@skaile/workspaces 5.19.0 → 6.0.0

package/dist/{chunk-YIF2IJUA.js.map → chunk-6GWSDPBP.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../connectors/src/connect-error-kind.ts"],"names":[],"mappings":";;;AAuBO,IAAM,2BAAA,GAA8B;AAYpC,SAAS,yBAAyB,GAAA,EAA8C;AACrF,EAAA,IAAI,QAAQ,IAAA,IAAQ,OAAO,QAAQ,QAAA,IAAY,EAAE,+BAA+B,GAAA,CAAA,EAAM;AACpF,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,KAAA,GAAS,IAAgC,2BAA2B,CAAA;AAC1E,EAAA,OAAQ,qBAAA,CAA6C,QAAA,CAAS,KAAK,CAAA,GAC9D,KAAA,GACD,MAAA;AACN;AAOO,SAAS,oBAAA,CAAwB,KAAQ,IAAA,EAA6B;AAC3E,EAAA,IAAI,QAAQ,IAAA,IAAQ,OAAO,QAAQ,QAAA,IAAY,EAAE,+BAA+B,GAAA,CAAA,EAAM;AACpF,IAAA,IAAI;AACF,MAAC,GAAA,CAAgC,2BAA2B,CAAA,GAAI,IAAA;AAAA,IAClE,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAMO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAChD,CAAU,2BAA2B;AAAA,EACrC,WAAA,CAAY,SAAiB,IAAA,EAA0B;AACrD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,2BAA2B,CAAA,GAAI,IAAA;AAAA,EACtC;AACF","file":"chunk-YIF2IJUA.js","sourcesContent":["/**\n * The driver-side contract for classifying a connect failure: how a thrower\n * says which {@link ConnectorErrorKind} its error is. Read by the manager's\n * `classifyConnectError` (`classify-connect-error.ts`) into the `errorKind`\n * field of `connector_status` error events.\n *\n * Depends on nothing but `types`, so the `connectors-shared` subpath can\n * re-export it to out-of-tree drivers.\n *\n * @docLink packages/connectors/concepts#connector-manager\n */\n\nimport { CONNECTOR_ERROR_KINDS, type ConnectorErrorKind } from \"@skaile/workspaces/types\";\n\n/**\n * The property a thrown error carries its kind on.\n *\n * Namespaced because it is read off any thrown object: a bare `errorKind` is\n * a name a library's own error may already use, and a value that happened to\n * read `\"config\"` would silently misroute the failure. A plain string key\n * rather than a symbol, so a driver with no import from this package can still\n * set it: `throw Object.assign(new Error(msg), { skaileConnectErrorKind: \"config\" })`.\n */\nexport const CONNECT_ERROR_KIND_PROPERTY = \"skaileConnectErrorKind\";\n\n/**\n * The shape of an error that declares its kind. For classes that must spell the\n * key out instead of computing it (see the git driver's `TokenMediatorError`):\n * `implements` keeps the literal tied to {@link CONNECT_ERROR_KIND_PROPERTY}.\n */\nexport type DeclaresConnectErrorKind = {\n  readonly [CONNECT_ERROR_KIND_PROPERTY]: ConnectorErrorKind;\n};\n\n/** The kind `err` declares for itself, or `undefined` when it declares none (or an unknown one). */\nexport function declaredConnectErrorKind(err: unknown): ConnectorErrorKind | undefined {\n  if (err === null || typeof err !== \"object\" || !(CONNECT_ERROR_KIND_PROPERTY in err)) {\n    return undefined;\n  }\n  const value = (err as Record<string, unknown>)[CONNECT_ERROR_KIND_PROPERTY];\n  return (CONNECTOR_ERROR_KINDS as readonly unknown[]).includes(value)\n    ? (value as ConnectorErrorKind)\n    : undefined;\n}\n\n/**\n * Stamp `kind` onto `err` unless it already declares one, and return it for\n * rethrowing. For throw sites that know what a failure means but throw an\n * error they did not construct (a failed `git` child, say).\n */\nexport function withConnectErrorKind<T>(err: T, kind: ConnectorErrorKind): T {\n  if (err !== null && typeof err === \"object\" && !(CONNECT_ERROR_KIND_PROPERTY in err)) {\n    try {\n      (err as Record<string, unknown>)[CONNECT_ERROR_KIND_PROPERTY] = kind;\n    } catch {\n      // Frozen or sealed: unclassified beats replacing the real error with a TypeError.\n    }\n  }\n  return err;\n}\n\n/**\n * An `Error` carrying an explicit {@link ConnectorErrorKind}, for throw sites\n * that build their own error.\n */\nexport class ClassifiedConnectError extends Error {\n  readonly [CONNECT_ERROR_KIND_PROPERTY]: ConnectorErrorKind;\n  constructor(message: string, kind: ConnectorErrorKind) {\n    super(message);\n    this.name = \"ClassifiedConnectError\";\n    this[CONNECT_ERROR_KIND_PROPERTY] = kind;\n  }\n}\n"]}
+{"version":3,"sources":["../connectors/src/connect-error-kind.ts"],"names":[],"mappings":";;;AAuBO,IAAM,2BAAA,GAA8B;AAYpC,SAAS,yBAAyB,GAAA,EAA8C;AACrF,EAAA,IAAI,QAAQ,IAAA,IAAQ,OAAO,QAAQ,QAAA,IAAY,EAAE,+BAA+B,GAAA,CAAA,EAAM;AACpF,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,KAAA,GAAS,IAAgC,2BAA2B,CAAA;AAC1E,EAAA,OAAQ,qBAAA,CAA6C,QAAA,CAAS,KAAK,CAAA,GAC9D,KAAA,GACD,MAAA;AACN;AAOO,SAAS,oBAAA,CAAwB,KAAQ,IAAA,EAA6B;AAC3E,EAAA,IAAI,QAAQ,IAAA,IAAQ,OAAO,QAAQ,QAAA,IAAY,EAAE,+BAA+B,GAAA,CAAA,EAAM;AACpF,IAAA,IAAI;AACF,MAAC,GAAA,CAAgC,2BAA2B,CAAA,GAAI,IAAA;AAAA,IAClE,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAMO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAChD,CAAU,2BAA2B;AAAA,EACrC,WAAA,CAAY,SAAiB,IAAA,EAA0B;AACrD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,2BAA2B,CAAA,GAAI,IAAA;AAAA,EACtC;AACF","file":"chunk-6GWSDPBP.js","sourcesContent":["/**\n * The driver-side contract for classifying a connect failure: how a thrower\n * says which {@link ConnectorErrorKind} its error is. Read by the manager's\n * `classifyConnectError` (`classify-connect-error.ts`) into the `errorKind`\n * field of `connector_status` error events.\n *\n * Depends on nothing but `types`, so the `connectors-shared` subpath can\n * re-export it to out-of-tree drivers.\n *\n * @docLink packages/connectors/concepts#connector-manager\n */\n\nimport { CONNECTOR_ERROR_KINDS, type ConnectorErrorKind } from \"@skaile/workspaces/types\";\n\n/**\n * The property a thrown error carries its kind on.\n *\n * Namespaced because it is read off any thrown object: a bare `errorKind` is\n * a name a library's own error may already use, and a value that happened to\n * read `\"config\"` would silently misroute the failure. A plain string key\n * rather than a symbol, so a driver with no import from this package can still\n * set it: `throw Object.assign(new Error(msg), { skaileConnectErrorKind: \"config\" })`.\n */\nexport const CONNECT_ERROR_KIND_PROPERTY = \"skaileConnectErrorKind\";\n\n/**\n * The shape of an error that declares its kind. For classes that must spell the\n * key out instead of computing it (see the git driver's `TokenMediatorError`):\n * `implements` keeps the literal tied to {@link CONNECT_ERROR_KIND_PROPERTY}.\n */\nexport type DeclaresConnectErrorKind = {\n  readonly [CONNECT_ERROR_KIND_PROPERTY]: ConnectorErrorKind;\n};\n\n/** The kind `err` declares for itself, or `undefined` when it declares none (or an unknown one). */\nexport function declaredConnectErrorKind(err: unknown): ConnectorErrorKind | undefined {\n  if (err === null || typeof err !== \"object\" || !(CONNECT_ERROR_KIND_PROPERTY in err)) {\n    return undefined;\n  }\n  const value = (err as Record<string, unknown>)[CONNECT_ERROR_KIND_PROPERTY];\n  return (CONNECTOR_ERROR_KINDS as readonly unknown[]).includes(value)\n    ? (value as ConnectorErrorKind)\n    : undefined;\n}\n\n/**\n * Stamp `kind` onto `err` unless it already declares one, and return it for\n * rethrowing. For throw sites that know what a failure means but throw an\n * error they did not construct (a failed `git` child, say).\n */\nexport function withConnectErrorKind<T>(err: T, kind: ConnectorErrorKind): T {\n  if (err !== null && typeof err === \"object\" && !(CONNECT_ERROR_KIND_PROPERTY in err)) {\n    try {\n      (err as Record<string, unknown>)[CONNECT_ERROR_KIND_PROPERTY] = kind;\n    } catch {\n      // Frozen or sealed: unclassified beats replacing the real error with a TypeError.\n    }\n  }\n  return err;\n}\n\n/**\n * An `Error` carrying an explicit {@link ConnectorErrorKind}, for throw sites\n * that build their own error.\n */\nexport class ClassifiedConnectError extends Error {\n  readonly [CONNECT_ERROR_KIND_PROPERTY]: ConnectorErrorKind;\n  constructor(message: string, kind: ConnectorErrorKind) {\n    super(message);\n    this.name = \"ClassifiedConnectError\";\n    this[CONNECT_ERROR_KIND_PROPERTY] = kind;\n  }\n}\n"]}

package/dist/{chunk-MKRWN7XP.js → chunk-7CV3HFWJ.js}

@@ -1,6 +1,6 @@
-import { getProviderPreset, resolvePresetBaseUrl, expandPreset, resolveProbeUrl, buildCredentialHeaders, presetBaseUrl } from './chunk-CQJH4G2K.js';
-import { modelIdSchemaForTarget } from './chunk-335ENCCS.js';
-import { resolveEntryBaseUrl, entryTransport, parseModelRef, registryEntries } from './chunk-MJHSLODD.js';
+import { getProviderPreset, resolvePresetBaseUrl, expandPreset, resolveProbeUrl, buildCredentialHeaders, presetBaseUrl } from './chunk-F2GOZMRA.js';
+import { modelIdSchemaForTarget } from './chunk-E572OHGY.js';
+import { resolveEntryBaseUrl, entryTransport, parseModelRef, registryEntries } from './chunk-LSI2IVFT.js';
 
 // bridge/src/models.ts
 function humanize(id) {
@@ -323,5 +323,5 @@ function resolveModelTier(tier, sessionModel, options = {}) {
 }
 
 export { ModelTierResolutionError, PROVIDER_MODEL_TIERS, STATIC_MODELS, fetchProviderModels, getModels, getStaticModels, modelIdTargetForEntry, resolveManifestModel, resolveModelCapabilities, resolveModelTier };
-//# sourceMappingURL=chunk-MKRWN7XP.js.map
-//# sourceMappingURL=chunk-MKRWN7XP.js.map
+//# sourceMappingURL=chunk-7CV3HFWJ.js.map
+//# sourceMappingURL=chunk-7CV3HFWJ.js.map

