@skaile/workspaces 5.2.0 → 5.4.0

package/dist/{chunk-EB6OPURC.js.map → chunk-HTKZ4AOW.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../secrets/src/lifecycle.ts","../secrets/src/providers/env.ts","../secrets/src/providers/local.ts","../secrets/src/router.ts","../secrets/src/index.ts"],"names":["provider"],"mappings":";;;;;;;;AAuCO,IAAM,6BAAN,MAAiC;AAAA,EAC9B,MAAA;AAAA;AAAA;AAAA;AAAA,EAKR,WAAA,CAAY,QAAuB,OAAA,EAA8C;AAC/E,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,aAAA,EAA+C;AAGnE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA;AAC3C,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,IACtD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAkB,OAAO,sBAAA,EAAuB;AAAA,IACrF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,aAAA,EAAyC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AACzC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACnDA,IAAM,qBAAA,mBAAwB,IAAI,IAAA,CAAK,CAAC,CAAA;AAEjC,IAAM,qBAAN,MAAqD;AAAA,EACjD,EAAA,GAAK,KAAA;AAAA,EAEd,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvC;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,MAAA,EAAoB,KAAA,EAAyC;AACzF,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,aAAa,IAAA,EAA6B;AAC9C,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAClC,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AAKA,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,qBAAA;AAAA,MACX,SAAA,EAAW,qBAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;AChDA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,aAAA,GAAgB,QAAA;AAEtB,IAAM,gBAAA,GAAmB,gBAAA;AACzB,IAAM,gBAAA,GAAmB,YAAA;AAGzB,IAAM,cAAA,GAAiB,2BAAA;AAoBvB,SAAS,eAAA,CAAgB,YAAoB,IAAA,EAAsB;AACjE,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,iBAAA,EAAmB,YAAY,aAAa,CAAA;AACzF;AAEA,SAAS,oBAAA,GAA+B;AAEtC,EAAA,OAAO,UAAa,EAAA,CAAA,QAAA,EAAU,CAAA,CAAA,EAAO,EAAA,CAAA,QAAA,GAAW,QAAQ,CAAA,CAAA;AAC1D;AAGA,SAAS,eAAe,UAAA,EAA4B;AAClD,EAAA,OAAc,kBAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACpE;AAMA,SAAS,UAAU,GAAA,EAAqB;AACtC,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC1E;AAMA,SAAS,OAAA,CAAQ,MAAkB,GAAA,EAAqB;AACtD,EAAA,MAAM,EAAA,GAAY,mBAAY,SAAS,CAAA;AACvC,EAAA,MAAM,MAAA,GAAgB,sBAAe,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC3F,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,EAAA,EAAI,OAAA,EAAS,SAAS,CAAC,CAAA;AAC/C;AAEA,SAAS,OAAA,CAAQ,MAAc,GAAA,EAAqB;AAClD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,CAAA,EAAG,SAAS,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,YAAY,eAAe,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,QAAA,CAAS,SAAA,GAAY,eAAe,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAkB,wBAAiB,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC/F,EAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACtE;AAMO,IAAM,uBAAN,MAAuD;AAAA,EACnD,EAAA,GAAK,OAAA;AAAA,EACN,UAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAC3B,IAAA,GAAsB,IAAA;AAAA,EACtB,QAAA,GAAwB,SAAA;AAAA,EAEhC,YAAY,UAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA,IAAmB,IAAA,CAAA,IAAA,CAAK,eAAA,IAAmB,SAAS,CAAA;AAAA,EACxE;AAAA;AAAA,EAIQ,SAAA,GAAkB;AACxB,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,EAAG;AACnC,MAAG,EAAA,CAAA,SAAA,CAAU,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,gBAAA,GAA2B;AACjC,IAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,OAAU,gBAAa,QAAQ,CAAA;AAAA,IACjC;AACA,IAAA,MAAM,IAAA,GAAc,mBAAY,WAAW,CAAA;AAC3C,IAAG,iBAAc,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAA,GAA2B;AACvC,IAAA,IAAI,KAAK,SAAA,EAAW;AAEpB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,gBAAA,EAAiB;AAGlC,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,IAAA,CAAK,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,EAAE,IAAA,EAAK;AAAA,IAC9D,CAAA,MAAO;AAEL,MAAA,IAAA,CAAK,QAAA,GAAY,MAAM,IAAA,CAAK,mBAAA,KAAyB,UAAA,GAAa,SAAA;AAClE,MAAG,iBAAc,YAAA,EAAc,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,wBAAA,CAAyB,KAAK,QAAQ,CAAA;AACpE,IAAA,IAAA,CAAK,SAAA,GAAY,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAAA,EACxD;AAAA,EAEA,MAAc,mBAAA,GAAwC;AACpD,IAAA,IAAI;AAGF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AACxE,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,GAAgB,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACjD,QAAA,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAA,EAAkB,gBAAA,EAAkB,MAAM,CAAA;AAAA,MACrE;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,yBAAyB,QAAA,EAAwC;AAC7E,IAAA,QAAQ,QAAA;AAAU,MAChB,KAAK,UAAA,EAAY;AACf,QAAA,IAAI;AAGF,UAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AAC1E,UAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,QACrB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,QAAA,IAAI,aAAA,EAAe;AAEjB,UAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,UAAA,IAAO,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,YAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC7D,YAAA,IAAI,cAAA,CAAe,aAAa,CAAA,KAAM,UAAA,EAAY;AAChD,cAAA,MAAM,IAAI,YAAA;AAAA,gBACR,mBAAmB,cAAc,CAAA,kFAAA,CAAA;AAAA,gBAEjC;AAAA,eACF;AAAA,YACF;AAAA,UACF;AACA,UAAA,OAAO,aAAA;AAAA,QACT;AAIA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,6BAAA,EAAgC,cAAc,CAAA,8CAAA,EACR,cAAc,CAAA,MAAA,CAAA;AAAA,UACpD;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,SAAA;AACH,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AACE,QAAA,OAAO,oBAAA,EAAqB;AAAA;AAChC,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CAAe,QAAA,EAAuB,UAAA,EAAoC;AAC9E,IAAA,IAAA,CAAK,SAAA,EAAU;AAIf,IAAA,MAAM,mBAAA,GAAsB,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEpE,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,sDAAsD,cAAc,CAAA,CAAA,CAAA;AAAA,UACpE;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC/C,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,wBAAA,CAAyB,OAAA,EAAS,2BAA2B,CAAA;AAAA,MACzE;AAAA,IACF;AAOA,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AACnC,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,KAAK,SAAA,EAAU;AACrB,MAAA,MAAM,SAAS,IAAA,CAAK,SAAA;AAGpB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,MAAA,MAAM,aAAA,GACJ,QAAA,KAAa,YAAA,GACT,mBAAA,GACA,QAAA,KAAa,UAAA,GACX,MAAM,IAAA,CAAK,wBAAA,CAAyB,UAAU,CAAA,GAC9C,oBAAA,EAAqB;AAC7B,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,aAAA,EAAe,IAAI,CAAA;AAOlD,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,QAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AACtC,UAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AAC7C,UAAG,iBAAc,QAAA,EAAU,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,QACzD,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,QACrB;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sEACK,MAAA,CAAO,MAAM,eAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,mFAAA;AAAA,SAEpD;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,MAAG,EAAA,CAAA,aAAA,CAAc,YAAY,cAAA,CAAe,mBAAoB,GAAG,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAG,iBAAc,YAAA,EAAc,QAAA,EAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AACxD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,cAAA,GAA8B;AAC5B,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,OAAU,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAA,CAAE,IAAA,EAAK;AAAA,IACrD;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA,EAIQ,YAAY,GAAA,EAAqB;AACvC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,IAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,aAAa,GAAA,EAAqB;AACxC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,UAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,SAAS,GAAA,EAAqB;AACpC,IAAA,OAAY,UAAK,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,YAAA,CAAa,GAAG,CAAC,CAAA;AAAA,EAC1D;AAAA,EAEQ,YAAA,GAAyB;AAC/B,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,SAAU,EAAC;AAC7C,IAAA,OAAU,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACzE;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,IAAA,CAAK,SAAU,CAAA;AAG/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC1D,QAAA,IAAA,CAAK,cAAA,GAAA,iBAAiB,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAC7C,QAAG,EAAA,CAAA,aAAA,CAAc,UAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,MAClE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,WAAW,SAAS,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,EAAO,IAAA,CAAK,SAAU,CAAA;AAChD,IAAG,iBAAc,QAAA,EAAU,SAAA,EAAW,EAAE,IAAA,EAAM,KAAO,CAAA;AAGrD,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,GAAA;AAAA,MACA,SAAA,EAAW,SAAS,SAAA,IAAa,GAAA;AAAA,MACjC,SAAA,EAAW,GAAA;AAAA,MACX,cAAA,EAAgB,GAAA;AAAA,MAChB,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,IAAA,CAAK,QAAA,KAAa,EAAC;AAAA,MACpD,GAAI,IAAA,EAAM,UAAA,GACN,EAAE,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY,KACvE;AAAC,KACP;AACA,IAAG,EAAA,CAAA,aAAA,CAAc,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAG,cAAW,QAAQ,CAAA;AACtB,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAG,cAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAA,CAAK,SAAA,EAAU;AAEf,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,YAAY,CAAC,CAAA;AACxF,IAAA,IAAI,OAAiB,EAAC;AACtB,IAAA,KAAA,MAAW,MAAM,SAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,UAAA,EAAY,EAAE,CAAA,EAAG,OAAO,CAAC,CAAA;AAChF,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,MAClC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,SAAA,EAAU;AAErB,MAAA,MAAM,UAAU,CAAA,OAAA,EAAiB,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AAC/D,MAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,SAAS,CAAA;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,aAAa,OAAO,CAAA;AAC/B,MAAA,IAAI,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACnD;AACA,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAW,IAAA,CAAK,GAAA,KAAQ,KAAA,EAAM;AAAA,IACnD,SAAS,CAAA,EAAG;AACV,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,QACxB,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC;AAAA,OAClD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,GAAA,EAAK,IAAI,GAAA,IAAO,GAAA;AAAA,QAChB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,gBAAgB,GAAA,CAAI,cAAA,GAAiB,IAAI,IAAA,CAAK,GAAA,CAAI,cAAc,CAAA,GAAI,MAAA;AAAA,QACpE,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAU,YAAS,QAAQ,CAAA;AACjC,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,KAAA;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;;;ACzZO,IAAM,gBAAN,MAAoB;AAAA,EACjB,SAAA,uBAAgB,GAAA,EAA8B;AAAA,EAC9C,MAAA;AAAA,EACA,QAAqB,EAAC;AAAA;AAAA,EAG9B,eAAA;AAAA,EACA,cAAA;AAAA,EAEA,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA,EAIA,SAAS,QAAA,EAAkC;AACzC,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC1C;AAAA,EAEA,WAAW,EAAA,EAAkB;AAC3B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,EAC1B;AAAA,EAEA,aAAA,GAA0B;AACxB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAA,EAClC;AAAA;AAAA,EAIA,QAAQ,IAAA,EAAuB;AAC7B,IAAA,IAAA,CAAK,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACtB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,SAAA,EAA4C,UAAA,EAA0B;AAC9F,IAAA,MAAM,KAAA,GAA4B;AAAA,MAChC,cAAA,EAAgB,GAAA;AAAA,MAChB,SAAA;AAAA,MACA,WAAA,EAAa,UAAA;AAAA,MACb,mBAAmB,IAAA,CAAK,eAAA;AAAA,MACxB,kBAAkB,IAAA,CAAK,cAAA;AAAA,MACvB,SAAA,sBAAe,IAAA;AAAK,KACtB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIQ,QAAQ,GAAA,EAA+B;AAE7C,IAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO;AACpC,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,MAAMA,SAAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,KAAK,WAAW,CAAA;AACpD,UAAA,IAAIA,WAAU,OAAOA,SAAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,KAAK,MAAA,CAAO,gBAAA;AAAA,QACZ,CAAA,uCAAA,EAA0C,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,UAAU,GAAG,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,IAAI,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,QAAA,CAAS,EAAE,CAAA;AACpC,IAAA,OAAO,QAAA,CAAS,aAAa,GAAG,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AAIxD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,CAAS,EAAE,CAAA;AAClC,IAAA,OAAO,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAA,EAAY,QAAA,CAAS,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,CAAS,YAAY,GAAG,CAAA;AAAA,EACjC;AAAA,EAEA,gBAAgB,UAAA,EAAkD;AAChE,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,EAAU,iBAAgB,IAAK,IAAA;AAAA,EACxC;AAAA,EAEA,MAAM,eACJ,UAAA,EAC8D;AAC9D,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,UAAA,EAAa,EAAE,CAAA,gBAAA,CAAA,EAAmB;AAAA,IAC/D;AACA,IAAA,OAAO,SAAS,cAAA,EAAe;AAAA,EACjC;AACF;;;ACvNO,IAAM,OAAA,GAAU","file":"chunk-EB6OPURC.js","sourcesContent":["/**\n * CredentialLifecycleService — manages OAuth token refresh outside the SecretsRouter.\n *\n * Works with opaque token blobs stored via the {@link SecretsRouter}; providers remain\n * OAuth-unaware. Phase 1 ships non-OAuth paths (always returns `not_applicable`).\n * Full proactive OAuth refresh with expiry checking ships in Phase 3.4.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\n\nimport type { SecretsRouter } from \"./router.js\";\n\n/**\n * Configuration for {@link CredentialLifecycleService}.\n *\n * Controls how aggressively the service proactively refreshes credentials before they expire.\n * The default lead time is 300 seconds (5 minutes).\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface CredentialLifecycleConfig {\n  /** How far before expiry to trigger a proactive refresh (seconds). */\n  refreshLeadTimeSec: number;\n}\n\n/**\n * Result returned by {@link CredentialLifecycleService.refreshIfNeeded}.\n *\n * The `reason` discriminant indicates why a refresh did or did not occur.\n * An `error` string is present only when `reason` is `refresh_failed`.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface RefreshResult {\n  refreshed: boolean;\n  reason: \"not_applicable\" | \"still_valid\" | \"refreshed\" | \"refresh_failed\";\n  error?: string;\n}\n\nexport class CredentialLifecycleService {\n  private router: SecretsRouter;\n\n  // `_config` is accepted for signature stability but not stored yet: Phase 1\n  // ships no OAuth refresh, so there is nothing to configure. Phase 3.4 will\n  // store and read `refreshLeadTimeSec` when proactive refresh lands.\n  constructor(router: SecretsRouter, _config?: Partial<CredentialLifecycleConfig>) {\n    this.router = router;\n  }\n\n  /**\n   * Attempt to refresh a credential if needed.\n   * Phase 1: always returns not_applicable (no OAuth support yet).\n   */\n  async refreshIfNeeded(credentialRef: string): Promise<RefreshResult> {\n    // Phase 1: no OAuth refresh implemented.\n    // The credential exists and is valid as-is (static secrets, env vars, etc.)\n    try {\n      await this.router.getMetadata(credentialRef);\n      return { refreshed: false, reason: \"not_applicable\" };\n    } catch {\n      return { refreshed: false, reason: \"refresh_failed\", error: \"Credential not found\" };\n    }\n  }\n\n  /**\n   * Check if a credential is still valid (not expired).\n   * Phase 1: always returns true for non-OAuth credentials.\n   */\n  async isValid(credentialRef: string): Promise<boolean> {\n    try {\n      await this.router.getSecret(credentialRef);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","/**\n * EnvSecretsProvider — read-only provider that resolves secrets from environment variables.\n *\n * Refs are expected to be plain env var names (e.g. `DATABASE_URL`). The provider is\n * always available with zero configuration and requires no encryption or keychain access.\n * `setSecret` and `deleteSecret` always throw `SecretAccessDeniedError` because\n * environment variables are managed externally to the running process.\n *\n * @docLink packages/secrets/concepts#env-secrets-provider\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { SecretAccessDeniedError, SecretNotFoundError } from \"@skaile/workspaces/plugins\";\n\n/**\n * Sentinel timestamp for env secrets, which have no real created/updated time.\n * The Unix epoch is unambiguously not \"now\", so consumers can recognise it as\n * \"unknown\" rather than treating it as a genuine recent timestamp.\n */\nconst ENV_UNKNOWN_TIMESTAMP = new Date(0);\n\nexport class EnvSecretsProvider implements ISecretsProvider {\n  readonly id = \"env\";\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    return new TextEncoder().encode(value);\n  }\n\n  async setSecret(_ref: string, _value: Uint8Array, _opts?: SetSecretOptions): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async deleteSecret(_ref: string): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    let keys = Object.keys(process.env);\n    if (filter?.prefix) {\n      keys = keys.filter((k) => k.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      keys = keys.slice(0, filter.limit);\n    }\n    return keys;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    return { ok: true, latencyMs: 0 };\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    // Env vars carry no creation/modification time. `SecretMetadata` requires\n    // both fields, so use the Unix epoch as a documented \"unknown\" sentinel\n    // rather than `new Date()`, which would falsely imply the secret was just\n    // created/updated. The read-only scope summary already signals the source.\n    return {\n      ref,\n      createdAt: ENV_UNKNOWN_TIMESTAMP,\n      updatedAt: ENV_UNKNOWN_TIMESTAMP,\n      scopeSummary: \"environment variable (read-only)\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * LocalSecretsProvider — AES-256-GCM encrypted file-blob storage at `~/.skaile/secrets/`.\n *\n * Each secret is stored as a separate `.enc` file named by the SHA-256 hash of the ref\n * (collision-free, filesystem-safe). A companion `.meta.json` stores the original ref,\n * timestamps, and optional user metadata. The master key is derived via PBKDF2-SHA-512\n * from one of three {@link KeyStrategy} sources: OS keychain (keytar), a passphrase from\n * `SKAILE_SECRETS_PASSPHRASE`, or a machine-derived passphrase as last resort.\n * Switching strategies re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\n// The narrow module, not the `core` barrel: the barrel's chunks use `import.meta`,\n// which CommonJS-transpiling consumers (ts-jest) cannot load.\nimport { globalSkaileDir } from \"../../../core/src/cache-paths.js\";\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport {\n  ProviderUnavailableError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\nconst KEY_LENGTH = 32;\nconst PBKDF2_ITERATIONS = 100_000;\nconst PBKDF2_DIGEST = \"sha512\";\n\nconst KEYCHAIN_SERVICE = \"skaile-secrets\";\nconst KEYCHAIN_ACCOUNT = \"master-key\";\n\n/** Env var that provides the passphrase at runtime (never stored on disk). */\nconst PASSPHRASE_ENV = \"SKAILE_SECRETS_PASSPHRASE\";\n\n/**\n * Master key derivation strategy used by {@link LocalSecretsProvider}.\n *\n * - `keychain` — OS keychain (via keytar); most secure, requires keytar to be installed.\n * - `passphrase` — PBKDF2 from `SKAILE_SECRETS_PASSPHRASE` env var; portable across machines.\n * - `machine` — deterministic from hostname + username; least secure, last-resort fallback.\n *\n * The active strategy is persisted in `~/.skaile/secrets/.key-strategy`. Switching strategies\n * re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\nexport type KeyStrategy = \"keychain\" | \"passphrase\" | \"machine\";\n\n// ---------------------------------------------------------------------------\n// Key derivation\n// ---------------------------------------------------------------------------\n\nfunction deriveMasterKey(passphrase: string, salt: Buffer): Buffer {\n  return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);\n}\n\nfunction getMachinePassphrase(): string {\n  // Deterministic but not secret -- last resort only.