@skaile/workspaces 5.18.1 → 5.19.0

package/dist/{chunk-B4X2N7JQ.js → chunk-RPZVHXQ3.js}

@@ -305,16 +305,6 @@ function findMatchingCloseBrace(text, braceStart) {
   return -1;
 }
 
-// bridge/src/runner-private-env.ts
-var RUNNER_PRIVATE_ENV_KEYS = [
-  "SKAILE_WS_AUTH_TOKEN",
-  "SKAILE_WS_AUTH_TOKEN_FILE"
-];
-function stripRunnerPrivateEnv(env) {
-  for (const key of RUNNER_PRIVATE_ENV_KEYS) delete env[key];
-  return env;
-}
-
 // bridge/src/reconfigure-model-ref.ts
 function selectable(registry) {
   return registryEntries(registry).filter(
@@ -515,6 +505,16 @@ var ReconfigureLedger = class {
   }
 };
 
+// bridge/src/runner-private-env.ts
+var RUNNER_PRIVATE_ENV_KEYS = [
+  "SKAILE_WS_AUTH_TOKEN",
+  "SKAILE_WS_AUTH_TOKEN_FILE"
+];
+function stripRunnerPrivateEnv(env) {
+  for (const key of RUNNER_PRIVATE_ENV_KEYS) delete env[key];
+  return env;
+}
+
 export { AccountUnavailableError, AuthError, LONG_CONTEXT_CREDITS_API_ERROR, RUNNER_PRIVATE_ENV_KEYS, ReconfigureLedger, classifyClaudeSdkError, classifyGenericErrorMessage, isLongContextEntitlementRejection, reclassifyAuthAsAccountUnavailable, scopeReconfigureModel, stripRunnerPrivateEnv };
-//# sourceMappingURL=chunk-B4X2N7JQ.js.map
-//# sourceMappingURL=chunk-B4X2N7JQ.js.map
+//# sourceMappingURL=chunk-RPZVHXQ3.js.map
+//# sourceMappingURL=chunk-RPZVHXQ3.js.map

package/dist/chunk-RPZVHXQ3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/error-classifier.ts","../bridge/src/reconfigure-model-ref.ts","../bridge/src/reconfigure-ledger.ts","../bridge/src/runner-private-env.ts"],"names":[],"mappings":";;;AAkDO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EAC1B,MAAA;AAAA,EACT,YAAY,MAAA,EAAoB;AAC9B,IAAA,KAAA,CAAM,OAAO,OAAO,CAAA;AACpB,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF;AAaO,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACxC,MAAA;AAAA,EACT,YAAY,MAAA,EAAoB;AAC9B,IAAA,KAAA,CAAM,OAAO,OAAO,CAAA;AACpB,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF;AAQO,SAAS,mCAAmC,MAAA,EAAgC;AACjF,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,QAAA,EAAU,SAAA;AAAA,IACV,UAAA,EAAY,OAAO,UAAA,IAAc,GAAA;AAAA,IACjC,SAAA,EAAW,KAAA;AAAA,IACX,IAAA,EAAM;AAAA,GACR;AACF;AAMA,IAAM,8CAA8B,IAAI,GAAA,CAAY,CAAC,gBAAA,EAAkB,sBAAsB,CAAC,CAAA;AAM9F,IAAM,yCAAyB,IAAI,GAAA,CAAY,CAAC,aAAA,EAAe,aAAa,CAAC,CAAA;AAiCtE,IAAM,8BAAA,GAAiC;AAO9C,IAAM,gCAAA,GACJ,iFAAA;AASK,SAAS,kCACd,KAAA,EACS;AACT,EAAA,OAAO,KAAA,CAAM,IAAA;AAAA,IACX,CAAC,IAAA,KAAS,OAAO,SAAS,QAAA,IAAY,gCAAA,CAAiC,KAAK,IAAI;AAAA,GAClF;AACF;AAYO,SAAS,uBAAuB,KAAA,EAAuD;AAC5F,EAAA,MAAM,IAAA,GAAkC,OAAO,KAAA,KAAU,QAAA,GAAW,EAAE,MAAA,EAAQ,CAAC,KAAK,CAAA,EAAE,GAAI,KAAA;AAE1F,EAAA,MAAM,WAAW,IAAA,CAAK,MAAA,IAAU,EAAC,EAAG,IAAA,CAAK,IAAI,CAAA,IAAK,qBAAA;AAGlD,EAAA,MAAM,gBAAA,GAAmB,wBAAA,CAAyB,OAAA,EAAS,IAAI,CAAA;AAC/D,EAAA,IAAI,gBAAA,EAAkB;AACpB,IAAA,OAAO,gBAAA;AAAA,EACT;AAGA,EAAA,MAAM,UAAA,GAAa,+BAA+B,OAAO,CAAA;AACzD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,YAAA,GAAe,yBAAA,CAA0B,OAAA,EAAS,UAAA,EAAY,IAAI,CAAA;AACxE,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,OAAO,YAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,MAAM,KAAA,GAAQ,QAAQ,WAAA,EAAY;AAElC,EAAA,MAAM,SAAA,GAAY,iBAAA,CAAkB,OAAA,EAAS,KAAA,EAAO,IAAI,CAAA;AACxD,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,SAAA;AAAA,EACT;AAGA,EAAA,MAAM,SAAA,GAAY,iBAAA,CAAkB,OAAA,EAAS,IAAI,CAAA;AACjD,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,SAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,QAAA,EAAU,SAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AACF;AAMA,SAAS,wBAAA,CACP,SACA,IAAA,EACmB;AACnB,EAAA,IAAI,KAAK,cAAA,IAAkB,2BAAA,CAA4B,GAAA,CAAI,IAAA,CAAK,cAAc,CAAA,EAAG;AAC/E,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,cAAA,CAAe,IAAA,CAAK,eAAe;AAAA,KAC3C;AAAA,EACF;AACA,EAAA,IAAI,IAAA,CAAK,mBAAmB,iBAAA,EAAmB;AAC7C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,IAAI,KAAK,cAAA,IAAkB,sBAAA,CAAuB,GAAA,CAAI,IAAA,CAAK,cAAc,CAAA,EAAG;AAC1E,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,yBAAA,CACP,OAAA,EACA,UAAA,EACA,IAAA,EACmB;AACnB,EAAA,IAAI,UAAA,CAAW,cAAc,kBAAA,EAAoB;AAC/C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,cAAA,CAAe,IAAA,CAAK,eAAe;AAAA,KAC3C;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,cAAc,kBAAA,EAAoB;AAC/C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,cAAc,sBAAA,EAAwB;AAMnD,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM,IAAA,CAAK,eAAA,GACP,kTAAA,GACA;AAAA,KACN;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,cAAc,kBAAA,EAAoB;AAC/C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,cAAc,uBAAA,EAAyB;AACpD,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,UAAA,EAAY,WAAW,UAAA,IAAc,GAAA;AAAA,MACrC,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,iBAAA,CACP,OAAA,EACA,KAAA,EACA,IAAA,EACmB;AACnB,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,IAC3B,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,IAC3B,KAAA,CAAM,QAAA,CAAS,mBAAmB,CAAA,IAClC,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,IACpB,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,IACtB,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,IAC/B,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,EAC7B;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,cAAA,CAAe,IAAA,CAAK,eAAe;AAAA,KAC3C;AAAA,EACF;AAEA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,IAC/B,KAAA,CAAM,QAAA,CAAS,qBAAqB,CAAA,IACpC,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,EAC/B;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,iDAAiD,CAAA,EAAG;AACrE,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,UAAA,EAAY,GAAA;AAAA,MACZ,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAWA,EAAA,IAAI,MAAM,QAAA,CAAS,eAAe,KAAK,KAAA,CAAM,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC1E,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,UAAA,EAAY,GAAA;AAAA,MACZ,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM,IAAA,CAAK,eAAA,GACP,wOAAA,GACA;AAAA,KACN;AAAA,EACF;AAEA,EAAA,IACE,KAAA,CAAM,SAAS,SAAS,CAAA,IACxB,MAAM,QAAA,CAAS,gBAAgB,CAAA,IAC/B,KAAA,CAAM,QAAA,CAAS,wBAAwB,KACvC,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,IACpB,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,EACpB;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,MAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM,IAAA,CAAK,eAAA,GACP,sNAAA,GACA;AAAA,KACN;AAAA,EACF;AAEA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,KACrB,MAAM,QAAA,CAAS,WAAW,CAAA,IACzB,KAAA,CAAM,SAAS,eAAe,CAAA,IAC9B,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,CAAA,EACjC;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAEA,EAAA,IACE,MAAM,QAAA,CAAS,gBAAgB,KAC/B,KAAA,CAAM,QAAA,CAAS,aAAa,CAAA,IAC5B,KAAA,CAAM,SAAS,YAAY,CAAA,IAC3B,MAAM,QAAA,CAAS,oBAAoB,KACnC,KAAA,CAAM,QAAA,CAAS,iBAAiB,CAAA,EAChC;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,OAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAEA,EAAA,IACE,MAAM,QAAA,CAAS,SAAS,KACxB,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,SAAS,WAAW,CAAA,IAC1B,MAAM,QAAA,CAAS,cAAc,KAC7B,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA,EACxB;AACA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,iBAAA,CAAkB,SAAiB,IAAA,EAAoD;AAC9F,EAAA,IAAI,IAAA,CAAK,YAAY,iBAAA,EAAmB;AACtC,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,IAAI,IAAA,CAAK,YAAY,sBAAA,EAAwB;AAC3C,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,QAAA,EAAU,YAAA;AAAA,MACV,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAgBO,SAAS,4BACd,GAAA,EAC+D;AAC/D,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY;AAC9B,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA,IACxB,MAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,SAAS,gBAAgB,CAAA,IAC/B,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,EACpB;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAM;AAAA,EAC9C;AACA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,IAC3B,MAAM,QAAA,CAAS,KAAK,CAAA,IACpB,KAAA,CAAM,SAAS,mBAAmB,CAAA,IAClC,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,EACtB;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,SAAA,EAAW,IAAA,EAAK;AAAA,EACnD;AACA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,KACrB,MAAM,QAAA,CAAS,WAAW,CAAA,IACzB,KAAA,CAAM,SAAS,eAAe,CAAA,IAC9B,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,CAAA,EACjC;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AAAA,EAC/C;AACA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,IAC/B,MAAM,QAAA,CAAS,UAAU,CAAA,IACzB,KAAA,CAAM,SAAS,aAAa,CAAA,IAC5B,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,EAC3B;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AAAA,EAC/C;AACA,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA,IACxB,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,QAAA,CAAS,WAAW,CAAA,IAC1B,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA,IACxB,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,IACtB,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,EAC3B;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,SAAA,EAAW,IAAA,EAAK;AAAA,EAChD;AACA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,eAAe,eAAA,EAAmC;AACzD,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,uNAAA;AAAA,EACT;AACA,EAAA,OAAO,sEAAA;AACT;AAeA,SAAS,+BACP,IAAA,EACmD;AACnD,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACnC,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAA,GAAW,sBAAA,CAAuB,IAAA,EAAM,UAAU,CAAA;AACxD,EAAA,IAAI,WAAW,CAAA,EAAG;AAChB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAK,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,QAAQ,CAAC,CAAA;AAAA,EACtD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAA,GAAY,QAAQ,KAAA,EAAO,IAAA;AACjC,EAAA,IAAI,OAAO,cAAc,QAAA,EAAU;AACjC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,uBAAuB,CAAA;AACtD,EAAA,MAAM,aAAa,WAAA,GAAc,MAAA,CAAO,WAAA,CAAY,CAAC,CAAC,CAAA,GAAI,MAAA;AAC1D,EAAA,OAAO,EAAE,WAAW,UAAA,EAAW;AACjC;AAOA,SAAS,sBAAA,CAAuB,MAAc,UAAA,EAA4B;AACxE,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,UAAA,EAAY,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AAC7C,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA;AAC5B,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,GAAU,KAAA;AAAA,MACZ,CAAA,MAAA,IAAW,OAAO,EAAA,EAAY;AAC5B,QAAA,OAAA,GAAU,IAAA;AAAA,MACZ,CAAA,MAAA,IAAW,OAAO,EAAA,EAAY;AAC5B,QAAA,QAAA,GAAW,KAAA;AAAA,MACb;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,EAAA,EAAY;AACrB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb,CAAA,MAAA,IAAW,OAAO,GAAA,EAAa;AAC7B,MAAA,KAAA,EAAA;AAAA,IACF,CAAA,MAAA,IAAW,OAAO,GAAA,EAAa;AAC7B,MAAA,KAAA,EAAA;AACA,MAAA,IAAI,UAAU,CAAA,EAAG;AACf,QAAA,OAAO,CAAA,GAAI,CAAA;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAA;AACT;;;ACzkBA,SAAS,WACP,QAAA,EACqC;AACrC,EAAA,OAAO,eAAA,CAAgB,QAAQ,CAAA,CAAE,MAAA;AAAA,IAC/B,CAAC,IAAA,KAAA,CACE,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,KAAA,IAAS,IAAA,CAAK,CAAC,EAAE,IAAA,KAAS,OAAA,KAAY,cAAA,CAAe,IAAA,CAAK,CAAC,CAAC;AAAA,GAClF;AACF;AAQA,SAAS,WAAA,CAAY,OAA2B,OAAA,EAA0B;AACxE,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,SAAA,IAAa,EAAC;AAChC,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,YAAA,IAAgB,EAAC;AACpC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC5E,EAAA,OAAO,OAAA,IAAW,OAAO,OAAA,IAAW,IAAA,IAAQ,OAAO,MAAA,CAAO,GAAG,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA;AACjF;AAGA,SAAS,iBAAA,CACP,QAAA,EACA,QAAA,EACA,OAAA,EACA,KAAA,EACoB;AACpB,EAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,EAAK;AAC7B,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,OAAA,CAAQ,CAAC,IAAI,CAAC,CAAA;AAEjC,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAC,CAAC,EAAE,CAAA,KAAM,EAAA,KAAO,KAAK,CAAA,EAAG,OAAO,KAAA;AACjD,EAAA,OAAO,aAAA,CAAc,KAAA,EAAO,QAAA,EAAU,KAAK,CAAA,EAAG,UAAA;AAChD;AAgBO,SAAS,sBAAsB,KAAA,EAA0D;AAC9F,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,OAAM,GAAI,KAAA;AAC7C,EAAA,MAAM,MAAA,GAAgC;AAAA,IACpC,EAAA,EAAI,IAAA;AAAA,IACJ,QAAA,EAAU,QAAA,KAAa,MAAA,GAAY,MAAA,GAAY;AAAA,GACjD;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,WAAW,QAAQ,CAAA;AACnC,EAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,CAAA,EAAG,OAAO,MAAA;AAEhC,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,EAAK;AAC5B,EAAA,IAAI,QAAA,CAAS,WAAW,GAAG,CAAA,SAAU,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,QAAA,EAAS;AAEpE,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAClC,EAAA,IAAI,QAAQ,CAAA,EAAG;AACb,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AACpC,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AACrC,IAAA,MAAM,KAAA,GAAQ,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,IAAI,CAAA;AAChD,IAAA,IAAI,KAAA,IAAS,SAAS,EAAA,EAAI;AACxB,MAAA,IAAI,WAAA,CAAY,KAAA,CAAM,CAAC,CAAA,EAAG,IAAI,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,QAAA,EAAS;AACvE,MAAA,OAAO,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,IAC1B;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,QAAA,EAAU,QAAA,EAAU,SAAS,KAAK,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,OAAO,UAAU,CAAA;AACxD,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,CAAC,WAAA,CAAY,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAQ,CAAA,EAAG,OAAO,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAQ,CAAA;AAC1E,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,CAAA,EAAG,QAAQ,CAAC,CAAC,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAG;AAC3D;AAEA,SAAS,MAAA,CAAO,YAAoB,OAAA,EAAwC;AAC1E,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,IAAA,EAAM,uBAAA;AAAA,IACN,UAAA;AAAA,IACA,OAAA,EAAS,CAAA,mBAAA,EAAsB,UAAU,CAAA,uBAAA,EAA0B,OAAO,CAAA,mDAAA;AAAA,GAC5E;AACF;;;ACzEA,IAAM,MAAA,GAAS,CAAC,OAAA,EAAS,UAAA,EAAY,YAAY,QAAQ,CAAA;AAoDlD,IAAM,oBAAN,MAA6E;AAAA,EAKlF,YAA6B,OAAA,EAAsC;AAAtC,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAAA,EAAuC;AAAA,EAAvC,OAAA;AAAA,EAJrB,QAAA,GAAqB,IAAA;AAAA,EACrB,OAAA,GAAU,KAAA;AAAA,EACV,IAAA,GAAgC,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASxC,YAAY,QAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,YAAA,GAAwB;AAC1B,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,KAAA,EAAsD;AAChE,IAAA,OAAO,KAAK,OAAA,CAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAA,GAAiC;AAC/B,IAAA,OAAO,IAAA,CAAK,QAAQ,YAAY;AAC9B,MAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AACtB,MAAA,IAAI,CAAC,YAAY,IAAA,CAAK,OAAA,IAAW,EAAE,IAAA,CAAK,OAAA,CAAQ,MAAA,IAAS,IAAK,IAAA,CAAA,EAAO;AACrE,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,QAAA,kBAAU,IAAI,KAAK,CAAA;AAAA,IACtC,CAAC,CAAA;AAAA,EACH;AAAA,EAEQ,QAAW,GAAA,EAAmC;AAEpD,IAAA,MAAM,GAAA,GAAM,KAAK,IAAA,GAAO,IAAA,CAAK,KAAK,IAAA,CAAK,GAAG,IAAI,GAAA,EAAI;AAClD,IAAA,MAAM,UAAU,GAAA,CAAI,IAAA;AAAA,MAClB,MAAM,MAAA;AAAA,MACN,MAAM;AAAA,KACR;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,OAAA;AACZ,IAAA,KAAK,OAAA,CAAQ,KAAK,MAAM;AACtB,MAAA,IAAI,IAAA,CAAK,IAAA,KAAS,OAAA,EAAS,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,IACzC,CAAC,CAAA;AACD,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAA,EAAsD;AAC3E,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAO;AACnC,IAAA,MAAM,UAA8B,EAAC;AACrC,IAAA,IAAI,KAAA,CAAM,UAAU,MAAA,EAAW;AAG7B,MAAA,MAAM,QAAQ,qBAAA,CAAsB;AAAA,QAClC,OAAO,KAAA,CAAM,KAAA;AAAA,QACb,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,OAAO,MAAA,CAAO;AAAA,OACf,CAAA;AACD,MAAA,IAAI,CAAC,MAAM,EAAA,EAAI;AACb,QAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,IAAA,CAAK,iDAAA,EAAmD;AAAA,UACxE,OAAO,KAAA,CAAM,KAAA;AAAA,UACb,YAAY,KAAA,CAAM;AAAA,SACnB,CAAA;AACD,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,KAAA;AAAA,UACJ,MAAM,KAAA,CAAM,IAAA;AAAA,UACZ,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,YAAY,KAAA,CAAM;AAAA,SACpB;AAAA,MACF;AACA,MAAA,MAAA,CAAO,KAAA,GAAQ,OAAA,CAAQ,KAAA,GAAQ,KAAA,CAAM,KAAA;AACrC,MAAA,IAAI,MAAM,QAAA,KAAa,MAAA,SAAkB,QAAA,GAAW,OAAA,CAAQ,WAAW,KAAA,CAAM,QAAA;AAAA,IAC/E;AACA,IAAA,IAAI,MAAM,QAAA,KAAa,MAAA,SAAkB,QAAA,GAAW,OAAA,CAAQ,WAAW,KAAA,CAAM,QAAA;AAC7E,IAAA,IAAI,MAAM,MAAA,KAAW,MAAA,SAAkB,MAAA,GAAS,OAAA,CAAQ,SAAS,KAAA,CAAM,MAAA;AACvE,IAAA,IAAA,CAAK,OAAA,CAAQ,YAAY,OAAO,CAAA;AAEhC,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AAEtB,IAAA,IAAI,CAAC,YAAY,IAAA,CAAK,OAAA,SAAgB,EAAE,EAAA,EAAI,MAAM,OAAA,EAAQ;AAC1D,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,IAAS,IAAK,IAAA;AACxC