package/dist/chunk-7CV3HFWJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/models.ts"],"names":[],"mappings":";;;;;AAmDA,SAAS,SAAS,EAAA,EAAoB;AACpC,EAAA,OAAO,EAAA,CACJ,OAAA,CAAQ,4BAAA,EAA8B,EAAE,EACxC,OAAA,CAAQ,OAAA,EAAS,GAAG,CAAA,CACpB,QAAQ,OAAA,EAAS,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAC5C;AAMA,SAAS,kBAAkB,EAAA,EAAqB;AAC9C,EAAA,MAAM,IAAA,GAAO,gEAAA;AACb,EAAA,OAAO,CAAC,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA;AACtB;AAKA,IAAM,gBAAA,GAAgD;AAAA,EACpD,SAAA,EAAW,CAAC,IAAA,KAAS;AACnB,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,IAAA,IAAQ,EAAC;AAC9B,IAAA,OAAO,MAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAW,EAAE,EAAA,IAAM,CAAC,CAAA,CAAE,EAAA,CAAG,SAAS,OAAO,CAAC,CAAA,CAClD,GAAA,CAAI,CAAC,CAAA,MAAY;AAAA,MAChB,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,IAAA,EAAM,CAAA,CAAE,YAAA,IAAgB,QAAA,CAAS,EAAE,EAAE;AAAA,KACvC,CAAE,CAAA;AAAA,EACN,CAAA;AAAA,EACA,MAAA,EAAQ,CAAC,IAAA,KAAS;AAChB,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,IAAA,IAAQ,EAAC;AAC9B,IAAA,OAAO,MAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAW,EAAE,EAAA,IAAM,iBAAA,CAAkB,CAAA,CAAE,EAAE,CAAC,CAAA,CAClD,GAAA,CAAI,CAAC,CAAA,MAAY,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAI,IAAA,EAAM,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,CAAA,CACpD,IAAA,CAAK,CAAC,CAAA,EAAe,MAAkB,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAAA,EACpE,CAAA;AAAA,EACA,UAAA,EAAY,CAAC,IAAA,KAAS;AACpB,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,IAAA,IAAQ,EAAC;AAC9B,IAAA,OAAO,MAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAW,EAAE,EAAE,CAAA,CACvB,GAAA,CAAI,CAAC,CAAA,MAAY,EAAE,EAAA,EAAI,CAAA,CAAE,IAAI,IAAA,EAAM,CAAA,CAAE,IAAA,IAAQ,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,EAAE,CAAE,EAC9D,IAAA,CAAK,CAAC,CAAA,EAAe,CAAA,KAAkB,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAAA,EACpE,CAAA;AAAA,EACA,OAAA,EAAS,CAAC,IAAA,KAAS;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,IAAA,IAAQ,EAAC;AAC9B,IAAA,OAAO,MAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAW,EAAE,EAAA,IAAM,iBAAA,CAAkB,CAAA,CAAE,EAAE,CAAC,CAAA,CAClD,GAAA,CAAI,CAAC,CAAA,MAAY,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAI,IAAA,EAAM,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,CAAA,CACpD,IAAA,CAAK,CAAC,CAAA,EAAe,MAAkB,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAAA,EACpE,CAAA;AAAA,EACA,IAAA,EAAM,CAAC,IAAA,KAAS;AACd,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,IAAA,IAAQ,EAAC;AAC9B,IAAA,OAAO,MAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAW,EAAE,EAAA,IAAM,iBAAA,CAAkB,CAAA,CAAE,EAAE,CAAC,CAAA,CAClD,GAAA,CAAI,CAAC,CAAA,MAAY,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAI,IAAA,EAAM,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,CAAA,CACpD,IAAA,CAAK,CAAC,CAAA,EAAe,MAAkB,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAAA,EACpE,CAAA;AAAA,EACA,QAAA,EAAU,CAAC,IAAA,KAAS;AAClB,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,IAAA,IAAQ,EAAC;AAC9B,IAAA,OAAO,MAAA,CACJ,GAAA,CAAI,CAAC,CAAA,MAAY,EAAE,IAAI,CAAA,CAAE,EAAA,EAAI,IAAA,EAAM,QAAA,CAAS,CAAA,CAAE,EAAE,GAAE,CAAE,CAAA,CACpD,IAAA,CAAK,CAAC,CAAA,EAAe,CAAA,KAAkB,EAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAAA,EACpE,CAAA;AAAA,EACA,GAAA,EAAK,CAAC,IAAA,KAAS;AACb,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,IAAA,IAAQ,EAAC;AAC9B,IAAA,OAAO,MAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAW,EAAE,EAAA,IAAM,iBAAA,CAAkB,CAAA,CAAE,EAAE,CAAC,CAAA,CAClD,GAAA,CAAI,CAAC,CAAA,MAAY,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAI,IAAA,EAAM,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,CAAA,CACpD,IAAA,CAAK,CAAC,CAAA,EAAe,MAAkB,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAAA,EACpE,CAAA;AAAA,EACA,QAAA,EAAU,CAAC,IAAA,KAAS;AAClB,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,IAAA,IAAQ,IAAA,IAAQ,EAAC;AACtC,IAAA,MAAM,MAAM,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,SAAS,EAAC;AAC9C,IAAA,OAAO,GAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAW,EAAE,EAAA,IAAM,CAAA,CAAE,IAAA,KAAS,MAAM,EAC5C,GAAA,CAAI,CAAC,CAAA,MAAY,EAAE,IAAI,CAAA,CAAE,EAAA,EAAI,IAAA,EAAM,CAAA,CAAE,gBAAgB,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,CAAA,CACtE,IAAA,CAAK,CAAC,CAAA,EAAe,MAAkB,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAAA,EACpE,CAAA;AAAA,EACA,SAAA,EAAW,CAAC,IAAA,KAAS;AACnB,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,IAAA,IAAQ,EAAC;AAC9B,IAAA,OAAO,MAAA,CACJ,GAAA,CAAI,CAAC,CAAA,MAAY,EAAE,IAAI,CAAA,CAAE,EAAA,EAAI,IAAA,EAAM,QAAA,CAAS,CAAA,CAAE,EAAE,GAAE,CAAE,CAAA,CACpD,IAAA,CAAK,CAAC,CAAA,EAAe,CAAA,KAAkB,EAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAAA,EACpE,CAAA;AAAA,EACA,MAAA,EAAQ,CAAC,IAAA,KAAS;AAChB,IAAA,MAAM,MAAA,GAAS,IAAA,EAAM,MAAA,IAAU,EAAC;AAChC,IAAA,OAAO,MAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAW,CAAA,CAAE,0BAAA,EAA4B,QAAA,CAAS,iBAAiB,CAAC,CAAA,CAC5E,GAAA,CAAI,CAAC,CAAA,MAAY;AAAA,MAChB,KAAK,CAAA,CAAE,IAAA,IAAQ,EAAA,EAAI,OAAA,CAAQ,aAAa,EAAE,CAAA;AAAA,MAC1C,MAAM,CAAA,CAAE,WAAA,IAAe,QAAA,CAAS,CAAA,CAAE,QAAQ,EAAE;AAAA,KAC9C,CAAE,CAAA,CACD,IAAA,CAAK,CAAC,CAAA,EAAe,CAAA,KAAkB,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAAA,EACpE;AACF,CAAA;AAiEA,eAAsB,mBAAA,CACpB,QAAA,EACA,MAAA,EACA,OAAA,GAA8B,EAAC,EACH;AAC5B,EAAA,MAAM,MAAA,GAAS,kBAAkB,QAAQ,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,iBAAiB,QAAQ,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,KAAA,EAAO;AACrB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,QAAQ,EAAC;AAAA,MACT,KAAA,EAAO,+BAA+B,QAAQ,CAAA,CAAA;AAAA,MAC9C,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,qBAAqB,MAAA,EAAQ;AAAA,IAC3C,GAAI,QAAQ,OAAA,GAAU,EAAE,SAAS,OAAA,CAAQ,OAAA,KAAY,EAAC;AAAA,IACtD,GAAA,EAAK,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ;AAAA,GAC7B,CAAA;AACD,EAAA,MAAM,KAAA,GAAQ,aAAa,MAAA,EAAQ,OAAA,GAAU,EAAE,OAAA,EAAQ,GAAI,EAAE,CAAA;AAC7D,EAAA,MAAM,GAAA,GAAM,gBAAgB,KAAK,CAAA;AACjC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,QAAQ,EAAC;AAAA,MACT,KAAA,EAAO,YAAY,QAAQ,CAAA,2BAAA,CAAA;AAAA,MAC3B,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAGA,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,KAAA,CAAM,SAAS,GAAG,sBAAA,CAAuB,KAAA,EAAO,MAAM,CAAA,EAAE;AAE7E,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,UAAU,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,GAAM,CAAA;AAE3D,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA;AAAA,MACA,QAAQ,UAAA,CAAW;AAAA,KACpB,CAAA;AAED,IAAA,YAAA,CAAa,OAAO,CAAA;AAEpB,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,QAAQ,EAAC;AAAA,QACT,KAAA,EAAO,CAAA,kBAAA,EAAqB,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,QAC3C,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAI,CAAA;AAEzB,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,QAAQ,KAAA,EAAM;AAAA,EAC3C,SAAS,GAAA,EAAU;AACjB,IAAA,MAAM,MACJ,GAAA,CAAI,IAAA,KAAS,YAAA,GAAe,yBAAA,GAA6B,IAAI,OAAA,IAAW,eAAA;AAC1E,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,EAAC,EAAG,KAAA,EAAO,GAAA,EAAK,MAAA,EAAQ,QAAA,EAAS;AAAA,EAC/D;AACF;AAeA,eAAsB,SAAA,CACpB,QAAA,EACA,MAAA,EACA,OAAA,GAA8B,EAAC,EACH;AAC5B,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,MAAA,GAAS,gBAAgB,QAAQ,CAAA;AACvC,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,QAAQ,QAAA,EAAS;AAAA,EAC9C;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,mBAAA,CAAoB,QAAA,EAAU,QAAQ,OAAO,CAAA;AAClE,EAAA,IAAI,MAAA,CAAO,EAAA,IAAM,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,YAAA,GAAe,gBAAgB,QAAQ,CAAA;AAC7C,EAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAI,IAAA,EAAM,MAAA,EAAQ,cAAc,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAO,MAAA,CAAO,KAAA,EAAM;AAAA,EACjF;AAEA,EAAA,OAAO,MAAA;AACT;AAgBO,IAAM,aAAA,GAA8C;AAAA,EACzD,SAAA,EAAW;AAAA,IACT,EAAE,EAAA,EAAI,iBAAA,EAAmB,IAAA,EAAM,iBAAA,EAAkB;AAAA,IACjD,EAAE,EAAA,EAAI,mBAAA,EAAqB,IAAA,EAAM,mBAAA,EAAoB;AAAA,IACrD,EAAE,EAAA,EAAI,2BAAA,EAA6B,IAAA,EAAM,kBAAA,EAAmB;AAAA,IAC5D,EAAE,EAAA,EAAI,iBAAA,EAAmB,IAAA,EAAM,iBAAA,EAAkB;AAAA,IACjD,EAAE,EAAA,EAAI,mBAAA,EAAqB,IAAA,EAAM,mBAAA;AAAoB,GACvD;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,EAAE,EAAA,EAAI,QAAA,EAAU,IAAA,EAAM,QAAA,EAAS;AAAA,IAC/B,EAAE,EAAA,EAAI,aAAA,EAAe,IAAA,EAAM,aAAA,EAAc;AAAA,IACzC,EAAE,EAAA,EAAI,SAAA,EAAW,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,EAAE,EAAA,EAAI,cAAA,EAAgB,IAAA,EAAM,cAAA,EAAe;AAAA,IAC3C,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,IAAA,EAAK;AAAA,IACvB,EAAE,EAAA,EAAI,SAAA,EAAW,IAAA,EAAM,SAAA;AAAU,GACnC;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,EAAE,EAAA,EAAI,gBAAA,EAAkB,IAAA,EAAM,gBAAA,EAAiB;AAAA,IAC/C,EAAE,EAAA,EAAI,kBAAA,EAAoB,IAAA,EAAM,kBAAA,EAAmB;AAAA,IACnD,EAAE,EAAA,EAAI,kBAAA,EAAoB,IAAA,EAAM,kBAAA;AAAmB,GACrD;AAAA,EACA,OAAA,EAAS;AAAA,IACP,EAAE,EAAA,EAAI,sBAAA,EAAwB,IAAA,EAAM,eAAA,EAAgB;AAAA,IACpD,EAAE,EAAA,EAAI,sBAAA,EAAwB,IAAA,EAAM,eAAA,EAAgB;AAAA,IACpD,EAAE,EAAA,EAAI,kBAAA,EAAoB,IAAA,EAAM,WAAA;AAAY,GAC9C;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,EAAE,EAAA,EAAI,yBAAA,EAA2B,IAAA,EAAM,eAAA,EAAgB;AAAA,IACvD,EAAE,EAAA,EAAI,sBAAA,EAAwB,IAAA,EAAM,cAAA,EAAe;AAAA,IACnD,EAAE,EAAA,EAAI,oBAAA,EAAsB,IAAA,EAAM,cAAA;AAAe,GACnD;AAAA,EACA,QAAA,EAAU;AAAA,IACR,EAAE,EAAA,EAAI,eAAA,EAAiB,IAAA,EAAM,eAAA,EAAgB;AAAA,IAC7C,EAAE,EAAA,EAAI,mBAAA,EAAqB,IAAA,EAAM,mBAAA;AAAoB,GACvD;AAAA,EACA,GAAA,EAAK;AAAA,IACH,EAAE,EAAA,EAAI,QAAA,EAAU,IAAA,EAAM,QAAA,EAAS;AAAA,IAC/B,EAAE,EAAA,EAAI,aAAA,EAAe,IAAA,EAAM,aAAA;AAAc,GAC3C;AAAA,EACA,QAAA,EAAU;AAAA,IACR,EAAE,EAAA,EAAI,yCAAA,EAA2C,IAAA,EAAM,qBAAA,EAAsB;AAAA,IAC7E,EAAE,EAAA,EAAI,sCAAA,EAAwC,IAAA,EAAM,cAAA;AAAe,GACrE;AAAA,EACA,SAAA,EAAW;AAAA,IACT,EAAE,EAAA,EAAI,mDAAA,EAAqD,IAAA,EAAM,eAAA,EAAgB;AAAA,IACjF,EAAE,EAAA,EAAI,uCAAA,EAAyC,IAAA,EAAM,aAAA;AAAc,GACrE;AAAA,EACA,UAAA,EAAY;AAAA,IACV,EAAE,EAAA,EAAI,6BAAA,EAA+B,IAAA,EAAM,mBAAA,EAAoB;AAAA,IAC/D,EAAE,EAAA,EAAI,2BAAA,EAA6B,IAAA,EAAM,iBAAA,EAAkB;AAAA,IAC3D,EAAE,EAAA,EAAI,4BAAA,EAA8B,IAAA,EAAM,kBAAA,EAAmB;AAAA,IAC7D,EAAE,EAAA,EAAI,6BAAA,EAA+B,IAAA,EAAM,mBAAA,EAAoB;AAAA,IAC/D,EAAE,EAAA,EAAI,6BAAA,EAA+B,IAAA,EAAM,mBAAA,EAAoB;AAAA,IAC/D,EAAE,EAAA,EAAI,eAAA,EAAiB,IAAA,EAAM,QAAA,EAAS;AAAA,IACtC,EAAE,EAAA,EAAI,gBAAA,EAAkB,IAAA,EAAM,SAAA,EAAU;AAAA,IACxC,EAAE,EAAA,EAAI,qBAAA,EAAuB,IAAA,EAAM,cAAA,EAAe;AAAA,IAClD,EAAE,EAAA,EAAI,uBAAA,EAAyB,IAAA,EAAM,gBAAA,EAAiB;AAAA,IACtD,EAAE,EAAA,EAAI,yBAAA,EAA2B,IAAA,EAAM,kBAAA,EAAmB;AAAA,IAC1D,EAAE,EAAA,EAAI,6BAAA,EAA+B,IAAA,EAAM,kBAAA,EAAmB;AAAA,IAC9D,EAAE,EAAA,EAAI,mCAAA,EAAqC,IAAA,EAAM,eAAA,EAAgB;AAAA,IACjE,EAAE,EAAA,EAAI,gCAAA,EAAkC,IAAA,EAAM,aAAA,EAAc;AAAA,IAC5D,EAAE,EAAA,EAAI,sBAAA,EAAwB,IAAA,EAAM,aAAA,EAAc;AAAA,IAClD,EAAE,EAAA,EAAI,8BAAA,EAAgC,IAAA,EAAM,iBAAA;AAAkB;AAElE;AAYO,SAAS,gBAAgB,QAAA,EAAgC;AAC9D,EAAA,OAAO,aAAA,CAAc,QAAQ,CAAA,IAAK,EAAC;AACrC;AA2BA,SAAS,QAAA,CAAS,UAAgC,EAAA,EAA4C;AAC5F,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,QAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,CAAC,OAAO,CAAA,KAAM,OAAA,KAAY,EAAE,CAAA,GAAI,CAAC,CAAA;AAC/E,EAAA,IAAI,CAAC,SAAU,KAAA,CAAM,IAAA,KAAS,SAAS,KAAA,CAAM,IAAA,KAAS,SAAU,OAAO,MAAA;AACvE,EAAA,OAAO,KAAA;AACT;AAWO,SAAS,sBAAsB,KAAA,EAA0C;AAC9E,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,CAAA,GAAI,MAAA;AAChE,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,IAAW,MAAA,EAAQ,OAAA;AACzC,EAAA,MAAM,WAAW,mBAAA,CAAoB,KAAK,MAAM,MAAA,GAAS,aAAA,CAAc,MAAM,CAAA,GAAI,MAAA,CAAA;AACjF,EAAA,OAAO;AAAA,IACL,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,IAC7B,GAAI,cAAA,CAAe,KAAK,CAAA,GAAI,EAAE,WAAW,cAAA,CAAe,KAAK,CAAA,EAAE,GAAI,EAAC;AAAA,IACpE,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa;AAAC,GACjC;AACF;AAqCO,SAAS,oBAAA,CACd,UAAA,EACA,OAAA,GAAgC,EAAC,EACE;AACnC,EAAA,IAAI,CAAC,UAAA,IAAc,CAAC,OAAA,CAAQ,UAAU,OAAO,MAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc,UAAA,EAAY,OAAA,CAAQ,QAAA,EAAU,QAAQ,KAAK,CAAA;AACrE,EAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AAEjB,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,OAAA,CAAQ,QAAA,EAAU,IAAI,UAAU,CAAA;AACvD,EAAA,MAAM,MAAA,GAAS,KAAA,GAAQ,qBAAA,CAAsB,KAAK,IAAI,EAAC;AACvD,EAAA,MAAM,QAAA,GAAkC;AAAA,IACtC,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,GAAI,IAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAQ,GAAI,EAAC;AAAA,IAC5D,GAAI,IAAI,eAAA,KAAoB,MAAA,GAAY,EAAE,eAAA,EAAiB,GAAA,CAAI,eAAA,EAAgB,GAAI,EAAC;AAAA,IACpF,GAAI,IAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAK,GAAI,EAAC;AAAA,IACnD,MAAA;AAAA,IACA,QAAA,EAAU,CAAC,GAAG,GAAA,CAAI,QAAQ;AAAA,GAC5B;AACA,EAAA,IAAI,GAAA,CAAI,eAAA,KAAoB,MAAA,EAAW,OAAO,QAAA;AAE9C,EAAA,MAAM,QAAQ,sBAAA,CAAuB,MAAM,CAAA,CAAE,SAAA,CAAU,IAAI,eAAe,CAAA;AAC1E,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,QAAA,CAAS,KAAA,GACP,CAAA,OAAA,EAAU,GAAA,CAAI,eAAe,CAAA,6BAAA,EAAgC,GAAA,CAAI,UAAU,CAAA,WAAA,EAC/D,MAAA,CAAO,OAAA,IAAW,SAAS,CAAA,YAAA,EAAe,MAAA,CAAO,SAAA,IAAa,QAAQ,CAAA,EAC/E,MAAA,CAAO,QAAA,GAAW,CAAA,EAAA,EAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,GAAK,EAAE,CAAA,GAAA,CAAA,IAC/C,KAAA,CAAM,KAAA,CAAM,MAAA,CAAO,CAAC,GAAG,OAAA,IAAW,kBAAA,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,QAAA;AACT;AAcO,SAAS,wBAAA,CACd,QAAA,EACA,OAAA,GAGI,EAAC,EAC+B;AACpC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,GAAA,GAAM,QAAQ,QAAA,GAChB,aAAA,CAAc,UAAU,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,KAAK,CAAA,GACvD,MAAA;AACJ,EAAA,MAAM,KAAA,GAAQ,OAAO,OAAA,CAAQ,QAAA,GAAW,SAAS,OAAA,CAAQ,QAAA,EAAU,GAAA,CAAI,UAAU,CAAA,GAAI,MAAA;AACrF,EAAA,MAAM,MAAM,CAAC,GAAA,EAAK,SAAS,GAAA,EAAK,eAAA,EAAiB,QAAQ,CAAA,CAAE,MAAA;AAAA,IACzD,CAAC,OAAqB,EAAA,KAAO;AAAA,GAC/B;AACA,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,GAAA,CAAI,CAAC,OAAO,KAAA,EAAO,YAAA,GAAe,EAAE,CAAC,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,SAAS,MAAS,CAAA;AAC9F,EAAA,MAAM,YAAA,GAAe,GAAA,CAAI,GAAA,CAAI,CAAC,OAAO,OAAA,CAAQ,QAAA,GAAW,EAAE,CAAC,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,SAAS,MAAS,CAAA;AAE9F,EAAA,MAAM,cAAA,GAAiB,SAAA,EAAW,cAAA,IAAkB,YAAA,EAAc,cAAA;AAClE,EAAA,MAAM,YAAA,GAAe,SAAA,EAAW,YAAA,IAAgB,YAAA,EAAc,YAAA;AAC9D,EAAA,MAAM,KAAA,GAAQ,SAAA,EAAW,KAAA,IAAS,YAAA,EAAc,KAAA;AAChD,EAAA,MAAM,MAAA,GAAS,SAAA,EAAW,MAAA,IAAU,YAAA,EAAc,MAAA;AAClD,EAAA,IACE,mBAAmB,MAAA,IACnB,YAAA,KAAiB,UACjB,KAAA,KAAU,MAAA,IACV,WAAW,MAAA,EACX;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,GAAI,cAAA,KAAmB,MAAA,GAAY,EAAE,cAAA,KAAmB,EAAC;AAAA,IACzD,GAAI,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,KAAiB,EAAC;AAAA,IACrD,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,GAAI,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,KAAW;AAAC,GAC3C;AACF;AA4CO,IAAM,oBAAA,GAAqE;AAAA,EAChF,SAAA,EAAW;AAAA,IACT,KAAA,EAAO,2BAAA;AAAA,IACP,OAAA,EAAS,mBAAA;AAAA,IACT,IAAA,EAAM;AAAA,GACR;AAAA,EACA,QAAQ,EAAE,KAAA,EAAO,eAAe,OAAA,EAAS,SAAA,EAAW,MAAM,IAAA,EAAK;AAAA,EAC/D,QAAQ,EAAE,KAAA,EAAO,oBAAoB,OAAA,EAAS,kBAAA,EAAoB,MAAM,gBAAA,EAAiB;AAAA,EACzF,OAAA,EAAS;AAAA,IACP,KAAA,EAAO,sBAAA;AAAA,IACP,OAAA,EAAS,sBAAA;AAAA,IACT,IAAA,EAAM;AAAA,GACR;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,KAAA,EAAO,sBAAA;AAAA,IACP,OAAA,EAAS,yBAAA;AAAA,IACT,IAAA,EAAM;AAAA,GACR;AAAA,EACA,UAAU,EAAE,KAAA,EAAO,iBAAiB,OAAA,EAAS,eAAA,EAAiB,MAAM,mBAAA,EAAoB;AAAA,EACxF,KAAK,EAAE,KAAA,EAAO,eAAe,OAAA,EAAS,QAAA,EAAU,MAAM,QAAA,EAAS;AAAA,EAC/D,QAAA,EAAU;AAAA,IACR,KAAA,EAAO,sCAAA;AAAA,IACP,OAAA,EAAS,yCAAA;AAAA,IACT,IAAA,EAAM;AAAA,GACR;AAAA,EACA,SAAA,EAAW;AAAA,IACT,KAAA,EAAO,mDAAA;AAAA,IACP,OAAA,EAAS,mDAAA;AAAA,IACT,IAAA,EAAM;AAAA,GACR;AAAA,EACA,UAAA,EAAY;AAAA,IACV,KAAA,EAAO,4BAAA;AAAA,IACP,OAAA,EAAS,6BAAA;AAAA,IACT,IAAA,EAAM;AAAA;AAEV;AAGO,IAAM,wBAAA,GAAN,cAAuC,KAAA,CAAM;AAAA,EAClD,WAAA,CACW,MACA,QAAA,EACT;AACA,IAAA,KAAA;AAAA,MACE,8BAA8B,IAAI,CAAA,gBAAA,EAAmB,QAAA,IAAY,QAAQ,mEACvD,IAAI,CAAA,wGAAA;AAAA,KACxB;AANS,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAMT,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AAAA,EACd;AAAA,EARW,IAAA;AAAA,EACA,QAAA;AAQb;AAWA,SAAS,0BAAA,CACP,MACA,OAAA,EACoB;AACpB,EAAA,MAAM,EAAE,QAAA,EAAU,KAAA,EAAO,UAAA,EAAW,GAAI,OAAA;AACxC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,IAAI,KAAA,GAAQ,IAAI,CAAA,KAAM,MAAA,EAAW;AAC/B,IAAA,MAAM,UAAU,aAAA,CAAc,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,UAAU,KAAK,CAAA;AACzD,IAAA,IAAI,OAAA,EAAS,eAAA,EAAiB,OAAO,OAAA,CAAQ,eAAA;AAAA,EAC/C;AACA,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,UAAA,GAAa,CAAA,EAAG,UAAU,IAAI,IAAI,CAAA,CAAA,GAAK,IAAA,EAAM,QAAA,EAAU,KAAK,CAAA;AACtF,EAAA,IAAI,CAAC,GAAA,EAAK,OAAA,EAAS,OAAO,MAAA;AAC1B,EAAA,OAAO,SAAS,QAAA,EAAU,GAAA,CAAI,UAAU,CAAA,EAAG,SAAA,GAAY,IAAI,OAAO,CAAA;AACpE;AAkCO,SAAS,gBAAA,CACd,IAAA,EACA,YAAA,EACA,OAAA,GAAmC,EAAC,EAChB;AAGpB,EAAA,MAAM,SAAA,GAAY,CAAC,OAAA,CAAQ,KAAA,IAAS,QAAQ,KAAA,KAAU,SAAA;AACtD,EAAA,MAAM,OAAA,GACJ,CAAC,OAAA,CAAQ,QAAA,IAAY,SAAA,IAAa,QAAQ,QAAA,GACtC,oBAAA,CAAqB,OAAA,CAAQ,QAAQ,CAAA,GACrC,MAAA;AACN,EAAA,IAAI,IAAA,KAAS,OAAA,IAAW,IAAA,KAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,QAAA,GACJ,OAAA,CAAQ,SAAA,GAAY,IAAI,CAAA,IAAK,2BAA2B,IAAA,EAAM,OAAO,CAAA,IAAK,OAAA,GAAU,IAAI,CAAA;AAC1F,IAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,wBAAA,CAAyB,IAAA,EAAM,QAAQ,QAAQ,CAAA;AACxE,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OACE,OAAA,CAAQ,WAAW,OAAA,IACnB,YAAA,IACA,2BAA2B,SAAA,EAAW,OAAO,KAC7C,OAAA,EAAS,OAAA;AAEb","file":"chunk-7CV3HFWJ.js","sourcesContent":["/**\n * Model catalog — static fallback + live provider API fetching.\n *\n * Provides `fetchProviderModels(provider, apiKey)` for live model lists and\n * `getStaticModels(provider)` as an offline fallback.\n * OMP model listing is handled by `OmpHarness.listModels()` in the bridge harness.\n */\n\nimport {\n  type AIProviderCapabilities,\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  entryTransport,\n  type MergedAIProviderRegistry,\n  parseModelRef,\n  registryEntries,\n  resolveEntryBaseUrl,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport { type ModelIdTarget, modelIdSchemaForTarget } from \"@skaile/workspaces/types/manifests\";\nimport {\n  buildCredentialHeaders,\n  expandPreset,\n  getProviderPreset,\n  presetBaseUrl,\n  resolvePresetBaseUrl,\n  resolveProbeUrl,\n} from \"./provider-catalog.js\";\n\n/**\n * A single LLM model entry returned by the model catalog.\n *\n * Used by `getModels`, `getStaticModels`, and `fetchProviderModels` to represent\n * an available model for a provider.\n *\n * @docLink packages/bridge/api-reference#models\n */\nexport interface ModelEntry {\n  /** Provider-specific model identifier used in API calls (e.g. `\"claude-sonnet-4-5\"`). */\n  id: string;\n  /** Human-readable display name for UIs and logs (e.g. `\"Claude Sonnet 4.5\"`). */\n  name: string;\n}\n\n// ---------------------------------------------------------------------------\n// Provider API configs (for fetching model lists)\n// ---------------------------------------------------------------------------\n\n/** Extract ModelEntry[] from a provider's parsed models-list JSON response. */\ntype ParseModels = (body: any) => ModelEntry[];\n\n/** Humanize a model ID into a display name (e.g. \"claude-sonnet-4-6\" → \"Claude Sonnet 4 6\") */\nfunction humanize(id: string): string {\n  return id\n    .replace(/^accounts\\/[^/]+\\/models\\//, \"\")\n    .replace(/[-_]/g, \" \")\n    .replace(/\\b\\w/g, (c) => c.toUpperCase());\n}\n\n/**\n * Filter function used by providers that return the OpenAI-style /v1/models list.\n * Keeps only chat/completion models, skips embeddings, moderation, tts, whisper, dall-e, etc.\n */\nfunction isLikelyChatModel(id: string): boolean {\n  const skip = /embed|moderat|tts|whisper|dall-e|davinci|babbage|ada-00|text-/i;\n  return !skip.test(id);\n}\n\n// Per-provider response parsers. The endpoint URL and the credential header\n// come from the catalog preset (provider-catalog.ts), joined in\n// fetchProviderModels.\nconst PROVIDER_PARSERS: Record<string, ParseModels> = {\n  anthropic: (body) => {\n    const models = body?.data ?? [];\n    return models\n      .filter((m: any) => m.id && !m.id.includes(\"embed\"))\n      .map((m: any) => ({\n        id: m.id,\n        name: m.display_name ?? humanize(m.id),\n      }));\n  },\n  openai: (body) => {\n    const models = body?.data ?? [];\n    return models\n      .filter((m: any) => m.id && isLikelyChatModel(m.id))\n      .map((m: any) => ({ id: m.id, name: humanize(m.id) }))\n      .sort((a: ModelEntry, b: ModelEntry) => a.id.localeCompare(b.id));\n  },\n  openrouter: (body) => {\n    const models = body?.data ?? [];\n    return models\n      .filter((m: any) => m.id)\n      .map((m: any) => ({ id: m.id, name: m.name ?? humanize(m.id) }))\n      .sort((a: ModelEntry, b: ModelEntry) => a.id.localeCompare(b.id));\n  },\n  mistral: (body) => {\n    const models = body?.data ?? [];\n    return models\n      .filter((m: any) => m.id && isLikelyChatModel(m.id))\n      .map((m: any) => ({ id: m.id, name: humanize(m.id) }))\n      .sort((a: ModelEntry, b: ModelEntry) => a.id.localeCompare(b.id));\n  },\n  groq: (body) => {\n    const models = body?.data ?? [];\n    return models\n      .filter((m: any) => m.id && isLikelyChatModel(m.id))\n      .map((m: any) => ({ id: m.id, name: humanize(m.id) }))\n      .sort((a: ModelEntry, b: ModelEntry) => a.id.localeCompare(b.id));\n  },\n  deepseek: (body) => {\n    const models = body?.data ?? [];\n    return models\n      .map((m: any) => ({ id: m.id, name: humanize(m.id) }))\n      .sort((a: ModelEntry, b: ModelEntry) => a.id.localeCompare(b.id));\n  },\n  xai: (body) => {\n    const models = body?.data ?? [];\n    return models\n      .filter((m: any) => m.id && isLikelyChatModel(m.id))\n      .map((m: any) => ({ id: m.id, name: humanize(m.id) }))\n      .sort((a: ModelEntry, b: ModelEntry) => a.id.localeCompare(b.id));\n  },\n  together: (body) => {\n    const models = body?.data ?? body ?? [];\n    const arr = Array.isArray(models) ? models : [];\n    return arr\n      .filter((m: any) => m.id && m.type === \"chat\")\n      .map((m: any) => ({ id: m.id, name: m.display_name ?? humanize(m.id) }))\n      .sort((a: ModelEntry, b: ModelEntry) => a.id.localeCompare(b.id));\n  },\n  fireworks: (body) => {\n    const models = body?.data ?? [];\n    return models\n      .map((m: any) => ({ id: m.id, name: humanize(m.id) }))\n      .sort((a: ModelEntry, b: ModelEntry) => a.id.localeCompare(b.id));\n  },\n  google: (body) => {\n    const models = body?.models ?? [];\n    return models\n      .filter((m: any) => m.supportedGenerationMethods?.includes(\"generateContent\"))\n      .map((m: any) => ({\n        id: (m.name ?? \"\").replace(/^models\\//, \"\"),\n        name: m.displayName ?? humanize(m.name ?? \"\"),\n      }))\n      .sort((a: ModelEntry, b: ModelEntry) => a.id.localeCompare(b.id));\n  },\n};\n\n// ---------------------------------------------------------------------------\n// Live fetch\n// ---------------------------------------------------------------------------\n\n/**\n * Result of a model-list fetch operation, with source attribution.\n *\n * Returned by {@link fetchProviderModels} and {@link getModels}. When `ok` is `false`,\n * `models` is empty and `error` describes the failure. The `source` field indicates\n * whether the list came from a live API call or the offline static catalog.\n *\n * @docLink packages/bridge/api-reference#models\n */\nexport interface FetchModelsResult {\n  /** `true` when the fetch succeeded and `models` is populated. */\n  ok: boolean;\n  /** Fetched model list; empty on failure. */\n  models: ModelEntry[];\n  /** Human-readable error description when `ok` is `false`. */\n  error?: string;\n  /** Whether the result came from a live API call or the static fallback. */\n  source: \"api\" | \"static\";\n}\n\n/**\n * Options controlling where a model-list fetch is addressed.\n *\n * @since 1.5.0\n */\nexport interface FetchModelsOptions {\n  /**\n   * Base URL to resolve the provider's models endpoint against — e.g. the\n   * gateway a session already routes completions through. Overrides the\n   * provider's `baseUrlEnv` value.