\n  return `skaile:${os.hostname()}:${os.userInfo().username}`;\n}\n\n/** Hash a passphrase for verification (stored in .master). */\nfunction hashPassphrase(passphrase: string): string {\n  return crypto.createHash(\"sha256\").update(passphrase).digest(\"hex\");\n}\n\n// ---------------------------------------------------------------------------\n// Filename hashing (injective: sha256 of ref)\n// ---------------------------------------------------------------------------\n\nfunction refToHash(ref: string): string {\n  return crypto.createHash(\"sha256\").update(ref).digest(\"hex\").slice(0, 40);\n}\n\n// ---------------------------------------------------------------------------\n// Encryption / decryption\n// ---------------------------------------------------------------------------\n\nfunction encrypt(data: Uint8Array, key: Buffer): Buffer {\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);\n  const authTag = cipher.getAuthTag();\n  // Format: [iv (12)] [authTag (16)] [ciphertext (...)]\n  return Buffer.concat([iv, authTag, encrypted]);\n}\n\nfunction decrypt(blob: Buffer, key: Buffer): Buffer {\n  const iv = blob.subarray(0, IV_LENGTH);\n  const authTag = blob.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);\n  const ciphertext = blob.subarray(IV_LENGTH + AUTH_TAG_LENGTH);\n  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  decipher.setAuthTag(authTag);\n  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n}\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport class LocalSecretsProvider implements ISecretsProvider {\n  readonly id = \"local\";\n  private secretsDir: string;\n  private masterKey: Buffer | null = null;\n  private salt: Buffer | null = null;\n  private strategy: KeyStrategy = \"machine\";\n\n  constructor(secretsDir?: string) {\n    this.secretsDir = secretsDir ?? path.join(globalSkaileDir(), \"secrets\");\n  }\n\n  // -- Initialization --------------------------------------------------------\n\n  private ensureDir(): void {\n    if (!fs.existsSync(this.secretsDir)) {\n      fs.mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });\n    }\n  }\n\n  private loadOrCreateSalt(): Buffer {\n    const saltPath = path.join(this.secretsDir, \".salt\");\n    if (fs.existsSync(saltPath)) {\n      return fs.readFileSync(saltPath);\n    }\n    const salt = crypto.randomBytes(SALT_LENGTH);\n    fs.writeFileSync(saltPath, salt, { mode: 0o600 });\n    return salt;\n  }\n\n  private async ensureKey(): Promise<void> {\n    if (this.masterKey) return;\n\n    this.ensureDir();\n    this.salt = this.loadOrCreateSalt();\n\n    // Determine strategy\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      this.strategy = fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    } else {\n      // Auto-detect: try keychain, fall back to machine\n      this.strategy = (await this.tryKeychainStrategy()) ? \"keychain\" : \"machine\";\n      fs.writeFileSync(strategyPath, this.strategy, { mode: 0o600 });\n    }\n\n    // Derive key from strategy\n    const passphrase = await this.getPassphraseForStrategy(this.strategy);\n    this.masterKey = deriveMasterKey(passphrase, this.salt);\n  }\n\n  private async tryKeychainStrategy(): Promise<boolean> {\n    try {\n      // `keytar` is an optional OS-keychain native module the user installs\n      // themselves; the `as string` specifier keeps it out of tsc resolution.\n      const keytar = await import(\"keytar\" as string);\n      let stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n      if (!stored) {\n        stored = crypto.randomBytes(32).toString(\"base64\");\n        await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, stored);\n      }\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private async getPassphraseForStrategy(strategy: KeyStrategy): Promise<string> {\n    switch (strategy) {\n      case \"keychain\": {\n        try {\n          // `keytar` is an optional OS-keychain native module the user installs\n          // themselves; the `as string` specifier keeps it out of tsc resolution.\n          const keytar = await import(\"keytar\" as string);\n          const stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n          if (stored) return stored;\n        } catch {\n          // Keychain failed; fall through to machine\n        }\n        return getMachinePassphrase();\n      }\n      case \"passphrase\": {\n        const envPassphrase = process.env[PASSPHRASE_ENV];\n        if (envPassphrase) {\n          // Verify against stored hash if it exists\n          const masterPath = path.join(this.secretsDir, \".master\");\n          if (fs.existsSync(masterPath)) {\n            const storedHash = fs.readFileSync(masterPath, \"utf-8\").trim();\n            if (hashPassphrase(envPassphrase) !== storedHash) {\n              throw new SecretsError(\n                `Passphrase from ${PASSPHRASE_ENV} does not match stored hash. ` +\n                  \"Use skaile auth set-key-strategy passphrase to reset.\",\n                \"PASSPHRASE_MISMATCH\",\n              );\n            }\n          }\n          return envPassphrase;\n        }\n        // No env var -- hard error. Silent fallback to machine would\n        // produce a different key, causing AES-GCM auth-tag failures\n        // on secrets encrypted with the real passphrase.\n        throw new SecretsError(\n          `Strategy is \"passphrase\" but ${PASSPHRASE_ENV} is not set. ` +\n            `Export it before running: export ${PASSPHRASE_ENV}='...'`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n      case \"machine\":\n        return getMachinePassphrase();\n      default:\n        return getMachinePassphrase();\n    }\n  }\n\n  // -- Strategy management ---------------------------------------------------\n\n  /**\n   * Set the key strategy explicitly. Called by `skaile auth set-key-strategy`.\n   *\n   * When existing secrets are present, they are re-encrypted with the new key\n   * to prevent data loss from key mismatch.\n   */\n  async setKeyStrategy(strategy: KeyStrategy, passphrase?: string): Promise<void> {\n    this.ensureDir();\n\n    // --- 1. Validate new strategy prerequisites -------------------------\n\n    const effectivePassphrase = passphrase ?? process.env[PASSPHRASE_ENV];\n\n    if (strategy === \"passphrase\") {\n      if (!effectivePassphrase) {\n        throw new SecretsError(\n          `Passphrase required. Pass it as an argument or set ${PASSPHRASE_ENV}.`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n    }\n\n    if (strategy === \"keychain\") {\n      const success = await this.tryKeychainStrategy();\n      if (!success) {\n        throw new ProviderUnavailableError(\"local\", \"OS keychain not available\");\n      }\n    }\n\n    // --- 2. Load the OLD key under the current strategy -----------------\n    // ensureKey() reads the current strategy file and derives the key\n    // that was used to encrypt existing secrets. This is critical for\n    // cross-process scenarios where masterKey starts as null.\n\n    const encFiles = this.listEncFiles();\n    if (encFiles.length > 0) {\n      await this.ensureKey();\n      const oldKey = this.masterKey!;\n\n      // Derive the new key\n      const salt = this.salt!;\n      const newPassphrase =\n        strategy === \"passphrase\"\n          ? effectivePassphrase!\n          : strategy === \"keychain\"\n            ? await this.getPassphraseForStrategy(\"keychain\")\n            : getMachinePassphrase();\n      const newKey = deriveMasterKey(newPassphrase, salt);\n\n      // Re-encrypt each secret with the new key. A single failure must abort the\n      // whole switch: committing the new strategy while a secret is still under\n      // the old key orphans that secret (the registry advertises a key that no\n      // longer decrypts it). Collect failures and throw before the commit below,\n      // leaving `.key-strategy`/`.master` — and every secret — on the old key.\n      const failed: string[] = [];\n      for (const encFile of encFiles) {\n        const filePath = path.join(this.secretsDir, encFile);\n        const blob = fs.readFileSync(filePath);\n        try {\n          const plaintext = decrypt(blob, oldKey);\n          const reEncrypted = encrypt(plaintext, newKey);\n          fs.writeFileSync(filePath, reEncrypted, { mode: 0o600 });\n        } catch {\n          failed.push(encFile);\n        }\n      }\n      if (failed.length > 0) {\n        throw new Error(\n          `[skaile/secrets] Key-strategy switch aborted: could not re-encrypt ` +\n            `${failed.length} secret(s) (${failed.join(\", \")}). The previous strategy ` +\n            \"is unchanged; resolve the failing secrets before retrying.\",\n        );\n      }\n    }\n\n    // --- 3. Commit the new strategy (last write -- failure above leaves\n    //        the old strategy intact) ------------------------------------\n\n    if (strategy === \"passphrase\") {\n      const masterPath = path.join(this.secretsDir, \".master\");\n      fs.writeFileSync(masterPath, hashPassphrase(effectivePassphrase!), { mode: 0o600 });\n    }\n\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    fs.writeFileSync(strategyPath, strategy, { mode: 0o600 });\n    this.masterKey = null;\n    this.strategy = strategy;\n  }\n\n  getKeyStrategy(): KeyStrategy {\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      return fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    }\n    return \"machine\";\n  }\n\n  // -- File helpers ----------------------------------------------------------\n\n  private encFilename(ref: string): string {\n    return `${refToHash(ref)}.enc`;\n  }\n\n  private metaFilename(ref: string): string {\n    return `${refToHash(ref)}.meta.json`;\n  }\n\n  private metaPath(ref: string): string {\n    return path.join(this.secretsDir, this.metaFilename(ref));\n  }\n\n  private listEncFiles(): string[] {\n    if (!fs.existsSync(this.secretsDir)) return [];\n    return fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".enc\"));\n  }\n\n  // -- ISecretsProvider implementation ----------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    await this.ensureKey();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    const blob = fs.readFileSync(filePath);\n    const decrypted = decrypt(blob, this.masterKey!);\n\n    // Update lastAccessedAt\n    const metaFile = this.metaPath(ref);\n    if (fs.existsSync(metaFile)) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n        meta.lastAccessedAt = new Date().toISOString();\n        fs.writeFileSync(metaFile, JSON.stringify(meta), { mode: 0o600 });\n      } catch {\n        // Non-fatal\n      }\n    }\n\n    return new Uint8Array(decrypted);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    await this.ensureKey();\n    this.ensureDir();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const encrypted = encrypt(value, this.masterKey!);\n    fs.writeFileSync(filePath, encrypted, { mode: 0o600 });\n\n    // Write metadata (stores the original ref for reverse lookup)\n    const now = new Date().toISOString();\n    const metaFile = this.metaPath(ref);\n    let existing: Record<string, unknown> = {};\n    if (fs.existsSync(metaFile)) {\n      try {\n        existing = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      } catch {\n        // Overwrite corrupt meta\n      }\n    }\n    const meta = {\n      ref,\n      createdAt: existing.createdAt ?? now,\n      updatedAt: now,\n      lastAccessedAt: now,\n      ...