK,QAAA,CAAS,CAAA,CAAE,QAAQ,CAAA;AACzC,EAAA,MAAM,UAAUA,KAAAA,CAAK,QAAA,CAASA,MAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAC,CAAA;AACtD,EAAA,MAAM,OAAA,GAAUC,GAAAA,CAAG,YAAA,CAAa,CAAA,CAAE,UAAU,OAAO,CAAA;AACnD,EAAA,IAAI,CAAA,CAAE,QAAA,CAAS,QAAA,CAAS,KAAK,CAAA,EAAG;AAE9B,IAAA,MAAM,GAAA,GAAM,iBAAA,CAAkB,CAAA,CAAE,QAAA,EAAU,OAAO,CAAA;AACjD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,EAAA,GAAM,GAAA,CAAI,OAAmC,EAAC;AAC/D,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,CAAQ,eAAA,EAAiB,EAAE,CAAA;AACjD,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,IAAA,EAAM,OAAO,IAAA,CAAK,IAAA,KAAS,WAAW,IAAA,CAAK,IAAA,GAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,OAAA;AAAA,MAC7E,OAAA,EAAS,eAAA,CAAgB,IAAI,CAAA,IAAK,EAAA;AAAA,MAClC,UAAU,CAAA,CAAE;AAAA,KACd;AAAA,EACF;AACA,EAAA,IAAI,MAAA,GAAyC,IAAA;AAC7C,EAAA,IAAI;AACF,IAAA,MAAA,GAASC,MAAU,OAAO,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,IAAA,EAAM,OAAO,MAAA,EAAQ,EAAA,IAAM,SAAS,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAC,CAAA;AAAA,MAC7D,OAAA,EAAS,MAAA,CAAO,MAAA,EAAQ,OAAA,IAAW,EAAE,CAAA;AAAA,MACrC,UAAU,CAAA,CAAE;AAAA,KACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,IAAA,EAAM,MAAA,CAAO,MAAA,EAAQ,IAAA,IAAQ,OAAO,CAAA;AAAA,IACpC,OAAA,EAAS,MAAA,CAAO,MAAA,EAAQ,OAAA,IAAW,EAAE,CAAA;AAAA,IACrC,UAAU,CAAA,CAAE;AAAA,GACd;AACF;AAOA,SAAS,qBAAqB,IAAA,EAA8B;AAC1D,EAAA,IAAI,CAACD,GAAAA,CAAG,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAClC,EAAA,MAAM,SAAyB,EAAC;AAChC,EAAA,KAAA,MAAW,CAAA,IAAK,sBAAA,CAAuB,IAAI,CAAA,EAAG;AAC5C,IAAA,IAAI,CAAC,eAAA,CAAgB,CAAA,CAAE,IAAI,CAAA,EAAG;AAE9B,IAAA,IAAI,CAAA,CAAE,QAAA,CAAS,QAAA,CAAS,YAAY,CAAA,EAAG;AACvC,IAAA,IAAI,eAAeD,KAAAA,CAAK,QAAA,CAAS,MAAM,CAAA,CAAE,QAAQ,CAAC,CAAA,EAAG;AACrD,IAAA,MAAA,CAAO,IAAA,CAAK,gBAAA,CAAiB,CAAC,CAAC,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,aAAA,CAAc,GAAiB,IAAA,EAAsB;AAC5D,EAAA,OAAO,QAAQA,KAAAA,CAAK,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,QAAQ,CAAC,CAAA;AAChD;AAQA,SAAS,iBAAA,CAAkB,cAAsB,IAAA,EAA6B;AAC5E,EAAA,IAAI,MAAMA,KAAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,YAAY,CAAC,CAAA;AAClD,EAAA,WAAS;AACP,IAAA,MAAM,SAAA,GAAY,GAAA,KAAQ,GAAA,GAAM,cAAA,GAAiB,GAAG,GAAG,CAAA,aAAA,CAAA;AACvD,IAAA,IAAIC,GAAAA,CAAG,WAAWD,KAAAA,CAAK,IAAA,CAAK,MAAM,SAAS,CAAC,GAAG,OAAO,SAAA;AACtD,IAAA,IAAI,GAAA,KAAQ,KAAK,OAAO,IAAA;AACxB,IAAA,GAAA,GAAMA,KAAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAAA,EAC9B;AACF;AAoBO,SAAS,mBAAA,CAAoB,eAAyB,IAAA,EAA8B;AACzF,EAAA,MAAM,WAAW,IAAI,GAAA,CAAI,aAAA,CAAc,GAAA,CAAI,OAAO,CAAC,CAAA;AACnD,EAAA,MAAM,YAAA,GAAe,oDAAA;AACrB,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAI,CAAC,YAAA,CAAa,IAAA,CAAK,CAAC,CAAA,IAAK,cAAA,CAAe,CAAC,CAAA,EAAG;AAChD,IAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,CAAA,EAAG,IAAI,CAAA;AACtC,IAAA,IAAI,IAAA,EAAM,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAAA,SACnB,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EACrB;AACA,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,KAAK,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,QAAA,CAAS,GAAA,CAAI,CAAC,CAAC,CAAA;AACxD,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,KAAK,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,QAAA,CAAS,GAAA,CAAI,CAAC,CAAC,CAAA;AACvD,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAQ;AACnC;AAGA,SAAS,yBAAA,CAA0B,UAAkB,OAAA,EAAgC;AACnF,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAMI,OAAAA,GAASF,MAAU,OAAO,CAAA;AAChC,IAAA,OAAOE,SAAQ,OAAA,IAAW,IAAA;AAAA,EAC5B;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,uBAAuB,CAAA;AACrD,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,MAAM,MAAA,GAASF,KAAAA,CAAU,OAAA,CAAQ,CAAC,CAAC,CAAA;AACnC,EAAA,OAAO,MAAA,EAAQ,QAAA,EAAU,OAAA,IAAW,MAAA,EAAQ,OAAA,IAAW,IAAA;AACzD;AAGA,SAAS,kBAAA,CACP,QACA,IAAA,EACsC;AACtC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,MAAM,QAAA,GAAW,CAAA;AACjB,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,MAAM,QAAA,GAAW,aAAA,CAAc,CAAA,EAAG,IAAI,CAAA;AACtC,IAAA,IAAI,CAAC,EAAE,OAAA,EAAS;AACd,MAAA,MAAA,CAAO,CAAA,EAAG,EAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,wBAAA,CAAqB,CAAA;AAC5D,MAAA,MAAA,EAAA;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,CAAA,CAAE,OAAO,CAAA;AAC3C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAA,CAAO,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,SAAA,EAAO,OAAO,CAAA,CAAE,CAAA;AACvD,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC5B;AAGA,SAAS,iBAAA,CAAkB,QAAwB,IAAA,EAAsB;AACvE,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,IAAI,CAAC,EAAE,OAAA,EAAS;AAEhB,IAAA,MAAM,UAAU,OAAA,CAAQF,KAAAA,CAAK,SAAS,IAAA,EAAM,CAAA,CAAE,QAAQ,CAAC,CAAA;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,aAAa,KAAA,EAAO,CAAC,QAAQ,CAAA,OAAA,EAAU,OAAO,EAAE,CAAA,EAAG;AAAA,QACrE,GAAA,EAAK,IAAA;AAAA,QACL,QAAA,EAAU,OAAA;AAAA,QACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,OACjC,CAAA;AACD,MAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,CAAA,CAAE,QAAA,EAAU,WAAW,CAAA;AACrE,MAAA,IAAI,WAAA,IAAe,WAAA,KAAgB,CAAA,CAAE,OAAA,EAAS;AAC5C,QAAA,OAAA;AAAA,UACE,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,aAAA,CAAc,CAAA,EAAG,IAAI,CAAC,CAAA,8CAAA,EAA4C,EAAE,OAAO,CAAA,CAAA;AAAA,SACrG;AACA,QAAA,QAAA,EAAA;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AASA,SAAS,oBAAA,CACP,QACA,IAAA,EACsC;AACtC,EAAA,MAAM,QAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,MAAM,CAAA;AACpD,EAAA,MAAM,eAAA,uBAAsB,GAAA,EAAoB;AAChD,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,MAAA,CAAO,CAACK,OAAMA,EAAAA,CAAE,IAAA,KAAS,OAAO,CAAA,EAAG;AACxD,IAAA,eAAA,CAAgB,GAAA,CAAI,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAA;AAAA,EACvC;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,oBAAA,CAAqB,QAAA,CAAS,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA,IAClD,SAASF,IAAAA,EAAK;AAIZ,MAAA,OAAA;AAAA,QACE,CAAA,KAAA,EAAQ,CAAA,CAAE,IAAI,CAAA,EAAA,EAAKH,MAAK,QAAA,CAAS,IAAA,EAAM,CAAA,CAAE,QAAQ,CAAC,CAAA,4BAAA,EAC7CG,IAAAA,YAAe,KAAA,GAAQA,IAAAA,CAAI,UAAUA,IAAG,CAAA;AAAA,OAC/C;AACA,MAAA,QAAA,EAAA;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,IAAA,EAAM,eAAe,CAAA;AACzD,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,MAAA,CAAO,CAACG,OAAM,CAACA,EAAAA,CAAE,SAAS,CAAA,EAAG;AAClD,MAAA,MAAA;AAAA,QACE,CAAA,KAAA,EAAQ,CAAA,CAAE,IAAI,CAAA,MAAA,EAAS,CAAA,CAAE,MAAM,CAAA,cAAA,EAAY,CAAA,CAAE,SAAS,CAAA,QAAA,EAAW,CAAA,CAAE,MAAA,IAAU,QAAQ,CAAA;AAAA,OACvF;AACA,MAAA,MAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC5B;AASA,SAAS,iBAAiB,OAAA,EAA4C;AACpE,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,GAAA,GAAMN,KAAAA,CAAK,OAAA,CAAQ,OAAO,CAAA;AAChC,IAAA,IAAI,CAACC,GAAAA,CAAG,UAAA,CAAW,GAAG,CAAA,EAAG;AACvB,MAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,GAAG,CAAA,CAAE,CAAA;AACpC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,KAAA,IAAS,GAAA,GAAM,QAAQ,GAAA,EAAI,IAAK,MAAMD,KAAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvD,IAAA,IAAIC,GAAAA,CAAG,WAAWD,KAAAA,CAAK,IAAA,CAAK,KAAK,wBAAwB,CAAC,GAAG,OAAO,GAAA;AACpE,IAAA,IAAIA,KAAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,KAAK,OAAO,YAAA;AAAA,EACxC;AACF;AAGA,SAAS,gBAAgB,IAAA,EAAuB;AAC9C,EAAA,IAAI;AACF,IAAA,OACE,YAAA,CAAa,KAAA,EAAO,CAAC,WAAA,EAAa,uBAAuB,CAAA,EAAG;AAAA,MAC1D,GAAA,EAAK,IAAA;AAAA,MACL,QAAA,EAAU,OAAA;AAAA,MACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,QAAQ;AAAA,KACnC,CAAA,CAAE,IAAA,EAAK,KAAM,MAAA;AAAA,EAElB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAWA,SAAS,aACP,IAAA,EACA,GAAA,EACA,IAAA,EACA,IAAA,GAAgC,EAAC,EAChB;AACjB,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAI,CAAA,EAAG;AAC1B,IAAA,MAAA,CAAO,CAAA,EAAG,IAAI,CAAA,yBAAA,EAA4B,IAAI,CAAA,+BAAA,CAAiC,CAAA;AAC/E,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,YAAA;AAAA,MACV,KAAA;AAAA,MACA,CAAC,MAAA,EAAQ,aAAA,EAAe,YAAA,EAAc,oBAAoB,GAAG,CAAA;AAAA,MAC7D;AAAA,QACE,GAAA,EAAK,IAAA;AAAA,QACL,QAAA,EAAU,OAAA;AAAA,QACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA;AAClC,KACF;AACA,IAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK,CAAE,MAAM,IAAI,CAAA,CAAE,OAAO,OAAO,CAAA;AACrD,IAAA,IAAI,KAAK,SAAA,EAAW;AAElB,MAAA,MAAM,QAAQ,YAAA,CAAa,KAAA,EAAO,CAAC,UAAA,EAAY,UAAA,EAAY,oBAAoB,CAAA,EAAG;AAAA,QAChF,GAAA,EAAK,IAAA;AAAA,QACL,QAAA,EAAU,OAAA;AAAA,QACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,OACjC,CAAA;AACD,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,KAAA,CAAM,IAAA,EAAK,CAAE,MAAM,IAAI,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,OAAA;AAAA,EACT,SAASG,IAAAA,EAAK;AACZ,IAAA,MAAM,MAAA,GAASA,IAAAA,YAAe,KAAA,IAAS,QAAA,IAAYA,IAAAA,GAAM,OAAOA,IAAAA,CAAI,MAAM,CAAA,CAAE,IAAA,EAAK,GAAI,EAAA;AACrF,IAAA,MAAM,MAAA,GAAA,CAAU,MAAA,KAAWA,IAAAA,YAAe,KAAA,GAAQA,IAAAA,CAAI,OAAA,GAAU,MAAA,CAAOA,IAAG,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,CAAE,CAAC,CAAA;AAC3F,IAAA,MAAA,CAAO,CAAA,mBAAA,EAAsB,IAAI,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,CAAA;AAC9C,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOA,SAAS,YAAY,CAAA,EAAgC;AACnD,EAAA,MAAM,GAAA,GAAMH,KAAAA,CAAK,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,EAAS,UAAU,EAAE,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA,IAAKA,MAAK,QAAA,CAAS,GAAG,CAAA,KAAM,CAAA,CAAE,MAAM,OAAO,GAAA;AAC7F,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,YAAA,CAAa,GAAiB,UAAA,EAA0C;AAC/E,EAAA,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAE,QAAQ,GAAG,OAAO,IAAA;AACvC,EAAA,MAAM,GAAA,GAAM,YAAY,CAAC,CAAA;AACzB,EAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,KAAA;AACzB,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,MAAM,GAAA,GAAMA,KAAAA,CAAK,QAAA,CAAS,GAAA,EAAK,CAAC,CAAA;AAChC,IAAA,IAAI,IAAI,UAAA,CAAW,IAAI,KAAKA,KAAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AAClD,IAAA,IAAI,CAAC,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAC,GAAG,OAAO,IAAA;AAAA,EAC5C;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,gBAAA,CACP,SACA,IAAA,EACM;AACN,EAAA,MAAM,IAAA,GAAO,iBAAiB,OAAO,CAAA;AACrC,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,IAAA;AAAA,EACF;AACA,EAAA,IAAI,MAAA,GAAS,qBAAqB,IAAI,CAAA;AAGtC,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,MAAM,OAAA,GAAU,aAAa,IAAA,EAAM,MAAA,EAAQ,kBAAkB,EAAE,SAAA,EAAW,MAAM,CAAA;AAChF,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAMA,KAAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AACpE,IAAA,MAAA,GAAS,OAAO,MAAA,CAAO,CAAC,MAAM,YAAA,CAAa,CAAA,EAAG,UAAU,CAAC,CAAA;AAAA,EAC3D;AAEA,EAAA,OAAA,CAAQ,CAAA,qBAAA,EAAwB,IAAI,CAAA,CAAE,CAAA;AACtC,EAAA,MAAM,YAAA,GAAe,kBAAA,CAAmB,MAAA,EAAQ,IAAI,CAAA;AACpD,EAAA,IAAI,SAAS,YAAA,CAAa,MAAA;AAC1B,EAAA,IAAI,WAAW,YAAA,CAAa,QAAA;AAG5B,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,QAAA,IAAY,iBAAA,CAAkB,QAAQ,IAAI,CAAA;AAAA,EAC5C;AAEA,EAAA,MAAM,QAAA,GAAW,oBAAA,CAAqB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,MAAA,IAAU,QAAA,CAAS,MAAA;AACnB,EAAA,QAAA,IAAY,QAAA,CAAS,QAAA;AAGrB,EAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,EAAA,OAAA,CAAQ,CAAA,QAAA,EAAW,MAAA,CAAO,MAAM,CAAA,OAAA,CAAS,CAAA;AACzC,EAAA,IAAI,MAAA,KAAW,CAAA,IAAK,QAAA,KAAa,CAAA,EAAG;AAClC,IAAA,KAAA,CAAM,oBAAoB,CAAA;AAAA,EAC5B,CAAA,MAAO;AACL,IAAA,IAAI,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,CAAA,EAAG,MAAM,CAAA,SAAA,CAAW,CAAA;AAC3C,IAAA,IAAI,QAAA,GAAW,CAAA,EAAG,OAAA,CAAQ,CAAA,EAAG,QAAQ,CAAA,WAAA,CAAa,CAAA;AAAA,EACpD;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA,IAAM,IAAA,CAAK,MAAA,IAAU,WAAW,CAAA,EAAI;AAC/C,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAaO,SAAS,mBAAA,GAA+B;AAC7C,EAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,UAAU,CAAA,CAAE,WAAA;AAAA,IAClC;AAAA,GACF;AAGA,EAAA,GAAA,CACG,QAAA,CAAS,QAAA,EAAU,6CAAA,EAA+C,GAAG,CAAA,CACrE,MAAA;AAAA,IACC,sBAAA;AAAA,IACA;AAAA,GACF,CACC,MAAA,CAAO,OAAO,UAAA,EAAoB,IAAA,KAA0C;AAC3E,IAAA,MAAM,OAAA,GAAUA,KAAAA,CAAK,OAAA,CAAQ,UAAU,CAAA;AACvC,IAAA,IAAIC,GAAAA,CAAG,UAAA,CAAW,OAAO,CAAA,IAAK,CAACA,IAAG,QAAA,CAAS,OAAO,CAAA,CAAE,WAAA,EAAY,EAAG;AACjE,MAAA,MAAA,CAAO,CAAA,EAAG,OAAO,CAAA,qEAAA,CAAuE,CAAA;AACxF,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,CAAA,wBAAA,EAA2B,OAAO,CAAA,CAAE,CAAA;AAC5C,IAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAS,GAAI,iBAAA;AAAA,MAClC,OAAA;AAAA,MACA,KAAK,iBAAA,IAAqB,KAAA;AAAA,MAC1B,MAAM,mBAAA,CAAoB,aAAA,CAAc,OAAO,CAAC;AAAA,KAClD;AACA,IAAA,MAAM,EAAA,GAAK,MAAM,0BAAA,CAA2B,OAAO,CAAA;AACnD,IAAA,MAAM,UAAA,GAAa,6BAA6B,OAAO,CAAA;AACvD,IAAA,MAAM,UAAA,GAAa,sCAAsC,OAAO,CAAA;AAChE,IAAA,MAAM,cAAA,GAAiB,iCAAiC,OAAO,CAAA;AAC/D,IAAA,MAAM,WAAA,GAAc,8BAA8B,OAAO,CAAA;AACzD,IAAA,MAAM,cAAA,GAAiB,gCAAgC,OAAO,CAAA;AAC9D,IAAA,MAAM,eAAA,GAAkB,gCAAgC,OAAO,CAAA;AAC/D,IAAA,MAAM,iBAAA,GAAoB,kCAAkC,OAAO,CAAA;AAGnE,IAAA,MAAM,kBAAA,GAAqB,MAAM,8BAAA,CAA+B,OAAO,CAAA;AACvE,IAAA,KAAA,MAAW,CAAA,IAAK,kBAAA,EAAoB,OAAA,CAAQ,CAAC,CAAA;AAC7C,IAAA,MAAM,qBAAqB,kBAAA,CAAmB,MAAA;AAC9C,IAAA,MAAM,cACJ,MAAA,GACA,EAAA,CAAG,SACH,UAAA,GACA,UAAA,GACA,iBACA,WAAA,GACA,cAAA;AACF,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,sBAAA,CAAuB,OAAO,CAAA;AAC9B,IAAA,qBAAA,CAAsB,OAAO,CAAA;AAC7B,IAAA,OAAA,CAAQ,CAAA,QAAA,EAAW,KAAK,CAAA,uBAAA,EAA0B,EAAA,CAAG,KAAK,CAAA,oBAAA,CAAsB,CAAA;AAGhF,IAAA,IACE,KAAA,KAAU,CAAA,IACV,EAAA,CAAG,KAAA,KAAU,KACb,WAAA,KAAgB,CAAA,IAChB,CAACA,GAAAA,CAAG,WAAWD,KAAAA,CAAK,IAAA,CAAK,OAAA,EAAS,wBAAwB,CAAC,CAAA,EAC3D;AACA,MAAA,MAAA;AAAA,QACE,CAAA,uBAAA,EAA0B,OAAO,CAAA,oCAAA,EAAuC,wBAAwB,CAAA,OAAA;AAAA,OAClG;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,MAAM,aAAA,GAAgB,QAAA,GAAW,eAAA,GAAkB,iBAAA,GAAoB,kBAAA;AACvE,IAAA,IAAI,aAAA,GAAgB,CAAA,EAAG,OAAA,CAAQ,CAAA,EAAG,aAAa,CAAA,WAAA,CAAa,CAAA;AAC5D,IAAA,IAAI,gBAAgB,CAAA,EAAG;AACrB,MAAA,KAAA,CAAM,qBAAqB,CAAA;AAAA,IAC7B,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,CAAA,EAAG,WAAW,CAAA,oBAAA,CAAsB,CAAA;AAC3C,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,EACF,CAAC,CAAA;AAEH,EAAA,GAAA,CACG,OAAA,CAAQ,UAAU,CAAA,CAClB,WAAA,CAAY,4CAA4C,CAAA,CACxD,QAAA,CAAS,UAAU,2DAA2D,CAAA,CAC9E,OAAO,gBAAA,EAAkB,8CAA8C,EACvE,MAAA,CAAO,UAAA,EAAY,6BAA6B,CAAA,CAChD,SAAA,CAAU,mBAAA,EAAqB,CAAA,CAC/B,MAAA;AAAA,IACC,CACE,SACA,IAAA,KACG;AACH,MAAA,yBAAA,CAA0B,IAAI,CAAA;AAC9B,MAAA,gBAAA,CAAiB,SAAS,IAAI,CAAA;AAAA,IAChC;AAAA,GACF;AAEF,EAAA,GAAA,CACG,QAAQ,WAAW,CAAA,CACnB,YAAY,iEAAiE,CAAA,CAC7E,SAAS,QAAA,EAAU,2DAA2D,CAAA,CAC9E,MAAA,CAAO,gBAAgB,uBAAA,EAAyB,MAAM,EACtD,MAAA,CAAO,CAAC,SAA6B,IAAA,KAA2B;AAC/D,IAAA,MAAM,IAAA,GAAO,iBAAiB,OAAO,CAAA;AACrC,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,MAAM,aAAA,GAAgB,YAAA,CAAa,IAAA,EAAM,IAAA,CAAK,MAAM,WAAW,CAAA;AAC/D,IAAA,IAAI,kBAAkB,IAAA,EAAM;AAC1B,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACd,MAAA;AAAA,IACF;AACA,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAO,SAAQ,GAAI,mBAAA,CAAoB,eAAe,IAAI,CAAA;AAE3E,IAAA,IAAI,QAAQ,MAAA,GAAS,KAAA,CAAM,MAAA,GAAS,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxD,MAAA,KAAA,CAAM,0BAA0B,CAAA;AAChC,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,IAAA,IAAQ,OAAA,EAAS,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,QAAA,CAAU,CAAA;AACnD,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,CAAO,CAAA,EAAG,IAAI,CAAA,mCAAA,CAAqC,CAAA;AAC7E,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAA,CAAO,CAAA,EAAG,KAAK,CAAA,sEAAA,CAAmE,CAAA;AAAA,IACpF;AAEA,IAAA,IAAI,MAAM,MAAA,GAAS,OAAA,CAAQ,SAAS,CAAA,EAAG,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EACvD,CAAC,CAAA;AAEH,EAAA,OAAO,GAAA;AACT","file":"chunk-FWAJUWXQ.js","sourcesContent":["/** Narrow to a plain-object-shaped value (not `null`, not an array); fields stay `unknown`. */\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n","/**\n * `skaile validate` rules for the root `agents:` map of one `skaile.yaml`.\n *\n * Normalisation errors, the `agent:` + `agents.default` conflict, and the\n * asset-dependent rules: every `ref` resolves to an `agent.yaml`, role\n * instances need the asset's `io`, `connectors` bind real connector slots to\n * real `connectors[]` ids, and trigger ids are unique and known.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  AgentRefResolutionError,\n  type AgentInstanceConfig,\n  type AgentInstanceTrigger,\n  agentBlockKeyDiagnostics,\n  agentInstanceDiagnostics,\n  type Diagnostic,\n  normalizeAgentInstances,\n  resolveAgentDefinitionDir,\n} from \"@skaile/workspaces/core\";\nimport { parse as parseYaml } from \"yaml\";\nimport { isRecord } from \"../type-guards.ts\";\n\nconst AGENT_MANIFEST_FILE = \"agent.yaml\";\n\n/** Fields a trigger needs when it declares itself in full (no asset trigger to override). */\nconst TRIGGER_REQUIRED_FIELDS: Record<NonNullable<AgentInstanceTrigger[\"kind\"]>, string[]> = {\n  schedule: [\"cron\", \"prompt\"],\n  webhook: [\"prompt\"],\n  channel: [\"when\"],\n  event: [\"event\"],\n};\n\nconst err = (code: string, message: string, at: string): Diagnostic => ({\n  code,\n  severity: \"error\",\n  message,\n  path: at,\n});\n\n/** The parts of an agent asset the instance rules read. */\ninterface AssetFacts {\n  lifecycle: unknown;\n  hasIo: boolean;\n  /** `composes[].id` of `kind: connector` items. */\n  connectorSlots: string[];\n  /** `composes[].id` of every other item that has one. */\n  otherSlots: string[];\n  triggerIds: string[];\n}\n\nfunction readAssetFacts(manifest: Record<string, unknown>): AssetFacts {\n  const facts: AssetFacts = {\n    lifecycle: manifest.lifecycle,\n    hasIo: manifest.io !== undefined && manifest.io !== null,\n    connectorSlots: [],\n    otherSlots: [],\n    triggerIds: [],\n  };\n  for (const item of Array.isArray(manifest.composes) ? manifest.composes : []) {\n    if (!isRecord(item) || typeof item.id !== \"string\") continue;\n    (item.kind === \"connector\" ? facts.connectorSlots : facts.otherSlots).push(item.id);\n  }\n  for (const t of Array.isArray(manifest.triggers) ? manifest.triggers : []) {\n    if (isRecord(t) && typeof t.id === \"string\") facts.triggerIds.push(t.id);\n  }\n  return facts;\n}\n\n/** Resolve an instance `ref` to its parsed `agent.yaml`, or an error diagnostic. */\nfunction loadAsset(\n  projectDir: string,\n  id: string,\n  ref: string,\n): { facts: AssetFacts } | { diagnostic: Diagnostic } {\n  const at = `agents.${id}.ref`;\n  let dir: string | undefined;\n  try {\n    dir = resolveAgentDefinitionDir(projectDir, ref);\n  } catch (e) {\n    if (!(e instanceof AgentRefResolutionError)) throw e;\n    return { diagnostic: err(\"agent_ref_unresolved\", `agents.${id}: ${e.message}`, at) };\n  }\n  if (dir === undefined) {\n    return {\n      diagnostic: err(\n        \"agent_ref_unresolved\",\n        `agents.${id}: ref \"${ref}\" cannot be resolved — no ai-assets/ directory above the project`,\n        at,\n      ),\n    };\n  }\n  const manifestPath = path.join(dir, AGENT_MANIFEST_FILE);\n  let text: string;\n  try {\n    text = fs.readFileSync(manifestPath, \"utf-8\");\n  } catch {\n    return {\n      diagnostic: err(\n        \"agent_ref_unresolved\",\n        `agents.${id}: ref \"${ref}\" resolves to ${dir}, which has no ${AGENT_MANIFEST_FILE}`,\n        at,\n      ),\n    };\n  }\n  let manifest: unknown;\n  try {\n    manifest = parseYaml(text);\n  } catch (e) {\n    return {\n      diagnostic: err(\n        \"agent_manifest_invalid\",\n        `agents.${id}: ${manifestPath} is not valid YAML: ${e instanceof Error ? e.message : String(e)}`,\n        at,\n      ),\n    };\n  }\n  if (!isRecord(manifest)) {\n    return {\n      diagnostic: err(\n        \"agent_manifest_invalid\",\n        `agents.${id}: ${manifestPath} is not a mapping`,\n        at,\n      ),\n    };\n  }\n  return { facts: readAssetFacts(manifest) };\n}\n\n/**\n * Trigger rules. Duplicate ids are always an error; the asset-dependent rules\n * (known id, complete full declaration) run only when `assetTriggerIds` is\n * known — i.e. the instance's `ref` resolved.\n */\nfunction checkTriggers(\n  id: string,\n  triggers: AgentInstanceTrigger[],\n  assetTriggerIds: string[] | undefined,\n): Diagnostic[] {\n  const out: Diagnostic[] = [];\n  const seen = new Set<string>();\n  triggers.forEach((trigger, i) => {\n    const at = `agents.${id}.triggers[${i}]`;\n    if (seen.has(trigger.id)) {\n      out.push(\n        err(\n          \"agent_trigger_duplicate\",\n          `agents.${id}: trigger id \"${trigger.id}\" is declared twice`,\n          `${at}.id`,\n        ),\n      );\n      return;\n    }\n    seen.add(trigger.id);\n    if (!assetTriggerIds || assetTriggerIds.includes(trigger.id)) return;\n    if (!trigger.kind) {\n      out.push(\n        err(\n          \"agent_trigger_unknown\",\n          `agents.${id}: trigger \"${trigger.id}\" is not declared by the agent asset (${assetTriggerIds.length > 0 ? `has: ${assetTriggerIds.join(\", \")}` : \"it declares no triggers\"}) — add \\`kind\\` and the trigger's fields to declare a new one`,\n          `${at}.id`,\n        ),\n      );\n      return;\n    }\n    const missing = TRIGGER_REQUIRED_FIELDS[trigger.kind].filter(\n      (field) => (trigger as unknown as Record<string, unknown>)[field] === undefined,\n    );\n    if (missing.length > 0) {\n      out.push(\n        err(\n          \"agent_trigger_incomplete\",\n          `agents.${id}: trigger \"${trigger.id}\" (kind ${trigger.kind}) is not in the asset, so it must declare ${missing.join(\", \")}`,\n          at,\n        ),\n      );\n    }\n  });\n  return out;\n}\n\nfunction checkConnectors(\n  id: string,\n  instance: AgentInstanceConfig,\n  facts: AssetFacts,\n  connectorIds: string[],\n): Diagnostic[] {\n  const out: Diagnostic[] = [];\n  for (const [slot, connectorId] of Object.entries(instance.connectors ?? {})) {\n    const at = `agents.${id}.connectors.${slot}`;\n    if (!facts.connectorSlots.includes(slot)) {\n      const hint = facts.otherSlots.includes(slot)\n        ? `\"${slot}\" is a slot of a non-connector item`\n        : facts.connectorSlots.length > 0\n          ? `the asset's connector slots are: ${facts.connectorSlots.join(\", \")}`\n          : \"the asset declares no connector slots\";\n      out.push(\n        err(\n          \"agent_connector_slot_unknown\",\n          `agents.${id}: connectors.${slot} is not a connector slot id of the agent asset (${hint})`,\n          at,\n        ),\n      );\n    }\n    if (!connectorIds.includes(connectorId)) {\n      out.push(\n        err(\n          \"agent_connector_unknown\",\n          `agents.${id}: connectors.${slot} points at \"${connectorId}\", which is not in skaile.yaml connectors[]${connectorIds.length > 0 ? ` (has: ${connectorIds.join(\", \")})` : \"\"}`,\n          at,\n        ),\n      );\n    }\n  }\n  return out;\n}\n\n/**\n * Diagnostics for the `agents:` map of a parsed `skaile.yaml`.