\n   */\n  baseUrl?: string;\n  /**\n   * Environment consulted for the provider's base-URL env var\n   * (`ANTHROPIC_BASE_URL` for `anthropic`). Defaults to `process.env`; pass an\n   * explicit record to keep a call hermetic.\n   */\n  env?: Record<string, string | undefined>;\n}\n\n/**\n * Fetch the model list from a provider's REST API.\n *\n * Returns `{ ok: true, models, source: 'api' }` on success, or\n * `{ ok: false, models: [], error }` on any HTTP or network failure — the\n * caller should fall back to {@link getStaticModels} in that case.\n *\n * The endpoint, the credential header and the response path all come from the\n * catalog preset named by `provider` ({@link resolvePresetBaseUrl},\n * {@link resolveProbeUrl}, {@link buildCredentialHeaders}), so discovery hits\n * the same host dispatch does — including a gateway named by `baseUrl` or by\n * the vendor's own `*_BASE_URL` variable.\n *\n * @param provider - Catalog preset id (e.g. `\"anthropic\"`, `\"openai\"`, `\"google\"`).\n * @param apiKey - API key presented in the preset's credential header.\n * @param options - Optional base-URL / environment overrides.\n * @returns Resolved model list with source attribution.\n * @docLink packages/bridge/api-reference#models\n */\nexport async function fetchProviderModels(\n  provider: string,\n  apiKey: string,\n  options: FetchModelsOptions = {},\n): Promise<FetchModelsResult> {\n  const preset = getProviderPreset(provider);\n  const parse = PROVIDER_PARSERS[provider];\n  if (!preset || !parse) {\n    return {\n      ok: false,\n      models: [],\n      error: `No API config for provider: ${provider}`,\n      source: \"static\",\n    };\n  }\n\n  const baseUrl = resolvePresetBaseUrl(preset, {\n    ...(options.baseUrl ? { baseUrl: options.baseUrl } : {}),\n    env: options.env ?? process.env,\n  });\n  const entry = expandPreset(preset, baseUrl ? { baseUrl } : {});\n  const url = resolveProbeUrl(entry);\n  if (!url) {\n    return {\n      ok: false,\n      models: [],\n      error: `Provider ${provider} exposes no models endpoint`,\n      source: \"static\",\n    };\n  }\n  // Static non-secret headers (Anthropic's `anthropic-version`) plus the\n  // credential carrier the preset's `auth_header` names.\n  const headers = { ...entry.headers, ...buildCredentialHeaders(entry, apiKey) };\n\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), 10_000);\n\n    const response = await fetch(url, {\n      method: \"GET\",\n      headers,\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeout);\n\n    if (!response.ok) {\n      return {\n        ok: false,\n        models: [],\n        error: `API returned HTTP ${response.status}`,\n        source: \"static\",\n      };\n    }\n\n    const body = await response.json();\n    const models = parse(body);\n\n    return { ok: true, models, source: \"api\" };\n  } catch (err: any) {\n    const msg =\n      err.name === \"AbortError\" ? \"Request timed out (10s)\" : (err.message ?? \"Network error\");\n    return { ok: false, models: [], error: msg, source: \"static\" };\n  }\n}\n\n/**\n * Get models for a provider, trying the live API first and falling back to the static catalog.\n *\n * When no `apiKey` is provided the static catalog is returned immediately without\n * a network call. When the live API fails or returns an empty list, the static\n * catalog is used as a fallback — the result's `source` field indicates which was used.\n *\n * @param provider - Provider name (e.g. `\"anthropic\"`, `\"openai\"`, `\"google\"`).\n * @param apiKey - Optional API key; omit to skip the live fetch and use the static catalog.\n * @param options - Optional base-URL / environment overrides (see {@link FetchModelsOptions}).\n * @returns Resolved model list with source attribution.\n * @docLink packages/bridge/api-reference#models\n */\nexport async function getModels(\n  provider: string,\n  apiKey?: string,\n  options: FetchModelsOptions = {},\n): Promise<FetchModelsResult> {\n  if (!apiKey) {\n    const models = getStaticModels(provider);\n    return { ok: true, models, source: \"static\" };\n  }\n\n  const result = await fetchProviderModels(provider, apiKey, options);\n  if (result.ok && result.models.length > 0) {\n    return result;\n  }\n\n  // Fall back to static\n  const staticModels = getStaticModels(provider);\n  if (staticModels.length > 0) {\n    return { ok: true, models: staticModels, source: \"static\", error: result.error };\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Static catalog (offline fallback)\n// ---------------------------------------------------------------------------\n\n/**\n * Offline model catalog keyed by provider name.\n *\n * Used as a fallback by {@link getModels} when the live provider API is unreachable or\n * returns an empty list. Covers Anthropic, OpenAI, Google, Mistral, Groq, DeepSeek,\n * xAI, Together, Fireworks, and OpenRouter. Update this list when providers add new\n * models and a live fetch is not available.\n *\n * @docLink packages/bridge/api-reference#models\n */\nexport const STATIC_MODELS: Record<string, ModelEntry[]> = {\n  anthropic: [\n    { id: \"claude-opus-4-6\", name: \"Claude Opus 4.6\" },\n    { id: \"claude-sonnet-4-6\", name: \"Claude Sonnet 4.6\" },\n    { id: \"claude-haiku-4-5-20251001\", name: \"Claude Haiku 4.5\" },\n    { id: \"claude-opus-4-5\", name: \"Claude Opus 4.5\" },\n    { id: \"claude-sonnet-4-5\", name: \"Claude Sonnet 4.5\" },\n  ],\n  openai: [\n    { id: \"gpt-4o\", name: \"GPT-4o\" },\n    { id: \"gpt-4o-mini\", name: \"GPT-4o Mini\" },\n    { id: \"gpt-4.1\", name: \"GPT-4.1\" },\n    { id: \"gpt-4.1-mini\", name: \"GPT-4.1 Mini\" },\n    { id: \"o3\", name: \"o3\" },\n    { id: \"o4-mini\", name: \"o4-mini\" },\n  ],\n  google: [\n    { id: \"gemini-2.5-pro\", name: \"Gemini 2.5 Pro\" },\n    { id: \"gemini-2.5-flash\", name: \"Gemini 2.5 Flash\" },\n    { id: \"gemini-2.0-flash\", name: \"Gemini 2.0 Flash\" },\n  ],\n  mistral: [\n    { id: \"mistral-large-latest\", name: \"Mistral Large\" },\n    { id: \"mistral-small-latest\", name: \"Mistral Small\" },\n    { id: \"codestral-latest\", name: \"Codestral\" },\n  ],\n  groq: [\n    { id: \"llama-3.3-70b-versatile\", name: \"Llama 3.3 70B\" },\n    { id: \"llama-3.1-8b-instant\", name: \"Llama 3.1 8B\" },\n    { id: \"mixtral-8x7b-32768\", name: \"Mixtral 8x7B\" },\n  ],\n  deepseek: [\n    { id: \"deepseek-chat\", name: \"DeepSeek Chat\" },\n    { id: \"deepseek-reasoner\", name: \"DeepSeek Reasoner\" },\n  ],\n  xai: [\n    { id: \"grok-3\", name: \"Grok 3\" },\n    { id: \"grok-3-mini\", name: \"Grok 3 Mini\" },\n  ],\n  together: [\n    { id: \"meta-llama/Llama-3.3-70B-Instruct-Turbo\", name: \"Llama 3.3 70B Turbo\" },\n    { id: \"mistralai/Mixtral-8x7B-Instruct-v0.1\", name: \"Mixtral 8x7B\" },\n  ],\n  fireworks: [\n    { id: \"accounts/fireworks/models/llama-v3p3-70b-instruct\", name: \"Llama 3.3 70B\" },\n    { id: \"accounts/fireworks/models/deepseek-v3\", name: \"DeepSeek v3\" },\n  ],\n  openrouter: [\n    { id: \"anthropic/claude-sonnet-4.6\", name: \"Claude Sonnet 4.6\" },\n    { id: \"anthropic/claude-opus-4.6\", name: \"Claude Opus 4.6\" },\n    { id: \"anthropic/claude-haiku-4.5\", name: \"Claude Haiku 4.5\" },\n    { id: \"anthropic/claude-sonnet-4.5\", name: \"Claude Sonnet 4.5\" },\n    { id: \"anthropic/claude-3.7-sonnet\", name: \"Claude 3.7 Sonnet\" },\n    { id: \"openai/gpt-4o\", name: \"GPT-4o\" },\n    { id: \"openai/gpt-4.1\", name: \"GPT-4.1\" },\n    { id: \"openai/gpt-4.1-mini\", name: \"GPT-4.1 Mini\" },\n    { id: \"google/gemini-2.5-pro\", name: \"Gemini 2.5 Pro\" },\n    { id: \"google/gemini-2.5-flash\", name: \"Gemini 2.5 Flash\" },\n    { id: \"meta-llama/llama-4-maverick\", name: \"Llama 4 Maverick\" },\n    { id: \"meta-llama/llama-3.3-70b-instruct\", name: \"Llama 3.3 70B\" },\n    { id: \"deepseek/deepseek-chat-v3-0324\", name: \"DeepSeek v3\" },\n    { id: \"deepseek/deepseek-r1\", name: \"DeepSeek R1\" },\n    { id: \"mistralai/mistral-large-2411\", name: \"Mistral Large 2\" },\n  ],\n};\n\n/**\n * Get models for a specific provider from the static catalog, or empty array if unknown.\n *\n * Pure synchronous lookup — no network call. Use when the provider API is unavailable\n * or when a fast offline fallback is needed (e.g. in the UI before credentials are configured).\n *\n * @param provider - Provider name matching a key in {@link STATIC_MODELS}.\n * @returns Offline model list, or `[]` for unknown providers.\n * @docLink packages/bridge/api-reference#models\n */\nexport function getStaticModels(provider: string): ModelEntry[] {\n  return STATIC_MODELS[provider] ?? [];\n}\n\n// ---------------------------------------------------------------------------\n// Registry-backed model identity (§2.4)\n// ---------------------------------------------------------------------------\n\n/** A registry in either of the two shapes consumers hold. */\nexport type ProviderRegistryView = AIProviderRegistry | MergedAIProviderRegistry;\n\n/**\n * Where a model selector is resolved. `registry` absent means no registry is\n * configured at all — every resolver here then returns `undefined` and the\n * caller keeps its pre-registry behaviour.\n */\nexport interface ModelRegistryContext {\n  /** The merged registry (`mergeRegistries`), or a single layer. */\n  registry?: ProviderRegistryView;\n  /** `skaile.yaml` `roles`: role name → model selector (`smol` → `groq/llama-3.1-8b`). */\n  roles?: Record<string, string>;\n  /**\n   * Entry the session already runs on. Scopes `model_map` lookups to it;\n   * absent lets the selector pick in registry order.\n   */\n  providerId?: string;\n}\n\n/** The `llm`/`embed` entry registered under `id`, if any. */\nfunction llmEntry(registry: ProviderRegistryView, id: string): AIProviderLlmEntry | undefined {\n  const entry = registryEntries(registry).find(([entryId]) => entryId === id)?.[1];\n  if (!entry || (entry.kind !== \"llm\" && entry.kind !== \"embed\")) return undefined;\n  return entry;\n}\n\n/**\n * The wire facts that decide which model-id vocabulary an entry enforces\n * (`modelIdSchemaForTarget`).\n *\n * `surface` and `base_url` fall back to the entry's preset: an entry written as\n * `{kind: llm, preset: anthropic}` carries neither of its own until the catalog\n * merge layer expands it, and validation must not depend on having been handed\n * a merged registry.\n */\nexport function modelIdTargetForEntry(entry: AIProviderLlmEntry): ModelIdTarget {\n  const preset = entry.preset ? getProviderPreset(entry.preset) : undefined;\n  const surface = entry.surface ?? preset?.surface;\n  const base_url = resolveEntryBaseUrl(entry) ?? (preset ? presetBaseUrl(preset) : undefined);\n  return {\n    ...(surface ? { surface } : {}),\n    ...(entryTransport(entry) ? { transport: entryTransport(entry) } : {}),\n    ...(base_url ? { base_url } : {}),\n  };\n}\n\n/** A manifest model preference resolved against the registry. */\nexport interface ResolvedManifestModel {\n  /** Entry the preference routes to. */\n  providerId: string;\n  /** Logical id, after `@role` expansion and before `model_map`. */\n  modelId?: string;\n  /** Provider-side id — what goes on the wire: `model_map[modelId] ?? modelId`. */\n  providerModelId?: string;\n  /** Role name, when the preference was `@role`. */\n  role?: string;\n  /** The wire target `providerModelId` was checked against. */\n  target: ModelIdTarget;\n  /** Non-fatal notes: a dangling role, a disabled provider, a stale preset. */\n  warnings: string[];\n  /**\n   * Set when `providerModelId` is not a legal id for `target` — in practice,\n   * a non-Anthropic id on the first-party Anthropic Messages API. Never\n   * thrown: the caller decides whether a manifest that names a model its\n   * endpoint cannot serve is a warning or a failure.\n   */\n  error?: string;\n}\n\n/**\n * Resolve an agent manifest's `model.preferred` (or any single entry of\n * `model.fallback`) against the provider registry, then check the id it\n * produces against the selected entry's own vocabulary.\n *\n * The three selector forms — `@role`, `<providerId>/<modelId>`, bare id — are\n * resolved by `parseModelRef` (`@skaile/workspaces/core/provider-registry`),\n * which owns that grammar; this adds the per-surface id check on top.\n *\n * Returns `undefined` when there is nothing to resolve: no preference, or no\n * registry that can serve one.\n */\nexport function resolveManifestModel(\n  preference: string | undefined,\n  context: ModelRegistryContext = {},\n): ResolvedManifestModel | undefined {\n  if (!preference || !context.registry) return undefined;\n  const ref = parseModelRef(preference, context.registry, context.roles);\n  if (!ref) return undefined;\n\n  const entry = llmEntry(context.registry, ref.providerId);\n  const target = entry ? modelIdTargetForEntry(entry) : {};\n  const resolved: ResolvedManifestModel = {\n    providerId: ref.providerId,\n    ...(ref.modelId !== undefined ? { modelId: ref.modelId } : {}),\n    ...(ref.providerModelId !== undefined ? { providerModelId: ref.providerModelId } : {}),\n    ...(ref.role !== undefined ? { role: ref.role } : {}),\n    target,\n    warnings: [...ref.warnings],\n  };\n  if (ref.providerModelId === undefined) return resolved;\n\n  const check = modelIdSchemaForTarget(target).safeParse(ref.providerModelId);\n  if (!check.success) {\n    resolved.error =\n      `model \"${ref.providerModelId}\" is not valid for provider \"${ref.providerId}\" ` +\n      `(surface ${target.surface ?? \"unknown\"}, transport ${target.transport ?? \"direct\"}` +\n      `${target.base_url ? `, ${target.base_url}` : \"\"}): ` +\n      (check.error.issues[0]?.message ?? \"invalid model id\");\n  }\n  return resolved;\n}\n\n/**\n * Resolve a model's capability facts — context window, thinking ceiling, tool\n * and image support — from the registry entry that serves it.\n *\n * `capabilities` is keyed by the *logical* id (the `model_map` key), so a\n * selector is resolved first and the record is read under both the logical and\n * the provider-side id. `fallback` is the caller's own per-model table (the\n * compaction window defaults, the platform's thinking limits); the entry wins\n * field by field, and a field the entry does not state falls through.\n *\n * Returns `undefined` when neither source knows anything about the model.\n */\nexport function resolveModelCapabilities(\n  selector: string | undefined,\n  context: ModelRegistryContext & {\n    /** Per-model-id capability table consulted for fields the entry omits. */\n    fallback?: Record<string, AIProviderCapabilities>;\n  } = {},\n): AIProviderCapabilities | undefined {\n  if (!selector) return undefined;\n  const ref = context.registry\n    ? parseModelRef(selector, context.registry, context.roles)\n    : undefined;\n  const entry = ref && context.registry ? llmEntry(context.registry, ref.providerId) : undefined;\n  const ids = [ref?.modelId, ref?.providerModelId, selector].filter(\n    (id): id is string => id !== undefined,\n  );\n  const entryCaps = ids.map((id) => entry?.capabilities?.[id]).find((caps) => caps !== undefined);\n  const fallbackCaps = ids.map((id) => context.fallback?.[id]).find((caps) => caps !== undefined);\n\n  const context_window = entryCaps?.context_window ?? fallbackCaps?.context_window;\n  const thinking_max = entryCaps?.thinking_max ?? fallbackCaps?.thinking_max;\n  const tools = entryCaps?.tools ?? fallbackCaps?.tools;\n  const images = entryCaps?.images ?? fallbackCaps?.images;\n  if (\n    context_window === undefined &&\n    thinking_max === undefined &&\n    tools === undefined &&\n    images === undefined\n  ) {\n    return undefined;\n  }\n  return {\n    ...(context_window !== undefined ? { context_window } : {}),\n    ...(thinking_max !== undefined ? { thinking_max } : {}),\n    ...(tools !== undefined ? { tools } : {}),\n    ...(images !== undefined ? { images } : {}),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Model tier resolution (Flow v2 `run.model`)\n// ---------------------------------------------------------------------------\n\n/** Per-tier concrete model ids for one provider. */\nexport interface ModelTierOverrides {\n  small?: string;\n  default?: string;\n  deep?: string;\n}\n\n/**\n * Tier→model mapping per provider, for deployments with **no provider\n * registry**. This is the point of the closed `small | default | deep`\n * vocabulary: an authored flow names an intent and the runtime owns which\n * concrete model serves it, so flows stay portable across model-lineup changes.\n *\n * It is no longer the source of truth for what a tier means. Where a registry\n * exists, a tier resolves through `roles` and the selected entry's `model_map`\n * (see {@link resolveModelTier}) — which works for every provider, names the\n * ids that deployment actually serves, and is editable without a release. This\n * table survives only for the pre-registry path, where nothing else can answer\n * the question; a vendor missing from it there is a `ModelTierResolutionError`,\n * not a guess.\n *\n * These are **direct provider-API ids**. A gateway transport (Bedrock, Vertex,\n * Azure) addresses the same models by different ids — Bedrock prefixes\n * `us.anthropic.`, for instance — and that translation belongs to whoever owns\n * the deployment, not here. {@link resolveModelTier} therefore consults this\n * table only on the direct API and demands an explicit override otherwise,\n * rather than handing a gateway an id it cannot serve.\n *\n * Every id here must also appear in {@link STATIC_MODELS} — a test asserts it,\n * so the two cannot drift into naming a model the catalog disowns. That check\n * proves internal consistency only; it cannot tell you an id is still current\n * with a provider's live lineup.\n *\n * Where a provider's lineup has no genuinely distinct model for a tier, the\n * entry deliberately repeats the neighbouring one. That is a reviewable\n * property of that lineup, unlike inheriting whatever model the session\n * happened to start with — which is how `small` could silently mean Opus.\n */\nexport const PROVIDER_MODEL_TIERS: Record<string, Required<ModelTierOverrides>> = {\n  anthropic: {\n    small: \"claude-haiku-4-5-20251001\",\n    default: \"claude-sonnet-4-6\",\n    deep: \"claude-opus-4-6\",\n  },\n  openai: { small: \"gpt-4o-mini\", default: \"gpt-4.1\", deep: \"o3\" },\n  google: { small: \"gemini-2.0-flash\", default: \"gemini-2.5-flash\", deep: \"gemini-2.5-pro\" },\n  mistral: {\n    small: \"mistral-small-latest\",\n    default: \"mistral-large-latest\",\n    deep: \"mistral-large-latest\",\n  },\n  groq: {\n    small: \"llama-3.1-8b-instant\",\n    default: \"llama-3.3-70b-versatile\",\n    deep: \"llama-3.3-70b-versatile\",\n  },\n  deepseek: { small: \"deepseek-chat\", default: \"deepseek-chat\", deep: \"deepseek-reasoner\" },\n  xai: { small: \"grok-3-mini\", default: \"grok-3\", deep: \"grok-3\" },\n  together: {\n    small: \"mistralai/Mixtral-8x7B-Instruct-v0.1\",\n    default: \"meta-llama/Llama-3.3-70B-Instruct-Turbo\",\n    deep: \"meta-llama/Llama-3.3-70B-Instruct-Turbo\",\n  },\n  fireworks: {\n    small: \"accounts/fireworks/models/llama-v3p3-70b-instruct\",\n    default: \"accounts/fireworks/models/llama-v3p3-70b-instruct\",\n    deep: \"accounts/fireworks/models/deepseek-v3\",\n  },\n  openrouter: {\n    small: \"anthropic/claude-haiku-4.5\",\n    default: \"anthropic/claude-sonnet-4.6\",\n    deep: \"anthropic/claude-opus-4.6\",\n  },\n};\n\n/** Raised when a tier names an intent this provider cannot serve. */\nexport class ModelTierResolutionError extends Error {\n  constructor(\n    readonly tier: \"small\" | \"deep\",\n    readonly provider: string | undefined,\n  ) {\n    super(\n      `cannot resolve model tier \"${tier}\" for provider \"${provider ?? \"(none)\"}\": no built-in mapping and no configured override. ` +\n        `Configure a \"${tier}\" model override for this provider, or author the node as model: \"default\" to inherit the session model.`,\n    );\n    this.name = \"ModelTierResolutionError\";\n  }\n}\n\n/**\n * Resolve a tier for a deployment that has a registry: through `roles[tier]`\n * first, then the selected entry's `model_map[tier]`.\n *\n * A `model_map` **miss is a miss**. `parseModelRef` falls back to the literal\n * selector when nothing maps it, and no provider serves a model called\n * `\"small\"` — so only a genuine mapping counts, and an unmapped tier is left\n * for the caller to fail on.\n */\nfunction resolveTierThroughRegistry(\n  tier: keyof ModelTierOverrides,\n  options: ModelRegistryContext,\n): string | undefined {\n  const { registry, roles, providerId } = options;\n  if (!registry) return undefined;\n  if (roles?.[tier] !== undefined) {\n    const viaRole = parseModelRef(`@${tier}`, registry, roles);\n    if (viaRole?.providerModelId) return viaRole.providerModelId;\n  }\n  const ref = parseModelRef(providerId ? `${providerId}/${tier}` : tier, registry, roles);\n  if (!ref?.modelId) return undefined;\n  return llmEntry(registry, ref.providerId)?.model_map?.[ref.modelId];\n}\n\n/** Options {@link resolveModelTier} reads. */\nexport interface ResolveModelTierOptions extends ModelRegistryContext {\n  /** Legacy provider id, keying {@link PROVIDER_MODEL_TIERS}. */\n  provider?: string;\n  /** Legacy cloud transport; anything but `default` disables the built-in table. */\n  cloud?: string;\n  /** Per-tier ids configured for this deployment. Wins over everything. */\n  overrides?: ModelTierOverrides;\n}\n\n/**\n * Resolve a Flow v2 `run.model` tier to a concrete model id.\n *\n * Precedence, highest first: a configured `overrides` entry; the registry —\n * `roles[tier]`, then the selected entry's `model_map[tier]`, which is how a\n * tier is defined for *any* provider; and finally, **only when no registry is\n * configured**, {@link PROVIDER_MODEL_TIERS} on the direct provider API.\n *\n * `\"default\"` and an absent tier **inherit `sessionModel` first**. The session\n * model is the one id known to work for this deployment — it already carries\n * whatever provider, lineup and gateway translation the host configured — so\n * preferring any table over it would silently downgrade a configured model\n * and, on a gateway transport, substitute an id that provider cannot serve.\n *\n * `\"small\"` and `\"deep\"` never fall back to `sessionModel`; when nothing above\n * resolves them they throw {@link ModelTierResolutionError}. Inheriting there\n * would run an arbitrary model behind an author's explicit request for a cheap\n * or a strong one — a cost or quality surprise that shows up only in the bill\n * or the output. Failing names it at the node instead.\n *\n * Pure: no I/O, no environment reads.\n */\nexport function resolveModelTier(\n  tier: \"small\" | \"default\" | \"deep\" | undefined,\n  sessionModel: string | undefined,\n  options: ResolveModelTierOptions = {},\n): string | undefined {\n  // Built-in ids address the provider's own API; a gateway renames them. And a\n  // registry answers the question properly, so the table is its fallback only.\n  const directApi = !options.cloud || options.cloud === \"default\";\n  const builtIn =\n    !options.registry && directApi && options.provider\n      ? PROVIDER_MODEL_TIERS[options.provider]\n      : undefined;\n  if (tier === \"small\" || tier === \"deep\") {\n    const resolved =\n      options.overrides?.[tier] ?? resolveTierThroughRegistry(tier, options) ?? builtIn?.[tier];\n    if (!resolved) throw new ModelTierResolutionError(tier, options.provider);\n    return resolved;\n  }\n  return (\n    options.overrides?.default ??\n    sessionModel ??\n    resolveTierThroughRegistry(\"default\", options) ??\n    builtIn?.default\n  );\n}\n"]}