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,IAAS,IAAK,IAAA;AAExC,IAAA,IAAI,CAAC,QAAQ,CAAC,IAAA,SAAa,EAAE,EAAA,EAAI,MAAM,OAAA,EAAQ;AAE/C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,OAAO,CAAoC,CAAA;AAC3E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,UAAU,GAAG,CAAA;AAC/C,IAAA,OAAO,QAAA,KAAa,IAAA,GAChB,EAAE,EAAA,EAAI,IAAA,EAAM,OAAA,EAAQ,GACpB,EAAE,EAAA,EAAI,KAAA,EAAO,IAAA,EAAM,UAAA,EAAY,SAAS,QAAA,EAAS;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,KAAA,CACZ,QAAA,EACA,GAAA,EACwB;AACxB,IAAA,MAAM,IAAA,GAAO,KAAK,OAAA,CAAQ,SAAA;AAC1B,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAO;AACnC,IAAA,MAAM,QAA4B,EAAC;AACnC,IAAA,KAAA,MAAW,OAAO,MAAA,EAAQ;AACxB,MAAA,MAAM,KAAA,GAAQ,OAAO,GAAG,CAAA;AACxB,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,QAAA,CAAS,GAAG,CAAA,EAAG,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,CAAC,GAAG,GAAG,OAAO,CAAA;AAAA,IAC3F;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,KAAW,GAAG,OAAO,IAAA;AAG5C,IAAA,MAAM,OAAA,GAAkC,EAAE,IAAA,EAAM,GAAA,CAAI,SAAS,CAAA,EAAE;AAC/D,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,KAAA,EAAO,QAAA,EAAU,OAAO,CAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,GAAS,EAAE,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAA,EAAE;AAAA,IACxE;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,QAAA,EAAU,OAAO,IAAA;AAEvC,IAAA,IAAI,WAAW,SAAA,EAAW;AACxB,MAAA,MAAA,CAAO,MAAA,CAAO,UAAU,KAAK,CAAA;AAC7B,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,WAAW,SAAA,EAAW;AACxB,MAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,YAAgC,EAAC;AACvC,IAAA,MAAM,WAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,EAAmC;AAEpE,MAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,EAAE,CAAC,GAAG,GAAG,QAAA,CAAS,GAAG,CAAA,EAAG,CAAA;AAC9C,MAAA,IAAI,CAAC,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA,EAAG;AACjB,QAAA,MAAA,CAAO,MAAA,CAAO,WAAW,EAAE,CAAC,GAAG,GAAG,KAAA,CAAM,GAAG,CAAA,EAAG,CAAA;AAC9C,QAAA,MAAA,CAAO,MAAA,CAAO,UAAU,EAAE,CAAC,GAAG,GAAG,QAAA,CAAS,GAAG,CAAA,EAAG,CAAA;AAAA,MAClD;AAAA,IACF;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,IAAA,CAAK,8CAAA,EAAgD;AAAA,MACrE,QAAQ,MAAA,CAAO,QAAA;AAAA,MACf,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,KAAK;AAAA,KAC1B,CAAA;AACD,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,CAAA,EAAG;AACrC,MAAA,IAAA,CAAK,OAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAS,OAAO,QAAA,EAAU,SAAA,EAAW,UAAU,CAAA;AAAA,IAClF;AACA,IAAA,OAAO,MAAA,CAAO,QAAA;AAAA,EAChB;AACF;;;AChQO,IAAM,uBAAA,GAA6C;AAAA,EACxD,sBAAA;AAAA,EACA;AACF;AAMO,SAAS,sBAAoE,GAAA,EAAW;AAC7F,EAAA,KAAA,MAAW,GAAA,IAAO,uBAAA,EAAyB,OAAO,GAAA,CAAI,GAAG,CAAA;AACzD,EAAA,OAAO,GAAA;AACT","file":"chunk-RPZVHXQ3.js","sourcesContent":["/**\n * Error classification for the Claude Agent SDK driver.\n *\n * Wraps the Anthropic API error patterns surfaced through the bundled\n * `claude-cli.js`. The CLI flattens upstream HTTP errors into terse strings\n * like:\n *\n *   `Claude Code returned an error result: Failed to authenticate. API Error:\n *    401 {\"type\":\"error\",\"error\":{\"type\":\"authentication_error\",\"message\":\n *    \"Invalid authentication credentials\"}}`\n *\n * Word-for-word that reads as an auth failure, but in practice it also\n * fires when a Claude Max OAuth subscription has exhausted its current\n * quota window — Anthropic returns a non-200 that the CLI relabels as\n * \"Failed to authenticate\" without preserving the original error type.\n *\n * The classifier here:\n *   1. Parses an embedded JSON body when the upstream included one\n *      (e.g. `{\"type\":\"error\",\"error\":{\"type\":\"rate_limit_error\",...}}`)\n *      so we believe the structured `error.type` over the surrounding\n *      free-text wrapper.\n *   2. Honours the SDK's `terminal_reason` when it explicitly indicates\n *      a blocking-limit / rapid-refill / model-error condition — those\n *      are authoritative even if the textual error reads as auth.\n *   3. Falls back to keyword heuristics on the message text.\n *   4. For OAuth-style credentials (Claude Code subscriptions), adds a\n *      hint that bounces user attention to quota rather than credentials,\n *      because that's overwhelmingly the cause when a CredentialsFile\n *      provider that worked yesterday now returns \"Invalid authentication\n *      credentials\" without anyone touching the file.\n */\n\nimport type { AgentError } from \"./types.js\";\n\n/**\n * Error thrown by drivers when the upstream provider rejects the credential\n * with an authentication-shaped failure (HTTP 401 / `authentication_error`\n * structured body). Carries the structured {@link AgentError} produced by\n * {@link classifyClaudeSdkError} so the runner can mediate without\n * re-classifying string text.\n *\n * The runner's 401-mediation handler `instanceof`-discriminates on this\n * subclass so the auth-vs-rate_limit fork stays in one place.\n *\n * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md`\n * § \"Runner-side handling on 401\".\n *\n * @category Errors\n * @since 3.3.0\n */\nexport class AuthError extends Error {\n  readonly detail: AgentError;\n  constructor(detail: AgentError) {\n    super(detail.message);\n    this.name = \"AuthError\";\n    this.detail = detail;\n  }\n}\n\n/**\n * Error thrown when an auth-shaped failure persists *after* a successful\n * credential self-heal — the refresh worked, yet the immediate retry still\n * returned 401. That combination rules out the credential and points at the\n * account itself: a hidden-tier rate limit, a billing block, or anti-abuse\n * throttling on OAuth tokens used at scale (Anthropic mislabels all three as\n * `authentication_error`). It deliberately does **not** extend {@link AuthError}\n * so the driver's auth self-heal does not fire again on it.\n *\n * @category Errors\n */\nexport class AccountUnavailableError extends Error {\n  readonly detail: AgentError;\n  constructor(detail: AgentError) {\n    super(detail.message);\n    this.name = \"AccountUnavailableError\";\n    this.detail = detail;\n  }\n}\n\n/**\n * Re-label an auth-shaped {@link AgentError} as an `account` failure. Called\n * when a 401 recurs after a successful credential refresh: the credential is\n * fine, so the user needs an account-state hint, not \"check your API key\".\n * Pure function.\n */\nexport function reclassifyAuthAsAccountUnavailable(detail: AgentError): AgentError {\n  return {\n    ...detail,\n    category: \"account\",\n    statusCode: detail.statusCode ?? 401,\n    retryable: false,\n    hint: \"The credential was refreshed successfully but Anthropic still rejected the request. This is an account-state issue, not an invalid credential — usually a rate limit at a hidden tier, a billing block, or anti-abuse throttling. Wait a few minutes and retry; if it persists, check the account's billing and usage limits at https://console.anthropic.com/.\",\n  };\n}\n\n/**\n * `terminal_reason` values from the Claude Agent SDK that imply the failure\n * is a rate / quota / blocking condition rather than a credential problem.\n */\nconst RATE_LIMIT_TERMINAL_REASONS = new Set<string>([\"blocking_limit\", \"rapid_refill_breaker\"]);\n\n/**\n * `terminal_reason` values that indicate a generic, retryable model failure.\n * `prompt_too_long` is handled separately (not retryable, different hint).\n */\nconst MODEL_TERMINAL_REASONS = new Set<string>([\"model_error\", \"image_error\"]);\n\n/**\n * Input shape for {@link classifyClaudeSdkError} when decoding an `SDKResultError`.\n *\n * All fields are optional; `classifyClaudeSdkError` also accepts a plain `string`\n * (a thrown exception message) for the common non-SDK code paths.\n *\n * @docLink packages/bridge/api-reference#error-classifier\n */\nexport interface ClaudeSdkResultErrorInput {\n  /** `errors` array from `SDKResultError`. Empty when not provided. */\n  errors?: string[];\n  /**\n   * `terminal_reason` from `SDKResultError`. Authoritative when set to a\n   * blocking/rapid-refill value, regardless of message text.\n   */\n  terminalReason?: string;\n  /** `subtype` from `SDKResultError` — `error_max_turns` etc. */\n  subtype?: string;\n  /**\n   * `true` when the configured Anthropic credential is a Claude Code\n   * subscription (`CredentialsFile` provider) rather than a raw API key.\n   * Changes the hint copy because `Invalid authentication credentials`\n   * on an OAuth subscription almost always means quota.\n   */\n  oauthCredential?: boolean;\n}\n\n/**\n * The `apiError` tag the Claude Agent SDK (0.3.289) puts on the assistant\n * message it renders for a long-context entitlement 429.\n */\nexport const LONG_CONTEXT_CREDITS_API_ERROR = \"long_context_credits_required\";\n\n/**\n * Upstream and SDK-rendered wordings of the long-context entitlement 429:\n * \"Extra usage is required for long context\", \"Usage credits are required for\n * long context requests\", and the CLI's \"Usage credits required for 1M context\".\n */\nconst LONG_CONTEXT_ENTITLEMENT_PATTERN =\n  /\\b(?:extra usage is|usage credits(?: are)?) required for (?:long|1m) context\\b/i;\n\n/**\n * Whether any of `texts` is the 429 Anthropic returns when the account may not\n * use a long (1M) context window: the seat is not out of quota, it cannot serve\n * a context over 200k. Matches only that wording, never a usage-limit 429.\n *\n * @docLink packages/bridge/api-reference#error-classifier\n */\nexport function isLongContextEntitlementRejection(\n  texts: ReadonlyArray<string | null | undefined>,\n): boolean {\n  return texts.some(\n    (text) => typeof text === \"string\" && LONG_CONTEXT_ENTITLEMENT_PATTERN.test(text),\n  );\n}\n\n/**\n * Classify a Claude SDK result-error or thrown error into a structured\n * {@link AgentError}. Pure function — safe to call from any layer.\n *\n * @param input - Either a free-text error message (from a thrown exception)\n *   or a partially-decoded `SDKResultError` shape with `errors[]`,\n *   `terminal_reason`, and `subtype`.\n * @returns A category, retryable flag, and human-readable hint.\n * @docLink packages/bridge/api-reference#error-classifier\n */\nexport function classifyClaudeSdkError(input: string | ClaudeSdkResultErrorInput): AgentError {\n  const opts: ClaudeSdkResultErrorInput = typeof input === \"string\" ? { errors: [input] } : input;\n\n  const message = (opts.errors ?? []).join(\"; \") || \"Unknown agent error\";\n\n  // ── 1. Honour authoritative `terminal_reason` ──────────────────────────\n  const byTerminalReason = classifyByTerminalReason(message, opts);\n  if (byTerminalReason) {\n    return byTerminalReason;\n  }\n\n  // ── 2. Inspect embedded JSON body for a structured error.type ──────────\n  const structured = tryParseEmbeddedAnthropicError(message);\n  if (structured) {\n    const byStructured = classifyByStructuredError(message, structured, opts);\n    if (byStructured) {\n      return byStructured;\n    }\n  }\n\n  // ── 3. Heuristic keyword classification on the wrapper text ────────────\n  const lower = message.toLowerCase();\n\n  const byKeyword = classifyByKeyword(message, lower, opts);\n  if (byKeyword) {\n    return byKeyword;\n  }\n\n  // ── 4. SDK result subtypes ─────────────────────────────────────────────\n  const bySubtype = classifyBySubtype(message, opts);\n  if (bySubtype) {\n    return bySubtype;\n  }\n\n  return {\n    message,\n    category: \"unknown\",\n    retryable: true,\n  };\n}\n\n/**\n * Phase 1: classify on the SDK's authoritative `terminal_reason`. Returns\n * `null` when the reason is unset or not one of the recognised values.\n */\nfunction classifyByTerminalReason(\n  message: string,\n  opts: ClaudeSdkResultErrorInput,\n): AgentError | null {\n  if (opts.terminalReason && RATE_LIMIT_TERMINAL_REASONS.has(opts.terminalReason)) {\n    return {\n      message,\n      category: \"rate_limit\",\n      retryable: true,\n      hint: oauthQuotaHint(opts.oauthCredential),\n    };\n  }\n  if (opts.terminalReason === \"prompt_too_long\") {\n    return {\n      message,\n      category: \"model\",\n      retryable: false,\n      hint: \"The conversation is too long for the configured model. Start a new session or compact the existing one.\",\n    };\n  }\n  if (opts.terminalReason && MODEL_TERMINAL_REASONS.has(opts.terminalReason)) {\n    return {\n      message,\n      category: \"model\",\n      retryable: true,\n      hint: \"The model rejected this turn. Try again or switch models.\",\n    };\n  }\n  return null;\n}\n\n/**\n * Phase 2: classify on the structured `error.type` parsed from an embedded\n * Anthropic JSON body. Returns `null` for an unrecognised `errorType`.\n */\nfunction classifyByStructuredError(\n  message: string,\n  structured: { errorType: string; statusCode?: number },\n  opts: ClaudeSdkResultErrorInput,\n): AgentError | null {\n  if (structured.errorType === \"rate_limit_error\") {\n    return {\n      message,\n      category: \"rate_limit\",\n      statusCode: structured.statusCode ?? 429,\n      retryable: true,\n      hint: oauthQuotaHint(opts.oauthCredential),\n    };\n  }\n  if (structured.errorType === \"overloaded_error\") {\n    return {\n      message,\n      category: \"rate_limit\",\n      statusCode: structured.statusCode ?? 529,\n      retryable: true,\n      hint: \"Anthropic is overloaded. Try again in a moment.\",\n    };\n  }\n  if (structured.errorType === \"authentication_error\") {\n    // Anthropic genuinely says it's an auth failure. But for OAuth\n    // credentials with the `oauth-2025-04-20` beta flow, this still\n    // overwhelmingly correlates with quota. Surface both possibilities\n    // in the hint so the user does not first re-upload a perfectly\n    // good credentials file.\n    return {\n      message,\n      category: \"auth\",\n      statusCode: structured.statusCode ?? 401,\n      retryable: false,\n      hint: opts.oauthCredential\n        ? \"Anthropic rejected the OAuth credential. With Claude Code subscriptions this is usually a quota or rate-limit issue rather than an invalid token — wait a few minutes before re-uploading the credentials file. If it persists, re-export `~/.claude/.credentials.json` from a working Claude Code install.\"\n        : \"Anthropic rejected the API key. Check it in Settings -> AI Providers.\",\n    };\n  }\n  if (structured.errorType === \"permission_error\") {\n    return {\n      message,\n      category: \"auth\",\n      statusCode: structured.statusCode ?? 403,\n      retryable: false,\n      hint: \"The configured credential does not have access to the requested model.\",\n    };\n  }\n  if (structured.errorType === \"invalid_request_error\") {\n    return {\n      message,\n      category: \"validation\",\n      statusCode: structured.statusCode ?? 400,\n      retryable: false,\n      hint: \"Anthropic rejected the request shape. This is likely a bug — please report it.\",\n    };\n  }\n  return null;\n}\n\n/**\n * Phase 3: heuristic keyword classification on the lowercased wrapper text.\n * `lower` is the pre-lowercased `message`. Returns `null` when no bucket hits.\n */\nfunction classifyByKeyword(\n  message: string,\n  lower: string,\n  opts: ClaudeSdkResultErrorInput,\n): AgentError | null {\n  if (\n    lower.includes(\"rate limit\") ||\n    lower.includes(\"rate_limit\") ||\n    lower.includes(\"too many requests\") ||\n    lower.includes(\"429\") ||\n    lower.includes(\"quota\") ||\n    lower.includes(\"blocking_limit\") ||\n    lower.includes(\"rapid_refill\")\n  ) {\n    return {\n      message,\n      category: \"rate_limit\",\n      retryable: true,\n      hint: oauthQuotaHint(opts.oauthCredential),\n    };\n  }\n\n  if (\n    lower.includes(\"credit balance\") ||\n    lower.includes(\"insufficient credit\") ||\n    lower.includes(\"out of credits\")\n  ) {\n    return {\n      message,\n      category: \"rate_limit\",\n      retryable: false,\n      hint: \"The configured Anthropic account is out of credits. Top up at https://console.anthropic.com/ or switch providers.