@skaile/workspaces 5.18.1 → 6.0.0

package/dist/chunk-34C2EKWJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../bridge/src/logger.ts","../bridge/src/provider-registry-derive.ts","../bridge/src/types.ts"],"names":[],"mappings":";;;;;;AAuBO,SAAS,gBAAgB,OAAA,EAAyB;AACvD,EAAA,OAAO,YAAA,CAAa,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,CAAA;AACjD;;;ACFO,SAAS,gBAAA,CACd,QAAA,EACA,KAAA,GAA2B,SAAA,EACD;AAC1B,EAAA,IAAI,KAAA,CAAM,OAAA,CAAS,QAAA,CAAsC,KAAK,CAAA,EAAG;AAC/D,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAO,gBAAgB,CAAC,EAAE,OAAO,SAAA,EAAW,QAAA,EAAgC,CAAC,CAAA;AAC/E;AAYO,SAAS,oBAAA,CACd,QAAA,EACA,OAAA,GAAqC,EAAC,EACkD;AACxF,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,QAAA,EAAU,SAAS,CAAA;AACnD,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,MAAA;AAAA,IACV,GAAA,EAAK,qBAAA,CAAsB,MAAA,EAAQ,OAAO,CAAA;AAAA,IAC1C,GAAI,QAAQ,UAAA,GAAa,EAAE,UAAU,OAAA,CAAQ,UAAA,KAAe;AAAC,GAC/D;AACF;AC+UO,IAAM,sBAAsB,CAAC,KAAA,EAAO,QAAA,EAAU,MAAA,EAAQ,SAAS,KAAK;AAQpE,SAAS,cAAc,KAAA,EAAyC;AACrE,EAAA,OAAO,aAAA,CAAc,KAAK,CAAA,GAAI,KAAA,GAAQ,MAAA;AACxC;AAEA,SAAS,cAAc,KAAA,EAAsC;AAC3D,EAAA,OAAQ,mBAAA,CAA2C,SAAS,KAAK,CAAA;AACnE;AAgfO,IAAM,0BAAA,GAA6B;AA2BnC,IAAe,WAAA,GAAf,cAAmC,YAAA,CAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BrD,YAAY,KAAA,EAAwC;AAClD,IAAA,IAAI,MAAM,aAAA,KAAkB,MAAA;AAC1B,MAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,0BAA0B,CAAC,CAAA;AAC7D,IAAA,IAAI,KAAA,CAAM,aAAa,MAAA,EAAQ,OAAO,QAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AAC9F,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,qBAAA,GAAiC;AACnC,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,wBAAwB,SAAA,EAAwC;AAC9D,IAAA,OAAO,CAAC,GAAG,SAAS,CAAA;AAAA,EACtB;AAAA;AAAA,EAGA,IAAI,oBAAA,GAAgC;AAClC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAmBA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAA,CAAK,IAAA,EAAK;AAAA,EACZ;AAAA;AAAA,EAMA,IAAI,gBAAA,GAAuC;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA,EAGA,gBAAA,GAAuC;AACrC,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,kBAAA,GAA8B;AAC5B,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,cAAA,CAAe,MAAA,EAAgB,QAAA,EAAmB,SAAA,EAA6B;AAI7E,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,wBAAA,GAAiC;AAAA,EAEjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,YAAY,KAAA,EAAsD;AAChE,IAAA,MAAM,SAAS,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,KAAK,IAAI,CAAA;AAC3C,IAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,MACrB,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA,EAAM,eAAA;AAAA,MACN,SAAS,CAAA,IAAA,EAAO,IAAA,CAAK,UAAA,CAAW,EAAE,yBAAyB,MAAM,CAAA,uDAAA;AAAA,KAClE,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,GAA+B;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,cAAA,GAAgC;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAA,GAAmC;AACjC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,gBAAA,GAAkC;AAChC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAA,GAAkC;AAChC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,sBAAsB,KAAA,EAEY;AACtC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,UAAA,GAAoC;AACxC,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA,EAWU,UAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACF,cAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMR,YAAA,CAAa,UAA6B,KAAA,EAAoB;AAC5D,IAAA,IAAA,CAAK,UAAA,GAAa,QAAA;AAClB,IAAA,IAAA,CAAK,YAAA,GAAe,KAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAA,CACE,QACA,KAAA,EACkB;AAClB,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,IAAA,CAAK,cAAc,OAAO,MAAA;AACnD,IAAA,IAAA,CAAK,cAAA,GAAiB,KAAK,GAAA,EAAI;AAC/B,IAAA,IAAA,CAAK,kBAAkB,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU,MAAA,IAAU,KAAK,YAAA,EAAc;AAAA,MAC5E,IAAA,EAAM,gBAAA;AAAA,MACN,IAAA,EAAM,gBAAA;AAAA,MACN,UAAA,EAAY;AAAA,KACb,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,MAAA,EAOH;AACP,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,eAAA,EAAiB;AAC/C,IAAA,MAAM,aAAa,IAAA,CAAK,cAAA,GAAiB,KAAK,GAAA,EAAI,GAAI,KAAK,cAAA,GAAiB,CAAA;AAE5E,IAAA,IAAI,MAAA,EAAQ,WAAA,KAAgB,MAAA,IAAa,MAAA,EAAQ,iBAAiB,MAAA,EAAW;AAC3E,MAAA,IAAA,CAAK,UAAA,CAAW,aAAA,CAAc,IAAA,CAAK,eAAA,EAAiB;AAAA,QAClD,KAAA,EAAO,QAAQ,KAAA,IAAS,SAAA;AAAA,QACxB,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA;AAAA,QAC9B,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,cAAc,MAAA,CAAO,YAAA;AAAA,QACrB,UAAA;AAAA,QACA,YAAY,MAAA,CAAO;AAAA,OACpB,CAAA;AAAA,IACH;AAEA,IAAA,IAAA,CAAK,UAAA,CAAW,OAAA,CAAQ,IAAA,CAAK,eAAA,EAAiB;AAAA,MAC5C,MAAA,EAAQ,MAAA,EAAQ,KAAA,GAAQ,OAAA,GAAU,IAAA;AAAA,MAClC,OAAO,MAAA,EAAQ,KAAA;AAAA,MACf,UAAA,EAAY,EAAE,yBAAA,EAA2B,UAAA;AAAW,KACrD,CAAA;AAED,IAAA,IAAA,CAAK,eAAA,GAAkB,MAAA;AACvB,IAAA,IAAA,CAAK,cAAA,GAAiB,MAAA;AAAA,EACxB;AACF","file":"chunk-34C2EKWJ.js","sourcesContent":["/**\n * Bridge-layer logger factory.\n *\n * Each driver creates its own Logger via `getBridgeLogger(subkind)` at\n * construction time. Falls back to an off-mode Logger (stdout only) when\n * no LogStore is registered — see @skaile/workspaces/core/logging for details.\n */\n\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\nimport type { Logger } from \"@skaile/workspaces/types\";\n\n/**\n * Construct a bridge-scoped Logger for a given driver subkind.\n *\n * Creates a `Logger` with `kind: \"bridge\"` and the specified `subkind`. Falls back to\n * an off-mode Logger (stdout only) when no `LogStore` is registered — see\n * `@skaile/workspaces/core/logging` for details. Each driver calls this once at construction\n * time; never re-construct per call.\n *\n * @param subkind - Driver id, e.g. `\"claude-sdk\"`, `\"omp\"`, `\"echo\"`, `\"codex\"`.\n * @returns A `Logger` scoped to `bridge:<subkind>`.\n * @docLink packages/bridge/api-reference#logger\n */\nexport function getBridgeLogger(subkind: string): Logger {\n  return createLogger({ kind: \"bridge\", subkind });\n}\n","/**\n * The two shaping helpers every registry consumer needs.\n *\n * The legacy provider axis — `provider` / `cloud` / `cloud_config` /\n * `cloudSecrets` — is gone from the runtime, and so is the user-local\n * `settings.json` `apiKeys{}` map: a session carries an AI provider registry\n * and a model selector, nothing else. Credentials are named by a\n * `credential.ref` and resolved into the child environment; no literal secret\n * ever enters an entry.\n */\n\nimport {\n  type AIProviderLayerId,\n  type AIProviderRegistry,\n  type MergedAIProviderRegistry,\n  mergeRegistries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport {\n  type RegistryCredentialOptions,\n  registryCredentialEnv,\n} from \"./provider-materialize/credential-env.js\";\n\n/** Turn any registry shape into the merged view, without re-merging one. */\nexport function toMergedRegistry(\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n  layer: AIProviderLayerId = \"session\",\n): MergedAIProviderRegistry {\n  if (Array.isArray((registry as MergedAIProviderRegistry).order)) {\n    return registry as MergedAIProviderRegistry;\n  }\n  return mergeRegistries([{ layer, providers: registry as AIProviderRegistry }]);\n}\n\n/**\n * The `AgentConfig` slice a `DriverTarget.listModels` closure builds its\n * throwaway driver from: the registry, the selector when the caller named one\n * entry, and the credentials as a child-environment fragment.\n *\n * The credentials have to ride `env`, not a side channel: a `platform:` or\n * `cmd:` reference resolves where the *caller* stands, and this process's own\n * environment cannot see it. `registryCredentialEnv` writes each one under\n * `SKAILE_AIP_<ID>_KEY`, which is the carrier every driver already consults.\n */\nexport function registryDriverConfig(\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n  options: RegistryCredentialOptions = {},\n): { registry: MergedAIProviderRegistry; env: Record<string, string>; modelRef?: string } {\n  const merged = toMergedRegistry(registry, \"runtime\");\n  return {\n    registry: merged,\n    env: registryCredentialEnv(merged, options),\n    ...(options.providerId ? { modelRef: options.providerId } : {}),\n  };\n}\n","import { EventEmitter } from \"node:events\";\nimport type { Span, TelemetryProvider, Trace } from \"@skaile/workspaces/telemetry\";\nimport type {\n  AgentPromptInput,\n  Capability,\n  CredentialMint,\n  CodexCredentialDelivery,\n  ContextUsageDetail,\n  DriverContextReport,\n  DriverInfo,\n  ErrorRetryReason,\n  CodexSubscriptionRefreshInput,\n  CodexSubscriptionRefreshResult,\n  FlowExecution,\n  ModelTokenUsage,\n  RenderInvokedEvent,\n  TokenUsage,\n} from \"@skaile/workspaces/types\";\nimport type { CodexServerRequestHandlers } from \"./codex-app-server.js\";\nexport type { AgentPromptInput } from \"@skaile/workspaces/types\";\nimport type { MergedAIProviderRegistry } from \"@skaile/workspaces/core/provider-registry\";\nimport type { ModelEntry } from \"./models.js\";\n\n/**\n * Test-only hook injected by the runner so a no-LLM driver (the echo driver's\n * scripted-flow mode) can read flow state and drive flow-adapter mutations\n * without an SDK/MCP round-trip. The runner wires this in `createActiveFlow`\n * from the active FlowAdapter + handle.\n *\n * This is an internal runner↔driver interface — NOT part of any wire\n * protocol or flow contract. Production drivers ignore it.\n *\n * @see packages/bridge/drivers/echo — scripted-flow mode\n * @since 3.6.0\n */\nexport interface FlowTestDriverHook {\n  /** Current flow execution snapshot, or `null` when no flow is active. */\n  getState(): FlowExecution | null;\n  /**\n   * Execute a flow-adapter operation (`start_node`, `request_approval`,\n   * `complete_node`, `request_input`, `skip_node`, `fail_node`, …). Returns\n   * the adapter's JSON string result (or rejects on an illegal transition).\n   */\n  execute(op: string, args: Record<string, unknown>): Promise<string>;\n  /**\n   * Node IDs marked as mandatory approval gates. The scripted policy resolves\n   * `auto` to `request_approval` for these even in autonomous mode, so hosts\n   * can drive a mandatory gate deterministically. Optional — absent hooks\n   * behave as if no node is mandatory.\n   */\n  mandatoryGates?(): string[];\n}\n\n/**\n * Minimal LLM tool descriptor used by the capability dispatch path. Mirrors\n * the runner's `LLMTool` shape so drivers can consume registry output without\n * importing `@skaile/workspaces/runner` (which would create a circular dep).\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/bridge/concepts#bridge-capability-tool\n */\nexport interface BridgeCapabilityTool {\n  /** Capability name; used as the LLM-visible tool name. */\n  name: string;\n  /** Human/LLM-readable description. */\n  description: string;\n  /** JSON Schema for the tool's input parameters. */\n  parameters: Record<string, unknown>;\n}\n\n/**\n * Render-cap event emission callback used by the bridge when the LLM invokes\n * a capability that carries a `render` spec. The runner provides the actual\n * sink (transport.send / sendEvent); the bridge only emits.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/bridge/concepts#bridge-render-emit\n */\nexport type BridgeRenderEmit = (event: RenderInvokedEvent) => void;\n\n/**\n * Text-event emission callback for render-capability fallbacks. When a\n * `RenderCapability` carries `render.fallback` and the LLM invokes it, the\n * bridge substitutes `{{prop}}` placeholders (top-level keys of `props`,\n * optional dotted-path traversal `{{user.name}}`) and pushes the rendered\n * string through this callback so clients without a render layer still see\n * a textual representation. No-op when `fallback` is absent.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/bridge/concepts#bridge-text-emit\n */\nexport type BridgeTextEmit = (text: string) => void;\n\n/**\n * Bundle of capability dispatch hooks. Registered into the driver via\n * `AgentConfig.capabilities`; the driver routes registered LLM tool calls\n * back into `invoke()` instead of using its native dispatch path.\n *\n * The runner constructs this from a `CapabilityRegistry` instance and threads\n * it through `createAgentSession()`. Drivers that don't yet implement\n * capability dispatch ignore the field — legacy v1 paths stay intact.\n *\n * @category Capabilities\n * @since 2.0.0\n * @docLink packages/bridge/concepts#bridge-capability-hooks\n */\nexport interface BridgeCapabilityHooks {\n  /** Build the LLM tool descriptor list from the registry. Called per turn so registration changes take effect. */\n  composeTools(): BridgeCapabilityTool[];\n  /** Resolve a wire-format Capability descriptor by name. Used by the bridge to inspect `fireAndForget` / `render`. */\n  resolve(name: string): Capability | null;\n  /**\n   * Validate input + dispatch through the registry. Logging is wired by the\n   * registry.\n   *\n   * `callId` is the per-dispatch id minted by `dispatchCapability`. It MUST be\n   * unique per process (never a driver/provider tool-call id, which only the\n   * model backend keeps unique): it is the `render_invoked.callId`, the\n   * registry's log correlation id, the handler's `ctx.callId` and — for client\n   * capabilities — the `capability_invoked.callId` keying the runner's pending\n   * map, so a reused id would let a late `capability_result` for a timed-out\n   * call resolve a later call. Callers without one omit it and the registry\n   * generates a fresh id.\n   */\n  invoke(name: string, input: unknown, signal?: AbortSignal, callId?: string): Promise<unknown>;\n  /** Subscribe to registry changes; callback carries no credentials or tool payloads. */\n  onToolsChanged?(listener: () => void): () => void;\n  /** Emit a render-invoked event. The runner forwards via the WebSocket transport. */\n  emitRender?: BridgeRenderEmit;\n  /** Emit a text fallback for render capabilities with `render.fallback`. */\n  emitText?: BridgeTextEmit;\n  /** Session id passed through to the runner's per-handler logger. */\n  sessionId: string;\n}\n\n/**\n * Static metadata for a registered agent driver (the harness it drives).\n *\n * Declared once in `@skaile/workspaces/types` — it is protocol surface (the\n * platform reads `surfaces` to decide which AI provider registry entries a\n * driver can serve) and was previously duplicated here field-for-field.\n *\n * Returned by {@link listDrivers} and exposed on every {@link AgentDriver}\n * instance via `driverInfo`.\n *\n * @docLink packages/bridge/concepts#driver-info\n */\nexport type { DriverInfo };\n\n/** Closed, passive managed-MCP observations. Counts saturate at 512. */\nexport interface CodexNativeMcpDiagnostics {\n  startupBeforeTurn: \"unknown\" | \"starting\" | \"ready\" | \"failed\" | \"cancelled\";\n  startupAtEnd: CodexNativeMcpDiagnostics[\"startupBeforeTurn\"];\n  toolsListBeforeTurn: number;\n  toolsListTotal: number;\n  toolsCallTotal: number;\n  nativeMcpToolItemCount: number;\n}\n\n/** Trusted session-local tool transport; fulfilled only after required tools are ready. */\nexport interface CodexToolTransport {\n  mcpServers: Record<string, Record<string, unknown>>;\n  /** Trusted runner server eligible for human native consent; must name its configured entry. */\n  approvalServerName?: string;\n  onServerRequest?: CodexServerRequestHandlers;\n  /** Revalidate the required live inventory before starting each turn. */\n  validate?(): Promise<void>;\n  /** Rebuild the native generation at idle when its advertised inventory is stale. */\n  needsReload?(): boolean;\n  instructions?: string;\n  /** Restrict model calls to the active turn and abort outstanding calls when it ends. */\n  beginTurn?(signal: AbortSignal): void;\n  /** Trusted private server binding and passive request-handler counters; never performs I/O. */\n  diagnostics?: {\n    serverName: string;\n    requestCounts(): { toolsListTotal: number; toolsCallTotal: number };\n  };\n  dispose(): Promise<void>;\n}\n\n/** Explicit managed instance inputs; none are inferred from ambient developer state. */\nexport interface CodexManagedRuntimeOptions {\n  executable: string;\n  /** Optional launcher arguments, for the caller-owned executable wrapper. */\n  executableArgs?: string[];\n  /** Private local filesystem state; the host must fence old native processes before reuse. */\n  privateDirectory: string;\n  /** Host-owned private mount containing every parent/child instance; denied to native tools. */\n  privateRoot: string;\n  environment: Record<string, string>;\n  credential: CodexCredentialDelivery;\n  instructionFiles?: string[];\n  skillsDirectory?: string;\n  prepareTools(signal: AbortSignal): Promise<CodexToolTransport>;\n  /**\n   * Passive snapshots before/after turns, plus final local counts after successful transport closure.\n   * No final snapshot is emitted on uncertain cleanup or a failed final counter read. Earlier snapshots\n   * are not proof of completed cleanup. Sink failures never affect native execution or cleanup.\n   */\n  onNativeMcpDiagnostics?(value: Readonly<CodexNativeMcpDiagnostics>): void | Promise<void>;\n  refreshCredential?: (\n    input: CodexSubscriptionRefreshInput,\n    signal: AbortSignal,\n  ) => Promise<CodexSubscriptionRefreshResult>;\n  requestTimeoutMs?: number;\n  turnTimeoutMs?: number;\n  /** Maximum native turns admitted by this instance; reserved for disposable one-turn children. */\n  nativeTurnBudget?: 1;\n  /** Human interaction deadline, bounded separately from ordinary RPCs. */\n  interactionTimeoutMs?: number;\n}\n\n/**\n * Codex-specific tuning options passed through `DriverOptions.codex`.\n *\n * @remarks These are forwarded verbatim to the Codex driver and have no effect on other drivers.\n * @docLink packages/bridge/concepts#codex-driver-options\n */\nexport interface CodexDriverOptions {\n  /** Omission retains the standalone SDK path; managed mode always requires App Server inputs. */\n  authSource?: \"local\" | \"managed\";\n  managedRuntime?: CodexManagedRuntimeOptions;\n  /** Controls whether Codex may auto-apply edits without user approval. */\n  approvalPolicy?: \"never\" | \"on-request\" | \"on-failure\" | \"untrusted\";\n  /** Filesystem sandbox level for the Codex process. */\n  sandboxMode?: \"read-only\" | \"workspace-write\" | \"danger-full-access\";\n  /** Reasoning budget passed to the model. */\n  reasoningEffort?: \"minimal\" | \"low\" | \"medium\" | \"high\" | \"xhigh\";\n  /** When `true`, the Codex sandbox is allowed to make outbound network requests. */\n  networkAccessEnabled?: boolean;\n  /** Extra directories made accessible to the Codex sandbox in addition to `cwd`. */\n  additionalDirectories?: string[];\n}\n\n/**\n * omp-specific options passed through `DriverOptions.omp`.\n *\n * They govern the session-private agent directory the omp adapter renders the\n * provider registry into (`omp-models-yml.ts`); every one of them has a\n * working default, so a caller that sets none still gets a correct session.\n *\n * @remarks Forwarded verbatim to the omp driver; no effect on other drivers.\n * @see PROVIDER-CONFIG-PLAN.md §2.3\n */\nexport interface OmpDriverOptions {\n  /**\n   * Explicit session-private agent directory for `PI_CODING_AGENT_DIR`.\n   * Defaults to `<cwd>/.omp/agent-home/<sessionId>`.\n   */\n  agentHome?: string;\n  /**\n   * Inherit the developer's own omp state (auth store, blobs, extensions) by\n   * symlinking {@link OmpDriverOptions.userAgentDir} into the session\n   * directory. Defaults to *on when that directory exists*, which is exactly\n   * the standalone case: a platform container has none, so its session starts\n   * empty. Set `false` to force an empty session directory regardless.\n   */\n  seedUserAgentDir?: boolean;\n  /** Seed source. Defaults to `~/.omp/agent`. */\n  userAgentDir?: string;\n}\n\n/**\n * Driver-specific configuration bag.\n *\n * Fields are keyed by driver ID so that callers can pass driver-specific options\n * through the common {@link AgentConfig} without breaking other drivers.\n *\n * @docLink packages/bridge/concepts#driver-options\n */\nexport interface DriverOptions {\n  /** Codex-specific options. Ignored by all other drivers. */\n  codex?: CodexDriverOptions;\n  /** omp-specific options. Ignored by all other drivers. */\n  omp?: OmpDriverOptions;\n}\n\n/**\n * What the driver tells the host about a turn blocked by an upstream usage\n * limit. Everything but `configId` is best-effort: the SDK reports the limit\n * window only on its structured telemetry, not on the error result text.\n *\n * @see AgentConfig.onLimitBlocked\n * @category Configuration\n * @since 3.9.0\n */\nexport interface LimitBlockedContext {\n  /** The AI provider config the blocked turn ran on (`\"\"` when unmediated). */\n  configId: string;\n  /** Upstream limit window (`five_hour`, `seven_day`, …) when reported. */\n  limitType?: string;\n  /** Epoch seconds at which the limit window resets, when reported. */\n  resetsAt?: number;\n  /** Fraction of the limit window consumed (0–1) when reported. */\n  utilization?: number;\n}\n\n/**\n * The host's verdict on a limit-blocked turn. `switched: true` is a promise\n * that a different seat's credential is already on disk — the driver acts on it\n * by respawning the CLI and replaying the prompt, so returning it without\n * having rewritten the credential file would just replay onto the dead seat.\n *\n * @see AgentConfig.onLimitBlocked\n * @category Configuration\n * @since 3.9.0\n */\nexport interface LimitFailoverResult {\n  /** Whether the session was repointed at a different AI provider config. */\n  switched: boolean;\n  /** The config id now in effect. Informational — used for logs. */\n  configId?: string;\n  /**\n   * Why no switch happened: `same-config`, `standalone`,\n   * `platform-omitted-config-id` (the mint succeeded but named no seat, so a\n   * re-resolution is indistinguishable from none), or a `CredentialMint`\n   * failure code. Diagnostic only — the driver branches on `switched`.\n   */\n  reason?: string;\n}\n\n/**\n * One observed AI-provider rejection, reported to the host for per-seat health\n * attribution. Fire-and-forget — see {@link AgentConfig.onProviderResponse}.\n *\n * @category Configuration\n * @since 3.9.0\n */\nexport interface ProviderResponseObservation {\n  /** 401 — the credential was rejected. 429 — an upstream rate/session limit. */\n  status: 401 | 429;\n  /** The AI provider config the observation is attributed to, when known. */\n  configId?: string;\n  /** Upstream limit window (`five_hour`, `seven_day`, …) when reported. */\n  limitType?: string;\n  /** Fraction of the limit window consumed (0–1) when reported. */\n  utilization?: number;\n  /** Epoch seconds at which the limit window resets, when reported. */\n  resetsAt?: number;\n  /**\n   * What the 429 was, when the driver recognised something narrower than a\n   * usage limit. `long-context-entitlement`: the account may not use a long\n   * (1M) context window; the seat is not out of quota. Diagnostic only — the\n   * driver still treats the rejection as before.\n   */\n  cause?: ProviderResponseCause;\n}\n\n/**\n * Why a 429 {@link ProviderResponseObservation} was rejected, when the driver\n * recognised it. Consumers must tolerate values they do not know.\n *\n * @category Configuration\n * @since 4.11.0\n */\nexport type ProviderResponseCause = \"long-context-entitlement\";\n\n/**\n * One upstream quota-window reading, reported to the host for every SDK\n * `rate_limit_event` — allowed, warning or rejected alike. Fire-and-forget —\n * see {@link AgentConfig.onProviderQuota}.\n *\n * @category Configuration\n * @since 4.1.0\n */\nexport interface ProviderQuotaObservation {\n  /** The AI provider config the reading is attributed to, when known. */\n  configId?: string;\n  /** Upstream window, verbatim (`five_hour`, `seven_day`, or a future value). */\n  window: string;\n  /** Upstream status, verbatim (`allowed`, `allowed_warning`, `rejected`, …). */\n  status: string;\n  /** Fraction of the window consumed (0–1); the SDK reports it on warnings and rejections only. */\n  utilization?: number;\n  /** Epoch seconds at which the window resets, when reported. */\n  resetsAt?: number;\n}\n\n/**\n * Reasoning effort levels a host may set. The platform sends all five, the\n * Agent SDK accepts all five, omp has a same-named thinking level for each, and\n * managed codex passes the value to its app server.\n *\n * @since 4.22.0\n */\nexport const AGENT_EFFORT_LEVELS = [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"] as const;\nexport type AgentEffort = (typeof AGENT_EFFORT_LEVELS)[number];\n\n/**\n * Narrow a free-form effort (the wire `agentConfig.effort`, a `skaile.yaml`\n * default) to an {@link AgentEffort}; anything else gives `undefined`, so an\n * unknown value never reaches a driver.\n */\nexport function toAgentEffort(value: unknown): AgentEffort | undefined {\n  return isAgentEffort(value) ? value : undefined;\n}\n\nfunction isAgentEffort(value: unknown): value is AgentEffort {\n  return (AGENT_EFFORT_LEVELS as readonly unknown[]).includes(value);\n}\n\n/**\n * Configuration passed to a driver when it is created via {@link createDriver}.\n *\n * All fields are shared across drivers; driver-specific behaviour is documented\n * per field. Fields that are silently ignored by a driver are marked accordingly.\n *\n * @docLink packages/bridge/concepts#agent-config\n */\nexport interface AgentConfig {\n  /** Absolute path to the working directory the agent operates in. */\n  cwd: string;\n  /**\n   * LLM model identifier (e.g. `\"claude-sonnet-4-5\"`, `\"gpt-4o\"`).\n   *\n   * The unscoped fallback: {@link AgentConfig.modelRef} is what a session\n   * normally carries, and this is what a driver falls back to when no\n   * registry entry resolved one.\n   */\n  model?: string;\n  /**\n   * The AI provider registry for this session — every endpoint the driver may\n   * address, already merged across the catalog / user / workspace / runtime /\n   * control-plane layers and in registry order.\n   *\n   * This is the *only* provider surface a driver reads. Entries reference\n   * their credential (`credential.ref`) and never carry the secret itself;\n   * the value reaches the child under `SKAILE_AIP_<ID>_KEY`\n   * (`provider-materialize/credential-env.ts`), which the session boundary\n   * puts in {@link AgentConfig.env}.\n   *\n   * Absent (or empty) means no endpoint was configured at all — the driver\n   * then falls back to whatever native auth it can discover on its own (a\n   * `claude` OAuth login, `codex login`, an ambient vendor key).\n   */\n  registry?: MergedAIProviderRegistry;\n  /**\n   * Model selector resolved against {@link AgentConfig.registry}:\n   * `\"<providerId>/<modelId>\"`, a bare `\"<modelId>\"` (first registry entry\n   * that maps it wins), or `\"@role\"`. Absent when no model was configured at\n   * all — the driver then applies its own default, exactly as it does for an\n   * absent `model`.\n   */\n  modelRef?: string;\n  /**\n   * The `skaile.yaml` `roles` table — role name → model selector\n   * (`{default: \"anthropic/opus\", smol: \"groq/llama-3.1-8b\"}`, §9.8). It is\n   * what `\"@role\"` in {@link AgentConfig.modelRef} expands through, and what\n   * a driver that supports per-role models materializes natively: omp renders\n   * it as `modelRoles` in its session-private `config.yml`, so `@smol` inside\n   * the session reaches a different provider than `@default`.\n   *\n   * Resolution is lenient: a role naming an entry this registry does not have\n   * is a warning, never a failure.\n   */\n  roles?: Record<string, string>;\n  /**\n   * Additional environment variables merged into the child process\n   * environment. The session boundary delivers resolved registry credentials\n   * here as `SKAILE_AIP_<ID>_KEY` entries; anything else the caller sets is\n   * merged over the driver's own allowlist, never instead of it.