package/dist/{chunk-YROR332M.js → chunk-7DN6JKP2.js}

@@ -21,5 +21,5 @@ function agentExecRequested(env = process.env) {
 }
 
 export { AGENT_EXEC_ENV, agentExecRequested, resolveAgentExec, wrapAgentCommand };
-//# sourceMappingURL=chunk-YROR332M.js.map
-//# sourceMappingURL=chunk-YROR332M.js.map
+//# sourceMappingURL=chunk-7DN6JKP2.js.map
+//# sourceMappingURL=chunk-7DN6JKP2.js.map

package/dist/chunk-7DN6JKP2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/agent-exec.ts"],"names":[],"mappings":";;;AAiBO,IAAM,cAAA,GAAiB;AASvB,SAAS,gBAAA,CACd,GAAA,GAA0C,OAAA,CAAQ,GAAA,EACnC;AACf,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,cAAc,CAAA,EAAG,IAAA,EAAK;AACxC,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,CAAC,UAAA,CAAW,KAAK,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,EAAG,cAAc,CAAA,yDAAA,EAA4D,KAAK,CAAA,CAAA;AAAA,KACpF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,gBAAA,CACd,OAAA,EACA,IAAA,EACA,IAAA,EACqC;AACrC,EAAA,IAAI,CAAC,MAAM,OAAO,EAAE,SAAS,IAAA,EAAM,CAAC,GAAG,IAAI,CAAA,EAAE;AAC7C,EAAA,OAAO,EAAE,SAAS,IAAA,EAAM,IAAA,EAAM,CAAC,IAAA,EAAM,OAAA,EAAS,GAAG,IAAI,CAAA,EAAE;AACzD;AAOO,SAAS,kBAAA,CAAmB,GAAA,GAA0C,OAAA,CAAQ,GAAA,EAAc;AACjG,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAAG,MAAM,CAAA;AAC5C","file":"chunk-7DN6JKP2.js","sourcesContent":["import { isAbsolute } from \"node:path\";\n\n/**\n * Names the shim that starts agent processes as a separate uid.\n *\n * In the Skaile agent image the runner cannot switch uid itself (it runs with\n * no-new-privs and no `CAP_SETUID`). When the container entrypoint has started\n * the root launcher (`skaile-agent-launchd`), it exports this variable with the\n * absolute path of the runner-side shim (`skaile-agent-exec`). A harness then\n * spawns `<shim> -- <command> <args...>` instead of `<command>`: the shim\n * passes its stdio, cwd, argv and env to the launcher, which runs the command\n * as the agent uid, forwards signals and reports the exit status, so the\n * returned child behaves like a direct one.\n *\n * Unset (every other environment, and the image until the entrypoint wires\n * it): harnesses spawn directly, unchanged.\n */\nexport const AGENT_EXEC_ENV = \"SKAILE_AGENT_EXEC\";\n\n/**\n * The shim path from `env`, or `null` when the uid split is off.\n *\n * Throws on a relative path rather than spawning the agent unsplit: only the\n * entrypoint sets this, so a bad value is a broken image, and silently running\n * the agent as the runner's uid would hide exactly what the variable promises.\n */\nexport function resolveAgentExec(\n  env: Record<string, string | undefined> = process.env,\n): string | null {\n  const value = env[AGENT_EXEC_ENV]?.trim();\n  if (!value) return null;\n  if (!isAbsolute(value)) {\n    throw new Error(\n      `${AGENT_EXEC_ENV} must be an absolute path to the agent launch shim, got \"${value}\"`,\n    );\n  }\n  return value;\n}\n\n/**\n * The command line to spawn: `command args` itself, or routed through the\n * shim when one is configured. The `--` stops the shim reading the agent's\n * own arguments as options.\n */\nexport function wrapAgentCommand(\n  command: string,\n  args: readonly string[],\n  shim: string | null,\n): { command: string; args: string[] } {\n  if (!shim) return { command, args: [...args] };\n  return { command: shim, args: [\"--\", command, ...args] };\n}\n\n/**\n * Whether the uid split is asked for at all, without validating the path.\n * For decisions that must not throw (env building); the spawn itself still\n * goes through {@link resolveAgentExec} and fails on a bad value.\n */\nexport function agentExecRequested(env: Record<string, string | undefined> = process.env): boolean {\n  return Boolean(env[AGENT_EXEC_ENV]?.trim());\n}\n"]}

package/dist/{chunk-IZCR27MU.js → chunk-7EKQDY2T.js}

@@ -1,4 +1,4 @@
-// bridge/src/drivers/recovery-policy.ts
+// bridge/src/harnesses/recovery-policy.ts
 var FAIL = { fail: true };
 var STALE_RESUME_PATTERN = /No conversation found with session ID/i;
 function isPoisonedHistoryError(message) {
@@ -56,5 +56,5 @@ function decide(observation, budget, wiring) {
 }
 
 export { decide, freshBudget, isAvailable, isFirstAttempt, isSpent, spend };
-//# sourceMappingURL=chunk-IZCR27MU.js.map
-//# sourceMappingURL=chunk-IZCR27MU.js.map
+//# sourceMappingURL=chunk-7EKQDY2T.js.map
+//# sourceMappingURL=chunk-7EKQDY2T.js.map