\n *\n * @param projectDir - Directory of the `skaile.yaml`; local and catalog refs resolve against it.\n * @param parsed - The raw YAML document.\n */\nexport function checkAgentInstances(\n  projectDir: string,\n  parsed: Record<string, unknown>,\n): Diagnostic[] {\n  const diagnostics: Diagnostic[] = [];\n  const instances = normalizeAgentInstances(parsed.agents, diagnostics);\n  const agent = isRecord(parsed.agent) ? parsed.agent : undefined;\n  diagnostics.push(...agentBlockKeyDiagnostics(parsed.agent));\n  if (agent?.subagents !== undefined) {\n    diagnostics.push(\n      err(\n        \"agent_subagents_removed\",\n        \"`agent.subagents` was removed — declare each subagent as an agent asset and bind it under `agents:` with `lifecycle: role`\",\n        \"agent.subagents\",\n      ),\n    );\n  }\n  if (agent?.instances !== undefined) {\n    diagnostics.push(\n      err(\n        \"misplaced_agent_instances\",\n        \"`agent.instances` is not a skaile.yaml key — declare instances under root `agents:`\",\n        \"agent.instances\",\n      ),\n    );\n  }\n  diagnostics.push(\n    ...agentInstanceDiagnostics({\n      agent: {\n        definition: typeof agent?.definition === \"string\" ? agent.definition : undefined,\n        instances,\n      },\n    }),\n  );\n  if (!instances) return diagnostics;\n\n  const connectorIds = (Array.isArray(parsed.connectors) ? parsed.connectors : []).flatMap((c) =>\n    isRecord(c) && typeof c.id === \"string\" ? [c.id] : [],\n  );\n\n  for (const [id, instance] of Object.entries(instances)) {\n    const loaded = loadAsset(projectDir, id, instance.ref);\n    if (\"diagnostic\" in loaded) {\n      // Asset-independent trigger rules still apply when the ref is broken.\n      diagnostics.push(loaded.diagnostic, ...checkTriggers(id, instance.triggers ?? [], undefined));\n      continue;\n    }\n    const { facts } = loaded;\n    const lifecycle = instance.lifecycle ?? facts.lifecycle ?? \"standing\";\n    if (lifecycle === \"role\" && !facts.hasIo) {\n      diagnostics.push(\n        err(\n          \"agent_role_missing_io\",\n          `agents.${id}: lifecycle \"role\" needs the agent asset to declare \\`io\\` ({ input, output } JSON Schemas)`,\n          `agents.${id}.lifecycle`,\n        ),\n      );\n    }\n    diagnostics.push(...checkConnectors(id, instance, facts, connectorIds));\n    diagnostics.push(...checkTriggers(id, instance.triggers ?? [], facts.triggerIds));\n  }\n  return diagnostics;\n}\n","/**\n * Validate asset versions, changelogs, and manifest schemas across asset repos.\n */\n\nimport { execFileSync } from \"node:child_process\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  ASSET_NAME_HINT,\n  type ConnectorDeclaration,\n  decodeSkaileYaml,\n  isInsideProject,\n  isValidAssetName,\n  loadSkPublishManifest,\n  localConnectorMountDir,\n  parseAssetRef,\n  resolveRuntimeAssets,\n  SKAILE_MANIFEST_FILENAME,\n  readAssetBody,\n} from \"@skaile/workspaces/core\";\nimport {\n  flowSkillVersionPins,\n  loadFlow,\n} from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { parseManifestFile } from \"@skaile/workspaces/discovery\";\nimport { isNonAssetPath } from \"@skaile/workspaces/core/publish-manifest\";\nimport { assertManifestEditable, missingRootAssets } from \"@skaile/workspaces/library\";\nimport type { IAssetKindRegistry } from \"@skaile/workspaces/plugins\";\nimport type { FlowVersionNode } from \"@skaile/workspaces/resolver\";\nimport { validateFlowVersions } from \"@skaile/workspaces/resolver\";\nimport { Command } from \"commander\";\nimport { parse as parseYaml } from \"yaml\";\nimport { type ComposeRefContext, composeRefContext } from \"../agent-checks.ts\";\nimport { logErr, logInfo, logOk, logWarn } from \"../helpers.ts\";\nimport { getKindRegistry } from \"../open-registry.ts\";\nimport { AI_RESOURCES } from \"../paths.ts\";\nimport {\n  checkAsset,\n  declaredVersion,\n  findAssetManifestFile,\n  invalidSemverText,\n} from \"../skill-checks.ts\";\nimport {\n  manifestEntryNameProblems,\n  manifestPublisherProblems,\n  manifestRootProblems,\n  manifestRequiresProblems,\n  registeredAssetKeys,\n  rejectRemovedDomainOption,\n  removedDomainOption,\n  reportLibrarySymlinks,\n  unresolvedManifestDependencies,\n  warnIgnoredDomainFiles,\n  warnLegacyBundleFiles,\n} from \"./library-index.ts\";\nimport { assetEntryRef, manifestVersionMismatchMessage } from \"./publish-core.ts\";\nimport { checkAgentInstances } from \"./validate-instances.ts\";\n\n// ---------------------------------------------------------------------------\n// Manifest schema validation (skaile validate [path])\n// ---------------------------------------------------------------------------\n\n/** Per-type regex patterns for deterministic asset discovery. */\nconst MANIFEST_GLOBS: Array<{ pattern: RegExp; kind: string }> = [\n  { pattern: /\\/SKILL\\.md$/, kind: \"skill\" },\n  { pattern: /\\/agent\\.yaml$/, kind: \"agent\" },\n  { pattern: /\\/AGENT\\.md$/, kind: \"agent\" },\n  { pattern: /\\/CONTRACT\\.md$/, kind: \"contract\" },\n  { pattern: /\\.flow\\.yaml$/, kind: \"flow\" },\n  { pattern: /\\.flow\\.json$/, kind: \"flow\" },\n  { pattern: /\\/CONNECTOR\\.md$/, kind: \"connector\" },\n  { pattern: /\\.prompt\\.md$/, kind: \"prompt\" },\n  { pattern: /\\/MCP\\.md$/, kind: \"mcp-server\" },\n  { pattern: /\\/knowledge\\.yaml$/, kind: \"knowledge\" },\n  { pattern: /\\/knowledge\\/index\\.yaml$/, kind: \"knowledge\" },\n  { pattern: /\\.preset\\.yaml$/, kind: \"preset\" },\n];\n\n/**\n * `.claude`, `.codex` and `.omp` hold the copies `skaile add` deploys for the harnesses (and\n * the harness's own state): a project `validate .` checks what the author owns, not the\n * deployed bytes of an asset published elsewhere (p853).\n */\nconst HARNESS_DIRS: ReadonlySet<string> = new Set([\".claude\", \".codex\", \".omp\"]);\n/** Directories to skip during tree walk. */\nconst SKIP_DIRS = new Set([\n  \"node_modules\",\n  \"dist\",\n  \".git\",\n  \".skaile\",\n  \"__pycache__\",\n  ...HARNESS_DIRS,\n]);\n\ninterface ManifestCandidate {\n  filePath: string;\n  kind: string;\n}\n\n/** Recursively walk a directory tree and find manifest candidates. */\nfunction findManifestCandidates(rootPath: string): ManifestCandidate[] {\n  const candidates: ManifestCandidate[] = [];\n\n  function walk(dir: string): void {\n    let entries: fs.Dirent[];\n    try {\n      entries = fs.readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const entry of entries) {\n      const fullPath = path.join(dir, entry.name);\n      if (entry.isDirectory()) {\n        if (!SKIP_DIRS.has(entry.name)) walk(fullPath);\n      } else if (entry.isFile()) {\n        for (const glob of MANIFEST_GLOBS) {\n          if (glob.pattern.test(fullPath)) {\n            candidates.push({ filePath: fullPath, kind: glob.kind });\n            break;\n          }\n        }\n      }\n    }\n  }\n\n  walk(rootPath);\n  return candidates;\n}\n\n/**\n * Parse a single manifest candidate's bytes with the indexer's own parser\n * (`parseManifestFile`), so a manifest `library index` cannot parse — an empty\n * `SKILL.md`, no frontmatter, invalid YAML — is an error here too. On failure\n * the error is already logged; count it.\n */\nfunction parseManifestCandidate(\n  c: ManifestCandidate,\n  absRoot: string,\n): { kind: \"value\"; parsed: unknown; body?: string } | { kind: \"error\" } {\n  const content = fs.readFileSync(c.filePath, \"utf-8\");\n  const res = parseManifestFile(c.filePath, content);\n  if (!res.ok) {\n    logErr(`${path.relative(absRoot, c.filePath)} [${c.kind}] — parse error: ${res.reason}`);\n    return { kind: \"error\" };\n  }\n  return {\n    kind: \"value\",\n    parsed: res.data,\n    body: readAssetBody(c.filePath, content),\n  };\n}\n\n/**\n * The library root a validated path belongs to: the nearest directory at or above `absRoot`\n * that holds a `skaile.yaml`, else `absRoot` itself.\n */\nfunction libraryRootOf(absRoot: string): string {\n  for (let dir = absRoot; ; dir = path.dirname(dir)) {\n    if (fs.existsSync(path.join(dir, SKAILE_MANIFEST_FILENAME))) return dir;\n    if (path.dirname(dir) === dir) return absRoot;\n  }\n}\n\n/**\n * Validate a single parsed manifest candidate against identity rules + the kind\n * registry. Returns the error/warning deltas this candidate contributes.\n */\nfunction validateManifestCandidate(\n  c: ManifestCandidate,\n  parsed: unknown,\n  body: string | undefined,\n  absRoot: string,\n  registry: IAssetKindRegistry,\n  strictConformance: boolean,\n  composeRefs: ComposeRefContext,\n): { errors: number; warnings: number } {\n  const relPath = path.relative(absRoot, c.filePath);\n  let errors = 0;\n  let warnings = 0;\n\n  // The shared per-asset checks (also run by `library index` and the publish plan):\n  // errors fail validate; advisories are warnings (exit code unchanged) unless\n  // --strict-conformance escalates the agentskills.io conformance ones to errors.\n  const dirName = path.basename(path.dirname(c.filePath)); // the manifest's folder\n  const checked = checkAsset(\n    c.kind,\n    (parsed ?? {}) as Record<string, unknown>,\n    body,\n    dirName,\n    registry,\n    fs.readFileSync(c.filePath, \"utf-8\"),\n    path.basename(c.filePath),\n    { dir: path.dirname(c.filePath), libraryRoot: libraryRootOf(absRoot), composeRefs },\n  );\n  for (const f of checked.errors) {\n    logErr(`${relPath} [${f.tag}] — ${f.text}`);\n    errors++;\n  }\n  for (const f of checked.advisories) {\n    const line = `${relPath} [${f.tag}] — ${f.text}`;\n    // An untouched scaffold body is an error: a passing `validate` means the asset can be published.\n    if ((f.conformance && strictConformance) || f.scaffoldBody) {\n      logErr(line);\n      errors++;\n    } else {\n      logWarn(line);\n      warnings++;\n    }\n  }\n\n  return { errors, warnings };\n}\n\n/**\n * The `kind:name` identity of every asset manifest under `root`, read quietly: a manifest\n * that does not parse holds no identity (its own validation reports the error).\n */\nexport function scanIdentities(root: string): Set<string> {\n  const identities = new Set<string>();\n  for (const c of findManifestCandidates(root)) {\n    let parsed: unknown;\n    try {\n      const res = parseManifestFile(c.filePath, fs.readFileSync(c.filePath, \"utf-8\"));\n      if (!res.ok) continue;\n      parsed = res.data;\n    } catch {\n      continue;\n    }\n    if (parsed === null || typeof parsed !== \"object\") continue;\n    const identity = (parsed as Record<string, unknown>)[c.kind === \"flow\" ? \"id\" : \"name\"];\n    if (typeof identity === \"string\" && identity.length > 0)\n      identities.add(`${c.kind}:${identity}`);\n  }\n  return identities;\n}\n\n/** Validate all manifest files in a directory tree using the kind registry. */\nexport function validateManifests(\n  rootPath: string,\n  strictConformance: boolean,\n  registeredAssets: ReadonlySet<string> = new Set(),\n): { total: number; errors: number; warnings: number } {\n  const absRoot = path.resolve(rootPath);\n  if (!fs.existsSync(absRoot)) {\n    logErr(`Path does not exist: ${absRoot}`);\n    return { total: 0, errors: 1, warnings: 0 };\n  }\n\n  const registry: IAssetKindRegistry = getKindRegistry();\n  const candidates = findManifestCandidates(absRoot);\n  // Symlinks are refused with the text `library index` and the publish plan print (p520). In a\n  // library (a `skaile.manifest.yaml` at the root) any symlink is refused, as `git add -A`\n  // would publish it; elsewhere (a project) only those inside an asset or looping.\n  const isLibrary = fs.existsSync(path.join(absRoot, SKAILE_MANIFEST_FILENAME));\n  // A project's deployed harness folders (`add --link` makes `.claude/skills/x` a link to the\n  // project's own `skills/x`) are not sources: they are skipped here as in the manifest walk.\n  let errors = reportLibrarySymlinks(absRoot, {\n    wholeTree: isLibrary,\n    skipDirs: isLibrary ? undefined : HARNESS_DIRS,\n  });\n  let warnings = 0;\n\n  // kind:name → directory of the first manifest seen; a second directory with the same\n  // identity cannot be told apart by `add`/`publish` (and `library index` skips it).\n  const seenIdentity = new Map<string, string>();\n  // `composes:` refs resolve against the assets of the whole library (the scanned tree plus,\n  // when `validate` got a sub-directory, its siblings under the enclosing library root) and the\n  // registered libraries of its publisher: a ref no library holds fails `skaile add` (p415).\n  const libraryRoot = libraryRootOf(absRoot);\n  const composeRefs = composeRefContext(\n    scanIdentities(libraryRoot),\n    registeredAssets,\n    loadSkPublishManifest(libraryRoot)?.publisher,\n  );\n  for (const c of candidates) {\n    const parseResult = parseManifestCandidate(c, absRoot);\n    if (parseResult.kind === \"error\") {\n      errors++;\n      continue;\n    }\n\n    const delta = validateManifestCandidate(\n      c,\n      parseResult.parsed,\n      parseResult.body,\n      absRoot,\n      registry,\n      strictConformance,\n      composeRefs,\n    );\n    errors += delta.errors;\n    warnings += delta.warnings;\n    const obj = parseResult.parsed as Record<string, unknown> | null;\n    const identity = obj && typeof obj === \"object\" ? obj[c.kind === \"flow\" ? \"id\" : \"name\"] : null;\n    if (typeof identity === \"string\" && identity.length > 0) {\n      const dir = path.dirname(c.filePath);\n      const key = `${c.kind}:${identity}`;\n      const first = seenIdentity.get(key);\n      if (first === undefined) {\n        seenIdentity.set(key, dir);\n      } else if (first !== dir) {\n        logErr(\n          `${path.relative(absRoot, c.filePath)} [${c.kind}] — ${key} is also defined in ${path.relative(absRoot, first) || \".\"}; ` +\n            \"two directories cannot share a kind and name (`skaile library index` keeps only the first).\",\n        );\n        errors++;\n      }\n    }\n  }\n\n  return { total: candidates.length, errors, warnings };\n}\n\n/** Recursively find every `skaile.yaml` / `*.skaile.yaml` workspace manifest. */\nfunction findWorkspaceManifests(rootPath: string): string[] {\n  const out: string[] = [];\n  function walk(dir: string): void {\n    let entries: fs.Dirent[];\n    try {\n      entries = fs.readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const entry of entries) {\n      const full = path.join(dir, entry.name);\n      if (entry.isDirectory()) {\n        if (!SKIP_DIRS.has(entry.name)) walk(full);\n      } else if (entry.isFile() && /(^|\\.)skaile\\.yaml$/.test(entry.name)) {\n        out.push(full);\n      }\n    }\n  }\n  walk(rootPath);\n  return out;\n}\n\n/**\n * Validate the dependency refs and asset identities declared in every\n * `skaile.yaml` under a tree. This is the manifest-level mirror of the\n * per-file identity check: it parses each `dependencies[]` /\n * `overrides[].ref` through `parseAssetRef` (the exact code path that produced\n * the original \"publisher required …\" / \"invalid asset name …\" hard error) and\n * checks each `assets[].name` against the canonical name grammar.\n */\n/**\n * Collect every `[field, ref]` pair to validate from a workspace manifest:\n * each string in `dependencies[]` and each `overrides[].ref`.\n */\nfunction collectWorkspaceRefFields(parsed: Record<string, unknown>): Array<[string, string]> {\n  const refFields: Array<[string, string]> = [];\n  if (Array.isArray(parsed.dependencies)) {\n    for (const d of parsed.dependencies) {\n      if (typeof d === \"string\") refFields.push([\"dependencies\", d]);\n    }\n  }\n  if (Array.isArray(parsed.overrides)) {\n    for (const o of parsed.overrides) {\n      const ref = (o as Record<string, unknown>)?.ref;\n      if (typeof ref === \"string\") refFields.push([\"overrides.ref\", ref]);\n    }\n  }\n  return refFields;\n}\n\n/** Parse each declared ref through `parseAssetRef`; returns the error count. */\nfunction validateWorkspaceRefs(refFields: Array<[string, string]>, relPath: string): number {\n  let errors = 0;\n  for (const [field, ref] of refFields) {\n    try {\n      parseAssetRef(ref);\n    } catch (e) {\n      logErr(`${relPath} [${field}] — ${e instanceof Error ? e.message : String(e)}`);\n      errors++;\n    }\n  }\n  return errors;\n}\n\n/** Validate `assets[].name` against the canonical name/ref grammar. */\nfunction validateWorkspaceAssets(parsed: Record<string, unknown>, relPath: string): number {\n  if (!Array.isArray(parsed.assets)) return 0;\n  let errors = 0;\n  const topPublisher = typeof parsed.publisher === \"string\" ? parsed.publisher : undefined;\n  for (const a of parsed.assets) {\n    const asset = a as Record<string, unknown>;\n    const name = asset?.name;\n    const kind = typeof asset?.kind === \"string\" ? asset.kind : \"skill\";\n    if (typeof name !== \"string\" || name.length === 0) continue;\n    const publisher = typeof asset?.publisher === \"string\" ? asset.publisher : topPublisher;\n    if (publisher !== undefined) {\n      try {\n        parseAssetRef(`${kind}:@${publisher}/${name}`);\n      } catch (e) {\n        logErr(`${relPath} [assets] — ${e instanceof Error ? e.message : String(e)}`);\n        errors++;\n      }\n    } else if (!isValidAssetName(name)) {\n      logErr(`${relPath} [assets] — invalid asset name \"${name}\" — ${ASSET_NAME_HINT}`);\n      errors++;\n    }\n  }\n  return errors;\n}\n\n/** `skaile.yaml` connector diagnostics that fail `validate` (the runner cannot mount it right). */\nconst CONNECTOR_ERROR_CODES: readonly string[] = [\n  \"connector_missing_driver\",\n  \"connector_missing_id\",\n  \"connector_duplicate_id\",\n  \"connector_invalid_access\",\n];\n\n/**\n * A `local` connector's `mountPath` is mounted read-write as given: one that does not exist\n * fails (`serve` refuses it too), one outside the project is a warning (p833).\n */\nfunction validateLocalConnectorMountPaths(\n  projectDir: string,\n  relPath: string,\n  connectors: ReadonlyArray<ConnectorDeclaration>,\n): number {\n  let errors = 0;\n  for (const c of connectors) {\n    if (c.driver !== \"local\" || c.mount) continue;\n    const dir = localConnectorMountDir(c, projectDir);\n    if (!dir) continue;\n    if (!fs.existsSync(dir)) {\n      logErr(\n        `${relPath} [connectors] — connector_mount_path_missing: connectors.${c.id}.mountPath: ${dir} does not exist; create the directory or fix the path`,\n      );\n      errors++;\n    } else if (!isInsideProject(dir, projectDir)) {\n      logWarn(\n        `${relPath} [connectors] — connectors.${c.id}.mountPath: ${dir} is outside the project ${projectDir}; the agent reads${c.access === \"read-write\" ? \" and writes\" : \"\"} there`,\n      );\n    }\n  }\n  return errors;\n}\n\nasync function validateWorkspaceManifests(rootPath: string): Promise<{\n  total: number;\n  errors: number;\n}> {\n  const absRoot = path.resolve(rootPath);\n  const files = findWorkspaceManifests(absRoot);\n  let errors = 0;\n\n  for (const file of files) {\n    const relPath = path.relative(absRoot, file);\n    let parsed: Record<string, unknown>;\n    try {\n      parsed = (parseYaml(fs.readFileSync(file, \"utf-8\")) ?? {}) as Record<string, unknown>;\n    } catch (e) {\n      logErr(`${relPath} — parse error: ${e instanceof Error ? e.message : String(e)}`);\n      errors++;\n      continue;\n    }\n\n    errors += validateWorkspaceRefs(collectWorkspaceRefFields(parsed), relPath);\n    errors += validateWorkspaceAssets(parsed, relPath);\n    for (const d of checkAgentInstances(path.dirname(file), parsed)) {\n      const line = `${relPath} [agents] — ${d.code}: ${d.path ? `${d.path}: ` : \"\"}${d.message}`;\n      if (d.severity === \"error\") {\n        logErr(line);\n        errors++;\n      } else {\n        logWarn(line);\n      }\n    }\n    // A connector the runner cannot mount or mounts wrongly: no `driver` (or the old `adapter`\n    // spelling), no `id`, a duplicate `id`, an `access` that is neither read-only nor read-write.\n    const decoded = decodeSkaileYaml(fs.readFileSync(file, \"utf-8\"));\n    for (const d of decoded.diagnostics) {\n      if (!CONNECTOR_ERROR_CODES.includes(d.code)) continue;\n      logErr(`${relPath} [connectors] — ${d.code}: ${d.path ? `${d.path}: ` : \"\"}${d.message}`);\n      errors++;\n    }\n    errors += validateLocalConnectorMountPaths(\n      path.dirname(file),\n      relPath,\n      decoded.config?.connectors ?? [],\n    );\n    // A `driver` no catalog entry provides: `serve` cannot mount it either. The text is the one\n    // `serve` logs as `validation_warning`. An unreachable source (not cloned yet) may hold the\n    // driver, so nothing is reported while one is missing.\n    if ((decoded.config?.connectors ?? []).length > 0) {\n      const assets = await resolveRuntimeAssets(path.dirname(file));\n      if (!assets.warnings.some((w) => w.code === \"repo_unavailable\")) {\n        for (const w of assets.warnings) {\n          if (w.code !== \"missing_driver\" || !w.name) continue;\n          logErr(`${relPath} [connectors] — ${w.code}: ${w.message}`);\n          errors++;\n        }\n      }\n    }\n  }\n\n  return { total: files.length, errors };\n}\n\n/**\n * Check the library's publication manifest (`skaile.manifest.yaml` at the\n * validated root): every first-party `root:` must still exist. An entry whose\n * directory was deleted would otherwise stay publishable; the fix is\n * `skaile library index <lib>`, which drops it.\n */\nfunction validatePublishManifestRoots(rootPath: string): number {\n  const absRoot = path.resolve(rootPath);\n  const manifest = loadSkPublishManifest(absRoot);\n  if (!manifest) return 0;\n  const missing = missingRootAssets(absRoot, manifest);\n  for (const a of missing) {\n    logErr(\n      `${SKAILE_MANIFEST_FILENAME} [assets] — ${assetEntryRef(a, manifest)}: root \"${a.root}\" does not exist. ` +\n        \"Run `skaile library index <library>` to drop the entry, or restore the directory.\",\n    );\n  }\n  return missing.length;\n}\n\n/**\n * Check every `assets[].dependencies` entry of the publication manifest with the\n * same syntax rule (and message) `library index` applies, so a malformed ref\n * fails `validate` instead of being silently dropped by the manifest decoder.