\n   */\n  env?: Record<string, string>;\n  /** Inline system prompt — written to .omp/system.md and passed via --append-system-prompt (omp driver) */\n  systemPrompt?: string;\n  /** Path to project .omp/ directory (PI_CODING_AGENT_DIR for omp driver) */\n  agentDir?: string;\n  /** SSH key path — injected as GIT_SSH_COMMAND */\n  sshKeyPath?: string;\n  /** Pre-assign a UUID as the session ID for a new session (claude-sdk: passed as sessionId option) */\n  sessionId?: string;\n  /** Resume this specific past session by UUID instead of starting fresh (claude-sdk: passed as resume option) */\n  resumeSessionId?: string;\n  /** Maximum agentic turns per query (claude-sdk: passed as maxTurns option) */\n  maxTurns?: number;\n  /**\n   * Whether the agent may act on its own (`auto`, the default) or has to be approved per tool\n   * call (`interactive`); the `agents.<id>.permissions.permission_mode` of the instance.\n   *\n   * - claude-sdk: `auto` runs under the SDK's `bypassPermissions`; `interactive` runs under\n   *   `default`, and a call the SDK does not auto-allow (a shell command, a file edit, an MCP\n   *   tool) pauses the turn on a `question` event with an `approval` card (`Approve once` /\n   *   `Deny`) answered through `answerQuestion`. With {@link AgentConfig.unattended} the call is\n   *   refused instead.\n   * - codex (standalone SDK path): `interactive` sets `approvalPolicy: \"on-request\"` instead of\n   *   `never`, unless `driverOptions.codex.approvalPolicy` is set. The standalone SDK path has no\n   *   way to show an approval card, so codex refuses a command that needs to leave its sandbox\n   *   instead of asking; nothing is ever approved. A managed codex session keeps the host's own\n   *   policy.\n   * - omp, echo and the subprocess CLI drivers (gemini, qwen, opencode, goose, continue): ignored.\n   */\n  permissionMode?: \"auto\" | \"interactive\";\n  /**\n   * The session has no one to answer a question (a nested `agent.run` role session, a\n   * single-shot `skaile run` without a terminal). With `permissionMode: \"interactive\"` a tool\n   * call that needs approval is then refused (claude-sdk) instead of waiting for a reply.\n   */\n  unattended?: boolean;\n  /** Agent name — selects a deployed sub-agent definition as the main agent identity.\n   *  claude-sdk: passed as `agent` option to query() → reads .claude/agents/<name>.md natively.\n   *  omp: ignored (omp uses agentDir/PI_CODING_AGENT_DIR instead). */\n  agentName?: string;\n  /** In-process SDK MCP servers for custom tool injection (Claude SDK only, ignored by other drivers) */\n  mcpServers?: Record<string, unknown>;\n  /** Tool restrictions from agent.yaml — applied to the main agent session */\n  tools?: {\n    /** Tool names that the agent is allowed to invoke. An empty array means no restriction. */\n    allowed?: string[];\n    /** Tool names that the agent is explicitly forbidden from invoking. */\n    denied?: string[];\n  };\n  /** Thinking mode for Claude models: adaptive (Claude decides), enabled (always think), disabled (no thinking). */\n  thinking?: \"adaptive\" | \"enabled\" | \"disabled\";\n  /** Reasoning effort level; each driver maps it to its own scale (see {@link AgentEffort}). */\n  effort?: AgentEffort;\n  /** Driver-specific configuration bag. */\n  driverOptions?: DriverOptions;\n  /**\n   * Protocol v2 capability dispatch hooks. When present, the driver uses the\n   * registry as the source of LLM tool definitions and routes invocations\n   * through `capabilities.invoke()`. Absent → legacy v1 path (existing\n   * mcpServers / native dispatch).\n   *\n   * @since 2.0.0\n   */\n  capabilities?: BridgeCapabilityHooks;\n  /**\n   * The platform's `AIProviderConfig.id` for the AI credential currently\n   * provisioned into this driver. The runner reads this off `AgentConfig`\n   * during 401 mediation and passes it as `configId` in\n   * `request_access_token { kind: 'ai-credentials' }`. The driver itself\n   * does not consume this field — only the runner uses it.\n   *\n   * Set by the platform agent-gateway in `ConfigureCommandV2` for mediated\n   * sessions. Standalone runners (CLI / forge / Claude plugin) leave it\n   * undefined; the runner falls back to surfacing the auth error to the\n   * user without mediating.\n   *\n   * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md`\n   * § \"Wire `aiProviderConfigId` end-to-end\".\n   *\n   * @since 3.3.0\n   */\n  aiProviderConfigId?: string;\n  /**\n   * Optional callback invoked by the driver when the underlying agent\n   * surfaces an `authentication_error`. In Protocol v3 the runner mediates\n   * the refresh via the `host.refresh_credential` capability and returns a\n   * typed {@link CredentialMint}. The driver inspects the discriminator:\n   *\n   *   - `mint.ok === true`: a fresh credential is now provisioned. The\n   *     driver re-attempts the in-flight prompt once.\n   *   - `mint.ok === false`: refresh failed (`code` carries a stable reason\n   *     such as `revoked`, `not-configured`, `provider-error`,\n   *     `backend-error`). The driver surfaces the original `AuthError` to\n   *     the caller.\n   *\n   * `args.configId` carries the platform `AIProviderConfig.id` the driver\n   * was provisioned with (mirrors {@link AgentConfig.aiProviderConfigId}).\n   * The runner uses it to scope the refresh to the correct AI credential.\n   *\n   * When omitted, the driver throws `AuthError` immediately as before\n   * (standalone CLI / forge mode — there is no platform mediator to ask).\n   *\n   * Centralising auth-retry inside the driver means every consumer of\n   * `driver.prompt(...)` (serve handler, compaction orchestrator, flow\n   * orchestrator, …) gets self-healing for free — there is no per-call-site\n   * wrapping.\n   *\n   * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`\n   * § \"host.refresh_credential capability\".\n   *\n   * @since 3.4.0\n   */\n  onAuthError?: (args: { configId: string }) => Promise<CredentialMint>;\n  /**\n   * Optional callback invoked by the driver when a turn is blocked by an\n   * upstream **usage limit** rather than a bad credential — the subscription\n   * five-hour / seven-day ceiling, or any `rate_limit` the classifier\n   * recognises. Called at most once per logical turn, and only after the\n   * blocked attempt has already failed, so it never runs mid-turn.\n   *\n   * The runner implements it by asking the platform to re-resolve the seat:\n   *\n   *   - `switched: true` — the session was repointed at a DIFFERENT AI\n   *     provider config and `.credentials.json` was rewritten. The driver\n   *     drops its query (forcing a fresh CLI spawn, which is what clears a\n   *     resident CLI's cached \"blocked until <reset>\" state — a hot file\n   *     rewrite alone does not) and replays the prompt once.\n   *   - `switched: false` — no alternative seat was available. The driver\n   *     surfaces the original limit error unchanged.\n   *\n   * Left unset by standalone runners (CLI / forge / Claude plugin): there is\n   * no platform mediator to re-resolve a seat, so the limit error surfaces\n   * exactly as it does today.\n   *\n   * Companion to {@link onAuthError}: that one covers 401s, this one covers\n   * the rejection path, which previously reached no failover at all\n   * (skaile-ai/workspaces#567, skaile-ai/platform#2976).\n   *\n   * @since 3.9.0\n   */\n  onLimitBlocked?: (ctx: LimitBlockedContext) => Promise<LimitFailoverResult>;\n  /**\n   * Optional fire-and-forget hook invoked when the driver observes a 401 or a\n   * 429 / subscription-limit rejection from the AI provider. The runner\n   * forwards it to the platform as a `provider_response_seen` event so the\n   * owning `AIProviderConfig`'s live health counters can be bumped — the cron\n   * health probe only samples auth, never capacity\n   * (skaile-ai/workspaces#368, skaile-ai/platform#3539).\n   *\n   * Never awaited and never retried; the driver swallows a throwing\n   * implementation so telemetry can never fail a turn.\n   *\n   * @since 3.9.0\n   */\n  onProviderResponse?: (observation: ProviderResponseObservation) => void;\n  /**\n   * Optional fire-and-forget hook invoked for every upstream quota-window\n   * reading (claude-sdk `rate_limit_event`), not only rejections. The runner\n   * forwards it as `provider_quota_observed`, which is the only quota signal\n   * the platform has for a seat whose token cannot read the OAuth usage\n   * endpoint (a `claude setup-token` seat).\n   *\n   * Never awaited and never retried; the driver swallows a throwing\n   * implementation so telemetry can never fail a turn. Unlike\n   * {@link onProviderResponse} it fires on every event, so dedupe at the host.\n   *\n   * @since 4.1.0\n   */\n  onProviderQuota?: (observation: ProviderQuotaObservation) => void;\n  /**\n   * Test-only flow driver hook. When present, the echo driver's scripted-flow\n   * mode uses it to advance flow nodes deterministically (no LLM). The runner\n   * injects it in `createActiveFlow`; every other driver ignores it.\n   *\n   * @see FlowTestDriverHook\n   * @since 3.6.0\n   */\n  flowTestDriver?: FlowTestDriverHook;\n}\n\n/**\n * A single message in an agent conversation.\n *\n * Emitted as part of {@link AgentEvent} variants (`message_start`, `message_update`, `message_end`).\n *\n * @docLink packages/bridge/concepts#agent-message\n */\nexport interface AgentMessage {\n  /** Originator of the message. */\n  role: \"user\" | \"assistant\" | \"tool\";\n  /** Message body — either a plain string or a list of typed content blocks. */\n  content: string | ContentBlock[];\n  /** Tool invocations made by the assistant in this message. */\n  toolCalls?: ToolCall[];\n  /** For `role === \"tool\"`: the name of the tool whose result this message carries. */\n  toolName?: string;\n  /** For `role === \"tool\"`: `true` when the tool returned an error. */\n  isError?: boolean;\n  /** Optional structured payload for tool results. */\n  data?: unknown;\n  /**\n   * Set when a subagent produced this message: the id of the tool use that\n   * runs the subagent. Absent on main-thread messages.\n   */\n  parentToolUseId?: string;\n}\n\n/**\n * A typed block within an {@link AgentMessage}'s content array.\n *\n * Mirrors the Anthropic content block schema but is driver-agnostic.\n *\n * @docLink packages/bridge/concepts#content-block\n */\nexport interface ContentBlock {\n  /** Block discriminant. */\n  type: \"text\" | \"tool_use\" | \"tool_result\" | \"thinking\";\n  /** Present for `text` and `thinking` blocks. */\n  text?: string;\n  /** Tool use / tool result correlation ID. */\n  id?: string;\n  /** Tool name (present on `tool_use` blocks). */\n  name?: string;\n  /** Tool input arguments (present on `tool_use` blocks). */\n  input?: any;\n  /** Serialised tool result content (present on `tool_result` blocks). */\n  content?: string;\n}\n\n/**\n * A single tool invocation made by the agent within a message.\n *\n * @docLink packages/bridge/concepts#tool-call\n */\nexport interface ToolCall {\n  /** Correlation ID used to match the call with its result. */\n  id: string;\n  /** Name of the tool being invoked. */\n  name: string;\n  /** Arguments passed to the tool. */\n  input: any;\n}\n\n/**\n * Error classification for agent failures.\n *\n * Used to determine whether a failure is retryable and to surface actionable\n * hints to the user. See `bridge/CLAUDE.md` for the full category-to-behaviour matrix.\n *\n * @see AgentError\n * @docLink packages/bridge/concepts#error-category\n */\nexport type ErrorCategory =\n  | \"auth\"\n  | \"account\"\n  | \"rate_limit\"\n  | \"model\"\n  | \"network\"\n  | \"config\"\n  | \"process\"\n  | \"validation\"\n  | \"unknown\";\n\n/**\n * Structured error payload emitted inside the `error` {@link AgentEvent}.\n *\n * Consumers should inspect `retryable` before deciding to surface a retry button,\n * and `hint` to provide an actionable message to the user.\n *\n * @docLink packages/bridge/concepts#agent-error\n */\nexport interface AgentError {\n  /** Human-readable error description. */\n  message: string;\n  /** Coarse failure classification used for retry logic and telemetry. */\n  category: ErrorCategory;\n  /** HTTP status code if the error originated from an API response. */\n  statusCode?: number;\n  /** `true` when the caller may safely retry the same operation. */\n  retryable: boolean;\n  /** Short actionable advice suitable for display in the UI. */\n  hint?: string;\n}\n\n/**\n * Metadata for a slash command exposed by the active agent runtime.\n *\n * @docLink packages/bridge/concepts#slash-command-info\n */\nexport interface SlashCommandInfo {\n  /** Command name without the leading slash (e.g. `\"compact\"`). */\n  name: string;\n  /** One-line description shown in command pickers. */\n  description: string;\n  /** Placeholder text describing what argument the command expects. */\n  argumentHint?: string;\n}\n\n/**\n * Discriminated union of all events emitted by a driver on the `'agent-event'` channel.\n *\n * @remarks\n * Consumers listen via `driver.on('agent-event', (event: AgentEvent) => ...)`.\n * The `[k: string]: any` index signature on most variants allows drivers to attach\n * driver-specific fields (e.g. `_textDelta`) without breaking the union.\n *\n * @docLink packages/bridge/concepts#agent-event\n */\nexport type AgentEvent =\n  | { type: \"message_start\"; message: AgentMessage; [k: string]: any }\n  | { type: \"message_update\"; message: AgentMessage; [k: string]: any }\n  | { type: \"message_end\"; message: AgentMessage; [k: string]: any }\n  /**\n   * Takes back `text`, the unfinished tail of streamed `_textDelta`s, before the\n   * driver replays an abandoned attempt. Always a suffix of what was streamed\n   * since the last completed assistant message; see `TextRetractEvent` in the types package.\n   */\n  | { type: \"message_retract\"; text: string; [k: string]: any }\n  | { type: \"turn_end\"; toolResults?: AgentMessage[]; [k: string]: any }\n  | { type: \"agent_end\"; [k: string]: any }\n  /** A background task started in the running turn; see `BackgroundTaskStartedEvent`. */\n  | { type: \"background_task_started\"; taskId: string; [k: string]: any }\n  /** A turn the driver was not prompted for began; see `SelfTurnStartedEvent`. */\n  | { type: \"self_turn_started\"; taskIds: string[]; [k: string]: any }\n  | {\n      type: \"result\";\n      subtype: string;\n      summary?: string;\n      costUsd?: number;\n      /** Per-turn token usage when the driver tracks it. Added in 3.1.0. */\n      tokens?: TokenUsage;\n      /** Per-turn usage keyed by model, subagent calls included. Added in 3.11.0. */\n      modelUsage?: Record<string, ModelTokenUsage>;\n      /** Prompt size of the turn's last main-thread API call. Added in 3.11.0. */\n      contextTokens?: number;\n      /** Context window of the main model, in tokens. Added in 3.11.0. */\n      contextWindow?: number;\n      errors?: string[];\n      [k: string]: any;\n    }\n  | {\n      type: \"error\";\n      error: string;\n      detail?: AgentError;\n      fatal?: boolean;\n      /** Set (with `fatal: false`) when the driver replays the prompt in place; see `ErrorEvent.retrying`. */\n      retrying?: boolean;\n      retryReason?: ErrorRetryReason;\n      /** Usage of a failed provider turn, when reported. */\n      tokens?: TokenUsage;\n      /** Failed-turn usage keyed by the actual model. */\n      modelUsage?: Record<string, ModelTokenUsage>;\n      contextTokens?: number;\n      contextWindow?: number;\n      [k: string]: any;\n    }\n  | {\n      type: \"tool_call\";\n      name?: string;\n      tool?: { name: string };\n      /** Set when a subagent made the call. */\n      parentToolUseId?: string;\n      [k: string]: any;\n    }\n  | { type: \"tool_execution_end\"; toolName?: string; parentToolUseId?: string; [k: string]: any }\n  | { type: \"commands_available\"; commands: SlashCommandInfo[] }\n  | { type: \"session_info\"; driverSessionId: string; sessionFile?: string }\n  | { type: \"ui_render\"; [k: string]: any }\n  | { type: \"ui_render_update\"; [k: string]: any }\n  | { type: \"ui_clear\"; [k: string]: any }\n  // Phase 3 (resume cascade) — driver-emitted resume outcome.\n  | {\n      type: \"resume_failed\";\n      resumeSessionId: string;\n      reason:\n        | \"signature_mismatch\"\n        | \"model_mismatch\"\n        | \"jsonl_lost\"\n        | \"jsonl_poisoned\"\n        | \"native_state_unavailable\";\n      [k: string]: any;\n    };\n\n/** The settings a live reconfigure may change. */\nexport type ReconfigurePatch = Partial<Pick<AgentConfig, \"model\" | \"thinking\" | \"effort\">>;\n\n/**\n * What a driver now holds for the fields of an accepted reconfigure. `modelRef`\n * is the registry selector the model was scoped to; it is absent when the\n * session has none. A host remembers exactly this, never the raw patch.\n */\nexport interface ReconfigureApplied {\n  model?: string;\n  modelRef?: string;\n  thinking?: AgentConfig[\"thinking\"];\n  effort?: AgentConfig[\"effort\"];\n}\n\n/**\n * Result of `AgentDriver.reconfigure()`. `ok: true` means effective from the\n * next turn (live switch, query recycle or respawn); a driver that cannot\n * promise that answers `ok: false` instead.\n *\n * - `not_supported`: the driver cannot change settings live.\n * - `model_not_on_provider`: the session's AI provider entry does not list the\n *   model (`providerId` names the entry).\n * - `rejected`: the running process refused the change; the driver config is\n *   unchanged.\n *\n * @category Bridge\n */\nexport type ReconfigureOutcome =\n  | { ok: true; applied: ReconfigureApplied }\n  | {\n      ok: false;\n      code: \"not_supported\" | \"model_not_on_provider\" | \"rejected\";\n      message: string;\n      providerId?: string;\n    };\n\n/**\n * A reconfigure the driver answered `ok` (it landed mid-turn) and then refused\n * at the next turn boundary. The driver already rolled its config back;\n * `requested` is what was asked, `restored` what it holds again. Emitted as the\n * driver event `'reconfigure-rollback'`.\n */\nexport interface ReconfigureRollback {\n  message: string;\n  requested: ReconfigureApplied;\n  restored: ReconfigureApplied;\n}\n\n/** Rejection message of a driver asked to run a turn under a tool allowlist it cannot enforce. */\nexport const TOOL_ALLOWLIST_UNSUPPORTED = \"This agent harness cannot enforce a tool allowlist\";\n\n/**\n * Abstract base class for agent drivers.\n *\n * Wraps an LLM coding agent behind a single `prompt()` interface.\n * All drivers emit `'agent-event'` with {@link AgentEvent} payloads.\n *\n * @remarks\n * Subclasses must implement `start`, `prompt`, `abort`, `kill`, and `isRunning`.\n * Implementations should never emit an event name other than `'agent-event'` as\n * the public streaming channel — internal events (`'ready'`, `'exit'`, etc.) are\n * driver-private. The one other public event is `'reconfigure-rollback'` (a\n * {@link ReconfigureRollback}): a live reconfigure the driver had accepted and\n * then refused at the turn boundary, already rolled back in the driver.\n *\n * @example\n * ```ts\n * const driver = createDriver('omp', config);\n * driver.on('agent-event', (event) => console.log(event.type));\n * await driver.start();\n * await driver.prompt('Refactor the auth module');\n * driver.kill();\n * ```\n *\n * @docLink packages/bridge/concepts#agent-driver\n */\nexport abstract class AgentDriver extends EventEmitter {\n  /** Static metadata describing this driver's capabilities. */\n  abstract readonly driverInfo: DriverInfo;\n\n  /**\n   * Initialises the driver's harness — spawns the child process (omp) or loads\n   * the SDK module (claude-sdk). Resolves when the harness is ready to accept\n   * prompts. Idempotent: calling `start()` on an already-running driver is a no-op.\n   *\n   * @throws {Error} When the harness binary is missing or the SDK cannot be loaded.\n   */\n  abstract start(): Promise<void>;\n\n  /**\n   * Sends a user message to the agent and resolves when the agent's turn completes\n   * (i.e. after the `agent_end` event has been emitted).\n   *\n   * @param message - Plain-text user prompt to send to the agent.\n   * @throws {Error} When the driver is not running or the underlying harness reports a fatal error.\n   */\n  abstract prompt(message: string): Promise<void>;\n\n  /**\n   * Preserve text-only callers; drivers must explicitly support attachments.\n   * A `toolAllowlist` is refused here: only a driver that overrides\n   * {@link enforcesToolAllowlist} may run a restricted turn.\n   */\n  promptInput(input: AgentPromptInput): Promise<void> {\n    if (input.toolAllowlist !== undefined)\n      return Promise.reject(new Error(TOOL_ALLOWLIST_UNSUPPORTED));\n    if (input.attachments?.length) return Promise.reject(new Error(\"Structured input unsupported\"));\n    return this.prompt(input.text);\n  }\n\n  /**\n   * Whether {@link promptInput} enforces `AgentPromptInput.toolAllowlist` for\n   * the whole turn, subagents included. A driver that answers `false` must\n   * reject an input carrying one; the runner refuses such a prompt before it\n   * reaches the driver.\n   */\n  get enforcesToolAllowlist(): boolean {\n    return false;\n  }\n\n  /**\n   * The names in `allowlist` this driver does not recognize as a tool it could\n   * offer. The runner refuses a prompt whose allowlist names any, rather than\n   * guess. A driver that does not enforce allowlists recognizes none.\n   */\n  unknownAllowlistedTools(allowlist: readonly string[]): string[] {\n    return [...allowlist];\n  }\n\n  /** Managed replies never fall back to a new prompt after a request has settled. */\n  get acceptsReplyAsPrompt(): boolean {\n    return true;\n  }\n\n  /**\n   * Sends an in-band abort signal to the agent, requesting it to stop the current\n   * turn without terminating the process. The driver remains usable after `abort()`.\n   *\n   * @remarks Only meaningful when `driverInfo.supportsInBandAbort` is `true`.\n   *   For other drivers, prefer `kill()` followed by creating a new driver instance.\n   */\n  abstract abort(): Promise<void>;\n\n  /**\n   * Terminates the agent harness immediately (SIGTERM for subprocess drivers,\n   * `close()` for in-process drivers). The driver instance must not be reused\n   * after `kill()`.\n   */\n  abstract kill(): void;\n\n  /** Stop the driver and await owned process/state cleanup when the harness supports it. */\n  async dispose(): Promise<void> {\n    this.kill();\n  }\n\n  /** `true` when the harness is alive and able to accept new prompts. */\n  abstract get isRunning(): boolean;\n\n  /** Optional provider-native session/thread identifier for resume support. */\n  get runtimeSessionId(): string | undefined {\n    return undefined;\n  }\n\n  /** Slash commands discovered from the agent runtime. Override in drivers that support introspection. */\n  getSlashCommands(): SlashCommandInfo[] {\n    return [];\n  }\n\n  // ── Interactive questions (AskUserQuestion) ──────────────────────────────\n\n  /**\n   * `true` while the driver is paused on an interactive question and waiting\n   * for the user's answer rather than a new prompt. The runner routes a\n   * `reply` command to {@link answerQuestion} instead of {@link prompt} when\n   * this returns `true`. Drivers without interactive-question support return\n   * `false` (the default), so a `reply` falls back to `prompt`.\n   */\n  hasPendingQuestion(): boolean {\n    return false;\n  }\n\n  /**\n   * Deliver the user's answer to the question the driver is currently paused\n   * on. This resumes the in-flight turn — it does NOT start a new one. When a\n   * single tool call asks several questions, the driver resolves the underlying\n   * call only once every sub-question has an answer.\n   *\n   * @param answer - The user's reply text (an option label, free text, or for\n   *   multi-select a comma-joined list).\n   * @param question - The sub-question this answers, verbatim from the\n   *   `question` event that asked it. Supply it whenever the host lets the user\n   *   answer out of order — without it the answer fills the next unanswered\n   *   slot in order, which silently mismatches a non-sequential reply.\n   * @returns `true` when the answer was consumed by a pending question; `false`\n   *   when no question was pending (caller should treat the reply as a prompt).\n   */\n  answerQuestion(answer: string, question?: string, requestId?: string): boolean {\n    void requestId;\n    void answer;\n    void question;\n    return false;\n  }\n\n  /**\n   * Apply this driver's rule for a new prompt that meets a pending question,\n   * ahead of the prompt itself. The runner queues a prompt behind the turn in\n   * flight, so a turn paused on a question would otherwise hold that prompt\n   * until the user answered. Drivers whose `prompt()` cancels the question\n   * (claude-sdk, omp) do the same here; the default keeps the question.\n   */\n  supersedePendingQuestion(): void {\n    // No-op: a driver without this rule keeps the question pending.\n  }\n\n  // ── Live reconfiguration ────────────────────────────────────────────────\n\n  /**\n   * Live-update driver configuration. `ok: true` means effective from the next\n   * turn: the next turn runs on the new settings, by live switch, query recycle\n   * or respawn, and the host needs no restart. A turn in progress finishes on\n   * the old settings. Only model/thinking/effort are reconfigurable mid-session.\n   *\n   * Drivers that can honour that promise build a `ReconfigureLedger` and\n   * delegate to it; it owns the model scope rule, ordering, drift and rollback.\n   * The base implementation answers `not_supported`.\n   */\n  reconfigure(patch: ReconfigurePatch): Promise<ReconfigureOutcome> {\n    const fields = Object.keys(patch).join(\", \");\n    return Promise.resolve({\n      ok: false,\n      code: \"not_supported\",\n      message: `The ${this.driverInfo.id} driver cannot change ${fields} live; the change applies when the session next starts.`,\n    });\n  }\n\n  /**\n   * Returns the model identifier currently configured on this driver.\n   * Subclasses that store config locally should override this.\n   */\n  getModel(): string | undefined {\n    return undefined;\n  }\n\n  // ── Compaction support ──────────────────────────────────────────────────\n\n  /**\n   * `Date.now()` of the harness's most recent sign of life, counting messages\n   * that emit no `agent-event` (thinking deltas, rate-limit telemetry, API\n   * retries). A stall check reads it alongside the events it sees. `null` when\n   * the driver does not track it.\n   */\n  lastActivityAt(): number | null {\n    return null;\n  }\n\n  /**\n   * Returns the token usage from the most recent completed turn.\n   * Returns `null` if usage data is unavailable (e.g. driver doesn't track it).\n   *\n   * Widened in 3.1.0 to return the full `TokenUsage` shape (input / output /\n   * cache-read / cache-creation / reasoning). All fields are optional so\n   * drivers can populate just what their provider reports. Existing callers\n   * that read only `inputTokens` / `outputTokens` keep working — those fields\n   * are still present and carry the same semantics as before.\n   */\n  getTokenUsage(): TokenUsage | null {\n    return null;\n  }\n\n  /**\n   * Prompt tokens occupying the context window as of the most recent API\n   * request — i.e. how full the context actually is right now.