package/dist/chunk-7EKQDY2T.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/harnesses/recovery-policy.ts"],"names":[],"mappings":";AA8DO,IAAM,IAAA,GAAyB,EAAE,IAAA,EAAM,IAAA,EAAK;AAMnD,IAAM,oBAAA,GAAuB,wCAAA;AAG7B,SAAS,uBAAuB,OAAA,EAA0B;AACxD,EAAA,OACE,yBAAyB,IAAA,CAAK,OAAO,CAAA,IACrC,qEAAA,CAAsE,KAAK,OAAO,CAAA;AAEtF;AAGO,SAAS,WAAA,GAA8B;AAC5C,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,KAAA;AAAA,IACd,YAAA,EAAc,KAAA;AAAA,IACd,YAAA,EAAc,KAAA;AAAA,IACd,cAAA,EAAgB,KAAA;AAAA,IAChB,kBAAA,EAAoB;AAAA,GACtB;AACF;AAGO,SAAS,KAAA,CAAM,QAAwB,IAAA,EAAoC;AAChF,EAAA,OAAO,EAAE,GAAG,MAAA,EAAQ,CAAC,IAAI,GAAG,IAAA,EAAK;AACnC;AAGO,SAAS,OAAA,CAAQ,QAAwB,IAAA,EAA6B;AAC3E,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;AAMO,SAAS,eAAe,MAAA,EAAiC;AAC9D,EAAA,OAAO,CAAC,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,KAAK,OAAO,CAAA;AAC5C;AAOO,SAAS,WAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,MAAA,CAAO,IAAI,CAAA,EAAG,OAAO,KAAA;AACzB,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,cAAA;AACH,MAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAChB,KAAK,gBAAA;AACH,MAAA,OAAO,MAAA,CAAO,cAAA;AAAA,IAChB,KAAK,cAAA;AACH,MAAA,OAAO,MAAA,CAAO,kBAAA;AAAA,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,oBAAA;AACH,MAAA,OAAO,IAAA;AAAA;AAEb;AAMO,SAAS,MAAA,CACd,WAAA,EACA,MAAA,EACA,MAAA,EACkB;AAElB,EAAA,IAAI,YAAY,UAAA,EAAY;AAC1B,IAAA,OAAO,WAAA,CAAY,QAAQ,oBAAA,EAAsB,MAAM,IACnD,EAAE,OAAA,EAAS,sBAAqB,GAChC,IAAA;AAAA,EACN;AACA,EAAA,IACE,oBAAA,CAAqB,KAAK,WAAA,CAAY,OAAO,KAC7C,WAAA,CAAY,MAAA,EAAQ,cAAA,EAAgB,MAAM,CAAA,EAC1C;AACA,IAAA,OAAO,EAAE,SAAS,cAAA,EAAe;AAAA,EACnC;AACA,EAAA,IAAI,sBAAA,CAAuB,YAAY,OAAO,CAAA,IAAK,YAAY,MAAA,EAAQ,cAAA,EAAgB,MAAM,CAAA,EAAG;AAC9F,IAAA,OAAO,EAAE,SAAS,cAAA,EAAe;AAAA,EACnC;AAIA,EAAA,IAAI,YAAY,SAAA,IAAa,WAAA,CAAY,MAAA,EAAQ,cAAA,EAAgB,MAAM,CAAA,EAAG;AACxE,IAAA,OAAO,EAAE,SAAS,cAAA,EAAe;AAAA,EACnC;AACA,EAAA,IAAI,YAAY,aAAA,IAAiB,WAAA,CAAY,MAAA,EAAQ,gBAAA,EAAkB,MAAM,CAAA,EAAG;AAC9E,IAAA,OAAO,EAAE,SAAS,gBAAA,EAAiB;AAAA,EACrC;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-7EKQDY2T.js","sourcesContent":["/**\n * Recovery policy for a failed turn: one decision per failure.\n *\n * A harness that can recover from a failed turn (the claude-sdk harness,\n * and the managed codex harness's 401 refresh gate) observes a failure, asks\n * {@link decide} once what to do, records the answer on the turn, and acts on\n * that record. The policy is pure: it picks at most one recovery *attempt* or\n * says to *fail*, and it owns the per-turn budgets. The recovery actions\n * themselves (drop the query, retract text, scrub a transcript, replay the\n * prompt, refresh a credential) stay in the harness.\n *\n * Rules:\n * - One attempt per kind per turn. Budgets are independent per kind, so a\n *   stale-resume retry never uses up the auth budget (the fresh session it\n *   starts can still meet an expired credential).\n * - Auth refresh and limit failover exclude each other: an auth failure with\n *   no `onAuthError` callback falls through to limit failover.\n * - Limit failover needs a limit rejection seen on *this* attempt.\n * - A poisoned-transcript scrub needs a resumable session id.\n *\n * Internal module: not exported from `bridge/src/index.ts`.\n */\n\n/** The recovery attempts a failed turn can take. */\nexport type RecoveryKind =\n  | \"stale_resume\"\n  | \"poison_scrub\"\n  | \"auth_refresh\"\n  | \"limit_failover\"\n  | \"query_ended_replay\";\n\n/**\n * What the harness saw fail. Facts only — the policy derives the meaning.\n */\nexport interface FailureObservation {\n  /** The failure's message text (thrown error, or the result's joined `errors[]`). */\n  message: string;\n  /** The failure was classified as an auth failure (a 401-shaped `AuthError`). */\n  authError: boolean;\n  /** An upstream usage-limit rejection was seen on THIS attempt (not an earlier one). */\n  limitRejected: boolean;\n  /** The turn was never dispatched: the serving query ended before it ran. */\n  queryEnded: boolean;\n}\n\n/** Which host capabilities exist for this failure. */\nexport interface RecoveryWiring {\n  /** The host wired an `onAuthError` credential-refresh callback. */\n  onAuthError: boolean;\n  /** The host wired an `onLimitBlocked` seat-failover callback. */\n  onLimitBlocked: boolean;\n  /** A session id exists that a transcript scrub could repair and resume. */\n  resumableSessionId: boolean;\n}\n\n/** One-shot budgets for a single logical turn; `true` = that kind has been spent. */\nexport type RecoveryBudget = Readonly<Record<RecoveryKind, boolean>>;\n\n/** The policy's answer: take one recovery attempt, or fail the turn. */\nexport type RecoveryDecision = { attempt: RecoveryKind } | { fail: true };\n\n/** The \"no recovery\" answer. */\nexport const FAIL: RecoveryDecision = { fail: true };\n\n/**\n * The CLI's text for a resume whose on-disk transcript is gone. It arrives\n * either as an iterator throw or inside an `is_error` result's `errors[]`.\n */\nconst STALE_RESUME_PATTERN = /No conversation found with session ID/i;\n\n/** A `400 invalid_request_error` the reactive transcript scrub may be able to repair. */\nfunction isPoisonedHistoryError(message: string): boolean {\n  return (\n    /invalid_request_error/i.test(message) &&\n    /media[_ ]?type|could not process image|image exceeds|cache_control/i.test(message)\n  );\n}\n\n/** A pristine budget for the first attempt of a turn (nothing spent yet). */\nexport function freshBudget(): RecoveryBudget {\n  return {\n    stale_resume: false,\n    poison_scrub: false,\n    auth_refresh: false,\n    limit_failover: false,\n    query_ended_replay: false,\n  };\n}\n\n/** The budget after `kind` has been spent; the input is not modified. */\nexport function spend(budget: RecoveryBudget, kind: RecoveryKind): RecoveryBudget {\n  return { ...budget, [kind]: true };\n}\n\n/** Whether `kind` has already been spent this turn (regardless of wiring). */\nexport function isSpent(budget: RecoveryBudget, kind: RecoveryKind): boolean {\n  return budget[kind];\n}\n\n/**\n * Whether no recovery has been spent yet — the turn is on its first attempt.\n * Derived from the budget, so a new {@link RecoveryKind} is covered by default.\n */\nexport function isFirstAttempt(budget: RecoveryBudget): boolean {\n  return !Object.values(budget).some(Boolean);\n}\n\n/**\n * Whether `kind` could still run this turn: unspent and with the host\n * capability it needs. For checks that run before any failure is classified\n * (e.g. hiding an auth-error render while a self-heal can still follow).\n */\nexport function isAvailable(\n  budget: RecoveryBudget,\n  kind: RecoveryKind,\n  wiring: RecoveryWiring,\n): boolean {\n  if (budget[kind]) return false;\n  switch (kind) {\n    case \"auth_refresh\":\n      return wiring.onAuthError;\n    case \"limit_failover\":\n      return wiring.onLimitBlocked;\n    case \"poison_scrub\":\n      return wiring.resumableSessionId;\n    case \"stale_resume\":\n    case \"query_ended_replay\":\n      return true;\n  }\n}\n\n/**\n * Decide what to do about one failure. Call once per failure, where it is\n * classified, and act on the recorded answer.\n */\nexport function decide(\n  observation: FailureObservation,\n  budget: RecoveryBudget,\n  wiring: RecoveryWiring,\n): RecoveryDecision {\n  // The prompt never reached a CLI; nothing else about the failure matters.\n  if (observation.queryEnded) {\n    return isAvailable(budget, \"query_ended_replay\", wiring)\n      ? { attempt: \"query_ended_replay\" }\n      : FAIL;\n  }\n  if (\n    STALE_RESUME_PATTERN.test(observation.message) &&\n    isAvailable(budget, \"stale_resume\", wiring)\n  ) {\n    return { attempt: \"stale_resume\" };\n  }\n  if (isPoisonedHistoryError(observation.message) && isAvailable(budget, \"poison_scrub\", wiring)) {\n    return { attempt: \"poison_scrub\" };\n  }\n  // Auth and limit exclude each other: when auth owns the failure, limit\n  // failover is not tried. An auth failure auth cannot own (no `onAuthError`,\n  // or its budget spent) falls through to limit failover.\n  if (observation.authError && isAvailable(budget, \"auth_refresh\", wiring)) {\n    return { attempt: \"auth_refresh\" };\n  }\n  if (observation.limitRejected && isAvailable(budget, \"limit_failover\", wiring)) {\n    return { attempt: \"limit_failover\" };\n  }\n  return FAIL;\n}\n"]}

package/dist/{chunk-2LSDMJI2.js → chunk-7TPYPVAH.js}

@@ -1,5 +1,5 @@
-import { err, okJson, ok } from './chunk-X5YPJV4N.js';
-import { buildConnectorListPayload } from './chunk-HT35SQZD.js';
+import { err, okJson, ok } from './chunk-3MWQKQUB.js';
+import { buildConnectorListPayload } from './chunk-SNEE6UGY.js';
 import { readFile } from 'fs/promises';
 import { join } from 'path';
 
@@ -117,5 +117,5 @@ async function connectorDescribe(manager, id) {
 }
 
 export { connectorDescribe, connectorExec, connectorList, connectorLoadSkill, connectorRead, connectorSearch, connectorWrite, mountList, mountRead, mountStatus, mountSync };
-//# sourceMappingURL=chunk-2LSDMJI2.js.map
-//# sourceMappingURL=chunk-2LSDMJI2.js.map
+//# sourceMappingURL=chunk-7TPYPVAH.js.map
+//# sourceMappingURL=chunk-7TPYPVAH.js.map

package/dist/{chunk-2LSDMJI2.js.map → chunk-7TPYPVAH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../workspace-plugin/src/tools/connectors.ts"],"names":[],"mappings":";;;;;AAwBA,SAAS,cAAc,OAAA,EAAiD;AACtE,EAAA,OAAO,OAAA,CACJ,gBAAe,CACf,MAAA,CAAO,CAAC,CAAA,KAA+B,OAAO,CAAA,CAAE,SAAA,KAAc,QAAQ,CAAA;AAC3E;AAaA,eAAe,YAAA,CACb,SACA,KAAA,EACoB;AAEpB,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,kBAAA,GAAqB,MAAM,EAAE,CAAA;AAC5D,EAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,KAAA,KAAU,QAAQ,OAAO,KAAA;AACnD,EAAA,IAAI,QAAA,CAAS,KAAA,KAAU,MAAA,EAAQ,OAAO,EAAE,GAAG,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAO;AAC3F,EAAA,OAAO,EAAE,GAAG,KAAA,EAAO,MAAA,EAAQ,SAAS,MAAA,EAAO;AAC7C;AAUA,eAAsB,UAAU,OAAA,EAAuD;AACrF,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,MAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,YAAA,CAAa,OAAA,EAAS,CAAC,CAAC,CAAC,CAAC,CAAA;AAAA,EAC9F,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,SAAA,CACpB,SACA,OAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA;AACzC,IAAA,OAAO,OAAO,MAAM,CAAA;AAAA,EACtB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,WAAA,CACpB,SACA,OAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAc,OAAO,CAAA,CAAE,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,OAAO,CAAA;AACjE,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,kBAAA,EAAqB,OAAO,CAAA,CAAA,CAAG,CAAA;AACtD,IAAA,OAAO,MAAA,CAAO,MAAM,YAAA,CAAa,OAAA,EAAS,KAAK,CAAC,CAAA;AAAA,EAClD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAYA,eAAsB,SAAA,CACpB,OAAA,EACA,OAAA,EACA,QAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAc,OAAO,CAAA,CAAE,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,OAAO,CAAA;AACjE,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,kBAAA,EAAqB,OAAO,CAAA,CAAA,CAAG,CAAA;AACtD,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,CAAK,MAAM,SAAA,EAAW,QAAQ,GAAG,OAAO,CAAA;AACvE,IAAA,OAAO,GAAG,OAAO,CAAA;AAAA,EACnB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAiBA,eAAsB,cAAc,OAAA,EAAuD;AACzF,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AAEF,IAAA,OAAO,MAAA,CAAO,MAAM,yBAAA,CAA0B,OAAO,CAAC,CAAA;AAAA,EACxD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,aAAA,CACpB,OAAA,EACA,EAAA,EACA,IAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,IAAI,CAAA;AAC3C,IAAA,IAAI,OAAA,KAAY,MAAM,OAAO,GAAA,CAAI,uBAAuB,IAAI,CAAA,gBAAA,EAAmB,EAAE,CAAA,CAAA,CAAG,CAAA;AACpF,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,cAAA,CACpB,OAAA,EACA,EAAA,EACA,IAAA,EACA,OAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,KAAA,CAAM,EAAA,EAAI,MAAM,EAAE,IAAA,EAAM,SAAS,CAAA;AAC/C,IAAA,OAAO,EAAA,CAAG,CAAA,YAAA,EAAe,IAAI,CAAA,gBAAA,EAAmB,EAAE,CAAA,CAAA,CAAG,CAAA;AAAA,EACvD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAaA,eAAsB,eAAA,CACpB,OAAA,EACA,EAAA,EACA,KAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAK,CAAA;AAC9C,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAgBA,eAAsB,aAAA,CACpB,OAAA,EACA,EAAA,EACA,SAAA,EACA,IAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,SAAA,CAAU,EAAA,EAAI,WAAW,IAAI,CAAA;AAC1D,IAAA,OAAO,GAAG,MAAM,CAAA;AAAA,EAClB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,kBAAA,CACpB,SACA,EAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,SAAA,CAAU,EAAE,CAAA;AAClC,IAAA,OAAO,GAAG,KAAK,CAAA;AAAA,EACjB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,iBAAA,CACpB,SACA,EAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,QAAQ,UAAA,EAAW;AAClC,IAAA,MAAM,aAAa,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,EAAE,CAAA;AACjD,IAAA,IAAI,CAAC,UAAA,EAAY,OAAO,GAAA,CAAI,CAAA,mCAAA,EAAsC,EAAE,CAAA,CAAA,CAAG,CAAA;AACvE,IAAA,OAAO,OAAO,UAAU,CAAA;AAAA,EAC1B,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF","file":"chunk-2LSDMJI2.js","sourcesContent":["// src/tools/connectors.ts\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { buildConnectorListPayload, type ConnectorManager } from \"@skaile/workspaces/connectors\";\nimport type { ToolResult } from \"../types.js\";\nimport { err, ok, okJson } from \"../types.js\";\n\n// ── Mountable-connector helpers ──────────────────────────────────────────────\n//\n// The unified ConnectorManager owns mountable (filesystem-face) connectors too.\n// A connector is mountable when its `listConnectors()` summary carries a\n// `mountPath`. The `mount*` helpers below project that subset for the legacy\n// `mount_*` tool surface.\n\n/**\n * A connector summary that carries a projected filesystem path. Unlike the raw\n * `listConnectors()` summary, `mountPath` is non-optional here — `listMountable()`\n * runtime-filters to exactly those entries before narrowing to this type.\n */\ntype MountableConnector = ReturnType<ConnectorManager[\"listConnectors\"]>[number] & {\n  mountPath: string;\n};\n\n/** Return the mountable (filesystem-face) connectors from a manager. */\nfunction listMountable(manager: ConnectorManager): MountableConnector[] {\n  return manager\n    .listConnectors()\n    .filter((c): c is MountableConnector => typeof c.mountPath === \"string\");\n}\n\n/**\n * A mountable connector as reported to the agent, with an optional `reason`.\n *\n * A fleet-managed mount whose path is gone reports `status: \"error\"` plus a\n * `reason`, even though the connector handle still reads `connected`. One whose\n * probe timed out keeps its cached status and gains a `reason` saying it is\n * unverified: a slow cloud mount is not reported dead.\n */\ntype MountView = MountableConnector & { reason?: string };\n\n/** Overlay a live re-check on the cached connect-time status where one applies. */\nasync function withLiveness(\n  manager: ConnectorManager,\n  mount: MountableConnector,\n): Promise<MountView> {\n  // Optional call: the tool tests' manager doubles omit the method.\n  const liveness = await manager.checkMountLiveness?.(mount.id);\n  if (!liveness || liveness.state === \"live\") return mount;\n  if (liveness.state === \"dead\") return { ...mount, status: \"error\", reason: liveness.reason };\n  return { ...mount, reason: liveness.reason };\n}\n\n/**\n * List all mountable (filesystem-face) connectors declared in `skaile.yaml`\n * with their current mount status.\n *\n * @param manager - Active `ConnectorManager` or `null` when not configured.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function mountList(manager: ConnectorManager | null): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    return okJson(await Promise.all(listMountable(manager).map((m) => withLiveness(manager, m))));\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Sync a mountable connector — pull the latest content from its remote source.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param mountId - Connector ID declared in `skaile.yaml`.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function mountSync(\n  manager: ConnectorManager | null,\n  mountId: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const result = await manager.sync(mountId);\n    return okJson(result);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Get the current status and metadata for a single mountable connector.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param mountId - Connector ID declared in `skaile.yaml`.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function mountStatus(\n  manager: ConnectorManager | null,\n  mountId: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const mount = listMountable(manager).find((v) => v.id === mountId);\n    if (!mount) return err(`Mount not found: \"${mountId}\"`);\n    return okJson(await withLiveness(manager, mount));\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Read a file from within a mountable connector's projected directory by its\n * relative path.\n *\n * @param manager  - Active `ConnectorManager` or `null`.\n * @param mountId  - Connector ID declared in `skaile.yaml`.\n * @param filePath - Relative path within the projected mount directory.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function mountRead(\n  manager: ConnectorManager | null,\n  mountId: string,\n  filePath: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const mount = listMountable(manager).find((v) => v.id === mountId);\n    if (!mount) return err(`Mount not found: \"${mountId}\"`);\n    const content = await readFile(join(mount.mountPath, filePath), \"utf-8\");\n    return ok(content);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * List all connectors registered with the `ConnectorManager`.\n *\n * Returns `{ connected, failed }` — `connected` from `manager.listConnectors()`,\n * `failed` from `manager.listFailedConnectors()`. A connector that threw during\n * `connect()` never enters the active map, so it is absent from the first list\n * entirely; without the second one an agent driven through MCP or OMP has no\n * way to learn that a mount it is about to write into is dead. Returns an error\n * result when no manager is configured (i.e. `skaile.yaml` has no `connectors`\n * section).\n *\n * @param manager - Active `ConnectorManager` or `null` when not configured.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorList(manager: ConnectorManager | null): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    // Same payload as the Claude SDK tool: per-mount health and a notice when one is not ok.\n    return okJson(await buildConnectorListPayload(manager));\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Read content from a connector at the given path.\n *\n * Delegates to `manager.read(id, path)`.  Returns an error result when the\n * path yields `null` (not found) or the manager is absent.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n * @param path    - Resource path within the connector (connector-specific format).\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorRead(\n  manager: ConnectorManager | null,\n  id: string,\n  path: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const content = await manager.read(id, path);\n    if (content === null) return err(`No content at path \"${path}\" in connector \"${id}\"`);\n    return okJson(content);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Write string content to a connector at the given path.\n *\n * Delegates to `manager.write(id, path, { data: content })`.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n * @param path    - Destination path within the connector.\n * @param content - String payload to write.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorWrite(\n  manager: ConnectorManager | null,\n  id: string,\n  path: string,\n  content: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    await manager.write(id, path, { data: content });\n    return ok(`Written to \"${path}\" in connector \"${id}\"`);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Search a connector's data using a query string.\n *\n * Delegates to `manager.search(id, query)` and returns the result set as JSON.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n * @param query   - Free-text or structured query (connector-specific format).\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorSearch(\n  manager: ConnectorManager | null,\n  id: string,\n  query: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const results = await manager.search(id, query);\n    return okJson(results);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Execute a named operation on a connector.\n *\n * Delegates to `manager.executeOp(id, operation, args)`.  Operations and\n * their argument shapes are connector-specific; use {@link connectorDescribe}\n * to discover what operations a connector supports.\n *\n * @param manager   - Active `ConnectorManager` or `null`.\n * @param id        - Connector ID declared in `skaile.yaml`.\n * @param operation - Operation name (from the connector's `RuntimeSkillDescriptor`).\n * @param args      - Named arguments for the operation.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorExec(\n  manager: ConnectorManager | null,\n  id: string,\n  operation: string,\n  args: Record<string, unknown>,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const result = await manager.executeOp(id, operation, args);\n    return ok(result);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Load the rendered skill body for a connector.\n *\n * Delegates to `manager.loadSkill(id)` and returns the skill content as\n * plain text.  Useful when the agent needs the connector's operations and\n * usage instructions injected as prompt context.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorLoadSkill(\n  manager: ConnectorManager | null,\n  id: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const skill = manager.loadSkill(id);\n    return ok(skill);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Describe a connector's capabilities via its `RuntimeSkillDescriptor`.\n *\n * Finds the matching skill descriptor from `manager.listSkills()` and returns\n * it as JSON.  The descriptor includes the connector's operations, argument\n * shapes, and usage instructions.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorDescribe(\n  manager: ConnectorManager | null,\n  id: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const skills = manager.listSkills();\n    const descriptor = skills.find((s) => s.id === id);\n    if (!descriptor) return err(`No skill descriptor for connector \"${id}\"`);\n    return okJson(descriptor);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n"]}
+{"version":3,"sources":["../workspace-plugin/src/tools/connectors.ts"],"names":[],"mappings":";;;;;AAwBA,SAAS,cAAc,OAAA,EAAiD;AACtE,EAAA,OAAO,OAAA,CACJ,gBAAe,CACf,MAAA,CAAO,CAAC,CAAA,KAA+B,OAAO,CAAA,CAAE,SAAA,KAAc,QAAQ,CAAA;AAC3E;AAaA,eAAe,YAAA,CACb,SACA,KAAA,EACoB;AAEpB,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,kBAAA,GAAqB,MAAM,EAAE,CAAA;AAC5D,EAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,KAAA,KAAU,QAAQ,OAAO,KAAA;AACnD,EAAA,IAAI,QAAA,CAAS,KAAA,KAAU,MAAA,EAAQ,OAAO,EAAE,GAAG,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAO;AAC3F,EAAA,OAAO,EAAE,GAAG,KAAA,EAAO,MAAA,EAAQ,SAAS,MAAA,EAAO;AAC7C;AAUA,eAAsB,UAAU,OAAA,EAAuD;AACrF,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,MAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,YAAA,CAAa,OAAA,EAAS,CAAC,CAAC,CAAC,CAAC,CAAA;AAAA,EAC9F,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,SAAA,CACpB,SACA,OAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA;AACzC,IAAA,OAAO,OAAO,MAAM,CAAA;AAAA,EACtB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,WAAA,CACpB,SACA,OAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAc,OAAO,CAAA,CAAE,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,OAAO,CAAA;AACjE,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,kBAAA,EAAqB,OAAO,CAAA,CAAA,CAAG,CAAA;AACtD,IAAA,OAAO,MAAA,CAAO,MAAM,YAAA,CAAa,OAAA,EAAS,KAAK,CAAC,CAAA;AAAA,EAClD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAYA,eAAsB,SAAA,CACpB,OAAA,EACA,OAAA,EACA,QAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAc,OAAO,CAAA,CAAE,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,OAAO,CAAA;AACjE,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,GAAA,CAAI,CAAA,kBAAA,EAAqB,OAAO,CAAA,CAAA,CAAG,CAAA;AACtD,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,CAAK,MAAM,SAAA,EAAW,QAAQ,GAAG,OAAO,CAAA;AACvE,IAAA,OAAO,GAAG,OAAO,CAAA;AAAA,EACnB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAiBA,eAAsB,cAAc,OAAA,EAAuD;AACzF,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AAEF,IAAA,OAAO,MAAA,CAAO,MAAM,yBAAA,CAA0B,OAAO,CAAC,CAAA;AAAA,EACxD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,aAAA,CACpB,OAAA,EACA,EAAA,EACA,IAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,IAAI,CAAA;AAC3C,IAAA,IAAI,OAAA,KAAY,MAAM,OAAO,GAAA,CAAI,uBAAuB,IAAI,CAAA,gBAAA,EAAmB,EAAE,CAAA,CAAA,CAAG,CAAA;AACpF,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,cAAA,CACpB,OAAA,EACA,EAAA,EACA,IAAA,EACA,OAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,KAAA,CAAM,EAAA,EAAI,MAAM,EAAE,IAAA,EAAM,SAAS,CAAA;AAC/C,IAAA,OAAO,EAAA,CAAG,CAAA,YAAA,EAAe,IAAI,CAAA,gBAAA,EAAmB,EAAE,CAAA,CAAA,CAAG,CAAA;AAAA,EACvD,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAaA,eAAsB,eAAA,CACpB,OAAA,EACA,EAAA,EACA,KAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAK,CAAA;AAC9C,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAgBA,eAAsB,aAAA,CACpB,OAAA,EACA,EAAA,EACA,SAAA,EACA,IAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,SAAA,CAAU,EAAA,EAAI,WAAW,IAAI,CAAA;AAC1D,IAAA,OAAO,GAAG,MAAM,CAAA;AAAA,EAClB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,kBAAA,CACpB,SACA,EAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,SAAA,CAAU,EAAE,CAAA;AAClC,IAAA,OAAO,GAAG,KAAK,CAAA;AAAA,EACjB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAcA,eAAsB,iBAAA,CACpB,SACA,EAAA,EACqB;AACrB,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,yCAAyC,CAAA;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,QAAQ,UAAA,EAAW;AAClC,IAAA,MAAM,aAAa,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,EAAE,CAAA;AACjD,IAAA,IAAI,CAAC,UAAA,EAAY,OAAO,GAAA,CAAI,CAAA,mCAAA,EAAsC,EAAE,CAAA,CAAA,CAAG,CAAA;AACvE,IAAA,OAAO,OAAO,UAAU,CAAA;AAAA,EAC1B,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF","file":"chunk-7TPYPVAH.js","sourcesContent":["// src/tools/connectors.ts\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { buildConnectorListPayload, type ConnectorManager } from \"@skaile/workspaces/connectors\";\nimport type { ToolResult } from \"../types.js\";\nimport { err, ok, okJson } from \"../types.js\";\n\n// ── Mountable-connector helpers ──────────────────────────────────────────────\n//\n// The unified ConnectorManager owns mountable (filesystem-face) connectors too.\n// A connector is mountable when its `listConnectors()` summary carries a\n// `mountPath`. The `mount*` helpers below project that subset for the legacy\n// `mount_*` tool surface.\n\n/**\n * A connector summary that carries a projected filesystem path. Unlike the raw\n * `listConnectors()` summary, `mountPath` is non-optional here — `listMountable()`\n * runtime-filters to exactly those entries before narrowing to this type.\n */\ntype MountableConnector = ReturnType<ConnectorManager[\"listConnectors\"]>[number] & {\n  mountPath: string;\n};\n\n/** Return the mountable (filesystem-face) connectors from a manager. */\nfunction listMountable(manager: ConnectorManager): MountableConnector[] {\n  return manager\n    .listConnectors()\n    .filter((c): c is MountableConnector => typeof c.mountPath === \"string\");\n}\n\n/**\n * A mountable connector as reported to the agent, with an optional `reason`.\n *\n * A fleet-managed mount whose path is gone reports `status: \"error\"` plus a\n * `reason`, even though the connector handle still reads `connected`. One whose\n * probe timed out keeps its cached status and gains a `reason` saying it is\n * unverified: a slow cloud mount is not reported dead.\n */\ntype MountView = MountableConnector & { reason?: string };\n\n/** Overlay a live re-check on the cached connect-time status where one applies. */\nasync function withLiveness(\n  manager: ConnectorManager,\n  mount: MountableConnector,\n): Promise<MountView> {\n  // Optional call: the tool tests' manager doubles omit the method.\n  const liveness = await manager.checkMountLiveness?.(mount.id);\n  if (!liveness || liveness.state === \"live\") return mount;\n  if (liveness.state === \"dead\") return { ...mount, status: \"error\", reason: liveness.reason };\n  return { ...mount, reason: liveness.reason };\n}\n\n/**\n * List all mountable (filesystem-face) connectors declared in `skaile.yaml`\n * with their current mount status.\n *\n * @param manager - Active `ConnectorManager` or `null` when not configured.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function mountList(manager: ConnectorManager | null): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    return okJson(await Promise.all(listMountable(manager).map((m) => withLiveness(manager, m))));\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Sync a mountable connector — pull the latest content from its remote source.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param mountId - Connector ID declared in `skaile.yaml`.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function mountSync(\n  manager: ConnectorManager | null,\n  mountId: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const result = await manager.sync(mountId);\n    return okJson(result);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Get the current status and metadata for a single mountable connector.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param mountId - Connector ID declared in `skaile.yaml`.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function mountStatus(\n  manager: ConnectorManager | null,\n  mountId: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const mount = listMountable(manager).find((v) => v.id === mountId);\n    if (!mount) return err(`Mount not found: \"${mountId}\"`);\n    return okJson(await withLiveness(manager, mount));\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Read a file from within a mountable connector's projected directory by its\n * relative path.\n *\n * @param manager  - Active `ConnectorManager` or `null`.\n * @param mountId  - Connector ID declared in `skaile.yaml`.\n * @param filePath - Relative path within the projected mount directory.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function mountRead(\n  manager: ConnectorManager | null,\n  mountId: string,\n  filePath: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const mount = listMountable(manager).find((v) => v.id === mountId);\n    if (!mount) return err(`Mount not found: \"${mountId}\"`);\n    const content = await readFile(join(mount.mountPath, filePath), \"utf-8\");\n    return ok(content);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * List all connectors registered with the `ConnectorManager`.\n *\n * Returns `{ connected, failed }` — `connected` from `manager.listConnectors()`,\n * `failed` from `manager.listFailedConnectors()`. A connector that threw during\n * `connect()` never enters the active map, so it is absent from the first list\n * entirely; without the second one an agent driven through MCP or OMP has no\n * way to learn that a mount it is about to write into is dead. Returns an error\n * result when no manager is configured (i.e. `skaile.yaml` has no `connectors`\n * section).\n *\n * @param manager - Active `ConnectorManager` or `null` when not configured.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorList(manager: ConnectorManager | null): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    // Same payload as the Claude SDK tool: per-mount health and a notice when one is not ok.\n    return okJson(await buildConnectorListPayload(manager));\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Read content from a connector at the given path.\n *\n * Delegates to `manager.read(id, path)`.  Returns an error result when the\n * path yields `null` (not found) or the manager is absent.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n * @param path    - Resource path within the connector (connector-specific format).\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorRead(\n  manager: ConnectorManager | null,\n  id: string,\n  path: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const content = await manager.read(id, path);\n    if (content === null) return err(`No content at path \"${path}\" in connector \"${id}\"`);\n    return okJson(content);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Write string content to a connector at the given path.\n *\n * Delegates to `manager.write(id, path, { data: content })`.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n * @param path    - Destination path within the connector.\n * @param content - String payload to write.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorWrite(\n  manager: ConnectorManager | null,\n  id: string,\n  path: string,\n  content: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    await manager.write(id, path, { data: content });\n    return ok(`Written to \"${path}\" in connector \"${id}\"`);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Search a connector's data using a query string.\n *\n * Delegates to `manager.search(id, query)` and returns the result set as JSON.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n * @param query   - Free-text or structured query (connector-specific format).\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorSearch(\n  manager: ConnectorManager | null,\n  id: string,\n  query: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const results = await manager.search(id, query);\n    return okJson(results);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Execute a named operation on a connector.\n *\n * Delegates to `manager.executeOp(id, operation, args)`.  Operations and\n * their argument shapes are connector-specific; use {@link connectorDescribe}\n * to discover what operations a connector supports.\n *\n * @param manager   - Active `ConnectorManager` or `null`.\n * @param id        - Connector ID declared in `skaile.yaml`.\n * @param operation - Operation name (from the connector's `RuntimeSkillDescriptor`).\n * @param args      - Named arguments for the operation.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorExec(\n  manager: ConnectorManager | null,\n  id: string,\n  operation: string,\n  args: Record<string, unknown>,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const result = await manager.executeOp(id, operation, args);\n    return ok(result);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Load the rendered skill body for a connector.\n *\n * Delegates to `manager.loadSkill(id)` and returns the skill content as\n * plain text.  Useful when the agent needs the connector's operations and\n * usage instructions injected as prompt context.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorLoadSkill(\n  manager: ConnectorManager | null,\n  id: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const skill = manager.loadSkill(id);\n    return ok(skill);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Describe a connector's capabilities via its `RuntimeSkillDescriptor`.\n *\n * Finds the matching skill descriptor from `manager.listSkills()` and returns\n * it as JSON.  The descriptor includes the connector's operations, argument\n * shapes, and usage instructions.\n *\n * @param manager - Active `ConnectorManager` or `null`.\n * @param id      - Connector ID declared in `skaile.yaml`.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function connectorDescribe(\n  manager: ConnectorManager | null,\n  id: string,\n): Promise<ToolResult> {\n  if (!manager) return err(\"No connectors configured in skaile.yaml\");\n  try {\n    const skills = manager.listSkills();\n    const descriptor = skills.find((s) => s.id === id);\n    if (!descriptor) return err(`No skill descriptor for connector \"${id}\"`);\n    return okJson(descriptor);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n"]}

