@skaile/workspaces 5.18.1 → 6.0.0

package/dist/{chunk-CKICWXMU.js → chunk-UQ33Y4DM.js}

@@ -1,8 +1,10 @@
 import { isManifestName } from './chunk-GOCWM7FN.js';
 import { parseAssetRef, isValidPublisher, PUBLISHER_HINT } from './chunk-WDXZA7QW.js';
+import { spawnSync } from 'child_process';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync, realpathSync, readdirSync, statSync, readlinkSync } from 'fs';
-import { join, resolve, sep } from 'path';
+import fg from 'fast-glob';
+import { join, resolve, relative, sep } from 'path';
 import { stringify, parse } from 'yaml';
 
 var SKAILE_MANIFEST_FILENAME = "skaile.manifest.yaml";
@@ -269,7 +271,8 @@ function isEnvFileName(name) {
   if (!name.startsWith(".env.")) return false;
   return !ENV_TEMPLATE_SUFFIXES.has(name.slice(".env".length));
 }
-var SECRET_FILE_SUFFIXES = [".pem", ".key", ".p12", ".pfx", ".tfstate"];
+var SECRET_FILE_SUFFIXES = [".pem", ".key", ".p12", ".pfx", ".tfstate", ".jks", ".keystore"];
+var SECRET_FILE_GLOBS = ["client_secret*.json"];
 var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
   "id_rsa",
   "id_dsa",
@@ -280,15 +283,27 @@ var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
   ".envrc",
   ".pypirc",
   ".htpasswd",
+  ".pgpass",
+  ".my.cnf",
+  ".dockercfg",
+  ".boto",
+  ".vault_pass",
+  ".git-credentials",
+  "kubeconfig",
+  "wallet.dat",
   "credentials",
+  "credentials.json",
   "token.json",
+  "secret.txt",
+  "secrets.txt",
+  "api_key.txt",
   "secrets.yaml",
   "secrets.yml",
   "secrets.json",
   "service-account.json"
 ]);
 function isSecretFileName(name) {
-  return isEnvFileName(name) || SECRET_FILE_NAMES.has(name) || SECRET_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix));
+  return isEnvFileName(name) || SECRET_FILE_NAMES.has(name) || SECRET_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix)) || name.startsWith("client_secret") && name.endsWith(".json");
 }
 var LIBRARY_GITIGNORE = [
   ".DS_Store",
@@ -306,6 +321,7 @@ var LIBRARY_GITIGNORE = [
   ".env.*",
   ...SECRET_FILE_NAMES,
   ...SECRET_FILE_SUFFIXES.map((suffix) => `*${suffix}`),
+  ...SECRET_FILE_GLOBS,
   ...[...ENV_TEMPLATE_SUFFIXES].map((suffix) => `!.env${suffix}`),
   ""
 ].join("\n");
@@ -335,6 +351,121 @@ function listAssetFiles(absDir) {
   walk(absDir, "");
   return out.sort();
 }
+function expandWith(patterns, isFile, glob) {
+  const files = /* @__PURE__ */ new Set();
+  const unmatched = [];
+  for (const raw of patterns) {
+    const pattern = raw.replace(/\\/g, "/");
+    if (!fg.isDynamicPattern(pattern)) {
+      if (isFile(pattern)) files.add(pattern);
+      else unmatched.push(raw);
+      continue;
+    }
+    const hits = glob(pattern);
+    if (hits.length === 0) unmatched.push(`${raw} (matches no file)`);
+    for (const hit of hits) files.add(hit);
+  }
+  return { files: [...files].sort(), unmatched };
+}
+function expandManifestFiles(baseDir, patterns) {
+  return expandWith(
+    patterns,
+    (rel) => {
+      try {
+        return statSync(join(baseDir, rel)).isFile();
+      } catch {
+        return false;
+      }
+    },
+    (pattern) => fg.sync(pattern, { cwd: baseDir, onlyFiles: true, dot: true })
+  );
+}
+function expandManifestFilesFromPaths(paths, patterns) {
+  const fileSet = new Set(paths);
+  const dirs = /* @__PURE__ */ new Map();
+  const link = (dir, child) => {
+    const set = dirs.get(dir) ?? /* @__PURE__ */ new Set();
+    set.add(child);
+    dirs.set(dir, set);
+  };
+  for (const file of fileSet) {
+    const parts = file.split("/");
+    for (let i = 0; i < parts.length; i++) {
+      link(i === 0 ? "" : parts.slice(0, i).join("/"), parts[i]);
+    }
+  }
+  const rel = (abs) => abs.replace(/^\/+/, "").replace(/\/+$/, "");
+  const stats = (abs) => {
+    const r = rel(abs);
+    const isFile = fileSet.has(r);
+    const isDir = r === "" || dirs.has(r);
+    if (!isFile && !isDir) {
+      const err = new Error(`ENOENT: ${abs}`);
+      err.code = "ENOENT";
+      throw err;
+    }
+    return {
+      isFile: () => isFile,
+      isDirectory: () => isDir,
+      isSymbolicLink: () => false,
+      isBlockDevice: () => false,
+      isCharacterDevice: () => false,
+      isFIFO: () => false,
+      isSocket: () => false,
+      mode: isDir ? 16384 : 32768
+    };
+  };
+  const list = (abs) => {
+    const r = rel(abs);
+    return [...dirs.get(r) ?? []].sort().map((name) => {
+      const full = r === "" ? name : `${r}/${name}`;
+      return { name, ...stats(`/${full}`) };
+    });
+  };
+  const cb = (fn) => (...args) => {
+    const done = args.pop();
+    try {
+      done(null, fn(...args));
+    } catch (err) {
+      done(err);
+    }
+  };
+  const vfs = {
+    lstatSync: stats,
+    statSync: stats,
+    readdirSync: (abs, opts) => opts?.withFileTypes ? list(abs) : list(abs).map((d) => d.name),
+    lstat: cb(stats),
+    stat: cb(stats),
+    readdir: cb(
+      (abs, opts) => opts?.withFileTypes ? list(abs) : list(abs).map((d) => d.name)
+    )
+  };
+  return expandWith(
+    patterns,
+    (r) => fileSet.has(r),
+    (pattern) => fg.sync(pattern, {
+      cwd: "/",
+      onlyFiles: true,
+      dot: true,
+      fs: vfs
+    })
+  );
+}
+function gitPublishedFiles(root) {
+  if (!existsSync(join(root, ".git"))) return null;
+  const listed = spawnSync(
+    "git",
+    ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 1 << 28 }
+  );
+  if (listed.error || listed.status !== 0) return null;
+  return new Set(listed.stdout.split("\0").filter((p) => p !== ""));
+}
+function onlyPublished(published, root, assetRoot, files) {
+  if (published === null) return [...files];
+  const prefix = relative(root, assetRoot).split(sep).join("/");
+  return files.filter((f) => published.has(prefix === "" ? f : `${prefix}/${f}`));
+}
 function listSkippedSymlinks(absDir) {
   const out = [];
   const walk = (dir, rel) => {
@@ -357,9 +488,8 @@ function listSkippedSymlinks(absDir) {
   return out.sort();
 }
 function listLibrarySymlinks(absDir, opts = {}) {
-  let root;
   try {
-    root = realpathSync(absDir);
+    realpathSync(absDir);
   } catch {
     return [];
   }
@@ -381,8 +511,7 @@ function listLibrarySymlinks(absDir, opts = {}) {
         let refused = here || opts.wholeTree === true;
         if (!refused) {
           try {
-            const real = realpathSync(full);
-            refused = statSync(real).isDirectory() && (real === root || real.startsWith(root + sep) || readdirSync(real).some((n) => isManifestName(n)));
+            refused = statSync(full).isDirectory() && readdirSync(full).some(isManifestName);
           } catch {
           }
         }
@@ -425,6 +554,6 @@ function listSecretFiles(absDir) {
   return out.sort();
 }
 
-export { ASSET_KEY_ORDER, LIBRARY_GITIGNORE, SKAILE_MANIFEST_FILENAME, compositeSha256, decodeSkaileManifest, encodeSkaileManifest, isEnvFileName, isNonAssetDir, isNonAssetFile, isNonAssetPath, isSecretFileName, librarySymlinkMessage, listAssetFiles, listLibrarySymlinks, listSecretFiles, listSkippedSymlinks, loadSkPublishManifest, orderedAsset, sha256Hex };
-//# sourceMappingURL=chunk-CKICWXMU.js.map
-//# sourceMappingURL=chunk-CKICWXMU.js.map
+export { ASSET_KEY_ORDER, LIBRARY_GITIGNORE, SKAILE_MANIFEST_FILENAME, compositeSha256, decodeSkaileManifest, encodeSkaileManifest, expandManifestFiles, expandManifestFilesFromPaths, gitPublishedFiles, isEnvFileName, isNonAssetDir, isNonAssetFile, isNonAssetPath, isSecretFileName, librarySymlinkMessage, listAssetFiles, listLibrarySymlinks, listSecretFiles, listSkippedSymlinks, loadSkPublishManifest, onlyPublished, orderedAsset, sha256Hex };
+//# sourceMappingURL=chunk-UQ33Y4DM.js.map
+//# sourceMappingURL=chunk-UQ33Y4DM.js.map

package/dist/chunk-UQ33Y4DM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/src/publish-manifest.ts"],"names":[],"mappings":";;;;;;;;;AA+JO,IAAM,wBAAA,GAA2B;AAIxC,SAAS,YAAY,GAAA,EAA0C;AAC7D,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,GAAA,KAAQ,QAAA,IAAY,EAAE,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,MAAA;AAC5D,EAAA,MAAM,GAAA,GAAsB,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAI;AACzC,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAA,CAAE,OAAO,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,MAAA,GAAS,CAAA,CAAE,MAAA;AACxE,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,gBAAgB,GAAA,EAA8C;AACrE,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,OAAO,MAAA;AAClE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,OAAO,EAAE,OAAA,KAAY,QAAA,IAAY,EAAE,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAO,MAAA;AACpE,EAAA,MAAM,GAAA,GAA0B,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,SAAA,KAAc,QAAA,IAAY,CAAA,CAAE,UAAU,MAAA,GAAS,CAAA,EAAG,GAAA,CAAI,SAAA,GAAY,CAAA,CAAE,SAAA;AACjF,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,WAAW,GAAA,EAA0D;AAC5E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,MAAA;AAChC,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,IACnB,CAAA,MAAA,IAAW,QAAQ,OAAO,IAAA,KAAS,YAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACnE,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,YAAY,OAAO,CAAA,CAAE,WAAW,QAAA,EAAU;AAC9D,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,IAAA,EAAM,CAAA,CAAE,MAAM,MAAA,EAAQ,CAAA,CAAE,QAAQ,CAAA;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG,OAAO,QAAA;AAChC,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,kBACP,IAAA,EACoF;AACpF,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAA,CAAM,IAAI,CAAA,IAAK,EAAC;AAAA,EAC3B,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,aAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS,iBAAiB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAC5E,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC1E,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,iBAAA;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,OAAA,EAAS;AAAA;AACX,KACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,MAAA,EAAkC;AAC5D;AAQA,SAAS,kBAAA,CAAmB,KAAA,EAAe,IAAA,EAAc,WAAA,EAAmC;AAC1F,EAAA,IAAI,CAAC,KAAA,CAAM,UAAA,CAAW,GAAG,GAAG,OAAO,KAAA;AACnC,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA;AAC9B,EAAA,WAAA,CAAY,IAAA,CAAK;AAAA,IACf,IAAA,EAAM,yBAAA;AAAA,IACN,QAAA,EAAU,SAAA;AAAA,IACV,OAAA,EAAS,CAAA,WAAA,EAAc,KAAK,CAAA,8EAAA,EAA4E,QAAQ,CAAA,CAAA,CAAA;AAAA,IAChH;AAAA,GACD,CAAA;AACD,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,oBAAA,CACP,GAAA,EACA,QAAA,EACA,WAAA,EACM;AACN,EAAA,IAAI,OAAO,GAAA,CAAI,SAAA,KAAc,YAAY,GAAA,CAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACjE,IAAA,QAAA,CAAS,SAAA,GAAY,kBAAA,CAAmB,GAAA,CAAI,SAAA,EAAW,aAAa,WAAW,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,UAAU,GAAA,CAAI,OAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,QAAA,KAAa,YAAY,GAAA,CAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/D,IAAA,QAAA,CAAS,WAAW,GAAA,CAAI,QAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA,EAAG;AAChC,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,SAAA,CAAU,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AAC5F,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,SAAA,GAAY,KAAA;AAAA,EAC7C;AACA,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,IAAI,MAAA,WAAiB,MAAA,GAAS,MAAA;AAC9B,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,GAAA,CAAI,UAAU,CAAA;AACjD,EAAA,IAAI,UAAA,WAAqB,UAAA,GAAa,UAAA;AACxC;AAMA,SAAS,uBAAA,CACP,GAAA,EACA,IAAA,EACA,IAAA,EACA,WAAA,EACU;AACV,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,IAAA;AAChC,EAAA,KAAA,MAAW,OAAO,GAAA,EAAK;AACrB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,cAAc,GAAG,CAAA;AAG7B,MAAA,IAAI,IAAI,SAAA,KAAc,KAAA,CAAA,IAAa,CAAC,gBAAA,CAAiB,GAAA,CAAI,SAAS,CAAA,EAAG;AACnE,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,SAAS,CAAA,SAAA,EAAO,cAAc,CAAA,CAAE,CAAA;AAAA,MACpE;AACA,MAAA,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,IACf,SAAS,GAAA,EAAK;AACZ,MAAA,WAAA,CAAY,IAAA,CAAK;AAAA,QACf,IAAA,EAAM,sBAAA;AAAA,QACN,QAAA,EAAU,SAAA;AAAA,QACV,OAAA,EAAS,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,gBAAA,EAC7B,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA,CAAA;AAAA,QACA,IAAA,EAAM,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,aAAA;AAAA,OAC7B,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAOA,SAAS,gBAAA,CAAiB,MAAe,WAAA,EAAmD;AAC1F,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG,OAAO,MAAA;AACrE,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,MAAM,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAE,IAAA,GAAO,EAAA;AACnD,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM,OAAO,MAAA;AAC3B,EAAA,MAAM,KAAA,GAAoB,EAAE,IAAA,EAAM,IAAA,EAAK;AACvC,EAAA,IAAI,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,EAAU,KAAA,CAAM,OAAO,CAAA,CAAE,IAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,CAAE,KAAK,CAAA;AAChC,EAAA,IAAI,KAAA,QAAa,KAAA,GAAQ,KAAA;AACzB,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,EAAE,SAAA,KAAc,QAAA;AACzB,IAAA,KAAA,CAAM,SAAA,GAAY,kBAAA;AAAA,MAChB,CAAA,CAAE,SAAA;AAAA,MACF,CAAA,OAAA,EAAU,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,UAAA,CAAA;AAAA,MACtB;AAAA,KACF;AACF,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,KAAA,CAAM,SAAS,CAAA,CAAE,MAAA;AACnD,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,CAAA,CAAE,MAAM,CAAA;AACxC,EAAA,IAAI,WAAA,QAAmB,MAAA,GAAS,WAAA;AAEhC,EAAA,MAAM,OAAO,uBAAA,CAAwB,CAAA,CAAE,YAAA,EAAc,IAAA,EAAM,MAAM,WAAW,CAAA;AAC5E,EAAA,IAAI,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,YAAA,GAAe,IAAA;AAE1C,EAAA,IAAI,OAAO,CAAA,CAAE,WAAA,KAAgB,QAAA,EAAU,KAAA,CAAM,cAAc,CAAA,CAAE,WAAA;AAC7D,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,QAAQ,CAAA,EAAG;AAC7B,IAAA,MAAM,EAAA,GAAK,EAAE,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,MAAM,QAAQ,CAAA;AACtE,IAAA,IAAI,EAAA,CAAG,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,QAAA,GAAW,EAAA;AAAA,EACtC;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AACvD,EAAA,IAAI,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,OAAA;AACrD,EAAA,IAAI,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,EAAU,KAAA,CAAM,WAAW,CAAA,CAAE,QAAA;AAEvD,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,oBAAA,CACP,GAAA,EACA,QAAA,EACA,WAAA,EACM;AACN,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG;AAChC,EAAA,MAAM,UAAwB,EAAC;AAC/B,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAI,MAAA,EAAQ;AAC7B,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,IAAA,EAAM,WAAW,CAAA;AAChD,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,MAAA,GAAS,OAAA;AAC5C;AAYO,SAAS,qBAAqB,IAAA,EAAoC;AACvE,EAAA,MAAM,IAAA,GAAO,kBAAkB,IAAI,CAAA;AACnC,EAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,UAAU,EAAC,EAAG,aAAa,CAAC,IAAA,CAAK,UAAU,CAAA,EAAE;AAAA,EACxD;AAEA,EAAA,MAAM,WAA8B,EAAC;AACrC,EAAA,MAAM,cAA4B,EAAC;AACnC,EAAA,oBAAA,CAAqB,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,WAAW,CAAA;AACpD,EAAA,oBAAA,CAAqB,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,WAAW,CAAA;AAEpD,EAAA,OAAO,EAAE,UAAU,WAAA,EAAY;AACjC;AAKA,IAAM,kBAAA,GAAkD;AAAA,EACtD,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAGO,IAAM,eAAA,GAAiD;AAAA,EAC5D,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF;AAGO,SAAS,aAAa,CAAA,EAAwC;AACnE,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,eAAA,EAAiB;AACjC,IAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,CAAA;AACnB,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,EACtC;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,qBAAqB,QAAA,EAAqC;AACxE,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,OAAO,kBAAA,EAAoB;AACpC,IAAA,MAAM,KAAA,GAAQ,SAAS,GAAG,CAAA;AAC1B,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAI,GAAA,KAAQ,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5C,MAAA,GAAA,CAAI,MAAA,GAAU,KAAA,CAAuB,GAAA,CAAI,YAAY,CAAA;AAAA,IACvD,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,KAAK,CAAA;AAC1C;AASO,SAAS,sBAAsB,GAAA,EAAuC;AAC3E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,GAAG,wBAAwB,CAAA;AAC5D,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,YAAA,CAAa,UAAU,OAAO,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,qBAAqB,GAAG,CAAA;AAC1D,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,aAAA,IAAiB,CAAA,CAAE,IAAA,KAAS,iBAAiB,CAAA,EAAG;AACrF,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,QAAA;AACT;AAKO,SAAS,UAAU,KAAA,EAA2B;AACnD,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAaO,SAAS,gBAAgB,KAAA,EAAgE;AAC9F,EAAA,MAAM,KAAA,GAAQ,MACX,KAAA,EAAM,CACN,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,EAAE,IAAI,CAAC,CAAA,CAC3C,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,MAAM;AAAA,CAAI,CAAA,CACpC,KAAK,EAAE,CAAA;AACV,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAQA,IAAM,cAAA,uBAAqB,GAAA,CAAI;AAAA,EAC7B,MAAA;AAAA,EACA,cAAA;AAAA,EACA,SAAA;AAAA,EACA,aAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,eAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAW,CAAC,CAAA;AAGnD,SAAS,cAAc,IAAA,EAAuB;AACnD,EAAA,OAAO,cAAA,CAAe,IAAI,IAAI,CAAA;AAChC;AAQO,SAAS,eAAe,IAAA,EAAuB;AACpD,EAAA,OACE,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA,IACxB,KAAK,QAAA,CAAS,MAAM,CAAA,IACpB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,IACpB,IAAA,CAAK,SAAS,MAAM,CAAA,IACpB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,IACpB,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,IACjB,IAAA,CAAK,QAAA,CAAS,MAAM,KACpB,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,IACpB,iBAAiB,IAAI,CAAA;AAEzB;AAGA,IAAM,qBAAA,uBAA4B,GAAA,CAAI,CAAC,YAAY,SAAA,EAAW,WAAA,EAAa,OAAO,CAAC,CAAA;AAM5E,SAAS,cAAc,IAAA,EAAuB;AACnD,EAAA,IAAI,IAAA,KAAS,QAAQ,OAAO,IAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,OAAO,GAAG,OAAO,KAAA;AACtC,EAAA,OAAO,CAAC,qBAAA,CAAsB,GAAA,CAAI,KAAK,KAAA,CAAM,MAAA,CAAO,MAAM,CAAC,CAAA;AAC7D;AAGA,IAAM,oBAAA,GAAuB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,MAAA,EAAQ,UAAA,EAAY,QAAQ,WAAW,CAAA;AAG7F,IAAM,iBAAA,GAAoB,CAAC,qBAAqB,CAAA;AAGhD,IAAM,iBAAA,uBAAwB,GAAA,CAAI;AAAA,EAChC,QAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,kBAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,aAAA;AAAA,EACA,kBAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAC,CAAA;AAWM,SAAS,iBAAiB,IAAA,EAAuB;AACtD,EAAA,OACE,aAAA,CAAc,IAAI,CAAA,IAClB,iBAAA,CAAkB,IAAI,IAAI,CAAA,IAC1B,oBAAA,CAAqB,IAAA,CAAK,CAAC,MAAA,KAAW,KAAK,QAAA,CAAS,MAAM,CAAC,CAAA,IAC1D,IAAA,CAAK,WAAW,eAAe,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAE9D;AAQO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,WAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,GAAG,iBAAA;AAAA,EACH,GAAG,oBAAA,CAAqB,GAAA,CAAI,CAAC,MAAA,KAAW,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,CAAA;AAAA,EACpD,GAAG,iBAAA;AAAA,EACH,GAAG,CAAC,GAAG,qBAAqB,CAAA,CAAE,IAAI,CAAC,MAAA,KAAW,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAE,CAAA;AAAA,EAC9D;AACF,CAAA,CAAE,KAAK,IAAI;AAOJ,SAAS,eAAe,SAAA,EAA4B;AACzD,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AACjC,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,GAAA,EAAI,IAAK,EAAA;AAC5B,EAAA,OAAO,cAAA,CAAe,IAAI,CAAA,IAAK,KAAA,CAAM,KAAK,aAAa,CAAA;AACzD;AAQO,SAAS,eAAe,MAAA,EAA0B;AACvD,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,KAAsB;AAC/C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,QAAA,GAAW,MAAM,CAAA,EAAG,GAAG,IAAI,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA;AAC9C,MAAA,IAAI,CAAA,CAAE,aAAY,EAAG;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,CAAA,CAAE,IAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,CAAA,EAAG,QAAQ,CAAA;AAAA,MAC9D,CAAA,MAAA,IAAW,EAAE,MAAA,EAAO,IAAK,CAAC,cAAA,CAAe,CAAA,CAAE,IAAI,CAAA,EAAG;AAChD,QAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,MACnB;AAAA,IACF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,QAAQ,EAAE,CAAA;AACf,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB;AAUA,SAAS,UAAA,CACP,QAAA,EACA,MAAA,EACA,IAAA,EAC0C;AAC1C,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AACtC,IAAA,IAAI,CAAC,EAAA,CAAG,gBAAA,CAAiB,OAAO,CAAA,EAAG;AACjC,MAAA,IAAI,MAAA,CAAO,OAAO,CAAA,EAAG,KAAA,CAAM,IAAI,OAAO,CAAA;AAAA,WACjC,SAAA,CAAU,KAAK,GAAG,CAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,KAAK,OAAO,CAAA;AACzB,IAAA,IAAI,KAAK,MAAA,KAAW,CAAA,YAAa,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,kBAAA,CAAoB,CAAA;AAChE,IAAA,KAAA,MAAW,GAAA,IAAO,IAAA,EAAM,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,IAAQ,SAAA,EAAU;AAC/C;AAMO,SAAS,mBAAA,CACd,SACA,QAAA,EAC0C;AAC1C,EAAA,OAAO,UAAA;AAAA,IACL,QAAA;AAAA,IACA,CAAC,GAAA,KAAQ;AACP,MAAA,IAAI;AACF,QAAA,OAAO,SAAS,IAAA,CAAK,OAAA,EAAS,GAAG,CAAC,EAAE,MAAA,EAAO;AAAA,MAC7C,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,KAAY,EAAA,CAAG,IAAA,CAAK,OAAA,EAAS,EAAE,GAAA,EAAK,OAAA,EAAS,SAAA,EAAW,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM;AAAA,GAC5E;AACF;AAQO,SAAS,4BAAA,CACd,OACA,QAAA,EAC0C;AAC1C,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,KAAK,CAAA;AAC7B,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAyB;AAC1C,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,KAAA,KAAwB;AACjD,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,wBAAS,GAAA,EAAY;AAC7C,IAAA,GAAA,CAAI,IAAI,KAAK,CAAA;AACb,IAAA,IAAA,CAAK,GAAA,CAAI,KAAK,GAAG,CAAA;AAAA,EACnB,CAAA;AACA,EAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC5B,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,MAAA,IAAA,CAAK,CAAA,KAAM,CAAA,GAAI,EAAA,GAAK,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,EAAG,KAAA,CAAM,CAAC,CAAE,CAAA;AAAA,IAC5D;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,CAAC,GAAA,KAAwB,GAAA,CAAI,OAAA,CAAQ,QAAQ,EAAE,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/E,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,KAAgB;AAC7B,IAAA,MAAM,CAAA,GAAI,IAAI,GAAG,CAAA;AACjB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA;AAC5B,IAAA,MAAM,KAAA,GAAQ,CAAA,KAAM,EAAA,IAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACpC,IAAA,IAAI,CAAC,MAAA,IAAU,CAAC,KAAA,EAAO;AACrB,MAAA,MAAM,GAAA,GAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,GAAG,CAAA,CAAE,CAAA;AACtC,MAAA,GAAA,CAAI,IAAA,GAAO,QAAA;AACX,MAAA,MAAM,GAAA;AAAA,IACR;AACA,IAAA,OAAO;AAAA,MACL,QAAQ,MAAM,MAAA;AAAA,MACd,aAAa,MAAM,KAAA;AAAA,MACnB,gBAAgB,MAAM,KAAA;AAAA,MACtB,eAAe,MAAM,KAAA;AAAA,MACrB,mBAAmB,MAAM,KAAA;AAAA,MACzB,QAAQ,MAAM,KAAA;AAAA,MACd,UAAU,MAAM,KAAA;AAAA,MAChB,IAAA,EAAM,QAAQ,KAAA,GAAW;AAAA,KAC3B;AAAA,EACF,CAAA;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,KAAgB;AAC5B,IAAA,MAAM,CAAA,GAAI,IAAI,GAAG,CAAA;AACjB,IAAA,OAAO,CAAC,GAAI,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,IAAK,EAAG,CAAA,CAAE,IAAA,EAAK,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS;AACnD,MAAA,MAAM,OAAO,CAAA,KAAM,EAAA,GAAK,OAAO,CAAA,EAAG,CAAC,IAAI,IAAI,CAAA,CAAA;AAC3C,MAAA,OAAO,EAAE,IAAA,EAAM,GAAG,MAAM,CAAA,CAAA,EAAI,IAAI,EAAE,CAAA,EAAE;AAAA,IACtC,CAAC,CAAA;AAAA,EACH,CAAA;AACA,EAAA,MAAM,EAAA,GACJ,CAAyB,EAAA,KACzB,CAAA,GAAI,IAAA,KAA0B;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAK,GAAA,EAAI;AACtB,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,IAAA,EAAM,EAAA,CAAG,GAAI,IAAU,CAAC,CAAA;AAAA,IAC/B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAY,CAAA;AAAA,IACnB;AAAA,EACF,CAAA;AACF,EAAA,MAAM,GAAA,GAAM;AAAA,IACV,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,KAAA;AAAA,IACV,aAAa,CAAC,GAAA,EAAa,IAAA,KACzB,IAAA,EAAM,gBAAgB,IAAA,CAAK,GAAG,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAAA,IAC/D,KAAA,EAAO,GAAG,KAAK,CAAA;AAAA,IACf,IAAA,EAAM,GAAG,KAAK,CAAA;AAAA,IACd,OAAA,EAAS,EAAA;AAAA,MAAG,CAAC,GAAA,EAAa,IAAA,KACxB,IAAA,EAAM,gBAAgB,IAAA,CAAK,GAAG,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI;AAAA;AAC/D,GACF;AACA,EAAA,OAAO,UAAA;AAAA,IACL,QAAA;AAAA,IACA,CAAC,CAAA,KAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA;AAAA,IACpB,CAAC,OAAA,KACC,EAAA,CAAG,IAAA,CAAK,OAAA,EAAS;AAAA,MACf,GAAA,EAAK,GAAA;AAAA,MACL,SAAA,EAAW,IAAA;AAAA,MACX,GAAA,EAAK,IAAA;AAAA,MACL,EAAA,EAAI;AAAA,KACL;AAAA,GACL;AACF;AAUO,SAAS,kBAAkB,IAAA,EAA0C;AAC1E,EAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,MAAM,MAAM,CAAC,GAAG,OAAO,IAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,SAAA;AAAA,IACb,KAAA;AAAA,IACA,CAAC,IAAA,EAAM,IAAA,EAAM,YAAY,IAAA,EAAM,UAAA,EAAY,YAAY,oBAAoB,CAAA;AAAA,IAC3E,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,QAAQ,CAAA,EAAG,SAAA,EAAW,CAAA,IAAK,EAAA;AAAG,GAC9E;AACA,EAAA,IAAI,MAAA,CAAO,KAAA,IAAS,MAAA,CAAO,MAAA,KAAW,GAAG,OAAO,IAAA;AAChD,EAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,KAAM,EAAE,CAAC,CAAA;AAClE;AAMO,SAAS,aAAA,CACd,SAAA,EACA,IAAA,EACA,SAAA,EACA,KAAA,EACU;AACV,EAAA,IAAI,SAAA,KAAc,IAAA,EAAM,OAAO,CAAC,GAAG,KAAK,CAAA;AACxC,EAAA,MAAM,MAAA,GAAS,SAAS,IAAA,EAAM,SAAS,EAAE,KAAA,CAAM,GAAG,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC5D,EAAA,OAAO,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,UAAU,GAAA,CAAI,MAAA,KAAW,EAAA,GAAK,CAAA,GAAI,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,CAAC,EAAE,CAAC,CAAA;AAChF;AAOO,SAAS,oBAAoB,MAAA,EAA0B;AAC5D,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,KAAsB;AAC/C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,QAAA,GAAW,MAAM,CAAA,EAAG,GAAG,IAAI,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA;AAC9C,MAAA,IAAI,CAAA,CAAE,gBAAe,EAAG;AACtB,QAAA,IAAI,CAAC,cAAA,CAAe,CAAA,CAAE,IAAI,CAAA,EAAG,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,MAChD,CAAA,MAAA,IAAW,EAAE,WAAA,EAAY,IAAK,CAAC,aAAA,CAAc,CAAA,CAAE,IAAI,CAAA,EAAG;AACpD,QAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,GAAG,QAAQ,CAAA;AAAA,MAClC;AAAA,IACF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,QAAQ,EAAE,CAAA;AACf,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB;AAoCO,SAAS,mBAAA,CACd,MAAA,EACA,IAAA,GAAuF,EAAC,EACtE;AAClB,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,MAAM,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,OAAA,GAAU,CAAC,IAAA,KACf,aAAA,CAAc,IAAI,KAAK,IAAA,CAAK,QAAA,EAAU,GAAA,CAAI,IAAI,CAAA,KAAM,IAAA;AACtD,EAAA,MAAM,MAAwB,EAAC;AAC/B,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,EAAa,OAAA,KAA2B;AACjE,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,OACJ,OAAA,IACC,GAAA,KAAQ,MAAA,IACP,OAAA,CAAQ,KAAK,CAAC,CAAA,KAAA,CAAO,CAAA,CAAE,MAAA,MAAY,CAAA,CAAE,cAAA,OAAqB,cAAA,CAAe,CAAA,CAAE,IAAI,CAAC,CAAA;AACpF,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,CAAA;AAC7B,MAAA,MAAM,QAAA,GAAW,MAAM,CAAA,EAAG,GAAG,IAAI,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA;AAC9C,MAAA,IAAI,CAAA,CAAE,gBAAe,EAAG;AACtB,QAAA,IAAI,eAAe,CAAA,CAAE,IAAI,KAAK,OAAA,CAAQ,CAAA,CAAE,IAAI,CAAA,EAAG;AAC/C,QAAA,IAAI,OAAA,GAAU,IAAA,IAAQ,IAAA,CAAK,SAAA,KAAc,IAAA;AACzC,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,IAAI;AAKF,YAAA,OAAA,GAAU,QAAA,CAAS,IAAI,CAAA,CAAE,WAAA,MAAiB,WAAA,CAAY,IAAI,CAAA,CAAE,IAAA,CAAK,cAAc,CAAA;AAAA,UACjF,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AACA,QAAA,IAAI,OAAA,EAAS;AACX,UAAA,IAAI,MAAA;AACJ,UAAA,IAAI;AACF,YAAA,MAAA,GAAS,aAAa,IAAI,CAAA;AAAA,UAC5B,CAAA,CAAA,MAAQ;AACN,YAAA,MAAA,GAAS,GAAA;AAAA,UACX;AACA,UAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AAAA,QACrC;AAAA,MACF,CAAA,MAAA,IAAW,EAAE,WAAA,EAAY,IAAK,CAAC,OAAA,CAAQ,CAAA,CAAE,IAAI,CAAA,EAAG;AAC9C,QAAA,IAAA,CAAK,IAAA,EAAM,UAAU,IAAI,CAAA;AAAA,MAC3B;AAAA,IACF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,MAAA,EAAQ,EAAA,EAAI,IAAA,CAAK,WAAA,KAAgB,IAAI,CAAA;AAC1C,EAAA,OAAO,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD;AAMO,SAAS,sBAAsB,IAAA,EAA8B;AAClE,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,iBAAA,EAAoB,KAAK,MAAM,CAAA,0HAAA,CAAA;AACpD;AAOO,SAAS,gBAAgB,MAAA,EAA0B;AACxD,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,GAAA,KAAsB;AAC/C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACpD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,QAAA,GAAW,MAAM,CAAA,EAAG,GAAG,IAAI,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,IAAA;AAC9C,MAAA,IAAI,CAAA,CAAE,QAAO,IAAK,gBAAA,CAAiB,EAAE,IAAI,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,QAAQ,CAAA;AAAA,WAAA,IACpD,CAAA,CAAE,WAAA,EAAY,IAAK,CAAC,cAAc,CAAA,CAAE,IAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,IAAI,GAAG,QAAQ,CAAA;AAAA,IACtF;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,QAAQ,EAAE,CAAA;AACf,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB","file":"chunk-UQ33Y4DM.js","sourcesContent":["/**\n * Publish manifest — `skaile.manifest.yaml`\n *\n * What a repo PUBLISHES: the `publisher` / `version` / `assets[]` that used to\n * live in the publication half of `skaile.yaml`, plus a per-asset dependency\n * graph, store-listing metadata, and an optional curator `source:` pointer.