\n   *\n   * Deliberately NOT the same number as {@link getTokenUsage}, whose usage is\n   * cumulative over every API call in the turn and therefore overstates the\n   * context by 10-40x on any multi-tool turn. Callers measuring context fill\n   * (compaction thresholds) must prefer this; callers billing a turn\n   * (usage ledgers, the `finished` event) must keep using `getTokenUsage()`.\n   *\n   * Returns `null` both when the driver cannot report a per-call figure at all\n   * and when it can but has no reading yet. Falling back to `getTokenUsage()`\n   * is safe in either case only because a driver clears the two in lockstep: no\n   * reading means no API call landed, so there is no cumulative usage to\n   * overstate. A driver implementing this must preserve that invariant.\n   */\n  getContextTokens(): number | null {\n    return null;\n  }\n\n  /**\n   * Returns the model's context window size in tokens.\n   * Returns `null` if unknown.\n   */\n  getContextWindow(): number | null {\n    return null;\n  }\n\n  /**\n   * What the driver can measure natively about its context window, in the\n   * neutral {@link DriverContextReport} shape, or `null` when it measures\n   * nothing beyond {@link getContextTokens} / {@link getContextWindow}.\n   *\n   * `detail: \"full\"` (the default) may be expensive — claude-sdk issues\n   * `count_tokens` requests — so the runner asks for it only when a host\n   * requests a measured breakdown; `\"summary\"` must make no provider call and\n   * is what the per-turn snapshot uses. Implementations must not throw for\n   * \"unsupported\"; a rejection means the measurement itself failed and the\n   * runner falls back to estimates.\n   */\n  async getContextUsageReport(_opts?: {\n    detail?: ContextUsageDetail;\n  }): Promise<DriverContextReport | null> {\n    return null;\n  }\n\n  /**\n   * Returns the list of models available to this driver without starting a session.\n   * Drivers that can enumerate their own models override this method.\n   * Returns an empty array by default.\n   */\n  async listModels(): Promise<ModelEntry[]> {\n    return [];\n  }\n\n  /**\n   * Closes the current conversation session and prepares for a fresh start.\n   * The next `prompt()` call will begin a new session without prior history.\n   * The driver remains usable after `resetSession()`.\n   */\n  abstract resetSession(): Promise<void>;\n\n  // ── Telemetry ─────────────────────────────────────────────────────────────\n\n  protected _telemetry?: TelemetryProvider;\n  protected _activeTrace?: Trace;\n  protected _activeTurnSpan?: Span;\n  private _turnStartTime?: number;\n\n  /**\n   * Attach a telemetry provider and active trace to this driver.\n   * Called by the runner after creating the driver but before start().\n   */\n  setTelemetry(provider: TelemetryProvider, trace: Trace): void {\n    this._telemetry = provider;\n    this._activeTrace = trace;\n  }\n\n  /**\n   * Begin a turn span. Called by the runner before prompt().\n   * Pass a parent span (e.g. the turn span from the orchestrator) for nesting.\n   * Returns the span so the runner can annotate it further.\n   */\n  beginTurnSpan(\n    parent?: Trace | Span,\n    attrs?: Record<string, string | number | boolean>,\n  ): Span | undefined {\n    if (!this._telemetry || !this._activeTrace) return undefined;\n    this._turnStartTime = Date.now();\n    this._activeTurnSpan = this._telemetry.startSpan(parent ?? this._activeTrace, {\n      name: \"llm_generation\",\n      kind: \"llm_generation\",\n      attributes: attrs,\n    });\n    return this._activeTurnSpan;\n  }\n\n  /**\n   * End the current turn span with generation data.\n   * Called by the runner after agent_end. Model and provider are passed\n   * explicitly — the driver base class does not access config directly.\n   */\n  endTurnSpan(result?: {\n    model?: string;\n    provider?: string;\n    inputTokens?: number;\n    outputTokens?: number;\n    stopReason?: string;\n    error?: string;\n  }): void {\n    if (!this._telemetry || !this._activeTurnSpan) return;\n    const durationMs = this._turnStartTime ? Date.now() - this._turnStartTime : 0;\n\n    if (result?.inputTokens !== undefined || result?.outputTokens !== undefined) {\n      this._telemetry.logGeneration(this._activeTurnSpan, {\n        model: result?.model ?? \"unknown\",\n        provider: result?.provider ?? \"unknown\",\n        inputTokens: result.inputTokens,\n        outputTokens: result.outputTokens,\n        durationMs,\n        stopReason: result.stopReason,\n      });\n    }\n\n    this._telemetry.endSpan(this._activeTurnSpan, {\n      status: result?.error ? \"error\" : \"ok\",\n      error: result?.error,\n      attributes: { \"skaile.turn.duration_ms\": durationMs },\n    });\n\n    this._activeTurnSpan = undefined;\n    this._turnStartTime = undefined;\n  }\n}\n\n/**\n * Factory function signature registered in the driver registry.\n *\n * @param config - Configuration for the new driver instance.\n * @returns A freshly constructed (not yet started) {@link AgentDriver}.\n * @docLink packages/bridge/concepts#driver-factory\n */\nexport type DriverFactory = (config: AgentConfig) => AgentDriver;\n"]}

package/dist/chunk-3KMREAR2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../bridge/src/approval-card.ts","../bridge/src/cloud.ts","../bridge/src/drivers/scrub-transcript.ts","../bridge/src/agent-transcript.ts","../bridge/src/drivers/resume-probe.ts"],"names":["join"],"mappings":";;;;;;;;;;;AAUO,IAAM,YAAA,GAAe;AAErB,IAAM,IAAA,GAAO;AAab,SAAS,eAAe,KAAA,EAA6C;AAC1E,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,eAAA,IAAmB,CAAC,KAAA,CAAM,QAAQ,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,OAAO,MAAA;AACpF,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS;AACzC,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,UAAA,IAAc,KAAA,CAAM,SAAS,iBAAA,EAAmB;AACnE,IAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,IAAA,MAAM,WAAW,KAAA,EAAO,QAAA;AACxB,IAAA,MAAM,YAAY,KAAA,EAAO,SAAA;AACzB,IAAA,MAAM,QAAQ,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,GAAK,SAAA,CAAU,CAAC,CAAA,GAA+B,MAAA;AACpF,IAAA,IACE,CAAC,YACD,OAAO,KAAA,EAAO,aAAa,QAAA,IAC3B,CAAC,MAAM,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA,IAC/B,CAAC,SAAS,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAA,KAAM,OAAO,CAAA,KAAM,QAAQ,CAAA,EACpD;AACA,MAAA;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,GAAI,OAAO,KAAA,EAAO,SAAA,KAAc,QAAA,GAAW,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU,GAAI,EAAC;AAAA,MAC7E,MAAM,QAAA,CAAS,IAAA;AAAA,MACf,SAAS,QAAA,CAAS;AAAA,KACpB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;;;ACVA,IAAM,iBAAA,GAAoB,CAAC,mBAAA,EAAqB,sBAAA,EAAwB,oBAAoB,CAAA;AAQrF,IAAM,0BAAA,GAA6B;AAQ1C,IAAM,iBAAA,GAA0C;AAAA,EAC9C,mBAAA,EAAqB,IAAA;AAAA,EACrB,aAAA,EAAe,IAAA;AAAA,EACf,WAAA,EAAa;AACf,CAAA;AAcO,SAAS,mBAAmB,KAAA,EAA4C;AAC7E,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,eAAe,KAAK,CAAA;AACtC,EAAA,IAAI,OAAA,KAAY,yBAAA,IAA6B,SAAA,KAAc,SAAA,EAAW,OAAO,SAAA;AAC7E,EAAA,IAAI,OAAA,KAAY,eAAA,IAAmB,SAAA,KAAc,QAAA,EAAU,OAAO,QAAA;AAClE,EAAA,IAAI,SAAA,KAAc,WAAW,OAAO,SAAA;AACpC,EAAA,OAAO,WAAA;AACT;AA2CO,SAAS,uBAAuB,IAAA,EAAsD;AAC3F,EAAA,MAAM,EAAE,KAAA,EAAO,UAAA,EAAY,OAAA,EAAS,WAAU,GAAI,IAAA;AAClD,EAAA,MAAM,MAA8B,EAAE,GAAG,SAAS,GAAI,SAAA,IAAa,EAAC,EAAG;AAIvE,EAAA,MAAM,UAAU,EAAE,SAAA,EAAW,IAAI,oBAAA,EAAsB,MAAA,EAAQ,IAAI,iBAAA,EAAkB;AAErF,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,IAAA,IAAI,kBAAkB,QAAA,CAAS,GAAG,KAAK,GAAA,CAAI,UAAA,CAAW,kBAAkB,CAAA,EAAG;AACzE,MAAA,OAAO,IAAI,GAAG,CAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,CAAC,GAAA,EAAa,KAAA,KAA8B;AAGtD,IAAA,IAAI,KAAA,EAAO,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,EACxB,CAAA;AAEA,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,UAAA,EAAY,IAAA,IAAQ,MAAA;AACvC,EAAA,MAAM,SAAU,KAAA,CAA6B,MAAA;AAK7C,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,OAAA,IAAW,EAAE,CAAA,CAAE,MAAA;AAAA,IAClD,CAAC,CAAC,IAAI,CAAA,KAAM,CAAC,iBAAA,CAAkB,IAAA,CAAK,aAAa;AAAA,GACnD;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,GAAA,CAAI,wBAAA,GAA2B,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAK,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EAC9F;AAEA,EAAA,QAAQ,kBAAA,CAAmB,KAAK,CAAA;AAAG,IACjC,KAAK,SAAA,EAAW;AACd,MAAA,GAAA,CAAI,uBAAA,GAA0B,GAAA;AAG9B,MAAA,GAAA,CAAI,YAAA,EAAc,QAAQ,MAAM,CAAA;AAChC,MAAA;AAAA,IACF;AAAA,IACA,KAAK,QAAA,EAAU;AACb,MAAA,GAAA,CAAI,sBAAA,GAAyB,GAAA;AAG7B,MAAA,GAAA,CAAI,6BAAA,EAA+B,QAAQ,OAAO,CAAA;AAClD,MAAA,GAAA,CAAI,iBAAA,EAAmB,QAAQ,QAAQ,CAAA;AACvC,MAAA;AAAA,IACF;AAAA,IACA,KAAK,SAAA,EAAW;AACd,MAAA,GAAA,CAAI,uBAAA,GAA0B,GAAA;AAG9B,MAAA,IAAI,KAAA,CAAM,QAAA,EAAU,GAAA,CAAI,4BAAA,EAA8B,MAAM,QAAQ,CAAA;AAAA,WAC/D,GAAA,CAAI,4BAAA,EAA8B,MAAA,EAAQ,QAAQ,CAAA;AACvD,MAAA,GAAA,CAAI,6BAA6B,UAAU,CAAA;AAC3C,MAAA;AAAA,IACF;AAAA,IACA,KAAK,WAAA,EAAa;AAChB,MAAA,MAAM,OAAA,GAAU,yBAAA,CAA0B,mBAAA,CAAoB,KAAK,CAAC,CAAA;AACpE,MAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,WAAA,EAAY,KAAM,0BAAA,EAA4B;AACnE,QAAA,GAAA,CAAI,kBAAA,GAAqB,OAAA;AAAA,MAC3B;AACA,MAAA,IAAI,IAAA,KAAS,QAAA,EAAU,GAAA,CAAI,sBAAA,EAAwB,UAAU,CAAA;AAAA,WAAA,IACpD,IAAA,KAAS,gBAAA,EAAkB,GAAA,CAAI,mBAAA,EAAqB,UAAU,CAAA;AACvE,MAAA,IAAI,CAAC,UAAA,EAAY;AAGf,QAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,GAAA,CAAI,oBAAA,GAAuB,OAAA,CAAQ,SAAA;AAAA,aACrD,GAAA,CAAI,mBAAA,EAAqB,OAAA,CAAQ,MAAM,CAAA;AAAA,MAC9C;AACA,MAAA;AAAA,IACF;AAAA;AAGF,EAAA,OAAO,GAAA;AACT;AC3CA,IAAM,SAAA,GAAY,2CAAA;AAGlB,IAAM,mBAAA,GAAsB,kCAAA;AAO5B,IAAM,eAAA,GAAkB,IAAI,IAAA,GAAO,IAAA;AAa5B,SAAS,oBAAoB,MAAA,EAA+B;AACjE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AAEF,IAAA,GAAA,GAAM,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,EAAG,EAAE,GAAG,QAAQ,CAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AAClB,IAAA,OAAO,IAAA;AAAA,EACT;AAIA,EAAA,IAAI,IAAI,CAAC,CAAA,KAAM,OAAQ,GAAA,CAAI,CAAC,MAAM,GAAA,EAAM;AACtC,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,GAAA,IAAQ,IAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,MAAM,EAAA,EAAM;AAC5E,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,IAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,MAAM,EAAA,EAAM;AAC5E,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,IACE,GAAA,CAAI,MAAA,IAAU,EAAA,IACd,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IACX,GAAA,CAAI,CAAC,MAAM,EAAA,IACX,GAAA,CAAI,CAAC,CAAA,KAAM,MACX,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IACX,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IACX,IAAI,CAAC,CAAA,KAAM,EAAA,IACX,GAAA,CAAI,EAAE,CAAA,KAAM,EAAA,IACZ,GAAA,CAAI,EAAE,MAAM,EAAA,EACZ;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAyBA,SAAS,aAAa,CAAA,EAA0B;AAC9C,EAAA,OAAO,CAAA,CAAE,SAAA,GAAY,CAAA,CAAE,OAAA,GAAU,CAAA,CAAE,aAAA;AACrC;AAkBA,SAAS,UAAA,CAAW,OAAyB,QAAA,EAA2C;AACtF,EAAA,IAAI,MAAM,IAAA,KAAS,aAAA,IAAiB,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA,EAAG;AAChE,IAAA,OAAO;AAAA,MACL,GAAG,KAAA;AAAA,MACH,OAAA,EAAU,MAAM,OAAA,CAA+B,GAAA,CAAI,CAAC,KAAA,KAAU,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAC;AAAA,KAC3F;AAAA,EACF;AAKA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,IAAU,KAAA,CAAM,iBAAiB,IAAA,EAAM;AACxD,IAAA,MAAM,OAAO,OAAO,KAAA,CAAM,IAAA,KAAS,QAAA,GAAW,MAAM,IAAA,GAAO,EAAA;AAC3D,IAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,EAAA,EAAI;AACtB,MAAA,QAAA,CAAS,aAAA,EAAA;AACT,MAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,KAAA,EAAM;AACzB,MAAA,OAAO,KAAA,CAAM,aAAA;AACb,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IACE,KAAA,CAAM,IAAA,KAAS,OAAA,IACf,KAAA,CAAM,MAAA,EAAQ,IAAA,KAAS,QAAA,IACvB,OAAO,KAAA,CAAM,MAAA,CAAO,IAAA,KAAS,QAAA,EAC7B;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA;AAI1B,IAAA,IAAI,KAAK,KAAA,CAAO,IAAA,CAAK,SAAS,CAAA,GAAK,CAAC,IAAI,eAAA,EAAiB;AACvD,MAAA,QAAA,CAAS,OAAA,EAAA;AACT,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,mBAAA,EAAoB;AAAA,IACnD;AACA,IAAA,MAAM,OAAA,GAAU,oBAAoB,IAAI,CAAA;AACxC,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,QAAA,CAAS,OAAA,EAAA;AACT,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IACzC;AACA,IAAA,IAAI,OAAA,KAAY,KAAA,CAAM,MAAA,CAAO,UAAA,EAAY;AACvC,MAAA,QAAA,CAAS,SAAA,EAAA;AACT,MAAA,OAAO,EAAE,GAAG,KAAA,EAAO,MAAA,EAAQ,EAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,EAAE;AAAA,IACtE;AAAA,EACF;AAEA,EAAA,OAAO,KAAA;AACT;AAkBA,eAAsB,oBAAA,CACpB,SAAA,EACA,SAAA,EACA,SAAA,GAAoB,cAAa,EACT;AACxB,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,UAAU,CAAA;AAC9C,EAAA,MAAM,UAAU,MAAM,iBAAA;AAAA,IACpB,WAAW,WAAW,CAAA,CAAA;AAAA,IACtB,MAAM,QAAQ,WAAW,CAAA;AAAA,IACzB,IAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAM,YAAY,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAA,EAAG,SAAS,CAAA,MAAA,CAAQ,CAAA;AAC/D,IAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,MAClB,QAAQ,SAAS,CAAA,CAAA;AAAA,MACjB,YAAA,CAAa,MAAM,IAAA,CAAK,SAAS,GAAG,MAAA,EAAO;AAAA,MAC3C,KAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,OAAO,OAAO,SAAA;AAAA,EACpB;AACA,EAAA,OAAO,IAAA;AACT;AAiBA,gBAAgB,YAAY,MAAA,EAAuD;AACjF,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,IAAA,OAAA,IAAW,KAAA;AACX,IAAA,IAAI,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AAC9B,IAAA,OAAO,QAAQ,EAAA,EAAI;AACjB,MAAA,MAAM,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC1B,MAAA,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC/B,MAAA,GAAA,GAAM,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,IAC5B;AAAA,EACF;AACA,EAAA,MAAM,OAAA;AACR;AAOO,IAAM,oBAAA,GAAwC;AAAA,EACnD,MAAA,EAAQ,CAAC,SAAA,EAAW,SAAA,EAAW,cAC7B,oBAAA,CAAqB,SAAA,EAAW,WAAW,SAAS,CAAA;AAAA,EACtD,OAAO,KAAK,QAAA,EAAU;AACpB,IAAA,MAAM,SAAS,gBAAA,CAAiB,QAAA,EAAU,EAAE,QAAA,EAAU,QAAQ,CAAA;AAC9D,IAAA,IAAI;AACF,MAAA,WAAA,MAAiB,KAAA,IAAS,QAAQ,MAAM,KAAA;AAAA,IAC1C,CAAA,SAAE;AACA,MAAA,MAAA,CAAO,OAAA,EAAQ;AAAA,IACjB;AAAA,EACF,CAAA;AAAA,EACA,MAAM,OAAA,CAAQ,QAAA,EAAU,MAAA,EAAQ;AAC9B,IAAA,MAAM,OAAA,GAAU,GAAG,QAAQ,CAAA,UAAA,CAAA;AAC3B,IAAA,MAAM,QAAA,CAAS,QAAQ,iBAAA,CAAkB,OAAA,EAAS,EAAE,QAAA,EAAU,MAAA,EAAQ,CAAC,CAAA;AACvE,IAAA,MAAM,MAAA,CAAO,SAAS,QAAQ,CAAA;AAAA,EAChC,CAAA;AAAA,EACA,MAAM,YAAY,QAAA,EAAU;AAC1B,IAAA,MAAM,OAAA,GAAU,GAAG,QAAQ,CAAA,UAAA,CAAA;AAC3B,IAAA,MAAM,iBAAA,CAAkB,CAAA,OAAA,EAAU,OAAO,CAAA,CAAA,EAAI,MAAM,OAAO,OAAO,CAAA,EAAG,MAAA,EAAW,YAAA,EAAc,CAAA;AAAA,EAC/F;AACF;AAMA,IAAM,uBAAA,GAA0B;AAAA,EAC9B,aAAA;AAAA,EACA,cAAA;AAAA,EACA,sBAAA;AAAA,EACA,0BAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,QAAQ,KAAA,EAAiC;AAChD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,KAAK,KAAA,IAAS,CAAA;AACzE;AASA,SAAS,aAAA,CAAc,MAAc,SAAA,EAA+C;AAClF,EAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,cAAc,GAAG,OAAO,IAAA;AAC3C,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,KAAK,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAC,CAAA;AAAA,EAC7C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAM,IAAA,KAAS,YAAA,IAAgB,KAAA,CAAM,SAAA,KAAc,WAAW,OAAO,IAAA;AACzE,EAAA,MAAM,QAAQ,KAAA,CAAM,YAAA;AACpB,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,QAAQ,KAAA,CAAM,UAAA;AACpB,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,IAAA;AACxE,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACxC,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,IAAA;AAChD,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,IAAI,CAAC,uBAAA,CAAwB,KAAA,CAAM,CAAC,KAAA,KAAU,OAAA,CAAQ,QAAA,CAAS,KAAK,CAAC,CAAC,CAAA,EAAG,OAAO,IAAA;AAAA,EAClF;AACA,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,KAAA;AAAA,IACd,UAAA,EAAY;AAAA,GACd;AACF;AAYA,SAAS,UAAA,CAAW,MAAc,QAAA,EAAiC;AACjE,EAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,EAAA,EAAI,OAAO,IAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAI,IAAI,IAAA,GAAO,EAAA;AACzC,EAAA,MAAM,OAAO,GAAA,KAAQ,EAAA,GAAK,OAAO,IAAA,CAAK,KAAA,CAAM,GAAG,EAAE,CAAA;AACjD,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,MAAM,OAAA,EAAS,OAAA;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,GAAG,OAAO,IAAA;AACpC,EAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AACpC,EAAA,MAAM,QAAA,GAAY,QAA+B,GAAA,CAAI,CAAC,UAAU,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAC,CAAA;AAC3F,EAAA,IAAI,YAAA,CAAa,QAAQ,CAAA,KAAM,MAAA,EAAQ,OAAO,IAAA;AAC9C,EAAA,OAAO,GAAG,IAAA,CAAK,SAAA,CAAU,EAAE,GAAG,OAAO,OAAA,EAAS,EAAE,GAAG,KAAA,CAAM,SAAS,OAAA,EAAS,QAAA,IAAY,CAAC,GAAG,GAAG,CAAA,CAAA;AAChG;AAqBA,eAAsB,wBACpB,IAAA,EACgC;AAChC,EAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAW,GAAA,EAAI,GAAI,IAAA;AACtC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,oBAAA;AAC5B,EAAA,MAAM,YAAY,YAAA,EAAa;AAC/B,EAAA,MAAM,MAAA,GAAgC;AAAA,IACpC,QAAA,EAAU,IAAA;AAAA,IACV,SAAA,EAAW,CAAA;AAAA,IACX,OAAA,EAAS,CAAA;AAAA,IACT,aAAA,EAAe,CAAA;AAAA,IACf,OAAA,EAAS,KAAA;AAAA,IACT,SAAA,EAAW;AAAA,GACb;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,CAAO,SAAA,EAAW,WAAW,SAAS,CAAA;AAAA,EAC/D,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,EAAK,KAAK,+CAAA,EAAiD;AAAA,MACzD,SAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,GAAA,EAAK,IAAA,CAAK,uCAAA,EAAyC,EAAE,SAAA,EAAW,WAAW,CAAA;AAC3E,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAA,CAAO,QAAA,GAAW,QAAA;AAGlB,EAAA,MAAM,WAA0B,EAAE,SAAA,EAAW,GAAG,OAAA,EAAS,CAAA,EAAG,eAAe,CAAA,EAAE;AAC7E,EAAA,IAAI,SAAA,GAAwC,IAAA;AAC5C,EAAA,IAAI;AACF,IAAA,MAAM,cAAA;AAAA,MACJ,mBAAmB,QAAQ,CAAA,CAAA;AAAA,MAC3B,YAAY;AACV,QAAA,WAAA,MAAiB,QAAQ,WAAA,CAAY,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAC,CAAA,EAAG;AAC1D,UAAA,UAAA,CAAW,MAAM,QAAQ,CAAA;AACzB,UAAA,SAAA,GAAY,aAAA,CAAc,IAAA,EAAM,SAAS,CAAA,IAAK,SAAA;AAAA,QAChD;AAAA,MACF,CAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,EAAK,KAAK,6CAAA,EAA+C;AAAA,MACvD,QAAA;AAAA,MACA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAA,CAAO,YAAY,QAAA,CAAS,SAAA;AAC5B,EAAA,MAAA,CAAO,UAAU,QAAA,CAAS,OAAA;AAC1B,EAAA,MAAA,CAAO,gBAAgB,QAAA,CAAS,aAAA;AAChC,EAAA,MAAA,CAAO,SAAA,GAAY,SAAA;AAEnB,EAAA,IAAI,YAAA,CAAa,QAAQ,CAAA,KAAM,CAAA,EAAG;AAChC,IAAA,OAAO,MAAA;AAAA,EACT;AAKA,EAAA,MAAM,MAAA,GAAS,QAAA;AACf,EAAA,IAAI;AACF,IAAA,MAAM,cAAA;AAAA,MACJ,sBAAsB,MAAM,CAAA,CAAA;AAAA,MAC5B,YAAY;AACV,QAAA,MAAM,UAAyB,EAAE,SAAA,EAAW,GAAG,OAAA,EAAS,CAAA,EAAG,eAAe,CAAA,EAAE;AAC5E,QAAA,MAAM,KAAA,CAAM,OAAA;AAAA,UACV,MAAA;AAAA,UAAA,CACC,mBAAmB;AAClB,YAAA,IAAI,KAAA,GAAQ,IAAA;AACZ,YAAA,WAAA,MAAiB,QAAQ,WAAA,CAAY,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA,EAAG;AACxD,cAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,EAAM,OAAO,CAAA,GAAI;AAAA,EAAK,UAAA,CAAW,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA;AACxE,cAAA,KAAA,GAAQ,KAAA;AAAA,YACV;AAAA,UACF,CAAA;AAAG,SACL;AAAA,MACF,CAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,EAAK,KAAK,gDAAA,EAAkD;AAAA,MAC1D,QAAA;AAAA,MACA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AAGD,IAAA,MAAM,KAAA,CAAM,WAAA,CAAY,MAAM,CAAA,CAAE,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAC9C,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAA,CAAO,OAAA,GAAU,IAAA;AACjB,EAAA,GAAA,EAAK,KAAK,gDAAA,EAAkD;AAAA,IAC1D,QAAA;AAAA,IACA,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,eAAe,MAAA,CAAO;AAAA,GACvB,CAAA;AACD,EAAA,OAAO,MAAA;AACT;ACjlBO,SAAS,qBAAqB,IAAA,EAA+B;AAGlE,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA0B;AAE/C,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAY;AAClC,EAAA,MAAM,KAAA,GAAQ,CAAC,QAAA,EAAkB,KAAA,KAAwB;AACvD,IAAA,QAAA,CAAS,GAAA,CAAI,UAAU,KAAK,CAAA;AAC5B,IAAA,KAAA,CAAM,IAAA,CAAK,SAAS,MAAM;AACxB,MAAA,IAAI,SAAS,GAAA,CAAI,QAAQ,MAAM,KAAA,EAAO,QAAA,CAAS,OAAO,QAAQ,CAAA;AAAA,IAChE,CAAC,CAAA;AAAA,EACH,CAAA;AACA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,SAAA,EAAW,SAAA,EAAW,YAAY,GAAA,EAAQ;AAErD,MAAA,IAAI,CAAC,mBAAA,CAAoB,IAAA,CAAK,SAAS,GAAG,OAAO,IAAA;AACjD,MAAA,MAAM,WAAA,GAAcA,IAAAA,CAAK,SAAA,EAAW,UAAU,CAAA;AAG9C,MAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAA;AAAA,QACvB,WAAW,IAAA,EAAM;AAAA,UACf,IAAA;AAAA,UACA,IAAA;AAAA,UACA,uIAAA;AAAA,UAEA,IAAA;AAAA,UACA,WAAA;AAAA,UACA,GAAG,SAAS,CAAA,MAAA;AAAA,SACb,CAAA;AAAA,QACD;AAAA,OACF;AACA,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAEpD,MAAA,IAAI,KAAA,CAAM,QAAA,CAAS,eAAe,CAAA,EAAG,OAAO,IAAA;AAC5C,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,SAAS,CAAC,CAAA;AACxD,MAAA,IAAI,MAAA,KAAW,MAAA;AACb,QAAA,MAAM,IAAI,MAAM,yEAAyE,CAAA;AAE3F,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,GAAG,CAAC,CAAA;AACjD,MAAA,IAAI,OAAO,OAAO,KAAA;AAClB,MAAA,IAAI,MAAA,KAAW,UAAA;AACb,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,OAAO,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,CAAG,CAAA;AACtF,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IAEA,OAAO,KAAK,QAAA,EAAU;AACpB,MAAA,MAAM,QAAQ,UAAA,CAAW,IAAA,EAAM,CAAC,KAAA,EAAO,IAAA,EAAM,QAAQ,CAAC,CAAA;AACtD,MAAA,MAAM,MAAA,GAAS,OAAO,KAAK,CAAA;AAC3B,MAAA,MAAA,CAAO,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACrB,MAAA,MAAM,MAAA,GAAS,MAAM,KAAK,CAAA;AAC1B,MAAA,KAAA,CAAM,MAAA,EAAQ,YAAY,MAAM,CAAA;AAChC,MAAA,WAAA,MAAiB,KAAA,IAAS,KAAA,CAAM,MAAA,EAAiC,MAAM,KAAA;AACvE,MAAA,MAAM,OAAO,MAAM,MAAA;AACnB,MAAA,IAAI,IAAA,KAAS,CAAA;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,QAAQ,CAAA,0BAAA,EAA6B,MAAM,MAAM,CAAA,CAAE,CAAA;AAAA,IAClF,CAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,QAAA,EAAU,MAAA,EAAQ;AAC9B,MAAA,MAAM,KAAA,GAAQ,WAAW,IAAA,EAAM;AAAA,QAC7B,IAAA;AAAA,QACA,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,iCAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AACzB,MAAA,KAAA,CAAM,UAAU,KAAK,CAAA;AACrB,MAAA,MAAM,MAAA,GAAS,OAAO,KAAK,CAAA;AAC3B,MAAA,MAAA,CAAO,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACrB,MAAA,MAAM,MAAA,GAAS,MAAM,KAAK,CAAA;AAC1B,MAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAErD,MAAA,KAAA,CAAM,EAAA,CAAG,SAAS,MAAM;AAAA,MAAC,CAAC,CAAA;AAC1B,MAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAAA,QAClB,MAAM,MAAA;AAAA,QACN,MAAM;AAAA,OACR;AAGA,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,aAAa,CAAA,EAAE;AAC3C,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,IAAI;AACF,QAAA,WAAS;AACP,UAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,CAAK;AAAA,YAC9B,MAAM,IAAA,EAAK;AAAA,YACX,KAAK,IAAA,CAAK,OAAO,EAAE,IAAA,EAAM,MAAc,CAAE;AAAA,WAC1C,CAAA;AACD,UAAA,IAAI,MAAA,IAAU,IAAA,IAAQ,KAAA,CAAM,SAAA,EAAW;AACvC,UAAA,IAAI,KAAK,IAAA,EAAM;AACb,YAAA,OAAA,GAAU,IAAA;AACV,YAAA;AAAA,UACF;AACA,UAAA,IAAI,CAAC,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5B,YAAA,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,IAAI,QAAQ,CAAC,OAAA,KAAY,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS,OAAO,CAAC,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,UACnF;AAAA,QACF;AAAA,MACF,CAAA,SAAE;AACA,QAAA,KAAA,CAAM,GAAA,EAAI;AAGV,QAAA,IAAI,CAAC,OAAA,EAAS,KAAK,MAAM,MAAA,IAAS,EAAG,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MACrD;AACA,MAAA,MAAM,OAAO,MAAM,MAAA;AACnB,MAAA,IAAI,IAAA,KAAS,KAAK,CAAC,OAAA;AACjB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,QAAQ,CAAA,0BAAA,EAA6B,MAAM,MAAM,CAAA,CAAE,CAAA;AAClF,MAAA,IAAI,SAAA,CAAU,IAAI,QAAQ,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,QAAQ,CAAA,cAAA,CAAgB,CAAA;AACnF,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,EAAM,CAAC,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,CAAA,EAAG,QAAQ,CAAA,UAAA,CAAA,EAAc,QAAQ,CAAC,CAAA;AACpF,MAAA,KAAA,CAAM,UAAU,KAAK,CAAA;AACrB,MAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAM,CAAA;AACzC,MAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,QAAQ,CAAA,OAAA,CAAS,CAAA;AAAA,IACnF,CAAA;AAAA,IAEA,MAAM,YAAY,QAAA,EAAU;AAE1B,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AACrC,MAAA,IAAI,WAAW,OAAA,CAAQ,QAAA,KAAa,IAAA,IAAQ,OAAA,CAAQ,eAAe,IAAA,EAAM;AAGvE,QAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,OAAO,CAAC,CAAA;AACtE,QAAA,OAAA,CAAQ,KAAK,SAAS,CAAA;AACtB,QAAA,MAAM,eAAe,CAAA,oBAAA,EAAuB,QAAQ,IAAI,MAAM,MAAA,EAAQ,cAAc,CAAA;AAAA,MACtF;AACA,MAAA,MAAM,OAAA,CAAQ,UAAA,CAAW,IAAA,EAAM,CAAC,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,CAAA,EAAG,QAAQ,CAAA,UAAA,CAAY,CAAC,CAAA,EAAG,GAAM,CAAA;AAAA,IACrF;AAAA,GACF;AACF;AAMO,SAAS,yBAAA,CACd,GAAA,GAA0C,OAAA,CAAQ,GAAA,EACjC;AACjB,EAAA,MAAM,IAAA,GAAO,iBAAiB,GAAG,CAAA;AACjC,EAAA,OAAO,IAAA,GAAO,oBAAA,CAAqB,IAAI,CAAA,GAAI,oBAAA;AAC7C;AAEA,SAAS,UAAA,CAAW,MAAc,IAAA,EAA8B;AAC9D,EAAA,OAAO,MAAM,IAAA,EAAM,CAAC,IAAA,EAAM,GAAG,IAAI,CAAA,EAAG;AAAA,IAClC,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK,EAAE,IAAA,EAAM,OAAA,CAAQ,IAAI,IAAA,IAAQ,eAAA,EAAiB,QAAQ,GAAA,EAAI;AAAA,IAC9D,KAAA,EAAO,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM;AAAA,GAC/B,CAAA;AACH;AAEA,SAAS,OAAO,KAAA,EAAsC;AACpD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,KAAA,CAAM,IAAA,CAAK,SAAS,MAAM,CAAA;AAC1B,IAAA,KAAA,CAAM,KAAK,OAAA,EAAS,CAAC,SAAS,OAAA,CAAQ,IAAA,IAAQ,CAAC,CAAC,CAAA;AAAA,EAClD,CAAC,CAAA;AACH;AAGA,SAAS,MAAM,KAAA,EAAsC;AACnD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,KAAA,CAAM,MAAA,EAAQ,YAAY,MAAM,CAAA;AAChC,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAc;AACtC,MAAA,IAAA,GAAA,CAAQ,IAAA,GAAO,CAAA,EAAG,KAAA,CAAM,KAAK,CAAA;AAAA,IAC/B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,KAAK,OAAA,EAAS,MAAM,QAAQ,IAAA,CAAK,IAAA,EAAM,CAAC,CAAA;AAAA,EACxD,CAAC,CAAA;AACH;AAEA,eAAe,OAAA,CACb,OACA,SAAA,EAC2C;AAC3C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,CAAM,MAAA,EAAQ,YAAY,MAAM,CAAA;AAChC,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAc;AACtC,IAAA,MAAA,IAAU,CAAA;AAAA,EACZ,CAAC,CAAA;AACD,EAAA,KAAK,MAAM,KAAK,CAAA;AAChB,EAAA,KAAA,CAAM,OAAO,GAAA,EAAI;AACjB,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,CAAK;AAAA,MAC9B,OAAO,KAAK,CAAA;AAAA,MACZ,IAAI,OAAA,CAAe,CAAC,CAAA,EAAG,MAAA,KAAW;AAChC,QAAA,KAAA,GAAQ,WAAW,MAAM;AACvB,UAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AACpB,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,SAAS,KAAK,CAAC,CAAA;AAAA,QACtE,GAAG,SAAS,CAAA;AAAA,MACd,CAAC;AAAA,KACF,CAAA;AACD,IAAA,OAAO,EAAE,MAAM,MAAA,EAAO;AAAA,EACxB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAAA,EACpB;AACF;AC5LA,IAAM,uBAAA,GAA0B,GAAA;AAwBzB,SAAS,uBAAuB,GAAA,EAAkD;AACvF,EAAA,OAAO,GAAA,EAAK,qBAAqB,OAAA,CAAQ,GAAA,CAAI,qBAAqBA,IAAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AAC7F;AAgBA,eAAsB,qBAAA,CACpB,WACA,IAAA,EAKyC;AACzC,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,IAAA,EAAM,GAAG,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,uBAAA;AACrC,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,oBAAA;AAC/B,EAAA,IAAI;AAIF,IAAA,MAAM,WAAW,MAAM,cAAA;AAAA,MACrB,gBAAgB,SAAS,CAAA,CAAA;AAAA,MACzB,MAAM,MAAA,CAAO,SAAA,EAAW,SAAS,CAAA;AAAA,MACjC;AAAA,KACF;AACA,IAAA,OAAO,WAAW,kBAAA,GAAqB,YAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF","file":"chunk-3KMREAR2.js","sourcesContent":["/**\n * The tool-approval card a driver raises for `permissionMode: \"interactive\"`: a `message_start`\n * carrying an `AskUserQuestion` tool call whose input has an `approval` description. The\n * normalizer turns it into a `question` event with `approval`; a host that reads the driver's\n * events directly (the REPL, a single-shot run) recognises it with {@link approvalCardOf} and\n * answers with {@link APPROVE_ONCE} or {@link DENY} through `driver.answerQuestion`.\n */\nimport type { AgentEvent } from \"./types.js\";\n\n/** The one positive answer of an approval card. */\nexport const APPROVE_ONCE = \"Approve once\";\n/** The negative answer of an approval card. */\nexport const DENY = \"Deny\";\n\n/** What a host needs to ask and answer one approval card. */\nexport interface ApprovalCard {\n  /** The question text; the key `answerQuestion` takes. */\n  question: string;\n  requestId?: string;\n  kind: \"command\" | \"file\" | \"permissions\" | \"mcp\";\n  /** Bounded plain text of what the tool call is about to do. */\n  details: string[];\n}\n\n/** The approval card an event carries, else `undefined`. */\nexport function approvalCardOf(event: AgentEvent): ApprovalCard | undefined {\n  if (event.type !== \"message_start\" || !Array.isArray(event.message.content)) return undefined;\n  for (const block of event.message.content) {\n    if (block.type !== \"tool_use\" || block.name !== \"AskUserQuestion\") continue;\n    const input = block.input as Record<string, unknown> | undefined;\n    const approval = input?.approval as { kind?: unknown; details?: unknown } | undefined;\n    const questions = input?.questions;\n    const first = Array.isArray(questions) ? (questions[0] as { question?: unknown }) : undefined;\n    if (\n      !approval ||\n      typeof first?.question !