(opts?.metadata ? { userMeta: opts.metadata } : {}),\n      ...(opts?.ttlSeconds\n        ? { expiresAt: new Date(Date.now() + opts.ttlSeconds * 1000).toISOString() }\n        : {}),\n    };\n    fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2), { mode: 0o600 });\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const metaFile = this.metaPath(ref);\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    fs.unlinkSync(filePath);\n    if (fs.existsSync(metaFile)) {\n      fs.unlinkSync(metaFile);\n    }\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    this.ensureDir();\n    // Read refs from meta files (the .enc filenames are hashes, not refs)\n    const metaFiles = fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".meta.json\"));\n    let refs: string[] = [];\n    for (const mf of metaFiles) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(path.join(this.secretsDir, mf), \"utf-8\"));\n        if (meta.ref) refs.push(meta.ref);\n      } catch {\n        // Skip corrupt meta files\n      }\n    }\n    if (filter?.prefix) {\n      refs = refs.filter((r) => r.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      refs = refs.slice(0, filter.limit);\n    }\n    return refs;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const start = Date.now();\n    try {\n      await this.ensureKey();\n      // Write + read + delete a test secret\n      const testRef = `__test_${crypto.randomBytes(4).toString(\"hex\")}`;\n      const testValue = new TextEncoder().encode(\"test\");\n      await this.setSecret(testRef, testValue);\n      const read = await this.getSecret(testRef);\n      await this.deleteSecret(testRef);\n      if (new TextDecoder().decode(read) !== \"test\") {\n        return { ok: false, error: \"Round-trip mismatch\" };\n      }\n      return { ok: true, latencyMs: Date.now() - start };\n    } catch (e) {\n      return {\n        ok: false,\n        latencyMs: Date.now() - start,\n        error: e instanceof Error ? e.message : String(e),\n      };\n    }\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const metaFile = this.metaPath(ref);\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    if (fs.existsSync(metaFile)) {\n      const raw = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      return {\n        ref: raw.ref ?? ref,\n        createdAt: new Date(raw.createdAt),\n        updatedAt: new Date(raw.updatedAt),\n        lastAccessedAt: raw.lastAccessedAt ? new Date(raw.lastAccessedAt) : undefined,\n        owner: raw.owner,\n        scopeSummary: \"local encrypted file\",\n      };\n    }\n    // Fallback: derive from file stat\n    const stat = fs.statSync(filePath);\n    return {\n      ref,\n      createdAt: stat.birthtime,\n      updatedAt: stat.mtime,\n      scopeSummary: \"local encrypted file\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * SecretsRouter — audit chokepoint for all secret operations.\n *\n * Registers {@link ISecretsProvider} implementations by id, routes credential refs by\n * prefix or via routing config, and emits {@link CredentialAccessed} events for every\n * get, set, delete, list, and metadata operation. Routing rules are evaluated top-to-bottom;\n * the first matching prefix wins and falls back to the configured default provider.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { ProviderUnavailableError } from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Audit event\n// ---------------------------------------------------------------------------\n\n/**\n * Audit event emitted by {@link SecretsRouter} after every secret operation.\n *\n * Delivered synchronously to all registered {@link AuditSink} functions. Errors thrown\n * by sinks are swallowed to ensure they never break the underlying secret operation.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface CredentialAccessed {\n  credential_ref: string;\n  operation: \"get\" | \"set\" | \"delete\" | \"list\" | \"metadata\";\n  provider_id: string;\n  caller_session_id?: string;\n  caller_tool_call?: string;\n  timestamp: Date;\n}\n\n/**\n * Callback function that receives {@link CredentialAccessed} audit events from {@link SecretsRouter}.\n *\n * Register sinks via `SecretsRouter.addSink()`. Sinks run synchronously after each operation;\n * exceptions are caught and suppressed so they cannot interrupt credential resolution.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport type AuditSink = (event: CredentialAccessed) => void;\n\n// ---------------------------------------------------------------------------\n// Routing config\n// ---------------------------------------------------------------------------\n\n/**\n * A single routing rule that maps a credential ref prefix to a provider.\n *\n * Rules in {@link SecretsRouterConfig.rules} are evaluated top-to-bottom;\n * the first rule whose `prefix` matches the start of the credential ref wins.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface RoutingRule {\n  /** Prefix match on credential_ref. First match wins. */\n  prefix: string;\n  /** Provider id to route to. */\n  provider_id: string;\n}\n\n/**\n * Configuration object for {@link SecretsRouter}.\n *\n * Specifies the default provider id used when no routing rule matches, and an optional\n * ordered list of {@link RoutingRule} entries for prefix-based routing.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface SecretsRouterConfig {\n  /** Default provider id when no routing rule matches. */\n  default_provider: string;\n  /** Ordered routing rules. Evaluated top-to-bottom; first prefix match wins. */\n  rules?: RoutingRule[];\n}\n\n// ---------------------------------------------------------------------------\n// Router\n// ---------------------------------------------------------------------------\n\nexport class SecretsRouter {\n  private providers = new Map<string, ISecretsProvider>();\n  private config: SecretsRouterConfig;\n  private sinks: AuditSink[] = [];\n\n  /** Caller context for audit events (set per-request by the runner). */\n  callerSessionId?: string;\n  callerToolCall?: string;\n\n  constructor(config: SecretsRouterConfig) {\n    this.config = config;\n  }\n\n  // -- Provider registration ------------------------------------------------\n\n  register(provider: ISecretsProvider): void {\n    this.providers.set(provider.id, provider);\n  }\n\n  unregister(id: string): void {\n    this.providers.delete(id);\n  }\n\n  listProviders(): string[] {\n    return [...this.providers.keys()];\n  }\n\n  // -- Audit sinks -----------------------------------------------------------\n\n  addSink(sink: AuditSink): void {\n    this.sinks.push(sink);\n  }\n\n  private emit(ref: string, operation: CredentialAccessed[\"operation\"], providerId: string): void {\n    const event: CredentialAccessed = {\n      credential_ref: ref,\n      operation,\n      provider_id: providerId,\n      caller_session_id: this.callerSessionId,\n      caller_tool_call: this.callerToolCall,\n      timestamp: new Date(),\n    };\n    for (const sink of this.sinks) {\n      try {\n        sink(event);\n      } catch {\n        // Audit sink errors must not break the secret operation.\n      }\n    }\n  }\n\n  // -- Routing ---------------------------------------------------------------\n\n  private resolve(ref: string): ISecretsProvider {\n    // Check routing rules first\n    if (this.config.rules) {\n      for (const rule of this.config.rules) {\n        if (ref.startsWith(rule.prefix)) {\n          const provider = this.providers.get(rule.provider_id);\n          if (provider) return provider;\n        }\n      }\n    }\n\n    // Fall back to default\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) {\n      throw new ProviderUnavailableError(\n        this.config.default_provider,\n        `No provider registered for default id \"${this.config.default_provider}\"`,\n      );\n    }\n    return provider;\n  }\n\n  // -- Delegated operations --------------------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"get\", provider.id);\n    return provider.getSecret(ref);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"set\", provider.id);\n    return provider.setSecret(ref, value, opts);\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"delete\", provider.id);\n    return provider.deleteSecret(ref);\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    // List aggregates from the default provider only (per-provider listing\n    // would require iterating all providers; deferred to Phase 3 with\n    // federated catalogs).\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) return [];\n    this.emit(\"*\", \"list\", provider.id);\n    return provider.listSecrets(filter);\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"metadata\", provider.id);\n    return provider.getMetadata(ref);\n  }\n\n  getCapabilities(providerId?: string): ProviderCapabilities | null {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    return provider?.getCapabilities() ?? null;\n  }\n\n  async testConnection(\n    providerId?: string,\n  ): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    if (!provider) {\n      return { ok: false, error: `Provider \"${id}\" not registered` };\n    }\n    return provider.testConnection();\n  }\n}\n","/** Package version of `@skaile/secrets`. */\nexport const VERSION = \"0.0.0\";\n\n// Re-export interface + errors from plugins (convenience for consumers)\nexport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nexport {\n  ProviderUnavailableError,\n  SecretAccessDeniedError,\n  SecretExpiredError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\nexport type { CredentialLifecycleConfig, RefreshResult } from \"./lifecycle.js\";\n// Lifecycle\nexport { CredentialLifecycleService } from \"./lifecycle.js\";\nexport { EnvSecretsProvider } from \"./providers/env.js\";\nexport type { KeyStrategy } from \"./providers/local.js\";\n// Built-in providers\nexport { LocalSecretsProvider } from \"./providers/local.js\";\nexport type { AuditSink, CredentialAccessed, RoutingRule, SecretsRouterConfig } from \"./router.js\";\n// Router\nexport { SecretsRouter } from \"./router.js\";\n"]}