\n *\n * ── Two files, two codecs ──────────────────────────────────────────────────\n *\n *   skaile.yaml             → SkWorkspaceConfig   (workspace + consumption)\n *   skaile.manifest.yaml    → SkPublishManifest   (publication)            ← this module\n *\n * A repo can have either file, both, or neither: a pure workspace has only\n * `skaile.yaml`; a pure asset repo (e.g. `ai-assets`) has only\n * `skaile.manifest.yaml`; a repo that is both has both.\n *\n * ── One format, three roles ────────────────────────────────────────────────\n *\n *   First-party    `source:` absent  → bytes live in this repo (`root`/`files`).\n *   Curator/sidecar `source:` present → bytes come from the referenced upstream,\n *                                       verified by `sha256`.\n *\n * `decodeSkaileManifest` mirrors `decodeSkaileYaml`: total (never throws),\n * returns {@link Diagnostic}s. Dep-ref strings are validated with `parseAssetRef`.\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport {\n  type Dirent,\n  existsSync,\n  readdirSync,\n  readFileSync,\n  readlinkSync,\n  realpathSync,\n  statSync,\n} from \"node:fs\";\nimport fg from \"fast-glob\";\nimport { join, relative, resolve, sep } from \"node:path\";\nimport { parse, stringify } from \"yaml\";\nimport { isManifestName } from \"./manifest.js\";\nimport { isValidPublisher, parseAssetRef, PUBLISHER_HINT } from \"./models.js\";\nimport type { Diagnostic } from \"./workspace-config.js\";\n\n// ── Types ───────────────────────────────────────────────────────────────────\n\n/** One file inside a curated asset, pinned to an exact upstream blob hash. */\nexport interface ManifestFileEntry {\n  path: string;\n  /** 64-hex sha256 of the upstream blob. */\n  sha256: string;\n}\n\n/**\n * One entry in a manifest's `assets:` list. Either `root:` (recursive walk) or\n * `files:` (explicit list, supports globs for first-party; the granular\n * `{path, sha256}` form for curated upstream verification) declares which paths\n * constitute the asset. `version:` overrides the manifest-level version.\n *\n * @docLink packages/core/publish-manifest#asset-entry\n */\nexport interface AssetEntry {\n  kind: string;\n  name: string;\n  root?: string;\n  /**\n   * Explicit file listing. First-party manifests use bare `string[]` (globs,\n   * fast-glob). Curated entries may use the granular `{path, sha256}` form so\n   * the resolver fetches + verifies exact upstream blobs without a full clone.\n   */\n  files?: string[] | ManifestFileEntry[];\n  version?: string;\n  /** Per-asset publisher override (e.g. for curator/mirror repos). */\n  publisher?: string;\n\n  /**\n   * Canonical dep refs (`kind:@<publisher>/name[#version]`) — same grammar as\n   * `SkWorkspaceConfig.dependencies`. Authoritative for this asset's resolved\n   * deps. (Was `requires` in `.skaile-source.yaml`.)\n   */\n  dependencies?: string[];\n\n  /**\n   * Author-pinned composite sha256 over the asset's `files`/`root` (the\n   * {@link compositeSha256} the walker, discovery and the lock all use). Optional locally;\n   * REQUIRED on store publish. (Was `.skaile-source.yaml` `assets[].sha256`.)\n   */\n  sha256?: string;\n\n  /**\n   * Curator override: this single asset's bytes come from a different upstream\n   * than the manifest-level `source`. Absent → inherit manifest `source` (or\n   * first-party when that is also absent).\n   */\n  source?: ManifestSource;\n\n  // ── Store-listing metadata (all optional; fall back to content frontmatter) ──\n  description?: string;\n  keywords?: string[];\n  category?: string;\n  license?: string;\n  homepage?: string;\n}\n\n/**\n * Upstream the bytes come from when a manifest curates a repo it does not own.\n * Absent → first-party (bytes live in the manifest's own repo).\n *\n * @docLink packages/core/publish-manifest#manifest-source\n */\nexport interface ManifestSource {\n  url: string;\n  /** 40-char commit the curated bytes are pinned to. */\n  commit?: string;\n}\n\n/**\n * Signing/attribution recorded when a manifest is published on behalf of others.\n *\n * @docLink packages/core/publish-manifest#manifest-provenance\n */\nexport interface ManifestProvenance {\n  curator: string;\n  signed_by?: string;\n}\n\n/**\n * Parsed `skaile.manifest.yaml` — what a repo publishes.\n *\n * @docLink packages/core/publish-manifest#sk-publish-manifest\n */\nexport interface SkPublishManifest {\n  publisher?: string;\n  version?: string;\n  /** Repo-level store defaults inherited by assets unless overridden per-entry. */\n  license?: string;\n  homepage?: string;\n  /**\n   * Repo-relative path prefixes holding dev-only assets — excluded from\n   * discovery/publish unless `--dev`. (Was `.skaile-source.yaml` `dev_paths`.)\n   */\n  dev_paths?: string[];\n  /**\n   * Curator mode: the single upstream all assets in this file come from. A\n   * per-asset `source` overrides it. Absent → first-party (own repo).\n   */\n  source?: ManifestSource;\n  /** Present when this manifest is curated/published on behalf of another author. */\n  provenance?: ManifestProvenance;\n  assets?: AssetEntry[];\n}\n\n/** Result of {@link decodeSkaileManifest}: the manifest plus any notes. */\nexport interface ManifestDecodeResult {\n  manifest: SkPublishManifest;\n  diagnostics: Diagnostic[];\n}\n\n/** The single fixed filename for a publish manifest. */\nexport const SKAILE_MANIFEST_FILENAME = \"skaile.manifest.yaml\";\n\n// ── Decode ──────────────────────────────────────────────────────────────────\n\nfunction parseSource(raw: unknown): ManifestSource | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const s = raw as Record<string, unknown>;\n  if (typeof s.url !== \"string\" || s.url.length === 0) return undefined;\n  const out: ManifestSource = { url: s.url };\n  if (typeof s.commit === \"string\" && s.commit.length > 0) out.commit = s.commit;\n  return out;\n}\n\nfunction parseProvenance(raw: unknown): ManifestProvenance | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const p = raw as Record<string, unknown>;\n  if (typeof p.curator !== \"string\" || p.curator.length === 0) return undefined;\n  const out: ManifestProvenance = { curator: p.curator };\n  if (typeof p.signed_by === \"string\" && p.signed_by.length > 0) out.signed_by = p.signed_by;\n  return out;\n}\n\n/** Parse `files:` as either `string[]` (globs) or `{path, sha256}[]` (granular). */\nfunction parseFiles(raw: unknown): string[] | ManifestFileEntry[] | undefined {\n  if (!Array.isArray(raw)) return undefined;\n  const strings: string[] = [];\n  const granular: ManifestFileEntry[] = [];\n  for (const item of raw) {\n    if (typeof item === \"string\") {\n      strings.push(item);\n    } else if (item && typeof item === \"object\" && !Array.isArray(item)) {\n      const f = item as Record<string, unknown>;\n      if (typeof f.path === \"string\" && typeof f.sha256 === \"string\") {\n        granular.push({ path: f.path, sha256: f.sha256 });\n      }\n    }\n  }\n  // A manifest uses one form per entry; if both somehow appear, granular wins\n  // (it is the verifiable form). Empty → undefined.\n  if (granular.length > 0) return granular;\n  if (strings.length > 0) return strings;\n  return undefined;\n}\n\n/** Parse the YAML root, returning either the mapping or an error diagnostic. */\nfunction parseManifestRoot(\n  text: string,\n): { ok: true; raw: Record<string, unknown> } | { ok: false; diagnostic: Diagnostic } {\n  let parsed: unknown;\n  try {\n    parsed = parse(text) ?? {};\n  } catch (err) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"yaml_syntax\",\n        severity: \"error\",\n        message: `Invalid YAML: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    };\n  }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    return {\n      ok: false,\n      diagnostic: {\n        code: \"non_object_root\",\n        severity: \"error\",\n        message: \"skaile.manifest.yaml must be a mapping at the top level.\",\n      },\n    };\n  }\n  return { ok: true, raw: parsed as Record<string, unknown> };\n}\n\n/**\n * Strip a SINGLE leading `@` from a publisher and, when one was removed, push a\n * `warning` diagnostic. The `@` is the scope sigil the ref formatter adds — an\n * authored `@acme` would otherwise index as `@@acme` and be un-addable. Bare\n * names are returned untouched.\n */\nfunction normalizePublisher(value: string, path: string, diagnostics: Diagnostic[]): string {\n  if (!value.startsWith(\"@\")) return value;\n  const stripped = value.slice(1);\n  diagnostics.push({\n    code: \"publisher_leading_sigil\",\n    severity: \"warning\",\n    message: `publisher \"${value}\": leading \"@\" is the scope sigil and is added automatically — use bare \"${stripped}\"`,\n    path,\n  });\n  return stripped;\n}\n\n/** Decode the manifest-level scalar/array/object fields onto `manifest`. */\nfunction decodeManifestFields(\n  raw: Record<string, unknown>,\n  manifest: SkPublishManifest,\n  diagnostics: Diagnostic[],\n): void {\n  if (typeof raw.publisher === \"string\" && raw.publisher.length > 0) {\n    manifest.publisher = normalizePublisher(raw.publisher, \"publisher\", diagnostics);\n  }\n  if (typeof raw.version === \"string\" && raw.version.length > 0) {\n    manifest.version = raw.version;\n  }\n  if (typeof raw.license === \"string\" && raw.license.length > 0) {\n    manifest.license = raw.license;\n  }\n  if (typeof raw.homepage === \"string\" && raw.homepage.length > 0) {\n    manifest.homepage = raw.homepage;\n  }\n  if (Array.isArray(raw.dev_paths)) {\n    const paths = raw.dev_paths.filter((p): p is string => typeof p === \"string\" && p.length > 0);\n    if (paths.length > 0) manifest.dev_paths = paths;\n  }\n  const source = parseSource(raw.source);\n  if (source) manifest.source = source;\n  const provenance = parseProvenance(raw.provenance);\n  if (provenance) manifest.provenance = provenance;\n}\n\n/**\n * Validate an asset's `dependencies` via `parseAssetRef`, pushing a `warning`\n * for each malformed ref. Returns the kept (valid) refs.