== \"string\" ||\n      !Array.isArray(approval.details) ||\n      !approval.details.every((d) => typeof d === \"string\")\n    ) {\n      continue;\n    }\n    return {\n      question: first.question,\n      ...(typeof input?.requestId === \"string\" ? { requestId: input.requestId } : {}),\n      kind: approval.kind as ApprovalCard[\"kind\"],\n      details: approval.details as string[],\n    };\n  }\n  return undefined;\n}\n","/**\n * AI endpoint transport for the `claude-sdk` driver — the Claude Agent SDK's\n * child-process environment.\n *\n * {@link buildClaudeEndpointEnv} takes an **AI provider registry entry** and\n * is what the driver calls, on every transport. It is plan §2.3's\n * `buildEndpointEnv` for the claude-sdk row (named for the driver because the\n * vars it emits — `CLAUDE_CODE_USE_*`, `ANTHROPIC_*` — are the Claude Agent\n * SDK's own contract, not a portable one).\n *\n * A registry entry says what the deleted `cloud` axis said — Amazon Bedrock,\n * Google Vertex AI, Azure AI Foundry, a generic gateway — with `surface` +\n * `transport` + `base_url` + `credential`, and says it for the direct\n * endpoint too, which the `cloud` axis could not address at all.\n *\n * Cross-repo contract: env key names and semantics here are load-bearing —\n * the platform resolves credential bundles against the same key set.\n */\n\nimport {\n  type AIProviderEntry,\n  type AIProviderLlmEntry,\n  entryTransport,\n  normalizeAnthropicBaseUrl,\n  resolveEntryBaseUrl,\n} from \"@skaile/workspaces/core/provider-registry\";\n\n/**\n * Env vars scrubbed from the inherited environment before an endpoint env is\n * assembled. Ambient first-party credentials or a stale `CLAUDE_CODE_USE_*`\n * flag must never leak into a session whose entry points elsewhere (the\n * ambient carriers are restored explicitly when the entry has none of its\n * own).\n *\n * Deliberately NOT exhaustive: ambient transport-specific vars (AWS_*,\n * GOOGLE_*, ANTHROPIC_VERTEX_PROJECT_ID, ANTHROPIC_FOUNDRY_*) survive so a\n * standalone CLI inherits its own signing chain; the SDK ignores vars whose\n * transport flag is unset.\n */\nconst SCRUBBED_ENV_KEYS = [\"ANTHROPIC_API_KEY\", \"ANTHROPIC_AUTH_TOKEN\", \"ANTHROPIC_BASE_URL\"];\n\n/**\n * The Anthropic first-party endpoint. An entry that resolves to exactly this\n * host needs no `ANTHROPIC_BASE_URL`: the SDK already points there, and an\n * explicit value would make every default session look like a third-party\n * redirect to Claude Code's own telemetry and auth heuristics.\n */\nexport const ANTHROPIC_DEFAULT_BASE_URL = \"https://api.anthropic.com\";\n\n/**\n * Headers the SDK owns and an entry must not restate through\n * `ANTHROPIC_CUSTOM_HEADERS`: the protocol version it was built against, and\n * the two credential carriers (which are `credential.ref`'s job — a literal\n * secret in `headers` is a validation error anyway).\n */\nconst SDK_OWNED_HEADERS: Record<string, true> = {\n  \"anthropic-version\": true,\n  authorization: true,\n  \"x-api-key\": true,\n};\n\n/**\n * Which of the Claude Agent SDK's four native transports an entry addresses.\n *\n * The SDK has no `transport` field: it switches on a `CLAUDE_CODE_USE_*` flag.\n * Bedrock and Vertex are their own wire surfaces, so they are recognized by\n * `surface` as well as by `transport` — a legacy-derived entry that had no\n * region (and therefore no `params`, and therefore no `transport`) is still a\n * Bedrock session, exactly as it was before the registry existed.\n */\nexport type ClaudeEndpointMode = \"anthropic\" | \"bedrock\" | \"vertex\" | \"foundry\";\n\n/** Classify a registry entry into its {@link ClaudeEndpointMode}. */\nexport function claudeEndpointMode(entry: AIProviderEntry): ClaudeEndpointMode {\n  const surface = (entry as AIProviderLlmEntry).surface;\n  const transport = entryTransport(entry);\n  if (surface === \"bedrock-converse-stream\" || transport === \"bedrock\") return \"bedrock\";\n  if (surface === \"google-vertex\" || transport === \"vertex\") return \"vertex\";\n  if (transport === \"foundry\") return \"foundry\";\n  return \"anthropic\";\n}\n\n/** Arguments for {@link buildClaudeEndpointEnv}. */\nexport interface ClaudeEndpointEnvInput {\n  /** The selected registry entry — the whole endpoint definition. */\n  entry: AIProviderEntry;\n  /**\n   * The entry's credential, already resolved from its `credential.ref`\n   * (`resolveEntryCredential`). Absent for `kind: none`, for an ambient\n   * `sigv4` / `google_adc` / `azure_entra` chain, for `oauth` (whose blob the\n   * runner writes to the Claude credentials file, never to the env), and for a\n   * reference that did not resolve.\n   */\n  credential?: string;\n  /**\n   * The driver's base environment — `process.env` with `undefined` dropped.\n   * The endpoint vars are layered **on top** of it, never instead of it, so\n   * `PATH`, `HOME` and `SKAILE_SESSION_ID` reach the child.\n   */\n  baseEnv: Record<string, string>;\n  /** `AgentConfig.env` plus any credential material the session carried. */\n  configEnv?: Record<string, string>;\n}\n\n/**\n * Assemble the Claude Agent SDK child env for one registry entry (plan §2.3).\n *\n * Pure (no external state read, no input mutated). Starts from `baseEnv`\n * merged with `configEnv`, scrubs the inherited Anthropic credential/routing\n * vars and every `CLAUDE_CODE_USE_*` flag, then writes exactly what the entry\n * describes: at most one transport flag, the endpoint, and the credential in\n * the carrier its `kind` names.\n *\n * Credential kinds (§1.4): `api_key_header` → `ANTHROPIC_API_KEY` (the SDK\n * sends it as `x-api-key`); `bearer` → `ANTHROPIC_AUTH_TOKEN` (sent as\n * `Authorization: Bearer`); `sigv4` / `google_adc` / `azure_entra` emit\n * nothing and let the AWS/Google/Azure chain sign — which is why the scrub\n * deliberately spares ambient `AWS_*` / `GOOGLE_*` values; `oauth` and `none`\n * emit nothing, and the pre-scrub ambient carriers are restored so an OAuth or\n * shell-configured session keeps the auth it had.\n *\n * Never returns `undefined` or empty values; absent settings are omitted.\n */\nexport function buildClaudeEndpointEnv(args: ClaudeEndpointEnvInput): Record<string, string> {\n  const { entry, credential, baseEnv, configEnv } = args;\n  const env: Record<string, string> = { ...baseEnv, ...(configEnv ?? {}) };\n\n  // Captured before the scrub — an entry with no credential material of its\n  // own falls back to these, the way the gateway branch always has.\n  const ambient = { authToken: env.ANTHROPIC_AUTH_TOKEN, apiKey: env.ANTHROPIC_API_KEY };\n\n  for (const key of Object.keys(env)) {\n    if (SCRUBBED_ENV_KEYS.includes(key) || key.startsWith(\"CLAUDE_CODE_USE_\")) {\n      delete env[key];\n    }\n  }\n\n  const set = (key: string, value: string | undefined) => {\n    // Falsy check is deliberate: an empty-string credential/setting is never\n    // valid env — dropping it beats shipping a key the SDK treats as set.\n    if (value) env[key] = value;\n  };\n\n  const kind = entry.credential?.kind ?? \"none\";\n  const params = (entry as AIProviderLlmEntry).params as Record<string, string> | undefined;\n\n  // Static headers ride as ANTHROPIC_CUSTOM_HEADERS (`Name: Value` per line),\n  // the only channel the SDK offers. An entry with none leaves an ambient\n  // value alone.\n  const headers = Object.entries(entry.headers ?? {}).filter(\n    ([name]) => !SDK_OWNED_HEADERS[name.toLowerCase()],\n  );\n  if (headers.length > 0) {\n    env.ANTHROPIC_CUSTOM_HEADERS = headers.map(([name, value]) => `${name}: ${value}`).join(\"\\n\");\n  }\n\n  switch (claudeEndpointMode(entry)) {\n    case \"bedrock\": {\n      env.CLAUDE_CODE_USE_BEDROCK = \"1\";\n      // The AWS credential bundle itself is `configEnv` material (AWS_*), and\n      // ambient AWS_* survived the scrub, so a standalone CLI keeps its own.\n      set(\"AWS_REGION\", params?.region);\n      break;\n    }\n    case \"vertex\": {\n      env.CLAUDE_CODE_USE_VERTEX = \"1\";\n      // GOOGLE_APPLICATION_CREDENTIALS is a path the runner materialized; it\n      // arrives through `configEnv` or ambient, never from `credential`.\n      set(\"ANTHROPIC_VERTEX_PROJECT_ID\", params?.project);\n      set(\"CLOUD_ML_REGION\", params?.location);\n      break;\n    }\n    case \"foundry\": {\n      env.CLAUDE_CODE_USE_FOUNDRY = \"1\";\n      // §1.3: an explicit `base_url` wins over the resource-derived endpoint,\n      // and the SDK has a separate var for each form.\n      if (entry.base_url) set(\"ANTHROPIC_FOUNDRY_BASE_URL\", entry.base_url);\n      else set(\"ANTHROPIC_FOUNDRY_RESOURCE\", params?.resource);\n      set(\"ANTHROPIC_FOUNDRY_API_KEY\", credential);\n      break;\n    }\n    case \"anthropic\": {\n      const baseUrl = normalizeAnthropicBaseUrl(resolveEntryBaseUrl(entry));\n      if (baseUrl && baseUrl.toLowerCase() !== ANTHROPIC_DEFAULT_BASE_URL) {\n        env.ANTHROPIC_BASE_URL = baseUrl;\n      }\n      if (kind === \"bearer\") set(\"ANTHROPIC_AUTH_TOKEN\", credential);\n      else if (kind === \"api_key_header\") set(\"ANTHROPIC_API_KEY\", credential);\n      if (!credential) {\n        // `oauth` / `none` / an unresolved ref: the ambient carriers are the\n        // only auth this session has, and the scrub just removed them.\n        if (ambient.authToken) env.ANTHROPIC_AUTH_TOKEN = ambient.authToken;\n        else set(\"ANTHROPIC_API_KEY\", ambient.apiKey);\n      }\n      break;\n    }\n  }\n\n  return env;\n}\n","/**\n * Poisoned-transcript repair for the Claude Agent SDK driver.\n *\n * The Anthropic Messages API can permanently reject a conversation once its\n * persisted history contains a malformed content block. Because the bad block\n * lives in the SDK's on-disk JSONL transcript, every replayed turn fails with\n * the same `400 invalid_request_error` and the session is bricked with no\n * in-band recovery.\n *\n * This module repairs the transcript in place, covering three known poison\n * classes:\n *\n * 1. **Image `media_type` mismatch / omission.** An image block whose declared\n *    `media_type` does not match — or is missing for — the actual bytes:\n *    `... The image was specified using the image/png media type, but the\n *    image appears to be a image/jpeg image`. Produced by the Claude Code\n *    `Read` tool's format fallback (anthropics/claude-code#55338, #30124,\n *    #33179). Repaired by sniffing the base64 magic bytes and correcting\n *    `media_type`.\n * 2. **Oversized image.** An image whose decoded payload exceeds the API's\n *    5 MB per-image limit (anthropics/claude-code#34566). Replaced with a\n *    text stub — the byte budget cannot be recovered any other way.\n * 3. **`cache_control` on an empty text block.** A text block carrying a\n *    `cache_control` marker with empty/whitespace `text`\n *    (anthropics/claude-code#59626). The `cache_control` field is stripped.\n *\n * Genuinely unidentifiable image blocks are also replaced with a text stub.\n *\n * Recovering by content scan (rather than parsing the API's `messages.N`\n * index) is deliberate: the index addresses the assembled API request, not a\n * JSONL line, and reproducing the SDK's message-assembly is fragile. A full\n * scan is index-free and repairs every poisoned block in one pass.\n *\n * **Async and line-streaming since #454.** A Claude Code transcript is routinely\n * multi-megabyte (base64 images inline in `tool_result` blocks), and this runs on\n * a failed turn *and before every resume* — inside the single-threaded `skaile\n * serve` loop. The previous `readFileSync` + `writeFileSync` + `renameSync` held\n * the loop for the whole file and materialised it twice over as one string. Both\n * passes now stream line by line off a `createReadStream`, so the loop is yielded\n * between lines and peak memory is one JSONL line rather than the whole file, and\n * every I/O phase is deadline-bounded.\n *\n * Streaming was chosen over a worker thread: the work is I/O-bound rather than\n * CPU-bound (per-line `JSON.parse` on a yielded loop is not what stalls a turn),\n * and a worker would add a structured-clone of the same multi-MB payload plus a\n * thread lifecycle to a path that must never block a turn.\n *\n * @module\n */\n\nimport { createReadStream, createWriteStream } from \"node:fs\";\nimport { readdir, rename, stat, unlink } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { pipeline } from \"node:stream/promises\";\nimport { fsDeadlineMs, tryWithFsDeadline, withFsDeadline } from \"@skaile/workspaces/core\";\n\n/**\n * Minimal logger shape accepted by {@link scrubPoisonedTranscript}. Compatible\n * with the bridge `Logger`, but narrowed so the helper stays unit-testable\n * without a real logger instance.\n *\n * @category Transcript repair\n */\nexport interface ScrubLogger {\n  info(message: string, data?: Record<string, unknown>): void;\n  warn(message: string, data?: Record<string, unknown>): void;\n}\n\n/**\n * Options for {@link scrubPoisonedTranscript}.\n *\n * @category Transcript repair\n */\nexport interface ScrubTranscriptOptions {\n  /**\n   * Claude Code config directory — the parent of `projects/`. Resolve from\n   * `CLAUDE_CONFIG_DIR`, falling back to `~/.claude`.\n   */\n  configDir: string;\n  /** SDK session id whose transcript JSONL should be repaired. */\n  sessionId: string;\n  /** Optional logger for diagnostics. */\n  log?: ScrubLogger;\n  /**\n   * Where the transcript is read and written. Defaults to this process's own\n   * filesystem access ({@link localTranscriptStore}); with the agent uid split\n   * the transcript belongs to the agent uid and must be reached through it.\n   */\n  store?: TranscriptStore;\n}\n\n/**\n * Filesystem access to Claude Code transcripts. The CLI creates them 0600 in\n * 0700 dirs, so when it runs as a different uid than the runner, only that uid\n * can locate, read or rewrite them (see `agent-transcript.ts`).\n *\n * @category Transcript repair\n */\nexport interface TranscriptStore {\n  /** Path of `<sessionId>.jsonl` under `<configDir>/projects/`, or `null` when absent. */\n  locate(configDir: string, sessionId: string, timeoutMs?: number): Promise<string | null>;\n  /** The file's contents as UTF-8 chunks. */\n  read(filePath: string): AsyncIterable<string>;\n  /** Atomically replace the file with `chunks` via a `.scrub-tmp` sibling. */\n  replace(filePath: string, chunks: AsyncIterable<string>): Promise<void>;\n  /** Remove the sibling a failed or abandoned {@link replace} left (best effort). */\n  discardTemp(filePath: string): Promise<void>;\n}\n\n/**\n * Outcome of a {@link scrubPoisonedTranscript} pass.\n *\n * @category Transcript repair\n */\nexport interface ScrubTranscriptResult {\n  /** The located JSONL transcript path, or `null` when not found. */\n  filePath: string | null;\n  /** Image blocks whose `media_type` was corrected (or filled in) to match the bytes. */\n  corrected: number;\n  /**\n   * Image blocks replaced with a text stub — either unidentifiable bytes or a\n   * payload over the API's 5 MB per-image limit.\n   */\n  stubbed: number;\n  /** Empty text blocks from which a rejected `cache_control` marker was stripped. */\n  cacheStripped: number;\n  /**\n   * `true` when the transcript was located, contained at least one poisoned\n   * block, and was rewritten. `false` means nothing needed repair (or the\n   * file was not found) — the caller should not retry the resume.\n   */\n  changed: boolean;\n  /**\n   * The last valid `cost-state` entry of this session, read during the same\n   * pass. The CLI restores its run totals from it on `--resume`, so it is the\n   * baseline of the resumed spawn's first `total_cost_usd` and `modelUsage`.\n   * `null` when the transcript holds none (the CLI then starts from zero) or\n   * could not be read.\n   */\n  costState: TranscriptCostState | null;\n}\n\n/**\n * The run totals the Claude Code CLI saves into a transcript as a\n * `{\"type\":\"cost-state\"}` entry and restores on `--resume`.\n *\n * @category Transcript repair\n */\nexport interface TranscriptCostState {\n  /** The CLI's run-cumulative `total_cost_usd` at the time of the save. */\n  totalCostUSD: number;\n  /** The CLI's run-cumulative per-model usage, keyed by model id, in SDK field names. */\n  modelUsage: Record<string, Record<string, number>>;\n}\n\n/** Text inserted in place of an image block whose format cannot be identified. */\nconst STUB_TEXT = \"[image removed: unprocessable image data]\";\n\n/** Text inserted in place of an image block that exceeds the API size limit. */\nconst STUB_TEXT_OVERSIZED = \"[image removed: image too large]\";\n\n/**\n * The Anthropic Messages API rejects any single image whose decoded payload\n * exceeds 5 MB. An image at or under this is left alone; a larger one is\n * stubbed (its byte budget cannot be recovered).\n */\nconst MAX_IMAGE_BYTES = 5 * 1024 * 1024;\n\n/**\n * Identify an image's media type from the leading bytes of its base64 payload.\n *\n * Recognises the four formats the Anthropic API accepts. Returns `null` when\n * the magic bytes match no known format — the caller treats that as a\n * genuinely corrupt block and stubs it.\n *\n * @param base64 - Base64-encoded image data (only the prefix is inspected).\n * @returns An `image/*` media type, or `null` when unrecognised.\n * @category Transcript repair\n */\nexport function sniffImageMediaType(base64: string): string | null {\n  let buf: Buffer;\n  try {\n    // 32 base64 chars decode to 24 bytes — enough for the WebP check at 12.\n    buf = Buffer.from(base64.slice(0, 32), \"base64\");\n  } catch {\n    return null;\n  }\n  if (buf.length < 4) {\n    return null;\n  }\n  // JPEG — SOI marker `FF D8`. Third byte varies (and may be corrupt), so a\n  // two-byte check is intentional: it still matches malformed JPEGs, which is\n  // exactly the poison case the API flags as \"appears to be image/jpeg\".\n  if (buf[0] === 0xff && buf[1] === 0xd8) {\n    return \"image/jpeg\";\n  }\n  // PNG — `89 50 4E 47`.\n  if (buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) {\n    return \"image/png\";\n  }\n  // GIF — `47 49 46 38` (\"GIF8\").\n  if (buf[0] === 0x47 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x38) {\n    return \"image/gif\";\n  }\n  // WebP — `RIFF` at 0..3 and `WEBP` at 8..11.\n  if (\n    buf.length >= 12 &&\n    buf[0] === 0x52 &&\n    buf[1] === 0x49 &&\n    buf[2] === 0x46 &&\n    buf[3] === 0x46 &&\n    buf[8] === 0x57 &&\n    buf[9] === 0x45 &&\n    buf[10] === 0x42 &&\n    buf[11] === 0x50\n  ) {\n    return \"image/webp\";\n  }\n  return null;\n}\n\n/** A base64 image source on a content block (shape is SDK-defined). */\ninterface Base64ImageSource {\n  type?: string;\n  media_type?: string;\n  data?: string;\n}\n\n/** Loosely-typed content block from a transcript message. */\ninterface ContentBlockLike {\n  type?: string;\n  source?: Base64ImageSource;\n  content?: unknown;\n  [k: string]: unknown;\n}\n\n/** Mutable counters threaded through one scrub pass. */\ninterface ScrubCounters {\n  corrected: number;\n  stubbed: number;\n  cacheStripped: number;\n}\n\n/** Total repairs recorded in a counter set — used to detect per-line changes. */\nfunction totalChanges(c: ScrubCounters): number {\n  return c.corrected + c.stubbed + c.cacheStripped;\n}\n\n/**\n * Repair a single content block. Returns the (possibly replaced) block.\n *\n * - A `tool_result` block recurses into its `content` array.\n * - A text block carrying a `cache_control` marker whose `text` is empty or\n *   whitespace has the marker stripped (the API rejects `cache_control` on\n *   empty text blocks).\n * - An image block whose decoded payload exceeds the API's 5 MB limit is\n *   replaced with a text stub.\n * - An image block whose bytes match no known format is replaced with a text\n *   stub (an image cannot simply be dropped — a `tool_result` must keep at\n *   least one content entry, and a bare `image` block is replaced 1:1).\n * - An image block whose declared `media_type` mismatches (or is missing for)\n *   the sniffed type is corrected in place.\n * - Every other block is returned untouched.\n */\nfunction scrubBlock(block: ContentBlockLike, counters: ScrubCounters): ContentBlockLike {\n  if (block.type === \"tool_result\" && Array.isArray(block.content)) {\n    return {\n      ...block,\n      content: (block.content as ContentBlockLike[]).map((inner) => scrubBlock(inner, counters)),\n    };\n  }\n\n  // A `cache_control` marker on a text block whose text is empty or whitespace\n  // is rejected by the API (\"cache_control cannot be set for empty text\n  // blocks\"). Strip the marker — the empty block itself is harmless.\n  if (block.type === \"text\" && block.cache_control != null) {\n    const text = typeof block.text === \"string\" ? block.text : \"\";\n    if (text.trim() === \"\") {\n      counters.cacheStripped++;\n      const clone = { ...block };\n      delete clone.cache_control;\n      return clone;\n    }\n  }\n\n  if (\n    block.type === \"image\" &&\n    block.source?.type === \"base64\" &&\n    typeof block.source.data === \"string\"\n  ) {\n    const data = block.source.data;\n    // The API rejects any image whose decoded payload exceeds 5 MB. The byte\n    // budget cannot be salvaged, so the whole block becomes a text stub.\n    // base64 encodes 3 bytes per 4 chars, so decoded length ≈ len * 3 / 4.\n    if (Math.floor((data.length * 3) / 4) > MAX_IMAGE_BYTES) {\n      counters.stubbed++;\n      return { type: \"text\", text: STUB_TEXT_OVERSIZED };\n    }\n    const sniffed = sniffImageMediaType(data);\n    if (sniffed === null) {\n      counters.stubbed++;\n      return { type: \"text\", text: STUB_TEXT };\n    }\n    if (sniffed !== block.source.media_type) {\n      counters.corrected++;\n      return { ...block, source: { ...block.source, media_type: sniffed } };\n    }\n  }\n\n  return block;\n}\n\n/**\n * Locate the JSONL transcript for `sessionId` under `<configDir>/projects/`.\n *\n * Claude Code encodes the project directory into the `projects/` subfolder\n * name; rather than reproduce that encoding, this scans every subfolder for\n * `<sessionId>.jsonl` (the session id is a UUID — globally unique).\n *\n * Async and deadline-bounded since #454. The `existsSync(projectsDir)` probe is\n * gone: `readdir` already fails on a missing directory, so the probe was a\n * second stat on the same path for no information.\n *\n * `timeoutMs` defaults to {@link fsDeadlineMs} so callers that only need the\n * path (the resume probe) can omit it.\n *\n * @category Transcript repair\n */\nexport async function locateTranscriptPath(\n  configDir: string,\n  sessionId: string,\n  timeoutMs: number = fsDeadlineMs(),\n): Promise<string | null> {\n  const projectsDir = join(configDir, \"projects\");\n  const entries = await tryWithFsDeadline(\n    `readdir ${projectsDir}`,\n    () => readdir(projectsDir),\n    null,\n    timeoutMs,\n  );\n  if (!entries) return null;\n  for (const entry of entries) {\n    const candidate = join(projectsDir, entry, `${sessionId}.jsonl`);\n    const found = await tryWithFsDeadline(\n      `stat ${candidate}`,\n      async () => (await stat(candidate)).isFile(),\n      false,\n      timeoutMs,\n    );\n    if (found) return candidate;\n  }\n  return null;\n}\n\n/**\n * Yield a file's contents line by line, reproducing `readFileSync(...).split(\"\\n\")`\n * exactly — including the final (possibly empty) segment, so a trailing newline\n * survives a rewrite byte for byte.\n *\n * Splits on `\\n` alone, so a line out of a CRLF transcript arrives with its\n * `\\r` still attached. That carrier byte is part of the line here, and\n * {@link repairLine} re-attaches it to a line it rewrites — the file keeps the\n * terminator style it arrived with. Deliberately not `node:readline`:\n * `crlfDelay` strips the `\\r` outright (rewriting a CRLF transcript to LF) and\n * the interface swallows the trailing-newline distinction, either of which\n * would make the \"clean transcript is left byte-for-byte untouched\" guarantee\n * false. Only one line is held in memory at a time, so a multi-MB transcript\n * never materialises as a single string.\n */\nasync function* streamLines(chunks: AsyncIterable<string>): AsyncGenerator<string> {\n  let pending = \"\";\n  for await (const chunk of chunks) {\n    pending += chunk;\n    let idx = pending.indexOf(\"\\n\");\n    while (idx !== -1) {\n      yield pending.slice(0, idx);\n      pending = pending.slice(idx + 1);\n      idx = pending.indexOf(\"\\n\");\n    }\n  }\n  yield pending;\n}\n\n/**\n * The runner's own filesystem access: the default {@link TranscriptStore}.\n *\n * @category Transcript repair\n */\nexport const localTranscriptStore: TranscriptStore = {\n  locate: (configDir, sessionId, timeoutMs) =>\n    locateTranscriptPath(configDir, sessionId, timeoutMs),\n  async *read(filePath) {\n    const stream = createReadStream(filePath, { encoding: \"utf8\" });\n    try {\n      for await (const chunk of stream) yield chunk as string;\n    } finally {\n      stream.destroy();\n    }\n  },\n  async replace(filePath, chunks) {\n    const tmpPath = `${filePath}.scrub-tmp`;\n    await pipeline(chunks, createWriteStream(tmpPath, { encoding: \"utf8\" }));\n    await rename(tmpPath, filePath);\n  },\n  async discardTemp(filePath) {\n    const tmpPath = `${filePath}.scrub-tmp`;\n    await tryWithFsDeadline(`unlink ${tmpPath}`, () => unlink(tmpPath), undefined, fsDeadlineMs());\n  },\n};\n\n/**\n * Per-model counters the CLI's `cost-state` schema requires (checked against\n * `@anthropic-ai/claude-agent-sdk` 0.3.289; `thinkingTokens` is optional there).\n */\nconst COST_STATE_MODEL_FIELDS = [\n  \"inputTokens\",\n  \"outputTokens\",\n  \"cacheReadInputTokens\",\n  \"cacheCreationInputTokens\",\n  \"webSearchRequests\",\n  \"costUSD\",\n] as const;\n\nfunction isCount(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value) && value >= 0;\n}\n\n/**\n * Read a `cost-state` entry of `sessionId` off one JSONL line, or `null` when\n * the line is anything else. Mirrors the CLI, which skips an entry that fails\n * its schema and keeps the last valid one, so an entry with a bad total or a\n * per-model counter that is not a non-negative number is not a restorable\n * state. Leading NUL bytes (a torn append) are stripped, as the CLI does.\n */\nfunction readCostState(line: string, sessionId: string): TranscriptCostState | null {\n  if (!line.includes('\"cost-state\"')) return null;\n  let entry: { type?: unknown; sessionId?: unknown; totalCostUSD?: unknown; modelUsage?: unknown };\n  try {\n    entry = JSON.parse(line.replace(/^\\0+/, \"\"));\n  } catch {\n    return null;\n  }\n  if (entry.type !== \"cost-state\" || entry.sessionId !== sessionId) return null;\n  const total = entry.totalCostUSD;\n  if (!isCount(total)) return null;\n  const usage = entry.modelUsage;\n  if (!usage || typeof usage !== \"object\" || Array.isArray(usage)) return null;\n  for (const model of Object.values(usage)) {\n    if (!model || typeof model !== \"object\") return null;\n    const counters = model as Record<string, unknown>;\n    if (!COST_STATE_MODEL_FIELDS.every((field) => isCount(counters[field]))) return null;\n  }\n  return {\n    totalCostUSD: total,\n    modelUsage: usage as Record<string, Record<string, number>>,\n  };\n}\n\n/**\n * Repair one JSONL line, returning the (possibly rewritten) line and mutating\n * `counters`. A non-JSON, blank, or content-less line is returned untouched.