+{"version":3,"sources":["../secrets/src/lifecycle.ts","../secrets/src/providers/env.ts","../secrets/src/providers/local.ts","../secrets/src/router.ts","../secrets/src/index.ts"],"names":["provider"],"mappings":";;;;;;;;AAuCO,IAAM,6BAAN,MAAiC;AAAA,EAC9B,MAAA;AAAA;AAAA;AAAA;AAAA,EAKR,WAAA,CAAY,QAAuB,OAAA,EAA8C;AAC/E,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,aAAA,EAA+C;AAGnE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA;AAC3C,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,IACtD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAkB,OAAO,sBAAA,EAAuB;AAAA,IACrF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,aAAA,EAAyC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AACzC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACnDA,IAAM,qBAAA,mBAAwB,IAAI,IAAA,CAAK,CAAC,CAAA;AAEjC,IAAM,qBAAN,MAAqD;AAAA,EACjD,EAAA,GAAK,KAAA;AAAA,EAEd,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvC;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,MAAA,EAAoB,KAAA,EAAyC;AACzF,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,aAAa,IAAA,EAA6B;AAC9C,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAClC,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AAKA,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,qBAAA;AAAA,MACX,SAAA,EAAW,qBAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;AChDA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,aAAA,GAAgB,QAAA;AAEtB,IAAM,gBAAA,GAAmB,gBAAA;AACzB,IAAM,gBAAA,GAAmB,YAAA;AAGzB,IAAM,cAAA,GAAiB,2BAAA;AAoBvB,SAAS,eAAA,CAAgB,YAAoB,IAAA,EAAsB;AACjE,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,iBAAA,EAAmB,YAAY,aAAa,CAAA;AACzF;AAEA,SAAS,oBAAA,GAA+B;AAEtC,EAAA,OAAO,UAAa,EAAA,CAAA,QAAA,EAAU,CAAA,CAAA,EAAO,EAAA,CAAA,QAAA,GAAW,QAAQ,CAAA,CAAA;AAC1D;AAGA,SAAS,eAAe,UAAA,EAA4B;AAClD,EAAA,OAAc,kBAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACpE;AAMA,SAAS,UAAU,GAAA,EAAqB;AACtC,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC1E;AAMA,SAAS,OAAA,CAAQ,MAAkB,GAAA,EAAqB;AACtD,EAAA,MAAM,EAAA,GAAY,mBAAY,SAAS,CAAA;AACvC,EAAA,MAAM,MAAA,GAAgB,sBAAe,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC3F,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,EAAA,EAAI,OAAA,EAAS,SAAS,CAAC,CAAA;AAC/C;AAEA,SAAS,OAAA,CAAQ,MAAc,GAAA,EAAqB;AAClD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,CAAA,EAAG,SAAS,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,YAAY,eAAe,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,QAAA,CAAS,SAAA,GAAY,eAAe,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAkB,wBAAiB,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC/F,EAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACtE;AAMO,IAAM,uBAAN,MAAuD;AAAA,EACnD,EAAA,GAAK,OAAA;AAAA,EACN,UAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAC3B,IAAA,GAAsB,IAAA;AAAA,EACtB,QAAA,GAAwB,SAAA;AAAA,EAEhC,YAAY,UAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA,IAAmB,IAAA,CAAA,IAAA,CAAK,eAAA,IAAmB,SAAS,CAAA;AAAA,EACxE;AAAA;AAAA,EAIQ,SAAA,GAAkB;AACxB,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,EAAG;AACnC,MAAG,EAAA,CAAA,SAAA,CAAU,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,gBAAA,GAA2B;AACjC,IAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,OAAU,gBAAa,QAAQ,CAAA;AAAA,IACjC;AACA,IAAA,MAAM,IAAA,GAAc,mBAAY,WAAW,CAAA;AAC3C,IAAG,iBAAc,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAA,GAA2B;AACvC,IAAA,IAAI,KAAK,SAAA,EAAW;AAEpB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,gBAAA,EAAiB;AAGlC,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,IAAA,CAAK,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,EAAE,IAAA,EAAK;AAAA,IAC9D,CAAA,MAAO;AAEL,MAAA,IAAA,CAAK,QAAA,GAAY,MAAM,IAAA,CAAK,mBAAA,KAAyB,UAAA,GAAa,SAAA;AAClE,MAAG,iBAAc,YAAA,EAAc,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,wBAAA,CAAyB,KAAK,QAAQ,CAAA;AACpE,IAAA,IAAA,CAAK,SAAA,GAAY,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAAA,EACxD;AAAA,EAEA,MAAc,mBAAA,GAAwC;AACpD,IAAA,IAAI;AAGF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AACxE,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,GAAgB,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACjD,QAAA,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAA,EAAkB,gBAAA,EAAkB,MAAM,CAAA;AAAA,MACrE;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,yBAAyB,QAAA,EAAwC;AAC7E,IAAA,QAAQ,QAAA;AAAU,MAChB,KAAK,UAAA,EAAY;AACf,QAAA,IAAI;AAGF,UAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AAC1E,UAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,QACrB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,QAAA,IAAI,aAAA,EAAe;AAEjB,UAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,UAAA,IAAO,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,YAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC7D,YAAA,IAAI,cAAA,CAAe,aAAa,CAAA,KAAM,UAAA,EAAY;AAChD,cAAA,MAAM,IAAI,YAAA;AAAA,gBACR,mBAAmB,cAAc,CAAA,kFAAA,CAAA;AAAA,gBAEjC;AAAA,eACF;AAAA,YACF;AAAA,UACF;AACA,UAAA,OAAO,aAAA;AAAA,QACT;AAIA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,6BAAA,EAAgC,cAAc,CAAA,8CAAA,EACR,cAAc,CAAA,MAAA,CAAA;AAAA,UACpD;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,SAAA;AACH,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AACE,QAAA,OAAO,oBAAA,EAAqB;AAAA;AAChC,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CAAe,QAAA,EAAuB,UAAA,EAAoC;AAC9E,IAAA,IAAA,CAAK,SAAA,EAAU;AAIf,IAAA,MAAM,mBAAA,GAAsB,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEpE,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,sDAAsD,cAAc,CAAA,CAAA,CAAA;AAAA,UACpE;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC/C,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,wBAAA,CAAyB,OAAA,EAAS,2BAA2B,CAAA;AAAA,MACzE;AAAA,IACF;AAOA,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AACnC,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,KAAK,SAAA,EAAU;AACrB,MAAA,MAAM,SAAS,IAAA,CAAK,SAAA;AAGpB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,MAAA,MAAM,aAAA,GACJ,QAAA,KAAa,YAAA,GACT,mBAAA,GACA,QAAA,KAAa,UAAA,GACX,MAAM,IAAA,CAAK,wBAAA,CAAyB,UAAU,CAAA,GAC9C,oBAAA,EAAqB;AAC7B,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,aAAA,EAAe,IAAI,CAAA;AAOlD,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,QAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AACtC,UAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AAC7C,UAAG,iBAAc,QAAA,EAAU,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,QACzD,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,QACrB;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sEACK,MAAA,CAAO,MAAM,eAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,mFAAA;AAAA,SAEpD;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,MAAG,EAAA,CAAA,aAAA,CAAc,YAAY,cAAA,CAAe,mBAAoB,GAAG,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAG,iBAAc,YAAA,EAAc,QAAA,EAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AACxD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,cAAA,GAA8B;AAC5B,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,OAAU,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAA,CAAE,IAAA,EAAK;AAAA,IACrD;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA,EAIQ,YAAY,GAAA,EAAqB;AACvC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,IAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,aAAa,GAAA,EAAqB;AACxC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,UAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,SAAS,GAAA,EAAqB;AACpC,IAAA,OAAY,UAAK,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,YAAA,CAAa,GAAG,CAAC,CAAA;AAAA,EAC1D;AAAA,EAEQ,YAAA,GAAyB;AAC/B,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,SAAU,EAAC;AAC7C,IAAA,OAAU,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACzE;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,IAAA,CAAK,SAAU,CAAA;AAG/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC1D,QAAA,IAAA,CAAK,cAAA,GAAA,iBAAiB,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAC7C,QAAG,EAAA,CAAA,aAAA,CAAc,UAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,MAClE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,WAAW,SAAS,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,EAAO,IAAA,CAAK,SAAU,CAAA;AAChD,IAAG,iBAAc,QAAA,EAAU,SAAA,EAAW,EAAE,IAAA,EAAM,KAAO,CAAA;AAGrD,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,GAAA;AAAA,MACA,SAAA,EAAW,SAAS,SAAA,IAAa,GAAA;AAAA,MACjC,SAAA,EAAW,GAAA;AAAA,MACX,cAAA,EAAgB,GAAA;AAAA,MAChB,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,IAAA,CAAK,QAAA,KAAa,EAAC;AAAA,MACpD,GAAI,IAAA,EAAM,UAAA,GACN,EAAE,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY,KACvE;AAAC,KACP;AACA,IAAG,EAAA,CAAA,aAAA,CAAc,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAG,cAAW,QAAQ,CAAA;AACtB,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAG,cAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAA,CAAK,SAAA,EAAU;AAEf,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,YAAY,CAAC,CAAA;AACxF,IAAA,IAAI,OAAiB,EAAC;AACtB,IAAA,KAAA,MAAW,MAAM,SAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,UAAA,EAAY,EAAE,CAAA,EAAG,OAAO,CAAC,CAAA;AAChF,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,MAClC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,SAAA,EAAU;AAErB,MAAA,MAAM,UAAU,CAAA,OAAA,EAAiB,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AAC/D,MAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,SAAS,CAAA;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,aAAa,OAAO,CAAA;AAC/B,MAAA,IAAI,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACnD;AACA,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAW,IAAA,CAAK,GAAA,KAAQ,KAAA,EAAM;AAAA,IACnD,SAAS,CAAA,EAAG;AACV,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,QACxB,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC;AAAA,OAClD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,GAAA,EAAK,IAAI,GAAA,IAAO,GAAA;AAAA,QAChB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,gBAAgB,GAAA,CAAI,cAAA,GAAiB,IAAI,IAAA,CAAK,GAAA,CAAI,cAAc,CAAA,GAAI,MAAA;AAAA,QACpE,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAU,YAAS,QAAQ,CAAA;AACjC,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,KAAA;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;;;ACzZO,IAAM,gBAAN,MAAoB;AAAA,EACjB,SAAA,uBAAgB,GAAA,EAA8B;AAAA,EAC9C,MAAA;AAAA,EACA,QAAqB,EAAC;AAAA;AAAA,EAG9B,eAAA;AAAA,EACA,cAAA;AAAA,EAEA,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA,EAIA,SAAS,QAAA,EAAkC;AACzC,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC1C;AAAA,EAEA,WAAW,EAAA,EAAkB;AAC3B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,EAC1B;AAAA,EAEA,aAAA,GAA0B;AACxB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAA,EAClC;AAAA;AAAA,EAIA,QAAQ,IAAA,EAAuB;AAC7B,IAAA,IAAA,CAAK,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACtB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,SAAA,EAA4C,UAAA,EAA0B;AAC9F,IAAA,MAAM,KAAA,GAA4B;AAAA,MAChC,cAAA,EAAgB,GAAA;AAAA,MAChB,SAAA;AAAA,MACA,WAAA,EAAa,UAAA;AAAA,MACb,mBAAmB,IAAA,CAAK,eAAA;AAAA,MACxB,kBAAkB,IAAA,CAAK,cAAA;AAAA,MACvB,SAAA,sBAAe,IAAA;AAAK,KACtB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIQ,QAAQ,GAAA,EAA+B;AAE7C,IAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO;AACpC,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,MAAMA,SAAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,KAAK,WAAW,CAAA;AACpD,UAAA,IAAIA,WAAU,OAAOA,SAAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,KAAK,MAAA,CAAO,gBAAA;AAAA,QACZ,CAAA,uCAAA,EAA0C,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,UAAU,GAAG,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,IAAI,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,QAAA,CAAS,EAAE,CAAA;AACpC,IAAA,OAAO,QAAA,CAAS,aAAa,GAAG,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AAIxD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,CAAS,EAAE,CAAA;AAClC,IAAA,OAAO,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAA,EAAY,QAAA,CAAS,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,CAAS,YAAY,GAAG,CAAA;AAAA,EACjC;AAAA,EAEA,gBAAgB,UAAA,EAAkD;AAChE,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,EAAU,iBAAgB,IAAK,IAAA;AAAA,EACxC;AAAA,EAEA,MAAM,eACJ,UAAA,EAC8D;AAC9D,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,UAAA,EAAa,EAAE,CAAA,gBAAA,CAAA,EAAmB;AAAA,IAC/D;AACA,IAAA,OAAO,SAAS,cAAA,EAAe;AAAA,EACjC;AACF;;;ACvNO,IAAM,OAAA,GAAU","file":"chunk-HTKZ4AOW.js","sourcesContent":["/**\n * CredentialLifecycleService — manages OAuth token refresh outside the SecretsRouter.\n *\n * Works with opaque token blobs stored via the {@link SecretsRouter}; providers remain\n * OAuth-unaware. Phase 1 ships non-OAuth paths (always returns `not_applicable`).\n * Full proactive OAuth refresh with expiry checking ships in Phase 3.4.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\n\nimport type { SecretsRouter } from \"./router.js\";\n\n/**\n * Configuration for {@link CredentialLifecycleService}.\n *\n * Controls how aggressively the service proactively refreshes credentials before they expire.\n * The default lead time is 300 seconds (5 minutes).\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface CredentialLifecycleConfig {\n  /** How far before expiry to trigger a proactive refresh (seconds). */\n  refreshLeadTimeSec: number;\n}\n\n/**\n * Result returned by {@link CredentialLifecycleService.refreshIfNeeded}.\n *\n * The `reason` discriminant indicates why a refresh did or did not occur.\n * An `error` string is present only when `reason` is `refresh_failed`.\n *\n * @docLink packages/secrets/concepts#credential-lifecycle\n */\nexport interface RefreshResult {\n  refreshed: boolean;\n  reason: \"not_applicable\" | \"still_valid\" | \"refreshed\" | \"refresh_failed\";\n  error?: string;\n}\n\nexport class CredentialLifecycleService {\n  private router: SecretsRouter;\n\n  // `_config` is accepted for signature stability but not stored yet: Phase 1\n  // ships no OAuth refresh, so there is nothing to configure. Phase 3.4 will\n  // store and read `refreshLeadTimeSec` when proactive refresh lands.\n  constructor(router: SecretsRouter, _config?: Partial<CredentialLifecycleConfig>) {\n    this.router = router;\n  }\n\n  /**\n   * Attempt to refresh a credential if needed.\n   * Phase 1: always returns not_applicable (no OAuth support yet).\n   */\n  async refreshIfNeeded(credentialRef: string): Promise<RefreshResult> {\n    // Phase 1: no OAuth refresh implemented.\n    // The credential exists and is valid as-is (static secrets, env vars, etc.)\n    try {\n      await this.router.getMetadata(credentialRef);\n      return { refreshed: false, reason: \"not_applicable\" };\n    } catch {\n      return { refreshed: false, reason: \"refresh_failed\", error: \"Credential not found\" };\n    }\n  }\n\n  /**\n   * Check if a credential is still valid (not expired).\n   * Phase 1: always returns true for non-OAuth credentials.\n   */\n  async isValid(credentialRef: string): Promise<boolean> {\n    try {\n      await this.router.getSecret(credentialRef);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","/**\n * EnvSecretsProvider — read-only provider that resolves secrets from environment variables.\n *\n * Refs are expected to be plain env var names (e.g. `DATABASE_URL`). The provider is\n * always available with zero configuration and requires no encryption or keychain access.\n * `setSecret` and `deleteSecret` always throw `SecretAccessDeniedError` because\n * environment variables are managed externally to the running process.\n *\n * @docLink packages/secrets/concepts#env-secrets-provider\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { SecretAccessDeniedError, SecretNotFoundError } from \"@skaile/workspaces/plugins\";\n\n/**\n * Sentinel timestamp for env secrets, which have no real created/updated time.\n * The Unix epoch is unambiguously not \"now\", so consumers can recognise it as\n * \"unknown\" rather than treating it as a genuine recent timestamp.\n */\nconst ENV_UNKNOWN_TIMESTAMP = new Date(0);\n\nexport class EnvSecretsProvider implements ISecretsProvider {\n  readonly id = \"env\";\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    return new TextEncoder().encode(value);\n  }\n\n  async setSecret(_ref: string, _value: Uint8Array, _opts?: SetSecretOptions): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async deleteSecret(_ref: string): Promise<void> {\n    throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    let keys = Object.keys(process.env);\n    if (filter?.prefix) {\n      keys = keys.filter((k) => k.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      keys = keys.slice(0, filter.limit);\n    }\n    return keys;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    return { ok: true, latencyMs: 0 };\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const value = process.env[ref];\n    if (value === undefined) {\n      throw new SecretNotFoundError(ref);\n    }\n    // Env vars carry no creation/modification time. `SecretMetadata` requires\n    // both fields, so use the Unix epoch as a documented \"unknown\" sentinel\n    // rather than `new Date()`, which would falsely imply the secret was just\n    // created/updated. The read-only scope summary already signals the source.\n    return {\n      ref,\n      createdAt: ENV_UNKNOWN_TIMESTAMP,\n      updatedAt: ENV_UNKNOWN_TIMESTAMP,\n      scopeSummary: \"environment variable (read-only)\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * LocalSecretsProvider — AES-256-GCM encrypted file-blob storage at `~/.skaile/secrets/`.\n *\n * Each secret is stored as a separate `.enc` file named by the SHA-256 hash of the ref\n * (collision-free, filesystem-safe). A companion `.meta.json` stores the original ref,\n * timestamps, and optional user metadata. The master key is derived via PBKDF2-SHA-512\n * from one of three {@link KeyStrategy} sources: OS keychain (keytar), a passphrase from\n * `SKAILE_SECRETS_PASSPHRASE`, or a machine-derived passphrase as last resort.\n * Switching strategies re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\n\nimport * as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\n// The narrow module, not the `core` barrel: the barrel's chunks use `import.meta`,\n// which CommonJS-transpiling consumers (ts-jest) cannot load.