\n */\nfunction validatePublishManifestRequires(rootPath: string): number {\n  const problems = manifestRequiresProblems(path.resolve(rootPath));\n  for (const p of problems) {\n    logErr(\n      `${SKAILE_MANIFEST_FILENAME} [assets] — ${p.asset}: ${p.message}. ` +\n        \"Use the `kind:@<publisher>/name[#version]` form.\",\n    );\n  }\n  return problems.length;\n}\n\n/**\n * Check the publisher of the publication manifest (top-level and every\n * `assets[].publisher`) against the one publisher slug rule `library create`, `library\n * index` and the publish plan apply, with the same message.\n */\nfunction validatePublishManifestPublisherSlugs(rootPath: string): number {\n  const problems = manifestPublisherProblems(path.resolve(rootPath));\n  for (const message of problems) logErr(message);\n  return problems.length;\n}\n\n/**\n * Check every first-party `assets[].root` of the publication manifest stays inside the library\n * and crosses no symlink ({@link manifestRootProblems}), the refusal `library index` and the\n * publish plan print too: a root outside the library is never found by `add` (p701).\n */\nfunction validatePublishManifestRootPaths(rootPath: string): number {\n  const problems = [\n    ...manifestRootProblems(path.resolve(rootPath)),\n    ...manifestEntryNameProblems(path.resolve(rootPath)),\n  ];\n  for (const message of problems) logErr(message);\n  return problems.length;\n}\n\n/**\n * Parse the publication manifest the way `library index` and `library publish` open it, so a\n * `skaile.manifest.yaml` that does not parse fails `validate` too, with the file and line.\n * Without the file there is nothing to check.\n */\nfunction validatePublishManifestParses(rootPath: string): number {\n  try {\n    assertManifestEditable(path.resolve(rootPath));\n    return 0;\n  } catch (err) {\n    logErr(err instanceof Error ? err.message : String(err));\n    return 1;\n  }\n}\n\n/**\n * Warn when a first-party `assets[].version` of the publication manifest differs\n * from the version in the asset's own manifest file. The file is the source of\n * truth — `skaile library index` rewrites the entry from it — so a hand-edited\n * manifest version is silently overwritten by the next index. Returns the warning count.\n */\nfunction validatePublishManifestVersions(rootPath: string): number {\n  const absRoot = path.resolve(rootPath);\n  const manifest = loadSkPublishManifest(absRoot);\n  if (!manifest || manifest.source) return 0;\n  let warnings = 0;\n  for (const a of manifest.assets ?? []) {\n    if (!a.root || a.source || !a.version) continue;\n    const file = findAssetManifestFile(path.join(absRoot, a.root), a.kind, a.name);\n    if (!file) continue;\n    const res = parseManifestFile(file, fs.readFileSync(file, \"utf-8\"));\n    if (!res.ok) continue; // reported by the per-file parse check\n    const fileVersion = declaredVersion(res.data);\n    if (fileVersion === undefined || fileVersion === a.version) continue;\n    logWarn(\n      manifestVersionMismatchMessage(\n        assetEntryRef(a, manifest),\n        a.version,\n        toPosix(path.relative(absRoot, file)),\n        fileVersion,\n      ),\n    );\n    warnings++;\n  }\n  return warnings;\n}\n\n/**\n * Warn when a first-party asset file still carries a `metadata.publisher` that\n * differs from the publisher the manifest resolves for it (`assets[].publisher`,\n * else the top-level `publisher`). The manifest is the only source of an\n * asset's publisher; the file value is ignored by every resolver, so a stale\n * one only misleads the reader. Returns the warning count.\n */\nfunction validatePublishManifestPublishers(rootPath: string): number {\n  const absRoot = path.resolve(rootPath);\n  const manifest = loadSkPublishManifest(absRoot);\n  if (!manifest || manifest.source) return 0;\n  const bare = (p: string) => p.trim().replace(/^@/, \"\");\n  let warnings = 0;\n  for (const a of manifest.assets ?? []) {\n    const resolved = a.publisher ?? manifest.publisher;\n    if (!a.root || a.source || !resolved) continue;\n    const file = findAssetManifestFile(path.join(absRoot, a.root), a.kind, a.name);\n    if (!file) continue;\n    const res = parseManifestFile(file, fs.readFileSync(file, \"utf-8\"));\n    if (!res.ok) continue; // reported by the per-file parse check\n    const meta = (res.data as Record<string, unknown>).metadata;\n    const declared =\n      meta !== null && typeof meta === \"object\"\n        ? (meta as Record<string, unknown>).publisher\n        : null;\n    if (typeof declared !== \"string\" || bare(declared) === bare(resolved)) continue;\n    logWarn(\n      `${toPosix(path.relative(absRoot, file))} [publisher] — metadata.publisher \"${bare(declared)}\" differs from ` +\n        `the manifest publisher \"${bare(resolved)}\" for ${assetEntryRef(a, manifest)}. The manifest wins and the ` +\n        \"file value is ignored: delete `metadata.publisher` from the file, or set the publisher in \" +\n        `${SKAILE_MANIFEST_FILENAME}.`,\n    );\n    warnings++;\n  }\n  return warnings;\n}\n\n/** Root-relative path prefixes excluded from version/changelog checks. */\nconst EXCLUDED_PATHS = [\"skaileup-shared/\", \"external/\", \"docs/\"];\n\n/** Normalise to forward slashes so prefix and set comparisons work on any OS. */\nfunction toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** True when a root-relative path sits under one of {@link EXCLUDED_PATHS}. */\nfunction isExcludedPath(relPath: string): boolean {\n  const rel = toPosix(relPath);\n  return EXCLUDED_PATHS.some((prefix) => rel.startsWith(prefix));\n}\n\ninterface AssetVersion {\n  kind: \"skill\" | \"agent\" | \"flow\" | \"prompt\" | \"preset\" | \"contract\";\n  name: string;\n  version: string;\n  filePath: string;\n}\n\n/** Manifest candidates whose kind carries a version `validate versions` checks. */\nconst VERSIONED_KINDS: Record<string, true> = {\n  skill: true,\n  agent: true,\n  flow: true,\n  prompt: true,\n  preset: true,\n  contract: true,\n};\n\n/** Read one manifest candidate's identity and version; unreadable YAML yields an empty version. */\nfunction readAssetVersion(c: ManifestCandidate): AssetVersion {\n  const kind = c.kind as AssetVersion[\"kind\"];\n  const fileName = path.basename(c.filePath);\n  const dirName = path.basename(path.dirname(c.filePath));\n  const content = fs.readFileSync(c.filePath, \"utf-8\");\n  if (c.filePath.endsWith(\".md\")) {\n    // The version `library index` records (top-level `version`, else `metadata.version`).\n    const res = parseManifestFile(c.filePath, content);\n    const data = res.ok ? (res.data as Record<string, unknown>) : {};\n    const stem = fileName.replace(/\\.prompt\\.md$/, \"\");\n    return {\n      kind,\n      name: typeof data.name === \"string\" ? data.name : kind === \"prompt\" ? stem : dirName,\n      version: declaredVersion(data) ?? \"\",\n      filePath: c.filePath,\n    };\n  }\n  let parsed: Record<string, unknown> | null = null;\n  try {\n    parsed = parseYaml(content);\n  } catch {\n    // Reported by the default `skaile validate`; here the asset just has no readable version.\n  }\n  if (kind === \"flow\") {\n    return {\n      kind,\n      name: String(parsed?.id ?? fileName.replace(\".flow.yaml\", \"\")),\n      version: String(parsed?.version ?? \"\"),\n      filePath: c.filePath,\n    };\n  }\n  return {\n    kind,\n    name: String(parsed?.name ?? dirName),\n    version: String(parsed?.version ?? \"\"),\n    filePath: c.filePath,\n  };\n}\n\n/**\n * Walk `root` at any depth and collect the version of every skill, agent, flow, prompt,\n * preset and contract — the same tree walk the default `validate` uses, so a library laid out\n * as `<root>/<asset>/SKILL.md` is covered as well as `skills/<asset>/SKILL.md`.\n */\nfunction collectAssetVersions(root: string): AssetVersion[] {\n  if (!fs.existsSync(root)) return [];\n  const assets: AssetVersion[] = [];\n  for (const c of findManifestCandidates(root)) {\n    if (!VERSIONED_KINDS[c.kind]) continue;\n    // Only the YAML flow form and `agent.yaml` / `AGENT.md` carry a readable version here.\n    if (c.filePath.endsWith(\".flow.json\")) continue;\n    if (isExcludedPath(path.relative(root, c.filePath))) continue;\n    assets.push(readAssetVersion(c));\n  }\n  return assets;\n}\n\n/** Root-relative posix location of an asset file, for messages. */\nfunction assetLocation(a: AssetVersion, root: string): string {\n  return toPosix(path.relative(root, a.filePath));\n}\n\n/**\n * Nearest ancestor directory of `assetRelPath` (root-relative, posix) that\n * holds a `CHANGELOG.md`, walking up from the asset's own directory to and\n * including `root`, never above it. Returns the changelog's root-relative\n * path, or `null` when no ancestor has one.\n */\nfunction findChangelogUnit(assetRelPath: string, root: string): string | null {\n  let dir = path.posix.dirname(toPosix(assetRelPath));\n  for (;;) {\n    const candidate = dir === \".\" ? \"CHANGELOG.md\" : `${dir}/CHANGELOG.md`;\n    if (fs.existsSync(path.join(root, candidate))) return candidate;\n    if (dir === \".\") return null;\n    dir = path.posix.dirname(dir);\n  }\n}\n\n/** Outcome of {@link checkChangelogUnits}. All paths are root-relative posix. */\nexport interface ChangelogCheck {\n  /** Changelog units whose `CHANGELOG.md` is among the modified files. */\n  updated: string[];\n  /** Changelog units covering a modified asset whose `CHANGELOG.md` is not modified. */\n  stale: string[];\n  /** Modified assets with no `CHANGELOG.md` in any ancestor up to the root. */\n  orphans: string[];\n}\n\n/**\n * Group the modified asset files by their nearest-ancestor `CHANGELOG.md` and\n * report which units were updated alongside them. Assets under\n * {@link EXCLUDED_PATHS} are ignored.\n *\n * @param modifiedFiles - Changed paths relative to `root`.\n * @param root - The asset root (`ai-assets/`); the walk up never leaves it.\n */\nexport function checkChangelogUnits(modifiedFiles: string[], root: string): ChangelogCheck {\n  const modified = new Set(modifiedFiles.map(toPosix));\n  const assetPattern = /(SKILL\\.md|agent\\.yaml|\\.flow\\.yaml|\\.prompt\\.md)$/;\n  const units = new Set<string>();\n  const orphans: string[] = [];\n  for (const f of modified) {\n    if (!assetPattern.test(f) || isExcludedPath(f)) continue;\n    const unit = findChangelogUnit(f, root);\n    if (unit) units.add(unit);\n    else orphans.push(f);\n  }\n  const updated = [...units].filter((u) => modified.has(u));\n  const stale = [...units].filter((u) => !modified.has(u));\n  return { updated, stale, orphans };\n}\n\n/** Extract version from file content using proper YAML parsing */\nfunction extractVersionFromContent(filePath: string, content: string): string | null {\n  if (filePath.endsWith(\".yaml\")) {\n    const parsed = parseYaml(content);\n    return parsed?.version ?? null;\n  }\n  // SKILL.md / .prompt.md — YAML frontmatter\n  const fmMatch = content.match(/^---\\n([\\s\\S]*?)\\n---/);\n  if (!fmMatch) return null;\n  const parsed = parseYaml(fmMatch[1]);\n  return parsed?.metadata?.version ?? parsed?.version ?? null;\n}\n\n/** Check every asset has a present + semver-valid version. */\nfunction checkAssetVersions(\n  assets: AssetVersion[],\n  root: string,\n): { errors: number; warnings: number } {\n  let errors = 0;\n  const warnings = 0;\n  for (const a of assets) {\n    const location = assetLocation(a, root);\n    if (!a.version) {\n      logErr(`${a.kind}:${a.name} (${location}) — missing version`);\n      errors++;\n      continue;\n    }\n    const invalid = invalidSemverText(a.version);\n    if (invalid) {\n      logErr(`${a.kind}:${a.name} (${location}) — ${invalid}`);\n      errors++;\n    }\n  }\n  return { errors, warnings };\n}\n\n/** In --changed-only mode, warn when a changed asset's version was not bumped. */\nfunction checkVersionBumps(assets: AssetVersion[], root: string): number {\n  let warnings = 0;\n  for (const a of assets) {\n    if (!a.version) continue; // already flagged above\n    // `HEAD:./<path>` is relative to `root` (the cwd), not the repository top level.\n    const relPath = toPosix(path.relative(root, a.filePath));\n    try {\n      const headContent = execFileSync(\"git\", [\"show\", `HEAD:./${relPath}`], {\n        cwd: root,\n        encoding: \"utf-8\",\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      });\n      const headVersion = extractVersionFromContent(a.filePath, headContent);\n      if (headVersion && headVersion === a.version) {\n        logWarn(\n          `${a.kind}:${a.name} (${assetLocation(a, root)}) — file changed but version not bumped (${a.version})`,\n        );\n        warnings++;\n      }\n    } catch {\n      // New file (no HEAD version) — that's fine\n    }\n  }\n  return warnings;\n}\n\n/**\n * Validate flow node skill-version pins against the discovered skill versions.\n *\n * Flows are read through `loadFlow`, which normalizes legacy v1 documents into\n * the strict v2 shape — reading the authored YAML directly would miss every v2\n * pin, since those ride in `run.assets` rather than `node.data.version`.\n */\nfunction checkFlowVersionPins(\n  assets: AssetVersion[],\n  root: string,\n): { errors: number; warnings: number } {\n  const flows = assets.filter((a) => a.kind === \"flow\");\n  const skillVersionMap = new Map<string, string>();\n  for (const a of assets.filter((a) => a.kind === \"skill\")) {\n    skillVersionMap.set(a.name, a.version);\n  }\n\n  let errors = 0;\n  let warnings = 0;\n  for (const f of flows) {\n    let pins: FlowVersionNode[];\n    try {\n      pins = flowSkillVersionPins(loadFlow(f.filePath));\n    } catch (err) {\n      // An unreadable flow is a gap in the check, not an absence of findings.\n      // Report the path, not `f.name`: that id comes from a raw-YAML read that\n      // falls back to the filename stem exactly when the file is unusable.\n      logWarn(\n        `flow:${f.name} (${path.relative(root, f.filePath)}) — could not be read: ` +\n          `${err instanceof Error ? err.message : err}`,\n      );\n      warnings++;\n      continue;\n    }\n\n    if (pins.length === 0) continue;\n    const checks = validateFlowVersions(pins, skillVersionMap);\n    for (const c of checks.filter((c) => !c.satisfied)) {\n      logErr(\n        `flow:${f.name} node ${c.nodeId} — wants ${c.requested}, found ${c.actual || \"(none)\"}`,\n      );\n      errors++;\n    }\n  }\n  return { errors, warnings };\n}\n\n/**\n * Root of a `validate versions` / `validate changelog` run: the explicit `[path]`,\n * else the library the shell is in (the nearest directory at or above the cwd\n * that holds `skaile.manifest.yaml`), else the bundled factory assets\n * ({@link AI_RESOURCES}). Returns `null` after printing an error when an explicit\n * path does not exist.\n */\nfunction resolveCheckRoot(pathArg: string | undefined): string | null {\n  if (pathArg) {\n    const abs = path.resolve(pathArg);\n    if (!fs.existsSync(abs)) {\n      logErr(`Path does not exist: ${abs}`);\n      return null;\n    }\n    return abs;\n  }\n  for (let dir = process.cwd(); ; dir = path.dirname(dir)) {\n    if (fs.existsSync(path.join(dir, SKAILE_MANIFEST_FILENAME))) return dir;\n    if (path.dirname(dir) === dir) return AI_RESOURCES;\n  }\n}\n\n/** `true` when `root` lies inside a git work tree. */\nfunction isInGitWorkTree(root: string): boolean {\n  try {\n    return (\n      execFileSync(\"git\", [\"rev-parse\", \"--is-inside-work-tree\"], {\n        cwd: root,\n        encoding: \"utf-8\",\n        stdio: [\"ignore\", \"pipe\", \"ignore\"],\n      }).trim() === \"true\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Run `git diff --name-only --relative <ref>` in `root` and return the changed paths\n * (relative to `root`), plus — with `untracked` — the new files git does not track yet.\n * No git work tree prints `<what> needs a git repository`; any other git failure — a bad\n * ref, no `git` — prints one `git diff failed in <root>: <first stderr line>` line. Both\n * return `null`; git's own usage text never reaches the terminal.\n *\n * @param what The command that needs git, for the message (`--changed-only`, `changelog`).\n */\nfunction changedFiles(\n  root: string,\n  ref: string,\n  what: string,\n  opts: { untracked?: boolean } = {},\n): string[] | null {\n  if (!isInGitWorkTree(root)) {\n    logErr(`${what} needs a git repository: ${root} is not inside a git work tree.`);\n    return null;\n  }\n  try {\n    const out = execFileSync(\n      \"git\",\n      [\"diff\", \"--name-only\", \"--relative\", \"--end-of-options\", ref],\n      {\n        cwd: root,\n        encoding: \"utf-8\",\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      },\n    );\n    const changed = out.trim().split(\"\\n\").filter(Boolean);\n    if (opts.untracked) {\n      // New files git does not track yet (`--others` paths are relative to `root`).\n      const fresh = execFileSync(\"git\", [\"ls-files\", \"--others\", \"--exclude-standard\"], {\n        cwd: root,\n        encoding: \"utf-8\",\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      });\n      changed.push(...fresh.trim().split(\"\\n\").filter(Boolean));\n    }\n    return changed;\n  } catch (err) {\n    const stderr = err instanceof Error && \"stderr\" in err ? String(err.stderr).trim() : \"\";\n    const reason = (stderr || (err instanceof Error ? err.message : String(err))).split(\"\\n\")[0];\n    logErr(`git diff failed in ${root}: ${reason}`);\n    return null;\n  }\n}\n\n/**\n * The directory whose files belong to `a`: the asset's own folder for a skill, agent, contract,\n * or a prompt/flow/preset that sits in a folder named after it — the folder `library create`\n * scaffolds. A single prompt/flow/preset file next to others is its own asset (`null`).\n */\nfunction assetOwnDir(a: AssetVersion): string | null {\n  const dir = path.dirname(a.filePath);\n  if ([\"skill\", \"agent\", \"contract\"].includes(a.kind) || path.basename(dir) === a.name) return dir;\n  return null;\n}\n\n/**\n * `true` when `a` changed: its asset file, or any file under its folder that a deploy ships\n * (the lock hash covers them, minus the deploy ignore list), is among `changedAbs`.\n */\nfunction assetChanged(a: AssetVersion, changedAbs: ReadonlySet<string>): boolean {\n  if (changedAbs.has(a.filePath)) return true;\n  const dir = assetOwnDir(a);\n  if (dir === null) return false;\n  for (const f of changedAbs) {\n    const rel = path.relative(dir, f);\n    if (rel.startsWith(\"..\") || path.isAbsolute(rel)) continue;\n    if (!isNonAssetPath(toPosix(rel))) return true;\n  }\n  return false;\n}\n\n/** Body of `skaile validate versions` — semver + bump + flow-pin checks. */\nfunction runVersionsCheck(\n  pathArg: string | undefined,\n  opts: { changedOnly?: boolean; strict?: boolean },\n): void {\n  const root = resolveCheckRoot(pathArg);\n  if (root === null) {\n    process.exit(1);\n    return;\n  }\n  let assets = collectAssetVersions(root);\n\n  // Filter to changed files only if requested\n  if (opts.changedOnly) {\n    const changed = changedFiles(root, \"HEAD\", \"--changed-only\", { untracked: true });\n    if (changed === null) {\n      process.exit(1);\n      return;\n    }\n    const changedAbs = new Set(changed.map((f) => path.resolve(root, f)));\n    assets = assets.filter((a) => assetChanged(a, changedAbs));\n  }\n\n  logInfo(`Checking versions in ${root}`);\n  const versionCheck = checkAssetVersions(assets, root);\n  let errors = versionCheck.errors;\n  let warnings = versionCheck.warnings;\n\n  // In --changed-only mode, check if version was actually bumped\n  if (opts.changedOnly) {\n    warnings += checkVersionBumps(assets, root);\n  }\n\n  const pinCheck = checkFlowVersionPins(assets, root);\n  errors += pinCheck.errors;\n  warnings += pinCheck.warnings;\n\n  // Summary\n  console.log();\n  logInfo(`Checked ${assets.length} assets`);\n  if (errors === 0 && warnings === 0) {\n    logOk(\"All versions valid\");\n  } else {\n    if (errors > 0) logErr(`${errors} error(s)`);\n    if (warnings > 0) logWarn(`${warnings} warning(s)`);\n  }\n\n  if (errors > 0 || (opts.strict && warnings > 0)) {\n    process.exit(1);\n  }\n}\n\n/**\n * Creates the `skaile validate` command group.\n *\n * Validates asset manifests, version fields, and changelogs in an asset\n * repository tree. Subcommands: default `validate [path]` (schema check),\n * `versions` (semver + flow pin validation), `changelog` (modified assets\n * must have an updated nearest-ancestor CHANGELOG.md).\n *\n * @returns Configured {@link Command} ready for `program.addCommand()`.\n * @docLink cli/commands/validate#make-validate-command\n */\nexport function makeValidateCommand(): Command {\n  const cmd = new Command(\"validate\").description(\n    \"Validate asset manifests, versions, and changelogs\",\n  );\n\n  // Default action: skaile validate [path]\n  cmd\n    .argument(\"[path]\", \"Path to asset repo or directory to validate\", \".\")\n    .option(\n      \"--strict-conformance\",\n      \"Treat Agent Skills (agentskills.io) standard findings as errors\",\n    )\n    .action(async (targetPath: string, opts: { strictConformance?: boolean }) => {\n      const absPath = path.resolve(targetPath);\n      if (fs.existsSync(absPath) && !fs.statSync(absPath).isDirectory()) {\n        logErr(`${absPath} is not a directory: nothing to validate. Pass the library directory.`);\n        process.exit(1);\n        return;\n      }\n      logInfo(`Validating manifests in ${absPath}`);\n      const { total, errors, warnings } = validateManifests(\n        absPath,\n        opts.strictConformance ?? false,\n        await registeredAssetKeys(libraryRootOf(absPath)),\n      );\n      const ws = await validateWorkspaceManifests(absPath);\n      const rootErrors = validatePublishManifestRoots(absPath);\n      const slugErrors = validatePublishManifestPublisherSlugs(absPath);\n      const rootPathErrors = validatePublishManifestRootPaths(absPath);\n      const parseErrors = validatePublishManifestParses(absPath);\n      const requiresErrors = validatePublishManifestRequires(absPath);\n      const versionWarnings = validatePublishManifestVersions(absPath);\n      const publisherWarnings = validatePublishManifestPublishers(absPath);\n      // Advisory and offline: a dependency no registered library holds may live in a\n      // library that is not registered on this machine.