\n *\n * The reader splits on `\\n` only, so a line from a CRLF transcript still carries\n * its trailing `\\r`. An untouched line is returned verbatim and keeps it; a\n * rewritten one is rebuilt by `JSON.stringify`, which would drop it — leaving a\n * repaired CRLF transcript with mixed line endings. So the terminator is split\n * off before the parse and re-appended to the rewritten line.\n */\nfunction repairLine(line: string, counters: ScrubCounters): string {\n  if (line.trim() === \"\") return line;\n  const eol = line.endsWith(\"\\r\") ? \"\\r\" : \"\";\n  const body = eol === \"\" ? line : line.slice(0, -1);\n  let entry: { message?: { content?: unknown } };\n  try {\n    entry = JSON.parse(body);\n  } catch {\n    return line; // Not JSON — leave untouched.\n  }\n  const content = entry.message?.content;\n  if (!Array.isArray(content)) return line;\n  const before = totalChanges(counters);\n  const scrubbed = (content as ContentBlockLike[]).map((block) => scrubBlock(block, counters));\n  if (totalChanges(counters) === before) return line; // Nothing changed on this line.\n  return `${JSON.stringify({ ...entry, message: { ...entry.message, content: scrubbed } })}${eol}`;\n}\n\n/**\n * Scan a Claude Code SDK transcript for image content blocks whose declared\n * `media_type` does not match the actual bytes, repair them, and atomically\n * rewrite the file.\n *\n * Safe to call after a turn has failed: the SDK query is dead at that point,\n * and the next resume re-reads the transcript from disk.\n *\n * **Async since #454.** Two streaming passes rather than one whole-file read:\n * pass 1 counts repairs without writing anything, and pass 2 runs only when\n * pass 1 found something. The common case — the preventive scrub of a clean\n * transcript before every resume — is therefore one streaming read and zero\n * writes, and a clean transcript is still left byte-for-byte untouched.\n *\n * @param opts - Config directory, session id, and an optional logger.\n * @returns A {@link ScrubTranscriptResult}. When `changed` is `true` the\n *   caller may retry the resume with the same session id.\n * @category Transcript repair\n */\nexport async function scrubPoisonedTranscript(\n  opts: ScrubTranscriptOptions,\n): Promise<ScrubTranscriptResult> {\n  const { configDir, sessionId, log } = opts;\n  const store = opts.store ?? localTranscriptStore;\n  const timeoutMs = fsDeadlineMs();\n  const result: ScrubTranscriptResult = {\n    filePath: null,\n    corrected: 0,\n    stubbed: 0,\n    cacheStripped: 0,\n    changed: false,\n    costState: null,\n  };\n\n  let filePath: string | null;\n  try {\n    filePath = await store.locate(configDir, sessionId, timeoutMs);\n  } catch (err) {\n    log?.warn(\"scrub-transcript: failed to locate transcript\", {\n      configDir,\n      sessionId,\n      error: err instanceof Error ? err.message : String(err),\n    });\n    return result;\n  }\n  if (!filePath) {\n    log?.warn(\"scrub-transcript: no transcript found\", { configDir, sessionId });\n    return result;\n  }\n  result.filePath = filePath;\n\n  // ── Pass 1: detect. Streams the transcript, counting repairs, writing nothing.\n  const counters: ScrubCounters = { corrected: 0, stubbed: 0, cacheStripped: 0 };\n  let costState: TranscriptCostState | null = null;\n  try {\n    await withFsDeadline(\n      `scan transcript ${filePath}`,\n      async () => {\n        for await (const line of streamLines(store.read(filePath))) {\n          repairLine(line, counters);\n          costState = readCostState(line, sessionId) ?? costState;\n        }\n      },\n      timeoutMs,\n    );\n  } catch (err) {\n    log?.warn(\"scrub-transcript: failed to read transcript\", {\n      filePath,\n      error: err instanceof Error ? err.message : String(err),\n    });\n    return result;\n  }\n\n  result.corrected = counters.corrected;\n  result.stubbed = counters.stubbed;\n  result.cacheStripped = counters.cacheStripped;\n  result.costState = costState;\n\n  if (totalChanges(counters) === 0) {\n    return result;\n  }\n\n  // ── Pass 2: rewrite. Atomic: stream a sibling temp file, then rename over the\n  // original. Line separators are re-emitted exactly as pass 1 split them, so a\n  // trailing newline and any blank lines survive verbatim.\n  const source = filePath;\n  try {\n    await withFsDeadline(\n      `rewrite transcript ${source}`,\n      async () => {\n        const discard: ScrubCounters = { corrected: 0, stubbed: 0, cacheStripped: 0 };\n        await store.replace(\n          source,\n          (async function* () {\n            let first = true;\n            for await (const line of streamLines(store.read(source))) {\n              yield first ? repairLine(line, discard) : `\\n${repairLine(line, discard)}`;\n              first = false;\n            }\n          })(),\n        );\n      },\n      timeoutMs,\n    );\n  } catch (err) {\n    log?.warn(\"scrub-transcript: failed to rewrite transcript\", {\n      filePath,\n      error: err instanceof Error ? err.message : String(err),\n    });\n    // Never leave a half-written `.scrub-tmp` in the SDK's projects dir, also\n    // when the deadline abandoned the replace mid-write.\n    await store.discardTemp(source).catch(() => {});\n    return result;\n  }\n\n  result.changed = true;\n  log?.info(\"scrub-transcript: repaired poisoned transcript\", {\n    filePath,\n    corrected: result.corrected,\n    stubbed: result.stubbed,\n    cacheStripped: result.cacheStripped,\n  });\n  return result;\n}\n","import { type ChildProcess, spawn } from \"node:child_process\";\nimport { join } from \"node:path\";\nimport { fsDeadlineMs, withFsDeadline } from \"@skaile/workspaces/core\";\nimport { resolveAgentExec } from \"./agent-exec.js\";\nimport { localTranscriptStore, type TranscriptStore } from \"./drivers/scrub-transcript.js\";\n\n/**\n * Transcripts reached through the agent launch shim.\n *\n * With the uid split on, the Claude CLI runs as the agent uid and creates its\n * transcripts 0600 in 0700 dirs, so the runner can no longer list, read or\n * rewrite them itself. This store runs plain tools (`find`, `cat`, `sh`, `mv`)\n * as the agent uid through the shim instead. The child gets only `PATH` and\n * `LC_ALL`, never the runner's environment, and runs in `/` because the\n * runner's own cwd may not be enterable by the agent uid.\n */\nexport function agentTranscriptStore(shim: string): TranscriptStore {\n  // A replace the scrub's deadline abandoned keeps running; discardTemp stops\n  // it before removing its temp file.\n  const inFlight = new Map<string, ChildProcess>();\n  // Paths whose rewrite discardTemp gave up on: their rename must never run.\n  const cancelled = new Set<string>();\n  const track = (filePath: string, child: ChildProcess) => {\n    inFlight.set(filePath, child);\n    child.once(\"close\", () => {\n      if (inFlight.get(filePath) === child) inFlight.delete(filePath);\n    });\n  };\n  return {\n    async locate(configDir, sessionId, timeoutMs = 10_000) {\n      // A session id is a UUID; anything glob- or path-shaped is not ours.\n      if (!/^[A-Za-z0-9._-]+$/.test(sessionId)) return null;\n      const projectsDir = join(configDir, \"projects\");\n      // Markers on stdout, not exit codes, carry the answer: a shim or launcher\n      // failure has exit codes of its own and must never read as \"not found\".\n      const { stdout } = await collect(\n        runAsAgent(shim, [\n          \"sh\",\n          \"-c\",\n          '[ -d \"$1\" ] || { echo \"@@no-projects\"; exit 0; }; ' +\n            'find \"$1\" -mindepth 2 -maxdepth 2 -type f -name \"$2\" -print -quit; echo \"@@find:$?\"',\n          \"sh\",\n          projectsDir,\n          `${sessionId}.jsonl`,\n        ]),\n        timeoutMs,\n      );\n      const lines = stdout.split(\"\\n\").map((l) => l.trim());\n      // A missing projects/ is the same \"not found\" as a failed readdir locally.\n      if (lines.includes(\"@@no-projects\")) return null;\n      const status = lines.find((l) => l.startsWith(\"@@find:\"));\n      if (status === undefined)\n        throw new Error(\"locating a transcript as the agent uid failed (no answer from the shim)\");\n      // A path find printed counts even if it later hit an unreadable sibling.\n      const found = lines.find((l) => l.startsWith(\"/\"));\n      if (found) return found;\n      if (status !== \"@@find:0\")\n        throw new Error(`locating a transcript as the agent uid failed (${status.slice(2)})`);\n      return null;\n    },\n\n    async *read(filePath) {\n      const child = runAsAgent(shim, [\"cat\", \"--\", filePath]);\n      const exited = exitOf(child);\n      exited.catch(() => {}); // awaited below; this only stops an unhandled rejection\n      const stderr = drain(child);\n      child.stdout?.setEncoding(\"utf8\");\n      for await (const chunk of child.stdout as AsyncIterable<string>) yield chunk;\n      const code = await exited;\n      if (code !== 0)\n        throw new Error(`reading ${filePath} as the agent uid failed: ${await stderr}`);\n    },\n\n    async replace(filePath, chunks) {\n      const child = runAsAgent(shim, [\n        \"sh\",\n        \"-c\",\n        // 0600 like the CLI's own files. Only writes the temp file: the rename\n        // is a separate step below, run only after the input was fully sent,\n        // so a killed or starved writer can never commit a partial transcript.\n        'umask 077; cat > \"$1.scrub-tmp\"',\n        \"sh\",\n        filePath,\n      ]);\n      cancelled.delete(filePath);\n      track(filePath, child);\n      const exited = exitOf(child);\n      exited.catch(() => {}); // awaited below; this only stops an unhandled rejection\n      const stderr = drain(child);\n      const stdin = child.stdin;\n      if (!stdin) throw new Error(\"agent shim has no stdin\");\n      // A child that dies early surfaces through its exit code, not an EPIPE crash.\n      stdin.on(\"error\", () => {});\n      const gone = exited.then(\n        () => undefined,\n        () => undefined,\n      );\n      // Stop pulling input as soon as the child is gone (killed by discardTemp,\n      // or failed), instead of waiting on a producer that may never resume.\n      const input = chunks[Symbol.asyncIterator]();\n      let drained = false;\n      try {\n        for (;;) {\n          const next = await Promise.race([\n            input.next(),\n            gone.then(() => ({ dead: true as const })),\n          ]);\n          if (\"dead\" in next || stdin.destroyed) break;\n          if (next.done) {\n            drained = true;\n            break;\n          }\n          if (!stdin.write(next.value)) {\n            await Promise.race([new Promise((resolve) => stdin.once(\"drain\", resolve)), gone]);\n          }\n        }\n      } finally {\n        stdin.end();\n        // Close the producer too, so the reader feeding it (a `cat` through\n        // the shim) is torn down rather than left blocked on a full pipe.\n        if (!drained) void input.return?.()?.catch(() => {});\n      }\n      const code = await exited;\n      if (code !== 0 || !drained)\n        throw new Error(`rewriting ${filePath} as the agent uid failed: ${await stderr}`);\n      if (cancelled.has(filePath)) throw new Error(`rewrite of ${filePath} was abandoned`);\n      const mover = runAsAgent(shim, [\"mv\", \"-f\", \"--\", `${filePath}.scrub-tmp`, filePath]);\n      track(filePath, mover);\n      const moved = await collect(mover, 10_000);\n      if (moved.code !== 0) throw new Error(`renaming the rewritten ${filePath} failed`);\n    },\n\n    async discardTemp(filePath) {\n      // Before anything else, so a writer that is just finishing never renames.\n      cancelled.add(filePath);\n      const pending = inFlight.get(filePath);\n      if (pending && pending.exitCode === null && pending.signalCode === null) {\n        // The writer cannot commit (the rename is a separate step), so this only\n        // stops it; bounded, since a writer stuck on a hung mount may never die.\n        const closed = new Promise((resolve) => pending.once(\"close\", resolve));\n        pending.kill(\"SIGKILL\");\n        await withFsDeadline(`stop the rewrite of ${filePath}`, () => closed, fsDeadlineMs());\n      }\n      await collect(runAsAgent(shim, [\"rm\", \"-f\", \"--\", `${filePath}.scrub-tmp`]), 10_000);\n    },\n  };\n}\n\n/**\n * The transcript store for this runner: through the agent shim when\n * `SKAILE_AGENT_EXEC` is set, the runner's own filesystem otherwise.\n */\nexport function transcriptStoreForRuntime(\n  env: Record<string, string | undefined> = process.env,\n): TranscriptStore {\n  const shim = resolveAgentExec(env);\n  return shim ? agentTranscriptStore(shim) : localTranscriptStore;\n}\n\nfunction runAsAgent(shim: string, argv: string[]): ChildProcess {\n  return spawn(shim, [\"--\", ...argv], {\n    cwd: \"/\",\n    env: { PATH: process.env.PATH ?? \"/usr/bin:/bin\", LC_ALL: \"C\" },\n    stdio: [\"pipe\", \"pipe\", \"pipe\"],\n  });\n}\n\nfunction exitOf(child: ChildProcess): Promise<number> {\n  return new Promise((resolve, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"close\", (code) => resolve(code ?? 1));\n  });\n}\n\n/** Keep the last 1 KiB of stderr for the error message, and keep the pipe drained. */\nfunction drain(child: ChildProcess): Promise<string> {\n  return new Promise((resolve) => {\n    let tail = \"\";\n    child.stderr?.setEncoding(\"utf8\");\n    child.stderr?.on(\"data\", (c: string) => {\n      tail = (tail + c).slice(-1024);\n    });\n    child.stderr?.once(\"close\", () => resolve(tail.trim()));\n  });\n}\n\nasync function collect(\n  child: ChildProcess,\n  timeoutMs: number,\n): Promise<{ code: number; stdout: string }> {\n  let stdout = \"\";\n  child.stdout?.setEncoding(\"utf8\");\n  child.stdout?.on(\"data\", (c: string) => {\n    stdout += c;\n  });\n  void drain(child);\n  child.stdin?.end();\n  let timer: NodeJS.Timeout | undefined;\n  try {\n    const code = await Promise.race([\n      exitOf(child),\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => {\n          child.kill(\"SIGKILL\");\n          reject(new Error(`agent shim did not answer within ${timeoutMs} ms`));\n        }, timeoutMs);\n      }),\n    ]);\n    return { code, stdout };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n","/**\n * Pre-first-turn resume probe for the Claude Agent SDK driver.\n *\n * A tier-1 native resume only hands its session id to the SDK inside the first\n * real turn, so the `jsonl_lost` outcome (\"No conversation found\") is invisible\n * until a turn is consumed. The runner shares the container filesystem with the\n * SDK, so a cheap `stat` of the on-disk JSONL transcript is an authoritative,\n * side-effect-free signal of whether the resume will find its history — no\n * probe query, no spurious model turn.\n *\n * @module\n */\n\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { withFsDeadline } from \"@skaile/workspaces/core\";\nimport { locateTranscriptPath } from \"./scrub-transcript.js\";\n\n/**\n * Overall wall-clock budget for the probe. Deliberately a small fraction of the\n * platform's `session_init_ack` timeout (`DEFAULT_INIT_ACK_TIMEOUT_MS`, 15s):\n * the probe runs synchronously on the pre-ack path, so a wedged\n * `CLAUDE_CONFIG_DIR` mount must never push the ack past its deadline.\n */\nconst RESUME_PROBE_TIMEOUT_MS = 2_000;\n\n/**\n * Outcome of {@link probeResumeTranscript}: whether the SDK transcript for a\n * requested tier-1 resume exists on disk.\n *\n * @category Resume probe\n */\nexport type ResumeProbeOutcome = \"transcript_found\" | \"jsonl_lost\";\n\n/**\n * Resolve the Claude Code config directory — the parent of `projects/` — from\n * an explicit env map, the process environment, or the `~/.claude` default.\n *\n * The runner's probe and the claude-sdk driver share this one resolver, so they\n * agree as long as they see the same `CLAUDE_CONFIG_DIR`. Today they do:\n * `CLAUDE_CONFIG_DIR` is container-scoped and neither side threads a per-session\n * override through `config.env`, so both fall through to `process.env`. If a\n * future change ever set the driver's `config.env.CLAUDE_CONFIG_DIR` to a\n * divergent path, the reactive `resume_failed { jsonl_lost }` turn remains the\n * safety net.\n *\n * @category Resume probe\n */\nexport function resolveClaudeConfigDir(env?: Record<string, string | undefined>): string {\n  return env?.CLAUDE_CONFIG_DIR || process.env.CLAUDE_CONFIG_DIR || join(homedir(), \".claude\");\n}\n\n/**\n * Probe whether the SDK JSONL transcript for `sessionId` exists on disk.\n *\n * Non-null locator result → `transcript_found`; null → `jsonl_lost`;\n * `undefined` → outcome unknown (the probe exceeded its budget or errored). The\n * caller leaves the ack field ABSENT on `undefined` so the reactive\n * `resume_failed { jsonl_lost }` turn stays the safety net — a timed-out probe\n * must never masquerade as a genuine `jsonl_lost` and force a needless downgrade.\n *\n * `opts.timeoutMs` overrides {@link RESUME_PROBE_TIMEOUT_MS}; `opts.locate`\n * overrides the transcript locator (used by tests / alternate stores).\n *\n * @category Resume probe\n */\nexport async function probeResumeTranscript(\n  sessionId: string,\n  opts?: {\n    env?: Record<string, string | undefined>;\n    timeoutMs?: number;\n    locate?: (configDir: string, sessionId: string) => Promise<string | null>;\n  },\n): Promise<ResumeProbeOutcome | undefined> {\n  const configDir = resolveClaudeConfigDir(opts?.env);\n  const timeoutMs = opts?.timeoutMs ?? RESUME_PROBE_TIMEOUT_MS;\n  const locate = opts?.locate ?? locateTranscriptPath;\n  try {\n    // Bound the whole probe on wall-clock and THROW on expiry: the inner per-op\n    // deadline swallows a timeout into a null path (a false `jsonl_lost`), so a\n    // wedged mount must yield \"unknown\" here rather than a spurious downgrade.\n    const filePath = await withFsDeadline(\n      `resume-probe ${sessionId}`,\n      () => locate(configDir, sessionId),\n      timeoutMs,\n    );\n    return filePath ? \"transcript_found\" : \"jsonl_lost\";\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/chunk-4ZTPYIBE.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../workspace-plugin/src/tools/validator.ts"],"names":["val"],"mappings":";;;;AAKA,IAAM,aAAA,GAAgB,UAAU,QAAQ,CAAA;AASxC,IAAM,gBAAA,GAAmB,GAAA;AAqBzB,SAAS,gBAAgB,MAAA,EAGvB;AACA,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,gBAAA,EAAkB,cAAA,MAAoB,EAAC;AAC1D,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,IAAI,MAAA,CAAO,CAAC,MAAM,OAAO,CAAA,CAAE,cAAc,QAAQ,CAAA;AAAA,IACzD,UAAA,EAAY,IAAI,MAAA,CAAO,CAAC,MAAM,OAAO,CAAA,CAAE,cAAc,QAAQ;AAAA,GAC/D;AACF;AAOA,SAAS,gBAAgB,MAAA,EAIvB;AACA,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAW,GAAI,gBAAgB,MAAM,CAAA;AACrD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,gBAAA,EAAkB,oBAAA,QAA4B,EAAC;AACrE,EAAA,OAAO,EAAE,QAAQ,MAAA,CAAO,MAAA,EAAQ,YAAY,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAO;AACvF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAA,EAAG,OAAO,MAAA;AAC9B,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,IAAA,CAAA;AAC7B;AAEA,SAAS,cAAc,GAAA,EAKrB;AACA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AAC1B,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,KAAA,CAAM,CAAC,CAAA;AAC3B,IAAA,MAAMA,IAAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AAC/B,IAAA,IAAIA,IAAAA,SAAY,EAAE,QAAA,EAAU,MAAM,KAAA,EAAOA,IAAAA,EAAK,UAAU,KAAA,EAAM;AAC9D,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,CAAA,SAAA,EAAY,OAAO,CAAA,YAAA,CAAA,EAAe;AAAA,EACrE;AACA,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,IAAI,GAAA,SAAY,EAAE,QAAA,EAAU,MAAM,KAAA,EAAO,GAAA,EAAK,UAAU,KAAA,EAAM;AAC9D,EAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,CAAA,CAAA,EAAI,GAAG,CAAA,0BAAA,CAAA,EAA6B;AACvE;AAeA,eAAsB,aAAA,CACpB,MAAA,EACA,MAAA,EACA,KAAA,EACqB;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAW,GAAI,gBAAgB,MAAM,CAAA;AACrD,IAAA,OAAO,MAAA,CAAO;AAAA,MACZ,MAAA;AAAA,MACA,KAAA;AAAA,MACA,YAAY,MAAA,CAAO,MAAA;AAAA,MACnB,gBAAgB,UAAA,CAAW,MAAA;AAAA,MAC3B,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,CAAC,OAAO,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAI,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,OAAA,EAAS,MAAK,CAAE,CAAA;AAAA,MACzE,UAAA,EAAY,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAI,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,CAAA;AAAA,MACnE,YAAY,MAAA,CAAO;AAAA,KACpB,CAAA;AAAA,EACH,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,oBAAoB,GAAA,EAAkC;AAC1E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,cAAc,GAAG,CAAA;AAChC,IAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,KAAA,EAAO;AACnC,MAAA,OAAO,MAAA,CAAO;AAAA,QACZ,QAAA,EAAU,IAAA;AAAA,QACV,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,MAAA,EAAQ,UAAA,CAAW,MAAA,CAAO,KAAK;AAAA,OAChC,CAAA;AAAA,IACH;AACA,IAAA,IAAI,GAAA,CAAI,SAAS,GAAG,CAAA,IAAK,CAAC,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AAChD,MAAA,OAAO,MAAA,CAAO;AAAA,QACZ,QAAA,EAAU,KAAA;AAAA,QACV,OAAO,CAAA,UAAA,EAAa,GAAA,CAAI,MAAM,GAAG,CAAA,CAAE,CAAC,CAAC,CAAA,kFAAA;AAAA,OACtC,CAAA;AAAA,IACH;AACA,IAAA,OAAO,OAAO,EAAE,QAAA,EAAU,OAAO,KAAA,EAAO,MAAA,CAAO,OAAO,CAAA;AAAA,EACxD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,iBAAA,CAAkB,QAAoB,MAAA,EAAqC;AAC/F,EAAA,MAAM,MAAA,GAAkC;AAAA,IACtC,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,WAAW,KAAA,EAAM;AAAA,IACzC,QAAQ,EAAC;AAAA,IACT,YAAY;AAAC,GACf;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAA,KAAW,KAAA,GAAQ,KAAA,GAAQ,QAAA;AAI9C,IAAA,MAAM,aAAA,CAAc,OAAA,EAAS,CAAC,UAAU,CAAA,EAAG;AAAA,MACzC,OAAA,EAAS,gBAAA;AAAA,MACT,UAAA,EAAY;AAAA,KACb,CAAA;AACD,IAAC,MAAA,CAAO,OAAe,SAAA,GAAY,IAAA;AAAA,EACrC,CAAA,CAAA,MAAQ;AACN,IAAC,MAAA,CAAO,OAAe,SAAA,GAAY,KAAA;AACnC,IAAC,MAAA,CAAO,MAAA,CAAe,IAAA,GAAO,CAAA,aAAA,EAAgB,MAAM,CAAA,2BAAA,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAW,GAAI,gBAAgB,MAAM,CAAA;AACrD,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAC,MAAA,CAAO,OAAiB,IAAA,CAAK;AAAA,MAC5B,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,OAAA,EAAS,IAAA;AAAA,MACT,EAAA,EAAI;AAAA,KACL,CAAA;AAAA,EACH;AAEA,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAC,MAAA,CAAO,WAAqB,IAAA,CAAK;AAAA,MAChC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,SAAS,CAAA,CAAE,MAAA;AAAA,MACX,SAAA,EAAW,IAAA;AAAA,MACX,EAAA,EAAI;AAAA,KACL,CAAA;AAAA,EACH;AAEA,EAAA,MAAA,CAAO,SACJ,MAAA,CAAO,MAAA,CAAe,aACtB,MAAA,CAAO,MAAA,CAAiB,MAAM,CAAC,CAAA,KAAM,CAAA,CAAE,EAAE,KACzC,MAAA,CAAO,UAAA,CAAqB,MAAM,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA;AAEhD,EAAA,OAAO,OAAO,MAAM,CAAA;AACtB;AAYA,eAAsB,gBAAgB,MAAA,EAAyC;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,gBAAgB,MAAM,CAAA;AACrC,IAAA,MAAM,OAAO,MAAA,EAAO;AACpB,IAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AACpC,IAAA,OAAO,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,MAAA,EAAQ,OAAO,CAAA;AAAA,EACjD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF","file":"chunk-4ZTPYIBE.js","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport type { ToolResult } from \"../types.js\";\nimport { err, okJson } from \"../types.js\";\n\nconst execFileAsync = promisify(execFile);\n\n/**\n * Wall-clock ceiling for the driver-binary probe.\n *\n * `which` searches `PATH`, and a `PATH` entry on a wedged network mount makes\n * the lookup itself unbounded. This runs on an agent request path inside the\n * long-lived `skaile serve` process, so the probe must fail rather than wait.\n */\nconst WHICH_TIMEOUT_MS = 10_000;\n\n// Minimal interface for WorkspacePlugin to avoid circular dep.\n// The unified ConnectorManager owns both filesystem-face (mountable) and\n// tool-face connectors — `listConnectors()` returns both; filesystem-face\n// entries carry a `mountPath`.\ninterface ConnectorSummary {\n  id: string;\n  driver: string;\n  mountPath?: string;\n}\ninterface PluginLike {\n  projectDir: string;\n  connectorManager: {\n    listConnectors(): ConnectorSummary[];\n    listFailedConnectors?(): unknown[];\n  } | null;\n  reload(): Promise<void>;\n}\n\n/** Split a manager's connectors into mountable / tool-face groups. */\nfunction splitConnectors(plugin: PluginLike): {\n  mounts: ConnectorSummary[];\n  connectors: ConnectorSummary[];\n} {\n  const all = plugin.connectorManager?.listConnectors() ?? [];\n  return {\n    mounts: all.filter((c) => typeof c.mountPath === \"string\"),\n    connectors: all.filter((c) => typeof c.mountPath !== \"string\"),\n  };\n}\n\n/**\n * Connected mounts/connectors plus the declared-but-failed ones. Without\n * `failed`, a declaration that never connected leaves every count unchanged,\n * which reads the same as a declaration that was never saved.\n */\nfunction countConnectors(plugin: PluginLike): {\n  mounts: number;\n  connectors: number;\n  failed: number;\n} {\n  const { mounts, connectors } = splitConnectors(plugin);\n  const failed = plugin.connectorManager?.listFailedConnectors?.() ?? [];\n  return { mounts: mounts.length, connectors: connectors.length, failed: failed.length };\n}\n\nfunction maskSecret(value: string): string {\n  if (value.length <= 4) return \"****\";\n  return `${value.slice(0, 4)}****`;\n}\n\nfunction resolveEnvRef(ref: string): {\n  resolved: boolean;\n  value?: string;\n  provider?: string;\n  error?: string;\n} {\n  if (ref.startsWith(\"env:\")) {\n    const varName = ref.slice(4);\n    const val = process.env[varName];\n    if (val) return { resolved: true, value: val, provider: \"env\" };\n    return { resolved: false, error: `env var '${varName}' is not set` };\n  }\n  const val = process.env[ref];\n  if (val) return { resolved: true, value: val, provider: \"env\" };\n  return { resolved: false, error: `'${ref}' not found in environment` };\n}\n\n/**\n * Return a summary of the current workspace configuration.\n *\n * Reports the active driver, model, mount count, connector count, and\n * per-resource descriptors. Endpoints are not summarised here: they live in\n * the session's AI provider registry, which `skaile providers list` prints.\n *\n * @param plugin   - Plugin instance (or compatible shape) exposing managers.\n * @param driver   - Driver name (e.g. `\"omp\"`, `\"claude-sdk\"`).\n * @param model    - Model identifier, if resolved.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function workspaceInfo(\n  plugin: PluginLike,\n  driver: string,\n  model: string | undefined,\n): Promise<ToolResult> {\n  try {\n    const { mounts, connectors } = splitConnectors(plugin);\n    return okJson({\n      driver,\n      model,\n      mountCount: mounts.length,\n      connectorCount: connectors.length,\n      mounts: mounts.map((v) => ({ id: v.id, driver: v.driver, mounted: true })),\n      connectors: connectors.map((c) => ({ id: c.id, adapter: c.driver })),\n      projectDir: plugin.projectDir,\n    });\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Test resolution of a secret reference.\n *\n * Resolves `env:<VAR>` references against `process.env`.  For other provider\n * schemes (e.g. `forge:key`) reports that a running forge/vault context is\n * required.  Returns a JSON object with `{ resolved, provider?, masked? }` —\n * the secret value is never returned in plain text.\n *\n * @param ref - Secret reference string, e.g. `\"env:ANTHROPIC_API_KEY\"`.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function workspaceTestSecret(ref: string): Promise<ToolResult> {\n  try {\n    const result = resolveEnvRef(ref);\n    if (result.resolved && result.value) {\n      return okJson({\n        resolved: true,\n        provider: result.provider,\n        masked: maskSecret(result.value),\n      });\n    }\n    if (ref.includes(\":\") && !ref.startsWith(\"env:\")) {\n      return okJson({\n        resolved: false,\n        error: `Provider '${ref.split(\":\")[0]}' requires a running forge/vault context. Use env: refs for standalone validation.`,\n      });\n    }\n    return okJson({ resolved: false, error: result.error });\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Run a full health check on the workspace.\n *\n * Checks whether the driver binary is installed, then validates every\n * declared mount and connector.  Returns a JSON report with a top-level\n * `passed` boolean and per-resource `ok` flags.\n *\n * @param plugin - Plugin instance (or compatible shape) exposing managers.\n * @param driver - Driver name used to locate the binary (`omp` or `claude`).\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function workspaceValidate(plugin: PluginLike, driver: string): Promise<ToolResult> {\n  const report: Record<string, unknown> = {\n    driver: { name: driver, installed: false },\n    mounts: [] as unknown[],\n    connectors: [] as unknown[],\n  };\n\n  try {\n    const binaryName = driver === \"omp\" ? \"omp\" : \"claude\";\n    // `killSignal: \"SIGKILL\"`: a process stuck in an uninterruptible wait on a\n    // dead mount never receives SIGTERM, so a SIGTERM-based timeout would not\n    // actually end it — the same reason the recipe resolver uses SIGKILL.\n    await execFileAsync(\"which\", [binaryName], {\n      timeout: WHICH_TIMEOUT_MS,\n      killSignal: \"SIGKILL\",\n    });\n    (report.driver as any).installed = true;\n  } catch {\n    (report.driver as any).installed = false;\n    (report.driver as any).hint = `Install the '${driver}' binary to use this driver`;\n  }\n\n  const { mounts, connectors } = splitConnectors(plugin);\n  for (const v of mounts) {\n    (report.mounts as any[]).push({\n      id: v.id,\n      driver: v.driver,\n      mounted: true,\n      ok: true,\n    });\n  }\n\n  for (const c of connectors) {\n    (report.connectors as any[]).push({\n      id: c.id,\n      adapter: c.driver,\n      connected: true,\n      ok: true,\n    });\n  }\n\n  report.passed =\n    (report.driver as any).installed &&\n    (report.mounts as any[]).every((v) => v.ok) &&\n    (report.connectors as any[]).every((c) => c.ok);\n\n  return okJson(report);\n}\n\n/**\n * Re-read `skaile.yaml` and reinitialise all plugin resources.\n *\n * Delegates to `plugin.reload()`.  Returns a JSON object comparing the\n * mount and connector counts before and after the reload.\n *\n * @param plugin - Plugin instance exposing a `reload()` method.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function workspaceReload(plugin: PluginLike): Promise<ToolResult> {\n  try {\n    const before = countConnectors(plugin);\n    await plugin.reload();\n    const after = countConnectors(plugin);\n    return okJson({ reloaded: true, before, after });\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n"]}