\",\n    };\n  }\n\n  if (lower.includes(\"oauth authentication is currently not supported\")) {\n    return {\n      message,\n      category: \"auth\",\n      statusCode: 401,\n      retryable: false,\n      hint: \"The Claude Code CLI did not send the OAuth beta header. The bundled CLI in this image is too old — rebuild the agent image.\",\n    };\n  }\n\n  // The Claude Code CLI emits this terse, JSON-less string when it finds no\n  // usable credential — most commonly because the OAuth access token in\n  // `~/.claude/.credentials.json` expired and the file carries no refresh token\n  // (the platform provisions access-token-only files by design). It MUST be\n  // classified as `auth` so the driver promotes it to `AuthError` and the\n  // `onAuthError` self-heal re-mints the credential. Without this branch the\n  // message falls through to `unknown`, the self-heal never fires, and every\n  // subsequent turn dead-ends on \"please /login\". The check sits ahead of the\n  // generic auth keywords because the string contains none of them.\n  if (lower.includes(\"not logged in\") || lower.includes(\"please run /login\")) {\n    return {\n      message,\n      category: \"auth\",\n      statusCode: 401,\n      retryable: false,\n      hint: opts.oauthCredential\n        ? \"The Claude Code OAuth credential expired and could not be auto-refreshed in-container. The runner will re-mint it — retry the prompt. If it persists, re-export `~/.claude/.credentials.json` from a working Claude Code install.\"\n        : \"No Anthropic credential is configured for this provider. Add one in Settings -> AI Providers.\",\n    };\n  }\n\n  if (\n    lower.includes(\"api key\") ||\n    lower.includes(\"authentication\") ||\n    lower.includes(\"invalid authentication\") ||\n    lower.includes(\"unauthorized\") ||\n    lower.includes(\"401\") ||\n    lower.includes(\"403\")\n  ) {\n    return {\n      message,\n      category: \"auth\",\n      retryable: false,\n      hint: opts.oauthCredential\n        ? \"Anthropic rejected the OAuth credential. With Claude Code subscriptions this is usually a quota or rate-limit issue rather than an invalid token — wait a few minutes before re-uploading the credentials file.\"\n        : \"Check the API key configured for this AI provider in Settings.\",\n    };\n  }\n\n  if (\n    lower.includes(\"model\") &&\n    (lower.includes(\"not found\") ||\n      lower.includes(\"not available\") ||\n      lower.includes(\"does not exist\"))\n  ) {\n    return {\n      message,\n      category: \"model\",\n      retryable: false,\n      hint: \"The selected model is not available for this credential. Change the model in the AI provider config.\",\n    };\n  }\n\n  if (\n    lower.includes(\"context length\") ||\n    lower.includes(\"token limit\") ||\n    lower.includes(\"max_tokens\") ||\n    lower.includes(\"prompt is too long\") ||\n    lower.includes(\"prompt_too_long\")\n  ) {\n    return {\n      message,\n      category: \"model\",\n      retryable: false,\n      hint: \"The conversation is too long for the model. Start a new session or compact this one.\",\n    };\n  }\n\n  if (\n    lower.includes(\"timeout\") ||\n    lower.includes(\"econnrefused\") ||\n    lower.includes(\"enotfound\") ||\n    lower.includes(\"fetch failed\") ||\n    lower.includes(\"network\")\n  ) {\n    return {\n      message,\n      category: \"network\",\n      retryable: true,\n      hint: \"Network error reaching Anthropic. The runner will retry — try again if it persists.\",\n    };\n  }\n\n  return null;\n}\n\n/**\n * Phase 4: classify on the SDK result `subtype` (`error_max_turns` etc).\n * Returns `null` when the subtype is unset or unrecognised.\n */\nfunction classifyBySubtype(message: string, opts: ClaudeSdkResultErrorInput): AgentError | null {\n  if (opts.subtype === \"error_max_turns\") {\n    return {\n      message,\n      category: \"unknown\",\n      retryable: true,\n      hint: \"The agent stopped after reaching `max_turns`. Resume the session or raise `max_turns` in the agent config.\",\n    };\n  }\n  if (opts.subtype === \"error_max_budget_usd\") {\n    return {\n      message,\n      category: \"rate_limit\",\n      retryable: false,\n      hint: \"The agent stopped because it hit the configured per-turn budget. Raise the budget or split the work.\",\n    };\n  }\n  return null;\n}\n\n/**\n * The shared keyword buckets matched by {@link classifyGenericErrorMessage}.\n * Drivers layer a provider-specific `hint` on top of the returned category.\n */\nexport type GenericErrorCategory = \"auth\" | \"rate_limit\" | \"model\" | \"network\";\n\n/**\n * Classify a free-text driver error against the keyword buckets common to the\n * subprocess/SDK drivers (omp, codex). Returns the matched `category` +\n * `retryable` flag, or `null` when no shared bucket matches so the caller can\n * fall through to its own provider-specific buckets (e.g. codex sandbox) and\n * `unknown` default. The driver supplies the user-facing `hint` — only the\n * bucketing logic is shared, not the copy.\n */\nexport function classifyGenericErrorMessage(\n  msg: string,\n): { category: GenericErrorCategory; retryable: boolean } | null {\n  const lower = msg.toLowerCase();\n  if (\n    lower.includes(\"api key\") ||\n    lower.includes(\"unauthorized\") ||\n    lower.includes(\"authentication\") ||\n    lower.includes(\"401\")\n  ) {\n    return { category: \"auth\", retryable: false };\n  }\n  if (\n    lower.includes(\"rate limit\") ||\n    lower.includes(\"429\") ||\n    lower.includes(\"too many requests\") ||\n    lower.includes(\"quota\")\n  ) {\n    return { category: \"rate_limit\", retryable: true };\n  }\n  if (\n    lower.includes(\"model\") &&\n    (lower.includes(\"not found\") ||\n      lower.includes(\"not available\") ||\n      lower.includes(\"does not exist\"))\n  ) {\n    return { category: \"model\", retryable: false };\n  }\n  if (\n    lower.includes(\"context length\") ||\n    lower.includes(\"too long\") ||\n    lower.includes(\"token limit\") ||\n    lower.includes(\"max_tokens\")\n  ) {\n    return { category: \"model\", retryable: false };\n  }\n  if (\n    lower.includes(\"timeout\") ||\n    lower.includes(\"econnrefused\") ||\n    lower.includes(\"enotfound\") ||\n    lower.includes(\"network\") ||\n    lower.includes(\"fetch failed\") ||\n    lower.includes(\"fetch\") ||\n    lower.includes(\"connection\")\n  ) {\n    return { category: \"network\", retryable: true };\n  }\n  return null;\n}\n\n/**\n * Returns the rate-limit hint copy, branched on whether the active\n * credential is a Claude Code OAuth subscription.\n */\nfunction oauthQuotaHint(oauthCredential?: boolean): string {\n  if (oauthCredential) {\n    return \"Quota exhausted on this Claude Code subscription. Wait for the rate-limit window to reset (typically a few minutes for short windows, longer for daily/weekly limits) before retrying. The credential itself is fine.\";\n  }\n  return \"The Anthropic account hit a rate limit. Wait a moment and try again.\";\n}\n\n/**\n * Try to extract a structured Anthropic error body from a free-text wrapper.\n * The bundled `claude-cli.js` typically formats failures as\n * `... API Error: <status> {\"type\":\"error\",\"error\":{\"type\":\"<errorType>\",...}}`\n * with optional trailing garbage after the JSON.\n *\n * Strategy: find the first `{`, then forward-scan tracking brace depth (with\n * string-literal awareness so braces inside quoted values do not throw the\n * count). The substring from `braceStart` to the matching `}` is the JSON\n * candidate; one `JSON.parse` does the rest. O(n) in the input length.\n *\n * Returns `null` when nothing parseable is found.\n */\nfunction tryParseEmbeddedAnthropicError(\n  text: string,\n): { errorType: string; statusCode?: number } | null {\n  const braceStart = text.indexOf(\"{\");\n  if (braceStart < 0) {\n    return null;\n  }\n\n  const braceEnd = findMatchingCloseBrace(text, braceStart);\n  if (braceEnd < 0) {\n    return null;\n  }\n\n  let parsed: { type?: string; error?: { type?: string; message?: string } };\n  try {\n    parsed = JSON.parse(text.slice(braceStart, braceEnd));\n  } catch {\n    return null;\n  }\n  const errorType = parsed?.error?.type;\n  if (typeof errorType !== \"string\") {\n    return null;\n  }\n  const statusMatch = text.match(/API Error:\\s*(\\d{3})/i);\n  const statusCode = statusMatch ? Number(statusMatch[1]) : undefined;\n  return { errorType, statusCode };\n}\n\n/**\n * Forward-scan `text` from `braceStart` (a `{`) with brace counting, returning\n * the index just past the matching close brace, or `-1` if unbalanced.\n * String-literal awareness: skip braces between unescaped double quotes.\n */\nfunction findMatchingCloseBrace(text: string, braceStart: number): number {\n  let depth = 0;\n  let inString = false;\n  let escaped = false;\n  for (let i = braceStart; i < text.length; i++) {\n    const ch = text.charCodeAt(i);\n    if (inString) {\n      if (escaped) {\n        escaped = false;\n      } else if (ch === 92 /* \\ */) {\n        escaped = true;\n      } else if (ch === 34 /* \" */) {\n        inString = false;\n      }\n      continue;\n    }\n    if (ch === 34 /* \" */) {\n      inString = true;\n    } else if (ch === 123 /* { */) {\n      depth++;\n    } else if (ch === 125 /* } */) {\n      depth--;\n      if (depth === 0) {\n        return i + 1;\n      }\n    }\n  }\n  return -1;\n}\n","// The registry selector a live model change (`reconfigure({ model })`) leaves a\n// session on. Shared by the runner's `runner.reconfigure` handler and every\n// driver whose `reconfigure()` rewrites `modelRef`, so both pick the same entry.\nimport {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseModelRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\n\n/** What a model-only reconfigure does to the session's registry selector. */\nexport type ReconfigureModelScope =\n  | {\n      ok: true;\n      /** The selector to run from now on; `undefined` leaves `modelRef` unset. */\n      modelRef: string | undefined;\n    }\n  | {\n      ok: false;\n      code: \"model_not_on_provider\";\n      /** The entry the session runs on, or the one the patch named. */\n      providerId: string;\n      message: string;\n    };\n\nexport interface ReconfigureModelScopeInput {\n  /** The model the patch names: bare, `<providerId>/<modelId>` or `@role`. */\n  model: string;\n  /** The session's current selector (`AgentConfig.modelRef`). */\n  modelRef: string | undefined;\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined;\n  roles?: Record<string, string>;\n}\n\nfunction selectable(\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n): Array<[string, AIProviderLlmEntry]> {\n  return registryEntries(registry).filter(\n    (pair): pair is [string, AIProviderLlmEntry] =>\n      (pair[1].kind === \"llm\" || pair[1].kind === \"embed\") && isEntryEnabled(pair[1]),\n  );\n}\n\n/**\n * Whether an entry serves a model id. An entry that declares no model at all\n * (no `model_map`, no `capabilities`) passes any id through, as the wake does.\n * Otherwise the id must be a declared logical id or a `model_map` target: the\n * platform sends the provider-side id the wake translated to.\n */\nfunction entryServes(entry: AIProviderLlmEntry, modelId: string): boolean {\n  const map = entry.model_map ?? {};\n  const caps = entry.capabilities ?? {};\n  if (Object.keys(map).length === 0 && Object.keys(caps).length === 0) return true;\n  return modelId in map || modelId in caps || Object.values(map).includes(modelId);\n}\n\n/** The entry a selector runs on, resolved the way the drivers resolve it. */\nfunction currentProviderId(\n  modelRef: string | undefined,\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n  entries: Array<[string, AIProviderLlmEntry]>,\n  roles: Record<string, string> | undefined,\n): string | undefined {\n  const named = modelRef?.trim();\n  if (!named) return entries[0]?.[0];\n  // A selector that is exactly an entry id names the endpoint and no model.\n  if (entries.some(([id]) => id === named)) return named;\n  return parseModelRef(named, registry, roles)?.providerId;\n}\n\n/**\n * Decide the selector a live model change leaves the session on.\n *\n * A bare model id keeps the provider the session already runs on\n * (`<currentProvider>/<model>`): re-resolving it by id alone could move the\n * session to another entry that lists the same id, which changes billing and\n * data residency without a sign. Only a patch that names a provider\n * (`<providerId>/<model>` or `@role`) moves it. When the target entry declares\n * its models and this one is not among them, the patch is refused so the host\n * applies it at the next wake instead.\n *\n * A registry with at most one usable entry has nowhere to move to and keeps the\n * old behaviour: the selector becomes the patch's model when one was set.\n */\nexport function scopeReconfigureModel(input: ReconfigureModelScopeInput): ReconfigureModelScope {\n  const { model, modelRef, registry, roles } = input;\n  const legacy: ReconfigureModelScope = {\n    ok: true,\n    modelRef: modelRef === undefined ? undefined : model,\n  };\n  if (!registry) return legacy;\n  const entries = selectable(registry);\n  if (entries.length <= 1) return legacy;\n\n  const selector = model.trim();\n  if (selector.startsWith(\"@\")) return { ok: true, modelRef: selector };\n\n  const slash = selector.indexOf(\"/\");\n  if (slash > 0) {\n    const head = selector.slice(0, slash);\n    const tail = selector.slice(slash + 1);\n    const named = entries.find(([id]) => id === head);\n    if (named && tail !== \"\") {\n      if (entryServes(named[1], tail)) return { ok: true, modelRef: selector };\n      return refuse(head, tail);\n    }\n  }\n\n  const providerId = currentProviderId(modelRef, registry, entries, roles);\n  const current = entries.find(([id]) => id === providerId);\n  if (!current) return legacy;\n  if (!entryServes(current[1], selector)) return refuse(current[0], selector);\n  return { ok: true, modelRef: `${current[0]}/${selector}` };\n}\n\nfunction refuse(providerId: string, modelId: string): ReconfigureModelScope {\n  return {\n    ok: false,\n    code: \"model_not_on_provider\",\n    providerId,\n    message: `AI provider entry \"${providerId}\" does not list model \"${modelId}\"; the change applies when the session next starts.`,\n  };\n}\n","// One owner for a live reconfigure (`AgentDriver.reconfigure()`): the desired\n// config, the snapshot the running process was last given, drift between them,\n// serial ordering of patches, the provider-entry scope rule, rollback on a\n// refusal and the typed outcome. A driver supplies one `applyLive` hook that\n// pushes a delta into its process; everything else lives here.\nimport type { Logger } from \"@skaile/workspaces/types\";\nimport { scopeReconfigureModel } from \"./reconfigure-model-ref.js\";\nimport type {\n  AgentConfig,\n  ReconfigureApplied,\n  ReconfigureOutcome,\n  ReconfigurePatch,\n  ReconfigureRollback,\n} from \"./types.js\";\n\n/** The config fields a live reconfigure reads and writes (the driver's own config object). */\nexport type ReconfigureConfig = Pick<\n  AgentConfig,\n  \"model\" | \"modelRef\" | \"thinking\" | \"effort\" | \"registry\" | \"roles\"\n>;\n\n/** What the running process holds: the settings it spawned with or was last switched to. */\nexport interface ReconfigureSnapshot {\n  model?: string;\n  modelRef?: string;\n  thinking?: AgentConfig[\"thinking\"];\n  effort?: AgentConfig[\"effort\"];\n}\n\n/**\n * What an {@link ReconfigureLedgerOptions.applyLive} hook answers:\n *\n * - `\"applied\"`: the process now runs the delta.\n * - `\"respawn\"`: the process cannot take it live; the driver replaces it before\n *   the next turn and the new process reads the desired config.\n * - `{ rejected }`: the process refuses it; the ledger rolls the config back to\n *   the snapshot.