\n      const dependencyProblems = await unresolvedManifestDependencies(absPath);\n      for (const w of dependencyProblems) logWarn(w);\n      const dependencyWarnings = dependencyProblems.length;\n      const totalErrors =\n        errors +\n        ws.errors +\n        rootErrors +\n        slugErrors +\n        rootPathErrors +\n        parseErrors +\n        requiresErrors;\n      console.log();\n      warnIgnoredDomainFiles(absPath);\n      warnLegacyBundleFiles(absPath);\n      logInfo(`Scanned ${total} asset manifest(s) and ${ws.total} skaile.yaml file(s)`);\n      // Nothing scanned and no library manifest: a directory with nothing in it is not valid,\n      // it is not validated (p745).\n      if (\n        total === 0 &&\n        ws.total === 0 &&\n        totalErrors === 0 &&\n        !fs.existsSync(path.join(absPath, SKAILE_MANIFEST_FILENAME))\n      ) {\n        logErr(\n          `Nothing to validate in ${absPath}: no asset manifest, skaile.yaml or ${SKAILE_MANIFEST_FILENAME} found.`,\n        );\n        process.exit(1);\n        return;\n      }\n      const totalWarnings = warnings + versionWarnings + publisherWarnings + dependencyWarnings;\n      if (totalWarnings > 0) logWarn(`${totalWarnings} warning(s)`);\n      if (totalErrors === 0) {\n        logOk(\"All manifests valid\");\n      } else {\n        logErr(`${totalErrors} validation error(s)`);\n        process.exit(1);\n      }\n    });\n\n  cmd\n    .command(\"versions\")\n    .description(\"Check version fields and flow version pins\")\n    .argument(\"[path]\", \"Library or asset directory (default: the current library)\")\n    .option(\"--changed-only\", \"Only check assets modified since last commit\")\n    .option(\"--strict\", \"Exit 1 on warnings (for CI)\")\n    .addOption(removedDomainOption())\n    .action(\n      (\n        pathArg: string | undefined,\n        opts: { changedOnly?: boolean; strict?: boolean; domain?: string },\n      ) => {\n        rejectRemovedDomainOption(opts);\n        runVersionsCheck(pathArg, opts);\n      },\n    );\n\n  cmd\n    .command(\"changelog\")\n    .description(\"Check that modified assets have an updated nearest CHANGELOG.md\")\n    .argument(\"[path]\", \"Library or asset directory (default: the current library)\")\n    .option(\"--base <ref>\", \"Git base ref for diff\", \"HEAD\")\n    .action((pathArg: string | undefined, opts: { base: string }) => {\n      const root = resolveCheckRoot(pathArg);\n      if (root === null) {\n        process.exit(1);\n        return;\n      }\n      const modifiedFiles = changedFiles(root, opts.base, \"changelog\");\n      if (modifiedFiles === null) {\n        process.exit(1);\n        return;\n      }\n      const { updated, stale, orphans } = checkChangelogUnits(modifiedFiles, root);\n\n      if (updated.length + stale.length + orphans.length === 0) {\n        logOk(\"No modified assets found\");\n        return;\n      }\n\n      for (const unit of updated) logOk(`${unit} updated`);\n      for (const unit of stale) logErr(`${unit} not updated (assets were modified)`);\n      for (const asset of orphans) {\n        logErr(`${asset} — no CHANGELOG.md in any ancestor directory up to the asset root`);\n      }\n\n      if (stale.length + orphans.length > 0) process.exit(1);\n    });\n\n  return cmd;\n}\n"]}

package/dist/{chunk-ANSZULXH.js → chunk-H7R7R5BN.js}

@@ -1,5 +1,5 @@
-import { isManifestName } from './chunk-SP5NGNBV.js';
-import { parseAssetRef, isValidPublisher, PUBLISHER_HINT } from './chunk-VY6NTFE7.js';
+import { isManifestName } from './chunk-YW2BNDSE.js';
+import { parseAssetRef, isValidPublisher, PUBLISHER_HINT } from './chunk-FT4ZHLYR.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync, realpathSync, readdirSync, statSync, readlinkSync } from 'fs';
 import { join, resolve, sep } from 'path';
@@ -270,7 +270,17 @@ function isEnvFileName(name) {
   return !ENV_TEMPLATE_SUFFIXES.has(name.slice(".env".length));
 }
 var SECRET_FILE_SUFFIXES = [".pem", ".key", ".p12", ".pfx"];
-var SECRET_FILE_NAMES = /* @__PURE__ */ new Set(["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519"]);
+var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ed25519",
+  ".npmrc",
+  ".netrc",
+  ".envrc",
+  "credentials",
+  "token.json"
+]);
 function isSecretFileName(name) {
   return isEnvFileName(name) || SECRET_FILE_NAMES.has(name) || SECRET_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix));
 }
@@ -288,6 +298,11 @@ var LIBRARY_GITIGNORE = [
   "*.bak",
   ".env",
   ".env.*",
+  ".envrc",
+  ".npmrc",
+  ".netrc",
+  "credentials",
+  "token.json",
   ...[...ENV_TEMPLATE_SUFFIXES].map((suffix) => `!.env${suffix}`),
   ""
 ].join("\n");
@@ -364,7 +379,7 @@ function listLibrarySymlinks(absDir, opts = {}) {
         if (!refused) {
           try {
             const real = realpathSync(full);
-            refused = statSync(real).isDirectory() && (real === root || real.startsWith(root + sep));
+            refused = statSync(real).isDirectory() && (real === root || real.startsWith(root + sep) || readdirSync(real).some((n) => isManifestName(n)));
           } catch {
           }
         }
@@ -408,5 +423,5 @@ function listEnvFiles(absDir) {
 }
 
 export { ASSET_KEY_ORDER, LIBRARY_GITIGNORE, SKAILE_MANIFEST_FILENAME, compositeSha256, decodeSkaileManifest, encodeSkaileManifest, isEnvFileName, isNonAssetDir, isNonAssetFile, isNonAssetPath, isSecretFileName, librarySymlinkMessage, listAssetFiles, listEnvFiles, listLibrarySymlinks, listSkippedSymlinks, loadSkPublishManifest, orderedAsset, sha256Hex };
-//# sourceMappingURL=chunk-ANSZULXH.js.map
-//# sourceMappingURL=chunk-ANSZULXH.js.map
+//# sourceMappingURL=chunk-H7R7R5BN.js.map
+//# sourceMappingURL=chunk-H7R7R5BN.js.map

package/dist/chunk-H7R7R5BN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/src/publish-manifest.ts"],"names":[],"mappings":";;;;;;;AA6JO,IAAM,wBAAA,GAA2B;AAIxC,SAAS,YAAY,GAAA,EAA0C;AAC7D,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,GAAA,KAAQ,QAAA,IAAY,EAAE,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,MAAA;AAC5D,EAAA,MAAM,GAAA,GAAsB,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAI;AACzC,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAA,CAAE,OAAO,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,MAAA,GAAS,CAAA,CAAE,MAAA;AACxE,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,gBAAgB,GAAA,EAA8C;AACrE,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,OAAA,KAAY,QAAA,IAAY,EAAE,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAO,MAAA;AACpE,EAAA,MAAM,GAAA,GAA0B,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,SAAA,KAAc,QAAA,IAAY,CAAA,CAAE,UAAU,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,SAAA,GAAY,CAAA,CAAE,SAAA;AACjF,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,WAAW,GAAA,EAA0D;AAC5E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,MAAA;AAChC,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,IACnB,CAAA,MAAA,IAAW,QAAQ,OAAO,IAAA,KAAS,YAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACnE,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,YAAY,OAAO,CAAA,CAAE,WAAW,QAAA,EAAU;AAC9D,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,IAAA,EAAM,CAAA,CAAE,MAAM,MAAA,EAAQ,CAAA,CAAE,QAAQ,CAAA;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG,OAAO,QAAA;AAChC,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,kBACP,IAAA,EACoF;AACpF,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAA,CAAM,IAAI,CAAA,IAAK,EAAC;AAAA,EAC3B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,aAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS,iBAAiB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAC5E,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC1E,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,iBAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS;AAAA;AACX,KACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,MAAA,EAAkC;AAC5D;AAQA,SAAS,kBAAA,CAAmB,KAAA,EAAe,IAAA,EAAc,WAAA,EAAmC;AAC1F,EAAA,IAAI,CAAC,KAAA,CAAM,UAAA,CAAW,GAAG,GAAG,OAAO,KAAA;AACnC,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA;AAC9B,EAAA,WAAA,CAAY,IAAA,CAAK;AAAA,IACf,IAAA,EAAM,yBAAA;AAAA,IACN,QAAA,EAAU,SAAA;AAAA,IACV,OAAA,EAAS,CAAA,WAAA,EAAc,KAAK,CAAA,8EAAA,EAA4E,QAAQ,CAAA,CAAA,CAAA;AAAA,IAChH;AAAA,GACD,CAAA;AACD,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,oBAAA,CACP,GAAA,EACA,QAAA,EACA,WAAA,EACM;AACN,EAAA,IAAI,OAAO,GAAA,CAAI,SAAA,KAAc,YAAY,GAAA,CAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACjE,IAAA,QAAA,CAAS,SAAA,GAAY,kBAAA,CAAmB,GAAA,CAAI,SAAA,EAAW,aAAa,WAAW,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,QAAA,KAAa,YAAY,GAAA,CAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/D,IAAA,QAAA,CAAS,WAAW,GAAA,CAAI,QAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG;AAChC,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,SAAA,CAAU,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AAC5F,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,SAAA,GAAY,KAAA;AAAA,EAC7C;AACA,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,IAAI,MAAA,WAAiB,MAAA,GAAS,MAAA;AAC9B,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,GAAA,CAAI,UAAU,CAAA;AACjD,EAAA,IAAI,UAAA,WAAqB,UAAA,GAAa,UAAA;AACxC;AAMA,SAAS,uBAAA,CACP,GAAA,EACA,IAAA,EACA,IAAA,EACA,WAAA,EACU;AACV,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,IAAA;AAChC,EAAA,KAAA,MAAW,OAAO,GAAA,EAAK;AACrB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,cAAc,GAAG,CAAA;AAG7B,MAAA,IAAI,IAAI,SAAA,KAAc,KAAA,CAAA,IAAa,CAAC,gBAAA,CAAiB,GAAA,CAAI,SAAS,CAAA,EAAG;AACnE,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,SAAS,CAAA,SAAA,EAAO,cAAc,CAAA,CAAE,CAAA;AAAA,MACpE;AACA,MAAA,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,IACf,SAAS,GAAA,EAAK;AACZ,MAAA,WAAA,CAAY,IAAA,CAAK;AAAA,QACf,IAAA,EAAM,sBAAA;AAAA,QACN,QAAA,EAAU,SAAA;AAAA,QACV,OAAA,EAAS,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,gBAAA,EAC7B,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,QACA,IAAA,EAAM,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,aAAA;AAAA,OAC7B,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAOA,SAAS,gBAAA,CAAiB,MAAe,WAAA,EAAmD;AAC1F,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG,OAAO,MAAA;AACrE,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM,OAAO,MAAA;AAC3B,EAAA,MAAM,KAAA,GAAoB,EAAE,IAAA,EAAM,IAAA,EAAK;AACvC,EAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,EAAU,KAAA,CAAM,OAAO,CAAA,CAAE,IAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,CAAE,KAAK,CAAA;AAChC,EAAA,IAAI,KAAA,QAAa,KAAA,GAAQ,KAAA;AACzB,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,EAAE,SAAA,KAAc,QAAA;AACzB,IAAA,KAAA,CAAM,SAAA,GAAY,kBAAA;AAAA,MAChB,CAAA,CAAE,SAAA;AAAA,MACF,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,UAAA,CAAA;AAAA,MACtB;AAAA,KACF;AACF,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,KAAA,CAAM,SAAS,CAAA,CAAE,MAAA;AACnD,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,CAAA,CAAE,MAAM,CAAA;AACxC,EAAA,IAAI,WAAA,QAAmB,MAAA,GAAS,WAAA;AAEhC,EAAA,MAAM,OAAO,uBAAA,CAAwB,CAAA,CAAE,YAAA,EAAc,IAAA,EAAM,MAAM,WAAW,CAAA;AAC5E,EAAA,IAAI,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,YAAA,GAAe,IAAA;AAE1C,EAAA,IAAI,OAAO,CAAA,CAAE,WAAA,KAAgB,QAAA,EAAU,KAAA,CAAM,cAAc,CAAA,CAAE,WAAA;AAC7D,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,EAAG;AAC7B,IAAA,MAAM,EAAA,GAAK,EAAE,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,MAAM,QAAQ,CAAA;AACtE,IAAA,IAAI,EAAA,CAAG,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,QAAA,GAAW,EAAA;AAAA,EACtC;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AACvD,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AAEvD,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,oBAAA,CACP,GAAA,EACA,QAAA,EACA,WAAA,EACM;AACN,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG;AAChC,EAAA,MAAM,UAAwB,EAAC;AAC/B,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAI,MAAA,EAAQ;AAC7B,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,IAAA,EAAM,WAAW,CAAA;AAChD,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,MAAA,GAAS,OAAA;AAC5C;AAYO,SAAS,qBAAqB,IAAA,EAAoC;AACvE,EAAA,MAAM,IAAA,GAAO,kBAAkB,IAAI,CAAA;AACnC,EAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,UAAU,EAAC,EAAG,aAAa,CAAC,IAAA,CAAK,UAAU,CAAA,EAAE;AAAA,EACxD;AAEA,EAAA,MAAM,WAA8B,EAAC;AACrC,EAAA,MAAM,cAA4B,EAAC;AACnC,EAAA,oBAAA,CAAqB,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,WAAW,CAAA;AACpD,EAAA,oBAAA,CAAqB,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,WAAW,CAAA;AAEpD,EAAA,OAAO,EAAE,UAAU,WAAA,EAAY;AACjC;AAKA,IAAM,kBAAA,GAAkD;AAAA,EACtD,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAGO,IAAM,eAAA,GAAiD;AAAA,EAC5D,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAGO,SAAS,aAAa,CAAA,EAAwC;AACnE,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,eAAA,EAAiB;AACjC,IAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,CAAA;AACnB,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,EACtC;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,qBAAqB,QAAA,EAAqC;AACxE,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,kBAAA,EAAoB;AACpC,IAAA,MAAM,KAAA,GAAQ,SAAS,GAAG,CAAA;AAC1B,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAI,GAAA,KAAQ,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5C,MAAA,GAAA,CAAI,MAAA,GAAU,KAAA,CAAuB,GAAA,CAAI,YAAY,CAAA;AAAA,IACvD,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,KAAK,CAAA;AAC1C;AASO,SAAS,sBAAsB,GAAA,EAAuC;AAC3E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,GAAG,wBAAwB,CAAA;AAC5D,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,YAAA,CAAa,UAAU,OAAO,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,qBAAqB,GAAG,CAAA;AAC1D,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,aAAA,IAAiB,CAAA,CAAE,IAAA,KAAS,iBAAiB,CAAA,EAAG;AACrF,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,QAAA;AACT;AAKO,SAAS,UAAU,KAAA,EAA2B;AACnD,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAaO,SAAS,gBAAgB,KAAA,EAAgE;AAC9F,EAAA,MAAM,KAAA,GAAQ,MACX,KAAA,EAAM,CACN,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,EAAE,IAAI,CAAC,CAAA,CAC3C,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,MAAM;AAAA,CAAI,CAAA,CACpC,KAAK,EAAE,CAAA;AACV,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAQA,IAAM,cAAA,uBAAqB,GAAA,CAAI;AAAA,EAC7B,MAAA;AAAA,EACA,cAAA;AAAA,EACA,SAAA;AAAA,EACA,aAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,eAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAW,CAAC,CAAA;AAGnD,SAAS,cAAc,IAAA,EAAuB;AACnD,EAAA,OAAO,cAAA,CAAe,IAAI,IAAI,CAAA;AAChC;AAQO,SAAS,eAAe,IAAA,EAAuB;AACpD,EAAA,OACE,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA,IACxB,KAAK,QAAA,CAAS,MAAM,CAAA,IACpB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,IACpB,IAAA,CAAK,SAAS,MAAM,CAAA,IACpB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,IACpB,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,IACjB,IAAA,CAAK,QAAA,CAAS,MAAM,KACpB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,IACpB,cAAc,IAAI,CAAA;AAEtB;AAGA,IAAM,qBAAA,uBAA4B,GAAA,CAAI,CAAC,YAAY,SAAA,EAAW,WAAA,EAAa,OAAO,CAAC,CAAA;AAM5E,SAAS,cAAc,IAAA,EAAuB;AACnD,EAAA,IAAI,IAAA,KAAS,QAAQ,OAAO,IAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,OAAO,GAAG,OAAO,KAAA;AACtC,EAAA,OAAO,CAAC,qBAAA,CAAsB,GAAA,CAAI,KAAK,KAAA,CAAM,MAAA,CAAO,MAAM,CAAC,CAAA;AAC7D;AAGA,IAAM,oBAAA,GAAuB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAG5D,IAAM,iBAAA,uBAAwB,GAAA,CAAI;AAAA,EAChC,QAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAC,CAAA;AAOM,SAAS,iBAAiB,IAAA,EAAuB;AACtD,EAAA,OACE,aAAA,CAAc,IAAI,CAAA,IAClB,iBAAA,CAAkB,IAAI,IAAI,CAAA,IAC1B,oBAAA,CAAqB,IAAA,CAAK,CAAC,MAAA,KAAW,IAAA,CAAK,QAAA,CAAS,MAAM,CAAC,CAAA;AAE/D;AASO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,WAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,GAAG,CAAC,GAAG,qBAAqB,CAAA,CAAE,IAAI,CAAC,MAAA,KAAW,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAE,CAAA;AAAA,EAC9D;AACF,CAAA,CAAE,KAAK,IAAI;AAOJ,SAAS,eAAe,SAAA,EAA4B;AACzD,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AACjC,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,GAAA,EAAI,IAAK,EAAA;AAC5B,EAAA,OAAO,cAAA,CAAe,IAAI,CAAA,IAAK,KAAA,CAAM,KAAK,aAAa,CAAA;AACzD;AAQO,SAAS,eAAe,MAAA,EAA0B;AACvD,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,KAAsB;AAC/C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,QAAA,GAAW,MAAM,CAAA,EAAG,GAAG,IAAI,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA;AAC9C,MAAA,IAAI,CAAA,CAAE,aAAY,EAAG;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,CAAA,CAAE,IAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,CAAA,EAAG,QAAQ,CAAA;AAAA,MAC9D,CAAA,MAAA,IAAW,EAAE,MAAA,EAAO,IAAK,CAAC,cAAA,CAAe,CAAA,CAAE,IAAI,CAAA,EAAG;AAChD,QAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,MACnB;AAAA,IACF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,QAAQ,EAAE,CAAA;AACf,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB;AAOO,SAAS,oBAAoB,MAAA,EAA0B;AAC5D,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,KAAsB;AAC/C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,QAAA,GAAW,MAAM,CAAA,EAAG,GAAG,IAAI,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA;AAC9C,MAAA,IAAI,CAAA,CAAE,gBAAe,EAAG;AACtB,QAAA,IAAI,CAAC,cAAA,CAAe,CAAA,CAAE,IAAI,CAAA,EAAG,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,MAChD,CAAA,MAAA,IAAW,EAAE,WAAA,EAAY,IAAK,CAAC,aAAA,CAAc,CAAA,CAAE,IAAI,CAAA,EAAG;AACpD,QAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,GAAG,QAAQ,CAAA;AAAA,MAClC;AAAA,IACF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,QAAQ,EAAE,CAAA;AACf,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB;AAmCO,SAAS,mBAAA,CACd,MAAA,EACA,IAAA,GAAuF,EAAC,EACtE;AAClB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,aAAa,MAAM,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,OAAA,GAAU,CAAC,IAAA,KACf,aAAA,CAAc,IAAI,KAAK,IAAA,CAAK,QAAA,EAAU,GAAA,CAAI,IAAI,CAAA,KAAM,IAAA;AACtD,EAAA,MAAM,MAAwB,EAAC;AAC/B,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,EAAa,OAAA,KAA2B;AACjE,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,OACJ,OAAA,IACC,GAAA,KAAQ,MAAA,IACP,OAAA,CAAQ,KAAK,CAAC,CAAA,KAAA,CAAO,CAAA,CAAE,MAAA,MAAY,CAAA,CAAE,cAAA,OAAqB,cAAA,CAAe,CAAA,CAAE,IAAI,CAAC,CAAA;AACpF,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,CAAA;AAC7B,MAAA,MAAM,QAAA,GAAW,MAAM,CAAA,EAAG,GAAG,IAAI,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA;AAC9C,MAAA,IAAI,CAAA,CAAE,gBAAe,EAAG;AACtB,QAAA,IAAI,eAAe,CAAA,CAAE,IAAI,KAAK,OAAA,CAAQ,CAAA,CAAE,IAAI,CAAA,EAAG;AAC/C,QAAA,IAAI,OAAA,GAAU,IAAA,IAAQ,IAAA,CAAK,SAAA,KAAc,IAAA;AACzC,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,IAAI;AACF,YAAA,MAAM,IAAA,GAAO,aAAa,IAAI,CAAA;AAG9B,YAAA,OAAA,GACE,QAAA,CAAS,IAAI,CAAA,CAAE,WAAA,OACd,IAAA,KAAS,IAAA,IACR,KAAK,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,IAC1B,WAAA,CAAY,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,cAAA,CAAe,CAAC,CAAC,CAAA,CAAA;AAAA,UACrD,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AACA,QAAA,IAAI,OAAA,EAAS;AACX,UAAA,IAAI,MAAA;AACJ,UAAA,IAAI;AACF,YAAA,MAAA,GAAS,aAAa,IAAI,CAAA;AAAA,UAC5B,CAAA,CAAA,MAAQ;AACN,YAAA,MAAA,GAAS,GAAA;AAAA,UACX;AACA,UAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AAAA,QACrC;AAAA,MACF,CAAA,MAAA,IAAW,EAAE,WAAA,EAAY,IAAK,CAAC,OAAA,CAAQ,CAAA,CAAE,IAAI,CAAA,EAAG;AAC9C,QAAA,IAAA,CAAK,IAAA,EAAM,UAAU,IAAI,CAAA;AAAA,MAC3B;AAAA,IACF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,MAAA,EAAQ,EAAA,EAAI,IAAA,CAAK,WAAA,KAAgB,IAAI,CAAA;AAC1C,EAAA,OAAO,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD;AAMO,SAAS,sBAAsB,IAAA,EAA8B;AAClE,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,iBAAA,EAAoB,KAAK,MAAM,CAAA,0HAAA,CAAA;AACpD;AAMO,SAAS,aAAa,MAAA,EAA0B;AACrD,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,KAAsB;AAC/C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,QAAA,GAAW,MAAM,CAAA,EAAG,GAAG,IAAI,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA;AAC9C,MAAA,IAAI,CAAA,CAAE,QAAO,IAAK,aAAA,CAAc,EAAE,IAAI,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,QAAQ,CAAA;AAAA,WAAA,IACjD,CAAA,CAAE,WAAA,EAAY,IAAK,CAAC,cAAc,CAAA,CAAE,IAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,GAAG,QAAQ,CAAA;AAAA,IACtF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,QAAQ,EAAE,CAAA;AACf,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB","file":"chunk-H7R7R5BN.js","sourcesContent":["/**\n * Publish manifest — `skaile.manifest.yaml`\n *\n * What a repo PUBLISHES: the `publisher` / `version` / `assets[]` that used to\n * live in the publication half of `skaile.yaml`, plus a per-asset dependency\n * graph, store-listing metadata, and an optional curator `source:` pointer.\n *\n * ── Two files, two codecs ──────────────────────────────────────────────────\n *\n *   skaile.yaml             → SkWorkspaceConfig   (workspace + consumption)\n *   skaile.manifest.yaml    → SkPublishManifest   (publication)            ← this module\n *\n * A repo can have either file, both, or neither: a pure workspace has only\n * `skaile.yaml`; a pure asset repo (e.g. `ai-assets`) has only\n * `skaile.manifest.yaml`; a repo that is both has both.\n *\n * ── One format, three roles ────────────────────────────────────────────────\n *\n *   First-party    `source:` absent  → bytes live in this repo (`root`/`files`).\n *   Curator/sidecar `source:` present → bytes come from the referenced upstream,\n *                                       verified by `sha256`.\n *\n * `decodeSkaileManifest` mirrors `decodeSkaileYaml`: total (never throws),\n * returns {@link Diagnostic}s. Dep-ref strings are validated with `parseAssetRef`.\n */\n\nimport { createHash } from \"node:crypto\";\nimport {\n  type Dirent,\n  existsSync,\n  readdirSync,\n  readFileSync,\n  readlinkSync,\n  realpathSync,\n  statSync,\n} from \"node:fs\";\nimport { join, resolve, sep } from \"node:path\";\nimport { parse, stringify } from \"yaml\";\nimport { isManifestName } from \"./manifest.js\";\nimport { isValidPublisher, parseAssetRef, PUBLISHER_HINT } from \"./models.js\";\nimport type { Diagnostic } from \"./workspace-config.js\";\n\n// ── Types ───────────────────────────────────────────────────────────────────\n\n/** One file inside a curated asset, pinned to an exact upstream blob hash. */\nexport interface ManifestFileEntry {\n  path: string;\n  /** 64-hex sha256 of the upstream blob. */\n  sha256: string;\n}\n\n/**\n * One entry in a manifest's `assets:` list. Either `root:` (recursive walk) or\n * `files:` (explicit list, supports globs for first-party; the granular\n * `{path, sha256}` form for curated upstream verification) declares which paths\n * constitute the asset. `version:` overrides the manifest-level version.