package/dist/chunk-5BEFNLOR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../core/src/framework.ts"],"names":[],"mappings":";AA4BO,IAAM,iBAAA,GAAoB;AAO1B,IAAM,eAAA,GAA+C;AAAA,EAC1D,YAAA,EAAc;AAAA,IACZ,SAAA,EAAW,gBAAA;AAAA,IACX,SAAA,EAAW,gBAAA;AAAA,IACX,UAAA,EAAY;AAAA,GACd;AAAA,EACA,KAAA,EAAO;AAAA,IACL,SAAA,EAAW,eAAA;AAAA,IACX,SAAA,EAAW,eAAA;AAAA,IACX,UAAA,EAAY;AAAA,GACd;AAAA,EACA,GAAA,EAAK;AAAA,IACH,SAAA,EAAW,aAAA;AAAA,IACX,SAAA,EAAW,aAAA;AAAA,IACX,UAAA,EAAY;AAAA;AAEhB;AA0BO,SAAS,mBAAmB,QAAA,EAAqC;AACtE,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,iBAAA;AAClC,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,MAAM,CAAA,IAAK,gBAAgB,iBAAiB,CAAA;AAC7E,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,QAAA,CAAS,SAAA,IAAa,QAAA,CAAU,SAAA;AAAA,IAC3C,SAAA,EAAW,QAAA,CAAS,SAAA,IAAa,QAAA,CAAU,SAAA;AAAA,IAC3C,UAAA,EAAY,QAAA,CAAS,UAAA,IAAc,QAAA,CAAU;AAAA,GAC/C;AACF","file":"chunk-5BEFNLOR.js","sourcesContent":["/**\n * Driver path resolution — maps execution driver names to their runtime paths.\n */\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\n/**\n * Resolved runtime path structure for a bridge driver.\n * All three directories are relative to the project root.\n * @docLink packages/core/concepts#driver-paths\n */\nexport interface DriverPaths {\n  /** Where skills (SKILL.md dirs) are installed relative to projectDir */\n  skillsDir: string;\n  /** Where agent definitions are installed relative to projectDir */\n  agentsDir: string;\n  /** Where prompt files are installed relative to projectDir */\n  promptsDir: string;\n}\n\n// ── Driver defaults ───────────────────────────────────────────────────────────\n\n/**\n * The driver a session runs on when no settings layer, flag or profile names\n * one. The single definition: settings defaults, path resolution and the\n * runner's session build all import it.\n * @docLink packages/core/concepts#driver-defaults\n */\nexport const DEFAULT_DRIVER_ID = \"omp\";\n\n/**\n * Built-in per-driver runtime path conventions (relative to project root).\n * Covers `claude-sdk`, `codex`, and `omp`. Used as defaults by `resolveDriverPaths`.\n * @docLink packages/core/concepts#driver-defaults\n */\nexport const DRIVER_DEFAULTS: Record<string, DriverPaths> = {\n  \"claude-sdk\": {\n    skillsDir: \".claude/skills\",\n    agentsDir: \".claude/agents\",\n    promptsDir: \".claude/commands\",\n  },\n  codex: {\n    skillsDir: \".codex/skills\",\n    agentsDir: \".codex/agents\",\n    promptsDir: \".codex/rules\",\n  },\n  omp: {\n    skillsDir: \".omp/skills\",\n    agentsDir: \".omp/agents\",\n    promptsDir: \".omp/prompts\",\n  },\n};\n\n// ── Driver resolution ─────────────────────────────────────────────────────────\n\n/** Settings interface — minimal subset needed for driver path resolution. */\ninterface SettingsLike {\n  skillsDir?: string;\n  agentsDir?: string;\n  promptsDir?: string;\n  driver?: string;\n}\n\n/**\n * Resolve the effective runtime paths for a bridge driver.\n *\n * Looks up `DRIVER_DEFAULTS[settings.driver]`, then overlays any per-field\n * overrides from `settings.skillsDir`, `settings.agentsDir`, `settings.promptsDir`.\n * Falls back to the `omp` defaults for unknown driver values.\n *\n * To look up file install paths for a specific IDE/tool target, use\n * `DRIVER_TARGETS[driverTarget]` from `driver-targets.ts` directly.\n *\n * @param settings - Minimal settings object providing `driver` and optional path overrides\n * @returns `DriverPaths` with resolved relative paths for skills, agents, and prompts\n * @docLink packages/core/concepts#resolve-driver-paths\n */\nexport function resolveDriverPaths(settings: SettingsLike): DriverPaths {\n  const driver = settings.driver ?? DEFAULT_DRIVER_ID;\n  const defaults = DRIVER_DEFAULTS[driver] ?? DRIVER_DEFAULTS[DEFAULT_DRIVER_ID];\n  return {\n    skillsDir: settings.skillsDir ?? defaults!.skillsDir,\n    agentsDir: settings.agentsDir ?? defaults!.agentsDir,\n    promptsDir: settings.promptsDir ?? defaults!.promptsDir,\n  };\n}\n"]}

package/dist/chunk-5TBFN46Z.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../core/src/store.ts"],"names":[],"mappings":";;;;;;AA6BO,SAAS,YAAA,CACd,IAAA,EACA,MAAA,EACA,aAAA,EACA,GAAA,EACQ;AACR,EAAA,MAAM,SAAA,GAAY,eAAe,MAAM,CAAA;AACvC,EAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,MAAM,CAAA,CAAA,CAAG,CAAA;AACpE,EAAA,MAAM,KAAA,GAAQ,gBAAgB,QAAA,GAAW,OAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,UAAU,KAAK,CAAA;AAC7B,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,IAAI,CAAA,IAAK,MAAM,KAAA,IAAS,EAAA;AAC9C,EAAA,IAAI,aAAA,EAAe;AAGjB,IAAA,IAAI,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/D,MAAA,OAAO,KAAK,eAAA,EAAgB,EAAG,QAAQ,KAAA,CAAM,WAAA,CAAY,MAAM,CAAC,CAAA;AAAA,IAClE;AACA,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,GAAA,IAAO,OAAO,CAAA;AAC9C;AAaO,SAAS,WAAA,CACd,IAAA,EACA,IAAA,EACA,MAAA,EACA,eACA,GAAA,EACQ;AACR,EAAA,OAAO,KAAK,YAAA,CAAa,IAAA,EAAM,QAAQ,aAAA,EAAe,GAAG,GAAG,IAAI,CAAA;AAClE;AAeO,SAAS,aAAA,CACd,IAAA,EACA,IAAA,EACA,MAAA,EACA,eACA,GAAA,EACU;AACV,EAAA,MAAM,MAAM,WAAA,CAAY,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,eAAe,GAAG,CAAA;AAC9D,EAAA,OAAO,IAAA,KAAS,OAAA,GAAU,CAAC,GAAA,EAAK,CAAA,EAAG,GAAG,CAAA,GAAA,CAAA,EAAO,CAAA,EAAG,GAAG,CAAA,KAAA,CAAO,CAAA,GAAI,CAAC,GAAG,CAAA;AACpE;AAmBO,SAAS,UAAA,CACd,IAAA,EACA,IAAA,EACA,MAAA,EACA,eACA,GAAA,EACS;AACT,EAAA,MAAM,KAAA,GACJ,SAAS,OAAA,IAAW,MAAA,KAAW,QAC3B,CAAC,CAAA,EAAG,YAAY,IAAA,EAAM,IAAA,EAAM,QAAQ,aAAA,EAAe,GAAG,CAAC,CAAA,GAAA,CAAK,CAAA,GAC5D,cAAc,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,aAAA,EAAe,GAAG,CAAA;AAC1D,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM;AACvB,IAAA,IAAI;AAEF,MAAA,IAAI,UAAU,CAAC,CAAA,CAAE,cAAA,EAAe,WAAY,CAAC,CAAA;AAC7C,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF,CAAC,CAAA;AACH","file":"chunk-5TBFN46Z.js","sourcesContent":["/**\n * Deploy-target helpers — resolve framework-specific install paths.\n *\n * This module contains only deploy path resolution. All catalog, repository,\n * and history I/O has moved to @skaile/asset-manager (project-local).\n */\n\nimport { lstatSync, statSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport { globalSkaileDir } from \"./cache-paths.js\";\nimport type { DriverTarget } from \"./driver-targets.js\";\nimport { type AiComponent, DRIVER_TARGETS } from \"./driver-targets.js\";\n\n// ── Deploy-target helpers ─────────────────────────────────────────────────────\n\n/**\n * Resolve the base deploy directory for an asset kind in a given driver target + scope.\n * For local scope, the path is relative to `cwd` (defaults to `process.cwd()`).\n * For global scope, `~` is expanded to the home directory.\n *\n * @param kind - Asset component type (e.g. `\"skill\"`, `\"agent\"`)\n * @param target - Driver target identifier (e.g. `\"claude-code\"`, `\"omp\"`)\n * @param globalInstall - `true` for user-global install, `false` for project-local\n * @param cwd - Working directory for project-local installs (default: `process.cwd()`)\n * @returns Absolute path to the base deploy directory\n * @throws When `target` is not found in `DRIVER_TARGETS`\n * @docLink packages/core/concepts#deployed-base\n */\nexport function deployedBase(\n  kind: AiComponent,\n  target: DriverTarget,\n  globalInstall: boolean,\n  cwd?: string,\n): string {\n  const targetMap = DRIVER_TARGETS[target];\n  if (!targetMap) throw new Error(`Unknown deploy target: '${target}'`);\n  const scope = globalInstall ? \"global\" : \"local\";\n  const paths = targetMap[scope];\n  const destStr = paths[kind] ?? paths.skill ?? \"\";\n  if (globalInstall) {\n    // `~/.skaile/...` is skaile's own per-user root, so it follows `$SKAILE_HOME`;\n    // every other `~/...` is a driver's home dir (`~/.claude`, `~/.omp`, ...).\n    if (destStr === \"~/.skaile\" || destStr.startsWith(\"~/.skaile/\")) {\n      return join(globalSkaileDir(), destStr.slice(\"~/.skaile\".length));\n    }\n    return destStr.replace(/^~/, homedir());\n  }\n  return resolve(cwd ?? process.cwd(), destStr);\n}\n\n/**\n * Return the full deploy path for a named asset: `<deployedBase>/<name>`.\n *\n * @param kind - Asset component type\n * @param name - Asset name (becomes the directory/file name under the base)\n * @param target - Driver target identifier\n * @param globalInstall - `true` for user-global, `false` for project-local\n * @param cwd - Working directory for local installs\n * @returns Absolute path to the asset's deploy directory\n * @docLink packages/core/concepts#deployed-dir\n */\nexport function deployedDir(\n  kind: AiComponent,\n  name: string,\n  target: DriverTarget,\n  globalInstall: boolean,\n  cwd?: string,\n): string {\n  return join(deployedBase(kind, target, globalInstall, cwd), name);\n}\n\n/**\n * Every path a deploy of `name` can occupy. Skills, prompts, flows and contracts\n * deploy to `<base>/<name>`; an agent is rendered into the harness's native file\n * (`<base>/<name>.md` for claude-code, `<base>/<name>.toml` for codex) or a\n * directory (`<base>/<name>/` for omp), so all three count.\n *\n * @param kind - Asset component type\n * @param name - Asset name\n * @param target - Driver target identifier\n * @param globalInstall - `true` for user-global, `false` for project-local\n * @param cwd - Working directory for local installs\n * @returns Absolute paths, the {@link deployedDir} first\n */\nexport function deployedPaths(\n  kind: AiComponent,\n  name: string,\n  target: DriverTarget,\n  globalInstall: boolean,\n  cwd?: string,\n): string[] {\n  const dir = deployedDir(kind, name, target, globalInstall, cwd);\n  return kind === \"agent\" ? [dir, `${dir}.md`, `${dir}.toml`] : [dir];\n}\n\n/**\n * Check whether an asset is already deployed at one of its {@link deployedPaths}.\n * Uses `lstatSync` so symlinks are treated as deployed; a dangling symlink (its target is gone)\n * is not a deploy.\n *\n * An omp agent is the exception: the renderer writes a package directory (`<name>/`) and the\n * flat `<name>.md` omp loads, so the directory alone is not a deploy. A deleted flat file reads\n * as not deployed, as a deleted claude-code agent file does.\n *\n * @param kind - Asset component type\n * @param name - Asset name\n * @param target - Driver target identifier\n * @param globalInstall - `true` for user-global, `false` for project-local\n * @param cwd - Working directory for local installs\n * @returns `true` if a deploy path exists, `false` otherwise\n * @docLink packages/core/concepts#is-deployed\n */\nexport function isDeployed(\n  kind: AiComponent,\n  name: string,\n  target: DriverTarget,\n  globalInstall: boolean,\n  cwd?: string,\n): boolean {\n  const paths =\n    kind === \"agent\" && target === \"omp\"\n      ? [`${deployedDir(kind, name, target, globalInstall, cwd)}.md`]\n      : deployedPaths(kind, name, target, globalInstall, cwd);\n  return paths.some((p) => {\n    try {\n      // A symlink counts as deployed, a dangling one does not: nothing is behind it (p1061).\n      if (lstatSync(p).isSymbolicLink()) statSync(p);\n      return true;\n    } catch {\n      return false;\n    }\n  });\n}\n"]}

package/dist/chunk-6E6PKKAD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../plugin-registry/src/errors.ts","../plugin-registry/src/internal.ts","../plugin-registry/src/deploy-handle.ts","../plugin-registry/src/deploy-helpers.ts"],"names":["target"],"mappings":";;;AAQO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EAC3C,WAAA,CAAY,MAAc,EAAA,EAAY;AACpC,IAAA,KAAA,CAAM,CAAA,GAAA,EAAM,IAAI,CAAA,kBAAA,EAAqB,EAAE,CAAA,wBAAA,CAA0B,CAAA;AACjE,IAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,EACd;AACF;AAGO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EAC5C,WAAA,CAAY,MAAc,EAAA,EAAY;AACpC,IAAA,KAAA,CAAM,CAAA,IAAA,EAAO,IAAI,CAAA,6BAAA,EAAgC,EAAE,CAAA,EAAA,CAAI,CAAA;AACvD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF;AAGO,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACjD,WAAA,CAAY,IAAA,EAAc,EAAA,EAAY,GAAA,EAAc;AAClD,IAAA,KAAA;AAAA,MACE,WAAW,EAAE,CAAA,SAAA,EAAY,IAAI,CAAA,uBAAA,EAA0B,MAAA,CAAO,GAAG,CAAC,CAAA,iCAAA;AAAA,KACpE;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAGO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,YAAY,EAAA,EAAY;AACtB,IAAA,KAAA,CAAM,CAAA,qCAAA,EAAwC,EAAE,CAAA,EAAA,CAAI,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;;;AC1BA,IAAM,oBAAN,MAAkD;AAAA,EACvC,UAAA,GAAa,CAAA;AAAA;AAAA;AAAA,EAIL,MAAA,GAAqD;AAAA,IACpE,MAAA,sBAAY,GAAA,EAAI;AAAA,IAChB,SAAA,sBAAe,GAAA,EAAI;AAAA,IACnB,YAAA,sBAAkB,GAAA;AAAI,GACxB;AAAA,EAEA,QAAA,CAA+B,MAAS,MAAA,EAAyB;AAC/D,IAAA,MAAM,CAAA,GAAI,MAAA;AACV,IAAA,IAAI,CAAA,CAAE,eAAe,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,uBAAA,CAAwB,IAAA,EAAM,CAAA,CAAE,EAAA,EAAI,EAAE,UAAU,CAAA;AAAA,IAC5D;AACA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA;AAC9B,IAAA,IAAI,KAAA,CAAM,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AACnB,MAAA,MAAM,IAAI,iBAAA,CAAkB,IAAA,EAAM,CAAA,CAAE,EAAE,CAAA;AAAA,IACxC;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,CAAA,CAAE,EAAA,EAAI,CAAC,CAAA;AAAA,EACnB;AAAA,EAEA,UAAA,CAAiC,MAAS,EAAA,EAAqB;AAC7D,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA,CAAE,OAAO,EAAE,CAAA;AAAA,EACpC;AAAA,EAEA,GAAA,CAA0B,MAAS,EAAA,EAAmC;AACpE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACjC;AAAA,EAEA,KAA2B,IAAA,EAAgC;AACzD,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACjD,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,aAAa,CAAA,CAAE;AAAA,KACjB,CAAE,CAAA;AAAA,EACJ;AACF,CAAA;AAGO,SAAS,oBAAA,GAAuC;AACrD,EAAA,OAAO,IAAI,iBAAA,EAAkB;AAC/B;AAGO,IAAM,iBAAiC,oBAAA;;;ACpBvC,SAAS,iBAAA,CACd,WAA2B,cAAA,EACJ;AACvB,EAAA,OAAO,QAAA,CAAS,KAAK,cAAc,CAAA;AACrC;AAQO,SAAS,eAAA,CACd,EAAA,EACA,QAAA,GAA2B,cAAA,EACD;AAC1B,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,cAAA,EAAgB,EAAE,CAAA;AACxC;AAeA,eAAsB,mBAAA,CACpB,IAAA,EACA,QAAA,EACA,QAAA,GAA2B,cAAA,EACA;AAC3B,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAMA,OAAAA,GAAS,QAAA,CAAS,GAAA,CAAI,cAAA,EAAgB,SAAS,MAAM,CAAA;AAC3D,IAAA,IAAI,CAACA,OAAAA,EAAQ,MAAM,IAAI,yBAAA,CAA0B,SAAS,MAAM,CAAA;AAChE,IAAA,OAAO;AAAA,MACL,MAAA,EAAAA,OAAAA;AAAA,MACA,QAAQA,OAAAA,CAAO,YAAA,CAAa,MAAM,QAAA,CAAS,MAAA,IAAU,EAAE,CAAA;AAAA,MACvD,YAAY,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,SAAS,MAAA;AAAO,KAC5D;AAAA,EACF;AACA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,MAAMA,UAAS,QAAA,CAAS,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,OAAO,MAAM,CAAA;AAC9D,IAAA,IAAI,CAACA,OAAAA,EAAQ,MAAM,IAAI,yBAAA,CAA0B,IAAA,CAAK,OAAO,MAAM,CAAA;AACnE,IAAA,OAAO;AAAA,MACL,MAAA,EAAAA,OAAAA;AAAA,MACA,MAAA,EAAQA,QAAO,YAAA,CAAa,KAAA,CAAM,KAAK,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA;AAAA,MAC1D,UAAA,EAAY,EAAE,MAAA,EAAQ,MAAA;AAAO,KAC/B;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,cAAA,EAAgB,OAAO,CAAA;AACnD,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,0BAA0B,OAAO,CAAA;AACxD,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,MAAA,EAAQ,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,EAAE,CAAA;AAAA,IACpC,UAAA,EAAY,EAAE,MAAA,EAAQ,SAAA;AAAU,GAClC;AACF;ACnFO,IAAM,sBAAwB,CAAA,CAAA,IAAA,CAAK,CAAC,OAAA,EAAS,QAAA,EAAU,SAAS,CAAC;AAQxE,eAAsB,KAAA,CAAM,IAAY,MAAA,EAAoC;AAC1E,EAAA,OAAO,MAAM,IAAI,OAAA,CAAc,CAAC,SAAS,MAAA,KAAW;AAClD,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC3C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,MAAM,UAAU,MAAM;AACpB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,IAAI,KAAA,CAAM,uBAAuB,CAAC,CAAA;AAAA,IAC3C,CAAA;AACA,IAAA,IAAI,MAAA,CAAO,SAAS,OAAA,EAAQ;AAAA,SACvB,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAAA,EAC/C,CAAC,CAAA;AACH;AAoBA,eAAsB,UAAU,IAAA,EAAuC;AACrE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA;AACnC,EAAA,WAAS;AACP,IAAA,IAAI,MAAM,IAAA,CAAK,KAAA,EAAM,EAAG;AACxB,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AACzB,MAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,cAAA,IAAkB,WAAW,CAAA;AAAA,IACpD;AACA,IAAA,MAAM,KAAA,CAAM,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,MAAM,CAAA;AAAA,EAC1C;AACF;AAuBO,SAAS,iBAAoB,IAAA,EAAmD;AACrF,EAAA,IAAI,QAA+B,IAAA,CAAK,YAAA;AACxC,EAAA,MAAM,MAAA,GAA0B;AAAA,IAC9B,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,MAAA,GAAS,YAAA,GAAe,MAAA;AAAA,IACzC,IAAI,KAAA,GAAQ;AACV,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,IACA,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,MAAM,UAAU,SAAA,EAAoB;AAClC,MAAA,MAAM,SAAA,GAAY,aAAa,IAAA,CAAK,qBAAA;AACpC,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,CAAK,KAAA,CAAM,SAAA,EAAW,IAAA,CAAK,IAAI,MAAM,CAAA;AAC3C,QAAA,KAAA,GAAQ,OAAA;AAAA,MACV,SAAS,GAAA,EAAK;AACZ,QAAA,KAAA,GAAQ,SAAA;AACR,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IACA,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,MAAM,IAAA,GAAO;AACX,MAAA,KAAA,GAAQ,UAAA;AACR,MAAA,MAAM,KAAK,IAAA,EAAK;AAChB,MAAA,KAAA,GAAQ,SAAA;AAAA,IACV;AAAA,GACF;AACA,EAAA,IAAI,IAAA,CAAK,IAAA,EAAM,MAAA,CAAO,IAAA,GAAO,IAAA,CAAK,IAAA;AAClC,EAAA,OAAO,MAAA;AACT","file":"chunk-6E6PKKAD.js","sourcesContent":["/**\n * Error types thrown by the plugin registry and deploy resolution.\n *\n * Each carries a stable `.name` so callers can branch on identity without\n * importing the class (cross-package / cross-bundle `instanceof` is unreliable).\n */\n\n/** Thrown by `register()` when a target id is already registered for its kind. */\nexport class RegistrationError extends Error {\n  constructor(kind: string, id: string) {\n    super(`A \"${kind}\" target with id \"${id}\" is already registered.`);\n    this.name = \"RegistrationError\";\n  }\n}\n\n/** Thrown when a lookup by id finds no registered target for the given kind. */\nexport class MissingTargetError extends Error {\n  constructor(kind: string, id: string) {\n    super(`No \"${kind}\" target registered with id \"${id}\".`);\n    this.name = \"MissingTargetError\";\n  }\n}\n\n/** Thrown by `register()` when a target declares an unsupported `apiVersion`. */\nexport class ApiVersionMismatchError extends Error {\n  constructor(kind: string, id: string, got: unknown) {\n    super(\n      `Target \"${id}\" (kind \"${kind}\") declares apiVersion ${String(got)}; registry requires apiVersion 1.`,\n    );\n    this.name = \"ApiVersionMismatchError\";\n  }\n}\n\n/** Thrown by `resolveDeployTarget()` when the requested deploy target id is unknown. */\nexport class DeployTargetNotFoundError extends Error {\n  constructor(id: string) {\n    super(`No deploy target registered with id \"${id}\".`);\n    this.name = \"DeployTargetNotFoundError\";\n  }\n}\n","/**\n * Map-backed `PluginRegistry` implementation + the process-wide singleton.\n *\n * Storage is one Map per kind. Registration rejects duplicate ids\n * (`RegistrationError`) and any target not on `apiVersion: 1`\n * (`ApiVersionMismatchError`).\n */\n\nimport { ApiVersionMismatchError, RegistrationError } from \"./errors.js\";\nimport type { PluginRegistry, Target, TargetKind, TargetMeta } from \"./registry.js\";\n\ntype AnyTarget = { id: string; displayName: string; apiVersion: unknown };\n\nclass MapPluginRegistry implements PluginRegistry {\n  readonly apiVersion = 1 as const;\n\n  // One Map per kind keeps lookups kind-scoped — a driver and a connector may\n  // share an id without colliding.\n  private readonly stores: Record<TargetKind, Map<string, AnyTarget>> = {\n    driver: new Map(),\n    connector: new Map(),\n    deployTarget: new Map(),\n  };\n\n  register<K extends TargetKind>(kind: K, target: Target<K>): void {\n    const t = target as unknown as AnyTarget;\n    if (t.apiVersion !== 1) {\n      throw new ApiVersionMismatchError(kind, t.id, t.apiVersion);\n    }\n    const store = this.stores[kind];\n    if (store.has(t.id)) {\n      throw new RegistrationError(kind, t.id);\n    }\n    store.set(t.id, t);\n  }\n\n  unregister<K extends TargetKind>(kind: K, id: string): boolean {\n    return this.stores[kind].delete(id);\n  }\n\n  get<K extends TargetKind>(kind: K, id: string): Target<K> | undefined {\n    return this.stores[kind].get(id) as Target<K> | undefined;\n  }\n\n  list<K extends TargetKind>(kind: K): readonly TargetMeta[] {\n    return [...this.stores[kind].values()].map((t) => ({\n      id: t.id,\n      displayName: t.displayName,\n    }));\n  }\n}\n\n/** Create a fresh, isolated registry — used by tests so cases never share state. */\nexport function createPluginRegistry(): PluginRegistry {\n  return new MapPluginRegistry();\n}\n\n/** Process-wide default registry. Built-ins and loaded plugins register here. */\nexport const pluginRegistry: PluginRegistry = createPluginRegistry();\n","/**\n * Deploy handle contract + the `resolveDeployTarget` precedence resolver.\n *\n * A `DeployHandle` is the live, restorable result of standing up a workspace on\n * a deploy target. `resolveDeployTarget` picks which target+config to use with\n * an explicit override > yaml > default chain.\n */\n\nimport { DeployTargetNotFoundError } from \"./errors.js\";\nimport { pluginRegistry } from \"./internal.js\";\nimport type { PluginRegistry, TargetMeta } from \"./registry.js\";\nimport type { DeployTarget } from \"./targets.js\";\n\n/**\n * Live handle to a deployed workspace. `payload` is the target's own opaque\n * persistence slice (written to `.skaile/deploy/handle.json` and fed back into\n * `restore()`); the registry wrapper never inspects it.\n */\nexport interface DeployHandle<S = unknown> {\n  readonly wsUrl: string;\n  /** Redacted form of the auth token, safe to log. */\n  readonly wsAuth?: string;\n  readonly state: \"starting\" | \"ready\" | \"stopping\" | \"stopped\" | \"errored\";\n  readonly payload: S;\n  waitReady(timeoutMs?: number): Promise<void>;\n  health(): Promise<{ healthy: boolean; detail?: string }>;\n  logs?(opts?: { sinceMs?: number; follow?: boolean }): AsyncIterable<{ ts: number; line: string }>;\n  stop(): Promise<void>;\n}\n\n/**\n * List the registered deploy targets as lightweight `{ id, displayName }` rows,\n * the symmetric counterpart to `listDrivers()` / `listConnectors()`. Reads the\n * process-wide `pluginRegistry` by default, so call\n * `registerBuiltinDeployTargets()` (and load any plugins) first — unregistered\n * targets do not appear. Enough to populate a target picker without resolving a\n * config; use `getDeployTarget(id)` for the full target.\n */\nexport function listDeployTargets(\n  registry: PluginRegistry = pluginRegistry,\n): readonly TargetMeta[] {\n  return registry.list(\"deployTarget\");\n}\n\n/**\n * Look up a single registered deploy target by id, or `undefined` if none is\n * registered under that id. Thin wrapper over `pluginRegistry.get`, mirroring\n * `getConnector()`; unlike `resolveDeployTarget` it neither applies the\n * override/yaml/default precedence nor parses a config.\n */\nexport function getDeployTarget(\n  id: string,\n  registry: PluginRegistry = pluginRegistry,\n): DeployTarget | undefined {\n  return registry.get(\"deployTarget\", id);\n}\n\n/** Outcome of `resolveDeployTarget`: the chosen target, its parsed config, and where it came from. */\nexport interface DeployResolution {\n  target: DeployTarget;\n  config: unknown;\n  provenance: { source: \"default\" | \"yaml\" | \"override\"; reason?: string };\n}\n\n/**\n * Resolve which deploy target + config to use, with explicit precedence:\n * CLI override > `skaile.yaml` `deploy:` block > the built-in `local` default.\n * Config is parsed through the chosen target's `configSchema`, so validation\n * failures propagate to the caller.\n */\nexport async function resolveDeployTarget(\n  yaml: { deploy?: { target: string; config?: unknown } },\n  override?: { target: string; config?: unknown; reason: string },\n  registry: PluginRegistry = pluginRegistry,\n): Promise<DeployResolution> {\n  if (override) {\n    const target = registry.get(\"deployTarget\", override.target);\n    if (!target) throw new DeployTargetNotFoundError(override.target);\n    return {\n      target,\n      config: target.configSchema.parse(override.config ?? {}),\n      provenance: { source: \"override\", reason: override.reason },\n    };\n  }\n  if (yaml.deploy) {\n    const target = registry.get(\"deployTarget\", yaml.deploy.target);\n    if (!target) throw new DeployTargetNotFoundError(yaml.deploy.target);\n    return {\n      target,\n      config: target.configSchema.parse(yaml.deploy.config ?? {}),\n      provenance: { source: \"yaml\" },\n    };\n  }\n  const target = registry.get(\"deployTarget\", \"local\");\n  if (!target) throw new DeployTargetNotFoundError(\"local\");\n  return {\n    target,\n    config: target.configSchema.parse({}),\n    provenance: { source: \"default\" },\n  };\n}\n","/**\n * Shared building blocks for `DeployTarget` implementations.\n *\n * These lift the byte-for-byte duplication that had accumulated across the\n * provider packages (the `buildStrategy` enum, an abort-aware `sleep`, the\n * poll-until-ready loop, and the `DeployHandle` wrapper) into one authoritative\n * place — the package that already owns the `DeployHandle` contract.\n */\n\nimport * as z from \"zod\";\nimport type { DeployContext } from \"./context.js\";\nimport type { DeployHandle } from \"./deploy-handle.js\";\n\n/**\n * The authoritative build-strategy enum shared by every deploy target.\n * `local`/`managed` need an operator-supplied image; `remote` builds one.\n */\nexport const buildStrategySchema = z.enum([\"local\", \"remote\", \"managed\"]);\n\nexport type BuildStrategy = z.infer<typeof buildStrategySchema>;\n\n/**\n * Abort-aware sleep. Resolves after `ms`, or rejects immediately if `signal`\n * aborts first (so a cancelled deploy stops polling promptly).\n */\nexport async function sleep(ms: number, signal: AbortSignal): Promise<void> {\n  return await new Promise<void>((resolve, reject) => {\n    const timer = setTimeout(() => {\n      signal.removeEventListener(\"abort\", onAbort);\n      resolve();\n    }, ms);\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(new Error(\"aborted while polling\"));\n    };\n    if (signal.aborted) onAbort();\n    else signal.addEventListener(\"abort\", onAbort);\n  });\n}\n\n/** Options for {@link pollUntil}. */\nexport interface PollUntilOptions {\n  /** Predicate polled until it returns true. */\n  check: () => Promise<boolean>;\n  /** Deadline relative to `Date.now()` at the first failing check. */\n  timeoutMs: number;\n  /** Delay between attempts, via the abort-aware {@link sleep}. */\n  intervalMs: number;\n  signal: AbortSignal;\n  /** Descriptive message for the timeout error; defaults to \"timed out\". */\n  timeoutMessage?: string;\n}\n\n/**\n * Poll `check()` until it returns true. Sleeps `intervalMs` between attempts\n * and throws once `Date.now()` passes the deadline. Generalizes the readiness\n * loops the deploy providers each re-implemented.\n */\nexport async function pollUntil(opts: PollUntilOptions): Promise<void> {\n  const deadline = Date.now() + opts.timeoutMs;\n  for (;;) {\n    if (await opts.check()) return;\n    if (Date.now() > deadline) {\n      throw new Error(opts.timeoutMessage ?? \"timed out\");\n    }\n    await sleep(opts.intervalMs, opts.signal);\n  }\n}\n\n/** Options for {@link makeDeployHandle}. */\nexport interface MakeDeployHandleOptions<S> {\n  wsUrl: string;\n  /** Source of `wsAuth` redaction and the abort `signal` for the ready routine. */\n  ctx: DeployContext;\n  payload: S;\n  initialState: DeployHandle[\"state\"];\n  /** Timeout passed to `ready` when `waitReady` is called without one. */\n  defaultReadyTimeoutMs: number;\n  /** Readiness routine; receives the EFFECTIVE timeout (caller's or the default). */\n  ready: (timeoutMs: number, signal: AbortSignal) => Promise<void>;\n  health: () => Promise<{ healthy: boolean; detail?: string }>;\n  stop: () => Promise<void>;\n  logs?: DeployHandle<S>[\"logs\"];\n}\n\n/**\n * Build a `DeployHandle` from per-target seams, replacing the wrapper each\n * provider had copy-pasted. Unlike those wrappers, `waitReady(timeoutMs)`\n * forwards the caller's timeout to `ready` instead of discarding it.\n */\nexport function makeDeployHandle<S>(opts: MakeDeployHandleOptions<S>): DeployHandle<S> {\n  let state: DeployHandle[\"state\"] = opts.initialState;\n  const handle: DeployHandle<S> = {\n    wsUrl: opts.wsUrl,\n    wsAuth: opts.ctx.wsAuth ? \"<redacted>\" : undefined,\n    get state() {\n      return state;\n    },\n    payload: opts.payload,\n    async waitReady(timeoutMs?: number) {\n      const effective = timeoutMs ?? opts.defaultReadyTimeoutMs;\n      try {\n        await opts.ready(effective, opts.ctx.signal);\n        state = \"ready\";\n      } catch (err) {\n        state = \"errored\";\n        throw err;\n      }\n    },\n    health: opts.health,\n    async stop() {\n      state = \"stopping\";\n      await opts.stop();\n      state = \"stopped\";\n    },\n  };\n  if (opts.logs) handle.logs = opts.logs;\n  return handle;\n}\n"]}