\n */\nfunction decodeAssetDependencies(\n  raw: unknown,\n  kind: string,\n  name: string,\n  diagnostics: Diagnostic[],\n): string[] {\n  const deps: string[] = [];\n  if (!Array.isArray(raw)) return deps;\n  for (const dep of raw) {\n    if (typeof dep !== \"string\") continue;\n    try {\n      const ref = parseAssetRef(dep);\n      // The publisher follows the one slug rule, so an entry `library index` refuses is\n      // dropped here like every other malformed one (not left to fail discovery of the asset).\n      if (ref.publisher !== undefined && !isValidPublisher(ref.publisher)) {\n        throw new Error(`publisher \"${ref.publisher}\" — ${PUBLISHER_HINT}`);\n      }\n      deps.push(dep);\n    } catch (err) {\n      diagnostics.push({\n        code: \"malformed_dependency\",\n        severity: \"warning\",\n        message: `assets[${kind}:${name}].dependencies: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n        path: `assets.${kind}:${name}.dependencies`,\n      });\n    }\n  }\n  return deps;\n}\n\n/**\n * Decode one `assets[]` item into an {@link AssetEntry}, or `undefined` when the\n * item is not a mapping or lacks both `kind` and `name`. Pushes dependency\n * warnings to `diagnostics`.\n */\nfunction decodeAssetEntry(item: unknown, diagnostics: Diagnostic[]): AssetEntry | undefined {\n  if (!item || typeof item !== \"object\" || Array.isArray(item)) return undefined;\n  const a = item as Record<string, unknown>;\n  const kind = typeof a.kind === \"string\" ? a.kind : \"\";\n  const name = typeof a.name === \"string\" ? a.name : \"\";\n  if (!kind || !name) return undefined;\n  const entry: AssetEntry = { kind, name };\n  if (typeof a.root === \"string\") entry.root = a.root;\n  const files = parseFiles(a.files);\n  if (files) entry.files = files;\n  if (typeof a.version === \"string\") entry.version = a.version;\n  if (typeof a.publisher === \"string\")\n    entry.publisher = normalizePublisher(\n      a.publisher,\n      `assets.${kind}:${name}.publisher`,\n      diagnostics,\n    );\n  if (typeof a.sha256 === \"string\") entry.sha256 = a.sha256;\n  const assetSource = parseSource(a.source);\n  if (assetSource) entry.source = assetSource;\n\n  const deps = decodeAssetDependencies(a.dependencies, kind, name, diagnostics);\n  if (deps.length > 0) entry.dependencies = deps;\n\n  if (typeof a.description === \"string\") entry.description = a.description;\n  if (Array.isArray(a.keywords)) {\n    const kw = a.keywords.filter((k): k is string => typeof k === \"string\");\n    if (kw.length > 0) entry.keywords = kw;\n  }\n  if (typeof a.category === \"string\") entry.category = a.category;\n  if (typeof a.license === \"string\") entry.license = a.license;\n  if (typeof a.homepage === \"string\") entry.homepage = a.homepage;\n\n  return entry;\n}\n\n/** Decode the `assets[]` list onto `manifest`, collecting dependency warnings. */\nfunction decodeManifestAssets(\n  raw: Record<string, unknown>,\n  manifest: SkPublishManifest,\n  diagnostics: Diagnostic[],\n): void {\n  if (!Array.isArray(raw.assets)) return;\n  const entries: AssetEntry[] = [];\n  for (const item of raw.assets) {\n    const entry = decodeAssetEntry(item, diagnostics);\n    if (entry) entries.push(entry);\n  }\n  if (entries.length > 0) manifest.assets = entries;\n}\n\n/**\n * Decode `skaile.manifest.yaml` text into a {@link SkPublishManifest} plus\n * {@link Diagnostic}s. Total — never throws: a YAML syntax error or non-object\n * root is reported as an `error`-severity diagnostic with an empty manifest.\n * Malformed `assets[].dependencies` refs are reported as `warning`s (validated\n * via `parseAssetRef`) rather than silently dropped.\n *\n * Pair with {@link encodeSkaileManifest} for round-tripping.\n * @docLink packages/core/publish-manifest#decode-skaile-manifest\n */\nexport function decodeSkaileManifest(text: string): ManifestDecodeResult {\n  const root = parseManifestRoot(text);\n  if (!root.ok) {\n    return { manifest: {}, diagnostics: [root.diagnostic] };\n  }\n\n  const manifest: SkPublishManifest = {};\n  const diagnostics: Diagnostic[] = [];\n  decodeManifestFields(root.raw, manifest, diagnostics);\n  decodeManifestAssets(root.raw, manifest, diagnostics);\n\n  return { manifest, diagnostics };\n}\n\n// ── Encode ──────────────────────────────────────────────────────────────────\n\n/** Fixed top-level key order for {@link encodeSkaileManifest}. */\nconst MANIFEST_KEY_ORDER: (keyof SkPublishManifest)[] = [\n  \"publisher\",\n  \"version\",\n  \"license\",\n  \"homepage\",\n  \"dev_paths\",\n  \"source\",\n  \"provenance\",\n  \"assets\",\n];\n\n/** Fixed per-asset key order for {@link encodeSkaileManifest}. */\nexport const ASSET_KEY_ORDER: readonly (keyof AssetEntry)[] = [\n  \"kind\",\n  \"name\",\n  \"source\",\n  \"root\",\n  \"files\",\n  \"version\",\n  \"publisher\",\n  \"sha256\",\n  \"dependencies\",\n  \"description\",\n  \"keywords\",\n  \"category\",\n  \"license\",\n  \"homepage\",\n];\n\n/** An entry with its keys in canonical order, undefined fields dropped. */\nexport function orderedAsset(a: AssetEntry): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const key of ASSET_KEY_ORDER) {\n    const value = a[key];\n    if (value !== undefined) out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Encode a {@link SkPublishManifest} to canonical `skaile.manifest.yaml` text:\n * deterministic key order, only defined fields, `lineWidth: 120` (mirrors\n * `encodeSkaileYaml`).\n * @docLink packages/core/publish-manifest#encode-skaile-manifest\n */\nexport function encodeSkaileManifest(manifest: SkPublishManifest): string {\n  const out: Record<string, unknown> = {};\n  for (const key of MANIFEST_KEY_ORDER) {\n    const value = manifest[key];\n    if (value === undefined) continue;\n    if (key === \"assets\" && Array.isArray(value)) {\n      out.assets = (value as AssetEntry[]).map(orderedAsset);\n    } else {\n      out[key] = value;\n    }\n  }\n  return stringify(out, { lineWidth: 120 });\n}\n\n// ── File I/O ──────────────────────────────────────────────────────────────────\n\n/**\n * Load and decode `<dir>/skaile.manifest.yaml`. Returns `null` when the file is\n * absent or unparseable (mirrors `loadSkWorkspaceConfig`'s tolerant contract).\n * @docLink packages/core/publish-manifest#load-sk-publish-manifest\n */\nexport function loadSkPublishManifest(dir: string): SkPublishManifest | null {\n  const filePath = join(resolve(dir), SKAILE_MANIFEST_FILENAME);\n  if (!existsSync(filePath)) return null;\n  let raw: string;\n  try {\n    raw = readFileSync(filePath, \"utf-8\");\n  } catch {\n    return null;\n  }\n  const { manifest, diagnostics } = decodeSkaileManifest(raw);\n  if (diagnostics.some((d) => d.code === \"yaml_syntax\" || d.code === \"non_object_root\")) {\n    return null;\n  }\n  return manifest;\n}\n\n// ── Asset content hash ──────────────────────────────────────────────────────\n\n/** Hex SHA-256 of one file's bytes (the per-file `files[].sha256`). */\nexport function sha256Hex(bytes: Uint8Array): string {\n  return createHash(\"sha256\").update(bytes).digest(\"hex\");\n}\n\n/**\n * The one asset content hash, shared by every origin (library index, library\n * lock, git-source lock + provenance walker, store install manifest, author-pinned\n * `sha256`): SHA-256 (bare 64-hex) over `localeCompare`-sorted `<path>:<sha256>\\n`\n * rows, where each `sha256` is the file's own {@link sha256Hex}.\n *\n * `path` MUST be POSIX and relative to the root of the repository/library that\n * holds the asset (so `skills/foo/SKILL.md`, never `SKILL.md` relative to the\n * asset folder) — the path is folded into the digest, so a different base gives a\n * different hash for the same bytes.\n */\nexport function compositeSha256(files: ReadonlyArray<{ path: string; sha256: string }>): string {\n  const lines = files\n    .slice()\n    .sort((a, b) => a.path.localeCompare(b.path))\n    .map((f) => `${f.path}:${f.sha256}\\n`)\n    .join(\"\");\n  return createHash(\"sha256\").update(lines).digest(\"hex\");\n}\n\n/**\n * Directories never part of an asset's bytes: VCS, dependencies, per-project state, interpreter\n * and tool caches, virtual environments and editor folders. One list for the deploy file set and\n * the content hash, so a helper script or a test run inside a library (`__pycache__/`,\n * `.pytest_cache/`) never makes the lock drift.\n */\nconst NON_ASSET_DIRS = new Set([\n  \".git\",\n  \"node_modules\",\n  \".skaile\",\n  \"__pycache__\",\n  \".venv\",\n  \"venv\",\n  \".pytest_cache\",\n  \".mypy_cache\",\n  \".ruff_cache\",\n  \".idea\",\n  \".vscode\",\n]);\n\n/** File names never part of an asset's bytes (OS and interpreter leftovers). */\nconst NON_ASSET_FILES = new Set([\".DS_Store\", \"Thumbs.db\"]);\n\n/** `true` for a directory name no asset ships (see {@link NON_ASSET_DIRS}). */\nexport function isNonAssetDir(name: string): boolean {\n  return NON_ASSET_DIRS.has(name);\n}\n\n/**\n * `true` for a file name no asset ships: `.DS_Store`, `Thumbs.db`, `*.pyc`, `*.pyo`, a secret\n * ({@link isSecretFileName}: `.env*`, private keys, credential files), editor leftovers\n * (`*.swp`, `*.swo`, `*~`, `*.bak`) and `*.log`. The scaffolded library `.gitignore` ignores the\n * same names, so what import, deploy and the hash leave out is what the published repo lacks.