\n *\n * @docLink packages/core/publish-manifest#asset-entry\n */\nexport interface AssetEntry {\n  kind: string;\n  name: string;\n  root?: string;\n  /**\n   * Explicit file listing. First-party manifests use bare `string[]` (globs,\n   * fast-glob). Curated entries may use the granular `{path, sha256}` form so\n   * the resolver fetches + verifies exact upstream blobs without a full clone.\n   */\n  files?: string[] | ManifestFileEntry[];\n  version?: string;\n  /** Per-asset publisher override (e.g. for curator/mirror repos). */\n  publisher?: string;\n\n  /**\n   * Canonical dep refs (`kind:@<publisher>/name[#version]`) — same grammar as\n   * `SkWorkspaceConfig.dependencies`. Authoritative for this asset's resolved\n   * deps. (Was `requires` in `.skaile-source.yaml`.)\n   */\n  dependencies?: string[];\n\n  /**\n   * Author-pinned composite sha256 over the asset's `files`/`root` (the\n   * {@link compositeSha256} the walker, discovery and the lock all use). Optional locally;\n   * REQUIRED on store publish. (Was `.skaile-source.yaml` `assets[].sha256`.)\n   */\n  sha256?: string;\n\n  /**\n   * Curator override: this single asset's bytes come from a different upstream\n   * than the manifest-level `source`. Absent → inherit manifest `source` (or\n   * first-party when that is also absent).\n   */\n  source?: ManifestSource;\n\n  // ── Store-listing metadata (all optional; fall back to content frontmatter) ──\n  description?: string;\n  keywords?: string[];\n  category?: string;\n  license?: string;\n  homepage?: string;\n}\n\n/**\n * Upstream the bytes come from when a manifest curates a repo it does not own.\n * Absent → first-party (bytes live in the manifest's own repo).\n *\n * @docLink packages/core/publish-manifest#manifest-source\n */\nexport interface ManifestSource {\n  url: string;\n  /** 40-char commit the curated bytes are pinned to. */\n  commit?: string;\n}\n\n/**\n * Signing/attribution recorded when a manifest is published on behalf of others.\n *\n * @docLink packages/core/publish-manifest#manifest-provenance\n */\nexport interface ManifestProvenance {\n  curator: string;\n  signed_by?: string;\n}\n\n/**\n * Parsed `skaile.manifest.yaml` — what a repo publishes.\n *\n * @docLink packages/core/publish-manifest#sk-publish-manifest\n */\nexport interface SkPublishManifest {\n  publisher?: string;\n  version?: string;\n  /** Repo-level store defaults inherited by assets unless overridden per-entry. */\n  license?: string;\n  homepage?: string;\n  /**\n   * Repo-relative path prefixes holding dev-only assets — excluded from\n   * discovery/publish unless `--dev`. (Was `.skaile-source.yaml` `dev_paths`.)\n   */\n  dev_paths?: string[];\n  /**\n   * Curator mode: the single upstream all assets in this file come from. A\n   * per-asset `source` overrides it. Absent → first-party (own repo).\n   */\n  source?: ManifestSource;\n  /** Present when this manifest is curated/published on behalf of another author. */\n  provenance?: ManifestProvenance;\n  assets?: AssetEntry[];\n}\n\n/** Result of {@link decodeSkaileManifest}: the manifest plus any notes. */\nexport interface ManifestDecodeResult {\n  manifest: SkPublishManifest;\n  diagnostics: Diagnostic[];\n}\n\n/** The single fixed filename for a publish manifest. */\nexport const SKAILE_MANIFEST_FILENAME = \"skaile.manifest.yaml\";\n\n// ── Decode ──────────────────────────────────────────────────────────────────\n\nfunction parseSource(raw: unknown): ManifestSource | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const s = raw as Record<string, unknown>;\n  if (typeof s.url !== \"string\" || s.url.length === 0) return undefined;\n  const out: ManifestSource = { url: s.url };\n  if (typeof s.commit === \"string\" && s.commit.length > 0) out.commit = s.commit;\n  return out;\n}\n\nfunction parseProvenance(raw: unknown): ManifestProvenance | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const p = raw as Record<string, unknown>;\n  if (typeof p.curator !== \"string\" || p.curator.length === 0) return undefined;\n  const out: ManifestProvenance = { curator: p.curator };\n  if (typeof p.signed_by === \"string\" && p.signed_by.length > 0) out.signed_by = p.signed_by;\n  return out;\n}\n\n/** Parse `files:` as either `string[]` (globs) or `{path, sha256}[]` (granular). */\nfunction parseFiles(raw: unknown): string[] | ManifestFileEntry[] | undefined {\n  if (!Array.isArray(raw)) return undefined;\n  const strings: string[] = [];\n  const granular: ManifestFileEntry[] = [];\n  for (const item of raw) {\n    if (typeof item === \"string\") {\n      strings.push(item);\n    } else if (item && typeof item === \"object\" && !Array.isArray(item)) {\n      const f = item as Record<string, unknown>;\n      if (typeof f.path === \"string\" && typeof f.sha256 === \"string\") {\n        granular.push({ path: f.path, sha256: f.sha256 });\n      }\n    }\n  }\n  // A manifest uses one form per entry; if both somehow appear, granular wins\n  // (it is the verifiable form). Empty → undefined.\n  if (granular.length > 0) return granular;\n  if (strings.length > 0) return strings;\n  return undefined;\n}\n\n/** Parse the YAML root, returning either the mapping or an error diagnostic. */\nfunction parseManifestRoot(\n  text: string,\n): { ok: true; raw: Record<string, unknown> } | { ok: false; diagnostic: Diagnostic } {\n  let parsed: unknown;\n  try {\n    parsed = parse(text) ?? {};\n  } catch (err) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"yaml_syntax\",\n        severity: \"error\",\n        message: `Invalid YAML: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    };\n  }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"non_object_root\",\n        severity: \"error\",\n        message: \"skaile.manifest.yaml must be a mapping at the top level.\",\n      },\n    };\n  }\n  return { ok: true, raw: parsed as Record<string, unknown> };\n}\n\n/**\n * Strip a SINGLE leading `@` from a publisher and, when one was removed, push a\n * `warning` diagnostic. The `@` is the scope sigil the ref formatter adds — an\n * authored `@acme` would otherwise index as `@@acme` and be un-addable. Bare\n * names are returned untouched.\n */\nfunction normalizePublisher(value: string, path: string, diagnostics: Diagnostic[]): string {\n  if (!value.startsWith(\"@\")) return value;\n  const stripped = value.slice(1);\n  diagnostics.push({\n    code: \"publisher_leading_sigil\",\n    severity: \"warning\",\n    message: `publisher \"${value}\": leading \"@\" is the scope sigil and is added automatically — use bare \"${stripped}\"`,\n    path,\n  });\n  return stripped;\n}\n\n/** Decode the manifest-level scalar/array/object fields onto `manifest`. */\nfunction decodeManifestFields(\n  raw: Record<string, unknown>,\n  manifest: SkPublishManifest,\n  diagnostics: Diagnostic[],\n): void {\n  if (typeof raw.publisher === \"string\" && raw.publisher.length > 0) {\n    manifest.publisher = normalizePublisher(raw.publisher, \"publisher\", diagnostics);\n  }\n  if (typeof raw.version === \"string\" && raw.version.length > 0) {\n    manifest.version = raw.version;\n  }\n  if (typeof raw.license === \"string\" && raw.license.length > 0) {\n    manifest.license = raw.license;\n  }\n  if (typeof raw.homepage === \"string\" && raw.homepage.length > 0) {\n    manifest.homepage = raw.homepage;\n  }\n  if (Array.isArray(raw.dev_paths)) {\n    const paths = raw.dev_paths.filter((p): p is string => typeof p === \"string\" && p.length > 0);\n    if (paths.length > 0) manifest.dev_paths = paths;\n  }\n  const source = parseSource(raw.source);\n  if (source) manifest.source = source;\n  const provenance = parseProvenance(raw.provenance);\n  if (provenance) manifest.provenance = provenance;\n}\n\n/**\n * Validate an asset's `dependencies` via `parseAssetRef`, pushing a `warning`\n * for each malformed ref. Returns the kept (valid) refs.\n */\nfunction decodeAssetDependencies(\n  raw: unknown,\n  kind: string,\n  name: string,\n  diagnostics: Diagnostic[],\n): string[] {\n  const deps: string[] = [];\n  if (!Array.isArray(raw)) return deps;\n  for (const dep of raw) {\n    if (typeof dep !== \"string\") continue;\n    try {\n      const ref = parseAssetRef(dep);\n      // The publisher follows the one slug rule, so an entry `library index` refuses is\n      // dropped here like every other malformed one (not left to fail discovery of the asset).\n      if (ref.publisher !== undefined && !isValidPublisher(ref.publisher)) {\n        throw new Error(`publisher \"${ref.publisher}\" — ${PUBLISHER_HINT}`);\n      }\n      deps.push(dep);\n    } catch (err) {\n      diagnostics.push({\n        code: \"malformed_dependency\",\n        severity: \"warning\",\n        message: `assets[${kind}:${name}].dependencies: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n        path: `assets.${kind}:${name}.dependencies`,\n      });\n    }\n  }\n  return deps;\n}\n\n/**\n * Decode one `assets[]` item into an {@link AssetEntry}, or `undefined` when the\n * item is not a mapping or lacks both `kind` and `name`. Pushes dependency\n * warnings to `diagnostics`.\n */\nfunction decodeAssetEntry(item: unknown, diagnostics: Diagnostic[]): AssetEntry | undefined {\n  if (!item || typeof item !== \"object\" || Array.isArray(item)) return undefined;\n  const a = item as Record<string, unknown>;\n  const kind = typeof a.kind === \"string\" ? a.kind : \"\";\n  const name = typeof a.name === \"string\" ? a.name : \"\";\n  if (!kind || !name) return undefined;\n  const entry: AssetEntry = { kind, name };\n  if (typeof a.root === \"string\") entry.root = a.root;\n  const files = parseFiles(a.files);\n  if (files) entry.files = files;\n  if (typeof a.version === \"string\") entry.version = a.version;\n  if (typeof a.publisher === \"string\")\n    entry.publisher = normalizePublisher(\n      a.publisher,\n      `assets.${kind}:${name}.publisher`,\n      diagnostics,\n    );\n  if (typeof a.sha256 === \"string\") entry.sha256 = a.sha256;\n  const assetSource = parseSource(a.source);\n  if (assetSource) entry.source = assetSource;\n\n  const deps = decodeAssetDependencies(a.dependencies, kind, name, diagnostics);\n  if (deps.length > 0) entry.dependencies = deps;\n\n  if (typeof a.description === \"string\") entry.description = a.description;\n  if (Array.isArray(a.keywords)) {\n    const kw = a.keywords.filter((k): k is string => typeof k === \"string\");\n    if (kw.length > 0) entry.keywords = kw;\n  }\n  if (typeof a.category === \"string\") entry.category = a.category;\n  if (typeof a.license === \"string\") entry.license = a.license;\n  if (typeof a.homepage === \"string\") entry.homepage = a.homepage;\n\n  return entry;\n}\n\n/** Decode the `assets[]` list onto `manifest`, collecting dependency warnings. */\nfunction decodeManifestAssets(\n  raw: Record<string, unknown>,\n  manifest: SkPublishManifest,\n  diagnostics: Diagnostic[],\n): void {\n  if (!Array.isArray(raw.assets)) return;\n  const entries: AssetEntry[] = [];\n  for (const item of raw.assets) {\n    const entry = decodeAssetEntry(item, diagnostics);\n    if (entry) entries.push(entry);\n  }\n  if (entries.length > 0) manifest.assets = entries;\n}\n\n/**\n * Decode `skaile.manifest.yaml` text into a {@link SkPublishManifest} plus\n * {@link Diagnostic}s. Total — never throws: a YAML syntax error or non-object\n * root is reported as an `error`-severity diagnostic with an empty manifest.\n * Malformed `assets[].dependencies` refs are reported as `warning`s (validated\n * via `parseAssetRef`) rather than silently dropped.\n *\n * Pair with {@link encodeSkaileManifest} for round-tripping.\n * @docLink packages/core/publish-manifest#decode-skaile-manifest\n */\nexport function decodeSkaileManifest(text: string): ManifestDecodeResult {\n  const root = parseManifestRoot(text);\n  if (!root.ok) {\n    return { manifest: {}, diagnostics: [root.diagnostic] };\n  }\n\n  const manifest: SkPublishManifest = {};\n  const diagnostics: Diagnostic[] = [];\n  decodeManifestFields(root.raw, manifest, diagnostics);\n  decodeManifestAssets(root.raw, manifest, diagnostics);\n\n  return { manifest, diagnostics };\n}\n\n// ── Encode ──────────────────────────────────────────────────────────────────\n\n/** Fixed top-level key order for {@link encodeSkaileManifest}. */\nconst MANIFEST_KEY_ORDER: (keyof SkPublishManifest)[] = [\n  \"publisher\",\n  \"version\",\n  \"license\",\n  \"homepage\",\n  \"dev_paths\",\n  \"source\",\n  \"provenance\",\n  \"assets\",\n];\n\n/** Fixed per-asset key order for {@link encodeSkaileManifest}. */\nexport const ASSET_KEY_ORDER: readonly (keyof AssetEntry)[] = [\n  \"kind\",\n  \"name\",\n  \"source\",\n  \"root\",\n  \"files\",\n  \"version\",\n  \"publisher\",\n  \"sha256\",\n  \"dependencies\",\n  \"description\",\n  \"keywords\",\n  \"category\",\n  \"license\",\n  \"homepage\",\n];\n\n/** An entry with its keys in canonical order, undefined fields dropped. */\nexport function orderedAsset(a: AssetEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const key of ASSET_KEY_ORDER) {\n    const value = a[key];\n    if (value !== undefined) out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Encode a {@link SkPublishManifest} to canonical `skaile.manifest.yaml` text:\n * deterministic key order, only defined fields, `lineWidth: 120` (mirrors\n * `encodeSkaileYaml`).\n * @docLink packages/core/publish-manifest#encode-skaile-manifest\n */\nexport function encodeSkaileManifest(manifest: SkPublishManifest): string {\n  const out: Record<string, unknown> = {};\n  for (const key of MANIFEST_KEY_ORDER) {\n    const value = manifest[key];\n    if (value === undefined) continue;\n    if (key === \"assets\" && Array.isArray(value)) {\n      out.assets = (value as AssetEntry[]).map(orderedAsset);\n    } else {\n      out[key] = value;\n    }\n  }\n  return stringify(out, { lineWidth: 120 });\n}\n\n// ── File I/O ──────────────────────────────────────────────────────────────────\n\n/**\n * Load and decode `<dir>/skaile.manifest.yaml`. Returns `null` when the file is\n * absent or unparseable (mirrors `loadSkWorkspaceConfig`'s tolerant contract).\n * @docLink packages/core/publish-manifest#load-sk-publish-manifest\n */\nexport function loadSkPublishManifest(dir: string): SkPublishManifest | null {\n  const filePath = join(resolve(dir), SKAILE_MANIFEST_FILENAME);\n  if (!existsSync(filePath)) return null;\n  let raw: string;\n  try {\n    raw = readFileSync(filePath, \"utf-8\");\n  } catch {\n    return null;\n  }\n  const { manifest, diagnostics } = decodeSkaileManifest(raw);\n  if (diagnostics.some((d) => d.code === \"yaml_syntax\" || d.code === \"non_object_root\")) {\n    return null;\n  }\n  return manifest;\n}\n\n// ── Asset content hash ──────────────────────────────────────────────────────\n\n/** Hex SHA-256 of one file's bytes (the per-file `files[].sha256`). */\nexport function sha256Hex(bytes: Uint8Array): string {\n  return createHash(\"sha256\").update(bytes).digest(\"hex\");\n}\n\n/**\n * The one asset content hash, shared by every origin (library index, library\n * lock, git-source lock + provenance walker, store install manifest, author-pinned\n * `sha256`): SHA-256 (bare 64-hex) over `localeCompare`-sorted `<path>:<sha256>\\n`\n * rows, where each `sha256` is the file's own {@link sha256Hex}.\n *\n * `path` MUST be POSIX and relative to the root of the repository/library that\n * holds the asset (so `skills/foo/SKILL.md`, never `SKILL.md` relative to the\n * asset folder) — the path is folded into the digest, so a different base gives a\n * different hash for the same bytes.\n */\nexport function compositeSha256(files: ReadonlyArray<{ path: string; sha256: string }>): string {\n  const lines = files\n    .slice()\n    .sort((a, b) => a.path.localeCompare(b.path))\n    .map((f) => `${f.path}:${f.sha256}\\n`)\n    .join(\"\");\n  return createHash(\"sha256\").update(lines).digest(\"hex\");\n}\n\n/**\n * Directories never part of an asset's bytes: VCS, dependencies, per-project state, interpreter\n * and tool caches, virtual environments and editor folders. One list for the deploy file set and\n * the content hash, so a helper script or a test run inside a library (`__pycache__/`,\n * `.pytest_cache/`) never makes the lock drift.\n */\nconst NON_ASSET_DIRS = new Set([\n  \".git\",\n  \"node_modules\",\n  \".skaile\",\n  \"__pycache__\",\n  \".venv\",\n  \"venv\",\n  \".pytest_cache\",\n  \".mypy_cache\",\n  \".ruff_cache\",\n  \".idea\",\n  \".vscode\",\n]);\n\n/** File names never part of an asset's bytes (OS and interpreter leftovers). */\nconst NON_ASSET_FILES = new Set([\".DS_Store\", \"Thumbs.db\"]);\n\n/** `true` for a directory name no asset ships (see {@link NON_ASSET_DIRS}). */\nexport function isNonAssetDir(name: string): boolean {\n  return NON_ASSET_DIRS.has(name);\n}\n\n/**\n * `true` for a file name no asset ships: `.DS_Store`, `Thumbs.db`, `*.pyc`, `*.pyo`, `.env*`,\n * editor leftovers (`*.swp`, `*.swo`, `*~`, `*.bak`) and `*.log`. The scaffolded library\n * `.gitignore` ignores the same names, so what import, deploy and the hash leave out is what\n * the published repo lacks.\n */\nexport function isNonAssetFile(name: string): boolean {\n  return (\n    NON_ASSET_FILES.has(name) ||\n    name.endsWith(\".pyc\") ||\n    name.endsWith(\".pyo\") ||\n    name.endsWith(\".swp\") ||\n    name.endsWith(\".swo\") ||\n    name.endsWith(\"~\") ||\n    name.endsWith(\".bak\") ||\n    name.endsWith(\".log\") ||\n    isEnvFileName(name)\n  );\n}\n\n/** Committed `.env` templates: no secrets, so they stay part of the asset. */\nconst ENV_TEMPLATE_SUFFIXES = new Set([\".example\", \".sample\", \".template\", \".dist\"]);\n\n/**\n * `true` for a `.env` or `.env.*` file name that holds local secrets and is never shipped with\n * an asset. A template (`.env.example`, `.env.sample`, `.env.template`, `.env.dist`) is not one.\n */\nexport function isEnvFileName(name: string): boolean {\n  if (name === \".env\") return true;\n  if (!name.startsWith(\".env.\")) return false;\n  return !ENV_TEMPLATE_SUFFIXES.has(name.slice(\".env\".length));\n}\n\n/** Private key and certificate bundle extensions that never belong in a published library. */\nconst SECRET_FILE_SUFFIXES = [\".pem\", \".key\", \".p12\", \".pfx\"];\n\n/** File names that hold a private key or a credential, whatever sits next to them. */\nconst SECRET_FILE_NAMES = new Set([\n  \"id_rsa\",\n  \"id_dsa\",\n  \"id_ecdsa\",\n  \"id_ed25519\",\n  \".npmrc\",\n  \".netrc\",\n  \".envrc\",\n  \"credentials\",\n  \"token.json\",\n]);\n\n/**\n * `true` for a file name that holds a secret: a local `.env` ({@link isEnvFileName}), a private\n * key, a certificate bundle, or a credential file (`.npmrc`, `.netrc`, `.envrc`, `credentials`,\n * `token.json`). The publish plan names these before `git add -A` commits them.\n */\nexport function isSecretFileName(name: string): boolean {\n  return (\n    isEnvFileName(name) ||\n    SECRET_FILE_NAMES.has(name) ||\n    SECRET_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix))\n  );\n}\n\n/**\n * The `.gitignore` `library create` scaffolds: the names {@link isNonAssetFile} and\n * {@link NON_ASSET_DIRS} leave out of an asset (OS files, caches, editor leftovers, `.env`\n * secrets), so what the library publishes is what a deploy ships, plus the credential files\n * {@link isSecretFileName} names (`.npmrc`, `.netrc`, `.envrc`, `credentials`, `token.json`).\n * `.env` templates stay.\n */\nexport const LIBRARY_GITIGNORE = [\n  \".DS_Store\",\n  \"Thumbs.db\",\n  \"node_modules/\",\n  \"__pycache__/\",\n  \"*.pyc\",\n  \"*.pyo\",\n  \"*.log\",\n  \"*.swp\",\n  \"*.swo\",\n  \"*~\",\n  \"*.bak\",\n  \".env\",\n  \".env.*\",\n  \".envrc\",\n  \".npmrc\",\n  \".netrc\",\n  \"credentials\",\n  \"token.json\",\n  ...[...ENV_TEMPLATE_SUFFIXES].map((suffix) => `!.env${suffix}`),\n  \"\",\n].join(\"\\n\");\n\n/**\n * `true` when a POSIX path (relative to anything) lies in a {@link isNonAssetDir} directory\n * or names a {@link isNonAssetFile} file. Symlinks are not part of an asset either, but a path\n * string cannot tell: walkers skip them through `Dirent.isFile()`.\n */\nexport function isNonAssetPath(posixPath: string): boolean {\n  const parts = posixPath.split(\"/\");\n  const last = parts.pop() ?? \"\";\n  return isNonAssetFile(last) || parts.some(isNonAssetDir);\n}\n\n/**\n * Every file under `absDir`, as sorted POSIX paths relative to `absDir`,\n * skipping {@link NON_ASSET_DIRS}, {@link NON_ASSET_FILES} and `*.pyc`. The single enumeration\n * behind a `root:` manifest entry — used by the provenance walker and by discovery, so both\n * hash the same file list. Symlinks are skipped.\n */\nexport function listAssetFiles(absDir: string): string[] {\n  const out: string[] = [];\n  const walk = (dir: string, rel: string): void => {\n    let entries: Dirent[];\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const e of entries) {\n      const childRel = rel ? `${rel}/${e.name}` : e.name;\n      if (e.isDirectory()) {\n        if (!isNonAssetDir(e.name)) walk(join(dir, e.name), childRel);\n      } else if (e.isFile() && !isNonAssetFile(e.name)) {\n        out.push(childRel);\n      }\n    }\n  };\n  walk(absDir, \"\");\n  return out.sort();\n}\n\n/**\n * Every symlink under `absDir` (sorted POSIX paths relative to `absDir`) that\n * {@link listAssetFiles} leaves out: the links a deploy drops. Walks the same\n * directories, never follows a link and skips {@link NON_ASSET_DIRS}.