package/dist/chunk-7ANRSTNR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../cli/src/commands/providers.ts"],"names":[],"mappings":";;;;;;;;;AAkDA,IAAM,aAAA,GAAgB,QAAA;AAStB,SAAS,WAAW,IAAA,EAAmE;AACrF,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,OAAO,EAAE,OAAO,WAAA,EAAa,IAAA,EAAM,8BAA8B,iBAAA,CAAkB,IAAI,CAAC,CAAA,EAAE;AAAA,EAC5F;AACA,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,IAAA,EAAM,0BAAyB,EAAE;AAC3D;AAGA,SAAS,kBAAkB,IAAA,EAA4B;AACrD,EAAA,OAAO,IAAA,CAAK,aAAa,IAAA,CAAK,OAAA,CAAQ,KAAK,UAAU,CAAA,GAAI,QAAQ,GAAA,EAAI;AACvE;AAoBO,SAAS,iBAAiB,IAAA,EAAkC;AACjE,EAAA,MAAM,SAAS,oBAAA,CAAqB,EAAE,YAAY,iBAAA,CAAkB,IAAI,GAAG,CAAA;AAC3E,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,IAC7C,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,SAAA,EAAW,KAAK,QAAA,CAAS;AAAA,GAC3B,CAAE,CAAA;AACF,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,MAAA,CAAO,OAAO,CAAA;AAC3C,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,sBAAA;AAAA,IAChC,eAAA,CAAgB,CAAC,GAAG,UAAA,EAAY,OAAO,CAAC,CAAA;AAAA,IACxC;AAAA,MACE,OAAA,EAAS;AAAA,QACP,GAAG,MAAA,CAAO,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,MAAU,EAAE,KAAA,EAAO,IAAA,CAAK,IAAA,EAAM,SAAA,EAAW,IAAA,CAAK,QAAA,CAAS,WAAU,CAAE;AAAA;AAC1F;AACF,GACF;AACA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,QAAA;AAAA,IACR,OAAO,MAAA,CAAO,KAAA;AAAA;AAAA;AAAA,IAGd,WAAA,EAAa,CAAC,GAAG,MAAA,CAAO,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,WAAW,CAAA,EAAG,GAAG,WAAW;AAAA,GACnF;AACF;AAGA,SAAS,kBAAkB,WAAA,EAA6C;AACtE,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AACpC,IAAA,MAAM,QAAQ,UAAA,CAAW,IAAA,GAAO,CAAA,EAAG,UAAA,CAAW,IAAI,CAAA,EAAA,CAAA,GAAO,EAAA;AACzD,IAAA,IAAI,UAAA,CAAW,aAAa,OAAA,EAAS;AACnC,MAAA,MAAA,EAAA;AACA,MAAA,MAAA,CAAO,CAAA,EAAG,KAAK,CAAA,EAAG,UAAA,CAAW,OAAO,CAAA,CAAE,CAAA;AAAA,IACxC,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,CAAA,EAAG,KAAK,CAAA,EAAG,UAAA,CAAW,OAAO,CAAA,CAAE,CAAA;AAAA,IACzC;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,SAAA,CAAU,IAAY,KAAA,EAA8D;AAC3F,EAAA,IAAI,KAAA;AACJ,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,SAAA,CAAU,EAAE,GAAG,MAAA,EAAQ;AACvC,MAAA,MAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,MAAA,IAAI,CAAC,SAAS,kBAAA,CAAmB,OAAA,CAAQ,KAAK,CAAA,GAAI,kBAAA,CAAmB,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnF,QAAA,KAAA,GAAQ,KAAA;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAUA,SAAS,YAAA,CACP,EAAA,EACA,MAAA,EACA,KAAA,EACA,GAAA,EACoB;AACpB,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,EAAA,EAAI,KAAK,CAAA;AACjC,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,MAAM,SAAA,GAAY,kBAAA,CAAmB,OAAA,CAAQ,KAAK,CAAA;AAClD,EAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA;AAC1D,EAAA,IAAI,SAAA,KAAc,UAAA,IAAc,GAAA,KAAQ,QAAA,EAAU,OAAO,MAAA;AACzD,EAAA,IAAI,SAAA,GAAY,YAAY,OAAO,MAAA;AACnC,EAAA,OACE,IAAI,EAAE,CAAA,mBAAA,EAAsB,KAAK,CAAA,kCAAA,EAAqC,OAAO,KAAK,CAAA;AAAA,CAAA,IACjF,SAAA,KAAc,UAAA,GACX,CAAA,wCAAA,EAA2C,EAAE,CAAA,aAAA,CAAA,GAC7C,CAAA,wDAAA,CAAA,CAAA;AAER;AAGA,SAAS,YAAA,CACP,EAAA,EACA,MAAA,EACA,KAAA,EACA,GAAA,EACM;AACN,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,OAAO,GAAG,CAAA;AACnD,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAA,CAAO,OAAO,CAAA;AACd,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB;AAGA,SAAS,kBAAA,CACP,QACA,KAAA,EAC4B;AAC5B,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,OAAO,IAAI,CAAA;AACrD,EAAA,OAAO,MAAM,QAAA,IAAY,EAAE,SAAS,CAAA,EAAG,SAAA,EAAW,EAAC,EAAE;AACvD;AASA,SAAS,cAAA,CACP,UACA,MAAA,EACM;AACN,EAAA,MAAM,EAAE,aAAY,GAAI,gBAAA;AAAA,IACtB,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,SAAS,SAAA,EAAU;AAAA,IAC5C,EAAE,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,KAAA,EAAO,OAAO,KAAA;AAAM,GAC7C;AACA,EAAA,IAAI,kBAAkB,WAAW,CAAA,GAAI,CAAA,EAAG,OAAA,CAAQ,KAAK,CAAC,CAAA;AACxD;AAIA,SAAS,GAAA,CAAI,OAAe,KAAA,EAAuB;AACjD,EAAA,OAAO,KAAA,CAAM,UAAU,KAAA,GAAQ,KAAA,GAAQ,QAAQ,GAAA,CAAI,MAAA,CAAO,KAAA,GAAQ,KAAA,CAAM,MAAM,CAAA;AAChF;AAEA,SAAS,kBAAkB,KAAA,EAAgC;AACzD,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,CAAC,UAAA,IAAc,UAAA,CAAW,IAAA,KAAS,QAAQ,OAAO,MAAA;AACtD,EAAA,OAAO,UAAA,CAAW,MAAM,CAAA,EAAG,UAAA,CAAW,IAAI,CAAA,CAAA,EAAI,UAAA,CAAW,GAAG,CAAA,CAAA,GAAK,UAAA,CAAW,IAAA;AAC9E;AAEA,SAAS,YAAA,GAAqB;AAC5B,EAAA,MAAM,UAAU,mBAAA,EAAoB;AACpC,EAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,EAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,iBAAiB,CAAC,CAAA,CAAE,CAAA;AAC/C,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,CAAG,MAAM,CAAC,CAAA,GAAI,CAAA;AAC/D,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,GAAA,CAAI,GAAG,oBAAA,CAAqB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA,GAAI,CAAA;AAC9E,EAAA,MAAM,MAAA,GAAS,GAAG,GAAA,CAAI,QAAA,EAAU,OAAO,CAAC,CAAA,EAAG,IAAI,MAAA,EAAQ,CAAC,CAAC,CAAA,EAAG,GAAA,CAAI,WAAW,YAAY,CAAC,GAAG,GAAA,CAAI,WAAA,EAAa,EAAE,CAAC,CAAA,gBAAA,CAAA;AAC/G,EAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,CAAE,CAAA;AAChC,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,MACJ,GAAA,CAAI,MAAA,CAAO,EAAA,EAAI,OAAO,IACtB,GAAA,CAAI,MAAA,CAAO,IAAA,EAAM,CAAC,IAClB,GAAA,CAAI,MAAA,CAAO,OAAA,IAAW,QAAA,EAAK,YAAY,CAAA,GACvC,GAAA;AAAA,MACE,MAAA,CAAO,SAAS,KAAA,IAAS,MAAA,CAAO,SAAS,OAAA,GAAW,MAAA,CAAO,aAAa,QAAA,GAAY,QAAA;AAAA,MACpF;AAAA,KACF,IACC,aAAA,CAAc,MAAM,CAAA,IAAK,QAAA,CAAA;AAC5B,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAAA,EACxB;AACF;AAEA,SAAS,gBAAgB,IAAA,EAA0B;AACjD,EAAA,MAAM,GAAA,GAAM,KAAK,MAAA,CAAO,KAAA;AACxB,EAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,EAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,sBAAsB,CAAC,CAAA,CAAE,CAAA;AACpD,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,CAAA,EAAA,EAAK,EAAE,GAAA,CAAI,0BAAqB,CAAC,CAAA,CAAA,EAAI,CAAA,CAAE,GAAA,CAAI,wCAAwC,CAAC,CAAA;AAAA,KACtF;AACA,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,GAAG,GAAA,CAAI,GAAA,CAAI,CAAC,EAAA,KAAO,EAAA,CAAG,MAAM,CAAC,CAAA,GAAI,CAAA;AAC1D,EAAA,MAAM,MAAA,GAAS,GAAG,GAAA,CAAI,IAAA,EAAM,OAAO,CAAC,CAAA,EAAG,IAAI,OAAA,EAAS,EAAE,CAAC,CAAA,EAAG,GAAA,CAAI,WAAW,EAAE,CAAC,GAAG,GAAA,CAAI,WAAA,EAAa,EAAE,CAAC,CAAA,QAAA,CAAA;AACnG,EAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA,CAAE,CAAA;AAChC,EAAA,KAAA,MAAW,MAAM,GAAA,EAAK;AACpB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,EAAE,CAAA;AACtC,IAAA,MAAM,OAAA,GAAW,MAA6B,OAAA,IAAW,QAAA;AACzD,IAAA,MAAM,SAAA,GAAY,cAAA,CAAe,KAAK,CAAA,IAAK,QAAA;AAC3C,IAAA,MAAM,MAAM,mBAAA,CAAoB,KAAK,CAAA,IAAK,CAAA,CAAE,IAAI,cAAc,CAAA;AAC9D,IAAA,MAAM,KAAA,GAAQ;AAAA,MACZ,eAAe,KAAK,CAAA,GAAI,EAAA,GAAK,CAAA,CAAE,KAAK,UAAU,CAAA;AAAA,MAC9C,KAAA,CAAM,MAAA,GAAS,CAAA,CAAE,IAAA,CAAK,QAAQ,CAAA,GAAI;AAAA,KACpC,CACG,MAAA,CAAO,OAAO,CAAA,CACd,KAAK,GAAG,CAAA;AACX,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,CAAA,EAAA,EAAK,GAAA,CAAI,EAAA,EAAI,OAAO,CAAC,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA,EAAG,EAAE,CAAC,CAAA,EAAG,GAAA,CAAI,OAAA,EAAS,EAAE,CAAC,CAAA,EAAG,GAAA,CAAI,SAAA,EAAW,EAAE,CAAC,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAK,GAAG,OAAA;AAAQ,KAC3H;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,CAAA,CAAE,GAAA,CAAI,GAAG,GAAA,CAAI,EAAA,EAAI,OAAO,CAAC,GAAG,iBAAA,CAAkB,KAAK,CAAC,CAAA,CAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5E;AACA,EAAA,OAAA,CAAQ,GAAA,EAAI;AACd;AAeA,SAAS,YAAY,KAAA,EAAyC;AAC5D,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,MAAM,CAAA,EAAG;AACX,MAAA,MAAA,CAAO,CAAA,oCAAA,EAAuC,IAAI,CAAA,EAAA,CAAI,CAAA;AACtD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA,EAAG,EAAE,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,EAAA,GAAK,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,GAAA;AACT;AAGA,eAAe,iBAAA,CACb,IACA,IAAA,EACiF;AACjF,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,KAAA,CAAM,KAAA,KAAU,IAAA;AAC5C,EAAA,IAAI,UAAU,IAAA,CAAK,OAAA;AACnB,EAAA,IAAI,UAAU,IAAA,CAAK,OAAA;AACnB,EAAA,IAAI,gBAAgB,IAAA,CAAK,UAAA;AAEzB,EAAA,IAAI,CAAC,WAAA,KAAgB,CAAC,WAAW,CAAC,OAAA,IAAW,CAAC,aAAA,CAAA,EAAgB;AAC5D,IAAA,MAAA;AAAA,MACE;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,MAAA,GAAS,MAAQ,CAAA,CAAA,MAAA,CAAO;AAAA,MAC5B,OAAA,EAAS,eAAA;AAAA,MACT,OAAA,EAAS,qBAAqB,GAAA,CAAI,CAAC,WAAW,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAM,CAAE,CAAA;AAAA,MACtE,YAAA,EAAc;AAAA,KACf,CAAA;AACD,IAAA,IAAM,CAAA,CAAA,QAAA,CAAS,MAAM,CAAA,EAAG;AACtB,MAAE,SAAO,YAAY,CAAA;AACrB,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,OAAA,GAAU,MAAA;AAAA,EACZ;AACA,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,MAAA,GAAS,MAAQ,CAAA,CAAA,IAAA,CAAK;AAAA,MAC1B,OAAA,EAAS,WAAA;AAAA,MACT,WAAA,EAAa;AAAA,KACd,CAAA;AACD,IAAA,IAAM,CAAA,CAAA,QAAA,CAAS,MAAM,CAAA,EAAG;AACtB,MAAE,SAAO,YAAY,CAAA;AACrB,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,OAAA,GAAU,MAAA;AAAA,EACZ;AACA,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,MAAA,GAAS,MAAQ,CAAA,CAAA,IAAA,CAAK;AAAA,MAC1B,OAAA,EAAS,oFAAA;AAAA,MACT,YAAA,EAAc,OAAO,EAAA,CAAG,WAAA,GAAc,OAAA,CAAQ,YAAA,EAAc,GAAG,CAAC,CAAA,QAAA;AAAA,KACjE,CAAA;AACD,IAAA,IAAM,CAAA,CAAA,QAAA,CAAS,MAAM,CAAA,EAAG;AACtB,MAAE,SAAO,YAAY,CAAA;AACrB,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,aAAA,GAAgB,MAAA;AAAA,EAClB;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,aAAA,EAAc;AAC3C;AAGO,IAAM,0BAAA,GAAN,cAAyC,KAAA,CAAM;AAAC;AAwChD,SAAS,iBAAiB,KAAA,EAAkD;AACjF,EAAA,MAAM,EAAE,IAAG,GAAI,KAAA;AACf,EAAA,IAAI,CAAC,gBAAA,CAAiB,EAAE,CAAA,EAAG;AACzB,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,IAAI,EAAE,CAAA,wDAAA;AAAA,KACR;AAAA,EACF;AACA,EAAA,IAAI,MAAM,aAAA,IAAiB,CAAC,kBAAA,CAAmB,KAAA,CAAM,aAAa,CAAA,EAAG;AACnE,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,iBAAiB,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,KAAK,KAAK,CAAA;AAClD,EAAA,IAAI,MAAA,EAAQ,MAAM,IAAI,0BAAA,CAA2B,MAAM,CAAA;AAEvD,EAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AACtD,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,SAAA,CAAU,EAAE,CAAA,KAAM,MAAA;AAC5C,EAAA,IAAI,QAAA,IAAY,CAAC,KAAA,CAAM,KAAA,EAAO;AAC5B,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,CAAA,CAAA,EAAI,EAAE,CAAA,oBAAA,EAAuB,MAAA,CAAO,IAAI,CAAA,qCAAA;AAAA,KAC1C;AAAA,EACF;AAEA,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,GAAQ,KAAA,CAAM,KAAA;AAAA,EAChB,CAAA,MAAO;AACL,IAAA,MAAM,SAAS,KAAA,CAAM,QAAA,GAAW,iBAAA,CAAkB,KAAA,CAAM,QAAQ,CAAA,GAAI,MAAA;AACpE,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,0BAAA;AAAA,QACR,CAAA,gBAAA,EAAmB,MAAM,QAAQ,CAAA,gFAAA;AAAA,OAEnC;AAAA,IACF;AACA,IAAA,KAAA,GAAQ,aAAa,MAAA,EAAQ;AAAA,MAC3B,eAAe,KAAA,CAAM,aAAA;AAAA,MACrB,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,QAAQ,KAAA,CAAM;AAAA,KACf,CAAA;AACD,IAAA,MAAM,OAAA,GAAA,CAAW,MAAA,CAAO,eAAA,IAAmB,EAAC,EAAG,MAAA;AAAA,MAC7C,CAAC,GAAA,KAAQ,EAAE,GAAA,KAAS,KAAA,CAA6B,UAAU,EAAC,CAAA;AAAA,KAC9D;AACA,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,0BAAA;AAAA,QACR,CAAA,QAAA,EAAW,MAAA,CAAO,EAAE,CAAA,QAAA,EAAW,QAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,QAAA,EAAW,CAAC,CAAA,QAAA,CAAU,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,OACrF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAmC;AAAA,IACvC,OAAA,EAAS,CAAA;AAAA,IACT,SAAA,EAAW,EAAE,GAAG,QAAA,CAAS,WAAW,CAAC,EAAE,GAAG,KAAA;AAAM,GAClD;AACA,EAAA,MAAM,EAAE,aAAY,GAAI,gBAAA;AAAA,IACtB,EAAE,OAAA,EAAS,CAAA,EAAG,SAAA,EAAW,KAAK,SAAA,EAAU;AAAA,IACxC,EAAE,MAAA,EAAQ,MAAA,CAAO,IAAA;AAAK,GACxB;AACA,EAAA,MAAM,SAAS,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,OAAO,CAAA;AAC/D,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,OAAO,GAAA,CAAI,CAAC,CAAA,KAAO,CAAA,CAAE,OAAO,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,EAAE,OAAO,CAAA,CAAA,GAAK,EAAE,OAAQ,CAAA,CAAE,KAAK,IAAI;AAAA,KAC/E;AAAA,EACF;AACA,EAAA,wBAAA,CAAyB,MAAA,CAAO,MAAM,IAAI,CAAA;AAE1C,EAAA,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,CAAO,OAAO,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,KAAA,EAAO,QAAA,EAAS;AACvE;AAGO,SAAS,qBAAqB,KAAA,EAA4C;AAC/E,EAAA,MAAM,GAAA,GAAM,MAAM,UAAA,EAAY,GAAA;AAC9B,EAAA,OAAO,KAAK,UAAA,CAAW,MAAM,IAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA;AAClD;AAGA,SAAS,WAAA,CACP,SACA,IAAA,EACiB;AACjB,EAAA,MAAM,IAAA,GAAQ,KAAK,IAAA,IAAQ,KAAA;AAG3B,EAAA,MAAM,cAAA,GACJ,IAAA,KAAS,KAAA,IACT,IAAA,KAAS,SACT,OAAA,CAAQ,OAAA,KAAY,oBAAA,IACpB,OAAA,CAAQ,OAAA,KAAY,sBAAA,IACpB,OAAA,CAAQ,OAAA,KAAY,2BAChB,gBAAA,GACA,QAAA;AACN,EAAA,IAAI,IAAA,KAAS,KAAA,IAAS,IAAA,KAAS,KAAA,EAAO;AACpC,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,GAAI,KAAK,KAAA,GAAQ,EAAE,OAAO,IAAA,CAAK,KAAA,KAAU,EAAC;AAAA,MAC1C,UAAU,OAAA,CAAQ,OAAA;AAAA,MAClB,YAAY,EAAE,IAAA,EAAM,cAAA,EAAgB,GAAA,EAAK,QAAQ,aAAA;AAAc,KACjE;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,GAAI,KAAK,KAAA,GAAQ,EAAE,OAAO,IAAA,CAAK,KAAA,KAAU,EAAC;AAAA,IAC1C,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,UAAU,OAAA,CAAQ,OAAA;AAAA,IAClB,YAAY,EAAE,IAAA,EAAM,cAAA,EAAgB,GAAA,EAAK,QAAQ,aAAA;AAAc,GACjE;AACF;AAEA,eAAe,MAAA,CAAO,OAA2B,IAAA,EAAiC;AAChF,EAAA,MAAM,WAAW,IAAA,CAAK,MAAA;AACtB,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAA;AAAA,MACE,CAAA,0BAAA,EAA6B,EAAE,GAAA,CAAI,uBAAuB,CAAC,CAAA,yBAAA,EAC/C,CAAA,CAAE,GAAA,CAAI,iBAAiB,CAAC,CAAA,CAAA;AAAA,KACtC;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,MAAM,KAAK,KAAA,IAAS,QAAA;AACpB,EAAA,IAAI,EAAA,KAAO,aAAA,IAAiB,CAAC,KAAA,EAAO;AAClC,IAAA,MAAA,CAAO,8EAA8E,CAAA;AACrF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,KAAA,GACJ,QAAA,KAAa,aAAA,GAAgB,WAAA,CAAY,MAAM,kBAAkB,EAAA,EAAI,IAAI,CAAA,EAAG,IAAI,CAAA,GAAI,MAAA;AAEtF,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,gBAAA,CAAiB;AAAA,MACvB,EAAA;AAAA,MACA,GAAI,KAAA,GAAQ,EAAE,KAAA,EAAM,GAAI,EAAE,QAAA,EAAS;AAAA,MACnC,eAAe,IAAA,CAAK,UAAA;AAAA,MACpB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,MAAA,EAAQ,WAAA,CAAY,IAAA,CAAK,KAAK,CAAA;AAAA,MAC9B,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,MAAA,CAAO,iBAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAC7D,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,KAAA,CAAM,CAAA,MAAA,EAAS,CAAA,CAAE,IAAA,CAAK,EAAE,CAAC,KAAK,QAAQ,CAAA,SAAA,EAAY,KAAA,CAAM,KAAK,CAAA,SAAA,CAAW,CAAA;AACxE,EAAA,OAAA,CAAQ,IAAI,CAAA,CAAE,GAAA,CAAI,YAAO,KAAA,CAAM,IAAI,EAAE,CAAC,CAAA;AACtC,EAAA,MAAM,IAAA,GAAO,oBAAA,CAAqB,KAAA,CAAM,KAAK,CAAA;AAC7C,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,CAAA,EAAA,EAAK,CAAA,CAAE,GAAA,CAAI,6DAAwD,CAAC,CAAA,CAAA,EAAI,CAAA,CAAE,GAAA,CAAI,CAAA,OAAA,EAAU,IAAI,CAAA,OAAA,CAAI,CAAC,CAAA;AAAA,KACnG;AAAA,EACF;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,CAAA,CAAE,GAAA,CAAI,cAAc,CAAC,CAAA,CAAA,EAAI,CAAA,CAAE,GAAA,CAAI,CAAA,sBAAA,EAAyB,EAAE,CAAA,CAAE,CAAC,CAAA,CAAE,CAAA;AAClF;AAKA,SAAS,WAAA,CAAY,KAAa,KAAA,EAAwB;AACxD,EAAA,MAAM,OAAO,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,GAAA;AACrC,EAAA,IAAI,SAAS,SAAA,IAAa,IAAA,KAAS,YAAY,IAAA,KAAS,OAAA,IAAW,SAAS,QAAA,EAAU;AACpF,IAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,IAAA;AAC7B,IAAA,IAAI,KAAA,KAAU,SAAS,OAAO,KAAA;AAC9B,IAAA,MAAA,CAAO,CAAA,CAAA,EAAI,GAAG,CAAA,4BAAA,EAA+B,KAAK,CAAA,EAAA,CAAI,CAAA;AACtD,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,IAAI,IAAA,KAAS,gBAAA,IAAoB,IAAA,KAAS,cAAA,EAAgB;AACxD,IAAA,MAAM,MAAA,GAAS,OAAO,KAAK,CAAA;AAC3B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG;AAC5B,MAAA,MAAA,CAAO,CAAA,CAAA,EAAI,GAAG,CAAA,uBAAA,EAA0B,KAAK,CAAA,EAAA,CAAI,CAAA;AACjD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,SAAA,CAAU,KAAA,EAAgC,GAAA,EAAa,KAAA,EAAsB;AACpF,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA;AAC9B,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,MAAW,OAAA,IAAW,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAA,GAAO,OAAO,OAAO,CAAA;AAC3B,IAAA,IAAI,OAAO,SAAS,QAAA,IAAY,IAAA,KAAS,QAAQ,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACpE,MAAA,MAAA,CAAO,OAAO,IAAI,EAAC;AAAA,IACrB;AACA,IAAA,MAAA,GAAS,OAAO,OAAO,CAAA;AAAA,EACzB;AACA,EAAA,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,CAAC,CAAA,GAAI,KAAA;AAC1C;AAEA,SAAS,MAAA,CAAO,EAAA,EAAY,GAAA,EAAa,KAAA,EAAe,IAAA,EAA0B;AAChF,EAAA,MAAM,IAAA,GAAO,iBAAiB,IAAI,CAAA;AAClC,EAAA,MAAM,MAAA,GAAS,WAAW,IAAI,CAAA;AAC9B,EAAA,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAExC,EAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AACtD,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,SAAA,CAAU,EAAE,CAAA;AACtC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,EAAE,CAAA;AAC1C,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,SAAA,EAAW;AAC3B,IAAA,MAAA;AAAA,MACE,CAAA,aAAA,EAAgB,EAAE,CAAA,eAAA,EAAkB,CAAA,CAAE,IAAI,CAAA,qBAAA,EAAwB,EAAE,oBAAoB,CAAC,CAAA;AAAA,KAC3F;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAKA,EAAA,MAAM,IAAA,GAAQ,QAAA,GAAW,eAAA,CAAgB,QAAQ,IAAI,EAAC;AACtD,EAAA,SAAA,CAAU,IAAA,EAAM,GAAA,EAAK,WAAA,CAAY,GAAA,EAAK,KAAK,CAAC,CAAA;AAE5C,EAAA,MAAM,IAAA,GAAmC;AAAA,IACvC,OAAA,EAAS,CAAA;AAAA,IACT,SAAA,EAAW,EAAE,GAAG,QAAA,CAAS,WAAW,CAAC,EAAE,GAAG,IAAA;AAAmC,GAC/E;AACA,EAAA,cAAA,CAAe,MAAM,MAAM,CAAA;AAC3B,EAAA,wBAAA,CAAyB,MAAA,CAAO,MAAM,IAAI,CAAA;AAE1C,EAAA,KAAA,CAAM,CAAA,IAAA,EAAO,CAAA,CAAE,IAAA,CAAK,CAAA,EAAG,EAAE,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAC,CAAA,GAAA,EAAM,KAAK,CAAA,QAAA,EAAW,MAAA,CAAO,KAAK,CAAA,SAAA,CAAW,CAAA;AAChF,EAAA,OAAA,CAAQ,IAAI,CAAA,CAAE,GAAA,CAAI,YAAO,MAAA,CAAO,IAAI,EAAE,CAAC,CAAA;AACzC;AAEA,SAAS,SAAA,CAAU,IAAY,IAAA,EAA0B;AACvD,EAAA,MAAM,IAAA,GAAO,iBAAiB,IAAI,CAAA;AAClC,EAAA,MAAM,MAAA,GAAS,WAAW,IAAI,CAAA;AAC9B,EAAA,YAAA,CAAa,EAAA,EAAI,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAEnC,EAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AACtD,EAAA,IAAI,CAAC,QAAA,CAAS,SAAA,CAAU,EAAE,CAAA,EAAG;AAC3B,IAAA,MAAA,CAAO,CAAA,aAAA,EAAgB,EAAE,CAAA,KAAA,EAAQ,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AAC9C,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,MAAM,SAAA,GAAY,EAAE,GAAG,QAAA,CAAS,SAAA,EAAU;AAC1C,EAAA,OAAO,UAAU,EAAE,CAAA;AACnB,EAAA,wBAAA,CAAyB,OAAO,IAAA,EAAM,EAAE,OAAA,EAAS,CAAA,EAAG,WAAW,CAAA;AAE/D,EAAA,KAAA,CAAM,CAAA,QAAA,EAAW,EAAE,IAAA,CAAK,EAAE,CAAC,CAAA,UAAA,EAAa,MAAA,CAAO,KAAK,CAAA,SAAA,CAAW,CAAA;AAC/D,EAAA,OAAA,CAAQ,IAAI,CAAA,CAAE,GAAA,CAAI,YAAO,MAAA,CAAO,IAAI,EAAE,CAAC,CAAA;AACvC,EAAA,IACE,KAAK,MAAA,CAAO,SAAA,CAAU,EAAE,CAAA,IACxB,IAAA,CAAK,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,OAAO,IAAA,IAAQ,CAAA,CAAE,SAAS,SAAA,CAAU,EAAE,CAAC,CAAA,EACzE;AACA,IAAA,OAAA,CAAQ,CAAA,CAAA,EAAI,EAAE,CAAA,iFAAA,CAA8E,CAAA;AAAA,EAC9F;AACF;AAIA,eAAe,OAAA,CAAQ,IAAY,IAAA,EAAmC;AACpE,EAAA,MAAM,IAAA,GAAO,iBAAiB,IAAI,CAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,EAAE,CAAA;AACtC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAA,CAAO,gBAAgB,EAAE,CAAA,OAAA,EAAU,EAAE,GAAA,CAAI,uBAAuB,CAAC,CAAA,2BAAA,CAA6B,CAAA;AAC9F,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,UAAA,GAAa,kBAAkB,KAAK,CAAA;AAC1C,EAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,EAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,EAAE,CAAC,CAAA,CAAA,EAAI,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,EAAI,KAAK,MAAA,CAAO,MAAA,CAAO,EAAE,CAAC,CAAA,OAAA,CAAS,CAAC,CAAA,CAAE,CAAA;AAC9E,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,CAAA,CAAE,KAAA,CAAM,YAAY,CAAC,CAAA,CAAA,EAAI,mBAAA,CAAoB,KAAK,CAAA,IAAK,CAAA,CAAE,GAAA,CAAI,cAAc,CAAC,CAAA,CAAE,CAAA;AAC/F,EAAA,OAAA,CAAQ,GAAA;AAAA,IACN,CAAA,EAAA,EAAK,CAAA,CAAE,KAAA,CAAM,YAAY,CAAC,IAAI,iBAAA,CAAkB,KAAK,CAAC,CAAA,CAAA,EACpD,UAAA,CAAW,KAAA,GACP,EAAE,GAAA,CAAI,CAAA,OAAA,EAAK,UAAA,CAAW,KAAK,CAAA,CAAE,CAAA,GAC7B,CAAA,CAAE,GAAA,CAAI,CAAA,qBAAA,EAAmB,UAAA,CAAW,MAAM,CAAA,CAAE,CAClD,CAAA;AAAA,GACF;AAEA,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,MAAA,CAAO,CAAA,EAAG,EAAE,CAAA,oBAAA,EAAuB,UAAA,CAAW,KAAK,CAAA,CAAE,CAAA;AACrD,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,KAAA,EAAO,EAAE,MAAA,EAAQ,UAAA,CAAW,OAAO,CAAA;AAC3E,EAAA,IAAI,MAAA,CAAO,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,CAAA,CAAE,KAAA,CAAM,YAAY,CAAC,CAAA,KAAA,EAAQ,MAAA,CAAO,GAAG,CAAA,CAAE,CAAA;AAC1E,EAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,EAAA,IAAI,OAAO,EAAA,EAAI;AACb,IAAA,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,EAAA,EAAK,MAAA,CAAO,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,GAAS,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,CAAE,CAAA;AACjF,IAAA;AAAA,EACF;AACA,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,IAAA,OAAA,CAAQ,CAAA,EAAG,EAAE,CAAA,EAAA,EAAK,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AACjC,IAAA;AAAA,EACF;AACA,EAAA,MAAA,CAAO,CAAA,EAAG,EAAE,CAAA,EAAA,EAAK,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAChC,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAChB;AAcO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,WAAW,CAAA,CAAE,WAAA;AAAA,IACnC;AAAA,GACF;AAEA,EAAA,GAAA,CACG,QAAQ,MAAM,CAAA,CACd,WAAA,CAAY,+CAA+C,EAC3D,MAAA,CAAO,sBAAA,EAAwB,mBAAmB,CAAA,CAClD,OAAO,QAAA,EAAU,yBAAyB,CAAA,CAC1C,MAAA,CAAO,CAAC,IAAA,KAAS;AAChB,IAAA,MAAM,IAAA,GAAO,iBAAiB,IAAI,CAAA;AAClC,IAAA,IAAI,KAAK,IAAA,EAAM;AACb,MAAA,OAAA,CAAQ,GAAA;AAAA,QACN,IAAA,CAAK,SAAA;AAAA,UACH;AAAA,YACE,OAAA,EAAS,mBAAA,EAAoB,CAAE,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,cAC9C,IAAI,MAAA,CAAO,EAAA;AAAA,cACX,MAAM,MAAA,CAAO,IAAA;AAAA,cACb,SAAS,MAAA,CAAO,OAAA;AAAA,cAChB,SAAA,EAAW,MAAA,CAAO,SAAA,KAAc,MAAA,CAAO,UAAU,QAAA,GAAW,MAAA,CAAA;AAAA,cAC5D,QAAA,EAAU,cAAc,MAAM,CAAA;AAAA,cAC9B,YAAY,MAAA,CAAO,UAAA;AAAA,cACnB,iBAAiB,MAAA,CAAO;AAAA,aAC1B,CAAE,CAAA;AAAA,YACF,WAAW,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,GAAA,CAAI,CAAC,EAAA,MAAQ;AAAA,cACxC,EAAA;AAAA,cACA,KAAA,EAAO,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAAA,cAC5B,KAAA,EAAO,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,EAAE,CAAA;AAAA,cAC/B,UAAU,mBAAA,CAAoB,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,EAAE,CAAC;AAAA,aACzD,CAAE;AAAA,WACJ;AAAA,UACA,IAAA;AAAA,UACA;AAAA;AACF,OACF;AACA,MAAA;AAAA,IACF;AACA,IAAA,iBAAA,CAAkB,KAAK,WAAW,CAAA;AAClC,IAAA,YAAA,EAAa;AACb,IAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,EACtB,CAAC,CAAA;AAEH,EAAA,GAAA,CACG,QAAQ,UAAU,CAAA,CAClB,WAAA,CAAY,uEAAuE,EACnF,cAAA,CAAe,mBAAA,EAAqB,CAAA,oBAAA,EAAuB,aAAa,GAAG,CAAA,CAC3E,MAAA,CAAO,oBAAA,EAAsB,8EAA+D,EAC5F,MAAA,CAAO,kBAAA,EAAoB,8BAA8B,CAAA,CACzD,OAAO,qBAAA,EAAuB,CAAA,cAAA,EAAiB,oBAAA,CAAqB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA,CACjF,MAAA,CAAO,iBAAiB,uDAAA,EAAyD,KAAK,EACtF,MAAA,CAAO,gBAAA,EAAkB,eAAe,CAAA,CACxC,MAAA;AAAA,IACC,qBAAA;AAAA,IACA,gGAAA;AAAA,IACA,CAAC,KAAA,EAAe,QAAA,KAAuB,CAAC,GAAG,UAAU,KAAK,CAAA;AAAA,IAC1D;AAAC,GACH,CACC,OAAO,aAAA,EAAe,kEAAkE,EACxF,MAAA,CAAO,sBAAA,EAAwB,mBAAmB,CAAA,CAClD,MAAA,CAAO,WAAW,gDAAgD,CAAA,CAClE,OAAO,CAAC,EAAA,EAAwB,SAAqB,MAAA,CAAO,EAAA,EAAI,IAAI,CAAC,CAAA;AAExE,EAAA,GAAA,CACG,OAAA,CAAQ,wBAAwB,CAAA,CAChC,WAAA;AAAA,IACC;AAAA,GACF,CACC,OAAO,aAAA,EAAe,kEAAkE,EACxF,MAAA,CAAO,sBAAA,EAAwB,mBAAmB,CAAA,CAClD,MAAA;AAAA,IAAO,CAAC,IAAY,GAAA,EAAa,KAAA,EAAe,SAC/C,MAAA,CAAO,EAAA,EAAI,GAAA,EAAK,KAAA,EAAO,IAAI;AAAA,GAC7B;AAEF,EAAA,GAAA,CACG,OAAA,CAAQ,SAAS,CAAA,CACjB,WAAA,CAAY,kCAAkC,CAAA,CAC9C,MAAA,CAAO,eAAe,iEAAiE,CAAA,CACvF,OAAO,sBAAA,EAAwB,mBAAmB,EAClD,MAAA,CAAO,CAAC,IAAY,IAAA,KAAuB,SAAA,CAAU,EAAA,EAAI,IAAI,CAAC,CAAA;AAEjE,EAAA,GAAA,CACG,QAAQ,WAAW,CAAA,CACnB,WAAA,CAAY,gEAAgE,EAC5E,MAAA,CAAO,sBAAA,EAAwB,mBAAmB,CAAA,CAClD,OAAO,CAAC,EAAA,EAAY,SAAuB,OAAA,CAAQ,EAAA,EAAI,IAAI,CAAC,CAAA;AAE/D,EAAA,OAAO,GAAA;AACT","file":"chunk-7ANRSTNR.js","sourcesContent":["/**\n * `skaile providers` — manage the AI provider registry.\n *\n * Endpoints are defined once, in `~/.skaile/providers.yml`, optionally\n * overridden per project in `<workspace>/.skaile/providers.yml` (gitignored by\n * `skaile init`). Every subcommand writes exactly one of those two files and\n * validates the result before it lands — a literal secret never reaches disk.