\n */\nexport function isNonAssetFile(name: string): boolean {\n  return (\n    NON_ASSET_FILES.has(name) ||\n    name.endsWith(\".pyc\") ||\n    name.endsWith(\".pyo\") ||\n    name.endsWith(\".swp\") ||\n    name.endsWith(\".swo\") ||\n    name.endsWith(\"~\") ||\n    name.endsWith(\".bak\") ||\n    name.endsWith(\".log\") ||\n    isSecretFileName(name)\n  );\n}\n\n/** Committed `.env` templates: no secrets, so they stay part of the asset. */\nconst ENV_TEMPLATE_SUFFIXES = new Set([\".example\", \".sample\", \".template\", \".dist\"]);\n\n/**\n * `true` for a `.env` or `.env.*` file name that holds local secrets and is never shipped with\n * an asset. A template (`.env.example`, `.env.sample`, `.env.template`, `.env.dist`) is not one.\n */\nexport function isEnvFileName(name: string): boolean {\n  if (name === \".env\") return true;\n  if (!name.startsWith(\".env.\")) return false;\n  return !ENV_TEMPLATE_SUFFIXES.has(name.slice(\".env\".length));\n}\n\n/** Private key, certificate bundle and state-file extensions that never belong in a published library. */\nconst SECRET_FILE_SUFFIXES = [\".pem\", \".key\", \".p12\", \".pfx\", \".tfstate\", \".jks\", \".keystore\"];\n\n/** Patterns of secret file names that are not one fixed name, as `.gitignore` globs. */\nconst SECRET_FILE_GLOBS = [\"client_secret*.json\"];\n\n/** File names that hold a private key or a credential, whatever sits next to them. */\nconst SECRET_FILE_NAMES = new Set([\n  \"id_rsa\",\n  \"id_dsa\",\n  \"id_ecdsa\",\n  \"id_ed25519\",\n  \".npmrc\",\n  \".netrc\",\n  \".envrc\",\n  \".pypirc\",\n  \".htpasswd\",\n  \".pgpass\",\n  \".my.cnf\",\n  \".dockercfg\",\n  \".boto\",\n  \".vault_pass\",\n  \".git-credentials\",\n  \"kubeconfig\",\n  \"wallet.dat\",\n  \"credentials\",\n  \"credentials.json\",\n  \"token.json\",\n  \"secret.txt\",\n  \"secrets.txt\",\n  \"api_key.txt\",\n  \"secrets.yaml\",\n  \"secrets.yml\",\n  \"secrets.json\",\n  \"service-account.json\",\n]);\n\n/**\n * `true` for a file name that holds a secret: a local `.env` ({@link isEnvFileName}), a private\n * key, a certificate bundle, a keystore, a Terraform state file, or a credential file (`.npmrc`,\n * `.netrc`, `.envrc`, `.pypirc`, `.htpasswd`, `.pgpass`, `.dockercfg`, `.git-credentials`,\n * `kubeconfig`, `credentials`, `credentials.json`, `client_secret*.json`, `token.json`,\n * `secrets.yaml`, `service-account.json`, ...: the list is in this file). One list for the\n * publish plan, the scaffolded `.gitignore`, the deploy file set and the content hash: `add` and\n * `install` never copy these (p1040, p1202).\n */\nexport function isSecretFileName(name: string): boolean {\n  return (\n    isEnvFileName(name) ||\n    SECRET_FILE_NAMES.has(name) ||\n    SECRET_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix)) ||\n    (name.startsWith(\"client_secret\") && name.endsWith(\".json\"))\n  );\n}\n\n/**\n * The `.gitignore` `library create` scaffolds: the names {@link isNonAssetFile} and\n * {@link NON_ASSET_DIRS} leave out of an asset (OS files, caches, editor leftovers, secrets), so\n * what the library publishes is what a deploy ships: `.env*` and every name of\n * {@link isSecretFileName}. `.env` templates stay.\n */\nexport const LIBRARY_GITIGNORE = [\n  \".DS_Store\",\n  \"Thumbs.db\",\n  \"node_modules/\",\n  \"__pycache__/\",\n  \"*.pyc\",\n  \"*.pyo\",\n  \"*.log\",\n  \"*.swp\",\n  \"*.swo\",\n  \"*~\",\n  \"*.bak\",\n  \".env\",\n  \".env.*\",\n  ...SECRET_FILE_NAMES,\n  ...SECRET_FILE_SUFFIXES.map((suffix) => `*${suffix}`),\n  ...SECRET_FILE_GLOBS,\n  ...[...ENV_TEMPLATE_SUFFIXES].map((suffix) => `!.env${suffix}`),\n  \"\",\n].join(\"\\n\");\n\n/**\n * `true` when a POSIX path (relative to anything) lies in a {@link isNonAssetDir} directory\n * or names a {@link isNonAssetFile} file. Symlinks are not part of an asset either, but a path\n * string cannot tell: walkers skip them through `Dirent.isFile()`.\n */\nexport function isNonAssetPath(posixPath: string): boolean {\n  const parts = posixPath.split(\"/\");\n  const last = parts.pop() ?? \"\";\n  return isNonAssetFile(last) || parts.some(isNonAssetDir);\n}\n\n/**\n * Every file under `absDir`, as sorted POSIX paths relative to `absDir`,\n * skipping {@link NON_ASSET_DIRS}, {@link NON_ASSET_FILES} and `*.pyc`. The single enumeration\n * behind a `root:` manifest entry — used by the provenance walker and by discovery, so both\n * hash the same file list. Symlinks are skipped.\n */\nexport function listAssetFiles(absDir: string): string[] {\n  const out: string[] = [];\n  const walk = (dir: string, rel: string): void => {\n    let entries: Dirent[];\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const e of entries) {\n      const childRel = rel ? `${rel}/${e.name}` : e.name;\n      if (e.isDirectory()) {\n        if (!isNonAssetDir(e.name)) walk(join(dir, e.name), childRel);\n      } else if (e.isFile() && !isNonAssetFile(e.name)) {\n        out.push(childRel);\n      }\n    }\n  };\n  walk(absDir, \"\");\n  return out.sort();\n}\n\n/**\n * The one rule that turns a manifest entry's `files:` list into files (p1201), shared by the\n * disk walk ({@link expandManifestFiles}) and the tree-entries walk the store's catalog backend\n * uses ({@link expandManifestFilesFromPaths}). A plain path stays as written when it is a file;\n * a glob (`comp/*`, dot files included) becomes the files it matches. `unmatched` names every\n * plain path that is not a file (missing or a directory) and every glob that matches no file, so\n * a caller refuses the entry instead of listing nothing.\n */\nfunction expandWith(\n  patterns: readonly string[],\n  isFile: (rel: string) => boolean,\n  glob: (pattern: string) => string[],\n): { files: string[]; unmatched: string[] } {\n  const files = new Set<string>();\n  const unmatched: string[] = [];\n  for (const raw of patterns) {\n    const pattern = raw.replace(/\\\\/g, \"/\");\n    if (!fg.isDynamicPattern(pattern)) {\n      if (isFile(pattern)) files.add(pattern);\n      else unmatched.push(raw);\n      continue;\n    }\n    const hits = glob(pattern);\n    if (hits.length === 0) unmatched.push(`${raw} (matches no file)`);\n    for (const hit of hits) files.add(hit);\n  }\n  return { files: [...files].sort(), unmatched };\n}\n\n/**\n * Expand a manifest entry's `files:` list against `baseDir` on disk (POSIX paths relative to it):\n * what `validate`, the publish plan, `library index`, `add` and the lock hash share (p1201).\n */\nexport function expandManifestFiles(\n  baseDir: string,\n  patterns: readonly string[],\n): { files: string[]; unmatched: string[] } {\n  return expandWith(\n    patterns,\n    (rel) => {\n      try {\n        return statSync(join(baseDir, rel)).isFile();\n      } catch {\n        return false;\n      }\n    },\n    (pattern) => fg.sync(pattern, { cwd: baseDir, onlyFiles: true, dot: true }),\n  );\n}\n\n/**\n * {@link expandManifestFiles} over a flat list of file paths (POSIX, relative to the entry's\n * directory) instead of the disk: the tree-entries discovery of the store's catalog backend has\n * no files to walk. fast-glob matches against a virtual file system built from `paths`, so the\n * result is the one the disk walk gives for the same layout.\n */\nexport function expandManifestFilesFromPaths(\n  paths: Iterable<string>,\n  patterns: readonly string[],\n): { files: string[]; unmatched: string[] } {\n  const fileSet = new Set(paths);\n  const dirs = new Map<string, Set<string>>();\n  const link = (dir: string, child: string): void => {\n    const set = dirs.get(dir) ?? new Set<string>();\n    set.add(child);\n    dirs.set(dir, set);\n  };\n  for (const file of fileSet) {\n    const parts = file.split(\"/\");\n    for (let i = 0; i < parts.length; i++) {\n      link(i === 0 ? \"\" : parts.slice(0, i).join(\"/\"), parts[i]!);\n    }\n  }\n  const rel = (abs: string): string => abs.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  const stats = (abs: string) => {\n    const r = rel(abs);\n    const isFile = fileSet.has(r);\n    const isDir = r === \"\" || dirs.has(r);\n    if (!isFile && !isDir) {\n      const err = new Error(`ENOENT: ${abs}`) as NodeJS.ErrnoException;\n      err.code = \"ENOENT\";\n      throw err;\n    }\n    return {\n      isFile: () => isFile,\n      isDirectory: () => isDir,\n      isSymbolicLink: () => false,\n      isBlockDevice: () => false,\n      isCharacterDevice: () => false,\n      isFIFO: () => false,\n      isSocket: () => false,\n      mode: isDir ? 0o040000 : 0o100000,\n    };\n  };\n  const list = (abs: string) => {\n    const r = rel(abs);\n    return [...(dirs.get(r) ?? [])].sort().map((name) => {\n      const full = r === \"\" ? name : `${r}/${name}`;\n      return { name, ...stats(`/${full}`) };\n    });\n  };\n  const cb =\n    <A extends unknown[], T>(fn: (...a: A) => T) =>\n    (...args: unknown[]): void => {\n      const done = args.pop() as (e: Error | null, v?: T) => void;\n      try {\n        done(null, fn(...