\n */\nexport type ReconfigureApplyResult = \"applied\" | \"respawn\" | { rejected: string };\n\n/**\n * What an {@link ReconfigureLedgerOptions.applyLive} hook is told about a push.\n * `late` is true when the whole delta was answered `ok` earlier (it landed\n * mid-turn): a refusal then reaches the host only through\n * {@link ReconfigureLedgerOptions.onLateRejection}, so the hook must not also\n * report it on another channel (an `error` event).\n */\nexport interface ReconfigurePushContext {\n  late: boolean;\n}\n\nconst FIELDS = [\"model\", \"modelRef\", \"thinking\", \"effort\"] as const;\n\nexport interface ReconfigureLedgerOptions<S extends ReconfigureSnapshot> {\n  /**\n   * The desired config. A getter, because a driver may replace its config object;\n   * the ledger writes accepted patches into whatever it returns.\n   */\n  config: () => ReconfigureConfig;\n  /**\n   * Push a delta (the fields whose desired value differs from the snapshot) into\n   * the running process. Called with the process up and idle, or at a turn\n   * boundary through {@link ReconfigureLedger.flushBeforeTurn}. The hook receives\n   * the live snapshot and may refine it (a driver that keeps extra fields on `S`\n   * updates them here); on `\"applied\"` the ledger copies the delta into it.\n   * A hook that throws counts as a rejection. Its `context.late` says whether a\n   * refusal is reported elsewhere (see {@link ReconfigurePushContext}). Absent: the process reads the\n   * desired config at its next spawn and there is nothing to push.\n   */\n  applyLive?: (\n    delta: ReconfigureApplied,\n    snapshot: S,\n    context: ReconfigurePushContext,\n  ) => ReconfigureApplyResult | Promise<ReconfigureApplyResult>;\n  /** Whether the process is up and can take a push. Default: true. */\n  isLive?: () => boolean;\n  /** Whether no turn is in flight. Default: true. */\n  isIdle?: () => boolean;\n  /**\n   * Called synchronously once a patch is written to the desired config, before\n   * any live push. For drivers that must refresh a derived cache on a change.\n   */\n  onDesired?: (applied: ReconfigureApplied) => void;\n  /**\n   * A refusal that arrives after the patch was already answered `ok` (it landed\n   * mid-turn and flushed at the turn boundary). The config is already rolled back\n   * when this runs, and an idle-time refusal never calls it (the capability call\n   * answers that one). A driver emits the driver event `reconfigure-rollback`.\n   */\n  onLateRejection?: (rollback: ReconfigureRollback) => void;\n  log?: Pick<Logger, \"warn\" | \"info\">;\n}\n\n/**\n * Serialised live reconfigure for one driver.\n *\n * `ok: true` means effective from the next turn: the next turn runs on the new\n * settings by live switch, query recycle or respawn. A patch that lands while a\n * turn is in flight (or before the process is ready) stays desired, is answered\n * `ok`, and is pushed by {@link flushBeforeTurn}.\n *\n * @category Bridge\n */\nexport class ReconfigureLedger<S extends ReconfigureSnapshot = ReconfigureSnapshot> {\n  private snapshot: S | null = null;\n  private respawn = false;\n  private tail: Promise<unknown> | null = null;\n\n  constructor(private readonly options: ReconfigureLedgerOptions<S>) {}\n\n  /**\n   * Record what a freshly spawned process runs. Call at every spawn: the\n   * desired config is what that spawn read, so drift is computed against this.\n   * `null` forgets the process (nothing left to push to).\n   */\n  setSnapshot(snapshot: S | null): void {\n    this.snapshot = snapshot;\n    this.respawn = false;\n  }\n\n  /**\n   * The process cannot take the desired config live and the driver must replace\n   * it before the next turn. Cleared by the next {@link setSnapshot}.\n   */\n  get needsRespawn(): boolean {\n    return this.respawn;\n  }\n\n  /**\n   * Apply a patch: scope the model to the session's provider entry, write it to\n   * the desired config, and push it when the process is up and idle. Patches run\n   * one at a time in arrival order.\n   */\n  reconfigure(patch: ReconfigurePatch): Promise<ReconfigureOutcome> {\n    return this.enqueue(() => this.runPatch(patch));\n  }\n\n  /**\n   * Push any drift to the process at a turn boundary. Await it before the turn\n   * is sent, so the turn runs on the desired settings. Never rejects.\n   */\n  flushBeforeTurn(): Promise<void> {\n    return this.enqueue(async () => {\n      const snapshot = this.snapshot;\n      if (!snapshot || this.respawn || !(this.options.isLive?.() ?? true)) return;\n      await this.flush(snapshot, new Set());\n    });\n  }\n\n  private enqueue<T>(job: () => Promise<T>): Promise<T> {\n    // With nothing in flight the job's synchronous prefix (scope + write) runs now.\n    const run = this.tail ? this.tail.then(job) : job();\n    const settled = run.then(\n      () => undefined,\n      () => undefined,\n    );\n    this.tail = settled;\n    void settled.then(() => {\n      if (this.tail === settled) this.tail = null;\n    });\n    return run;\n  }\n\n  private async runPatch(patch: ReconfigurePatch): Promise<ReconfigureOutcome> {\n    const config = this.options.config();\n    const applied: ReconfigureApplied = {};\n    if (patch.model !== undefined) {\n      // In registry mode the spawned model derives from `modelRef`, so it moves\n      // too: scoped to the current entry unless the patch names another one.\n      const scope = scopeReconfigureModel({\n        model: patch.model,\n        modelRef: config.modelRef,\n        registry: config.registry,\n        roles: config.roles,\n      });\n      if (!scope.ok) {\n        this.options.log?.warn(\"model change refused; keeping the current model\", {\n          model: patch.model,\n          providerId: scope.providerId,\n        });\n        return {\n          ok: false,\n          code: scope.code,\n          message: scope.message,\n          providerId: scope.providerId,\n        };\n      }\n      config.model = applied.model = patch.model;\n      if (scope.modelRef !== undefined) config.modelRef = applied.modelRef = scope.modelRef;\n    }\n    if (patch.thinking !== undefined) config.thinking = applied.thinking = patch.thinking;\n    if (patch.effort !== undefined) config.effort = applied.effort = patch.effort;\n    this.options.onDesired?.(applied);\n\n    const snapshot = this.snapshot;\n    // No process: the next spawn reads the desired config.\n    if (!snapshot || this.respawn) return { ok: true, applied };\n    const live = this.options.isLive?.() ?? true;\n    const idle = this.options.isIdle?.() ?? true;\n    // Mid-turn or before ready: stays desired, flushed at the turn boundary.\n    if (!live || !idle) return { ok: true, applied };\n\n    const own = new Set(Object.keys(applied) as Array<keyof ReconfigureApplied>);\n    const rejected = await this.flush(snapshot, own);\n    return rejected === null\n      ? { ok: true, applied }\n      : { ok: false, code: \"rejected\", message: rejected };\n  }\n\n  /**\n   * Push the drift to the process. Returns the refusal message, or `null` when\n   * the process took it (or will, by respawn). On a refusal the config rolls back\n   * to the snapshot; fields outside `own` were answered `ok` earlier, so they are\n   * reported through `onLateRejection`.\n   */\n  private async flush(\n    snapshot: S,\n    own: ReadonlySet<keyof ReconfigureApplied>,\n  ): Promise<string | null> {\n    const hook = this.options.applyLive;\n    if (!hook) return null;\n    const config = this.options.config();\n    const delta: ReconfigureApplied = {};\n    for (const key of FIELDS) {\n      const value = config[key];\n      if (value !== undefined && value !== snapshot[key]) Object.assign(delta, { [key]: value });\n    }\n    if (Object.keys(delta).length === 0) return null;\n\n    // Nothing in the delta was answered to a caller of this push: it is all late.\n    const context: ReconfigurePushContext = { late: own.size === 0 };\n    let result: ReconfigureApplyResult;\n    try {\n      result = await hook(delta, snapshot, context);\n    } catch (err) {\n      result = { rejected: err instanceof Error ? err.message : String(err) };\n    }\n    // The process was replaced meanwhile; the new one read the desired config.\n    if (this.snapshot !== snapshot) return null;\n\n    if (result === \"applied\") {\n      Object.assign(snapshot, delta);\n      return null;\n    }\n    if (result === \"respawn\") {\n      this.respawn = true;\n      return null;\n    }\n\n    const requested: ReconfigureApplied = {};\n    const restored: ReconfigureApplied = {};\n    for (const key of Object.keys(delta) as (keyof ReconfigureApplied)[]) {\n      // The hook may have applied part of the delta and refined the snapshot.\n      Object.assign(config, { [key]: snapshot[key] });\n      if (!own.has(key)) {\n        Object.assign(requested, { [key]: delta[key] });\n        Object.assign(restored, { [key]: snapshot[key] });\n      }\n    }\n    this.options.log?.warn(\"live reconfigure refused; config rolled back\", {\n      reason: result.rejected,\n      fields: Object.keys(delta),\n    });\n    if (Object.keys(requested).length > 0) {\n      this.options.onLateRejection?.({ message: result.rejected, requested, restored });\n    }\n    return result.rejected;\n  }\n}\n","/**\n * Environment variables that belong to the runner process and must never reach\n * an agent child (the CLI, its tools, MCP servers, hooks).\n *\n * `SKAILE_WS_AUTH_TOKEN` authenticates the host on the runner's own WebSocket.\n * An agent that can read it can connect to the runner as the host and send host\n * commands (prompts, connector mutations such as flow-gate approvals). The\n * runner removes it from `process.env` at startup; every driver strips it again\n * from the env it hands its child, so a value that slips back in through\n * `AgentConfig.env` or an embedder that skipped the startup scrub still stops\n * at the driver.\n */\nexport const RUNNER_PRIVATE_ENV_KEYS: readonly string[] = [\n  \"SKAILE_WS_AUTH_TOKEN\",\n  \"SKAILE_WS_AUTH_TOKEN_FILE\",\n];\n\n/**\n * Remove every {@link RUNNER_PRIVATE_ENV_KEYS} entry from `env`, in place, and\n * return it. Call it on the final child env, after every merge.\n */\nexport function stripRunnerPrivateEnv<T extends Record<string, string | undefined>>(env: T): T {\n  for (const key of RUNNER_PRIVATE_ENV_KEYS) delete env[key];\n  return env;\n}\n"]}

package/dist/{chunk-KC6HGWXN.js → chunk-TIIXG3PN.js}

@@ -1,4 +1,4 @@
-import { resolveSkWorkspaceConfig, readLinks, getGlobalCacheDir, sourceCacheKey } from './chunk-2NOLF7B2.js';
+import { resolveSkWorkspaceConfig, readLinks, getGlobalCacheDir, sourceCacheKey } from './chunk-V257LUBM.js';
 import { scanDirectory, tryWithFsDeadline } from './chunk-GOCWM7FN.js';
 import { existsSync, readFileSync } from 'fs';
 import { lstat, stat } from 'fs/promises';
@@ -229,5 +229,5 @@ function findCatalogEntry(entries, query) {
 }
 
 export { FACTORY_ASSETS_REPO_NAME, factoryAssetRoots, resolveFactoryAssetsRoot, resolveFactoryAssetsRootOrNull, resolvePackagedAssetsDir, resolveRuntimeAssets, resolveWorkspacesPackageRoot };
-//# sourceMappingURL=chunk-KC6HGWXN.js.map
-//# sourceMappingURL=chunk-KC6HGWXN.js.map
+//# sourceMappingURL=chunk-TIIXG3PN.js.map
+//# sourceMappingURL=chunk-TIIXG3PN.js.map

package/dist/{chunk-KC6HGWXN.js.map → chunk-TIIXG3PN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../core/src/runtime-assets.ts"],"names":["resolvePath","require"],"mappings":";;;;;;;;AAsDA,SAAS,sBACP,OAAA,EACmC;AACnC,EAAA,MAAM,aAAa,iBAAA,EAAkB;AACrC,EAAA,MAAM,MAAyC,EAAC;AAChD,EAAA,KAAA,MAAW,CAAA,IAAK,OAAA,IAAW,EAAC,EAAG;AAC7B,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,CAAA,CAAE,GAAG,CAAA;AAChC,IAAA,IAAI,GAAA,CAAI,GAAG,CAAA,EAAG;AACd,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI;AAAA,MACT,IAAA,EAAM,IAAA,CAAK,UAAA,EAAY,GAAG,CAAA;AAAA,MAC1B,KAAK,CAAA,CAAE,GAAA;AAAA,MACP,QAAQ,CAAA,CAAE,GAAA;AAAA,MACV,GAAI,EAAE,SAAA,GAAY,EAAE,WAAW,CAAA,CAAE,SAAA,KAAc;AAAC,KAClD;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAqDO,IAAM,wBAAA,GAA2B;AAMxC,IAAM,iCAAA,GAAoC,yBAAA;AAsC1C,eAAsB,qBAAqB,UAAA,EAAkD;AAC3F,EAAA,MAAM,MAAA,GAA8B;AAAA,IAClC,gBAAgB,EAAC;AAAA,IACjB,cAAc,EAAC;AAAA,IACf,iBAAiB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,IAC9C,UAAU,EAAC;AAAA,IACX,SAAS,YAAY;AACnB,MAAA,MAAM,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,WAAW,CAAC,KAAA,KAAU,gBAAA,CAAiB,MAAA,CAAO,gBAAgB,KAAK;AAAA,GACrE;AAEA,EAAA,MAAM,QAAA,CAAS,YAAY,MAAM,CAAA;AACjC,EAAA,OAAO,MAAA;AACT;AAmBO,SAAS,iBAAA,GAA8B;AAC5C,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,QAAQ,GAAA,CAAI,sBAAA;AAOpE,EAAA,IAAI,MAAA,IAAU,WAAW,MAAM,CAAA,QAAS,IAAA,CAAKA,OAAA,CAAY,MAAM,CAAC,CAAA;AAChE,EAAA,MAAM,OAAA,GAAU,yBAAyB,gBAAgB,CAAA;AACzD,EAAA,IAAI,OAAA,EAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAC/B,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,KAAK,CAAC,CAAA;AAC3B;AAYO,SAAS,wBAAA,GAAmC;AACjD,EAAA,MAAM,MAAM,8BAAA,EAA+B;AAC3C,EAAA,IAAI,KAAK,OAAO,GAAA;AAEhB,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,+LAAA;AAAA,GAIF;AACF;AAUO,SAAS,8BAAA,GAAgD;AAC9D,EAAA,OAAO,iBAAA,EAAkB,CAAE,CAAC,CAAA,IAAK,IAAA;AACnC;AAoBA,IAAI,0BAAA;AAEG,SAAS,4BAAA,GAA8C;AAC5D,EAAA,IAAI,0BAAA,KAA+B,QAAW,OAAO,0BAAA;AACrD,EAAA,0BAAA,GAA6B,4BAAA,EAA6B;AAC1D,EAAA,OAAO,0BAAA;AACT;AAEA,SAAS,4BAAA,GAA8C;AACrD,EAAA,IAAI;AACF,IAAA,MAAMC,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAC7C,IAAA,OAAO,OAAA,CAAQA,QAAAA,CAAQ,OAAA,CAAQ,iCAAiC,CAAC,CAAA;AAAA,EACnE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACxC,IAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,OAAA,EAAS,OAAO,CAAC,CAAA;AACrD,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,oBAAA,EAAsB,OAAO,GAAA;AAAA,MAChD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,QAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAiBO,SAAS,yBAAyB,MAAA,EAA+B;AACtE,EAAA,MAAM,OAAO,4BAAA,EAA6B;AAC1C,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAC,CAAA,EAAG;AACnE,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,IAAA;AAAA,EAC/B;AACA,EAAA,OAAO,IAAA;AACT;AAIA,IAAM,oBAAA,mBAA4C,IAAI,GAAA,CAAI,CAAC,WAAW,CAAC,CAAA;AAEvE,eAAe,QAAA,CAAS,YAAoB,MAAA,EAA4C;AACtF,EAAA,MAAA,CAAO,iBAAiB,EAAC;AACzB,EAAA,MAAA,CAAO,eAAe,EAAC;AACvB,EAAA,MAAA,CAAO,kBAAkB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AACtD,EAAA,MAAA,CAAO,WAAW,EAAC;AAEnB,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,MAAM,YAAA,GAAe,0BAAA,CAA2B,qBAAA,CAAsB,MAAA,CAAO,OAAO,CAAC,CAAA;AACrF,EAAA,MAAM,KAAA,GAAQ,UAAU,UAAU,CAAA;AAGlC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,IAAA,MAAM,UAAU,MAAM,cAAA,CAAe,IAAA,EAAM,IAAA,EAAM,YAAY,KAAK,CAAA;AAClE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,sBAAA,CAAuB,IAAA,EAAM,IAAI;AAAA,OAC3C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AAGF,MAAA,MAAM,QAAA,GAAW,IAAA,KAAS,iCAAA,GAAoC,wBAAA,GAA2B,IAAA;AAGzF,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,OAAA,EAAS,QAAA,EAAU;AAAA,QACrD,UAAA,EAAY,oBAAA;AAAA,QACZ,cAAc,MAAM;AAAA,QAAC;AAAA,OACtB,CAAA;AACD,MAAA,MAAM,UAAU,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,WAAW,CAAA;AAC5D,MAAA,MAAA,CAAO,cAAA,CAAe,IAAA,CAAK,GAAG,OAAO,CAAA;AAAA,IACvC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,CAAA,2BAAA,EAA8B,IAAI,CAAA,KAAA,EAAQ,OAAO,CAAA,EAAA,EACxD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF;AAMA,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAA,CAAO,cAAA,GAAiB,MAAA,CAAO,cAAA,CAAe,MAAA,CAAO,CAAC,CAAA,KAAM;AAC1D,IAAA,MAAM,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,CAAA;AAC/B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,KAAA;AAC1B,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AAGD,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,UAAA,IAAc,EAAC,EAAG;AACvC,IAAA,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,CAAA,CAAE,MAAA,EAAQ,aAAA,EAAe,CAAA,CAAE,EAAA,EAAI,CAAA;AAAA,EACrF;AAGA,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,KAAA,MAAW,GAAA,IAAO,OAAO,YAAA,EAAc;AACrC,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,MAAA,CAAO,cAAA,EAAgB,GAAG,CAAA;AACzD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