package/dist/{chunk-ICSCSM5D.js → chunk-ADPM6AYF.js}

@@ -1,4 +1,4 @@
-import { parseCredentialRef } from './chunk-MJHSLODD.js';
+import { parseCredentialRef } from './chunk-LSI2IVFT.js';
 import { spawn, spawnSync } from 'child_process';
 import { constants } from 'os';
 import { Readable } from 'stream';
@@ -138,5 +138,5 @@ function resolveCredential(entry, options = {}) {
 }
 
 export { __resetCredentialCommandCache, portableSpawn, portableSpawnSync, resolveCredential };
-//# sourceMappingURL=chunk-ICSCSM5D.js.map
-//# sourceMappingURL=chunk-ICSCSM5D.js.map
+//# sourceMappingURL=chunk-ADPM6AYF.js.map
+//# sourceMappingURL=chunk-ADPM6AYF.js.map

package/dist/{chunk-ICSCSM5D.js.map → chunk-ADPM6AYF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../core/src/subprocess.ts","../core/src/provider-registry-credentials.ts"],"names":[],"mappings":";;;;;AAsEO,SAAS,aAAA,CAAc,GAAA,EAAe,IAAA,GAA6B,EAAC,EAAuB;AAChG,EAAA,MAAM,CAAC,GAAA,EAAK,GAAG,IAAI,CAAA,GAAI,GAAA;AACvB,EAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,MAAM,8BAA8B,CAAA;AACxD,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,EAAK,IAAA,EAAM;AAAA,IAC7B,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,GAAA,EAAK,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA;AAAA,IACzB,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,IAChC,UAAU,IAAA,CAAK;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAgB,CAAC,OAAA,KAAY;AAC9C,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,EAAM,MAAA,KAAW;AAClC,MAAA,IAAI,SAAS,IAAA,EAAM;AACjB,QAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,QAAA;AAAA,MACF;AACA,MAAA,MAAM,YAAA,GAAe,MAAA,GAAS,SAAA,CAAU,OAAA,CAAQ,MAAM,CAAA,GAAI,MAAA;AAC1D,MAAA,OAAA,CAAQ,YAAA,KAAiB,MAAA,GAAY,EAAA,GAAK,GAAA,GAAM,YAAY,CAAA;AAAA,IAC9D,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,MAAM,OAAA,CAAQ,EAAE,CAAC,CAAA;AAAA,EACrC,CAAC,CAAA;AACD,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,MAAM,GAAA,IAAO,EAAA;AAAA,IAClB,MAAA,EAAQ,QAAA,CAAS,KAAA,CAAM,KAAA,CAAM,MAAkB,CAAA;AAAA,IAC/C,MAAA,EAAQ,QAAA,CAAS,KAAA,CAAM,KAAA,CAAM,MAAkB,CAAA;AAAA,IAC/C,MAAA;AAAA,IACA,IAAA,EAAM,CAAC,MAAA,KAAW;AAChB,MAAA,IAAI,IAAA,CAAK,QAAA,IAAY,KAAA,CAAM,GAAA,EAAK;AAC9B,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AAC/B,UAAA;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AACA,MAAA,KAAA,CAAM,KAAK,MAAM,CAAA;AAAA,IACnB;AAAA,GACF;AACF;AAmBO,SAAS,iBAAA,CACd,KACA,IAAA,EACyB;AACzB,EAAA,MAAM,CAAC,GAAA,EAAK,GAAG,IAAI,CAAA,GAAI,GAAA;AACvB,EAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAC5D,EAAA,IAAI,EAAE,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI;AACzB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8CAAA,EAAiD,IAAA,CAAK,SAAS,CAAA,CAAA,CAAG,CAAA;AAAA,EACpF;AACA,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,EAAK,IAAA,EAAM;AAAA,IAClC,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,GAAA,EAAK,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA;AAAA,IACzB,QAAA,EAAU,MAAA;AAAA,IACV,SAAS,IAAA,CAAK,SAAA;AAAA,IACd,UAAA,EAAY;AAAA,GACb,CAAA;AAGD,EAAA,MAAM,QAAA,GACH,OAAO,KAAA,EAA6C,IAAA,KAAS,eAC7D,MAAA,CAAO,MAAA,KAAW,IAAA,IAAQ,MAAA,CAAO,MAAA,KAAW,SAAA;AAC/C,EAAA,IAAI,MAAA,GAAS,OAAO,MAAA,IAAU,EAAA;AAC9B,EAAA,IAAI,QAAA,EAAU;AAGZ,IAAA,MAAA,IAAU,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,IAAK,MAAA,KAAW,EAAA,GAAK,EAAA,GAAK,IAAI,CAAA,EAAG,GAAG,CAAA,kBAAA,EAAqB,KAAK,SAAS,CAAA;AAAA,CAAA;AAAA,EAC1G;AACA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,OAAO,MAAA,IAAU,EAAA;AAAA,IAC3B,MAAA,EAAQ,OAAO,MAAA,IAAU,EAAA;AAAA,IACzB,MAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrHA,IAAM,YAAA,uBAAmB,GAAA,EAAoB;AAGtC,SAAS,6BAAA,GAAsC;AACpD,EAAA,YAAA,CAAa,KAAA,EAAM;AACrB;AAEA,IAAM,kBAAA,GAAqB,GAAA;AAapB,SAAS,iBAAA,CACd,KAAA,EACA,OAAA,GAAoC,EAAC,EACP;AAC9B,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,CAAC,UAAA,IAAc,UAAA,CAAW,IAAA,KAAS,MAAA,EAAQ;AAC7C,IAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,IAAA,IAAQ,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,EAC5D;AACA,EAAA,MAAM,OAAO,UAAA,CAAW,IAAA;AACxB,EAAA,IAAI,CAAC,WAAW,GAAA,EAAK;AACnB,IAAA,IAAI,IAAA,KAAS,OAAA,IAAW,IAAA,KAAS,YAAA,IAAgB,SAAS,aAAA,EAAe;AACvE,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAU;AAAA,IACnC;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAQ,KAAA,EAAO,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAA,CAAA,EAAI;AAAA,EACvF;AAEA,EAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA;AAChD,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,OAAO,yCAAA,EAA0C;AAAA,EAClF;AAEA,EAAA,QAAQ,OAAO,IAAA;AAAM,IACnB,KAAK,KAAA,EAAO;AACV,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,GAAA;AACnC,MAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA;AAC7B,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,OAAO,EAAE,MAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA,qBAAA,EAAwB,MAAA,CAAO,IAAI,CAAA,WAAA,CAAA,EAAc;AAAA,MACxF;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,KAAA,EAAM;AAAA,IACtC;AAAA,IACA,KAAK,UAAA,EAAY;AACf,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,GAAU,MAAA,CAAO,QAAQ,CAAA;AAC/C,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,OAAO;AAAA,UACL,IAAA;AAAA,UACA,MAAA,EAAQ,UAAA;AAAA,UACR,KAAA,EAAO,CAAA,0CAAA,EAA6C,MAAA,CAAO,QAAQ,CAAA,CAAA;AAAA,SACrE;AAAA,MACF;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,KAAA,EAAM;AAAA,IAC3C;AAAA,IACA,KAAK,KAAA,EAAO;AACV,MAAA,IAAI,OAAA,CAAQ,iBAAiB,KAAA,EAAO;AAClC,QAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,mDAAA,EAAoD;AAAA,MAC3F;AACA,MAAA,MAAM,MAAA,GAAS,YAAA,CAAa,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA;AAC9C,MAAA,IAAI,MAAA,KAAW,QAAW,OAAO,EAAE,MAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,MAAA,EAAO;AACtE,MAAA,MAAM,IAAA,GACJ,OAAA,CAAQ,QAAA,KAAa,OAAA,GACjB,CAAC,KAAA,EAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA,GAC5B,CAAC,SAAA,EAAW,IAAA,EAAM,OAAO,OAAO,CAAA;AACtC,MAAA,MAAM,SAAS,iBAAA,CAAkB,IAAA,EAAM,EAAE,SAAA,EAAW,oBAAoB,CAAA;AACxE,MAAA,IAAI,OAAO,QAAA,EAAU;AACnB,QAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA,sCAAA,CAAA,EAAyC;AAAA,MAChF;AACA,MAAA,IAAI,MAAA,CAAO,aAAa,CAAA,EAAG;AACzB,QAAA,OAAO,EAAE,MAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA,0BAAA,EAA6B,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAG;AAAA,MACtF;AACA,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,IAAA,EAAK;AACjC,MAAA,IAAI,CAAC,OAAO,OAAO,EAAE,MAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,uCAAA,EAAwC;AACzF,MAAA,YAAA,CAAa,GAAA,CAAI,MAAA,CAAO,OAAA,EAAS,KAAK,CAAA;AACtC,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,KAAA,EAAM;AAAA,IACtC;AAAA,IACA,KAAK,SAAA;AACH,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,MAAA,EAAQ,SAAA;AAAA,QACR,KAAA,EACE,CAAA,yGAAA;AAAA,OAEJ;AAAA;AAEN","file":"chunk-ICSCSM5D.js","sourcesContent":["/**\n * Runtime-portable subprocess spawning.\n *\n * `node:child_process` is implemented by both Node and Bun, so it is the\n * portable choice — no runtime detection needed (unlike embedded SQLite,\n * which has no shared API; see `logging/sinks/sqlite-runtime.ts`).\n *\n * These helpers wrap `node:child_process` to present a `Bun.Subprocess`-shaped\n * result — web `ReadableStream` stdio plus an `exited` promise — so call sites\n * migrated off `Bun.spawn` keep their stream-reading code unchanged.\n */\nimport { spawn, spawnSync } from \"node:child_process\";\nimport { constants } from \"node:os\";\nimport { Readable } from \"node:stream\";\n\nexport interface PortableSpawnOptions {\n  cwd?: string;\n  env?: Record<string, string | undefined>;\n  detached?: boolean;\n}\n\n/**\n * Options for {@link portableSpawnSync}.\n *\n * `timeoutMs` is **required**, and deliberately so. A synchronous spawn blocks\n * the single-threaded event loop until the child exits; if the child stalls —\n * classically on a wedged network/FUSE mount reachable from `cwd` — the whole\n * process stops serving. An unbounded `spawnSync` is therefore not a call that\n * should be expressible, so the deadline is part of the type rather than an\n * optional extra a caller can forget.\n */\nexport interface PortableSpawnSyncOptions extends PortableSpawnOptions {\n  /** Wall-clock limit for the child, in milliseconds. Must be > 0. */\n  timeoutMs: number;\n}\n\n/** A spawned process with stdout/stderr piped. Mirrors the shape of `Bun.Subprocess`. */\nexport interface PortableSubprocess {\n  /** OS process id, or -1 if the process failed to spawn. */\n  readonly pid: number;\n  readonly stdout: ReadableStream<Uint8Array>;\n  readonly stderr: ReadableStream<Uint8Array>;\n  /**\n   * Resolves with the exit code once the process closes. Signal termination\n   * uses the conventional `128 + signal number`; spawn errors or unknown\n   * signals use `-1`.\n   */\n  readonly exited: Promise<number>;\n  kill(signal?: number | NodeJS.Signals): void;\n}\n\nexport interface PortableSpawnSyncResult {\n  /** Exit code; -1 when the process did not exit cleanly. */\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n  /**\n   * `true` when the child was killed for exceeding\n   * {@link PortableSpawnSyncOptions.timeoutMs}. Lets a caller tell \"the command\n   * failed\" apart from \"the command never finished\", which are different\n   * operational events.\n   */\n  timedOut: boolean;\n}\n\n/**\n * Spawn a subprocess with stdout/stderr piped. Works under Node and Bun.\n *\n * @param cmd - Command and arguments, e.g. `[\"docker\", \"ps\"]`.\n */\nexport function portableSpawn(cmd: string[], opts: PortableSpawnOptions = {}): PortableSubprocess {\n  const [bin, ...args] = cmd;\n  if (!bin) throw new Error(\"portableSpawn: empty command\");\n  const child = spawn(bin, args, {\n    cwd: opts.cwd,\n    env: opts.env ?? process.env,\n    stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    detached: opts.detached,\n  });\n  const exited = new Promise<number>((resolve) => {\n    child.on(\"close\", (code, signal) => {\n      if (code !== null) {\n        resolve(code);\n        return;\n      }\n      const signalNumber = signal ? constants.signals[signal] : undefined;\n      resolve(signalNumber === undefined ? -1 : 128 + signalNumber);\n    });\n    child.on(\"error\", () => resolve(-1));\n  });\n  return {\n    pid: child.pid ?? -1,\n    stdout: Readable.toWeb(child.stdout as Readable) as unknown as ReadableStream<Uint8Array>,\n    stderr: Readable.toWeb(child.stderr as Readable) as unknown as ReadableStream<Uint8Array>,\n    exited,\n    kill: (signal) => {\n      if (opts.detached && child.pid) {\n        try {\n          process.kill(-child.pid, signal);\n          return;\n        } catch {\n          /* fall back to killing the direct child */\n        }\n      }\n      child.kill(signal);\n    },\n  };\n}\n\n/**\n * Run a subprocess to completion synchronously, capturing stdout/stderr as\n * UTF-8 strings. Works under Node and Bun.\n *\n * Blocks the event loop for the child's whole lifetime, so `opts.timeoutMs`\n * is required — see {@link PortableSpawnSyncOptions}. Prefer\n * {@link portableSpawn} wherever an async call is possible; only reach for this\n * when the caller genuinely cannot await (process teardown, CLI entry points).\n *\n * The child is killed with `SIGKILL` rather than `SIGTERM` on expiry: a process\n * blocked in an uninterruptible kernel wait (`D` state, e.g. a dead FUSE\n * connection) never runs a `SIGTERM` handler, so a graceful signal would leave\n * the deadline unenforced.\n *\n * @param cmd - Command and arguments, e.g. `[\"docker\", \"info\"]`.\n * @param opts - Spawn options; `timeoutMs` is mandatory.\n */\nexport function portableSpawnSync(\n  cmd: string[],\n  opts: PortableSpawnSyncOptions,\n): PortableSpawnSyncResult {\n  const [bin, ...args] = cmd;\n  if (!bin) throw new Error(\"portableSpawnSync: empty command\");\n  if (!(opts.timeoutMs > 0)) {\n    throw new Error(`portableSpawnSync: timeoutMs must be > 0 (got ${opts.timeoutMs})`);\n  }\n  const result = spawnSync(bin, args, {\n    cwd: opts.cwd,\n    env: opts.env ?? process.env,\n    encoding: \"utf8\",\n    timeout: opts.timeoutMs,\n    killSignal: \"SIGKILL\",\n  });\n  // Node reports the expiry as `error.code === \"ETIMEDOUT\"`; Bun surfaces the\n  // same case as a SIGKILL with no status, so accept either signal.\n  const timedOut =\n    (result.error as NodeJS.ErrnoException | undefined)?.code === \"ETIMEDOUT\" ||\n    (result.status === null && result.signal === \"SIGKILL\");\n  let stderr = result.stderr ?? \"\";\n  if (timedOut) {\n    // Surface the reason on the channel every caller already inspects — an\n    // exitCode of -1 alone reads as \"command failed\" and hides the stall.\n    stderr += `${stderr.endsWith(\"\\n\") || stderr === \"\" ? \"\" : \"\\n\"}${bin}: timed out after ${opts.timeoutMs}ms\\n`;\n  }\n  return {\n    exitCode: result.status ?? -1,\n    stdout: result.stdout ?? \"\",\n    stderr,\n    timedOut,\n  };\n}\n","/**\n * Credential resolution for registry entries (§1.4).\n *\n * Split from `provider-registry.ts` deliberately: resolving a `cmd:` reference\n * spawns a process and `env:` reads `process.env`, so this module depends on\n * Node. The schema module must stay dependency-free because browser bundles\n * (`@skaile/workspace-bridge-react`) reach the registry *types* through\n * `@skaile/workspaces/types`, and a `node:child_process` import in that graph\n * breaks their typecheck.\n *\n * @see PROVIDER-CONFIG-PLAN.md §1.4\n */\n\nimport type { AIProviderCredentialKind, AIProviderEntry } from \"./provider-registry.js\";\nimport { parseCredentialRef } from \"./provider-registry.js\";\nimport { portableSpawnSync } from \"./subprocess.js\";\n\n/** Options for {@link resolveCredential}. */\nexport interface ResolveCredentialOptions {\n  /** Environment `env:` refs read from; defaults to `process.env`. */\n  env?: Record<string, string | undefined>;\n  /**\n   * Control-plane secrets, keyed by config id (a `platform:<configId>` ref) —\n   * the `secrets` map that rides alongside `session_init`.\n   */\n  secrets?: Record<string, string>;\n  /** Run `cmd:` references. Default `true`; the platform sets it `false`. */\n  allowCommand?: boolean;\n}\n\n/** Outcome of {@link resolveCredential}. Never carries the secret in `error`. */\nexport interface ResolvedAIProviderCredential {\n  kind: AIProviderCredentialKind;\n  /** The secret, when one was produced. */\n  value?: string;\n  /** Where the value came from; `ambient` means the transport's own chain signs. */\n  source: \"env\" | \"cmd\" | \"platform\" | \"keyring\" | \"ambient\" | \"none\";\n  /** Why there is no value. Secret-free. */\n  error?: string;\n}\n\n/** `cmd:` results are cached per process, matching omp's `!cmd` semantics. */\nconst commandCache = new Map<string, string>();\n\n/** Test seam — drops the memoized `cmd:` results. */\nexport function __resetCredentialCommandCache(): void {\n  commandCache.clear();\n}\n\nconst COMMAND_TIMEOUT_MS = 10_000;\n\n/**\n * Resolve an entry's credential to a value (§1.4).\n *\n * `env:` reads the environment, `cmd:` runs a shell (10 s, trimmed stdout,\n * cached per process), `platform:` reads the injected secrets map. `keyring:`\n * is a reserved grammar slot: it validates but does not resolve, and says so.\n *\n * `sigv4`, `google_adc` and `azure_entra` entries without a ref resolve to\n * `source: \"ambient\"` with no value — the AWS/Google/Azure SDK chain signs the\n * request, there is nothing for this function to hand over.\n */\nexport function resolveCredential(\n  entry: AIProviderEntry,\n  options: ResolveCredentialOptions = {},\n): ResolvedAIProviderCredential {\n  const credential = entry.credential;\n  if (!credential || credential.kind === \"none\") {\n    return { kind: credential?.kind ?? \"none\", source: \"none\" };\n  }\n  const kind = credential.kind;\n  if (!credential.ref) {\n    if (kind === \"sigv4\" || kind === \"google_adc\" || kind === \"azure_entra\") {\n      return { kind, source: \"ambient\" };\n    }\n    return { kind, source: \"none\", error: `credential.ref is missing for kind '${kind}'` };\n  }\n\n  const parsed = parseCredentialRef(credential.ref);\n  if (!parsed) {\n    return { kind, source: \"none\", error: \"credential.ref is not a valid reference\" };\n  }\n\n  switch (parsed.form) {\n    case \"env\": {\n      const env = options.env ?? process.env;\n      const value = env[parsed.name];\n      if (!value) {\n        return { kind, source: \"env\", error: `environment variable ${parsed.name} is not set` };\n      }\n      return { kind, source: \"env\", value };\n    }\n    case \"platform\": {\n      const value = options.secrets?.[parsed.configId];\n      if (!value) {\n        return {\n          kind,\n          source: \"platform\",\n          error: `no control-plane secret was injected for '${parsed.configId}'`,\n        };\n      }\n      return { kind, source: \"platform\", value };\n    }\n    case \"cmd\": {\n      if (options.allowCommand === false) {\n        return { kind, source: \"cmd\", error: \"cmd: references are not permitted in this context\" };\n      }\n      const cached = commandCache.get(parsed.command);\n      if (cached !== undefined) return { kind, source: \"cmd\", value: cached };\n      const argv =\n        process.platform === \"win32\"\n          ? [\"cmd\", \"/c\", parsed.command]\n          : [\"/bin/sh\", \"-c\", parsed.command];\n      const result = portableSpawnSync(argv, { timeoutMs: COMMAND_TIMEOUT_MS });\n      if (result.timedOut) {\n        return { kind, source: \"cmd\", error: `credential command timed out after 10s` };\n      }\n      if (result.exitCode !== 0) {\n        return { kind, source: \"cmd\", error: `credential command exited ${result.exitCode}` };\n      }\n      const value = result.stdout.trim();\n      if (!value) return { kind, source: \"cmd\", error: \"credential command produced no output\" };\n      commandCache.set(parsed.command, value);\n      return { kind, source: \"cmd\", value };\n    }\n    case \"keyring\":\n      return {\n        kind,\n        source: \"keyring\",\n        error:\n          `keyring references are a reserved grammar slot — ` +\n          `no OS keychain backend ships yet (use env: or cmd:)`,\n      };\n  }\n}\n"]}
+{"version":3,"sources":["../core/src/subprocess.ts","../core/src/provider-registry-credentials.ts"],"names":[],"mappings":";;;;;AAsEO,SAAS,aAAA,CAAc,GAAA,EAAe,IAAA,GAA6B,EAAC,EAAuB;AAChG,EAAA,MAAM,CAAC,GAAA,EAAK,GAAG,IAAI,CAAA,GAAI,GAAA;AACvB,EAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,MAAM,8BAA8B,CAAA;AACxD,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,EAAK,IAAA,EAAM;AAAA,IAC7B,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,GAAA,EAAK,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA;AAAA,IACzB,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,IAChC,UAAU,IAAA,CAAK;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAgB,CAAC,OAAA,KAAY;AAC9C,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,EAAM,MAAA,KAAW;AAClC,MAAA,IAAI,SAAS,IAAA,EAAM;AACjB,QAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,QAAA;AAAA,MACF;AACA,MAAA,MAAM,YAAA,GAAe,MAAA,GAAS,SAAA,CAAU,OAAA,CAAQ,MAAM,CAAA,GAAI,MAAA;AAC1D,MAAA,OAAA,CAAQ,YAAA,KAAiB,MAAA,GAAY,EAAA,GAAK,GAAA,GAAM,YAAY,CAAA;AAAA,IAC9D,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,MAAM,OAAA,CAAQ,EAAE,CAAC,CAAA;AAAA,EACrC,CAAC,CAAA;AACD,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,MAAM,GAAA,IAAO,EAAA;AAAA,IAClB,MAAA,EAAQ,QAAA,CAAS,KAAA,CAAM,KAAA,CAAM,MAAkB,CAAA;AAAA,IAC/C,MAAA,EAAQ,QAAA,CAAS,KAAA,CAAM,KAAA,CAAM,MAAkB,CAAA;AAAA,IAC/C,MAAA;AAAA,IACA,IAAA,EAAM,CAAC,MAAA,KAAW;AAChB,MAAA,IAAI,IAAA,CAAK,QAAA,IAAY,KAAA,CAAM,GAAA,EAAK;AAC9B,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,MAAM,CAAA;AAC/B,UAAA;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AACA,MAAA,KAAA,CAAM,KAAK,MAAM,CAAA;AAAA,IACnB;AAAA,GACF;AACF;AAmBO,SAAS,iBAAA,CACd,KACA,IAAA,EACyB;AACzB,EAAA,MAAM,CAAC,GAAA,EAAK,GAAG,IAAI,CAAA,GAAI,GAAA;AACvB,EAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAC5D,EAAA,IAAI,EAAE,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI;AACzB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8CAAA,EAAiD,IAAA,CAAK,SAAS,CAAA,CAAA,CAAG,CAAA;AAAA,EACpF;AACA,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,EAAK,IAAA,EAAM;AAAA,IAClC,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,GAAA,EAAK,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA;AAAA,IACzB,QAAA,EAAU,MAAA;AAAA,IACV,SAAS,IAAA,CAAK,SAAA;AAAA,IACd,UAAA,EAAY;AAAA,GACb,CAAA;AAGD,EAAA,MAAM,QAAA,GACH,OAAO,KAAA,EAA6C,IAAA,KAAS,eAC7D,MAAA,CAAO,MAAA,KAAW,IAAA,IAAQ,MAAA,CAAO,MAAA,KAAW,SAAA;AAC/C,EAAA,IAAI,MAAA,GAAS,OAAO,MAAA,IAAU,EAAA;AAC9B,EAAA,IAAI,QAAA,EAAU;AAGZ,IAAA,MAAA,IAAU,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,IAAK,MAAA,KAAW,EAAA,GAAK,EAAA,GAAK,IAAI,CAAA,EAAG,GAAG,CAAA,kBAAA,EAAqB,KAAK,SAAS,CAAA;AAAA,CAAA;AAAA,EAC1G;AACA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,OAAO,MAAA,IAAU,EAAA;AAAA,IAC3B,MAAA,EAAQ,OAAO,MAAA,IAAU,EAAA;AAAA,IACzB,MAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACrHA,IAAM,YAAA,uBAAmB,GAAA,EAAoB;AAGtC,SAAS,6BAAA,GAAsC;AACpD,EAAA,YAAA,CAAa,KAAA,EAAM;AACrB;AAEA,IAAM,kBAAA,GAAqB,GAAA;AAapB,SAAS,iBAAA,CACd,KAAA,EACA,OAAA,GAAoC,EAAC,EACP;AAC9B,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,CAAC,UAAA,IAAc,UAAA,CAAW,IAAA,KAAS,MAAA,EAAQ;AAC7C,IAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,IAAA,IAAQ,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,EAC5D;AACA,EAAA,MAAM,OAAO,UAAA,CAAW,IAAA;AACxB,EAAA,IAAI,CAAC,WAAW,GAAA,EAAK;AACnB,IAAA,IAAI,IAAA,KAAS,OAAA,IAAW,IAAA,KAAS,YAAA,IAAgB,SAAS,aAAA,EAAe;AACvE,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAU;AAAA,IACnC;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAQ,KAAA,EAAO,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAA,CAAA,EAAI;AAAA,EACvF;AAEA,EAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA;AAChD,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,OAAO,yCAAA,EAA0C;AAAA,EAClF;AAEA,EAAA,QAAQ,OAAO,IAAA;AAAM,IACnB,KAAK,KAAA,EAAO;AACV,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ,GAAA;AACnC,MAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA;AAC7B,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,OAAO,EAAE,MAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA,qBAAA,EAAwB,MAAA,CAAO,IAAI,CAAA,WAAA,CAAA,EAAc;AAAA,MACxF;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,KAAA,EAAM;AAAA,IACtC;AAAA,IACA,KAAK,UAAA,EAAY;AACf,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,GAAU,MAAA,CAAO,QAAQ,CAAA;AAC/C,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,OAAO;AAAA,UACL,IAAA;AAAA,UACA,MAAA,EAAQ,UAAA;AAAA,UACR,KAAA,EAAO,CAAA,0CAAA,EAA6C,MAAA,CAAO,QAAQ,CAAA,CAAA;AAAA,SACrE;AAAA,MACF;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,KAAA,EAAM;AAAA,IAC3C;AAAA,IACA,KAAK,KAAA,EAAO;AACV,MAAA,IAAI,OAAA,CAAQ,iBAAiB,KAAA,EAAO;AAClC,QAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,mDAAA,EAAoD;AAAA,MAC3F;AACA,MAAA,MAAM,MAAA,GAAS,YAAA,CAAa,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA;AAC9C,MAAA,IAAI,MAAA,KAAW,QAAW,OAAO,EAAE,MAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,MAAA,EAAO;AACtE,MAAA,MAAM,IAAA,GACJ,OAAA,CAAQ,QAAA,KAAa,OAAA,GACjB,CAAC,KAAA,EAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA,GAC5B,CAAC,SAAA,EAAW,IAAA,EAAM,OAAO,OAAO,CAAA;AACtC,MAAA,MAAM,SAAS,iBAAA,CAAkB,IAAA,EAAM,EAAE,SAAA,EAAW,oBAAoB,CAAA;AACxE,MAAA,IAAI,OAAO,QAAA,EAAU;AACnB,QAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA,sCAAA,CAAA,EAAyC;AAAA,MAChF;AACA,MAAA,IAAI,MAAA,CAAO,aAAa,CAAA,EAAG;AACzB,QAAA,OAAO,EAAE,MAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA,0BAAA,EAA6B,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAG;AAAA,MACtF;AACA,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,IAAA,EAAK;AACjC,MAAA,IAAI,CAAC,OAAO,OAAO,EAAE,MAAM,MAAA,EAAQ,KAAA,EAAO,OAAO,uCAAA,EAAwC;AACzF,MAAA,YAAA,CAAa,GAAA,CAAI,MAAA,CAAO,OAAA,EAAS,KAAK,CAAA;AACtC,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,KAAA,EAAM;AAAA,IACtC;AAAA,IACA,KAAK,SAAA;AACH,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,MAAA,EAAQ,SAAA;AAAA,QACR,KAAA,EACE,CAAA,yGAAA;AAAA,OAEJ;AAAA;AAEN","file":"chunk-ADPM6AYF.js","sourcesContent":["/**\n * Runtime-portable subprocess spawning.\n *\n * `node:child_process` is implemented by both Node and Bun, so it is the\n * portable choice — no runtime detection needed (unlike embedded SQLite,\n * which has no shared API; see `logging/sinks/sqlite-runtime.ts`).\n *\n * These helpers wrap `node:child_process` to present a `Bun.Subprocess`-shaped\n * result — web `ReadableStream` stdio plus an `exited` promise — so call sites\n * migrated off `Bun.spawn` keep their stream-reading code unchanged.\n */\nimport { spawn, spawnSync } from \"node:child_process\";\nimport { constants } from \"node:os\";\nimport { Readable } from \"node:stream\";\n\nexport interface PortableSpawnOptions {\n  cwd?: string;\n  env?: Record<string, string | undefined>;\n  detached?: boolean;\n}\n\n/**\n * Options for {@link portableSpawnSync}.\n *\n * `timeoutMs` is **required**, and deliberately so. A synchronous spawn blocks\n * the single-threaded event loop until the child exits; if the child stalls —\n * classically on a wedged network/FUSE mount reachable from `cwd` — the whole\n * process stops serving. An unbounded `spawnSync` is therefore not a call that\n * should be expressible, so the deadline is part of the type rather than an\n * optional extra a caller can forget.\n */\nexport interface PortableSpawnSyncOptions extends PortableSpawnOptions {\n  /** Wall-clock limit for the child, in milliseconds. Must be > 0. */\n  timeoutMs: number;\n}\n\n/** A spawned process with stdout/stderr piped. Mirrors the shape of `Bun.Subprocess`. */\nexport interface PortableSubprocess {\n  /** OS process id, or -1 if the process failed to spawn. */\n  readonly pid: number;\n  readonly stdout: ReadableStream<Uint8Array>;\n  readonly stderr: ReadableStream<Uint8Array>;\n  /**\n   * Resolves with the exit code once the process closes. Signal termination\n   * uses the conventional `128 + signal number`; spawn errors or unknown\n   * signals use `-1`.\n   */\n  readonly exited: Promise<number>;\n  kill(signal?: number | NodeJS.Signals): void;\n}\n\nexport interface PortableSpawnSyncResult {\n  /** Exit code; -1 when the process did not exit cleanly. */\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n  /**\n   * `true` when the child was killed for exceeding\n   * {@link PortableSpawnSyncOptions.timeoutMs}. Lets a caller tell \"the command\n   * failed\" apart from \"the command never finished\", which are different\n   * operational events.\n   */\n  timedOut: boolean;\n}\n\n/**\n * Spawn a subprocess with stdout/stderr piped. Works under Node and Bun.\n *\n * @param cmd - Command and arguments, e.g. `[\"docker\", \"ps\"]`.\n */\nexport function portableSpawn(cmd: string[], opts: PortableSpawnOptions = {}): PortableSubprocess {\n  const [bin, ...args] = cmd;\n  if (!bin) throw new Error(\"portableSpawn: empty command\");\n  const child = spawn(bin, args, {\n    cwd: opts.cwd,\n    env: opts.env ?? process.env,\n    stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    detached: opts.detached,\n  });\n  const exited = new Promise<number>((resolve) => {\n    child.on(\"close\", (code, signal) => {\n      if (code !== null) {\n        resolve(code);\n        return;\n      }\n      const signalNumber = signal ? constants.signals[signal] : undefined;\n      resolve(signalNumber === undefined ? -1 : 128 + signalNumber);\n    });\n    child.on(\"error\", () => resolve(-1));\n  });\n  return {\n    pid: child.pid ?? -1,\n    stdout: Readable.toWeb(child.stdout as Readable) as unknown as ReadableStream<Uint8Array>,\n    stderr: Readable.toWeb(child.stderr as Readable) as unknown as ReadableStream<Uint8Array>,\n    exited,\n    kill: (signal) => {\n      if (opts.detached && child.pid) {\n        try {\n          process.kill(-child.pid, signal);\n          return;\n        } catch {\n          /* fall back to killing the direct child */\n        }\n      }\n      child.kill(signal);\n    },\n  };\n}\n\n/**\n * Run a subprocess to completion synchronously, capturing stdout/stderr as\n * UTF-8 strings. Works under Node and Bun.\n *\n * Blocks the event loop for the child's whole lifetime, so `opts.timeoutMs`\n * is required — see {@link PortableSpawnSyncOptions}. Prefer\n * {@link portableSpawn} wherever an async call is possible; only reach for this\n * when the caller genuinely cannot await (process teardown, CLI entry points).\n *\n * The child is killed with `SIGKILL` rather than `SIGTERM` on expiry: a process\n * blocked in an uninterruptible kernel wait (`D` state, e.g. a dead FUSE\n * connection) never runs a `SIGTERM` handler, so a graceful signal would leave\n * the deadline unenforced.\n *\n * @param cmd - Command and arguments, e.g. `[\"docker\", \"info\"]`.\n * @param opts - Spawn options; `timeoutMs` is mandatory.\n */\nexport function portableSpawnSync(\n  cmd: string[],\n  opts: PortableSpawnSyncOptions,\n): PortableSpawnSyncResult {\n  const [bin, ...args] = cmd;\n  if (!bin) throw new Error(\"portableSpawnSync: empty command\");\n  if (!(opts.timeoutMs > 0)) {\n    throw new Error(`portableSpawnSync: timeoutMs must be > 0 (got ${opts.timeoutMs})`);\n  }\n  const result = spawnSync(bin, args, {\n    cwd: opts.cwd,\n    env: opts.env ?? process.env,\n    encoding: \"utf8\",\n    timeout: opts.timeoutMs,\n    killSignal: \"SIGKILL\",\n  });\n  // Node reports the expiry as `error.code === \"ETIMEDOUT\"`; Bun surfaces the\n  // same case as a SIGKILL with no status, so accept either signal.\n  const timedOut =\n    (result.error as NodeJS.ErrnoException | undefined)?.code === \"ETIMEDOUT\" ||\n    (result.status === null && result.signal === \"SIGKILL\");\n  let stderr = result.stderr ?? \"\";\n  if (timedOut) {\n    // Surface the reason on the channel every caller already inspects — an\n    // exitCode of -1 alone reads as \"command failed\" and hides the stall.\n    stderr += `${stderr.endsWith(\"\\n\") || stderr === \"\" ? \"\" : \"\\n\"}${bin}: timed out after ${opts.timeoutMs}ms\\n`;\n  }\n  return {\n    exitCode: result.status ?? -1,\n    stdout: result.stdout ?? \"\",\n    stderr,\n    timedOut,\n  };\n}\n","/**\n * Credential resolution for registry entries (§1.4).\n *\n * Split from `provider-registry.ts` deliberately: resolving a `cmd:` reference\n * spawns a process and `env:` reads `process.env`, so this module depends on\n * Node. The schema module must stay dependency-free because browser bundles\n * (`@skaile/workspace-bridge-react`) reach the registry *types* through\n * `@skaile/workspaces/types`, and a `node:child_process` import in that graph\n * breaks their typecheck.\n *\n * @see PROVIDER-CONFIG-PLAN.md §1.4\n */\n\nimport type { AIProviderCredentialKind, AIProviderEntry } from \"./provider-registry.js\";\nimport { parseCredentialRef } from \"./provider-registry.js\";\nimport { portableSpawnSync } from \"./subprocess.js\";\n\n/** Options for {@link resolveCredential}. */\nexport interface ResolveCredentialOptions {\n  /** Environment `env:` refs read from; defaults to `process.env`. */\n  env?: Record<string, string | undefined>;\n  /**\n   * Control-plane secrets, keyed by config id (a `platform:<configId>` ref) —\n   * the `secrets` map that rides alongside `session_init`.\n   */\n  secrets?: Record<string, string>;\n  /** Run `cmd:` references. Default `true`; the platform sets it `false`. */\n  allowCommand?: boolean;\n}\n\n/** Outcome of {@link resolveCredential}. Never carries the secret in `error`. */\nexport interface ResolvedAIProviderCredential {\n  kind: AIProviderCredentialKind;\n  /** The secret, when one was produced. */\n  value?: string;\n  /** Where the value came from; `ambient` means the transport's own chain signs. */\n  source: \"env\" | \"cmd\" | \"platform\" | \"keyring\" | \"ambient\" | \"none\";\n  /** Why there is no value. Secret-free. */\n  error?: string;\n}\n\n/** `cmd:` results are cached per process, matching omp's `!cmd` semantics. */\nconst commandCache = new Map<string, string>();\n\n/** Test seam — drops the memoized `cmd:` results. */\nexport function __resetCredentialCommandCache(): void {\n  commandCache.clear();\n}\n\nconst COMMAND_TIMEOUT_MS = 10_000;\n\n/**\n * Resolve an entry's credential to a value (§1.4).\n *\n * `env:` reads the environment, `cmd:` runs a shell (10 s, trimmed stdout,\n * cached per process), `platform:` reads the injected secrets map. `keyring:`\n * is a reserved grammar slot: it validates but does not resolve, and says so.\n *\n * `sigv4`, `google_adc` and `azure_entra` entries without a ref resolve to\n * `source: \"ambient\"` with no value — the AWS/Google/Azure SDK chain signs the\n * request, there is nothing for this function to hand over.\n */\nexport function resolveCredential(\n  entry: AIProviderEntry,\n  options: ResolveCredentialOptions = {},\n): ResolvedAIProviderCredential {\n  const credential = entry.credential;\n  if (!credential || credential.kind === \"none\") {\n    return { kind: credential?.kind ?? \"none\", source: \"none\" };\n  }\n  const kind = credential.kind;\n  if (!credential.ref) {\n    if (kind === \"sigv4\" || kind === \"google_adc\" || kind === \"azure_entra\") {\n      return { kind, source: \"ambient\" };\n    }\n    return { kind, source: \"none\", error: `credential.ref is missing for kind '${kind}'` };\n  }\n\n  const parsed = parseCredentialRef(credential.ref);\n  if (!parsed) {\n    return { kind, source: \"none\", error: \"credential.ref is not a valid reference\" };\n  }\n\n  switch (parsed.form) {\n    case \"env\": {\n      const env = options.env ?? process.env;\n      const value = env[parsed.name];\n      if (!value) {\n        return { kind, source: \"env\", error: `environment variable ${parsed.name} is not set` };\n      }\n      return { kind, source: \"env\", value };\n    }\n    case \"platform\": {\n      const value = options.secrets?.[parsed.configId];\n      if (!value) {\n        return {\n          kind,\n          source: \"platform\",\n          error: `no control-plane secret was injected for '${parsed.configId}'`,\n        };\n      }\n      return { kind, source: \"platform\", value };\n    }\n    case \"cmd\": {\n      if (options.allowCommand === false) {\n        return { kind, source: \"cmd\", error: \"cmd: references are not permitted in this context\" };\n      }\n      const cached = commandCache.get(parsed.command);\n      if (cached !== undefined) return { kind, source: \"cmd\", value: cached };\n      const argv =\n        process.platform === \"win32\"\n          ? [\"cmd\", \"/c\", parsed.command]\n          : [\"/bin/sh\", \"-c\", parsed.command];\n      const result = portableSpawnSync(argv, { timeoutMs: COMMAND_TIMEOUT_MS });\n      if (result.timedOut) {\n        return { kind, source: \"cmd\", error: `credential command timed out after 10s` };\n      }\n      if (result.exitCode !== 0) {\n        return { kind, source: \"cmd\", error: `credential command exited ${result.exitCode}` };\n      }\n      const value = result.stdout.trim();\n      if (!value) return { kind, source: \"cmd\", error: \"credential command produced no output\" };\n      commandCache.set(parsed.command, value);\n      return { kind, source: \"cmd\", value };\n    }\n    case \"keyring\":\n      return {\n        kind,\n        source: \"keyring\",\n        error:\n          `keyring references are a reserved grammar slot — ` +\n          `no OS keychain backend ships yet (use env: or cmd:)`,\n      };\n  }\n}\n"]}

package/dist/{chunk-Y5MBW5EU.js → chunk-AF432MS3.js}

@@ -1,5 +1,5 @@
 import { decodeBearerFromHeader, tokensEqual } from './chunk-32NA4TVC.js';
-import { listenWithProbe } from './chunk-N46LQR46.js';
+import { listenWithProbe } from './chunk-L4YKW5AY.js';
 import { createServer } from 'http';
 import { WebSocketServer } from 'ws';
 