\n */\nexport function listSkippedSymlinks(absDir: string): string[] {\n  const out: string[] = [];\n  const walk = (dir: string, rel: string): void => {\n    let entries: Dirent[];\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const e of entries) {\n      const childRel = rel ? `${rel}/${e.name}` : e.name;\n      if (e.isSymbolicLink()) {\n        if (!isNonAssetFile(e.name)) out.push(childRel);\n      } else if (e.isDirectory() && !isNonAssetDir(e.name)) {\n        walk(join(dir, e.name), childRel);\n      }\n    }\n  };\n  walk(absDir, \"\");\n  return out.sort();\n}\n\n/** A symlink a library refuses: where it is and what it points at. */\nexport interface LibrarySymlink {\n  /** POSIX path relative to the scanned directory. */\n  path: string;\n  /** The link's own text (`readlink`), shown as written. */\n  target: string;\n}\n\n/**\n * The symlinks a library refuses. A library is plain files: `validate`, `library index`, the\n * publish plan, `library init --path` and `asset import` refuse a symlink that\n *\n * - sits inside an asset directory (one holding a `SKILL.md`, `agent.yaml`, … — a link to a\n *   file, to `/etc/hosts` or to `.` ships nothing a consumer can use, and a deploy drops it), or\n * - points at a directory inside the scanned tree (`s1alias -> s1`, `loop -> .`): the scan\n *   would see one asset twice or never end.\n *\n * With `opts.wholeTree` (a library: `git add -A` publishes every file in it) every symlink\n * anywhere in the tree is refused, also a root-level `README-link -> README.md`, a link to a\n * file or directory outside the library and a symlinked asset directory.\n *\n * Links are never followed; {@link NON_ASSET_DIRS} are not entered. Without `wholeTree` a\n * directory link that leaves the tree and sits outside every asset (a project's deployed\n * `.claude/skills/x -> …`) is not listed, and the scanned root itself does not count as an\n * asset directory, so a `CLAUDE.md -> AGENTS.md` next to a single-file asset at the root is fine.\n *\n * @param absDir Absolute directory to scan; a missing directory yields no links.\n * @param opts.rootIsAsset Treat `absDir` itself as an asset directory (the source of an\n *   `asset import`), so a link at its top level is listed too.\n * @param opts.wholeTree Refuse every symlink in the tree (a library).\n * @param opts.skipDirs Extra directory names not entered (a project's deployed harness folders).\n * @returns Links sorted by path.\n */\nexport function listLibrarySymlinks(\n  absDir: string,\n  opts: { rootIsAsset?: boolean; wholeTree?: boolean; skipDirs?: ReadonlySet<string> } = {},\n): LibrarySymlink[] {\n  let root: string;\n  try {\n    root = realpathSync(absDir);\n  } catch {\n    return [];\n  }\n  const skipped = (name: string): boolean =>\n    isNonAssetDir(name) || opts.skipDirs?.has(name) === true;\n  const out: LibrarySymlink[] = [];\n  const walk = (dir: string, rel: string, inAsset: boolean): void => {\n    let entries: Dirent[];\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    const here =\n      inAsset ||\n      (dir !== absDir &&\n        entries.some((e) => (e.isFile() || e.isSymbolicLink()) && isManifestName(e.name)));\n    for (const e of entries) {\n      const full = join(dir, e.name);\n      const childRel = rel ? `${rel}/${e.name}` : e.name;\n      if (e.isSymbolicLink()) {\n        if (isNonAssetFile(e.name) || skipped(e.name)) continue;\n        let refused = here || opts.wholeTree === true;\n        if (!refused) {\n          try {\n            const real = realpathSync(full);\n            // A link to a directory inside the tree aliases it; a link to a directory that holds\n            // an asset manifest is an asset directory that is not part of the tree (p520).\n            refused =\n              statSync(real).isDirectory() &&\n              (real === root ||\n                real.startsWith(root + sep) ||\n                readdirSync(real).some((n) => isManifestName(n)));\n          } catch {\n            // Dangling outside an asset: nothing to alias.\n          }\n        }\n        if (refused) {\n          let target: string;\n          try {\n            target = readlinkSync(full);\n          } catch {\n            target = \"?\";\n          }\n          out.push({ path: childRel, target });\n        }\n      } else if (e.isDirectory() && !skipped(e.name)) {\n        walk(full, childRel, here);\n      }\n    }\n  };\n  walk(absDir, \"\", opts.rootIsAsset === true);\n  return out.sort((a, b) => a.path.localeCompare(b.path));\n}\n\n/**\n * The one refusal text for a {@link LibrarySymlink}, printed by `validate`, `library index`,\n * `library publish` and `asset import`.\n */\nexport function librarySymlinkMessage(link: LibrarySymlink): string {\n  return `${link.path} is a symlink to ${link.target}: a library holds plain files and never follows symlinks. Remove the link, or replace it with a copy of what it points at.`;\n}\n\n/**\n * Every `.env` / `.env.*` file under `absDir` (sorted POSIX paths relative to `absDir`), in the\n * directories {@link listAssetFiles} walks. A deploy leaves them out; the list lets `add` say so.\n */\nexport function listEnvFiles(absDir: string): string[] {\n  const out: string[] = [];\n  const walk = (dir: string, rel: string): void => {\n    let entries: Dirent[];\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const e of entries) {\n      const childRel = rel ? `${rel}/${e.name}` : e.name;\n      if (e.isFile() && isEnvFileName(e.name)) out.push(childRel);\n      else if (e.isDirectory() && !isNonAssetDir(e.name)) walk(join(dir, e.name), childRel);\n    }\n  };\n  walk(absDir, \"\");\n  return out.sort();\n}\n"]}

package/dist/{chunk-4AKR4XPQ.js → chunk-HG52NGAV.js}

@@ -1,4 +1,4 @@
-import { registryCredentialEnv } from './chunk-GQ5OYFVD.js';
+import { registryCredentialEnv } from './chunk-6Q7NKTDG.js';
 import { mergeRegistries } from './chunk-MJHSLODD.js';
 import { createLogger } from './chunk-BOFL7GIF.js';
 import { EventEmitter } from 'events';
@@ -269,5 +269,5 @@ var AgentDriver = class extends EventEmitter {
 };
 
 export { AGENT_EFFORT_LEVELS, AgentDriver, TOOL_ALLOWLIST_UNSUPPORTED, getBridgeLogger, registryDriverConfig, toAgentEffort, toMergedRegistry };
-//# sourceMappingURL=chunk-4AKR4XPQ.js.map
-//# sourceMappingURL=chunk-4AKR4XPQ.js.map
+//# sourceMappingURL=chunk-HG52NGAV.js.map
+//# sourceMappingURL=chunk-HG52NGAV.js.map

package/dist/chunk-HG52NGAV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/logger.ts","../bridge/src/provider-registry-derive.ts","../bridge/src/types.ts"],"names":[],"mappings":";;;;;;AAuBO,SAAS,gBAAgB,OAAA,EAAyB;AACvD,EAAA,OAAO,YAAA,CAAa,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,CAAA;AACjD;;;ACFO,SAAS,gBAAA,CACd,QAAA,EACA,KAAA,GAA2B,SAAA,EACD;AAC1B,EAAA,IAAI,KAAA,CAAM,OAAA,CAAS,QAAA,CAAsC,KAAK,CAAA,EAAG;AAC/D,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAO,gBAAgB,CAAC,EAAE,OAAO,SAAA,EAAW,QAAA,EAAgC,CAAC,CAAA;AAC/E;AAYO,SAAS,oBAAA,CACd,QAAA,EACA,OAAA,GAAqC,EAAC,EACkD;AACxF,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,QAAA,EAAU,SAAS,CAAA;AACnD,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,MAAA;AAAA,IACV,GAAA,EAAK,qBAAA,CAAsB,MAAA,EAAQ,OAAO,CAAA;AAAA,IAC1C,GAAI,QAAQ,UAAA,GAAa,EAAE,UAAU,OAAA,CAAQ,UAAA,KAAe;AAAC,GAC/D;AACF;AC+UO,IAAM,sBAAsB,CAAC,KAAA,EAAO,QAAA,EAAU,MAAA,EAAQ,SAAS,KAAK;AAQpE,SAAS,cAAc,KAAA,EAAyC;AACrE,EAAA,OAAO,aAAA,CAAc,KAAK,CAAA,GAAI,KAAA,GAAQ,MAAA;AACxC;AAEA,SAAS,cAAc,KAAA,EAAsC;AAC3D,EAAA,OAAQ,mBAAA,CAA2C,SAAS,KAAK,CAAA;AACnE;AAgfO,IAAM,0BAAA,GAA6B;AA2BnC,IAAe,WAAA,GAAf,cAAmC,YAAA,CAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BrD,YAAY,KAAA,EAAwC;AAClD,IAAA,IAAI,MAAM,aAAA,KAAkB,MAAA;AAC1B,MAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,0BAA0B,CAAC,CAAA;AAC7D,IAAA,IAAI,KAAA,CAAM,aAAa,MAAA,EAAQ,OAAO,QAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AAC9F,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,qBAAA,GAAiC;AACnC,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,wBAAwB,SAAA,EAAwC;AAC9D,IAAA,OAAO,CAAC,GAAG,SAAS,CAAA;AAAA,EACtB;AAAA;AAAA,EAGA,IAAI,oBAAA,GAAgC;AAClC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAmBA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAA,CAAK,IAAA,EAAK;AAAA,EACZ;AAAA;AAAA,EAMA,IAAI,gBAAA,GAAuC;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA,EAGA,gBAAA,GAAuC;AACrC,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,kBAAA,GAA8B;AAC5B,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,cAAA,CAAe,MAAA,EAAgB,QAAA,EAAmB,SAAA,EAA6B;AAI7E,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,wBAAA,GAAiC;AAAA,EAEjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,YAAY,KAAA,EAAsD;AAChE,IAAA,MAAM,SAAS,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,KAAK,IAAI,CAAA;AAC3C,IAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,MACrB,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,eAAA;AAAA,MACN,SAAS,CAAA,IAAA,EAAO,IAAA,CAAK,UAAA,CAAW,EAAE,yBAAyB,MAAM,CAAA,uDAAA;AAAA,KAClE,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,GAA+B;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,cAAA,GAAgC;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAA,GAAmC;AACjC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,gBAAA,GAAkC;AAChC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAA,GAAkC;AAChC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,sBAAsB,KAAA,EAEY;AACtC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,UAAA,GAAoC;AACxC,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA,EAWU,UAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACF,cAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMR,YAAA,CAAa,UAA6B,KAAA,EAAoB;AAC5D,IAAA,IAAA,CAAK,UAAA,GAAa,QAAA;AAClB,IAAA,IAAA,CAAK,YAAA,GAAe,KAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAA,CACE,QACA,KAAA,EACkB;AAClB,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,IAAA,CAAK,cAAc,OAAO,MAAA;AACnD,IAAA,IAAA,CAAK,cAAA,GAAiB,KAAK,GAAA,EAAI;AAC/B,IAAA,IAAA,CAAK,kBAAkB,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU,MAAA,IAAU,KAAK,YAAA,EAAc;AAAA,MAC5E,IAAA,EAAM,gBAAA;AAAA,MACN,IAAA,EAAM,gBAAA;AAAA,MACN,UAAA,EAAY;AAAA,KACb,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,MAAA,EAOH;AACP,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,eAAA,EAAiB;AAC/C,IAAA,MAAM,aAAa,IAAA,CAAK,cAAA,GAAiB,KAAK,GAAA,EAAI,GAAI,KAAK,cAAA,GAAiB,CAAA;AAE5E,IAAA,IAAI,MAAA,EAAQ,WAAA,KAAgB,MAAA,IAAa,MAAA,EAAQ,iBAAiB,MAAA,EAAW;AAC3E,MAAA,IAAA,CAAK,UAAA,CAAW,aAAA,CAAc,IAAA,CAAK,eAAA,EAAiB;AAAA,QAClD,KAAA,EAAO,QAAQ,KAAA,IAAS,SAAA;AAAA,QACxB,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA;AAAA,QAC9B,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,cAAc,MAAA,CAAO,YAAA;AAAA,QACrB,UAAA;AAAA,QACA,YAAY,MAAA,CAAO;AAAA,OACpB,CAAA;AAAA,IACH;AAEA,IAAA,IAAA,CAAK,UAAA,CAAW,OAAA,CAAQ,IAAA,CAAK,eAAA,EAAiB;AAAA,MAC5C,MAAA,EAAQ,MAAA,EAAQ,KAAA,GAAQ,OAAA,GAAU,IAAA;AAAA,MAClC,OAAO,MAAA,EAAQ,KAAA;AAAA,MACf,UAAA,EAAY,EAAE,yBAAA,EAA2B,UAAA;AAAW,KACrD,CAAA;AAED,IAAA,IAAA,CAAK,eAAA,GAAkB,MAAA;AACvB,IAAA,IAAA,CAAK,cAAA,GAAiB,MAAA;AAAA,EACxB;AACF","file":"chunk-HG52NGAV.js","sourcesContent":["/**\n * Bridge-layer logger factory.\n *\n * Each driver creates its own Logger via `getBridgeLogger(subkind)` at\n * construction time. Falls back to an off-mode Logger (stdout only) when\n * no LogStore is registered — see @skaile/workspaces/core/logging for details.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\nimport type { Logger } from \"@skaile/workspaces/types\";\n\n/**\n * Construct a bridge-scoped Logger for a given driver subkind.\n *\n * Creates a `Logger` with `kind: \"bridge\"` and the specified `subkind`. Falls back to\n * an off-mode Logger (stdout only) when no `LogStore` is registered — see\n * `@skaile/workspaces/core/logging` for details. Each driver calls this once at construction\n * time; never re-construct per call.\n *\n * @param subkind - Driver id, e.g. `\"claude-sdk\"`, `\"omp\"`, `\"echo\"`, `\"codex\"`.\n * @returns A `Logger` scoped to `bridge:<subkind>`.\n * @docLink packages/bridge/api-reference#logger\n */\nexport function getBridgeLogger(subkind: string): Logger {\n  return createLogger({ kind: \"bridge\", subkind });\n}\n","/**\n * The two shaping helpers every registry consumer needs.\n *\n * The legacy provider axis — `provider` / `cloud` / `cloud_config` /\n * `cloudSecrets` — is gone from the runtime, and so is the user-local\n * `settings.json` `apiKeys{}` map: a session carries an AI provider registry\n * and a model selector, nothing else. Credentials are named by a\n * `credential.ref` and resolved into the child environment; no literal secret\n * ever enters an entry.\n */\n\nimport {\n  type AIProviderLayerId,\n  type AIProviderRegistry,\n  type MergedAIProviderRegistry,\n  mergeRegistries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport {\n  type RegistryCredentialOptions,\n  registryCredentialEnv,\n} from \"./provider-materialize/credential-env.js\";\n\n/** Turn any registry shape into the merged view, without re-merging one. */\nexport function toMergedRegistry(\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n  layer: AIProviderLayerId = \"session\",\n): MergedAIProviderRegistry {\n  if (Array.isArray((registry as MergedAIProviderRegistry).order)) {\n    return registry as MergedAIProviderRegistry;\n  }\n  return mergeRegistries([{ layer, providers: registry as AIProviderRegistry }]);\n}\n\n/**\n * The `AgentConfig` slice a `DriverTarget.listModels` closure builds its\n * throwaway driver from: the registry, the selector when the caller named one\n * entry, and the credentials as a child-environment fragment.\n *\n * The credentials have to ride `env`, not a side channel: a `platform:` or\n * `cmd:` reference resolves where the *caller* stands, and this process's own\n * environment cannot see it. `registryCredentialEnv` writes each one under\n * `SKAILE_AIP_<ID>_KEY`, which is the carrier every driver already consults.\n */\nexport function registryDriverConfig(\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n  options: RegistryCredentialOptions = {},\n): { registry: MergedAIProviderRegistry; env: Record<string, string>; modelRef?: string } {\n  const merged = toMergedRegistry(registry, \"runtime\");\n  return {\n    registry: merged,\n    env: registryCredentialEnv(merged, options),\n    ...(options.providerId ? { modelRef: options.providerId } : {}),\n  };\n}\n","import { EventEmitter } from \"node:events\";\nimport type { Span, TelemetryProvider, Trace } from \"@skaile/workspaces/telemetry\";\nimport type {\n  AgentPromptInput,\n  Capability,\n  CredentialMint,\n  CodexCredentialDelivery,\n  ContextUsageDetail,\n  DriverContextReport,\n  DriverInfo,\n  ErrorRetryReason,\n  CodexSubscriptionRefreshInput,\n  CodexSubscriptionRefreshResult,\n  FlowExecution,\n  ModelTokenUsage,\n  RenderInvokedEvent,\n  TokenUsage,\n} from \"@skaile/workspaces/types\";\nimport type { CodexServerRequestHandlers } from \"./codex-app-server.js\";\nexport type { AgentPromptInput } from \"@skaile/workspaces/types\";\nimport type { MergedAIProviderRegistry } from \"@skaile/workspaces/core/provider-registry\";\nimport type { ModelEntry } from \"./models.js\";\n\n/**\n * Test-only hook injected by the runner so a no-LLM driver (the echo driver's\n * scripted-flow mode) can read flow state and drive flow-adapter mutations\n * without an SDK/MCP round-trip. The runner wires this in `createActiveFlow`\n * from the active FlowAdapter + handle.\n *\n * This is an internal runner↔driver interface — NOT part of any wire\n * protocol or flow contract. Production drivers ignore it.\n *\n * @see packages/bridge/drivers/echo — scripted-flow mode\n * @since 3.6.0\n */\nexport interface FlowTestDriverHook {\n  /** Current flow execution snapshot, or `null` when no flow is active. */\n  getState(): FlowExecution | null;\n  /**\n   * Execute a flow-adapter operation (`start_node`, `request_approval`,\n   * `complete_node`, `request_input`, `skip_node`, `fail_node`, …). Returns\n   * the adapter's JSON string result (or rejects on an illegal transition).\n   */\n  execute(op: string, args: Record<string, unknown>): Promise<string>;\n  /**\n   * Node IDs marked as mandatory approval gates. The scripted policy resolves\n   * `auto` to `request_approval` for these even in autonomous mode, so hosts\n   * can drive a mandatory gate deterministically. Optional — absent hooks\n   * behave as if no node is mandatory.\n   */\n  mandatoryGates?(): string[];\n}\n\n/**\n * Minimal LLM tool descriptor used by the capability dispatch path. Mirrors\n * the runner's `LLMTool` shape so drivers can consume registry output without\n * importing `@skaile/workspaces/runner` (which would create a circular dep).\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/bridge/concepts#bridge-capability-tool\n */\nexport interface BridgeCapabilityTool {\n  /** Capability name; used as the LLM-visible tool name. */\n  name: string;\n  /** Human/LLM-readable description. */\n  description: string;\n  /** JSON Schema for the tool's input parameters. */\n  parameters: Record<string, unknown>;\n}\n\n/**\n * Render-cap event emission callback used by the bridge when the LLM invokes\n * a capability that carries a `render` spec. The runner provides the actual\n * sink (transport.send / sendEvent); the bridge only emits.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/bridge/concepts#bridge-render-emit\n */\nexport type BridgeRenderEmit = (event: RenderInvokedEvent) => void;\n\n/**\n * Text-event emission callback for render-capability fallbacks. When a\n * `RenderCapability` carries `render.fallback` and the LLM invokes it, the\n * bridge substitutes `{{prop}}` placeholders (top-level keys of `props`,\n * optional dotted-path traversal `{{user.name}}`) and pushes the rendered\n * string through this callback so clients without a render layer still see\n * a textual representation. No-op when `fallback` is absent.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/bridge/concepts#bridge-text-emit\n */\nexport type BridgeTextEmit = (text: string) => void;\n\n/**\n * Bundle of capability dispatch hooks. Registered into the driver via\n * `AgentConfig.capabilities`; the driver routes registered LLM tool calls\n * back into `invoke()` instead of using its native dispatch path.\n *\n * The runner constructs this from a `CapabilityRegistry` instance and threads\n * it through `createAgentSession()`. Drivers that don't yet implement\n * capability dispatch ignore the field — legacy v1 paths stay intact.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/bridge/concepts#bridge-capability-hooks\n */\nexport interface BridgeCapabilityHooks {\n  /** Build the LLM tool descriptor list from the registry. Called per turn so registration changes take effect. */\n  composeTools(): BridgeCapabilityTool[];\n  /** Resolve a wire-format Capability descriptor by name. Used by the bridge to inspect `fireAndForget` / `render`. */\n  resolve(name: string): Capability | null;\n  /**\n   * Validate input + dispatch through the registry. Logging is wired by the\n   * registry.\n   *\n   * `callId` is the per-dispatch id minted by `dispatchCapability`. It MUST be\n   * unique per process (never a driver/provider tool-call id, which only the\n   * model backend keeps unique): it is the `render_invoked.callId`, the\n   * registry's log correlation id, the handler's `ctx.callId` and — for client\n   * capabilities — the `capability_invoked.callId` keying the runner's pending\n   * map, so a reused id would let a late `capability_result` for a timed-out\n   * call resolve a later call. Callers without one omit it and the registry\n   * generates a fresh id.\n   */\n  invoke(name: string, input: unknown, signal?: AbortSignal, callId?: string): Promise<unknown>;\n  /** Subscribe to registry changes; callback carries no credentials or tool payloads. */\n  onToolsChanged?(listener: () => void): () => void;\n  /** Emit a render-invoked event. The runner forwards via the WebSocket transport. */\n  emitRender?: BridgeRenderEmit;\n  /** Emit a text fallback for render capabilities with `render.fallback`. */\n  emitText?: BridgeTextEmit;\n  /** Session id passed through to the runner's per-handler logger. */\n  sessionId: string;\n}\n\n/**\n * Static metadata for a registered agent driver (the harness it drives).\n *\n * Declared once in `@skaile/workspaces/types` — it is protocol surface (the\n * platform reads `surfaces` to decide which AI provider registry entries a\n * driver can serve) and was previously duplicated here field-for-field.\n *\n * Returned by {@link listDrivers} and exposed on every {@link AgentDriver}\n * instance via `driverInfo`.\n *\n * @docLink packages/bridge/concepts#driver-info\n */\nexport type { DriverInfo };\n\n/** Closed, passive managed-MCP observations. Counts saturate at 512. */\nexport interface CodexNativeMcpDiagnostics {\n  startupBeforeTurn: \"unknown\" | \"starting\" | \"ready\" | \"failed\" | \"cancelled\";\n  startupAtEnd: CodexNativeMcpDiagnostics[\"startupBeforeTurn\"];\n  toolsListBeforeTurn: number;\n  toolsListTotal: number;\n  toolsCallTotal: number;\n  nativeMcpToolItemCount: number;\n}\n\n/** Trusted session-local tool transport; fulfilled only after required tools are ready. */\nexport interface CodexToolTransport {\n  mcpServers: Record<string, Record<string, unknown>>;\n  /** Trusted runner server eligible for human native consent; must name its configured entry. */\n  approvalServerName?: string;\n  onServerRequest?: CodexServerRequestHandlers;\n  /** Revalidate the required live inventory before starting each turn. */\n  validate?(): Promise<void>;\n  /** Rebuild the native generation at idle when its advertised inventory is stale. */\n  needsReload?(): boolean;\n  instructions?: string;\n  /** Restrict model calls to the active turn and abort outstanding calls when it ends. */\n  beginTurn?(signal: AbortSignal): void;\n  /** Trusted private server binding and passive request-handler counters; never performs I/O. */\n  diagnostics?: {\n    serverName: string;\n    requestCounts(): { toolsListTotal: number; toolsCallTotal: number };\n  };\n  dispose(): Promise<void>;\n}\n\n/** Explicit managed instance inputs; none are inferred from ambient developer state. */\nexport interface CodexManagedRuntimeOptions {\n  executable: string;\n  /** Optional launcher arguments, for the caller-owned executable wrapper. */\n  executableArgs?: string[];\n  /** Private local filesystem state; the host must fence old native processes before reuse. */\n  privateDirectory: string;\n  /** Host-owned private mount containing every parent/child instance; denied to native tools. */\n  privateRoot: string;\n  environment: Record<string, string>;\n  credential: CodexCredentialDelivery;\n  instructionFiles?: string[];\n  skillsDirectory?: string;\n  prepareTools(signal: AbortSignal): Promise<CodexToolTransport>;\n  /**\n   * Passive snapshots before/after turns, plus final local counts after successful transport closure.