(args as A)));\n      } catch (err) {\n        done(err as Error);\n      }\n    };\n  const vfs = {\n    lstatSync: stats,\n    statSync: stats,\n    readdirSync: (abs: string, opts?: { withFileTypes?: boolean }) =>\n      opts?.withFileTypes ? list(abs) : list(abs).map((d) => d.name),\n    lstat: cb(stats),\n    stat: cb(stats),\n    readdir: cb((abs: string, opts?: { withFileTypes?: boolean }) =>\n      opts?.withFileTypes ? list(abs) : list(abs).map((d) => d.name),\n    ),\n  };\n  return expandWith(\n    patterns,\n    (r) => fileSet.has(r),\n    (pattern) =>\n      fg.sync(pattern, {\n        cwd: \"/\",\n        onlyFiles: true,\n        dot: true,\n        fs: vfs as unknown as NonNullable<Parameters<typeof fg.sync>[1]>[\"fs\"],\n      }),\n  );\n}\n\n/**\n * The files `git` would publish from the working tree at `root` (POSIX paths relative to `root`):\n * every tracked file plus every untracked file the ignore rules do not exclude, the set\n * `skaile library publish` ships. `null` when `root` is not itself a git working tree (no `.git`\n * entry in it) or git cannot list it: the caller then keeps every file on disk. A library that\n * lives in a subfolder of a bigger repository is not a git library: the ignore rules of the outer\n * repository say nothing about it. A tracked file that a `.gitignore` rule matches still counts.\n */\nexport function gitPublishedFiles(root: string): ReadonlySet<string> | null {\n  if (!existsSync(join(root, \".git\"))) return null;\n  const listed = spawnSync(\n    \"git\",\n    [\"-C\", root, \"ls-files\", \"-z\", \"--cached\", \"--others\", \"--exclude-standard\"],\n    { encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"], maxBuffer: 1 << 28 },\n  );\n  if (listed.error || listed.status !== 0) return null;\n  return new Set(listed.stdout.split(\"\\0\").filter((p) => p !== \"\"));\n}\n\n/**\n * `files` (relative to `assetRoot`) without those `git` would not publish ({@link gitPublishedFiles}\n * of `root`, `assetRoot` lies under it). `files` itself when `published` is `null`.\n */\nexport function onlyPublished(\n  published: ReadonlySet<string> | null,\n  root: string,\n  assetRoot: string,\n  files: readonly string[],\n): string[] {\n  if (published === null) return [...files];\n  const prefix = relative(root, assetRoot).split(sep).join(\"/\");\n  return files.filter((f) => published.has(prefix === \"\" ? f : `${prefix}/${f}`));\n}\n\n/**\n * Every symlink under `absDir` (sorted POSIX paths relative to `absDir`) that\n * {@link listAssetFiles} leaves out: the links a deploy drops. Walks the same\n * directories, never follows a link and skips {@link NON_ASSET_DIRS}.\n */\nexport function listSkippedSymlinks(absDir: string): string[] {\n  const out: string[] = [];\n  const walk = (dir: string, rel: string): void => {\n    let entries: Dirent[];\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const e of entries) {\n      const childRel = rel ? `${rel}/${e.name}` : e.name;\n      if (e.isSymbolicLink()) {\n        if (!isNonAssetFile(e.name)) out.push(childRel);\n      } else if (e.isDirectory() && !isNonAssetDir(e.name)) {\n        walk(join(dir, e.name), childRel);\n      }\n    }\n  };\n  walk(absDir, \"\");\n  return out.sort();\n}\n\n/** A symlink a library refuses: where it is and what it points at. */\nexport interface LibrarySymlink {\n  /** POSIX path relative to the scanned directory. */\n  path: string;\n  /** The link's own text (`readlink`), shown as written. */\n  target: string;\n}\n\n/**\n * The symlinks a library refuses. A library is plain files: `validate`, `library index`, the\n * publish plan, `library init --path` and `asset import` refuse a symlink that\n *\n * - sits inside an asset directory (one holding a `SKILL.md`, `agent.yaml`, … — a link to a\n *   file, to `/etc/hosts` or to `.` ships nothing a consumer can use, and a deploy drops it), or\n * - points at a directory that holds an asset manifest (`s1alias -> s1`): the scan would see\n *   one asset twice.\n *\n * With `opts.wholeTree` (a library: `git add -A` publishes every file in it) every symlink\n * anywhere in the tree is refused, also a root-level `README-link -> README.md`, a link to a\n * file or directory outside the library and a symlinked asset directory.\n *\n * Links are never followed; {@link NON_ASSET_DIRS} are not entered. Without `wholeTree` (a\n * project) a directory link outside every asset is not listed (a project's `mountPath` link or\n * deployed `.claude/skills/x -> …`; only the connector real-path check judges it, p1332), and the\n * scanned root itself does not count as an asset directory, so a `CLAUDE.md -> AGENTS.md` next to\n * a single-file asset at the root is fine.\n *\n * @param absDir Absolute directory to scan; a missing directory yields no links.\n * @param opts.rootIsAsset Treat `absDir` itself as an asset directory (the source of an\n *   `asset import`), so a link at its top level is listed too.\n * @param opts.wholeTree Refuse every symlink in the tree (a library).\n * @param opts.skipDirs Extra directory names not entered (a project's deployed harness folders).\n * @returns Links sorted by path.\n */\nexport function listLibrarySymlinks(\n  absDir: string,\n  opts: { rootIsAsset?: boolean; wholeTree?: boolean; skipDirs?: ReadonlySet<string> } = {},\n): LibrarySymlink[] {\n  try {\n    realpathSync(absDir);\n  } catch {\n    return [];\n  }\n  const skipped = (name: string): boolean =>\n    isNonAssetDir(name) || opts.skipDirs?.has(name) === true;\n  const out: LibrarySymlink[] = [];\n  const walk = (dir: string, rel: string, inAsset: boolean): void => {\n    let entries: Dirent[];\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    const here =\n      inAsset ||\n      (dir !== absDir &&\n        entries.some((e) => (e.isFile() || e.isSymbolicLink()) && isManifestName(e.name)));\n    for (const e of entries) {\n      const full = join(dir, e.name);\n      const childRel = rel ? `${rel}/${e.name}` : e.name;\n      if (e.isSymbolicLink()) {\n        if (isNonAssetFile(e.name) || skipped(e.name)) continue;\n        let refused = here || opts.wholeTree === true;\n        if (!refused) {\n          try {\n            // A link to a directory that holds an asset manifest is an asset directory that is\n            // not part of the tree (p520). Outside a library and an asset, any other directory\n            // link is the project's own business (a `mountPath` link, a data folder): only the\n            // connector real-path check judges it (p1332).\n            refused = statSync(full).isDirectory() && readdirSync(full).some(isManifestName);\n          } catch {\n            // Dangling outside an asset: nothing to alias.\n          }\n        }\n        if (refused) {\n          let target: string;\n          try {\n            target = readlinkSync(full);\n          } catch {\n            target = \"?\";\n          }\n          out.push({ path: childRel, target });\n        }\n      } else if (e.isDirectory() && !skipped(e.name)) {\n        walk(full, childRel, here);\n      }\n    }\n  };\n  walk(absDir, \"\", opts.rootIsAsset === true);\n  return out.sort((a, b) => a.path.localeCompare(b.path));\n}\n\n/**\n * The one refusal text for a {@link LibrarySymlink}, printed by `validate`, `library index`,\n * `library publish` and `asset import`.\n */\nexport function librarySymlinkMessage(link: LibrarySymlink): string {\n  return `${link.path} is a symlink to ${link.target}: a library holds plain files and never follows symlinks. Remove the link, or replace it with a copy of what it points at.`;\n}\n\n/**\n * Every secret file ({@link isSecretFileName}) under `absDir` (sorted POSIX paths relative to\n * `absDir`), in the directories {@link listAssetFiles} walks. A deploy leaves them out; the list\n * lets `add` say so.\n */\nexport function listSecretFiles(absDir: string): string[] {\n  const out: string[] = [];\n  const walk = (dir: string, rel: string): void => {\n    let entries: Dirent[];\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const e of entries) {\n      const childRel = rel ? `${rel}/${e.name}` : e.name;\n      if (e.isFile() && isSecretFileName(e.name)) out.push(childRel);\n      else if (e.isDirectory() && !isNonAssetDir(e.name)) walk(join(dir, e.name), childRel);\n    }\n  };\n  walk(absDir, \"\");\n  return out.sort();\n}\n"]}

package/dist/{chunk-34C2EKWJ.js → chunk-UVVVR4XO.js}

@@ -1,5 +1,5 @@
-import { registryCredentialEnv } from './chunk-KY4UXX7M.js';
-import { mergeRegistries } from './chunk-MJHSLODD.js';
+import { registryCredentialEnv } from './chunk-F2GOZMRA.js';
+import { mergeRegistries } from './chunk-LSI2IVFT.js';
 import { createLogger } from './chunk-BOFL7GIF.js';
 import { EventEmitter } from 'events';
 
@@ -15,7 +15,7 @@ function toMergedRegistry(registry, layer = "session") {
   }
   return mergeRegistries([{ layer, providers: registry }]);
 }
-function registryDriverConfig(registry, options = {}) {
+function registryHarnessConfig(registry, options = {}) {
   const merged = toMergedRegistry(registry, "runtime");
   return {
     registry: merged,
@@ -31,10 +31,10 @@ function isAgentEffort(value) {
   return AGENT_EFFORT_LEVELS.includes(value);
 }
 var TOOL_ALLOWLIST_UNSUPPORTED = "This agent harness cannot enforce a tool allowlist";
-var AgentDriver = class extends EventEmitter {
+var AgentHarness = class extends EventEmitter {
   /**
-   * Preserve text-only callers; drivers must explicitly support attachments.