\nimport { globalSkaileDir } from \"../../../core/src/cache-paths.js\";\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport {\n  ProviderUnavailableError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\nconst KEY_LENGTH = 32;\nconst PBKDF2_ITERATIONS = 100_000;\nconst PBKDF2_DIGEST = \"sha512\";\n\nconst KEYCHAIN_SERVICE = \"skaile-secrets\";\nconst KEYCHAIN_ACCOUNT = \"master-key\";\n\n/** Env var that provides the passphrase at runtime (never stored on disk). */\nconst PASSPHRASE_ENV = \"SKAILE_SECRETS_PASSPHRASE\";\n\n/**\n * Master key derivation strategy used by {@link LocalSecretsProvider}.\n *\n * - `keychain` — OS keychain (via keytar); most secure, requires keytar to be installed.\n * - `passphrase` — PBKDF2 from `SKAILE_SECRETS_PASSPHRASE` env var; portable across machines.\n * - `machine` — deterministic from hostname + username; least secure, last-resort fallback.\n *\n * The active strategy is persisted in `~/.skaile/secrets/.key-strategy`. Switching strategies\n * re-encrypts all existing secrets with the new key.\n *\n * @docLink packages/secrets/concepts#local-secrets-provider\n */\nexport type KeyStrategy = \"keychain\" | \"passphrase\" | \"machine\";\n\n// ---------------------------------------------------------------------------\n// Key derivation\n// ---------------------------------------------------------------------------\n\nfunction deriveMasterKey(passphrase: string, salt: Buffer): Buffer {\n  return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);\n}\n\nfunction getMachinePassphrase(): string {\n  // Deterministic but not secret -- last resort only.\n  return `skaile:${os.hostname()}:${os.userInfo().username}`;\n}\n\n/** Hash a passphrase for verification (stored in .master). */\nfunction hashPassphrase(passphrase: string): string {\n  return crypto.createHash(\"sha256\").update(passphrase).digest(\"hex\");\n}\n\n// ---------------------------------------------------------------------------\n// Filename hashing (injective: sha256 of ref)\n// ---------------------------------------------------------------------------\n\nfunction refToHash(ref: string): string {\n  return crypto.createHash(\"sha256\").update(ref).digest(\"hex\").slice(0, 40);\n}\n\n// ---------------------------------------------------------------------------\n// Encryption / decryption\n// ---------------------------------------------------------------------------\n\nfunction encrypt(data: Uint8Array, key: Buffer): Buffer {\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);\n  const authTag = cipher.getAuthTag();\n  // Format: [iv (12)] [authTag (16)] [ciphertext (...)]\n  return Buffer.concat([iv, authTag, encrypted]);\n}\n\nfunction decrypt(blob: Buffer, key: Buffer): Buffer {\n  const iv = blob.subarray(0, IV_LENGTH);\n  const authTag = blob.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);\n  const ciphertext = blob.subarray(IV_LENGTH + AUTH_TAG_LENGTH);\n  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n  decipher.setAuthTag(authTag);\n  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n}\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport class LocalSecretsProvider implements ISecretsProvider {\n  readonly id = \"local\";\n  private secretsDir: string;\n  private masterKey: Buffer | null = null;\n  private salt: Buffer | null = null;\n  private strategy: KeyStrategy = \"machine\";\n\n  constructor(secretsDir?: string) {\n    this.secretsDir = secretsDir ?? path.join(globalSkaileDir(), \"secrets\");\n  }\n\n  // -- Initialization --------------------------------------------------------\n\n  private ensureDir(): void {\n    if (!fs.existsSync(this.secretsDir)) {\n      fs.mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });\n    }\n  }\n\n  private loadOrCreateSalt(): Buffer {\n    const saltPath = path.join(this.secretsDir, \".salt\");\n    if (fs.existsSync(saltPath)) {\n      return fs.readFileSync(saltPath);\n    }\n    const salt = crypto.randomBytes(SALT_LENGTH);\n    fs.writeFileSync(saltPath, salt, { mode: 0o600 });\n    return salt;\n  }\n\n  private async ensureKey(): Promise<void> {\n    if (this.masterKey) return;\n\n    this.ensureDir();\n    this.salt = this.loadOrCreateSalt();\n\n    // Determine strategy\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      this.strategy = fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    } else {\n      // Auto-detect: try keychain, fall back to machine\n      this.strategy = (await this.tryKeychainStrategy()) ? \"keychain\" : \"machine\";\n      fs.writeFileSync(strategyPath, this.strategy, { mode: 0o600 });\n    }\n\n    // Derive key from strategy\n    const passphrase = await this.getPassphraseForStrategy(this.strategy);\n    this.masterKey = deriveMasterKey(passphrase, this.salt);\n  }\n\n  private async tryKeychainStrategy(): Promise<boolean> {\n    try {\n      // `keytar` is an optional OS-keychain native module the user installs\n      // themselves; the `as string` specifier keeps it out of tsc resolution.\n      const keytar = await import(\"keytar\" as string);\n      let stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n      if (!stored) {\n        stored = crypto.randomBytes(32).toString(\"base64\");\n        await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, stored);\n      }\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private async getPassphraseForStrategy(strategy: KeyStrategy): Promise<string> {\n    switch (strategy) {\n      case \"keychain\": {\n        try {\n          // `keytar` is an optional OS-keychain native module the user installs\n          // themselves; the `as string` specifier keeps it out of tsc resolution.\n          const keytar = await import(\"keytar\" as string);\n          const stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n          if (stored) return stored;\n        } catch {\n          // Keychain failed; fall through to machine\n        }\n        return getMachinePassphrase();\n      }\n      case \"passphrase\": {\n        const envPassphrase = process.env[PASSPHRASE_ENV];\n        if (envPassphrase) {\n          // Verify against stored hash if it exists\n          const masterPath = path.join(this.secretsDir, \".master\");\n          if (fs.existsSync(masterPath)) {\n            const storedHash = fs.readFileSync(masterPath, \"utf-8\").trim();\n            if (hashPassphrase(envPassphrase) !== storedHash) {\n              throw new SecretsError(\n                `Passphrase from ${PASSPHRASE_ENV} does not match stored hash. ` +\n                  \"Use skaile auth set-key-strategy passphrase to reset.\",\n                \"PASSPHRASE_MISMATCH\",\n              );\n            }\n          }\n          return envPassphrase;\n        }\n        // No env var -- hard error. Silent fallback to machine would\n        // produce a different key, causing AES-GCM auth-tag failures\n        // on secrets encrypted with the real passphrase.\n        throw new SecretsError(\n          `Strategy is \"passphrase\" but ${PASSPHRASE_ENV} is not set. ` +\n            `Export it before running: export ${PASSPHRASE_ENV}='...'`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n      case \"machine\":\n        return getMachinePassphrase();\n      default:\n        return getMachinePassphrase();\n    }\n  }\n\n  // -- Strategy management ---------------------------------------------------\n\n  /**\n   * Set the key strategy explicitly. Called by `skaile auth set-key-strategy`.\n   *\n   * When existing secrets are present, they are re-encrypted with the new key\n   * to prevent data loss from key mismatch.\n   */\n  async setKeyStrategy(strategy: KeyStrategy, passphrase?: string): Promise<void> {\n    this.ensureDir();\n\n    // --- 1. Validate new strategy prerequisites -------------------------\n\n    const effectivePassphrase = passphrase ?? process.env[PASSPHRASE_ENV];\n\n    if (strategy === \"passphrase\") {\n      if (!effectivePassphrase) {\n        throw new SecretsError(\n          `Passphrase required. Pass it as an argument or set ${PASSPHRASE_ENV}.`,\n          \"PASSPHRASE_REQUIRED\",\n        );\n      }\n    }\n\n    if (strategy === \"keychain\") {\n      const success = await this.tryKeychainStrategy();\n      if (!success) {\n        throw new ProviderUnavailableError(\"local\", \"OS keychain not available\");\n      }\n    }\n\n    // --- 2. Load the OLD key under the current strategy -----------------\n    // ensureKey() reads the current strategy file and derives the key\n    // that was used to encrypt existing secrets. This is critical for\n    // cross-process scenarios where masterKey starts as null.\n\n    const encFiles = this.listEncFiles();\n    if (encFiles.length > 0) {\n      await this.ensureKey();\n      const oldKey = this.masterKey!;\n\n      // Derive the new key\n      const salt = this.salt!;\n      const newPassphrase =\n        strategy === \"passphrase\"\n          ? effectivePassphrase!\n          : strategy === \"keychain\"\n            ? await this.getPassphraseForStrategy(\"keychain\")\n            : getMachinePassphrase();\n      const newKey = deriveMasterKey(newPassphrase, salt);\n\n      // Re-encrypt each secret with the new key. A single failure must abort the\n      // whole switch: committing the new strategy while a secret is still under\n      // the old key orphans that secret (the registry advertises a key that no\n      // longer decrypts it). Collect failures and throw before the commit below,\n      // leaving `.key-strategy`/`.master` — and every secret — on the old key.\n      const failed: string[] = [];\n      for (const encFile of encFiles) {\n        const filePath = path.join(this.secretsDir, encFile);\n        const blob = fs.readFileSync(filePath);\n        try {\n          const plaintext = decrypt(blob, oldKey);\n          const reEncrypted = encrypt(plaintext, newKey);\n          fs.writeFileSync(filePath, reEncrypted, { mode: 0o600 });\n        } catch {\n          failed.push(encFile);\n        }\n      }\n      if (failed.length > 0) {\n        throw new Error(\n          `[skaile/secrets] Key-strategy switch aborted: could not re-encrypt ` +\n            `${failed.length} secret(s) (${failed.join(\", \")}). The previous strategy ` +\n            \"is unchanged; resolve the failing secrets before retrying.