,gBAAA;AAAA,QACN,eAAe,GAAA,CAAI,aAAA;AAAA,QACnB,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,OAAA,EACE,CAAA,QAAA,EAAW,GAAA,CAAI,IAAI,YAAY,GAAA,CAAI,IAAI,CAAA,gBAAA,EAAmB,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,aAAa,CAAA,gBAAA,EACxE,IAAI,IAAI,CAAA,sGAAA;AAAA,OAE3B,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAO,KAAA,CAAM,QAAA,EAAU,QAAA,IAAY,EAAC;AAC1C,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AACrD,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EACvD;AACA,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACjD,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACnD;AAUA,SAAS,2BACP,QAAA,EACmC;AACnC,EAAA,MAAM,MAAA,GAA4C,EAAE,GAAI,QAAA,IAAY,EAAC,EAAG;AACxE,EAAA,MAAM,QAAQ,iBAAA,EAAkB;AAChC,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AAItB,IAAA,IAAI,CAAC,OAAO,wBAAwB,CAAA,SAAU,wBAAwB,CAAA,GAAI,EAAE,IAAA,EAAM,EAAA,EAAG;AACrF,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,IAAA,GACJ,MAAM,MAAA,GAAS,CAAA,GACX,CAAC,iCAAA,EAAmC,wBAAwB,CAAA,GAC5D,CAAC,wBAAwB,CAAA;AAC/B,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AACxB,IAAA,MAAM,MAAM,IAAA,CAAK,CAAC,KAAK,CAAA,EAAG,wBAAwB,IAAI,CAAC,CAAA,CAAA;AACvD,IAAA,IAAI,CAAC,OAAO,GAAG,CAAA,SAAU,GAAG,CAAA,GAAI,EAAE,IAAA,EAAM,GAAA,EAAI;AAAA,EAC9C,CAAC,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAoBA,eAAe,cAAA,CACb,IAAA,EACA,IAAA,EACA,UAAA,EACA,KAAA,EACwB;AAExB,EAAA,MAAM,MAAA,GAAS,MAAM,IAAI,CAAA;AACzB,EAAA,IAAI,MAAA,IAAW,MAAM,UAAA,CAAW,MAAM,GAAI,OAAO,MAAA;AAGjD,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,MAAM,QAAA,GAAWD,OAAA,CAAY,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAClD,IAAA,OAAQ,MAAM,UAAA,CAAW,QAAQ,CAAA,GAAK,QAAA,GAAW,IAAA;AAAA,EACnD;AAKA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,MAAM,cAAc,IAAA,CAAK,UAAA,EAAY,SAAA,EAAW,OAAA,EAAS,WAAW,IAAI,CAAA;AAIxE,IAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,MAClB,SAAS,WAAW,CAAA,CAAA;AAAA,MACpB,YAAY;AACV,QAAA,MAAM,MAAM,WAAW,CAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACT,CAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,QAAQ,WAAA,GAAc,IAAA;AAAA,EAC/B;AAEA,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAW,IAAA,EAAgC;AAClD,EAAA,OAAO,iBAAA;AAAA,IACL,QAAQ,IAAI,CAAA,CAAA;AAAA,IACZ,YAAY;AACV,MAAA,MAAM,KAAK,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,sBAAA,CAAuB,MAAc,IAAA,EAAiC;AAC7E,EAAA,IAAI,SAAS,wBAAA,IAA4B,CAAC,KAAK,IAAA,IAAQ,CAAC,KAAK,GAAA,EAAK;AAChE,IAAA,OACE,CAAA,oHAAA,CAAA;AAAA,EAGJ;AACA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,GAAA,EAAM,IAAA,CAAK,GAAG,CAAA,8EAAA,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,kBAAA,EAAqB,IAAA,CAAK,IAAI,CAAA,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,eAAe,IAAI,CAAA,2BAAA,CAAA;AAC5B;AAEA,SAAS,gBAAA,CACP,SACA,KAAA,EACiC;AACjC,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAI,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,MAAM,IAAI,CAAA;AAC3D,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,QAAQ,CAAC,CAAA;AAE1C,EAAA,OAAO,MAAA;AACT","file":"chunk-KC6HGWXN.js","sourcesContent":["/**\n * Runtime asset resolution — read `skaile.yaml`, scan all declared repositories\n * (including the built-in `factory-assets/` directory as an implicit default),\n * and produce a unified view of connector catalog entries plus the implicit refs\n * that the `skaile.yaml` `connectors:` section adds to the dependency graph.\n *\n * This module is the single source of truth for \"which connectors does this\n * project see at runtime, and where do their implementations live on disk\".\n * Both the runner (serve, REPL, flow) and the platform's mid-session\n * `add_resource` flow consume `RuntimeAssetsResult.catalogEntries` and pass\n * it into `ConnectorManager` for catalog-based resolution.\n *\n * `factory-assets/` is the single first-party content tree (built-in connectors\n * + first-party skills + bundles) shipped inside the `@skaile/workspaces`\n * package — not a standalone package.\n *\n * It resolves to an **ordered list of roots** ({@link factoryAssetRoots}), not a\n * single dir. The bundled tree is always the baseline; an optional\n * `SKAILE_FACTORY_ASSETS_DIR` (legacy: `SKAILE_BASE_ASSETS_DIR`) is layered\n * **in front** as an additive override source — the agent container points it at\n * `/app/factory-assets/` (or a bind-mounted host dir) to ship updated skills /\n * flows / bundles / connector manifests without rebuilding the image. The two\n * roots resolve uniformly across every consumer (connector catalog scan, skill /\n * flow / completion discovery, the asset-manager factory source):\n *   1. `SKAILE_FACTORY_ASSETS_DIR` env dir, when set and existing (override layer).\n *   2. the bundled tree via {@link resolvePackagedAssetsDir} — the in-repo source\n *      `packages/workspaces/factory-assets/` during dev, else the published\n *      `dist/factory-assets/` after install (always-present baseline).\n *\n * Override semantics are **env-first**: on a name conflict the env root wins and\n * the bundled root fills the rest. Connector *code* still loads via the package's\n * static `exports` map, so the env root can override/add skills, flows, bundles,\n * and connector **manifests/metadata**, but cannot ship a new executable\n * connector — its `.js` is not on the package's import graph.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { lstat, stat } from \"node:fs/promises\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join, resolve as resolvePath } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { tryWithFsDeadline } from \"./fs-deadline.js\";\nimport { scanDirectory } from \"./manifest.js\";\nimport type { CatalogEntry } from \"./models.js\";\nimport { getGlobalCacheDir, readLinks, sourceCacheKey } from \"./repo-manager.js\";\nimport type { SourceDeclaration, SourceEntry } from \"./workspace-config.js\";\nimport { resolveSkWorkspaceConfig } from \"./workspace-config.js\";\n\n/**\n * Map declared `sources[]` to internal `SourceDeclaration`s keyed by the\n * collision-free {@link sourceCacheKey} (`<host>/<owner>/<repo>`), pointing at\n * the unified machine-cache clone path (`getGlobalCacheDir()/<key>/`). Keyed by\n * the same function every other cache writer/reader uses so the path resolves.\n */\nfunction sourcesToDeclarations(\n  sources: SourceEntry[] | undefined,\n): Record<string, SourceDeclaration> {\n  const sourcesDir = getGlobalCacheDir();\n  const out: Record<string, SourceDeclaration> = {};\n  for (const s of sources ?? []) {\n    const key = sourceCacheKey(s.url);\n    if (out[key]) continue;\n    out[key] = {\n      path: join(sourcesDir, key),\n      url: s.url,\n      branch: s.pin,\n      ...(s.publisher ? { publisher: s.publisher } : {}),\n    };\n  }\n  return out;\n}\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\n/**\n * Catalog entry filtered to mount/connector kinds. Same shape as `CatalogEntry`.\n * @docLink packages/core/concepts#runtime-catalog-entry\n */\nexport type RuntimeCatalogEntry = CatalogEntry;\n\n/**\n * Implicit catalog reference derived from a `connectors:` declaration in `skaile.yaml`.\n * Each connector driver becomes an implicit ref that must be resolved in the catalog.\n * @docLink packages/core/concepts#runtime-asset-ref\n */\nexport interface RuntimeAssetRef {\n  kind: \"connector\";\n  /** Driver name — matches `RuntimeCatalogEntry.name`. */\n  name: string;\n  /** Source declaration id from `skaile.yaml`. */\n  declarationId: string;\n}\n\n/**\n * Aggregated npm packages required by all resolved mount/connector adapters.\n * Populated from `metadata.npm_deps` in each matched catalog entry.\n * @docLink packages/core/concepts#runtime-npm-deps\n */\nexport interface RuntimeNpmDeps {\n  required: string[];\n  optional: string[];\n}\n\n/**\n * Non-fatal warning emitted during `resolveRuntimeAssets` when a repo is unavailable\n * or a driver is not found in any catalog.\n * @docLink packages/core/concepts#runtime-asset-warning\n */\nexport interface RuntimeAssetWarning {\n  /** Stable code for filtering / structured logging. */\n  code: \"missing_driver\" | \"repo_unavailable\" | \"invalid_repo_decl\";\n  message: string;\n  /** Declaration id when applicable. */\n  declarationId?: string;\n  /** Driver / repository name when applicable. */\n  name?: string;\n}\n\n/**\n * Repository name used for the implicit built-in `factory-assets` catalog entry\n * (the in-package connector tree).\n * @docLink packages/core/concepts#factory-assets-repo-name\n */\nexport const FACTORY_ASSETS_REPO_NAME = \"factory-assets\";\n\n/**\n * Repository name for the optional `SKAILE_FACTORY_ASSETS_DIR` override layer,\n * scanned ahead of (and overriding) the bundled {@link FACTORY_ASSETS_REPO_NAME}.\n */\nconst FACTORY_ASSETS_OVERRIDE_REPO_NAME = \"factory-assets:override\";\n\n/**\n * Result of `resolveRuntimeAssets`.\n * The same object is mutated in place by `refresh()`, allowing callers to hold\n * a stable reference and observe updates after a new repository is cloned or\n * a driver is installed mid-session.\n * @docLink packages/core/concepts#runtime-assets-result\n */\nexport interface RuntimeAssetsResult {\n  catalogEntries: RuntimeCatalogEntry[];\n  implicitRefs: RuntimeAssetRef[];\n  requiredNpmDeps: RuntimeNpmDeps;\n  warnings: RuntimeAssetWarning[];\n  /** Re-scan repositories and re-derive implicit refs. Mutates in place. */\n  refresh(): Promise<void>;\n  /**\n   * Catalog lookup. When `kind` is omitted and multiple entries share the\n   * `name`, returns `undefined` (caller must disambiguate).\n   */\n  findEntry(query: { kind?: \"connector\"; name: string }): RuntimeCatalogEntry | undefined;\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/**\n * Resolve all runtime assets visible to a project by scanning declared repositories.\n *\n * Reads `skaile.yaml`, scans every declared repository (plus the implicit\n * built-in `factory-assets` repo), and derives implicit refs from `mounts:` /\n * `connectors:` declarations. Does not clone or install anything — purely a\n * read-only scan of what is already on disk. URL-only repositories that have\n * not been cloned yet are reported as `repo_unavailable` warnings.\n *\n * @param projectDir - Absolute path to the project workspace root\n * @returns `RuntimeAssetsResult` with catalog entries, implicit refs, npm deps, and warnings\n * @docLink packages/core/concepts#resolve-runtime-assets\n */\nexport async function resolveRuntimeAssets(projectDir: string): Promise<RuntimeAssetsResult> {\n  const result: RuntimeAssetsResult = {\n    catalogEntries: [],\n    implicitRefs: [],\n    requiredNpmDeps: { required: [], optional: [] },\n    warnings: [],\n    refresh: async () => {\n      await populate(projectDir, result);\n    },\n    findEntry: (query) => findCatalogEntry(result.catalogEntries, query),\n  };\n\n  await populate(projectDir, result);\n  return result;\n}\n\n/**\n * Resolve the ordered list of on-disk roots for the built-in `factory-assets`\n * tree (built-in connectors + first-party skills + bundles). This is the single\n * shared resolver every consumer goes through, so the env override and the\n * bundled baseline are honoured uniformly.\n *\n * Order (env-first = override-wins):\n * 1. `SKAILE_FACTORY_ASSETS_DIR` env dir (legacy: `SKAILE_BASE_ASSETS_DIR`),\n *    when set and existing — an additive override layer.\n * 2. {@link resolvePackagedAssetsDir} — the bundled tree (in-repo source in dev,\n *    `dist/factory-assets/` after install). Always-present baseline.\n *\n * Returns `[]` only when the package cannot be located at all. De-duplicated, so\n * pointing the env var at the bundled dir collapses to one root.\n *\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function factoryAssetRoots(): string[] {\n  const roots: string[] = [];\n  const envDir = process.env.SKAILE_FACTORY_ASSETS_DIR ?? process.env.SKAILE_BASE_ASSETS_DIR;\n  // Deliberately still synchronous after #454: both candidates are\n  // container-local (the image's `/app/factory-assets/`, or the installed\n  // package tree resolved by `resolvePackagedAssetsDir`), never the FUSE\n  // workspace mount. The mount-reachable probes on this module's scan path —\n  // the project-relative `sources[].path` candidates in `resolveRepoDir` — are\n  // async and deadline-bounded.\n  if (envDir && existsSync(envDir)) roots.push(resolvePath(envDir));\n  const bundled = resolvePackagedAssetsDir(\"factory-assets\");\n  if (bundled) roots.push(bundled);\n  return [...new Set(roots)];\n}\n\n/**\n * Resolve the primary on-disk root of the `factory-assets` tree — the first of\n * {@link factoryAssetRoots} (the env override when set, else the bundled tree).\n * Prefer {@link factoryAssetRoots} when you need to scan every layer; this\n * single-dir form is for callers that want one canonical path.\n *\n * @returns Absolute path to the highest-precedence `factory-assets` directory\n * @throws When no root can be located\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function resolveFactoryAssetsRoot(): string {\n  const hit = resolveFactoryAssetsRootOrNull();\n  if (hit) return hit;\n\n  throw new Error(\n    `Cannot resolve the factory-assets directory. ` +\n      `Set SKAILE_FACTORY_ASSETS_DIR to the on-disk path, ` +\n      `ensure @skaile/workspaces is installed, ` +\n      `or run from within the @skaile/workspaces package tree.`,\n  );\n}\n\n/**\n * Non-throwing variant of {@link resolveFactoryAssetsRoot}: the same\n * env-then-packaged resolution tiers, returning `null` instead of throwing when\n * none locate the directory. Callers that treat a missing factory tree as a\n * soft \"not present\" (e.g. the asset-manager's implicit-source injection) MUST\n * use this so they honour the `SKAILE_FACTORY_ASSETS_DIR` container override\n * identically to the runtime path.\n */\nexport function resolveFactoryAssetsRootOrNull(): string | null {\n  return factoryAssetRoots()[0] ?? null;\n}\n\n/**\n * Resolve the `@skaile/workspaces` package root — the directory containing its\n * `package.json`. Tries `require.resolve` first (works when installed as a\n * dependency *and* in-repo via the self-reference), then walks upward from this\n * module looking for a `package.json` whose `name` is `@skaile/workspaces`\n * (bounded to 8 levels). Returns `null` when neither locates it.\n *\n * The single source of truth for finding content shipped inside the package —\n * the unified `factory-assets/` tree (built-in connectors + first-party skills\n * + bundles) resolves through {@link resolvePackagedAssetsDir} on top of this.\n *\n * Memoized: the package location is immutable for the process lifetime, but\n * this sits on the CLI hot path (every `findSkills` / flow / completion call\n * funnels through here), so the `require.resolve` + upward `package.json` walk\n * runs once. `undefined` = not yet computed.\n *\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nlet workspacesPackageRootCache: string | null | undefined;\n\nexport function resolveWorkspacesPackageRoot(): string | null {\n  if (workspacesPackageRootCache !== undefined) return workspacesPackageRootCache;\n  workspacesPackageRootCache = computeWorkspacesPackageRoot();\n  return workspacesPackageRootCache;\n}\n\nfunction computeWorkspacesPackageRoot(): string | null {\n  try {\n    const require = createRequire(import.meta.url);\n    return dirname(require.resolve(\"@skaile/workspaces/package.json\"));\n  } catch {\n    // Fall through to the workspace walk.\n  }\n  let dir: string;\n  try {\n    dir = dirname(fileURLToPath(import.meta.url));\n  } catch {\n    return null;\n  }\n  for (let i = 0; i < 8; i++) {\n    const pkgPath = join(dir, \"package.json\");\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, \"utf-8\")) as { name?: string };\n        if (pkg.name === \"@skaile/workspaces\") return dir;\n      } catch {\n        // Ignore malformed package.json and keep walking.