@@ -256,5 +256,5 @@ var WebSocketServerTransport = class {
 };
 
 export { WebSocketServerTransport };
-//# sourceMappingURL=chunk-Y5MBW5EU.js.map
-//# sourceMappingURL=chunk-Y5MBW5EU.js.map
+//# sourceMappingURL=chunk-AF432MS3.js.map
+//# sourceMappingURL=chunk-AF432MS3.js.map

package/dist/{chunk-Y5MBW5EU.js.map → chunk-AF432MS3.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../transport/src/ws/server.ts"],"names":[],"mappings":";;;;;AAiDA,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,wBAAA,GAA2B,CAAA;AAkBjC,SAAS,yBAAyB,GAAA,EAA6C;AAC7E,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB,OAAO,6BAAA;AAExC,EAAA,MAAM,WAAW,GAAA,CAAI,QAAA;AACrB,EAAA,IAAI,CAAC,YAAY,OAAO,QAAA,KAAa,YAAY,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxE,IAAA,OAAO,4BAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,WAAA,KAAgB,QAAA,EAAU,OAAO,uCAAA;AACrD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AACnD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AAEnD,EAAA,MAAM,kBAAkB,GAAA,CAAI,eAAA;AAC5B,EAAA,IAAI,CAAC,mBAAmB,OAAO,eAAA,KAAoB,YAAY,KAAA,CAAM,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC7F,IAAA,OAAO,mCAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AAEtD,EAAA,IACE,CAAC,GAAA,CAAI,cAAA,IACL,OAAO,GAAA,CAAI,cAAA,KAAmB,QAAA,IAC9B,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAChC;AACA,IAAA,OAAO,kCAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,GAAA,CAAI,WAAA,IAAe,OAAO,GAAA,CAAI,WAAA,KAAgB,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAC7F,IAAA,OAAO,+BAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAyBO,IAAM,2BAAN,MAA0D;AAAA,EACvD,UAAA,GAAgC,IAAA;AAAA,EAChC,GAAA,GAA8B,IAAA;AAAA,EAC9B,YAAA,GAAiC,IAAA;AAAA,EACxB,IAAA;AAAA,EACA,GAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EAEA,WAAA;AAAA,EACA,eAAA,uBAAsB,GAAA,EAAqC;AAAA,EAC3D,eAAA,uBAAsB,GAAA,EAAgB;AAAA,EACtC,kBAAA,uBAAyB,GAAA,EAAgB;AAAA,EAE1D,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA;AACpC,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAC3B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC1C,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,cAAA,IAAkB,wBAAA;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,MAAA,GAAwB;AAC5B,IAAA,MAAM,UAAA,GAAa,YAAA,CAAa,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC7C,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,cAAc,CAAA;AACnD,MAAA,GAAA,CAAI,IAAI,qBAAqB,CAAA;AAAA,IAC/B,CAAC,CAAA;AAKD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA;AACtB,IAAA,MAAM,GAAA,GAAM,IAAI,eAAA,CAAgB;AAAA,MAC9B,MAAA,EAAQ,UAAA;AAAA,MACR,YAAA,EAAc,QAAA,GACV,CAAC,IAAA,EAAM,EAAA,KAAO;AACZ,QAAA,MAAM,YAAY,sBAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,wBAAwB,CAAC,CAAA;AACnF,QAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,WAAA,CAAY,SAAA,EAAW,QAAQ,CAAA,EAAG;AAC1D,UAAA,EAAA,CAAG,IAAI,CAAA;AAAA,QACT,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,IAAI,+CAA+C,CAAA;AACxD,UAAA,EAAA,CAAG,KAAA,EAAO,KAAK,cAAc,CAAA;AAAA,QAC/B;AAAA,MACF,CAAA,GACA;AAAA,KACL,CAAA;AACD,IAAA,GAAA,CAAI,GAAG,YAAA,EAAc,CAAC,OAAO,IAAA,CAAK,gBAAA,CAAiB,EAAE,CAAC,CAAA;AAItD,IAAA,MAAM,mBAAmB,MAAM;AAAA,IAAC,CAAA;AAChC,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,gBAAgB,CAAA;AAChC,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAEX,IAAA,IAAI;AACF,MAAA,MAAM,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAA,EAAM,KAAK,IAAI,CAAA;AAAA,IACxD,SAAS,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,KAAA,EAAM;AACV,MAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,MAAA,IAAI,eAAe,KAAA,IAAS,MAAA,IAAU,GAAA,IAAO,GAAA,CAAI,SAAS,YAAA,EAAc;AACtE,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,GAAK,CAAA,KAAA,EAAQ,IAAA,CAAK,IAAI,CAAA,CAAA;AACzE,QAAA,MAAM,MAAA,CAAO,MAAA;AAAA,UACX,IAAI,KAAA;AAAA,YACF,GAAG,KAAK,CAAA,qEAAA;AAAA,WACV;AAAA,UACA,EAAE,MAAM,YAAA;AAAa,SACvB;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,SAAS,gBAAgB,CAAA;AAAA,IACnC;AAEA,IAAA,MAAM,IAAA,GAAO,WAAW,OAAA,EAAQ;AAChC,IAAA,MAAM,YAAY,OAAO,IAAA,KAAS,YAAY,IAAA,GAAO,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACtE,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,gBAAA;AAC1B,IAAA,IAAA,CAAK,GAAA;AAAA,MACH,CAAA,8BAAA,EAAiC,SAAS,CAAA,EAAA,EAAK,IAAI,KAAK,IAAA,CAAK,SAAA,GAAY,mBAAmB,mBAAmB,CAAA,CAAA;AAAA,KACjH;AAEA,IAAA,MAAM,OAAA,GACJ,CAAC,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,SAAA,IAAa,IAAA,CAAK,IAAA,KAAS,IAAA,GACnD,WAAA,GACA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAClD,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,CAAA,GACb,IAAA,CAAK,IAAA;AACb,IAAA,IAAA,CAAK,WAAA,GAAc;AAAA,MACjB,GAAA,EAAK,CAAA,KAAA,EAAQ,OAAO,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AAAA,MACjC,IAAA,EAAM,SAAA;AAAA,MACN,aAAA,EAAe,KAAK,SAAA,KAAc;AAAA,KACnC,CAAA;AAAA,EACH;AAAA,EAEQ,iBAAiB,EAAA,EAAqB;AAC5C,IAAA,IAAI,KAAK,YAAA,EAAc;AAIrB,MAAA,IAAA,CAAK,IAAI,2CAA2C,CAAA;AACpD,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,IAAA,EAAM,4BAA4B,CAAA;AAAA,MAC5D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,IAAI,8BAA8B,CAAA;AACvC,IAAA,IAAA,CAAK,YAAA,GAAe,EAAA;AACpB,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,MAAA,OAAA,EAAQ;AAAA,IACV;AAEA,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,cAAA,CAAe,EAAE,CAAA;AAE5C,IAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAS;AACzB,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAC,CAAA;AAKtC,QAAA,IAAI,UAAU,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,SAAS,cAAA,EAAgB;AAC1E,UAAA,MAAM,MAAA,GAAS,yBAAyB,MAAM,CAAA;AAC9C,UAAA,IAAI,WAAW,IAAA,EAAM;AACnB,YAAA,IAAA,CAAK,GAAA,CAAI,CAAA,4CAAA,EAA+C,MAAM,CAAA,CAAE,CAAA;AAChE,YAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,cACX,IAAA,EAAM,OAAA;AAAA,cACN,OAAA,EAAS,yBAAyB,MAAM,CAAA,CAAA;AAAA,cACxC,KAAA,EAAO;AAAA,aACR,CAAA;AACD,YAAA;AAAA,UACF;AAAA,QACF;AACA,QAAA,MAAM,GAAA,GAAM,MAAA;AACZ,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,UAAA,OAAA,CAAQ,GAAG,CAAA;AAAA,QACb;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,UACX,IAAA,EAAM,OAAA;AAAA,UACN,OAAA,EAAS,oBAAoB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,UAC7E,KAAA,EAAO;AAAA,SACR,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,MAAA,aAAA,EAAc;AACd,MAAA,IAAA,CAAK,IAAI,iCAAiC,CAAA;AAC1C,MAAA,IAAI,IAAA,CAAK,iBAAiB,EAAA,EAAI;AAC5B,QAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,kBAAA,EAAoB;AAC7C,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,EAAA,EAA2B;AAChD,IAAA,IAAI,IAAA,CAAK,cAAA,IAAkB,CAAA,EAAG,OAAO,MAAM;AAAA,IAAC,CAAA;AAC5C,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,MAAM,YAAY,MAAM;AACtB,MAAA,MAAA,GAAS,CAAA;AAAA,IACX,CAAA;AACA,IAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,SAAS,CAAA;AACvB,IAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,YAAY,MAAM;AAC9B,MAAA,IAAI,EAAA,CAAG,UAAA,KAAe,EAAA,CAAG,IAAA,EAAM;AAC/B,MAAA,IAAI,MAAA,IAAU,KAAK,cAAA,EAAgB;AACjC,QAAA,IAAA,CAAK,GAAA;AAAA,UACH,CAAA,wBAAA,EAA2B,MAAM,CAAA,eAAA,EAAkB,IAAA,CAAK,WAAW,CAAA,sBAAA;AAAA,SACrE;AACA,QAAA,aAAA,CAAc,KAAK,CAAA;AACnB,QAAA,EAAA,CAAG,SAAA,EAAU;AACb,QAAA;AAAA,MACF;AACA,MAAA,MAAA,EAAA;AACA,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,IAAA,EAAK;AAAA,MACV,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA,EAAG,KAAK,WAAW,CAAA;AACnB,IAAA,KAAA,CAAM,KAAA,IAAQ;AACd,IAAA,OAAO,MAAM,cAAc,KAAK,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAc,SAAA,EAAU;AAAA,IAC/B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,KAAK,KAAA,EAAM;AAChB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,IAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,UAAA,CAAW,mBAAA,EAAoB;AAC/B,MAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,KAAA,CAAM,MAAM,OAAA,EAAS,CAAC,CAAA;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,KAAK,KAAA,EAAyB;AAC5B,IAAA,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,EACpB;AAAA,EAEA,UAAU,OAAA,EAAsD;AAC9D,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,UAAU,OAAA,EAAiC;AACzC,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,aAAa,OAAA,EAAiC;AAC5C,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAI,OAAO,CAAA;AACnC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,kBAAA,CAAmB,OAAO,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,EACF;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,KAAK,YAAA,KAAiB,IAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,IAAI,SAAA,GAAgC;AAClC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,OAAA,EAAQ;AACtC,IAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,GAAO,KAAK,IAAA,GAAO,MAAA;AAAA,EACxD;AAAA,EAEQ,QAAQ,IAAA,EAAqB;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AACpB,MAAA,IAAI,MAAA,IAAU,MAAA,CAAO,UAAA,KAAe,CAAA,EAAG;AACrC,QAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-Y5MBW5EU.js","sourcesContent":["/**\n * WebSocketServerTransport — `ws`-based WebSocket server.\n *\n * Accepts one client at a time. Implements ServerTransport from @skaile/workspaces/types.\n * Built on the `ws` package + `node:http`, both of which run under Node and Bun.\n */\n\nimport { createServer, type Server as HttpServer } from \"node:http\";\nimport { listenWithProbe } from \"@skaile/workspaces/core\";\nimport type { AgentCommand, AgentEvent, ServerTransport } from \"@skaile/workspaces/types\";\nimport { type WebSocket, WebSocketServer } from \"ws\";\nimport { decodeBearerFromHeader, tokensEqual } from \"./auth.js\";\n\n/** @deprecated Moved to `@skaile/workspaces/core`, where `portIsHeld` replaces it. */\nexport { needsWildcardProbe } from \"@skaile/workspaces/core\";\n\n/**\n * Options for {@link WebSocketServerTransport}.\n *\n * @param port - TCP port to bind to; `0` picks a free port (read it back via `boundPort`).\n * @param onLog - Optional callback for internal log lines (client connect/disconnect events).\n * @param host - Address to bind. Default: every interface (Node's unspecified address).\n *   `127.0.0.1` accepts local clients only.\n * @param authToken - When set, every upgrade must present this token via the\n *   `skaile-bearer.<base64url>` subprotocol or the handshake is rejected with\n *   HTTP 401. When unset, no auth is enforced (back-compatible default).\n * @param onListening - Called once the socket is bound, with the address a client\n *   connects to (`url`) and whether it needs a token. For a plain-text ready line\n *   (the `onLog` record carries the port only inside a log sentence).\n * @param heartbeatMs - Interval in milliseconds between pings to the active\n *   client. Default: 30 000.\n * @param maxMissedPongs - Heartbeat ticks the client may go without a pong (or\n *   any inbound frame) before its socket is terminated, so a client lost behind a\n *   dead path (no FIN) fires `onDisconnect` instead of swallowing every event\n *   sent to it. Default: 2, i.e. detection within 3 x `heartbeatMs`. `0` turns\n *   the heartbeat off. Every WebSocket client answers pings on its own.\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport interface WebSocketServerOptions {\n  port: number;\n  host?: string;\n  onLog?: (line: string) => void;\n  authToken?: string;\n  onListening?: (info: { url: string; port: number; tokenRequired: boolean }) => void;\n  heartbeatMs?: number;\n  maxMissedPongs?: number;\n}\n\nconst DEFAULT_HEARTBEAT_MS = 30_000;\nconst DEFAULT_MAX_MISSED_PONGS = 2;\n\n/**\n * Shape-validate a `session_init` frame at ingress before forwarding to the\n * runner. Protocol v3 requires the deterministic bootstrap envelope to carry\n * an identity tuple, a semver-shaped `protocolVersion`, a resolved config\n * object, and a `credentials` map keyed by `mounts` / `connectors`. Frames\n * that fail the guard are rejected on the wire so the runner never sees a\n * malformed boot envelope.\n *\n * Returns `null` when the frame is well-formed, or a human-readable reason\n * when it should be rejected.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`\n * § \"SessionInitCommand schema\".\n *\n * @internal\n */\nfunction validateSessionInitShape(cmd: Record<string, unknown>): string | null {\n  if (cmd.type !== \"session_init\") return \"type must be 'session_init'\";\n\n  const identity = cmd.identity as Record<string, unknown> | undefined;\n  if (!identity || typeof identity !== \"object\" || Array.isArray(identity)) {\n    return \"identity must be an object\";\n  }\n  if (typeof identity.containerId !== \"string\") return \"identity.containerId must be a string\";\n  if (typeof identity.sessionId !== \"string\") return \"identity.sessionId must be a string\";\n  if (typeof identity.projectId !== \"string\") return \"identity.projectId must be a string\";\n\n  const protocolVersion = cmd.protocolVersion as Record<string, unknown> | undefined;\n  if (!protocolVersion || typeof protocolVersion !== \"object\" || Array.isArray(protocolVersion)) {\n    return \"protocolVersion must be an object\";\n  }\n  if (typeof protocolVersion.major !== \"number\") return \"protocolVersion.major must be a number\";\n  if (typeof protocolVersion.minor !== \"number\") return \"protocolVersion.minor must be a number\";\n  if (typeof protocolVersion.patch !== \"number\") return \"protocolVersion.patch must be a number\";\n\n  if (\n    !cmd.resolvedConfig ||\n    typeof cmd.resolvedConfig !== \"object\" ||\n    Array.isArray(cmd.resolvedConfig)\n  ) {\n    return \"resolvedConfig must be an object\";\n  }\n\n  if (!cmd.credentials || typeof cmd.credentials !== \"object\" || Array.isArray(cmd.credentials)) {\n    return \"credentials must be an object\";\n  }\n\n  return null;\n}\n\n/**\n * `ServerTransport` implementation backed by the `ws` package on top of a\n * `node:http` server.\n *\n * Enforces a single-client policy: if a new connection arrives while a client is\n * already connected, the stale connection is closed with code 4001 and replaced.\n * Incoming frames are parsed as JSON `AgentCommand` messages and fanned out to\n * registered `onCommand` handlers; outgoing `AgentEvent` objects are JSON-serialised\n * before sending. Call `listen()` to start accepting connections and `close()` to\n * shut down cleanly — `close()` terminates the active socket immediately rather\n * than keeping the event loop alive.\n *\n * @example\n * ```ts\n * const server = new WebSocketServerTransport({ port: 8080 });\n * await server.listen();\n * server.onCommand((cmd) => console.log(cmd));\n * server.send({ type: 'agent_end' });\n * await server.close();\n * ```\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport class WebSocketServerTransport implements ServerTransport {\n  private httpServer: HttpServer | null = null;\n  private wss: WebSocketServer | null = null;\n  private activeClient: WebSocket | null = null;\n  private readonly port: number;\n  private readonly log: (line: string) => void;\n  private readonly host?: string;\n  private readonly authToken?: string;\n  private readonly heartbeatMs: number;\n  private readonly maxMissedPongs: number;\n\n  private readonly onListening: WebSocketServerOptions[\"onListening\"];\n  private readonly commandHandlers = new Set<(command: AgentCommand) => void>();\n  private readonly connectHandlers = new Set<() => void>();\n  private readonly disconnectHandlers = new Set<() => void>();\n\n  constructor(options: WebSocketServerOptions) {\n    this.port = options.port;\n    this.log = options.onLog ?? console.log;\n    this.host = options.host;\n    this.authToken = options.authToken;\n    this.onListening = options.onListening;\n    this.heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;\n    this.maxMissedPongs = options.maxMissedPongs ?? DEFAULT_MAX_MISSED_PONGS;\n  }\n\n  /** Start the server and accept connections. */\n  async listen(): Promise<void> {\n    const httpServer = createServer((_req, res) => {\n      res.writeHead(200, { \"content-type\": \"text/plain\" });\n      res.end(\"skaile agent server\");\n    });\n    // When an auth token is configured, reject the upgrade at handshake time\n    // (HTTP 401) unless the client presents the matching bearer subprotocol.\n    // Rejecting here — before `connection` — keeps unauthenticated sockets from\n    // ever reaching the command handlers.\n    const expected = this.authToken;\n    const wss = new WebSocketServer({\n      server: httpServer,\n      verifyClient: expected\n        ? (info, cb) => {\n            const presented = decodeBearerFromHeader(info.req.headers[\"sec-websocket-protocol\"]);\n            if (presented !== null && tokensEqual(presented, expected)) {\n              cb(true);\n            } else {\n              this.log(\"[ws-server] rejecting unauthenticated upgrade\");\n              cb(false, 401, \"Unauthorized\");\n            }\n          }\n        : undefined,\n    });\n    wss.on(\"connection\", (ws) => this.handleConnection(ws));\n    // `ws` re-emits the http server's errors on `wss`; unhandled during the bind,\n    // that throws before the reject below runs and `listen()` hangs. Scoped to the\n    // bind so a post-startup server error still surfaces loudly.\n    const swallowBindError = () => {};\n    wss.on(\"error\", swallowBindError);\n    this.httpServer = httpServer;\n    this.wss = wss;\n\n    try {\n      await listenWithProbe(httpServer, this.port, this.host);\n    } catch (err) {\n      wss.close();\n      this.wss = null;\n      this.httpServer = null;\n      if (err instanceof Error && \"code\" in err && err.code === \"EADDRINUSE\") {\n        const where = this.host ? `${this.host}:${this.port}` : `port ${this.port}`;\n        throw Object.assign(\n          new Error(\n            `${where} is already in use: another process listens there. Pick another port.`,\n          ),\n          { code: \"EADDRINUSE\" },\n        );\n      }\n      throw err;\n    } finally {\n      wss.off(\"error\", swallowBindError);\n    }\n\n    const addr = httpServer.address();\n    const boundPort = typeof addr === \"object\" && addr ? addr.port : this.port;\n    const bind = this.host ?? \"all interfaces\";\n    this.log(\n      `[ws-server] listening on port ${boundPort} (${bind}; ${this.authToken ? \"token required\" : \"no authentication\"})`,\n    );\n    // A wildcard bind is reachable on loopback; that is the URL worth printing.\n    const urlHost =\n      !this.host || this.host === \"0.0.0.0\" || this.host === \"::\"\n        ? \"127.0.0.1\"\n        : this.host.includes(\":\") && !this.host.startsWith(\"[\")\n          ? `[${this.host}]`\n          : this.host;\n    this.onListening?.({\n      url: `ws://${urlHost}:${boundPort}`,\n      port: boundPort,\n      tokenRequired: this.authToken !== undefined,\n    });\n  }\n\n  private handleConnection(ws: WebSocket): void {\n    if (this.activeClient) {\n      // Close the stale connection instead of rejecting the new one.\n      // This handles the race where waitForWsReady's probe hasn't\n      // fully disconnected before the real gateway client connects.\n      this.log(\"[ws-server] replacing previous connection\");\n      try {\n        this.activeClient.close(4001, \"Replaced by new connection\");\n      } catch {\n        // already closed\n      }\n    }\n    this.log(\"[ws-server] client connected\");\n    this.activeClient = ws;\n    for (const handler of this.connectHandlers) {\n      handler();\n    }\n\n    const stopHeartbeat = this.startHeartbeat(ws);\n\n    ws.on(\"message\", (data) => {\n      try {\n        const parsed = JSON.parse(String(data)) as Record<string, unknown>;\n        // Protocol v3: shape-validate `session_init` at ingress so the\n        // runner never receives a malformed boot envelope. Other command\n        // shapes pass through unchanged — invalid `AgentCommand`s surface\n        // through the existing per-command handlers in serve.ts.\n        if (parsed && typeof parsed === \"object\" && parsed.type === \"session_init\") {\n          const reason = validateSessionInitShape(parsed);\n          if (reason !== null) {\n            this.log(`[ws-server] rejecting invalid session_init: ${reason}`);\n            this.sendRaw({\n              type: \"error\",\n              message: `Invalid session_init: ${reason}`,\n              fatal: false,\n            });\n            return;\n          }\n        }\n        const cmd = parsed as unknown as AgentCommand;\n        for (const handler of this.commandHandlers) {\n          handler(cmd);\n        }\n      } catch (err) {\n        this.sendRaw({\n          type: \"error\",\n          message: `Invalid message: ${err instanceof Error ? err.message : String(err)}`,\n          fatal: false,\n        });\n      }\n    });\n\n    ws.on(\"close\", () => {\n      stopHeartbeat();\n      this.log(\"[ws-server] client disconnected\");\n      if (this.activeClient === ws) {\n        this.activeClient = null;\n        for (const handler of this.disconnectHandlers) {\n          handler();\n        }\n      }\n    });\n  }\n\n  /**\n   * Ping `ws` every {@link heartbeatMs}; terminate it after\n   * {@link maxMissedPongs} unanswered ticks. `terminate()` makes `ws` emit\n   * `close`, which runs the normal disconnect path. Returns the stop function.\n   */\n  private startHeartbeat(ws: WebSocket): () => void {\n    if (this.maxMissedPongs <= 0) return () => {};\n    let missed = 0;\n    const markAlive = () => {\n      missed = 0;\n    };\n    ws.on(\"pong\", markAlive);\n    ws.on(\"message\", markAlive);\n    const timer = setInterval(() => {\n      if (ws.readyState !== ws.OPEN) return;\n      if (missed >= this.maxMissedPongs) {\n        this.log(\n          `[ws-server] no pong for ${missed} heartbeats of ${this.heartbeatMs}ms; terminating client`,\n        );\n        clearInterval(timer);\n        ws.terminate();\n        return;\n      }\n      missed++;\n      try {\n        ws.ping();\n      } catch {\n        // socket closing underneath us; the close event cleans up\n      }\n    }, this.heartbeatMs);\n    timer.unref?.();\n    return () => clearInterval(timer);\n  }\n\n  /**\n   * Stop the server.\n   *\n   * Terminates the active socket immediately — otherwise a still-connected\n   * client would keep the event loop alive and block process shutdown.\n   */\n  async close(): Promise<void> {\n    try {\n      this.activeClient?.terminate();\n    } catch {\n      // already closed\n    }\n    this.activeClient = null;\n    this.wss?.close();\n    this.wss = null;\n    const httpServer = this.httpServer;\n    this.httpServer = null;\n    if (httpServer) {\n      httpServer.closeAllConnections();\n      await new Promise<void>((resolve) => httpServer.close(() => resolve()));\n    }\n  }\n\n  send(event: AgentEvent): void {\n    this.sendRaw(event);\n  }\n\n  onCommand(handler: (command: AgentCommand) => void): () => void {\n    this.commandHandlers.add(handler);\n    return () => {\n      this.commandHandlers.delete(handler);\n    };\n  }\n\n  onConnect(handler: () => void): () => void {\n    this.connectHandlers.add(handler);\n    return () => {\n      this.connectHandlers.delete(handler);\n    };\n  }\n\n  onDisconnect(handler: () => void): () => void {\n    this.disconnectHandlers.add(handler);\n    return () => {\n      this.disconnectHandlers.delete(handler);\n    };\n  }\n\n  get connected(): boolean {\n    return this.activeClient !== null;\n  }\n\n  /** The port actually bound by `listen()` (resolves `port: 0`); `undefined` when not listening. */\n  get boundPort(): number | undefined {\n    const addr = this.httpServer?.address();\n    return typeof addr === \"object\" && addr ? addr.port : undefined;\n  }\n\n  private sendRaw(data: unknown): void {\n    try {\n      const client = this.activeClient;\n      if (client && client.readyState === 1) {\n        client.send(JSON.stringify(data));\n      }\n    } catch {\n      // Silently ignore send failures\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../transport/src/ws/server.ts"],"names":[],"mappings":";;;;;AAiDA,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,wBAAA,GAA2B,CAAA;AAkBjC,SAAS,yBAAyB,GAAA,EAA6C;AAC7E,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB,OAAO,6BAAA;AAExC,EAAA,MAAM,WAAW,GAAA,CAAI,QAAA;AACrB,EAAA,IAAI,CAAC,YAAY,OAAO,QAAA,KAAa,YAAY,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxE,IAAA,OAAO,4BAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,WAAA,KAAgB,QAAA,EAAU,OAAO,uCAAA;AACrD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AACnD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AAEnD,EAAA,MAAM,kBAAkB,GAAA,CAAI,eAAA;AAC5B,EAAA,IAAI,CAAC,mBAAmB,OAAO,eAAA,KAAoB,YAAY,KAAA,CAAM,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC7F,IAAA,OAAO,mCAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AAEtD,EAAA,IACE,CAAC,GAAA,CAAI,cAAA,IACL,OAAO,GAAA,CAAI,cAAA,KAAmB,QAAA,IAC9B,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAChC;AACA,IAAA,OAAO,kCAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,GAAA,CAAI,WAAA,IAAe,OAAO,GAAA,CAAI,WAAA,KAAgB,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAC7F,IAAA,OAAO,+BAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAyBO,IAAM,2BAAN,MAA0D;AAAA,EACvD,UAAA,GAAgC,IAAA;AAAA,EAChC,GAAA,GAA8B,IAAA;AAAA,EAC9B,YAAA,GAAiC,IAAA;AAAA,EACxB,IAAA;AAAA,EACA,GAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EAEA,WAAA;AAAA,EACA,eAAA,uBAAsB,GAAA,EAAqC;AAAA,EAC3D,eAAA,uBAAsB,GAAA,EAAgB;AAAA,EACtC,kBAAA,uBAAyB,GAAA,EAAgB;AAAA,EAE1D,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA;AACpC,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAC3B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC1C,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,cAAA,IAAkB,wBAAA;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,MAAA,GAAwB;AAC5B,IAAA,MAAM,UAAA,GAAa,YAAA,CAAa,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC7C,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,cAAc,CAAA;AACnD,MAAA,GAAA,CAAI,IAAI,qBAAqB,CAAA;AAAA,IAC/B,CAAC,CAAA;AAKD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA;AACtB,IAAA,MAAM,GAAA,GAAM,IAAI,eAAA,CAAgB;AAAA,MAC9B,MAAA,EAAQ,UAAA;AAAA,MACR,YAAA,EAAc,QAAA,GACV,CAAC,IAAA,EAAM,EAAA,KAAO;AACZ,QAAA,MAAM,YAAY,sBAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,wBAAwB,CAAC,CAAA;AACnF,QAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,WAAA,CAAY,SAAA,EAAW,QAAQ,CAAA,EAAG;AAC1D,UAAA,EAAA,CAAG,IAAI,CAAA;AAAA,QACT,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,IAAI,+CAA+C,CAAA;AACxD,UAAA,EAAA,CAAG,KAAA,EAAO,KAAK,cAAc,CAAA;AAAA,QAC/B;AAAA,MACF,CAAA,GACA;AAAA,KACL,CAAA;AACD,IAAA,GAAA,CAAI,GAAG,YAAA,EAAc,CAAC,OAAO,IAAA,CAAK,gBAAA,CAAiB,EAAE,CAAC,CAAA;AAItD,IAAA,MAAM,mBAAmB,MAAM;AAAA,IAAC,CAAA;AAChC,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,gBAAgB,CAAA;AAChC,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAEX,IAAA,IAAI;AACF,MAAA,MAAM,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAA,EAAM,KAAK,IAAI,CAAA;AAAA,IACxD,SAAS,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,KAAA,EAAM;AACV,MAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,MAAA,IAAI,eAAe,KAAA,IAAS,MAAA,IAAU,GAAA,IAAO,GAAA,CAAI,SAAS,YAAA,EAAc;AACtE,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,GAAK,CAAA,KAAA,EAAQ,IAAA,CAAK,IAAI,CAAA,CAAA;AACzE,QAAA,MAAM,MAAA,CAAO,MAAA;AAAA,UACX,IAAI,KAAA;AAAA,YACF,GAAG,KAAK,CAAA,qEAAA;AAAA,WACV;AAAA,UACA,EAAE,MAAM,YAAA;AAAa,SACvB;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,SAAS,gBAAgB,CAAA;AAAA,IACnC;AAEA,IAAA,MAAM,IAAA,GAAO,WAAW,OAAA,EAAQ;AAChC,IAAA,MAAM,YAAY,OAAO,IAAA,KAAS,YAAY,IAAA,GAAO,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACtE,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,gBAAA;AAC1B,IAAA,IAAA,CAAK,GAAA;AAAA,MACH,CAAA,8BAAA,EAAiC,SAAS,CAAA,EAAA,EAAK,IAAI,KAAK,IAAA,CAAK,SAAA,GAAY,mBAAmB,mBAAmB,CAAA,CAAA;AAAA,KACjH;AAEA,IAAA,MAAM,OAAA,GACJ,CAAC,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,SAAA,IAAa,IAAA,CAAK,IAAA,KAAS,IAAA,GACnD,WAAA,GACA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAClD,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,CAAA,GACb,IAAA,CAAK,IAAA;AACb,IAAA,IAAA,CAAK,WAAA,GAAc;AAAA,MACjB,GAAA,EAAK,CAAA,KAAA,EAAQ,OAAO,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AAAA,MACjC,IAAA,EAAM,SAAA;AAAA,MACN,aAAA,EAAe,KAAK,SAAA,KAAc;AAAA,KACnC,CAAA;AAAA,EACH;AAAA,EAEQ,iBAAiB,EAAA,EAAqB;AAC5C,IAAA,IAAI,KAAK,YAAA,EAAc;AAIrB,MAAA,IAAA,CAAK,IAAI,2CAA2C,CAAA;AACpD,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,IAAA,EAAM,4BAA4B,CAAA;AAAA,MAC5D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,IAAI,8BAA8B,CAAA;AACvC,IAAA,IAAA,CAAK,YAAA,GAAe,EAAA;AACpB,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,MAAA,OAAA,EAAQ;AAAA,IACV;AAEA,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,cAAA,CAAe,EAAE,CAAA;AAE5C,IAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAS;AACzB,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAC,CAAA;AAKtC,QAAA,IAAI,UAAU,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,SAAS,cAAA,EAAgB;AAC1E,UAAA,MAAM,MAAA,GAAS,yBAAyB,MAAM,CAAA;AAC9C,UAAA,IAAI,WAAW,IAAA,EAAM;AACnB,YAAA,IAAA,CAAK,GAAA,CAAI,CAAA,4CAAA,EAA+C,MAAM,CAAA,CAAE,CAAA;AAChE,YAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,cACX,IAAA,EAAM,OAAA;AAAA,cACN,OAAA,EAAS,yBAAyB,MAAM,CAAA,CAAA;AAAA,cACxC,KAAA,EAAO;AAAA,aACR,CAAA;AACD,YAAA;AAAA,UACF;AAAA,QACF;AACA,QAAA,MAAM,GAAA,GAAM,MAAA;AACZ,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,UAAA,OAAA,CAAQ,GAAG,CAAA;AAAA,QACb;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,UACX,IAAA,EAAM,OAAA;AAAA,UACN,OAAA,EAAS,oBAAoB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,UAC7E,KAAA,EAAO;AAAA,SACR,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,MAAA,aAAA,EAAc;AACd,MAAA,IAAA,CAAK,IAAI,iCAAiC,CAAA;AAC1C,MAAA,IAAI,IAAA,CAAK,iBAAiB,EAAA,EAAI;AAC5B,QAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,kBAAA,EAAoB;AAC7C,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,EAAA,EAA2B;AAChD,IAAA,IAAI,IAAA,CAAK,cAAA,IAAkB,CAAA,EAAG,OAAO,MAAM;AAAA,IAAC,CAAA;AAC5C,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,MAAM,YAAY,MAAM;AACtB,MAAA,MAAA,GAAS,CAAA;AAAA,IACX,CAAA;AACA,IAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,SAAS,CAAA;AACvB,IAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,YAAY,MAAM;AAC9B,MAAA,IAAI,EAAA,CAAG,UAAA,KAAe,EAAA,CAAG,IAAA,EAAM;AAC/B,MAAA,IAAI,MAAA,IAAU,KAAK,cAAA,EAAgB;AACjC,QAAA,IAAA,CAAK,GAAA;AAAA,UACH,CAAA,wBAAA,EAA2B,MAAM,CAAA,eAAA,EAAkB,IAAA,CAAK,WAAW,CAAA,sBAAA;AAAA,SACrE;AACA,QAAA,aAAA,CAAc,KAAK,CAAA;AACnB,QAAA,EAAA,CAAG,SAAA,EAAU;AACb,QAAA;AAAA,MACF;AACA,MAAA,MAAA,EAAA;AACA,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,IAAA,EAAK;AAAA,MACV,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA,EAAG,KAAK,WAAW,CAAA;AACnB,IAAA,KAAA,CAAM,KAAA,IAAQ;AACd,IAAA,OAAO,MAAM,cAAc,KAAK,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAc,SAAA,EAAU;AAAA,IAC/B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,KAAK,KAAA,EAAM;AAChB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,IAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,UAAA,CAAW,mBAAA,EAAoB;AAC/B,MAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,KAAA,CAAM,MAAM,OAAA,EAAS,CAAC,CAAA;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,KAAK,KAAA,EAAyB;AAC5B,IAAA,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,EACpB;AAAA,EAEA,UAAU,OAAA,EAAsD;AAC9D,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,UAAU,OAAA,EAAiC;AACzC,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,aAAa,OAAA,EAAiC;AAC5C,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAI,OAAO,CAAA;AACnC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,kBAAA,CAAmB,OAAO,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,EACF;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,KAAK,YAAA,KAAiB,IAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,IAAI,SAAA,GAAgC;AAClC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,OAAA,EAAQ;AACtC,IAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,GAAO,KAAK,IAAA,GAAO,MAAA;AAAA,EACxD;AAAA,EAEQ,QAAQ,IAAA,EAAqB;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AACpB,MAAA,IAAI,MAAA,IAAU,MAAA,CAAO,UAAA,KAAe,CAAA,EAAG;AACrC,QAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-AF432MS3.js","sourcesContent":["/**\n * WebSocketServerTransport — `ws`-based WebSocket server.\n *\n * Accepts one client at a time. Implements ServerTransport from @skaile/workspaces/types.\n * Built on the `ws` package + `node:http`, both of which run under Node and Bun.\n */\n\nimport { createServer, type Server as HttpServer } from \"node:http\";\nimport { listenWithProbe } from \"@skaile/workspaces/core\";\nimport type { AgentCommand, AgentEvent, ServerTransport } from \"@skaile/workspaces/types\";\nimport { type WebSocket, WebSocketServer } from \"ws\";\nimport { decodeBearerFromHeader, tokensEqual } from \"./auth.js\";\n\n/** @deprecated Moved to `@skaile/workspaces/core`, where `portIsHeld` replaces it. */\nexport { needsWildcardProbe } from \"@skaile/workspaces/core\";\n\n/**\n * Options for {@link WebSocketServerTransport}.\n *\n * @param port - TCP port to bind to; `0` picks a free port (read it back via `boundPort`).\n * @param onLog - Optional callback for internal log lines (client connect/disconnect events).\n * @param host - Address to bind. Default: every interface (Node's unspecified address).\n *   `127.0.0.1` accepts local clients only.\n * @param authToken - When set, every upgrade must present this token via the\n *   `skaile-bearer.<base64url>` subprotocol or the handshake is rejected with\n *   HTTP 401. When unset, no auth is enforced (back-compatible default).\n * @param onListening - Called once the socket is bound, with the address a client\n *   connects to (`url`) and whether it needs a token. For a plain-text ready line\n *   (the `onLog` record carries the port only inside a log sentence).\n * @param heartbeatMs - Interval in milliseconds between pings to the active\n *   client. Default: 30 000.\n * @param maxMissedPongs - Heartbeat ticks the client may go without a pong (or\n *   any inbound frame) before its socket is terminated, so a client lost behind a\n *   dead path (no FIN) fires `onDisconnect` instead of swallowing every event\n *   sent to it. Default: 2, i.e. detection within 3 x `heartbeatMs`. `0` turns\n *   the heartbeat off. Every WebSocket client answers pings on its own.\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport interface WebSocketServerOptions {\n  port: number;\n  host?: string;\n  onLog?: (line: string) => void;\n  authToken?: string;\n  onListening?: (info: { url: string; port: number; tokenRequired: boolean }) => void;\n  heartbeatMs?: number;\n  maxMissedPongs?: number;\n}\n\nconst DEFAULT_HEARTBEAT_MS = 30_000;\nconst DEFAULT_MAX_MISSED_PONGS = 2;\n\n/**\n * Shape-validate a `session_init` frame at ingress before forwarding to the\n * runner. Protocol v3 requires the deterministic bootstrap envelope to carry\n * an identity tuple, a semver-shaped `protocolVersion`, a resolved config\n * object, and a `credentials` map keyed by `mounts` / `connectors`. Frames\n * that fail the guard are rejected on the wire so the runner never sees a\n * malformed boot envelope.\n *\n * Returns `null` when the frame is well-formed, or a human-readable reason\n * when it should be rejected.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`\n * § \"SessionInitCommand schema\".\n *\n * @internal\n */\nfunction validateSessionInitShape(cmd: Record<string, unknown>): string | null {\n  if (cmd.type !== \"session_init\") return \"type must be 'session_init'\";\n\n  const identity = cmd.identity as Record<string, unknown> | undefined;\n  if (!identity || typeof identity !== \"object\" || Array.isArray(identity)) {\n    return \"identity must be an object\";\n  }\n  if (typeof identity.containerId !== \"string\") return \"identity.containerId must be a string\";\n  if (typeof identity.sessionId !== \"string\") return \"identity.sessionId must be a string\";\n  if (typeof identity.projectId !== \"string\") return \"identity.projectId must be a string\";\n\n  const protocolVersion = cmd.protocolVersion as Record<string, unknown> | undefined;\n  if (!protocolVersion || typeof protocolVersion !== \"object\" || Array.isArray(protocolVersion)) {\n    return \"protocolVersion must be an object\";\n  }\n  if (typeof protocolVersion.major !== \"number\") return \"protocolVersion.major must be a number\";\n  if (typeof protocolVersion.minor !== \"number\") return \"protocolVersion.minor must be a number\";\n  if (typeof protocolVersion.patch !== \"number\") return \"protocolVersion.patch must be a number\";\n\n  if (\n    !cmd.resolvedConfig ||\n    typeof cmd.resolvedConfig !== \"object\" ||\n    Array.isArray(cmd.resolvedConfig)\n  ) {\n    return \"resolvedConfig must be an object\";\n  }\n\n  if (!cmd.credentials || typeof cmd.credentials !== \"object\" || Array.isArray(cmd.credentials)) {\n    return \"credentials must be an object\";\n  }\n\n  return null;\n}\n\n/**\n * `ServerTransport` implementation backed by the `ws` package on top of a\n * `node:http` server.\n *\n * Enforces a single-client policy: if a new connection arrives while a client is\n * already connected, the stale connection is closed with code 4001 and replaced.\n * Incoming frames are parsed as JSON `AgentCommand` messages and fanned out to\n * registered `onCommand` handlers; outgoing `AgentEvent` objects are JSON-serialised\n * before sending. Call `listen()` to start accepting connections and `close()` to\n * shut down cleanly — `close()` terminates the active socket immediately rather\n * than keeping the event loop alive.\n *\n * @example\n * ```ts\n * const server = new WebSocketServerTransport({ port: 8080 });\n * await server.listen();\n * server.onCommand((cmd) => console.log(cmd));\n * server.send({ type: 'agent_end' });\n * await server.close();\n * ```\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport class WebSocketServerTransport implements ServerTransport {\n  private httpServer: HttpServer | null = null;\n  private wss: WebSocketServer | null = null;\n  private activeClient: WebSocket | null = null;\n  private readonly port: number;\n  private readonly log: (line: string) => void;\n  private readonly host?: string;\n  private readonly authToken?: string;\n  private readonly heartbeatMs: number;\n  private readonly maxMissedPongs: number;\n\n  private readonly onListening: WebSocketServerOptions[\"onListening\"];\n  private readonly commandHandlers = new Set<(command: AgentCommand) => void>();\n  private readonly connectHandlers = new Set<() => void>();\n  private readonly disconnectHandlers = new Set<() => void>();\n\n  constructor(options: WebSocketServerOptions) {\n    this.port = options.port;\n    this.log = options.onLog ?? console.log;\n    this.host = options.host;\n    this.authToken = options.authToken;\n    this.onListening = options.onListening;\n    this.heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;\n    this.maxMissedPongs = options.maxMissedPongs ?? DEFAULT_MAX_MISSED_PONGS;\n  }\n\n  /** Start the server and accept connections. */\n  async listen(): Promise<void> {\n    const httpServer = createServer((_req, res) => {\n      res.writeHead(200, { \"content-type\": \"text/plain\" });\n      res.end(\"skaile agent server\");\n    });\n    // When an auth token is configured, reject the upgrade at handshake time\n    // (HTTP 401) unless the client presents the matching bearer subprotocol.\n    // Rejecting here — before `connection` — keeps unauthenticated sockets from\n    // ever reaching the command handlers.\n    const expected = this.authToken;\n    const wss = new WebSocketServer({\n      server: httpServer,\n      verifyClient: expected\n        ? (info, cb) => {\n            const presented = decodeBearerFromHeader(info.req.headers[\"sec-websocket-protocol\"]);\n            if (presented !== null && tokensEqual(presented, expected)) {\n              cb(true);\n            } else {\n              this.log(\"[ws-server] rejecting unauthenticated upgrade\");\n              cb(false, 401, \"Unauthorized\");\n            }\n          }\n        : undefined,\n    });\n    wss.on(\"connection\", (ws) => this.handleConnection(ws));\n    // `ws` re-emits the http server's errors on `wss`; unhandled during the bind,\n    // that throws before the reject below runs and `listen()` hangs. Scoped to the\n    // bind so a post-startup server error still surfaces loudly.\n    const swallowBindError = () => {};\n    wss.on(\"error\", swallowBindError);\n    this.httpServer = httpServer;\n    this.wss = wss;\n\n    try {\n      await listenWithProbe(httpServer, this.port, this.host);\n    } catch (err) {\n      wss.close();\n      this.wss = null;\n      this.httpServer = null;\n      if (err instanceof Error && \"code\" in err && err.code === \"EADDRINUSE\") {\n        const where = this.host ? `${this.host}:${this.port}` : `port ${this.port}`;\n        throw Object.assign(\n          new Error(\n            `${where} is already in use: another process listens there. Pick another port.`,\n          ),\n          { code: \"EADDRINUSE\" },\n        );\n      }\n      throw err;\n    } finally {\n      wss.off(\"error\", swallowBindError);\n    }\n\n    const addr = httpServer.address();\n    const boundPort = typeof addr === \"object\" && addr ? addr.port : this.port;\n    const bind = this.host ?? \"all interfaces\";\n    this.log(\n      `[ws-server] listening on port ${boundPort} (${bind}; ${this.authToken ? \"token required\" : \"no authentication\"})`,\n    );\n    // A wildcard bind is reachable on loopback; that is the URL worth printing.\n    const urlHost =\n      !this.host || this.host === \"0.0.0.0\" || this.host === \"::\"\n        ? \"127.0.0.1\"\n        : this.host.includes(\":\") && !this.host.startsWith(\"[\")\n          ? `[${this.host}]`\n          : this.host;\n    this.onListening?.({\n      url: `ws://${urlHost}:${boundPort}`,\n      port: boundPort,\n      tokenRequired: this.authToken !== undefined,\n    });\n  }\n\n  private handleConnection(ws: WebSocket): void {\n    if (this.activeClient) {\n      // Close the stale connection instead of rejecting the new one.\n      // This handles the race where waitForWsReady's probe hasn't\n      // fully disconnected before the real gateway client connects.\n      this.log(\"[ws-server] replacing previous connection\");\n      try {\n        this.activeClient.close(4001, \"Replaced by new connection\");\n      } catch {\n        // already closed\n      }\n    }\n    this.log(\"[ws-server] client connected\");\n    this.activeClient = ws;\n    for (const handler of this.connectHandlers) {\n      handler();\n    }\n\n    const stopHeartbeat = this.startHeartbeat(ws);\n\n    ws.on(\"message\", (data) => {\n      try {\n        const parsed = JSON.parse(String(data)) as Record<string, unknown>;\n        // Protocol v3: shape-validate `session_init` at ingress so the\n        // runner never receives a malformed boot envelope. Other command\n        // shapes pass through unchanged — invalid `AgentCommand`s surface\n        // through the existing per-command handlers in serve.ts.\n        if (parsed && typeof parsed === \"object\" && parsed.type === \"session_init\") {\n          const reason = validateSessionInitShape(parsed);\n          if (reason !== null) {\n            this.log(`[ws-server] rejecting invalid session_init: ${reason}`);\n            this.sendRaw({\n              type: \"error\",\n              message: `Invalid session_init: ${reason}`,\n              fatal: false,\n            });\n            return;\n          }\n        }\n        const cmd = parsed as unknown as AgentCommand;\n        for (const handler of this.commandHandlers) {\n          handler(cmd);\n        }\n      } catch (err) {\n        this.sendRaw({\n          type: \"error\",\n          message: `Invalid message: ${err instanceof Error ? err.message : String(err)}`,\n          fatal: false,\n        });\n      }\n    });\n\n    ws.on(\"close\", () => {\n      stopHeartbeat();\n      this.log(\"[ws-server] client disconnected\");\n      if (this.activeClient === ws) {\n        this.activeClient = null;\n        for (const handler of this.disconnectHandlers) {\n          handler();\n        }\n      }\n    });\n  }\n\n  /**\n   * Ping `ws` every {@link heartbeatMs}; terminate it after\n   * {@link maxMissedPongs} unanswered ticks. `terminate()` makes `ws` emit\n   * `close`, which runs the normal disconnect path. Returns the stop function.\n   */\n  private startHeartbeat(ws: WebSocket): () => void {\n    if (this.maxMissedPongs <= 0) return () => {};\n    let missed = 0;\n    const markAlive = () => {\n      missed = 0;\n    };\n    ws.on(\"pong\", markAlive);\n    ws.on(\"message\", markAlive);\n    const timer = setInterval(() => {\n      if (ws.readyState !== ws.OPEN) return;\n      if (missed >= this.maxMissedPongs) {\n        this.log(\n          `[ws-server] no pong for ${missed} heartbeats of ${this.heartbeatMs}ms; terminating client`,\n        );\n        clearInterval(timer);\n        ws.terminate();\n        return;\n      }\n      missed++;\n      try {\n        ws.ping();\n      } catch {\n        // socket closing underneath us; the close event cleans up\n      }\n    }, this.heartbeatMs);\n    timer.unref?.();\n    return () => clearInterval(timer);\n  }\n\n  /**\n   * Stop the server.\n   *\n   * Terminates the active socket immediately — otherwise a still-connected\n   * client would keep the event loop alive and block process shutdown.\n   */\n  async close(): Promise<void> {\n    try {\n      this.activeClient?.terminate();\n    } catch {\n      // already closed\n    }\n    this.activeClient = null;\n    this.wss?.close();\n    this.wss = null;\n    const httpServer = this.httpServer;\n    this.httpServer = null;\n    if (httpServer) {\n      httpServer.closeAllConnections();\n      await new Promise<void>((resolve) => httpServer.close(() => resolve()));\n    }\n  }\n\n  send(event: AgentEvent): void {\n    this.sendRaw(event);\n  }\n\n  onCommand(handler: (command: AgentCommand) => void): () => void {\n    this.commandHandlers.add(handler);\n    return () => {\n      this.commandHandlers.delete(handler);\n    };\n  }\n\n  onConnect(handler: () => void): () => void {\n    this.connectHandlers.add(handler);\n    return () => {\n      this.connectHandlers.delete(handler);\n    };\n  }\n\n  onDisconnect(handler: () => void): () => void {\n    this.disconnectHandlers.add(handler);\n    return () => {\n      this.disconnectHandlers.delete(handler);\n    };\n  }\n\n  get connected(): boolean {\n    return this.activeClient !== null;\n  }\n\n  /** The port actually bound by `listen()` (resolves `port: 0`); `undefined` when not listening. */\n  get boundPort(): number | undefined {\n    const addr = this.httpServer?.address();\n    return typeof addr === \"object\" && addr ? addr.port : undefined;\n  }\n\n  private sendRaw(data: unknown): void {\n    try {\n      const client = this.activeClient;\n      if (client && client.readyState === 1) {\n        client.send(JSON.stringify(data));\n      }\n    } catch {\n      // Silently ignore send failures\n    }\n  }\n}\n"]}