\n   * No final snapshot is emitted on uncertain cleanup or a failed final counter read. Earlier snapshots\n   * are not proof of completed cleanup. Sink failures never affect native execution or cleanup.\n   */\n  onNativeMcpDiagnostics?(value: Readonly<CodexNativeMcpDiagnostics>): void | Promise<void>;\n  refreshCredential?: (\n    input: CodexSubscriptionRefreshInput,\n    signal: AbortSignal,\n  ) => Promise<CodexSubscriptionRefreshResult>;\n  requestTimeoutMs?: number;\n  turnTimeoutMs?: number;\n  /** Maximum native turns admitted by this instance; reserved for disposable one-turn children. */\n  nativeTurnBudget?: 1;\n  /** Human interaction deadline, bounded separately from ordinary RPCs. */\n  interactionTimeoutMs?: number;\n}\n\n/**\n * Codex-specific tuning options passed through `DriverOptions.codex`.\n *\n * @remarks These are forwarded verbatim to the Codex driver and have no effect on other drivers.\n * @docLink packages/bridge/concepts#codex-driver-options\n */\nexport interface CodexDriverOptions {\n  /** Omission retains the standalone SDK path; managed mode always requires App Server inputs. */\n  authSource?: \"local\" | \"managed\";\n  managedRuntime?: CodexManagedRuntimeOptions;\n  /** Controls whether Codex may auto-apply edits without user approval. */\n  approvalPolicy?: \"never\" | \"on-request\" | \"on-failure\" | \"untrusted\";\n  /** Filesystem sandbox level for the Codex process. */\n  sandboxMode?: \"read-only\" | \"workspace-write\" | \"danger-full-access\";\n  /** Reasoning budget passed to the model. */\n  reasoningEffort?: \"minimal\" | \"low\" | \"medium\" | \"high\" | \"xhigh\";\n  /** When `true`, the Codex sandbox is allowed to make outbound network requests. */\n  networkAccessEnabled?: boolean;\n  /** Extra directories made accessible to the Codex sandbox in addition to `cwd`. */\n  additionalDirectories?: string[];\n}\n\n/**\n * omp-specific options passed through `DriverOptions.omp`.\n *\n * They govern the session-private agent directory the omp adapter renders the\n * provider registry into (`omp-models-yml.ts`); every one of them has a\n * working default, so a caller that sets none still gets a correct session.\n *\n * @remarks Forwarded verbatim to the omp driver; no effect on other drivers.\n * @see PROVIDER-CONFIG-PLAN.md §2.3\n */\nexport interface OmpDriverOptions {\n  /**\n   * Explicit session-private agent directory for `PI_CODING_AGENT_DIR`.\n   * Defaults to `<cwd>/.omp/agent-home/<sessionId>`.\n   */\n  agentHome?: string;\n  /**\n   * Inherit the developer's own omp state (auth store, blobs, extensions) by\n   * symlinking {@link OmpDriverOptions.userAgentDir} into the session\n   * directory. Defaults to *on when that directory exists*, which is exactly\n   * the standalone case: a platform container has none, so its session starts\n   * empty. Set `false` to force an empty session directory regardless.\n   */\n  seedUserAgentDir?: boolean;\n  /** Seed source. Defaults to `~/.omp/agent`. */\n  userAgentDir?: string;\n}\n\n/**\n * Driver-specific configuration bag.\n *\n * Fields are keyed by driver ID so that callers can pass driver-specific options\n * through the common {@link AgentConfig} without breaking other drivers.\n *\n * @docLink packages/bridge/concepts#driver-options\n */\nexport interface DriverOptions {\n  /** Codex-specific options. Ignored by all other drivers. */\n  codex?: CodexDriverOptions;\n  /** omp-specific options. Ignored by all other drivers. */\n  omp?: OmpDriverOptions;\n}\n\n/**\n * What the driver tells the host about a turn blocked by an upstream usage\n * limit. Everything but `configId` is best-effort: the SDK reports the limit\n * window only on its structured telemetry, not on the error result text.\n *\n * @see AgentConfig.onLimitBlocked\n * @category Configuration\n * @since 3.9.0\n */\nexport interface LimitBlockedContext {\n  /** The AI provider config the blocked turn ran on (`\"\"` when unmediated). */\n  configId: string;\n  /** Upstream limit window (`five_hour`, `seven_day`, …) when reported. */\n  limitType?: string;\n  /** Epoch seconds at which the limit window resets, when reported. */\n  resetsAt?: number;\n  /** Fraction of the limit window consumed (0–1) when reported. */\n  utilization?: number;\n}\n\n/**\n * The host's verdict on a limit-blocked turn. `switched: true` is a promise\n * that a different seat's credential is already on disk — the driver acts on it\n * by respawning the CLI and replaying the prompt, so returning it without\n * having rewritten the credential file would just replay onto the dead seat.\n *\n * @see AgentConfig.onLimitBlocked\n * @category Configuration\n * @since 3.9.0\n */\nexport interface LimitFailoverResult {\n  /** Whether the session was repointed at a different AI provider config. */\n  switched: boolean;\n  /** The config id now in effect. Informational — used for logs. */\n  configId?: string;\n  /**\n   * Why no switch happened: `same-config`, `standalone`,\n   * `platform-omitted-config-id` (the mint succeeded but named no seat, so a\n   * re-resolution is indistinguishable from none), or a `CredentialMint`\n   * failure code. Diagnostic only — the driver branches on `switched`.\n   */\n  reason?: string;\n}\n\n/**\n * One observed AI-provider rejection, reported to the host for per-seat health\n * attribution. Fire-and-forget — see {@link AgentConfig.onProviderResponse}.\n *\n * @category Configuration\n * @since 3.9.0\n */\nexport interface ProviderResponseObservation {\n  /** 401 — the credential was rejected. 429 — an upstream rate/session limit. */\n  status: 401 | 429;\n  /** The AI provider config the observation is attributed to, when known. */\n  configId?: string;\n  /** Upstream limit window (`five_hour`, `seven_day`, …) when reported. */\n  limitType?: string;\n  /** Fraction of the limit window consumed (0–1) when reported. */\n  utilization?: number;\n  /** Epoch seconds at which the limit window resets, when reported. */\n  resetsAt?: number;\n  /**\n   * What the 429 was, when the driver recognised something narrower than a\n   * usage limit. `long-context-entitlement`: the account may not use a long\n   * (1M) context window; the seat is not out of quota. Diagnostic only — the\n   * driver still treats the rejection as before.\n   */\n  cause?: ProviderResponseCause;\n}\n\n/**\n * Why a 429 {@link ProviderResponseObservation} was rejected, when the driver\n * recognised it. Consumers must tolerate values they do not know.\n *\n * @category Configuration\n * @since 4.11.0\n */\nexport type ProviderResponseCause = \"long-context-entitlement\";\n\n/**\n * One upstream quota-window reading, reported to the host for every SDK\n * `rate_limit_event` — allowed, warning or rejected alike. Fire-and-forget —\n * see {@link AgentConfig.onProviderQuota}.\n *\n * @category Configuration\n * @since 4.1.0\n */\nexport interface ProviderQuotaObservation {\n  /** The AI provider config the reading is attributed to, when known. */\n  configId?: string;\n  /** Upstream window, verbatim (`five_hour`, `seven_day`, or a future value). */\n  window: string;\n  /** Upstream status, verbatim (`allowed`, `allowed_warning`, `rejected`, …). */\n  status: string;\n  /** Fraction of the window consumed (0–1); the SDK reports it on warnings and rejections only. */\n  utilization?: number;\n  /** Epoch seconds at which the window resets, when reported. */\n  resetsAt?: number;\n}\n\n/**\n * Reasoning effort levels a host may set. The platform sends all five, the\n * Agent SDK accepts all five, omp has a same-named thinking level for each, and\n * managed codex passes the value to its app server.\n *\n * @since 4.22.0\n */\nexport const AGENT_EFFORT_LEVELS = [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"] as const;\nexport type AgentEffort = (typeof AGENT_EFFORT_LEVELS)[number];\n\n/**\n * Narrow a free-form effort (the wire `agentConfig.effort`, a `skaile.yaml`\n * default) to an {@link AgentEffort}; anything else gives `undefined`, so an\n * unknown value never reaches a driver.\n */\nexport function toAgentEffort(value: unknown): AgentEffort | undefined {\n  return isAgentEffort(value) ? value : undefined;\n}\n\nfunction isAgentEffort(value: unknown): value is AgentEffort {\n  return (AGENT_EFFORT_LEVELS as readonly unknown[]).includes(value);\n}\n\n/**\n * Configuration passed to a driver when it is created via {@link createDriver}.\n *\n * All fields are shared across drivers; driver-specific behaviour is documented\n * per field. Fields that are silently ignored by a driver are marked accordingly.\n *\n * @docLink packages/bridge/concepts#agent-config\n */\nexport interface AgentConfig {\n  /** Absolute path to the working directory the agent operates in. */\n  cwd: string;\n  /**\n   * LLM model identifier (e.g. `\"claude-sonnet-4-5\"`, `\"gpt-4o\"`).\n   *\n   * The unscoped fallback: {@link AgentConfig.modelRef} is what a session\n   * normally carries, and this is what a driver falls back to when no\n   * registry entry resolved one.\n   */\n  model?: string;\n  /**\n   * The AI provider registry for this session — every endpoint the driver may\n   * address, already merged across the catalog / user / workspace / runtime /\n   * control-plane layers and in registry order.\n   *\n   * This is the *only* provider surface a driver reads. Entries reference\n   * their credential (`credential.ref`) and never carry the secret itself;\n   * the value reaches the child under `SKAILE_AIP_<ID>_KEY`\n   * (`provider-materialize/credential-env.ts`), which the session boundary\n   * puts in {@link AgentConfig.env}.\n   *\n   * Absent (or empty) means no endpoint was configured at all — the driver\n   * then falls back to whatever native auth it can discover on its own (a\n   * `claude` OAuth login, `codex login`, an ambient vendor key).\n   */\n  registry?: MergedAIProviderRegistry;\n  /**\n   * Model selector resolved against {@link AgentConfig.registry}:\n   * `\"<providerId>/<modelId>\"`, a bare `\"<modelId>\"` (first registry entry\n   * that maps it wins), or `\"@role\"`. Absent when no model was configured at\n   * all — the driver then applies its own default, exactly as it does for an\n   * absent `model`.\n   */\n  modelRef?: string;\n  /**\n   * The `skaile.yaml` `roles` table — role name → model selector\n   * (`{default: \"anthropic/opus\", smol: \"groq/llama-3.1-8b\"}`, §9.8). It is\n   * what `\"@role\"` in {@link AgentConfig.modelRef} expands through, and what\n   * a driver that supports per-role models materializes natively: omp renders\n   * it as `modelRoles` in its session-private `config.yml`, so `@smol` inside\n   * the session reaches a different provider than `@default`.\n   *\n   * Resolution is lenient: a role naming an entry this registry does not have\n   * is a warning, never a failure.\n   */\n  roles?: Record<string, string>;\n  /**\n   * Additional environment variables merged into the child process\n   * environment. The session boundary delivers resolved registry credentials\n   * here as `SKAILE_AIP_<ID>_KEY` entries; anything else the caller sets is\n   * merged over the driver's own allowlist, never instead of it.\n   */\n  env?: Record<string, string>;\n  /** Inline system prompt — written to .omp/system.md and passed via --append-system-prompt (omp driver) */\n  systemPrompt?: string;\n  /** Path to project .omp/ directory (PI_CODING_AGENT_DIR for omp driver) */\n  agentDir?: string;\n  /** SSH key path — injected as GIT_SSH_COMMAND */\n  sshKeyPath?: string;\n  /** Pre-assign a UUID as the session ID for a new session (claude-sdk: passed as sessionId option) */\n  sessionId?: string;\n  /** Resume this specific past session by UUID instead of starting fresh (claude-sdk: passed as resume option) */\n  resumeSessionId?: string;\n  /** Maximum agentic turns per query (claude-sdk: passed as maxTurns option) */\n  maxTurns?: number;\n  /**\n   * Whether the agent may act on its own (`auto`, the default) or has to be approved per tool\n   * call (`interactive`); the `agents.<id>.permissions.permission_mode` of the instance.\n   *\n   * - claude-sdk: `auto` runs under the SDK's `bypassPermissions`; `interactive` runs under\n   *   `default`, and a call the SDK does not auto-allow (a shell command, a file edit, an MCP\n   *   tool) pauses the turn on a `question` event with an `approval` card (`Approve once` /\n   *   `Deny`) answered through `answerQuestion`. With {@link AgentConfig.unattended} the call is\n   *   refused instead.\n   * - codex (standalone SDK path): `interactive` sets `approvalPolicy: \"on-request\"` instead of\n   *   `never`, unless `driverOptions.codex.approvalPolicy` is set. The standalone SDK path has no\n   *   way to show an approval card, so codex refuses a command that needs to leave its sandbox\n   *   instead of asking; nothing is ever approved. A managed codex session keeps the host's own\n   *   policy.\n   * - omp, echo and the subprocess CLI drivers (gemini, qwen, opencode, goose, continue): ignored.\n   */\n  permissionMode?: \"auto\" | \"interactive\";\n  /**\n   * The session has no one to answer a question (a nested `agent.run` role session, a\n   * single-shot `skaile run` without a terminal). With `permissionMode: \"interactive\"` a tool\n   * call that needs approval is then refused (claude-sdk) instead of waiting for a reply.\n   */\n  unattended?: boolean;\n  /** Agent name — selects a deployed sub-agent definition as the main agent identity.\n   *  claude-sdk: passed as `agent` option to query() → reads .claude/agents/<name>.md natively.\n   *  omp: ignored (omp uses agentDir/PI_CODING_AGENT_DIR instead). */\n  agentName?: string;\n  /** In-process SDK MCP servers for custom tool injection (Claude SDK only, ignored by other drivers) */\n  mcpServers?: Record<string, unknown>;\n  /** Tool restrictions from agent.yaml — applied to the main agent session */\n  tools?: {\n    /** Tool names that the agent is allowed to invoke. An empty array means no restriction. */\n    allowed?: string[];\n    /** Tool names that the agent is explicitly forbidden from invoking. */\n    denied?: string[];\n  };\n  /** Thinking mode for Claude models: adaptive (Claude decides), enabled (always think), disabled (no thinking). */\n  thinking?: \"adaptive\" | \"enabled\" | \"disabled\";\n  /** Reasoning effort level; each driver maps it to its own scale (see {@link AgentEffort}). */\n  effort?: AgentEffort;\n  /** Driver-specific configuration bag. */\n  driverOptions?: DriverOptions;\n  /**\n   * Protocol v2 capability dispatch hooks. When present, the driver uses the\n   * registry as the source of LLM tool definitions and routes invocations\n   * through `capabilities.invoke()`. Absent → legacy v1 path (existing\n   * mcpServers / native dispatch).\n   *\n   * @since 2.0.0\n   */\n  capabilities?: BridgeCapabilityHooks;\n  /**\n   * The platform's `AIProviderConfig.id` for the AI credential currently\n   * provisioned into this driver. The runner reads this off `AgentConfig`\n   * during 401 mediation and passes it as `configId` in\n   * `request_access_token { kind: 'ai-credentials' }`. The driver itself\n   * does not consume this field — only the runner uses it.\n   *\n   * Set by the platform agent-gateway in `ConfigureCommandV2` for mediated\n   * sessions. Standalone runners (CLI / forge / Claude plugin) leave it\n   * undefined; the runner falls back to surfacing the auth error to the\n   * user without mediating.\n   *\n   * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md`\n   * § \"Wire `aiProviderConfigId` end-to-end\".\n   *\n   * @since 3.3.0\n   */\n  aiProviderConfigId?: string;\n  /**\n   * Optional callback invoked by the driver when the underlying agent\n   * surfaces an `authentication_error`. In Protocol v3 the runner mediates\n   * the refresh via the `host.refresh_credential` capability and returns a\n   * typed {@link CredentialMint}. The driver inspects the discriminator:\n   *\n   *   - `mint.ok === true`: a fresh credential is now provisioned. The\n   *     driver re-attempts the in-flight prompt once.\n   *   - `mint.ok === false`: refresh failed (`code` carries a stable reason\n   *     such as `revoked`, `not-configured`, `provider-error`,\n   *     `backend-error`). The driver surfaces the original `AuthError` to\n   *     the caller.\n   *\n   * `args.configId` carries the platform `AIProviderConfig.id` the driver\n   * was provisioned with (mirrors {@link AgentConfig.aiProviderConfigId}).\n   * The runner uses it to scope the refresh to the correct AI credential.\n   *\n   * When omitted, the driver throws `AuthError` immediately as before\n   * (standalone CLI / forge mode — there is no platform mediator to ask).\n   *\n   * Centralising auth-retry inside the driver means every consumer of\n   * `driver.prompt(...)` (serve handler, compaction orchestrator, flow\n   * orchestrator, …) gets self-healing for free — there is no per-call-site\n   * wrapping.\n   *\n   * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`\n   * § \"host.refresh_credential capability\".\n   *\n   * @since 3.4.0\n   */\n  onAuthError?: (args: { configId: string }) => Promise<CredentialMint>;\n  /**\n   * Optional callback invoked by the driver when a turn is blocked by an\n   * upstream **usage limit** rather than a bad credential — the subscription\n   * five-hour / seven-day ceiling, or any `rate_limit` the classifier\n   * recognises. Called at most once per logical turn, and only after the\n   * blocked attempt has already failed, so it never runs mid-turn.\n   *\n   * The runner implements it by asking the platform to re-resolve the seat:\n   *\n   *   - `switched: true` — the session was repointed at a DIFFERENT AI\n   *     provider config and `.credentials.json` was rewritten. The driver\n   *     drops its query (forcing a fresh CLI spawn, which is what clears a\n   *     resident CLI's cached \"blocked until <reset>\" state — a hot file\n   *     rewrite alone does not) and replays the prompt once.\n   *   - `switched: false` — no alternative seat was available. The driver\n   *     surfaces the original limit error unchanged.\n   *\n   * Left unset by standalone runners (CLI / forge / Claude plugin): there is\n   * no platform mediator to re-resolve a seat, so the limit error surfaces\n   * exactly as it does today.\n   *\n   * Companion to {@link onAuthError}: that one covers 401s, this one covers\n   * the rejection path, which previously reached no failover at all\n   * (skaile-ai/workspaces#567, skaile-ai/platform#2976).\n   *\n   * @since 3.9.0\n   */\n  onLimitBlocked?: (ctx: LimitBlockedContext) => Promise<LimitFailoverResult>;\n  /**\n   * Optional fire-and-forget hook invoked when the driver observes a 401 or a\n   * 429 / subscription-limit rejection from the AI provider. The runner\n   * forwards it to the platform as a `provider_response_seen` event so the\n   * owning `AIProviderConfig`'s live health counters can be bumped — the cron\n   * health probe only samples auth, never capacity\n   * (skaile-ai/workspaces#368, skaile-ai/platform#3539).\n   *\n   * Never awaited and never retried; the driver swallows a throwing\n   * implementation so telemetry can never fail a turn.\n   *\n   * @since 3.9.0\n   */\n  onProviderResponse?: (observation: ProviderResponseObservation) => void;\n  /**\n   * Optional fire-and-forget hook invoked for every upstream quota-window\n   * reading (claude-sdk `rate_limit_event`), not only rejections. The runner\n   * forwards it as `provider_quota_observed`, which is the only quota signal\n   * the platform has for a seat whose token cannot read the OAuth usage\n   * endpoint (a `claude setup-token` seat).\n   *\n   * Never awaited and never retried; the driver swallows a throwing\n   * implementation so telemetry can never fail a turn. Unlike\n   * {@link onProviderResponse} it fires on every event, so dedupe at the host.\n   *\n   * @since 4.1.0\n   */\n  onProviderQuota?: (observation: ProviderQuotaObservation) => void;\n  /**\n   * Test-only flow driver hook. When present, the echo driver's scripted-flow\n   * mode uses it to advance flow nodes deterministically (no LLM). The runner\n   * injects it in `createActiveFlow`; every other driver ignores it.\n   *\n   * @see FlowTestDriverHook\n   * @since 3.6.0\n   */\n  flowTestDriver?: FlowTestDriverHook;\n}\n\n/**\n * A single message in an agent conversation.\n *\n * Emitted as part of {@link AgentEvent} variants (`message_start`, `message_update`, `message_end`).\n *\n * @docLink packages/bridge/concepts#agent-message\n */\nexport interface AgentMessage {\n  /** Originator of the message. */\n  role: \"user\" | \"assistant\" | \"tool\";\n  /** Message body — either a plain string or a list of typed content blocks. */\n  content: string | ContentBlock[];\n  /** Tool invocations made by the assistant in this message. */\n  toolCalls?: ToolCall[];\n  /** For `role === \"tool\"`: the name of the tool whose result this message carries. */\n  toolName?: string;\n  /** For `role === \"tool\"`: `true` when the tool returned an error. */\n  isError?: boolean;\n  /** Optional structured payload for tool results. */\n  data?: unknown;\n  /**\n   * Set when a subagent produced this message: the id of the tool use that\n   * runs the subagent. Absent on main-thread messages.\n   */\n  parentToolUseId?: string;\n}\n\n/**\n * A typed block within an {@link AgentMessage}'s content array.\n *\n * Mirrors the Anthropic content block schema but is driver-agnostic.