\n *\n * @see PROVIDER-CONFIG-PLAN.md §1, §2.5\n */\n\nimport path from \"node:path\";\nimport * as p from \"@clack/prompts\";\nimport {\n  catalogLayer,\n  expandPreset,\n  getProviderPreset,\n  listProviderPresets,\n  presetBaseUrl,\n  probeProviderEntry,\n} from \"@skaile/workspaces/bridge\";\nimport {\n  AI_PROVIDER_LAYERS,\n  AI_PROVIDER_SURFACES,\n  type AIProviderDiagnostic,\n  type AIProviderEntry,\n  type AIProviderLayerId,\n  type AIProviderLlmEntry,\n  type AIProviderRegistryDocument,\n  type AIProviderSurface,\n  entryTransport,\n  isEntryEnabled,\n  isSafeProviderId,\n  loadProviderRegistry,\n  type MergedAIProviderRegistry,\n  mergeRegistries,\n  parseCredentialRef,\n  type ProviderRegistryFile,\n  resolveCredential,\n  resolveEntryBaseUrl,\n  saveProviderRegistryFile,\n  userProviderRegistryPath,\n  validateMergedRegistry,\n  validateRegistry,\n  workspaceProviderRegistryPath,\n} from \"@skaile/workspaces/core\";\nimport { Command } from \"commander\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\n\n/** Preset id that means \"no preset — I will supply the three literals\". */\nconst CUSTOM_PRESET = \"custom\";\n\n/** Which of the two registry files a command reads or writes. */\nexport interface ScopeOptions {\n  projectDir?: string;\n  workspace?: boolean;\n}\n\n/** The file a mutating subcommand writes: the workspace layer or the user one. */\nfunction targetFile(opts: ScopeOptions): { layer: \"user\" | \"workspace\"; path: string } {\n  if (opts.workspace) {\n    return { layer: \"workspace\", path: workspaceProviderRegistryPath(resolveProjectDir(opts)) };\n  }\n  return { layer: \"user\", path: userProviderRegistryPath() };\n}\n\n/** Project directory a subcommand operates on — `--project-dir` or the cwd. */\nfunction resolveProjectDir(opts: ScopeOptions): string {\n  return opts.projectDir ? path.resolve(opts.projectDir) : process.cwd();\n}\n\n/** Both file layers plus the catalog, merged — what every reader sees. */\nexport interface RegistryView {\n  merged: MergedAIProviderRegistry;\n  files: ProviderRegistryFile[];\n  diagnostics: AIProviderDiagnostic[];\n}\n\n/**\n * Load both file layers and merge them with the catalog layer the configured\n * `preset:` keys pull in, then gate the result. Read once, merged twice — the\n * catalog layer can only be built after the configured entries are known,\n * and it is built from the **pre-gate** merge: an entry that leaves `kind` or\n * its transport `params` to the preset fails the first gate by design.\n *\n * The gate is on the merged view, not per file: a workspace entry that sets\n * one field of an entry the user file defines is an override (§1.5), so it is\n * only here that an entry can be judged complete.\n */\nexport function loadRegistryView(opts: ScopeOptions): RegistryView {\n  const loaded = loadProviderRegistry({ projectDir: resolveProjectDir(opts) });\n  const fileLayers = loaded.files.map((file) => ({\n    layer: file.layer as AIProviderLayerId,\n    providers: file.document.providers,\n  }));\n  const catalog = catalogLayer(loaded.patches);\n  const { registry, diagnostics } = validateMergedRegistry(\n    mergeRegistries([...fileLayers, catalog]),\n    {\n      sources: [\n        ...loaded.files.map((file) => ({ label: file.path, providers: file.document.providers })),\n      ],\n    },\n  );\n  return {\n    merged: registry,\n    files: loaded.files,\n    // `loaded.diagnostics` already carries the merge notes for the file layers\n    // alone; this second merge adds the catalog, so its notes replace them.\n    diagnostics: [...loaded.files.flatMap((file) => file.diagnostics), ...diagnostics],\n  };\n}\n\n/** Print diagnostics; returns how many were errors. */\nfunction reportDiagnostics(diagnostics: AIProviderDiagnostic[]): number {\n  let errors = 0;\n  for (const diagnostic of diagnostics) {\n    const where = diagnostic.path ? `${diagnostic.path}: ` : \"\";\n    if (diagnostic.severity === \"error\") {\n      errors++;\n      logErr(`${where}${diagnostic.message}`);\n    } else {\n      logWarn(`${where}${diagnostic.message}`);\n    }\n  }\n  return errors;\n}\n\n/** Highest layer that pins an entry with `locked: true`. */\nfunction lockOwner(id: string, files: ProviderRegistryFile[]): AIProviderLayerId | undefined {\n  let owner: AIProviderLayerId | undefined;\n  for (const file of files) {\n    if (file.document.providers[id]?.locked) {\n      const layer = file.layer as AIProviderLayerId;\n      if (!owner || AI_PROVIDER_LAYERS.indexOf(layer) > AI_PROVIDER_LAYERS.indexOf(owner)) {\n        owner = layer;\n      }\n    }\n  }\n  return owner;\n}\n\n/**\n * The message for an edit a lock forbids, or `undefined` when it is allowed.\n * The merge ignores a lower layer silently; the CLI must not, or the operator\n * would watch an accepted edit have no effect.\n *\n * `set <id> locked <value>` stays legal at the locking layer itself —\n * otherwise a lock could never be lifted without hand-editing the file.\n */\nfunction lockConflict(\n  id: string,\n  target: { layer: \"user\" | \"workspace\"; path: string },\n  files: ProviderRegistryFile[],\n  key?: string,\n): string | undefined {\n  const owner = lockOwner(id, files);\n  if (!owner) return undefined;\n  const ownerRank = AI_PROVIDER_LAYERS.indexOf(owner);\n  const targetRank = AI_PROVIDER_LAYERS.indexOf(target.layer);\n  if (ownerRank === targetRank && key === \"locked\") return undefined;\n  if (ownerRank < targetRank) return undefined;\n  return (\n    `'${id}' is locked by the ${owner} layer and cannot be changed from ${target.layer}.\\n` +\n    (ownerRank === targetRank\n      ? `  Unlock it first: skaile providers set ${id} locked false`\n      : `  A higher layer owns this entry — change it there.`)\n  );\n}\n\n/** Refuse loudly when a locked entry would be edited. */\nfunction exitIfLocked(\n  id: string,\n  target: { layer: \"user\" | \"workspace\"; path: string },\n  files: ProviderRegistryFile[],\n  key?: string,\n): void {\n  const message = lockConflict(id, target, files, key);\n  if (!message) return;\n  logErr(message);\n  process.exit(1);\n}\n\n/** Read the target file, or an empty document when it does not exist yet. */\nfunction readTargetDocument(\n  target: { layer: \"user\" | \"workspace\"; path: string },\n  files: ProviderRegistryFile[],\n): AIProviderRegistryDocument {\n  const file = files.find((f) => f.path === target.path);\n  return file?.document ?? { version: 1, providers: {} };\n}\n\n/**\n * Validate the file that is about to be written; exits non-zero on errors.\n *\n * Validated as the layer it is, so `set` may leave a one-field override in the\n * workspace file (§1.5). Completeness is the merged registry's business, and\n * `loadRegistryView` reports it on the next read.\n */\nfunction validateOrExit(\n  document: AIProviderRegistryDocument,\n  target: { layer: \"user\" | \"workspace\"; path: string },\n): void {\n  const { diagnostics } = validateRegistry(\n    { version: 1, providers: document.providers },\n    { source: target.path, layer: target.layer },\n  );\n  if (reportDiagnostics(diagnostics) > 0) process.exit(1);\n}\n\n// ── list ───────────────────────────────────────────────────────────────────\n\nfunction pad(value: string, width: number): string {\n  return value.length >= width ? value : value + \" \".repeat(width - value.length);\n}\n\nfunction credentialSummary(entry: AIProviderEntry): string {\n  const credential = entry.credential;\n  if (!credential || credential.kind === \"none\") return \"none\";\n  return credential.ref ? `${credential.kind} ${credential.ref}` : credential.kind;\n}\n\nfunction printPresets(): void {\n  const presets = listProviderPresets();\n  console.log();\n  console.log(`  ${S.heading(\"Catalog presets\")}`);\n  const idWidth = Math.max(...presets.map((x) => x.id.length)) + 2;\n  const surfaceWidth = Math.max(...AI_PROVIDER_SURFACES.map((s) => s.length)) + 2;\n  const header = `${pad(\"preset\", idWidth)}${pad(\"kind\", 7)}${pad(\"surface\", surfaceWidth)}${pad(\"transport\", 14)}default base URL`;\n  console.log(`  ${S.dim(header)}`);\n  for (const preset of presets) {\n    const row =\n      pad(preset.id, idWidth) +\n      pad(preset.kind, 7) +\n      pad(preset.surface ?? \"—\", surfaceWidth) +\n      pad(\n        preset.kind === \"llm\" || preset.kind === \"embed\" ? (preset.transport ?? \"direct\") : \"—\",\n        14,\n      ) +\n      (presetBaseUrl(preset) ?? \"—\");\n    console.log(`  ${row}`);\n  }\n}\n\nfunction printConfigured(view: RegistryView): void {\n  const ids = view.merged.order;\n  console.log();\n  console.log(`  ${S.heading(\"Configured providers\")}`);\n  if (ids.length === 0) {\n    console.log(\n      `  ${S.dim(\"none — add one with\")} ${S.cmd(\"skaile providers add --preset <preset>\")}`,\n    );\n    console.log();\n    return;\n  }\n  const idWidth = Math.max(...ids.map((id) => id.length)) + 2;\n  const header = `${pad(\"id\", idWidth)}${pad(\"layer\", 11)}${pad(\"surface\", 26)}${pad(\"transport\", 14)}endpoint`;\n  console.log(`  ${S.dim(header)}`);\n  for (const id of ids) {\n    const entry = view.merged.providers[id];\n    const surface = (entry as AIProviderLlmEntry).surface ?? \"—\";\n    const transport = entryTransport(entry) ?? \"—\";\n    const url = resolveEntryBaseUrl(entry) ?? S.dim(\"(unresolved)\");\n    const flags = [\n      isEntryEnabled(entry) ? \"\" : S.warn(\"disabled\"),\n      entry.locked ? S.warn(\"locked\") : \"\",\n    ]\n      .filter(Boolean)\n      .join(\" \");\n    console.log(\n      `  ${pad(id, idWidth)}${pad(view.merged.origin[id], 11)}${pad(surface, 26)}${pad(transport, 14)}${url} ${flags}`.trimEnd(),\n    );\n    console.log(`  ${S.dim(`${pad(\"\", idWidth)}${credentialSummary(entry)}`)}`);\n  }\n  console.log();\n}\n\n// ── add ────────────────────────────────────────────────────────────────────\n\ninterface AddOptions extends ScopeOptions {\n  preset?: string;\n  credential?: string;\n  baseUrl?: string;\n  surface?: string;\n  label?: string;\n  kind?: string;\n  param: string[];\n  force?: boolean;\n}\n\nfunction parseParams(pairs: string[]): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const pair of pairs) {\n    const eq = pair.indexOf(\"=\");\n    if (eq <= 0) {\n      logErr(`--param expects <key>=<value> (got '${pair}')`);\n      process.exit(1);\n    }\n    out[pair.slice(0, eq)] = pair.slice(eq + 1);\n  }\n  return out;\n}\n\n/** Ask for the three literals a custom endpoint needs. Nothing else. */\nasync function promptCustomEntry(\n  id: string,\n  opts: AddOptions,\n): Promise<{ surface: AIProviderSurface; baseUrl: string; credentialRef: string }> {\n  const interactive = process.stdin.isTTY === true;\n  let surface = opts.surface as AIProviderSurface | undefined;\n  let baseUrl = opts.baseUrl;\n  let credentialRef = opts.credential;\n\n  if (!interactive && (!surface || !baseUrl || !credentialRef)) {\n    logErr(\n      \"--preset custom needs --surface, --base-url and --credential when there is no terminal to prompt on\",\n    );\n    process.exit(1);\n  }\n\n  if (!surface) {\n    const answer = await p.select({\n      message: \"Wire surface:\",\n      options: AI_PROVIDER_SURFACES.map((value) => ({ value, label: value })),\n      initialValue: \"openai-completions\" as AIProviderSurface,\n    });\n    if (p.isCancel(answer)) {\n      p.cancel(\"Cancelled.\");\n      process.exit(1);\n    }\n    surface = answer as AIProviderSurface;\n  }\n  if (!baseUrl) {\n    const answer = await p.text({\n      message: \"Base URL:\",\n      placeholder: \"https://api.example.com/v1\",\n    });\n    if (p.isCancel(answer)) {\n      p.cancel(\"Cancelled.\");\n      process.exit(1);\n    }\n    baseUrl = answer as string;\n  }\n  if (!credentialRef) {\n    const answer = await p.text({\n      message: \"Credential reference (env:NAME, cmd:<shell>, platform:<id>, keyring:<svc>/<acct>):\",\n      initialValue: `env:${id.toUpperCase().replace(/[^A-Z0-9]/g, \"_\")}_API_KEY`,\n    });\n    if (p.isCancel(answer)) {\n      p.cancel(\"Cancelled.\");\n      process.exit(1);\n    }\n    credentialRef = answer as string;\n  }\n  return { surface, baseUrl, credentialRef };\n}\n\n/** A rejected registry write. The message is already CLI-ready. */\nexport class ProviderRegistryWriteError extends Error {}\n\n/** What {@link addProviderEntry} writes. */\nexport interface AddProviderEntryInput extends ScopeOptions {\n  /** Registry entry id — `[a-z0-9][a-z0-9_-]*`. */\n  id: string;\n  /** Catalog preset to expand. Mutually exclusive with `entry`. */\n  presetId?: string;\n  /** A fully-built entry (the `--preset custom` path, which needs prompts). */\n  entry?: AIProviderEntry;\n  /** `env:NAME` / `cmd:…` / `platform:…` / `keyring:…` — never a literal. */\n  credentialRef?: string;\n  baseUrl?: string;\n  surface?: AIProviderSurface;\n  label?: string;\n  params?: Record<string, string>;\n  /** Overwrite an entry that already exists in the target file. */\n  force?: boolean;\n}\n\n/** Result of {@link addProviderEntry}. */\nexport interface AddedProviderEntry {\n  id: string;\n  layer: \"user\" | \"workspace\";\n  path: string;\n  entry: AIProviderEntry;\n  /** True when an existing entry in the target file was overwritten. */\n  replaced: boolean;\n}\n\n/**\n * Write one entry into a registry file — the single write path behind\n * `skaile providers add` and the `skaile setup` wizard.\n *\n * Throws {@link ProviderRegistryWriteError} instead of exiting, so a wizard\n * can report the failure in its own idiom. Every rejection a caller can\n * provoke (bad id, unknown preset, missing transport parameter, locked entry,\n * a literal secret) lands here, and the document is validated before it is\n * written — a secret cannot reach disk through this function.\n */\nexport function addProviderEntry(input: AddProviderEntryInput): AddedProviderEntry {\n  const { id } = input;\n  if (!isSafeProviderId(id)) {\n    throw new ProviderRegistryWriteError(\n      `'${id}' is not a valid entry id — use [a-z0-9][a-z0-9_-]*`,\n    );\n  }\n  if (input.credentialRef && !parseCredentialRef(input.credentialRef)) {\n    throw new ProviderRegistryWriteError(\n      \"the credential must be a reference, not a secret: \" +\n        \"env:NAME, cmd:<shell>, platform:<configId> or keyring:<service>/<account>\",\n    );\n  }\n\n  const view = loadRegistryView(input);\n  const target = targetFile(input);\n  const locked = lockConflict(id, target, view.files);\n  if (locked) throw new ProviderRegistryWriteError(locked);\n\n  const document = readTargetDocument(target, view.files);\n  const replaced = document.providers[id] !== undefined;\n  if (replaced && !input.force) {\n    throw new ProviderRegistryWriteError(\n      `'${id}' already exists in ${target.path} — pass --force to overwrite it.`,\n    );\n  }\n\n  let entry: AIProviderEntry;\n  if (input.entry) {\n    entry = input.entry;\n  } else {\n    const preset = input.presetId ? getProviderPreset(input.presetId) : undefined;\n    if (!preset) {\n      throw new ProviderRegistryWriteError(\n        `Unknown preset '${input.presetId}'. Run \\`skaile providers list\\` to see the catalog, ` +\n          \"or use `--preset custom`.\",\n      );\n    }\n    entry = expandPreset(preset, {\n      credentialRef: input.credentialRef,\n      baseUrl: input.baseUrl,\n      surface: input.surface,\n      label: input.label,\n      params: input.params,\n    });\n    const missing = (preset.required_params ?? []).filter(\n      (key) => !(key in ((entry as AIProviderLlmEntry).params ?? {})),\n    );\n    if (missing.length > 0) {\n      throw new ProviderRegistryWriteError(\n        `Preset '${preset.id}' needs ${missing.map((m) => `--param ${m}=<value>`).join(\" \")}`,\n      );\n    }\n  }\n\n  const next: AIProviderRegistryDocument = {\n    version: 1,\n    providers: { ...document.providers, [id]: entry },\n  };\n  const { diagnostics } = validateRegistry(\n    { version: 1, providers: next.providers },\n    { source: target.path },\n  );\n  const errors = diagnostics.filter((d) => d.severity === \"error\");\n  if (errors.length > 0) {\n    throw new ProviderRegistryWriteError(\n      errors.map((d) => (d.path ? `${d.path}: ${d.message}` : d.message)).join(\"\\n\"),\n    );\n  }\n  saveProviderRegistryFile(target.path, next);\n\n  return { id, layer: target.layer, path: target.path, entry, replaced };\n}\n\n/** The env var an `env:` credential reference points at, if it is one. */\nexport function credentialEnvVarName(entry: AIProviderEntry): string | undefined {\n  const ref = entry.credential?.ref;\n  return ref?.startsWith(\"env:\") ? ref.slice(4) : undefined;\n}\n\n/** Build the `--preset custom` entry from the three literals the user gave. */\nfunction customEntry(\n  answers: { surface: AIProviderSurface; baseUrl: string; credentialRef: string },\n  opts: AddOptions,\n): AIProviderEntry {\n  const kind = (opts.kind ?? \"llm\") as AIProviderEntry[\"kind\"];\n  // Anthropic- and Google-shaped surfaces read a dedicated API-key header;\n  // everything else is a bearer token. `set <id> credential.kind …` adjusts.\n  const credentialKind =\n    kind === \"stt\" ||\n    kind === \"tts\" ||\n    answers.surface === \"anthropic-messages\" ||\n    answers.surface === \"google-generative-ai\" ||\n    answers.surface === \"azure-openai-responses\"\n      ? \"api_key_header\"\n      : \"bearer\";\n  if (kind === \"stt\" || kind === \"tts\") {\n    return {\n      kind,\n      ...(opts.label ? { label: opts.label } : {}),\n      base_url: answers.baseUrl,\n      credential: { kind: credentialKind, ref: answers.credentialRef },\n    };\n  }\n  return {\n    kind,\n    ...(opts.label ? { label: opts.label } : {}),\n    surface: answers.surface,\n    base_url: answers.baseUrl,\n    credential: { kind: credentialKind, ref: answers.credentialRef },\n  } as AIProviderLlmEntry;\n}\n\nasync function runAdd(idArg: string | undefined, opts: AddOptions): Promise<void> {\n  const presetId = opts.preset;\n  if (!presetId) {\n    logErr(\n      `--preset is required. Run ${S.cmd(\"skaile providers list\")} for the catalog, ` +\n        `or use ${S.cmd(\"--preset custom\")}.`,\n    );\n    process.exit(1);\n  }\n  const id = idArg ?? presetId;\n  if (id === CUSTOM_PRESET && !idArg) {\n    logErr(\"--preset custom needs an entry id: skaile providers add <id> --preset custom\");\n    process.exit(1);\n  }\n\n  const entry =\n    presetId === CUSTOM_PRESET ? customEntry(await promptCustomEntry(id, opts), opts) : undefined;\n\n  let added: AddedProviderEntry;\n  try {\n    added = addProviderEntry({\n      id,\n      ...(entry ? { entry } : { presetId }),\n      credentialRef: opts.credential,\n      baseUrl: opts.baseUrl,\n      surface: opts.surface as AIProviderSurface | undefined,\n      label: opts.label,\n      params: parseParams(opts.param),\n      projectDir: opts.projectDir,\n      workspace: opts.workspace,\n      force: opts.force,\n    });\n  } catch (error) {\n    logErr(error instanceof Error ? error.message : String(error));\n    process.exit(1);\n  }\n\n  logOk(`Added ${S.bold(id)} (${presetId}) to the ${added.layer} registry`);\n  console.log(S.dim(`  → ${added.path}`));\n  const name = credentialEnvVarName(added.entry);\n  if (name) {\n    console.log(\n      `  ${S.dim(\"The secret itself never goes in this file — export it:\")} ${S.cmd(`export ${name}=…`)}`,\n    );\n  }\n  console.log(`  ${S.dim(\"Verify with:\")} ${S.cmd(`skaile providers test ${id}`)}`);\n}\n\n// ── set / rm ───────────────────────────────────────────────────────────────\n\n/** Coerce a CLI string into the type the schema expects at `key`. */\nfunction coerceValue(key: string, value: string): unknown {\n  const leaf = key.split(\".\").pop() ?? key;\n  if (leaf === \"enabled\" || leaf === \"locked\" || leaf === \"tools\" || leaf === \"images\") {\n    if (value === \"true\") return true;\n    if (value === \"false\") return false;\n    logErr(`'${key}' takes true or false (got '${value}')`);\n    process.exit(1);\n  }\n  if (leaf === \"context_window\" || leaf === \"thinking_max\") {\n    const parsed = Number(value);\n    if (!Number.isFinite(parsed)) {\n      logErr(`'${key}' takes a number (got '${value}')`);\n      process.exit(1);\n    }\n    return parsed;\n  }\n  return value;\n}\n\n/** Write `value` at a dotted path, creating intermediate maps. */\nfunction setDotted(entry: Record<string, unknown>, key: string, value: unknown): void {\n  const segments = key.split(\".\");\n  let cursor = entry;\n  for (const segment of segments.slice(0, -1)) {\n    const next = cursor[segment];\n    if (typeof next !== \"object\" || next === null || Array.isArray(next)) {\n      cursor[segment] = {};\n    }\n    cursor = cursor[segment] as Record<string, unknown>;\n  }\n  cursor[segments[segments.length - 1]] = value;\n}\n\nfunction runSet(id: string, key: string, value: string, opts: ScopeOptions): void {\n  const view = loadRegistryView(opts);\n  const target = targetFile(opts);\n  exitIfLocked(id, target, view.files, key);\n\n  const document = readTargetDocument(target, view.files);\n  const existing = document.providers[id];\n  const inherited = view.merged.providers[id];\n  if (!existing && !inherited) {\n    logErr(\n      `No provider '${id}'. Add it with ${S.cmd(`skaile providers add ${id} --preset <preset>`)}`,\n    );\n    process.exit(1);\n  }\n\n  // Writing a field into a layer that has no entry yet leaves a one-field\n  // override: the layers below keep supplying the rest (§1.5), so copying\n  // their `kind` down here would pin a value this layer does not own.\n  const base = (existing ? structuredClone(existing) : {}) as unknown as Record<string, unknown>;\n  setDotted(base, key, coerceValue(key, value));\n\n  const next: AIProviderRegistryDocument = {\n    version: 1,\n    providers: { ...document.providers, [id]: base as unknown as AIProviderEntry },\n  };\n  validateOrExit(next, target);\n  saveProviderRegistryFile(target.path, next);\n\n  logOk(`Set ${S.bold(`${id}.${key}`)} = ${value} in the ${target.layer} registry`);\n  console.log(S.dim(`  → ${target.path}`));\n}\n\nfunction runRemove(id: string, opts: ScopeOptions): void {\n  const view = loadRegistryView(opts);\n  const target = targetFile(opts);\n  exitIfLocked(id, target, view.files);\n\n  const document = readTargetDocument(target, view.files);\n  if (!document.providers[id]) {\n    logErr(`No provider '${id}' in ${target.path}`);\n    process.exit(1);\n  }\n  const providers = { ...document.providers };\n  delete providers[id];\n  saveProviderRegistryFile(target.path, { version: 1, providers });\n\n  logOk(`Removed ${S.bold(id)} from the ${target.layer} registry`);\n  console.log(S.dim(`  → ${target.path}`));\n  if (\n    view.merged.providers[id] &&\n    view.files.some((f) => f.path !== target.path && f.document.providers[id])\n  ) {\n    logInfo(`'${id}' is still defined in another layer — run 'skaile providers list' to see it.`);\n  }\n}\n\n// ── test ───────────────────────────────────────────────────────────────────\n\nasync function runTest(id: string, opts: ScopeOptions): Promise<void> {\n  const view = loadRegistryView(opts);\n  const entry = view.merged.providers[id];\n  if (!entry) {\n    logErr(`No provider '${id}'. Run ${S.cmd(\"skaile providers list\")} to see what is configured.`);\n    process.exit(1);\n  }\n\n  const credential = resolveCredential(entry);\n  console.log();\n  console.log(`  ${S.heading(id)} ${S.dim(`(${view.merged.origin[id]} layer)`)}`);\n  console.log(`  ${S.label(\"endpoint  \")} ${resolveEntryBaseUrl(entry) ?? S.dim(\"(unresolved)\")}`);\n  console.log(\n    `  ${S.label(\"credential\")} ${credentialSummary(entry)} ${\n      credential.error\n        ? S.err(`— ${credential.error}`)\n        : S.dim(`— resolved from ${credential.source}`)\n    }`,\n  );\n\n  if (credential.error) {\n    console.log();\n    logErr(`${id} is not usable yet: ${credential.error}`);\n    process.exit(1);\n  }\n\n  const result = await probeProviderEntry(entry, { secret: credential.value });\n  if (result.url) console.log(`  ${S.label(\"probe     \")} GET ${result.url}`);\n  console.log();\n  if (result.ok) {\n    logOk(`${id}: ${result.detail}${result.status ? ` (HTTP ${result.status})` : \"\"}`);\n    return;\n  }\n  if (!result.probed) {\n    logWarn(`${id}: ${result.detail}`);\n    return;\n  }\n  logErr(`${id}: ${result.detail}`);\n  process.exit(1);\n}\n\n// ── command ────────────────────────────────────────────────────────────────\n\n/**\n * Create the `skaile providers` command group.\n *\n * `list` shows the catalog and what is configured; `add` writes an entry from\n * a preset (or from three literals with `--preset custom`); `set` and `rm`\n * edit one layer; `test` sends one read-only request and reports what came\n * back, never the credential.\n *\n * @returns Configured {@link Command} ready for `program.addCommand()`.\n */\nexport function makeProvidersCommand(): Command {\n  const cmd = new Command(\"providers\").description(\n    \"Manage AI provider endpoints (~/.skaile/providers.yml)\",\n  );\n\n  cmd\n    .command(\"list\")\n    .description(\"List catalog presets and configured providers\")\n    .option(\"--project-dir <path>\", \"Project directory\")\n    .option(\"--json\", \"Machine-readable output\")\n    .action((opts) => {\n      const view = loadRegistryView(opts);\n      if (opts.json) {\n        console.log(\n          JSON.stringify(\n            {\n              presets: listProviderPresets().map((preset) => ({\n                id: preset.id,\n                kind: preset.kind,\n                surface: preset.surface,\n                transport: preset.transport ?? (preset.surface ? \"direct\" : undefined),\n                base_url: presetBaseUrl(preset),\n                credential: preset.credential,\n                required_params: preset.required_params,\n              })),\n              providers: view.merged.order.map((id) => ({\n                id,\n                layer: view.merged.origin[id],\n                entry: view.merged.providers[id],\n                base_url: resolveEntryBaseUrl(view.merged.providers[id]),\n              })),\n            },\n            null,\n            2,\n          ),\n        );\n        return;\n      }\n      reportDiagnostics(view.diagnostics);\n      printPresets();\n      printConfigured(view);\n    });\n\n  cmd\n    .command(\"add [id]\")\n    .description(\"Add a provider from a catalog preset (id defaults to the preset name)\")\n    .requiredOption(\"--preset <preset>\", `Catalog preset, or '${CUSTOM_PRESET}'`)\n    .option(\"--credential <ref>\", \"Credential reference (env:NAME, cmd:…, platform:…, keyring:…)\")\n    .option(\"--base-url <url>\", \"Override the preset endpoint\")\n    .option(\"--surface <surface>\", `Wire surface (${AI_PROVIDER_SURFACES.join(\", \")})`)\n    .option(\"--kind <kind>\", \"Entry kind for --preset custom (llm, embed, stt, tts)\", \"llm\")\n    .option(\"--label <text>\", \"Display label\")\n    .option(\n      \"--param <key=value>\",\n      \"Transport parameter (repeatable): region, project, location, resource, deployment, api_version\",\n      (value: string, previous: string[]) => [...previous, value],\n      [] as string[],\n    )\n    .option(\"--workspace\", \"Write <workspace>/.skaile/providers.yml instead of the user file\")\n    .option(\"--project-dir <path>\", \"Project directory\")\n    .option(\"--force\", \"Overwrite an existing entry in the target file\")\n    .action((id: string | undefined, opts: AddOptions) => runAdd(id, opts));\n\n  cmd\n    .command(\"set <id> <key> <value>\")\n    .description(\n      \"Set one field (base_url, enabled, credential.ref, headers.<name>, model_map.<id>…)\",\n    )\n    .option(\"--workspace\", \"Write <workspace>/.skaile/providers.yml instead of the user file\")\n    .option(\"--project-dir <path>\", \"Project directory\")\n    .action((id: string, key: string, value: string, opts: ScopeOptions) =>\n      runSet(id, key, value, opts),\n    );\n\n  cmd\n    .command(\"rm <id>\")\n    .description(\"Remove a provider from one layer\")\n    .option(\"--workspace\", \"Edit <workspace>/.skaile/providers.yml instead of the user file\")\n    .option(\"--project-dir <path>\", \"Project directory\")\n    .action((id: string, opts: ScopeOptions) => runRemove(id, opts));\n\n  cmd\n    .command(\"test <id>\")\n    .description(\"Send one read-only request to a provider and report the result\")\n    .option(\"--project-dir <path>\", \"Project directory\")\n    .action((id: string, opts: ScopeOptions) => runTest(id, opts));\n\n  return cmd;\n}\n"]}