\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Locate a content-asset directory inside the package. Prefers the in-repo\n * **source** dir `<pkgRoot>/<subdir>` when present — in a dev checkout it is the\n * full tree (e.g. `factory-assets/` keeps the connector `.ts` entry files that\n * `dist/` does not) — then the published `dist/<subdir>` copy (what\n * `files: [\"dist\"]` ships, the only one present after `npm i`). Returns `null`\n * when neither exists.\n *\n * `factory-assets/` resolves to the source tree in dev (code + skills + bundles)\n * and to `dist/factory-assets` post-install (compiled connectors + copied\n * manifests/skills/bundles).\n *\n * @param subdir - `\"factory-assets\"` | …\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function resolvePackagedAssetsDir(subdir: string): string | null {\n  const root = resolveWorkspacesPackageRoot();\n  if (!root) return null;\n  for (const cand of [join(root, subdir), join(root, \"dist\", subdir)]) {\n    if (existsSync(cand)) return cand;\n  }\n  return null;\n}\n\n// ─── Internals ────────────────────────────────────────────────────────────────\n\nconst CONNECTOR_SCAN_KINDS: ReadonlySet<string> = new Set([\"connector\"]);\n\nasync function populate(projectDir: string, target: RuntimeAssetsResult): Promise<void> {\n  target.catalogEntries = [];\n  target.implicitRefs = [];\n  target.requiredNpmDeps = { required: [], optional: [] };\n  target.warnings = [];\n\n  const config = resolveSkWorkspaceConfig(projectDir);\n  // Connector catalog scan runs over the project's declared sources[] (resolved\n  // to their machine-cache clone paths) plus the implicit factory-assets repo.\n  const repositories = buildEffectiveRepositories(sourcesToDeclarations(config.sources));\n  const links = readLinks(projectDir);\n\n  // Scan each repository for connector entries.\n  for (const [name, decl] of Object.entries(repositories)) {\n    const repoDir = await resolveRepoDir(name, decl, projectDir, links);\n    if (!repoDir) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: repoUnavailableMessage(name, decl),\n      });\n      continue;\n    }\n    try {\n      // Both factory layers carry the same `factory-assets` provenance — the\n      // override repo is an internal scan-order device, not a distinct source.\n      const repoName = name === FACTORY_ASSETS_OVERRIDE_REPO_NAME ? FACTORY_ASSETS_REPO_NAME : name;\n      // Only connector descriptors are consumed here, so only that kind is\n      // \"known\": typed manifests of any other kind are irrelevant to this scan.\n      const scanned = await scanDirectory(repoDir, repoName, {\n        knownKinds: CONNECTOR_SCAN_KINDS,\n        onDiagnostic: () => {},\n      });\n      const entries = scanned.filter((e) => e.kind === \"connector\");\n      target.catalogEntries.push(...entries);\n    } catch (err) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: `Failed to scan repository \"${name}\" at ${repoDir}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      });\n    }\n  }\n\n  // De-duplicate by (kind, name), keeping the first occurrence. Scan order is\n  // declared sources → env override → bundled baseline, so an env-supplied\n  // connector manifest overrides the bundled one and the bundled one fills the\n  // rest (the override layer can refresh built-in manifests in place).\n  const seen = new Set<string>();\n  target.catalogEntries = target.catalogEntries.filter((e) => {\n    const key = `${e.kind}:${e.name}`;\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n\n  // Derive implicit refs from skaile.yaml connectors.\n  for (const c of config.connectors ?? []) {\n    target.implicitRefs.push({ kind: \"connector\", name: c.driver, declarationId: c.id });\n  }\n\n  // Validate refs and aggregate npm deps.\n  const requiredSet = new Set<string>();\n  const optionalSet = new Set<string>();\n  for (const ref of target.implicitRefs) {\n    const entry = findCatalogEntry(target.catalogEntries, ref);\n    if (!entry) {\n      target.warnings.push({\n        code: \"missing_driver\",\n        declarationId: ref.declarationId,\n        name: ref.name,\n        message:\n          `Unknown ${ref.kind} driver \"${ref.name}\" referenced by ${ref.kind} \"${ref.declarationId}\". ` +\n          `Run \\`skaile ${ref.kind} catalog\\` to see available drivers, ` +\n          `or declare a repository in skaile.yaml that provides this driver.`,\n      });\n      continue;\n    }\n    const npm = (entry.metadata?.npm_deps ?? {}) as { required?: string[]; optional?: string[] };\n    for (const p of npm.required ?? []) requiredSet.add(p);\n    for (const p of npm.optional ?? []) optionalSet.add(p);\n  }\n  target.requiredNpmDeps.required = [...requiredSet];\n  target.requiredNpmDeps.optional = [...optionalSet];\n}\n\n/**\n * Build the effective `repositories` map: caller's declarations first, then the\n * implicit built-in `factory-assets` repos. Each {@link factoryAssetRoots} layer\n * becomes its own repo, the env override inserted **before** the bundled\n * baseline so its connector entries win on the first-match dedup downstream.\n * When the package cannot be located at all, a path-less sentinel under\n * {@link FACTORY_ASSETS_REPO_NAME} drives the `repo_unavailable` warning.\n */\nfunction buildEffectiveRepositories(\n  declared: Record<string, SourceDeclaration> | undefined,\n): Record<string, SourceDeclaration> {\n  const result: Record<string, SourceDeclaration> = { ...(declared ?? {}) };\n  const roots = factoryAssetRoots();\n  if (roots.length === 0) {\n    // Surface as a warning during scan rather than throwing here — let the\n    // caller decide whether factory-assets is required. resolveRepoDir() /\n    // repoUnavailableMessage re-discover the failure and emit it.\n    if (!result[FACTORY_ASSETS_REPO_NAME]) result[FACTORY_ASSETS_REPO_NAME] = { path: \"\" };\n    return result;\n  }\n  // override-first when both layers exist, so the env root's entries are scanned\n  // (and matched) ahead of the bundled baseline.\n  const keys =\n    roots.length > 1\n      ? [FACTORY_ASSETS_OVERRIDE_REPO_NAME, FACTORY_ASSETS_REPO_NAME]\n      : [FACTORY_ASSETS_REPO_NAME];\n  roots.forEach((dir, i) => {\n    const key = keys[i] ?? `${FACTORY_ASSETS_REPO_NAME}:${i}`;\n    if (!result[key]) result[key] = { path: dir };\n  });\n  return result;\n}\n\n/**\n * Resolve a repository declaration to an on-disk directory. Order:\n *   1. Linked override (`.skaile/links.yaml`).\n *   2. Local `path` — relative to `projectDir`.\n *   3. Cloned URL repo at `.skaile/cache/sources/<name>/` (must already exist).\n *\n * Returns `null` when none of these resolve. Does not clone.\n *\n * **Async and deadline-bounded since #454.** Every candidate here is a\n * project-relative or operator-supplied path, so a `sources[].path` of\n * `workspace/my-assets` resolves onto the rclone FUSE mount — the same tree the\n * scan that follows walks. Probing it with `existsSync`/`lstatSync` would park\n * the `skaile serve` event loop *before* the (now async) scan ever ran, which\n * would leave the H2 fix meaningless on the very declaration that triggers it.\n * A probe that misses its deadline reads as \"unavailable\", which is what the\n * caller already does with an absent path — it becomes a `repo_unavailable`\n * warning rather than a stall.\n */\nasync function resolveRepoDir(\n  name: string,\n  decl: SourceDeclaration,\n  projectDir: string,\n  links: Record<string, string>,\n): Promise<string | null> {\n  // 1. Linked override\n  const linked = links[name];\n  if (linked && (await pathExists(linked))) return linked;\n\n  // 2. Local path\n  if (decl.path) {\n    const resolved = resolvePath(projectDir, decl.path);\n    return (await pathExists(resolved)) ? resolved : null;\n  }\n\n  // 3. URL repo cloned to project's .skaile/cache/sources/<name> — the\n  //    project-local clone dir (often a symlink into the global cache, which\n  //    lives at getGlobalCacheDir()); NOT the global clone root itself.\n  if (decl.url) {\n    const projectDest = join(projectDir, \".skaile\", \"cache\", \"sources\", name);\n    // One `lstat` answers both questions the pre-#454 `existsSync` + `lstatSync`\n    // pair asked, and `lstat` (not `stat`) keeps the \"a symlink into the global\n    // cache counts\" behaviour intact.\n    const found = await tryWithFsDeadline(\n      `lstat ${projectDest}`,\n      async () => {\n        await lstat(projectDest);\n        return true;\n      },\n      false,\n    );\n    return found ? projectDest : null;\n  }\n\n  return null;\n}\n\n/** Deadline-bounded `existsSync` replacement — a wedged mount reads as absent. */\nfunction pathExists(path: string): Promise<boolean> {\n  return tryWithFsDeadline(\n    `stat ${path}`,\n    async () => {\n      await stat(path);\n      return true;\n    },\n    false,\n  );\n}\n\nfunction repoUnavailableMessage(name: string, decl: SourceDeclaration): string {\n  if (name === FACTORY_ASSETS_REPO_NAME && !decl.path && !decl.url) {\n    return (\n      `Cannot resolve the built-in factory-assets. ` +\n      `Set SKAILE_FACTORY_ASSETS_DIR or ensure @skaile/workspaces is installed.`\n    );\n  }\n  if (decl.url) {\n    return `Repository \"${name}\" (${decl.url}) is not available. Register it as a Library Source via \\`skaile source add\\`.`;\n  }\n  if (decl.path) {\n    return `Repository \"${name}\" path not found: ${decl.path}`;\n  }\n  return `Repository \"${name}\" has neither url nor path.`;\n}\n\nfunction findCatalogEntry(\n  entries: RuntimeCatalogEntry[],\n  query: { kind?: \"connector\"; name: string },\n): RuntimeCatalogEntry | undefined {\n  if (query.kind) {\n    return entries.find((e) => e.kind === query.kind && e.name === query.name);\n  }\n  const matches = entries.filter((e) => e.name === query.name);\n  if (matches.length === 1) return matches[0];\n  // 0 or >1 with no kind — caller must disambiguate.\n  return undefined;\n}\n"]}
+{"version":3,"sources":["../core/src/runtime-assets.ts"],"names":["resolvePath","require"],"mappings":";;;;;;;;AAsDA,SAAS,sBACP,OAAA,EACmC;AACnC,EAAA,MAAM,aAAa,iBAAA,EAAkB;AACrC,EAAA,MAAM,MAAyC,EAAC;AAChD,EAAA,KAAA,MAAW,CAAA,IAAK,OAAA,IAAW,EAAC,EAAG;AAC7B,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,CAAA,CAAE,GAAG,CAAA;AAChC,IAAA,IAAI,GAAA,CAAI,GAAG,CAAA,EAAG;AACd,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI;AAAA,MACT,IAAA,EAAM,IAAA,CAAK,UAAA,EAAY,GAAG,CAAA;AAAA,MAC1B,KAAK,CAAA,CAAE,GAAA;AAAA,MACP,QAAQ,CAAA,CAAE,GAAA;AAAA,MACV,GAAI,EAAE,SAAA,GAAY,EAAE,WAAW,CAAA,CAAE,SAAA,KAAc;AAAC,KAClD;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAqDO,IAAM,wBAAA,GAA2B;AAMxC,IAAM,iCAAA,GAAoC,yBAAA;AAsC1C,eAAsB,qBAAqB,UAAA,EAAkD;AAC3F,EAAA,MAAM,MAAA,GAA8B;AAAA,IAClC,gBAAgB,EAAC;AAAA,IACjB,cAAc,EAAC;AAAA,IACf,iBAAiB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,IAC9C,UAAU,EAAC;AAAA,IACX,SAAS,YAAY;AACnB,MAAA,MAAM,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,WAAW,CAAC,KAAA,KAAU,gBAAA,CAAiB,MAAA,CAAO,gBAAgB,KAAK;AAAA,GACrE;AAEA,EAAA,MAAM,QAAA,CAAS,YAAY,MAAM,CAAA;AACjC,EAAA,OAAO,MAAA;AACT;AAmBO,SAAS,iBAAA,GAA8B;AAC5C,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,QAAQ,GAAA,CAAI,sBAAA;AAOpE,EAAA,IAAI,MAAA,IAAU,WAAW,MAAM,CAAA,QAAS,IAAA,CAAKA,OAAA,CAAY,MAAM,CAAC,CAAA;AAChE,EAAA,MAAM,OAAA,GAAU,yBAAyB,gBAAgB,CAAA;AACzD,EAAA,IAAI,OAAA,EAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAC/B,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,KAAK,CAAC,CAAA;AAC3B;AAYO,SAAS,wBAAA,GAAmC;AACjD,EAAA,MAAM,MAAM,8BAAA,EAA+B;AAC3C,EAAA,IAAI,KAAK,OAAO,GAAA;AAEhB,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,+LAAA;AAAA,GAIF;AACF;AAUO,SAAS,8BAAA,GAAgD;AAC9D,EAAA,OAAO,iBAAA,EAAkB,CAAE,CAAC,CAAA,IAAK,IAAA;AACnC;AAoBA,IAAI,0BAAA;AAEG,SAAS,4BAAA,GAA8C;AAC5D,EAAA,IAAI,0BAAA,KAA+B,QAAW,OAAO,0BAAA;AACrD,EAAA,0BAAA,GAA6B,4BAAA,EAA6B;AAC1D,EAAA,OAAO,0BAAA;AACT;AAEA,SAAS,4BAAA,GAA8C;AACrD,EAAA,IAAI;AACF,IAAA,MAAMC,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAC7C,IAAA,OAAO,OAAA,CAAQA,QAAAA,CAAQ,OAAA,CAAQ,iCAAiC,CAAC,CAAA;AAAA,EACnE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACxC,IAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,OAAA,EAAS,OAAO,CAAC,CAAA;AACrD,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,oBAAA,EAAsB,OAAO,GAAA;AAAA,MAChD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,QAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAiBO,SAAS,yBAAyB,MAAA,EAA+B;AACtE,EAAA,MAAM,OAAO,4BAAA,EAA6B;AAC1C,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAC,CAAA,EAAG;AACnE,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,IAAA;AAAA,EAC/B;AACA,EAAA,OAAO,IAAA;AACT;AAIA,IAAM,oBAAA,mBAA4C,IAAI,GAAA,CAAI,CAAC,WAAW,CAAC,CAAA;AAEvE,eAAe,QAAA,CAAS,YAAoB,MAAA,EAA4C;AACtF,EAAA,MAAA,CAAO,iBAAiB,EAAC;AACzB,EAAA,MAAA,CAAO,eAAe,EAAC;AACvB,EAAA,MAAA,CAAO,kBAAkB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AACtD,EAAA,MAAA,CAAO,WAAW,EAAC;AAEnB,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,MAAM,YAAA,GAAe,0BAAA,CAA2B,qBAAA,CAAsB,MAAA,CAAO,OAAO,CAAC,CAAA;AACrF,EAAA,MAAM,KAAA,GAAQ,UAAU,UAAU,CAAA;AAGlC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,IAAA,MAAM,UAAU,MAAM,cAAA,CAAe,IAAA,EAAM,IAAA,EAAM,YAAY,KAAK,CAAA;AAClE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,sBAAA,CAAuB,IAAA,EAAM,IAAI;AAAA,OAC3C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AAGF,MAAA,MAAM,QAAA,GAAW,IAAA,KAAS,iCAAA,GAAoC,wBAAA,GAA2B,IAAA;AAGzF,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,OAAA,EAAS,QAAA,EAAU;AAAA,QACrD,UAAA,EAAY,oBAAA;AAAA,QACZ,cAAc,MAAM;AAAA,QAAC;AAAA,OACtB,CAAA;AACD,MAAA,MAAM,UAAU,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,WAAW,CAAA;AAC5D,MAAA,MAAA,CAAO,cAAA,CAAe,IAAA,CAAK,GAAG,OAAO,CAAA;AAAA,IACvC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,CAAA,2BAAA,EAA8B,IAAI,CAAA,KAAA,EAAQ,OAAO,CAAA,EAAA,EACxD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF;AAMA,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAA,CAAO,cAAA,GAAiB,MAAA,CAAO,cAAA,CAAe,MAAA,CAAO,CAAC,CAAA,KAAM;AAC1D,IAAA,MAAM,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,CAAA;AAC/B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,KAAA;AAC1B,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AAGD,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,UAAA,IAAc,EAAC,EAAG;AACvC,IAAA,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,CAAA,CAAE,MAAA,EAAQ,aAAA,EAAe,CAAA,CAAE,EAAA,EAAI,CAAA;AAAA,EACrF;AAGA,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,KAAA,MAAW,GAAA,IAAO,OAAO,YAAA,EAAc;AACrC,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,MAAA,CAAO,cAAA,EAAgB,GAAG,CAAA;AACzD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,gBAAA;AAAA,QACN,eAAe,GAAA,CAAI,aAAA;AAAA,QACnB,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,OAAA,EACE,CAAA,QAAA,EAAW,GAAA,CAAI,IAAI,YAAY,GAAA,CAAI,IAAI,CAAA,gBAAA,EAAmB,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,aAAa,CAAA,gBAAA,EACxE,IAAI,IAAI,CAAA,sGAAA;AAAA,OAE3B,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAO,KAAA,CAAM,QAAA,EAAU,QAAA,IAAY,EAAC;AAC1C,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AACrD,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EACvD;AACA,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACjD,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACnD;AAUA,SAAS,2BACP,QAAA,EACmC;AACnC,EAAA,MAAM,MAAA,GAA4C,EAAE,GAAI,QAAA,IAAY,EAAC,EAAG;AACxE,EAAA,MAAM,QAAQ,iBAAA,EAAkB;AAChC,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AAItB,IAAA,IAAI,CAAC,OAAO,wBAAwB,CAAA,SAAU,wBAAwB,CAAA,GAAI,EAAE,IAAA,EAAM,EAAA,EAAG;AACrF,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,IAAA,GACJ,MAAM,MAAA,GAAS,CAAA,GACX,CAAC,iCAAA,EAAmC,wBAAwB,CAAA,GAC5D,CAAC,wBAAwB,CAAA;AAC/B,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AACxB,IAAA,MAAM,MAAM,IAAA,CAAK,CAAC,KAAK,CAAA,EAAG,wBAAwB,IAAI,CAAC,CAAA,CAAA;AACvD,IAAA,IAAI,CAAC,OAAO,GAAG,CAAA,SAAU,GAAG,CAAA,GAAI,EAAE,IAAA,EAAM,GAAA,EAAI;AAAA,EAC9C,CAAC,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAoBA,eAAe,cAAA,CACb,IAAA,EACA,IAAA,EACA,UAAA,EACA,KAAA,EACwB;AAExB,EAAA,MAAM,MAAA,GAAS,MAAM,IAAI,CAAA;AACzB,EAAA,IAAI,MAAA,IAAW,MAAM,UAAA,CAAW,MAAM,GAAI,OAAO,MAAA;AAGjD,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,MAAM,QAAA,GAAWD,OAAA,CAAY,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAClD,IAAA,OAAQ,MAAM,UAAA,CAAW,QAAQ,CAAA,GAAK,QAAA,GAAW,IAAA;AAAA,EACnD;AAKA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,MAAM,cAAc,IAAA,CAAK,UAAA,EAAY,SAAA,EAAW,OAAA,EAAS,WAAW,IAAI,CAAA;AAIxE,IAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,MAClB,SAAS,WAAW,CAAA,CAAA;AAAA,MACpB,YAAY;AACV,QAAA,MAAM,MAAM,WAAW,CAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACT,CAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,QAAQ,WAAA,GAAc,IAAA;AAAA,EAC/B;AAEA,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAW,IAAA,EAAgC;AAClD,EAAA,OAAO,iBAAA;AAAA,IACL,QAAQ,IAAI,CAAA,CAAA;AAAA,IACZ,YAAY;AACV,MAAA,MAAM,KAAK,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,sBAAA,CAAuB,MAAc,IAAA,EAAiC;AAC7E,EAAA,IAAI,SAAS,wBAAA,IAA4B,CAAC,KAAK,IAAA,IAAQ,CAAC,KAAK,GAAA,EAAK;AAChE,IAAA,OACE,CAAA,oHAAA,CAAA;AAAA,EAGJ;AACA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,GAAA,EAAM,IAAA,CAAK,GAAG,CAAA,8EAAA,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,kBAAA,EAAqB,IAAA,CAAK,IAAI,CAAA,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,eAAe,IAAI,CAAA,2BAAA,CAAA;AAC5B;AAEA,SAAS,gBAAA,CACP,SACA,KAAA,EACiC;AACjC,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAI,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,MAAM,IAAI,CAAA;AAC3D,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,QAAQ,CAAC,CAAA;AAE1C,EAAA,OAAO,MAAA;AACT","file":"chunk-TIIXG3PN.js","sourcesContent":["/**\n * Runtime asset resolution — read `skaile.yaml`, scan all declared repositories\n * (including the built-in `factory-assets/` directory as an implicit default),\n * and produce a unified view of connector catalog entries plus the implicit refs\n * that the `skaile.yaml` `connectors:` section adds to the dependency graph.