-   * A `toolAllowlist` is refused here: only a driver that overrides
+   * Preserve text-only callers; harnesses must explicitly support attachments.
+   * A `toolAllowlist` is refused here: only a harness that overrides
    * {@link enforcesToolAllowlist} may run a restricted turn.
    */
   promptInput(input) {
@@ -45,17 +45,17 @@ var AgentDriver = class extends EventEmitter {
   }
   /**
    * Whether {@link promptInput} enforces `AgentPromptInput.toolAllowlist` for
-   * the whole turn, subagents included. A driver that answers `false` must
+   * the whole turn, subagents included. A harness that answers `false` must
    * reject an input carrying one; the runner refuses such a prompt before it
-   * reaches the driver.
+   * reaches the harness.
    */
   get enforcesToolAllowlist() {
     return false;
   }
   /**
-   * The names in `allowlist` this driver does not recognize as a tool it could
+   * The names in `allowlist` this harness does not recognize as a tool it could
    * offer. The runner refuses a prompt whose allowlist names any, rather than
-   * guess. A driver that does not enforce allowlists recognizes none.
+   * guess. A harness that does not enforce allowlists recognizes none.
    */
   unknownAllowlistedTools(allowlist) {
     return [...allowlist];
@@ -64,7 +64,7 @@ var AgentDriver = class extends EventEmitter {
   get acceptsReplyAsPrompt() {
     return true;
   }
-  /** Stop the driver and await owned process/state cleanup when the harness supports it. */
+  /** Stop the harness and await owned process/state cleanup when the harness supports it. */
   async dispose() {
     this.kill();
   }
@@ -72,25 +72,25 @@ var AgentDriver = class extends EventEmitter {
   get runtimeSessionId() {
     return void 0;
   }
-  /** Slash commands discovered from the agent runtime. Override in drivers that support introspection. */
+  /** Slash commands discovered from the agent runtime. Override in harnesses that support introspection. */
   getSlashCommands() {
     return [];
   }
   // ── Interactive questions (AskUserQuestion) ──────────────────────────────
   /**
-   * `true` while the driver is paused on an interactive question and waiting
+   * `true` while the harness is paused on an interactive question and waiting
    * for the user's answer rather than a new prompt. The runner routes a
    * `reply` command to {@link answerQuestion} instead of {@link prompt} when
-   * this returns `true`. Drivers without interactive-question support return
+   * this returns `true`. Harnesses without interactive-question support return
    * `false` (the default), so a `reply` falls back to `prompt`.
    */
   hasPendingQuestion() {
     return false;
   }
   /**
-   * Deliver the user's answer to the question the driver is currently paused
+   * Deliver the user's answer to the question the harness is currently paused
    * on. This resumes the in-flight turn — it does NOT start a new one. When a
-   * single tool call asks several questions, the driver resolves the underlying
+   * single tool call asks several questions, the harness resolves the underlying
    * call only once every sub-question has an answer.
    *
    * @param answer - The user's reply text (an option label, free text, or for
@@ -106,22 +106,22 @@ var AgentDriver = class extends EventEmitter {
     return false;
   }
   /**
-   * Apply this driver's rule for a new prompt that meets a pending question,
+   * Apply this harness's rule for a new prompt that meets a pending question,
    * ahead of the prompt itself. The runner queues a prompt behind the turn in
    * flight, so a turn paused on a question would otherwise hold that prompt
-   * until the user answered. Drivers whose `prompt()` cancels the question
+   * until the user answered. Harnesses whose `prompt()` cancels the question
    * (claude-sdk, omp) do the same here; the default keeps the question.
    */
   supersedePendingQuestion() {
   }
   // ── Live reconfiguration ────────────────────────────────────────────────
   /**
-   * Live-update driver configuration. `ok: true` means effective from the next
+   * Live-update harness configuration. `ok: true` means effective from the next
    * turn: the next turn runs on the new settings, by live switch, query recycle
    * or respawn, and the host needs no restart. A turn in progress finishes on
    * the old settings. Only model/thinking/effort are reconfigurable mid-session.
    *
-   * Drivers that can honour that promise build a `ReconfigureLedger` and
+   * Harnesses that can honour that promise build a `ReconfigureLedger` and
    * delegate to it; it owns the model scope rule, ordering, drift and rollback.
    * The base implementation answers `not_supported`.
    */
@@ -130,11 +130,11 @@ var AgentDriver = class extends EventEmitter {
     return Promise.resolve({
       ok: false,
       code: "not_supported",
-      message: `The ${this.driverInfo.id} driver cannot change ${fields} live; the change applies when the session next starts.`
+      message: `The ${this.harnessInfo.id} harness cannot change ${fields} live; the change applies when the session next starts.`
     });
   }
   /**
-   * Returns the model identifier currently configured on this driver.
+   * Returns the model identifier currently configured on this harness.
    * Subclasses that store config locally should override this.
    */
   getModel() {
@@ -145,18 +145,18 @@ var AgentDriver = class extends EventEmitter {
    * `Date.now()` of the harness's most recent sign of life, counting messages
    * that emit no `agent-event` (thinking deltas, rate-limit telemetry, API
    * retries). A stall check reads it alongside the events it sees. `null` when
-   * the driver does not track it.
+   * the harness does not track it.
    */
   lastActivityAt() {
     return null;
   }
   /**
    * Returns the token usage from the most recent completed turn.
-   * Returns `null` if usage data is unavailable (e.g. driver doesn't track it).
+   * Returns `null` if usage data is unavailable (e.g. harness doesn't track it).
    *
    * Widened in 3.1.0 to return the full `TokenUsage` shape (input / output /
    * cache-read / cache-creation / reasoning). All fields are optional so
-   * drivers can populate just what their provider reports. Existing callers
+   * harnesses can populate just what their provider reports. Existing callers
    * that read only `inputTokens` / `outputTokens` keep working — those fields
    * are still present and carry the same semantics as before.
    */
@@ -173,11 +173,11 @@ var AgentDriver = class extends EventEmitter {
    * (compaction thresholds) must prefer this; callers billing a turn
    * (usage ledgers, the `finished` event) must keep using `getTokenUsage()`.
    *
-   * Returns `null` both when the driver cannot report a per-call figure at all
+   * Returns `null` both when the harness cannot report a per-call figure at all
    * and when it can but has no reading yet. Falling back to `getTokenUsage()`
-   * is safe in either case only because a driver clears the two in lockstep: no
+   * is safe in either case only because a harness clears the two in lockstep: no
    * reading means no API call landed, so there is no cumulative usage to
-   * overstate. A driver implementing this must preserve that invariant.
+   * overstate. A harness implementing this must preserve that invariant.
    */
   getContextTokens() {
     return null;
@@ -190,8 +190,8 @@ var AgentDriver = class extends EventEmitter {
     return null;
   }
   /**
-   * What the driver can measure natively about its context window, in the
-   * neutral {@link DriverContextReport} shape, or `null` when it measures
+   * What the harness can measure natively about its context window, in the
+   * neutral {@link HarnessContextReport} shape, or `null` when it measures
    * nothing beyond {@link getContextTokens} / {@link getContextWindow}.
    *
    * `detail: "full"` (the default) may be expensive — claude-sdk issues
@@ -205,8 +205,8 @@ var AgentDriver = class extends EventEmitter {
     return null;
   }
   /**
-   * Returns the list of models available to this driver without starting a session.
-   * Drivers that can enumerate their own models override this method.
+   * Returns the list of models available to this harness without starting a session.
+   * Harnesses that can enumerate their own models override this method.
    * Returns an empty array by default.
    */
   async listModels() {
@@ -218,8 +218,8 @@ var AgentDriver = class extends EventEmitter {
   _activeTurnSpan;
   _turnStartTime;
   /**
-   * Attach a telemetry provider and active trace to this driver.
-   * Called by the runner after creating the driver but before start().
+   * Attach a telemetry provider and active trace to this harness.
+   * Called by the runner after creating the harness but before start().
    */
   setTelemetry(provider, trace) {
     this._telemetry = provider;
@@ -243,7 +243,7 @@ var AgentDriver = class extends EventEmitter {
   /**
    * End the current turn span with generation data.
    * Called by the runner after agent_end. Model and provider are passed
-   * explicitly — the driver base class does not access config directly.
+   * explicitly — the harness base class does not access config directly.
    */
   endTurnSpan(result) {
     if (!this._telemetry || !this._activeTurnSpan) return;
@@ -268,6 +268,6 @@ var AgentDriver = class extends EventEmitter {
   }
 };
 
-export { AGENT_EFFORT_LEVELS, AgentDriver, TOOL_ALLOWLIST_UNSUPPORTED, getBridgeLogger, registryDriverConfig, toAgentEffort, toMergedRegistry };
-//# sourceMappingURL=chunk-34C2EKWJ.js.map
-//# sourceMappingURL=chunk-34C2EKWJ.js.map
+export { AGENT_EFFORT_LEVELS, AgentHarness, TOOL_ALLOWLIST_UNSUPPORTED, getBridgeLogger, registryHarnessConfig, toAgentEffort, toMergedRegistry };
+//# sourceMappingURL=chunk-UVVVR4XO.js.map
+//# sourceMappingURL=chunk-UVVVR4XO.js.map