\n *\n * @docLink packages/bridge/concepts#content-block\n */\nexport interface ContentBlock {\n  /** Block discriminant. */\n  type: \"text\" | \"tool_use\" | \"tool_result\" | \"thinking\";\n  /** Present for `text` and `thinking` blocks. */\n  text?: string;\n  /** Tool use / tool result correlation ID. */\n  id?: string;\n  /** Tool name (present on `tool_use` blocks). */\n  name?: string;\n  /** Tool input arguments (present on `tool_use` blocks). */\n  input?: any;\n  /** Serialised tool result content (present on `tool_result` blocks). */\n  content?: string;\n}\n\n/**\n * A single tool invocation made by the agent within a message.\n *\n * @docLink packages/bridge/concepts#tool-call\n */\nexport interface ToolCall {\n  /** Correlation ID used to match the call with its result. */\n  id: string;\n  /** Name of the tool being invoked. */\n  name: string;\n  /** Arguments passed to the tool. */\n  input: any;\n}\n\n/**\n * Error classification for agent failures.\n *\n * Used to determine whether a failure is retryable and to surface actionable\n * hints to the user. See `bridge/CLAUDE.md` for the full category-to-behaviour matrix.\n *\n * @see AgentError\n * @docLink packages/bridge/concepts#error-category\n */\nexport type ErrorCategory =\n  | \"auth\"\n  | \"account\"\n  | \"rate_limit\"\n  | \"model\"\n  | \"network\"\n  | \"config\"\n  | \"process\"\n  | \"validation\"\n  | \"unknown\";\n\n/**\n * Structured error payload emitted inside the `error` {@link AgentEvent}.\n *\n * Consumers should inspect `retryable` before deciding to surface a retry button,\n * and `hint` to provide an actionable message to the user.\n *\n * @docLink packages/bridge/concepts#agent-error\n */\nexport interface AgentError {\n  /** Human-readable error description. */\n  message: string;\n  /** Coarse failure classification used for retry logic and telemetry. */\n  category: ErrorCategory;\n  /** HTTP status code if the error originated from an API response. */\n  statusCode?: number;\n  /** `true` when the caller may safely retry the same operation. */\n  retryable: boolean;\n  /** Short actionable advice suitable for display in the UI. */\n  hint?: string;\n}\n\n/**\n * Metadata for a slash command exposed by the active agent runtime.\n *\n * @docLink packages/bridge/concepts#slash-command-info\n */\nexport interface SlashCommandInfo {\n  /** Command name without the leading slash (e.g. `\"compact\"`). */\n  name: string;\n  /** One-line description shown in command pickers. */\n  description: string;\n  /** Placeholder text describing what argument the command expects. */\n  argumentHint?: string;\n}\n\n/**\n * Discriminated union of all events emitted by a driver on the `'agent-event'` channel.\n *\n * @remarks\n * Consumers listen via `driver.on('agent-event', (event: AgentEvent) => ...)`.\n * The `[k: string]: any` index signature on most variants allows drivers to attach\n * driver-specific fields (e.g. `_textDelta`) without breaking the union.\n *\n * @docLink packages/bridge/concepts#agent-event\n */\nexport type AgentEvent =\n  | { type: \"message_start\"; message: AgentMessage; [k: string]: any }\n  | { type: \"message_update\"; message: AgentMessage; [k: string]: any }\n  | { type: \"message_end\"; message: AgentMessage; [k: string]: any }\n  /**\n   * Takes back `text`, the unfinished tail of streamed `_textDelta`s, before the\n   * driver replays an abandoned attempt. Always a suffix of what was streamed\n   * since the last completed assistant message; see `TextRetractEvent` in the types package.\n   */\n  | { type: \"message_retract\"; text: string; [k: string]: any }\n  | { type: \"turn_end\"; toolResults?: AgentMessage[]; [k: string]: any }\n  | { type: \"agent_end\"; [k: string]: any }\n  /** A background task started in the running turn; see `BackgroundTaskStartedEvent`. */\n  | { type: \"background_task_started\"; taskId: string; [k: string]: any }\n  /** A turn the driver was not prompted for began; see `SelfTurnStartedEvent`. */\n  | { type: \"self_turn_started\"; taskIds: string[]; [k: string]: any }\n  | {\n      type: \"result\";\n      subtype: string;\n      summary?: string;\n      costUsd?: number;\n      /** Per-turn token usage when the driver tracks it. Added in 3.1.0. */\n      tokens?: TokenUsage;\n      /** Per-turn usage keyed by model, subagent calls included. Added in 3.11.0. */\n      modelUsage?: Record<string, ModelTokenUsage>;\n      /** Prompt size of the turn's last main-thread API call. Added in 3.11.0. */\n      contextTokens?: number;\n      /** Context window of the main model, in tokens. Added in 3.11.0. */\n      contextWindow?: number;\n      errors?: string[];\n      [k: string]: any;\n    }\n  | {\n      type: \"error\";\n      error: string;\n      detail?: AgentError;\n      fatal?: boolean;\n      /** Set (with `fatal: false`) when the driver replays the prompt in place; see `ErrorEvent.retrying`. */\n      retrying?: boolean;\n      retryReason?: ErrorRetryReason;\n      /** Usage of a failed provider turn, when reported. */\n      tokens?: TokenUsage;\n      /** Failed-turn usage keyed by the actual model. */\n      modelUsage?: Record<string, ModelTokenUsage>;\n      contextTokens?: number;\n      contextWindow?: number;\n      [k: string]: any;\n    }\n  | {\n      type: \"tool_call\";\n      name?: string;\n      tool?: { name: string };\n      /** Set when a subagent made the call. */\n      parentToolUseId?: string;\n      [k: string]: any;\n    }\n  | { type: \"tool_execution_end\"; toolName?: string; parentToolUseId?: string; [k: string]: any }\n  | { type: \"commands_available\"; commands: SlashCommandInfo[] }\n  | { type: \"session_info\"; driverSessionId: string; sessionFile?: string }\n  | { type: \"ui_render\"; [k: string]: any }\n  | { type: \"ui_render_update\"; [k: string]: any }\n  | { type: \"ui_clear\"; [k: string]: any }\n  // Phase 3 (resume cascade) — driver-emitted resume outcome.\n  | {\n      type: \"resume_failed\";\n      resumeSessionId: string;\n      reason:\n        | \"signature_mismatch\"\n        | \"model_mismatch\"\n        | \"jsonl_lost\"\n        | \"jsonl_poisoned\"\n        | \"native_state_unavailable\";\n      [k: string]: any;\n    };\n\n/** The settings a live reconfigure may change. */\nexport type ReconfigurePatch = Partial<Pick<AgentConfig, \"model\" | \"thinking\" | \"effort\">>;\n\n/**\n * What a driver now holds for the fields of an accepted reconfigure. `modelRef`\n * is the registry selector the model was scoped to; it is absent when the\n * session has none. A host remembers exactly this, never the raw patch.\n */\nexport interface ReconfigureApplied {\n  model?: string;\n  modelRef?: string;\n  thinking?: AgentConfig[\"thinking\"];\n  effort?: AgentConfig[\"effort\"];\n}\n\n/**\n * Result of `AgentDriver.reconfigure()`. `ok: true` means effective from the\n * next turn (live switch, query recycle or respawn); a driver that cannot\n * promise that answers `ok: false` instead.\n *\n * - `not_supported`: the driver cannot change settings live.\n * - `model_not_on_provider`: the session's AI provider entry does not list the\n *   model (`providerId` names the entry).\n * - `rejected`: the running process refused the change; the driver config is\n *   unchanged.\n *\n * @category Bridge\n */\nexport type ReconfigureOutcome =\n  | { ok: true; applied: ReconfigureApplied }\n  | {\n      ok: false;\n      code: \"not_supported\" | \"model_not_on_provider\" | \"rejected\";\n      message: string;\n      providerId?: string;\n    };\n\n/**\n * A reconfigure the driver answered `ok` (it landed mid-turn) and then refused\n * at the next turn boundary. The driver already rolled its config back;\n * `requested` is what was asked, `restored` what it holds again. Emitted as the\n * driver event `'reconfigure-rollback'`.\n */\nexport interface ReconfigureRollback {\n  message: string;\n  requested: ReconfigureApplied;\n  restored: ReconfigureApplied;\n}\n\n/** Rejection message of a driver asked to run a turn under a tool allowlist it cannot enforce. */\nexport const TOOL_ALLOWLIST_UNSUPPORTED = \"This agent harness cannot enforce a tool allowlist\";\n\n/**\n * Abstract base class for agent drivers.\n *\n * Wraps an LLM coding agent behind a single `prompt()` interface.\n * All drivers emit `'agent-event'` with {@link AgentEvent} payloads.\n *\n * @remarks\n * Subclasses must implement `start`, `prompt`, `abort`, `kill`, and `isRunning`.\n * Implementations should never emit an event name other than `'agent-event'` as\n * the public streaming channel — internal events (`'ready'`, `'exit'`, etc.) are\n * driver-private. The one other public event is `'reconfigure-rollback'` (a\n * {@link ReconfigureRollback}): a live reconfigure the driver had accepted and\n * then refused at the turn boundary, already rolled back in the driver.\n *\n * @example\n * ```ts\n * const driver = createDriver('omp', config);\n * driver.on('agent-event', (event) => console.log(event.type));\n * await driver.start();\n * await driver.prompt('Refactor the auth module');\n * driver.kill();\n * ```\n *\n * @docLink packages/bridge/concepts#agent-driver\n */\nexport abstract class AgentDriver extends EventEmitter {\n  /** Static metadata describing this driver's capabilities. */\n  abstract readonly driverInfo: DriverInfo;\n\n  /**\n   * Initialises the driver's harness — spawns the child process (omp) or loads\n   * the SDK module (claude-sdk). Resolves when the harness is ready to accept\n   * prompts. Idempotent: calling `start()` on an already-running driver is a no-op.\n   *\n   * @throws {Error} When the harness binary is missing or the SDK cannot be loaded.\n   */\n  abstract start(): Promise<void>;\n\n  /**\n   * Sends a user message to the agent and resolves when the agent's turn completes\n   * (i.e. after the `agent_end` event has been emitted).\n   *\n   * @param message - Plain-text user prompt to send to the agent.\n   * @throws {Error} When the driver is not running or the underlying harness reports a fatal error.\n   */\n  abstract prompt(message: string): Promise<void>;\n\n  /**\n   * Preserve text-only callers; drivers must explicitly support attachments.\n   * A `toolAllowlist` is refused here: only a driver that overrides\n   * {@link enforcesToolAllowlist} may run a restricted turn.\n   */\n  promptInput(input: AgentPromptInput): Promise<void> {\n    if (input.toolAllowlist !== undefined)\n      return Promise.reject(new Error(TOOL_ALLOWLIST_UNSUPPORTED));\n    if (input.attachments?.length) return Promise.reject(new Error(\"Structured input unsupported\"));\n    return this.prompt(input.text);\n  }\n\n  /**\n   * Whether {@link promptInput} enforces `AgentPromptInput.toolAllowlist` for\n   * the whole turn, subagents included. A driver that answers `false` must\n   * reject an input carrying one; the runner refuses such a prompt before it\n   * reaches the driver.\n   */\n  get enforcesToolAllowlist(): boolean {\n    return false;\n  }\n\n  /**\n   * The names in `allowlist` this driver does not recognize as a tool it could\n   * offer. The runner refuses a prompt whose allowlist names any, rather than\n   * guess. A driver that does not enforce allowlists recognizes none.\n   */\n  unknownAllowlistedTools(allowlist: readonly string[]): string[] {\n    return [...allowlist];\n  }\n\n  /** Managed replies never fall back to a new prompt after a request has settled. */\n  get acceptsReplyAsPrompt(): boolean {\n    return true;\n  }\n\n  /**\n   * Sends an in-band abort signal to the agent, requesting it to stop the current\n   * turn without terminating the process. The driver remains usable after `abort()`.\n   *\n   * @remarks Only meaningful when `driverInfo.supportsInBandAbort` is `true`.\n   *   For other drivers, prefer `kill()` followed by creating a new driver instance.\n   */\n  abstract abort(): Promise<void>;\n\n  /**\n   * Terminates the agent harness immediately (SIGTERM for subprocess drivers,\n   * `close()` for in-process drivers). The driver instance must not be reused\n   * after `kill()`.\n   */\n  abstract kill(): void;\n\n  /** Stop the driver and await owned process/state cleanup when the harness supports it. */\n  async dispose(): Promise<void> {\n    this.kill();\n  }\n\n  /** `true` when the harness is alive and able to accept new prompts. */\n  abstract get isRunning(): boolean;\n\n  /** Optional provider-native session/thread identifier for resume support. */\n  get runtimeSessionId(): string | undefined {\n    return undefined;\n  }\n\n  /** Slash commands discovered from the agent runtime. Override in drivers that support introspection. */\n  getSlashCommands(): SlashCommandInfo[] {\n    return [];\n  }\n\n  // ── Interactive questions (AskUserQuestion) ──────────────────────────────\n\n  /**\n   * `true` while the driver is paused on an interactive question and waiting\n   * for the user's answer rather than a new prompt. The runner routes a\n   * `reply` command to {@link answerQuestion} instead of {@link prompt} when\n   * this returns `true`. Drivers without interactive-question support return\n   * `false` (the default), so a `reply` falls back to `prompt`.\n   */\n  hasPendingQuestion(): boolean {\n    return false;\n  }\n\n  /**\n   * Deliver the user's answer to the question the driver is currently paused\n   * on. This resumes the in-flight turn — it does NOT start a new one. When a\n   * single tool call asks several questions, the driver resolves the underlying\n   * call only once every sub-question has an answer.\n   *\n   * @param answer - The user's reply text (an option label, free text, or for\n   *   multi-select a comma-joined list).\n   * @param question - The sub-question this answers, verbatim from the\n   *   `question` event that asked it. Supply it whenever the host lets the user\n   *   answer out of order — without it the answer fills the next unanswered\n   *   slot in order, which silently mismatches a non-sequential reply.\n   * @returns `true` when the answer was consumed by a pending question; `false`\n   *   when no question was pending (caller should treat the reply as a prompt).\n   */\n  answerQuestion(answer: string, question?: string, requestId?: string): boolean {\n    void requestId;\n    void answer;\n    void question;\n    return false;\n  }\n\n  /**\n   * Apply this driver's rule for a new prompt that meets a pending question,\n   * ahead of the prompt itself. The runner queues a prompt behind the turn in\n   * flight, so a turn paused on a question would otherwise hold that prompt\n   * until the user answered. Drivers whose `prompt()` cancels the question\n   * (claude-sdk, omp) do the same here; the default keeps the question.\n   */\n  supersedePendingQuestion(): void {\n    // No-op: a driver without this rule keeps the question pending.\n  }\n\n  // ── Live reconfiguration ────────────────────────────────────────────────\n\n  /**\n   * Live-update driver configuration. `ok: true` means effective from the next\n   * turn: the next turn runs on the new settings, by live switch, query recycle\n   * or respawn, and the host needs no restart. A turn in progress finishes on\n   * the old settings. Only model/thinking/effort are reconfigurable mid-session.\n   *\n   * Drivers that can honour that promise build a `ReconfigureLedger` and\n   * delegate to it; it owns the model scope rule, ordering, drift and rollback.\n   * The base implementation answers `not_supported`.\n   */\n  reconfigure(patch: ReconfigurePatch): Promise<ReconfigureOutcome> {\n    const fields = Object.keys(patch).join(\", \");\n    return Promise.resolve({\n      ok: false,\n      code: \"not_supported\",\n      message: `The ${this.driverInfo.id} driver cannot change ${fields} live; the change applies when the session next starts.`,\n    });\n  }\n\n  /**\n   * Returns the model identifier currently configured on this driver.\n   * Subclasses that store config locally should override this.\n   */\n  getModel(): string | undefined {\n    return undefined;\n  }\n\n  // ── Compaction support ──────────────────────────────────────────────────\n\n  /**\n   * `Date.now()` of the harness's most recent sign of life, counting messages\n   * that emit no `agent-event` (thinking deltas, rate-limit telemetry, API\n   * retries). A stall check reads it alongside the events it sees. `null` when\n   * the driver does not track it.\n   */\n  lastActivityAt(): number | null {\n    return null;\n  }\n\n  /**\n   * Returns the token usage from the most recent completed turn.\n   * Returns `null` if usage data is unavailable (e.g. driver doesn't track it).\n   *\n   * Widened in 3.1.0 to return the full `TokenUsage` shape (input / output /\n   * cache-read / cache-creation / reasoning). All fields are optional so\n   * drivers can populate just what their provider reports. Existing callers\n   * that read only `inputTokens` / `outputTokens` keep working — those fields\n   * are still present and carry the same semantics as before.\n   */\n  getTokenUsage(): TokenUsage | null {\n    return null;\n  }\n\n  /**\n   * Prompt tokens occupying the context window as of the most recent API\n   * request — i.e. how full the context actually is right now.\n   *\n   * Deliberately NOT the same number as {@link getTokenUsage}, whose usage is\n   * cumulative over every API call in the turn and therefore overstates the\n   * context by 10-40x on any multi-tool turn. Callers measuring context fill\n   * (compaction thresholds) must prefer this; callers billing a turn\n   * (usage ledgers, the `finished` event) must keep using `getTokenUsage()`.\n   *\n   * Returns `null` both when the driver cannot report a per-call figure at all\n   * and when it can but has no reading yet. Falling back to `getTokenUsage()`\n   * is safe in either case only because a driver clears the two in lockstep: no\n   * reading means no API call landed, so there is no cumulative usage to\n   * overstate. A driver implementing this must preserve that invariant.\n   */\n  getContextTokens(): number | null {\n    return null;\n  }\n\n  /**\n   * Returns the model's context window size in tokens.\n   * Returns `null` if unknown.\n   */\n  getContextWindow(): number | null {\n    return null;\n  }\n\n  /**\n   * What the driver can measure natively about its context window, in the\n   * neutral {@link DriverContextReport} shape, or `null` when it measures\n   * nothing beyond {@link getContextTokens} / {@link getContextWindow}.\n   *\n   * `detail: \"full\"` (the default) may be expensive — claude-sdk issues\n   * `count_tokens` requests — so the runner asks for it only when a host\n   * requests a measured breakdown; `\"summary\"` must make no provider call and\n   * is what the per-turn snapshot uses. Implementations must not throw for\n   * \"unsupported\"; a rejection means the measurement itself failed and the\n   * runner falls back to estimates.\n   */\n  async getContextUsageReport(_opts?: {\n    detail?: ContextUsageDetail;\n  }): Promise<DriverContextReport | null> {\n    return null;\n  }\n\n  /**\n   * Returns the list of models available to this driver without starting a session.\n   * Drivers that can enumerate their own models override this method.\n   * Returns an empty array by default.\n   */\n  async listModels(): Promise<ModelEntry[]> {\n    return [];\n  }\n\n  /**\n   * Closes the current conversation session and prepares for a fresh start.\n   * The next `prompt()` call will begin a new session without prior history.\n   * The driver remains usable after `resetSession()`.\n   */\n  abstract resetSession(): Promise<void>;\n\n  // ── Telemetry ─────────────────────────────────────────────────────────────\n\n  protected _telemetry?: TelemetryProvider;\n  protected _activeTrace?: Trace;\n  protected _activeTurnSpan?: Span;\n  private _turnStartTime?: number;\n\n  /**\n   * Attach a telemetry provider and active trace to this driver.\n   * Called by the runner after creating the driver but before start().\n   */\n  setTelemetry(provider: TelemetryProvider, trace: Trace): void {\n    this._telemetry = provider;\n    this._activeTrace = trace;\n  }\n\n  /**\n   * Begin a turn span. Called by the runner before prompt().\n   * Pass a parent span (e.g. the turn span from the orchestrator) for nesting.\n   * Returns the span so the runner can annotate it further.\n   */\n  beginTurnSpan(\n    parent?: Trace | Span,\n    attrs?: Record<string, string | number | boolean>,\n  ): Span | undefined {\n    if (!this._telemetry || !this._activeTrace) return undefined;\n    this._turnStartTime = Date.now();\n    this._activeTurnSpan = this._telemetry.startSpan(parent ?? this._activeTrace, {\n      name: \"llm_generation\",\n      kind: \"llm_generation\",\n      attributes: attrs,\n    });\n    return this._activeTurnSpan;\n  }\n\n  /**\n   * End the current turn span with generation data.\n   * Called by the runner after agent_end. Model and provider are passed\n   * explicitly — the driver base class does not access config directly.\n   */\n  endTurnSpan(result?: {\n    model?: string;\n    provider?: string;\n    inputTokens?: number;\n    outputTokens?: number;\n    stopReason?: string;\n    error?: string;\n  }): void {\n    if (!this._telemetry || !this._activeTurnSpan) return;\n    const durationMs = this._turnStartTime ? Date.now() - this._turnStartTime : 0;\n\n    if (result?.inputTokens !== undefined || result?.outputTokens !== undefined) {\n      this._telemetry.logGeneration(this._activeTurnSpan, {\n        model: result?.model ?? \"unknown\",\n        provider: result?.provider ?? \"unknown\",\n        inputTokens: result.inputTokens,\n        outputTokens: result.outputTokens,\n        durationMs,\n        stopReason: result.stopReason,\n      });\n    }\n\n    this._telemetry.endSpan(this._activeTurnSpan, {\n      status: result?.error ? \"error\" : \"ok\",\n      error: result?.error,\n      attributes: { \"skaile.turn.duration_ms\": durationMs },\n    });\n\n    this._activeTurnSpan = undefined;\n    this._turnStartTime = undefined;\n  }\n}\n\n/**\n * Factory function signature registered in the driver registry.\n *\n * @param config - Configuration for the new driver instance.\n * @returns A freshly constructed (not yet started) {@link AgentDriver}.\n * @docLink packages/bridge/concepts#driver-factory\n */\nexport type DriverFactory = (config: AgentConfig) => AgentDriver;\n"]}