\n *\n * This module is the single source of truth for \"which connectors does this\n * project see at runtime, and where do their implementations live on disk\".\n * Both the runner (serve, REPL, flow) and the platform's mid-session\n * `add_resource` flow consume `RuntimeAssetsResult.catalogEntries` and pass\n * it into `ConnectorManager` for catalog-based resolution.\n *\n * `factory-assets/` is the single first-party content tree (built-in connectors\n * + first-party skills + bundles) shipped inside the `@skaile/workspaces`\n * package — not a standalone package.\n *\n * It resolves to an **ordered list of roots** ({@link factoryAssetRoots}), not a\n * single dir. The bundled tree is always the baseline; an optional\n * `SKAILE_FACTORY_ASSETS_DIR` (legacy: `SKAILE_BASE_ASSETS_DIR`) is layered\n * **in front** as an additive override source — the agent container points it at\n * `/app/factory-assets/` (or a bind-mounted host dir) to ship updated skills /\n * flows / bundles / connector manifests without rebuilding the image. The two\n * roots resolve uniformly across every consumer (connector catalog scan, skill /\n * flow / completion discovery, the asset-manager factory source):\n *   1. `SKAILE_FACTORY_ASSETS_DIR` env dir, when set and existing (override layer).\n *   2. the bundled tree via {@link resolvePackagedAssetsDir} — the in-repo source\n *      `packages/workspaces/factory-assets/` during dev, else the published\n *      `dist/factory-assets/` after install (always-present baseline).\n *\n * Override semantics are **env-first**: on a name conflict the env root wins and\n * the bundled root fills the rest. Connector *code* still loads via the package's\n * static `exports` map, so the env root can override/add skills, flows, bundles,\n * and connector **manifests/metadata**, but cannot ship a new executable\n * connector — its `.js` is not on the package's import graph.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { lstat, stat } from \"node:fs/promises\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join, resolve as resolvePath } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { tryWithFsDeadline } from \"./fs-deadline.js\";\nimport { scanDirectory } from \"./manifest.js\";\nimport type { CatalogEntry } from \"./models.js\";\nimport { getGlobalCacheDir, readLinks, sourceCacheKey } from \"./repo-manager.js\";\nimport type { SourceDeclaration, SourceEntry } from \"./workspace-config.js\";\nimport { resolveSkWorkspaceConfig } from \"./workspace-config.js\";\n\n/**\n * Map declared `sources[]` to internal `SourceDeclaration`s keyed by the\n * collision-free {@link sourceCacheKey} (`<host>/<owner>/<repo>`), pointing at\n * the unified machine-cache clone path (`getGlobalCacheDir()/<key>/`). Keyed by\n * the same function every other cache writer/reader uses so the path resolves.\n */\nfunction sourcesToDeclarations(\n  sources: SourceEntry[] | undefined,\n): Record<string, SourceDeclaration> {\n  const sourcesDir = getGlobalCacheDir();\n  const out: Record<string, SourceDeclaration> = {};\n  for (const s of sources ?? []) {\n    const key = sourceCacheKey(s.url);\n    if (out[key]) continue;\n    out[key] = {\n      path: join(sourcesDir, key),\n      url: s.url,\n      branch: s.pin,\n      ...(s.publisher ? { publisher: s.publisher } : {}),\n    };\n  }\n  return out;\n}\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\n/**\n * Catalog entry filtered to mount/connector kinds. Same shape as `CatalogEntry`.\n * @docLink packages/core/concepts#runtime-catalog-entry\n */\nexport type RuntimeCatalogEntry = CatalogEntry;\n\n/**\n * Implicit catalog reference derived from a `connectors:` declaration in `skaile.yaml`.\n * Each connector driver becomes an implicit ref that must be resolved in the catalog.\n * @docLink packages/core/concepts#runtime-asset-ref\n */\nexport interface RuntimeAssetRef {\n  kind: \"connector\";\n  /** Driver name — matches `RuntimeCatalogEntry.name`. */\n  name: string;\n  /** Source declaration id from `skaile.yaml`. */\n  declarationId: string;\n}\n\n/**\n * Aggregated npm packages required by all resolved mount/connector adapters.\n * Populated from `metadata.npm_deps` in each matched catalog entry.\n * @docLink packages/core/concepts#runtime-npm-deps\n */\nexport interface RuntimeNpmDeps {\n  required: string[];\n  optional: string[];\n}\n\n/**\n * Non-fatal warning emitted during `resolveRuntimeAssets` when a repo is unavailable\n * or a driver is not found in any catalog.\n * @docLink packages/core/concepts#runtime-asset-warning\n */\nexport interface RuntimeAssetWarning {\n  /** Stable code for filtering / structured logging. */\n  code: \"missing_driver\" | \"repo_unavailable\" | \"invalid_repo_decl\";\n  message: string;\n  /** Declaration id when applicable. */\n  declarationId?: string;\n  /** Driver / repository name when applicable. */\n  name?: string;\n}\n\n/**\n * Repository name used for the implicit built-in `factory-assets` catalog entry\n * (the in-package connector tree).\n * @docLink packages/core/concepts#factory-assets-repo-name\n */\nexport const FACTORY_ASSETS_REPO_NAME = \"factory-assets\";\n\n/**\n * Repository name for the optional `SKAILE_FACTORY_ASSETS_DIR` override layer,\n * scanned ahead of (and overriding) the bundled {@link FACTORY_ASSETS_REPO_NAME}.\n */\nconst FACTORY_ASSETS_OVERRIDE_REPO_NAME = \"factory-assets:override\";\n\n/**\n * Result of `resolveRuntimeAssets`.\n * The same object is mutated in place by `refresh()`, allowing callers to hold\n * a stable reference and observe updates after a new repository is cloned or\n * a driver is installed mid-session.\n * @docLink packages/core/concepts#runtime-assets-result\n */\nexport interface RuntimeAssetsResult {\n  catalogEntries: RuntimeCatalogEntry[];\n  implicitRefs: RuntimeAssetRef[];\n  requiredNpmDeps: RuntimeNpmDeps;\n  warnings: RuntimeAssetWarning[];\n  /** Re-scan repositories and re-derive implicit refs. Mutates in place. */\n  refresh(): Promise<void>;\n  /**\n   * Catalog lookup. When `kind` is omitted and multiple entries share the\n   * `name`, returns `undefined` (caller must disambiguate).\n   */\n  findEntry(query: { kind?: \"connector\"; name: string }): RuntimeCatalogEntry | undefined;\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/**\n * Resolve all runtime assets visible to a project by scanning declared repositories.\n *\n * Reads `skaile.yaml`, scans every declared repository (plus the implicit\n * built-in `factory-assets` repo), and derives implicit refs from `mounts:` /\n * `connectors:` declarations. Does not clone or install anything — purely a\n * read-only scan of what is already on disk. URL-only repositories that have\n * not been cloned yet are reported as `repo_unavailable` warnings.\n *\n * @param projectDir - Absolute path to the project workspace root\n * @returns `RuntimeAssetsResult` with catalog entries, implicit refs, npm deps, and warnings\n * @docLink packages/core/concepts#resolve-runtime-assets\n */\nexport async function resolveRuntimeAssets(projectDir: string): Promise<RuntimeAssetsResult> {\n  const result: RuntimeAssetsResult = {\n    catalogEntries: [],\n    implicitRefs: [],\n    requiredNpmDeps: { required: [], optional: [] },\n    warnings: [],\n    refresh: async () => {\n      await populate(projectDir, result);\n    },\n    findEntry: (query) => findCatalogEntry(result.catalogEntries, query),\n  };\n\n  await populate(projectDir, result);\n  return result;\n}\n\n/**\n * Resolve the ordered list of on-disk roots for the built-in `factory-assets`\n * tree (built-in connectors + first-party skills + bundles). This is the single\n * shared resolver every consumer goes through, so the env override and the\n * bundled baseline are honoured uniformly.\n *\n * Order (env-first = override-wins):\n * 1. `SKAILE_FACTORY_ASSETS_DIR` env dir (legacy: `SKAILE_BASE_ASSETS_DIR`),\n *    when set and existing — an additive override layer.\n * 2. {@link resolvePackagedAssetsDir} — the bundled tree (in-repo source in dev,\n *    `dist/factory-assets/` after install). Always-present baseline.\n *\n * Returns `[]` only when the package cannot be located at all. De-duplicated, so\n * pointing the env var at the bundled dir collapses to one root.\n *\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function factoryAssetRoots(): string[] {\n  const roots: string[] = [];\n  const envDir = process.env.SKAILE_FACTORY_ASSETS_DIR ?? process.env.SKAILE_BASE_ASSETS_DIR;\n  // Deliberately still synchronous after #454: both candidates are\n  // container-local (the image's `/app/factory-assets/`, or the installed\n  // package tree resolved by `resolvePackagedAssetsDir`), never the FUSE\n  // workspace mount. The mount-reachable probes on this module's scan path —\n  // the project-relative `sources[].path` candidates in `resolveRepoDir` — are\n  // async and deadline-bounded.\n  if (envDir && existsSync(envDir)) roots.push(resolvePath(envDir));\n  const bundled = resolvePackagedAssetsDir(\"factory-assets\");\n  if (bundled) roots.push(bundled);\n  return [...new Set(roots)];\n}\n\n/**\n * Resolve the primary on-disk root of the `factory-assets` tree — the first of\n * {@link factoryAssetRoots} (the env override when set, else the bundled tree).\n * Prefer {@link factoryAssetRoots} when you need to scan every layer; this\n * single-dir form is for callers that want one canonical path.\n *\n * @returns Absolute path to the highest-precedence `factory-assets` directory\n * @throws When no root can be located\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function resolveFactoryAssetsRoot(): string {\n  const hit = resolveFactoryAssetsRootOrNull();\n  if (hit) return hit;\n\n  throw new Error(\n    `Cannot resolve the factory-assets directory. ` +\n      `Set SKAILE_FACTORY_ASSETS_DIR to the on-disk path, ` +\n      `ensure @skaile/workspaces is installed, ` +\n      `or run from within the @skaile/workspaces package tree.`,\n  );\n}\n\n/**\n * Non-throwing variant of {@link resolveFactoryAssetsRoot}: the same\n * env-then-packaged resolution tiers, returning `null` instead of throwing when\n * none locate the directory. Callers that treat a missing factory tree as a\n * soft \"not present\" (e.g. the asset-manager's implicit-source injection) MUST\n * use this so they honour the `SKAILE_FACTORY_ASSETS_DIR` container override\n * identically to the runtime path.\n */\nexport function resolveFactoryAssetsRootOrNull(): string | null {\n  return factoryAssetRoots()[0] ?? null;\n}\n\n/**\n * Resolve the `@skaile/workspaces` package root — the directory containing its\n * `package.json`. Tries `require.resolve` first (works when installed as a\n * dependency *and* in-repo via the self-reference), then walks upward from this\n * module looking for a `package.json` whose `name` is `@skaile/workspaces`\n * (bounded to 8 levels). Returns `null` when neither locates it.\n *\n * The single source of truth for finding content shipped inside the package —\n * the unified `factory-assets/` tree (built-in connectors + first-party skills\n * + bundles) resolves through {@link resolvePackagedAssetsDir} on top of this.\n *\n * Memoized: the package location is immutable for the process lifetime, but\n * this sits on the CLI hot path (every `findSkills` / flow / completion call\n * funnels through here), so the `require.resolve` + upward `package.json` walk\n * runs once. `undefined` = not yet computed.\n *\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nlet workspacesPackageRootCache: string | null | undefined;\n\nexport function resolveWorkspacesPackageRoot(): string | null {\n  if (workspacesPackageRootCache !== undefined) return workspacesPackageRootCache;\n  workspacesPackageRootCache = computeWorkspacesPackageRoot();\n  return workspacesPackageRootCache;\n}\n\nfunction computeWorkspacesPackageRoot(): string | null {\n  try {\n    const require = createRequire(import.meta.url);\n    return dirname(require.resolve(\"@skaile/workspaces/package.json\"));\n  } catch {\n    // Fall through to the workspace walk.\n  }\n  let dir: string;\n  try {\n    dir = dirname(fileURLToPath(import.meta.url));\n  } catch {\n    return null;\n  }\n  for (let i = 0; i < 8; i++) {\n    const pkgPath = join(dir, \"package.json\");\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, \"utf-8\")) as { name?: string };\n        if (pkg.name === \"@skaile/workspaces\") return dir;\n      } catch {\n        // Ignore malformed package.json and keep walking.\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Locate a content-asset directory inside the package. Prefers the in-repo\n * **source** dir `<pkgRoot>/<subdir>` when present — in a dev checkout it is the\n * full tree (e.g. `factory-assets/` keeps the connector `.ts` entry files that\n * `dist/` does not) — then the published `dist/<subdir>` copy (what\n * `files: [\"dist\"]` ships, the only one present after `npm i`). Returns `null`\n * when neither exists.\n *\n * `factory-assets/` resolves to the source tree in dev (code + skills + bundles)\n * and to `dist/factory-assets` post-install (compiled connectors + copied\n * manifests/skills/bundles).\n *\n * @param subdir - `\"factory-assets\"` | …\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function resolvePackagedAssetsDir(subdir: string): string | null {\n  const root = resolveWorkspacesPackageRoot();\n  if (!root) return null;\n  for (const cand of [join(root, subdir), join(root, \"dist\", subdir)]) {\n    if (existsSync(cand)) return cand;\n  }\n  return null;\n}\n\n// ─── Internals ────────────────────────────────────────────────────────────────\n\nconst CONNECTOR_SCAN_KINDS: ReadonlySet<string> = new Set([\"connector\"]);\n\nasync function populate(projectDir: string, target: RuntimeAssetsResult): Promise<void> {\n  target.catalogEntries = [];\n  target.implicitRefs = [];\n  target.requiredNpmDeps = { required: [], optional: [] };\n  target.warnings = [];\n\n  const config = resolveSkWorkspaceConfig(projectDir);\n  // Connector catalog scan runs over the project's declared sources[] (resolved\n  // to their machine-cache clone paths) plus the implicit factory-assets repo.