package/dist/{chunk-F6AA42GW.js → chunk-ARWKK325.js}

@@ -1,6 +1,6 @@
-import { flowKindProvider } from './chunk-IF6IA3PZ.js';
-import { knowledgeKindProvider } from './chunk-XM6T2AZ2.js';
-import { createDefaultKindRegistry } from './chunk-I37INEWE.js';
+import { flowKindProvider } from './chunk-SZXGRHQQ.js';
+import { knowledgeKindProvider } from './chunk-UL22SDGR.js';
+import { createDefaultKindRegistry } from './chunk-QOM5Z62G.js';
 
 // cli/src/open-registry.ts
 var registry;
@@ -13,5 +13,5 @@ function getKnownKinds() {
 }
 
 export { getKindRegistry, getKnownKinds };
-//# sourceMappingURL=chunk-F6AA42GW.js.map
-//# sourceMappingURL=chunk-F6AA42GW.js.map
+//# sourceMappingURL=chunk-ARWKK325.js.map
+//# sourceMappingURL=chunk-ARWKK325.js.map

package/dist/{chunk-F6AA42GW.js.map → chunk-ARWKK325.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/open-registry.ts"],"names":[],"mappings":";;;;;AAgBA,IAAI,QAAA;AAQG,SAAS,eAAA,GAAqC;AACnD,EAAA,QAAA,KAAa,yBAAA,CAA0B,CAAC,gBAAA,EAAkB,qBAAqB,CAAC,CAAA;AAChF,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,aAAA,GAAqC;AACnD,EAAA,OAAO,IAAI,GAAA,CAAI,eAAA,EAAgB,CAAE,aAAa,CAAA;AAChD","file":"chunk-F6AA42GW.js","sourcesContent":["/**\n * open-registry.ts — the CLI's one AssetKindRegistry.\n *\n * The provider registry is the only authority on asset kinds. The CLI builds it\n * once per process with all built-in providers (from @skaile/workspaces/discovery)\n * plus the extension kinds (flow from\n * @skaile/workspaces/factory-assets/connectors/flow/engine, knowledge from\n * @skaile/workspaces/library) and hands the same instance to every consumer\n * (catalog sources, the installer, validation, composition).\n */\n\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { flowKindProvider } from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\nlet registry: AssetKindRegistry | undefined;\n\n/**\n * The process-wide, fully-configured AssetKindRegistry.\n *\n * Registers every built-in kind plus flow and knowledge. Built lazily on first\n * call; every later call returns the same instance.\n */\nexport function getKindRegistry(): AssetKindRegistry {\n  registry ??= createDefaultKindRegistry([flowKindProvider, knowledgeKindProvider]);\n  return registry;\n}\n\n/** Registered kind names as a set — the `knownKinds` argument of the manifest scanners. */\nexport function getKnownKinds(): ReadonlySet<string> {\n  return new Set(getKindRegistry().getAllKinds());\n}\n"]}
+{"version":3,"sources":["../cli/src/open-registry.ts"],"names":[],"mappings":";;;;;AAgBA,IAAI,QAAA;AAQG,SAAS,eAAA,GAAqC;AACnD,EAAA,QAAA,KAAa,yBAAA,CAA0B,CAAC,gBAAA,EAAkB,qBAAqB,CAAC,CAAA;AAChF,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,aAAA,GAAqC;AACnD,EAAA,OAAO,IAAI,GAAA,CAAI,eAAA,EAAgB,CAAE,aAAa,CAAA;AAChD","file":"chunk-ARWKK325.js","sourcesContent":["/**\n * open-registry.ts — the CLI's one AssetKindRegistry.\n *\n * The provider registry is the only authority on asset kinds. The CLI builds it\n * once per process with all built-in providers (from @skaile/workspaces/discovery)\n * plus the extension kinds (flow from\n * @skaile/workspaces/factory-assets/connectors/flow/engine, knowledge from\n * @skaile/workspaces/library) and hands the same instance to every consumer\n * (catalog sources, the installer, validation, composition).\n */\n\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { flowKindProvider } from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\nlet registry: AssetKindRegistry | undefined;\n\n/**\n * The process-wide, fully-configured AssetKindRegistry.\n *\n * Registers every built-in kind plus flow and knowledge. Built lazily on first\n * call; every later call returns the same instance.\n */\nexport function getKindRegistry(): AssetKindRegistry {\n  registry ??= createDefaultKindRegistry([flowKindProvider, knowledgeKindProvider]);\n  return registry;\n}\n\n/** Registered kind names as a set — the `knownKinds` argument of the manifest scanners. */\nexport function getKnownKinds(): ReadonlySet<string> {\n  return new Set(getKindRegistry().getAllKinds());\n}\n"]}