\n  const repositories = buildEffectiveRepositories(sourcesToDeclarations(config.sources));\n  const links = readLinks(projectDir);\n\n  // Scan each repository for connector entries.\n  for (const [name, decl] of Object.entries(repositories)) {\n    const repoDir = await resolveRepoDir(name, decl, projectDir, links);\n    if (!repoDir) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: repoUnavailableMessage(name, decl),\n      });\n      continue;\n    }\n    try {\n      // Both factory layers carry the same `factory-assets` provenance — the\n      // override repo is an internal scan-order device, not a distinct source.\n      const repoName = name === FACTORY_ASSETS_OVERRIDE_REPO_NAME ? FACTORY_ASSETS_REPO_NAME : name;\n      // Only connector descriptors are consumed here, so only that kind is\n      // \"known\": typed manifests of any other kind are irrelevant to this scan.\n      const scanned = await scanDirectory(repoDir, repoName, {\n        knownKinds: CONNECTOR_SCAN_KINDS,\n        onDiagnostic: () => {},\n      });\n      const entries = scanned.filter((e) => e.kind === \"connector\");\n      target.catalogEntries.push(...entries);\n    } catch (err) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: `Failed to scan repository \"${name}\" at ${repoDir}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      });\n    }\n  }\n\n  // De-duplicate by (kind, name), keeping the first occurrence. Scan order is\n  // declared sources → env override → bundled baseline, so an env-supplied\n  // connector manifest overrides the bundled one and the bundled one fills the\n  // rest (the override layer can refresh built-in manifests in place).\n  const seen = new Set<string>();\n  target.catalogEntries = target.catalogEntries.filter((e) => {\n    const key = `${e.kind}:${e.name}`;\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n\n  // Derive implicit refs from skaile.yaml connectors.\n  for (const c of config.connectors ?? []) {\n    target.implicitRefs.push({ kind: \"connector\", name: c.driver, declarationId: c.id });\n  }\n\n  // Validate refs and aggregate npm deps.\n  const requiredSet = new Set<string>();\n  const optionalSet = new Set<string>();\n  for (const ref of target.implicitRefs) {\n    const entry = findCatalogEntry(target.catalogEntries, ref);\n    if (!entry) {\n      target.warnings.push({\n        code: \"missing_driver\",\n        declarationId: ref.declarationId,\n        name: ref.name,\n        message:\n          `Unknown ${ref.kind} driver \"${ref.name}\" referenced by ${ref.kind} \"${ref.declarationId}\". ` +\n          `Run \\`skaile ${ref.kind} catalog\\` to see available drivers, ` +\n          `or declare a repository in skaile.yaml that provides this driver.`,\n      });\n      continue;\n    }\n    const npm = (entry.metadata?.npm_deps ?? {}) as { required?: string[]; optional?: string[] };\n    for (const p of npm.required ?? []) requiredSet.add(p);\n    for (const p of npm.optional ?? []) optionalSet.add(p);\n  }\n  target.requiredNpmDeps.required = [...requiredSet];\n  target.requiredNpmDeps.optional = [...optionalSet];\n}\n\n/**\n * Build the effective `repositories` map: caller's declarations first, then the\n * implicit built-in `factory-assets` repos. Each {@link factoryAssetRoots} layer\n * becomes its own repo, the env override inserted **before** the bundled\n * baseline so its connector entries win on the first-match dedup downstream.\n * When the package cannot be located at all, a path-less sentinel under\n * {@link FACTORY_ASSETS_REPO_NAME} drives the `repo_unavailable` warning.\n */\nfunction buildEffectiveRepositories(\n  declared: Record<string, SourceDeclaration> | undefined,\n): Record<string, SourceDeclaration> {\n  const result: Record<string, SourceDeclaration> = { ...(declared ?? {}) };\n  const roots = factoryAssetRoots();\n  if (roots.length === 0) {\n    // Surface as a warning during scan rather than throwing here — let the\n    // caller decide whether factory-assets is required. resolveRepoDir() /\n    // repoUnavailableMessage re-discover the failure and emit it.\n    if (!result[FACTORY_ASSETS_REPO_NAME]) result[FACTORY_ASSETS_REPO_NAME] = { path: \"\" };\n    return result;\n  }\n  // override-first when both layers exist, so the env root's entries are scanned\n  // (and matched) ahead of the bundled baseline.\n  const keys =\n    roots.length > 1\n      ? [FACTORY_ASSETS_OVERRIDE_REPO_NAME, FACTORY_ASSETS_REPO_NAME]\n      : [FACTORY_ASSETS_REPO_NAME];\n  roots.forEach((dir, i) => {\n    const key = keys[i] ?? `${FACTORY_ASSETS_REPO_NAME}:${i}`;\n    if (!result[key]) result[key] = { path: dir };\n  });\n  return result;\n}\n\n/**\n * Resolve a repository declaration to an on-disk directory. Order:\n *   1. Linked override (`.skaile/links.yaml`).\n *   2. Local `path` — relative to `projectDir`.\n *   3. Cloned URL repo at `.skaile/cache/sources/<name>/` (must already exist).\n *\n * Returns `null` when none of these resolve. Does not clone.\n *\n * **Async and deadline-bounded since #454.** Every candidate here is a\n * project-relative or operator-supplied path, so a `sources[].path` of\n * `workspace/my-assets` resolves onto the rclone FUSE mount — the same tree the\n * scan that follows walks. Probing it with `existsSync`/`lstatSync` would park\n * the `skaile serve` event loop *before* the (now async) scan ever ran, which\n * would leave the H2 fix meaningless on the very declaration that triggers it.\n * A probe that misses its deadline reads as \"unavailable\", which is what the\n * caller already does with an absent path — it becomes a `repo_unavailable`\n * warning rather than a stall.\n */\nasync function resolveRepoDir(\n  name: string,\n  decl: SourceDeclaration,\n  projectDir: string,\n  links: Record<string, string>,\n): Promise<string | null> {\n  // 1. Linked override\n  const linked = links[name];\n  if (linked && (await pathExists(linked))) return linked;\n\n  // 2. Local path\n  if (decl.path) {\n    const resolved = resolvePath(projectDir, decl.path);\n    return (await pathExists(resolved)) ? resolved : null;\n  }\n\n  // 3. URL repo cloned to project's .skaile/cache/sources/<name> — the\n  //    project-local clone dir (often a symlink into the global cache, which\n  //    lives at getGlobalCacheDir()); NOT the global clone root itself.\n  if (decl.url) {\n    const projectDest = join(projectDir, \".skaile\", \"cache\", \"sources\", name);\n    // One `lstat` answers both questions the pre-#454 `existsSync` + `lstatSync`\n    // pair asked, and `lstat` (not `stat`) keeps the \"a symlink into the global\n    // cache counts\" behaviour intact.\n    const found = await tryWithFsDeadline(\n      `lstat ${projectDest}`,\n      async () => {\n        await lstat(projectDest);\n        return true;\n      },\n      false,\n    );\n    return found ? projectDest : null;\n  }\n\n  return null;\n}\n\n/** Deadline-bounded `existsSync` replacement — a wedged mount reads as absent. */\nfunction pathExists(path: string): Promise<boolean> {\n  return tryWithFsDeadline(\n    `stat ${path}`,\n    async () => {\n      await stat(path);\n      return true;\n    },\n    false,\n  );\n}\n\nfunction repoUnavailableMessage(name: string, decl: SourceDeclaration): string {\n  if (name === FACTORY_ASSETS_REPO_NAME && !decl.path && !decl.url) {\n    return (\n      `Cannot resolve the built-in factory-assets. ` +\n      `Set SKAILE_FACTORY_ASSETS_DIR or ensure @skaile/workspaces is installed.`\n    );\n  }\n  if (decl.url) {\n    return `Repository \"${name}\" (${decl.url}) is not available. Register it as a Library Source via \\`skaile source add\\`.`;\n  }\n  if (decl.path) {\n    return `Repository \"${name}\" path not found: ${decl.path}`;\n  }\n  return `Repository \"${name}\" has neither url nor path.`;\n}\n\nfunction findCatalogEntry(\n  entries: RuntimeCatalogEntry[],\n  query: { kind?: \"connector\"; name: string },\n): RuntimeCatalogEntry | undefined {\n  if (query.kind) {\n    return entries.find((e) => e.kind === query.kind && e.name === query.name);\n  }\n  const matches = entries.filter((e) => e.name === query.name);\n  if (matches.length === 1) return matches[0];\n  // 0 or >1 with no kind — caller must disambiguate.\n  return undefined;\n}\n"]}

package/dist/{chunk-CKICWXMU.js → chunk-UQ33Y4DM.js}

@@ -1,8 +1,10 @@
 import { isManifestName } from './chunk-GOCWM7FN.js';
 import { parseAssetRef, isValidPublisher, PUBLISHER_HINT } from './chunk-WDXZA7QW.js';
+import { spawnSync } from 'child_process';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync, realpathSync, readdirSync, statSync, readlinkSync } from 'fs';
-import { join, resolve, sep } from 'path';
+import fg from 'fast-glob';
+import { join, resolve, relative, sep } from 'path';
 import { stringify, parse } from 'yaml';
 
 var SKAILE_MANIFEST_FILENAME = "skaile.manifest.yaml";
@@ -269,7 +271,8 @@ function isEnvFileName(name) {
   if (!name.startsWith(".env.")) return false;
   return !ENV_TEMPLATE_SUFFIXES.has(name.slice(".env".length));
 }
-var SECRET_FILE_SUFFIXES = [".pem", ".key", ".p12", ".pfx", ".tfstate"];
+var SECRET_FILE_SUFFIXES = [".pem", ".key", ".p12", ".pfx", ".tfstate", ".jks", ".keystore"];
+var SECRET_FILE_GLOBS = ["client_secret*.json"];
 var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
   "id_rsa",
   "id_dsa",
@@ -280,15 +283,27 @@ var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
   ".envrc",
   ".pypirc",
   ".htpasswd",
+  ".pgpass",
+  ".my.cnf",
+  ".dockercfg",
+  ".boto",
+  ".vault_pass",
+  ".git-credentials",
+  "kubeconfig",
+  "wallet.dat",
   "credentials",
+  "credentials.json",
   "token.json",
+  "secret.txt",
+  "secrets.txt",
+  "api_key.txt",
   "secrets.yaml",
   "secrets.yml",
   "secrets.json",
   "service-account.json"
 ]);
 function isSecretFileName(name) {
-  return isEnvFileName(name) || SECRET_FILE_NAMES.has(name) || SECRET_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix));
+  return isEnvFileName(name) || SECRET_FILE_NAMES.has(name) || SECRET_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix)) || name.startsWith("client_secret") && name.endsWith(".json");
 }
 var LIBRARY_GITIGNORE = [
   ".DS_Store",
@@ -306,6 +321,7 @@ var LIBRARY_GITIGNORE = [
   ".env.*",
   ...SECRET_FILE_NAMES,
   ...SECRET_FILE_SUFFIXES.map((suffix) => `*${suffix}`),
+  ...SECRET_FILE_GLOBS,
   ...[...ENV_TEMPLATE_SUFFIXES].map((suffix) => `!.env${suffix}`),
   ""
 ].join("\n");
@@ -335,6 +351,121 @@ function listAssetFiles(absDir) {
   walk(absDir, "");
   return out.sort();
 }
+function expandWith(patterns, isFile, glob) {
+  const files = /* @__PURE__ */ new Set();
+  const unmatched = [];
+  for (const raw of patterns) {
+    const pattern = raw.replace(/\\/g, "/");
+    if (!fg.isDynamicPattern(pattern)) {
+      if (isFile(pattern)) files.add(pattern);
+      else unmatched.push(raw);
+      continue;
+    }
+    const hits = glob(pattern);
+    if (hits.length === 0) unmatched.push(`${raw} (matches no file)`);
+    for (const hit of hits) files.add(hit);
+  }
+  return { files: [...files].sort(), unmatched };
+}
+function expandManifestFiles(baseDir, patterns) {
+  return expandWith(
+    patterns,
+    (rel) => {
+      try {
+        return statSync(join(baseDir, rel)).isFile();
+      } catch {
+        return false;
+      }
+    },
+    (pattern) => fg.sync(pattern, { cwd: baseDir, onlyFiles: true, dot: true })
+  );
+}
+function expandManifestFilesFromPaths(paths, patterns) {
+  const fileSet = new Set(paths);
+  const dirs = /* @__PURE__ */ new Map();
+  const link = (dir, child) => {
+    const set = dirs.get(dir) ?? /* @__PURE__ */ new Set();
+    set.add(child);
+    dirs.set(dir, set);
+  };
+  for (const file of fileSet) {
+    const parts = file.split("/");
+    for (let i = 0; i < parts.length; i++) {
+      link(i === 0 ? "" : parts.slice(0, i).join("/"), parts[i]);
+    }
+  }
+  const rel = (abs) => abs.replace(/^\/+/, "").replace(/\/+$/, "");
+  const stats = (abs) => {
+    const r = rel(abs);
+    const isFile = fileSet.has(r);
+    const isDir = r === "" || dirs.has(r);
+    if (!isFile && !isDir) {
+      const err = new Error(`ENOENT: ${abs}`);
+      err.code = "ENOENT";
+      throw err;
+    }
+    return {
+      isFile: () => isFile,
+      isDirectory: () => isDir,
+      isSymbolicLink: () => false,
+      isBlockDevice: () => false,
+      isCharacterDevice: () => false,
+      isFIFO: () => false,
+      isSocket: () => false,
+      mode: isDir ? 16384 : 32768
+    };
+  };
+  const list = (abs) => {
+    const r = rel(abs);
+    return [...dirs.get(r) ?? []].sort().map((name) => {
+      const full = r === "" ? name : `${r}/${name}`;
+      return { name, ...stats(`/${full}`) };
+    });
+  };
+  const cb = (fn) => (...args) => {
+    const done = args.pop();
+    try {
+      done(null, fn(...args));
+    } catch (err) {
+      done(err);
+    }
+  };
+  const vfs = {
+    lstatSync: stats,
+    statSync: stats,
+    readdirSync: (abs, opts) => opts?.withFileTypes ? list(abs) : list(abs).map((d) => d.name),
+    lstat: cb(stats),
+    stat: cb(stats),
+    readdir: cb(
+      (abs, opts) => opts?.withFileTypes ? list(abs) : list(abs).map((d) => d.name)
+    )
+  };
+  return expandWith(
+    patterns,
+    (r) => fileSet.has(r),
+    (pattern) => fg.sync(pattern, {
+      cwd: "/",
+      onlyFiles: true,
+      dot: true,
+      fs: vfs
+    })
+  );
+}
+function gitPublishedFiles(root) {
+  if (!existsSync(join(root, ".git"))) return null;
+  const listed = spawnSync(
+    "git",
+    ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 1 << 28 }
+  );
+  if (listed.error || listed.status !== 0) return null;
+  return new Set(listed.stdout.split("\0").filter((p) => p !== ""));
+}
+function onlyPublished(published, root, assetRoot, files) {
+  if (published === null) return [...files];
+  const prefix = relative(root, assetRoot).split(sep).join("/");
+  return files.filter((f) => published.has(prefix === "" ? f : `${prefix}/${f}`));
+}
 function listSkippedSymlinks(absDir) {
   const out = [];
   const walk = (dir, rel) => {
@@ -357,9 +488,8 @@ function listSkippedSymlinks(absDir) {
   return out.sort();
 }
 function listLibrarySymlinks(absDir, opts = {}) {
-  let root;
   try {
-    root = realpathSync(absDir);
+    realpathSync(absDir);
   } catch {
     return [];
   }
@@ -381,8 +511,7 @@ function listLibrarySymlinks(absDir, opts = {}) {
         let refused = here || opts.wholeTree === true;
         if (!refused) {
           try {
-            const real = realpathSync(full);
-            refused = statSync(real).isDirectory() && (real === root || real.startsWith(root + sep) || readdirSync(real).some((n) => isManifestName(n)));
+            refused = statSync(full).isDirectory() && readdirSync(full).some(isManifestName);
           } catch {
           }
         }
@@ -425,6 +554,6 @@ function listSecretFiles(absDir) {
   return out.sort();
 }
 
-export { ASSET_KEY_ORDER, LIBRARY_GITIGNORE, SKAILE_MANIFEST_FILENAME, compositeSha256, decodeSkaileManifest, encodeSkaileManifest, isEnvFileName, isNonAssetDir, isNonAssetFile, isNonAssetPath, isSecretFileName, librarySymlinkMessage, listAssetFiles, listLibrarySymlinks, listSecretFiles, listSkippedSymlinks, loadSkPublishManifest, orderedAsset, sha256Hex };
-//# sourceMappingURL=chunk-CKICWXMU.js.map
-//# sourceMappingURL=chunk-CKICWXMU.js.map
+export { ASSET_KEY_ORDER, LIBRARY_GITIGNORE, SKAILE_MANIFEST_FILENAME, compositeSha256, decodeSkaileManifest, encodeSkaileManifest, expandManifestFiles, expandManifestFilesFromPaths, gitPublishedFiles, isEnvFileName, isNonAssetDir, isNonAssetFile, isNonAssetPath, isSecretFileName, librarySymlinkMessage, listAssetFiles, listLibrarySymlinks, listSecretFiles, listSkippedSymlinks, loadSkPublishManifest, onlyPublished, orderedAsset, sha256Hex };
+//# sourceMappingURL=chunk-UQ33Y4DM.js.map
+//# sourceMappingURL=chunk-UQ33Y4DM.js.map