\",\n        );\n      }\n    }\n\n    // --- 3. Commit the new strategy (last write -- failure above leaves\n    //        the old strategy intact) ------------------------------------\n\n    if (strategy === \"passphrase\") {\n      const masterPath = path.join(this.secretsDir, \".master\");\n      fs.writeFileSync(masterPath, hashPassphrase(effectivePassphrase!), { mode: 0o600 });\n    }\n\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    fs.writeFileSync(strategyPath, strategy, { mode: 0o600 });\n    this.masterKey = null;\n    this.strategy = strategy;\n  }\n\n  getKeyStrategy(): KeyStrategy {\n    const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n    if (fs.existsSync(strategyPath)) {\n      return fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n    }\n    return \"machine\";\n  }\n\n  // -- File helpers ----------------------------------------------------------\n\n  private encFilename(ref: string): string {\n    return `${refToHash(ref)}.enc`;\n  }\n\n  private metaFilename(ref: string): string {\n    return `${refToHash(ref)}.meta.json`;\n  }\n\n  private metaPath(ref: string): string {\n    return path.join(this.secretsDir, this.metaFilename(ref));\n  }\n\n  private listEncFiles(): string[] {\n    if (!fs.existsSync(this.secretsDir)) return [];\n    return fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".enc\"));\n  }\n\n  // -- ISecretsProvider implementation ----------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    await this.ensureKey();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    const blob = fs.readFileSync(filePath);\n    const decrypted = decrypt(blob, this.masterKey!);\n\n    // Update lastAccessedAt\n    const metaFile = this.metaPath(ref);\n    if (fs.existsSync(metaFile)) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n        meta.lastAccessedAt = new Date().toISOString();\n        fs.writeFileSync(metaFile, JSON.stringify(meta), { mode: 0o600 });\n      } catch {\n        // Non-fatal\n      }\n    }\n\n    return new Uint8Array(decrypted);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    await this.ensureKey();\n    this.ensureDir();\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const encrypted = encrypt(value, this.masterKey!);\n    fs.writeFileSync(filePath, encrypted, { mode: 0o600 });\n\n    // Write metadata (stores the original ref for reverse lookup)\n    const now = new Date().toISOString();\n    const metaFile = this.metaPath(ref);\n    let existing: Record<string, unknown> = {};\n    if (fs.existsSync(metaFile)) {\n      try {\n        existing = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      } catch {\n        // Overwrite corrupt meta\n      }\n    }\n    const meta = {\n      ref,\n      createdAt: existing.createdAt ?? now,\n      updatedAt: now,\n      lastAccessedAt: now,\n      ...(opts?.metadata ? { userMeta: opts.metadata } : {}),\n      ...(opts?.ttlSeconds\n        ? { expiresAt: new Date(Date.now() + opts.ttlSeconds * 1000).toISOString() }\n        : {}),\n    };\n    fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2), { mode: 0o600 });\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    const metaFile = this.metaPath(ref);\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    fs.unlinkSync(filePath);\n    if (fs.existsSync(metaFile)) {\n      fs.unlinkSync(metaFile);\n    }\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    this.ensureDir();\n    // Read refs from meta files (the .enc filenames are hashes, not refs)\n    const metaFiles = fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".meta.json\"));\n    let refs: string[] = [];\n    for (const mf of metaFiles) {\n      try {\n        const meta = JSON.parse(fs.readFileSync(path.join(this.secretsDir, mf), \"utf-8\"));\n        if (meta.ref) refs.push(meta.ref);\n      } catch {\n        // Skip corrupt meta files\n      }\n    }\n    if (filter?.prefix) {\n      refs = refs.filter((r) => r.startsWith(filter.prefix!));\n    }\n    if (filter?.limit) {\n      refs = refs.slice(0, filter.limit);\n    }\n    return refs;\n  }\n\n  async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const start = Date.now();\n    try {\n      await this.ensureKey();\n      // Write + read + delete a test secret\n      const testRef = `__test_${crypto.randomBytes(4).toString(\"hex\")}`;\n      const testValue = new TextEncoder().encode(\"test\");\n      await this.setSecret(testRef, testValue);\n      const read = await this.getSecret(testRef);\n      await this.deleteSecret(testRef);\n      if (new TextDecoder().decode(read) !== \"test\") {\n        return { ok: false, error: \"Round-trip mismatch\" };\n      }\n      return { ok: true, latencyMs: Date.now() - start };\n    } catch (e) {\n      return {\n        ok: false,\n        latencyMs: Date.now() - start,\n        error: e instanceof Error ? e.message : String(e),\n      };\n    }\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const metaFile = this.metaPath(ref);\n    const filePath = path.join(this.secretsDir, this.encFilename(ref));\n    if (!fs.existsSync(filePath)) {\n      throw new SecretNotFoundError(ref);\n    }\n    if (fs.existsSync(metaFile)) {\n      const raw = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n      return {\n        ref: raw.ref ?? ref,\n        createdAt: new Date(raw.createdAt),\n        updatedAt: new Date(raw.updatedAt),\n        lastAccessedAt: raw.lastAccessedAt ? new Date(raw.lastAccessedAt) : undefined,\n        owner: raw.owner,\n        scopeSummary: \"local encrypted file\",\n      };\n    }\n    // Fallback: derive from file stat\n    const stat = fs.statSync(filePath);\n    return {\n      ref,\n      createdAt: stat.birthtime,\n      updatedAt: stat.mtime,\n      scopeSummary: \"local encrypted file\",\n    };\n  }\n\n  getCapabilities(): ProviderCapabilities {\n    return {\n      supportsRotation: false,\n      supportsExpiry: false,\n      supportsBatch: false,\n      scopeModel: \"flat\",\n    };\n  }\n}\n","/**\n * SecretsRouter — audit chokepoint for all secret operations.\n *\n * Registers {@link ISecretsProvider} implementations by id, routes credential refs by\n * prefix or via routing config, and emits {@link CredentialAccessed} events for every\n * get, set, delete, list, and metadata operation. Routing rules are evaluated top-to-bottom;\n * the first matching prefix wins and falls back to the configured default provider.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\n\nimport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { ProviderUnavailableError } from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Audit event\n// ---------------------------------------------------------------------------\n\n/**\n * Audit event emitted by {@link SecretsRouter} after every secret operation.\n *\n * Delivered synchronously to all registered {@link AuditSink} functions. Errors thrown\n * by sinks are swallowed to ensure they never break the underlying secret operation.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface CredentialAccessed {\n  credential_ref: string;\n  operation: \"get\" | \"set\" | \"delete\" | \"list\" | \"metadata\";\n  provider_id: string;\n  caller_session_id?: string;\n  caller_tool_call?: string;\n  timestamp: Date;\n}\n\n/**\n * Callback function that receives {@link CredentialAccessed} audit events from {@link SecretsRouter}.\n *\n * Register sinks via `SecretsRouter.addSink()`. Sinks run synchronously after each operation;\n * exceptions are caught and suppressed so they cannot interrupt credential resolution.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport type AuditSink = (event: CredentialAccessed) => void;\n\n// ---------------------------------------------------------------------------\n// Routing config\n// ---------------------------------------------------------------------------\n\n/**\n * A single routing rule that maps a credential ref prefix to a provider.\n *\n * Rules in {@link SecretsRouterConfig.rules} are evaluated top-to-bottom;\n * the first rule whose `prefix` matches the start of the credential ref wins.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface RoutingRule {\n  /** Prefix match on credential_ref. First match wins. */\n  prefix: string;\n  /** Provider id to route to. */\n  provider_id: string;\n}\n\n/**\n * Configuration object for {@link SecretsRouter}.\n *\n * Specifies the default provider id used when no routing rule matches, and an optional\n * ordered list of {@link RoutingRule} entries for prefix-based routing.\n *\n * @docLink packages/secrets/concepts#secrets-router\n */\nexport interface SecretsRouterConfig {\n  /** Default provider id when no routing rule matches. */\n  default_provider: string;\n  /** Ordered routing rules. Evaluated top-to-bottom; first prefix match wins. */\n  rules?: RoutingRule[];\n}\n\n// ---------------------------------------------------------------------------\n// Router\n// ---------------------------------------------------------------------------\n\nexport class SecretsRouter {\n  private providers = new Map<string, ISecretsProvider>();\n  private config: SecretsRouterConfig;\n  private sinks: AuditSink[] = [];\n\n  /** Caller context for audit events (set per-request by the runner). */\n  callerSessionId?: string;\n  callerToolCall?: string;\n\n  constructor(config: SecretsRouterConfig) {\n    this.config = config;\n  }\n\n  // -- Provider registration ------------------------------------------------\n\n  register(provider: ISecretsProvider): void {\n    this.providers.set(provider.id, provider);\n  }\n\n  unregister(id: string): void {\n    this.providers.delete(id);\n  }\n\n  listProviders(): string[] {\n    return [...this.providers.keys()];\n  }\n\n  // -- Audit sinks -----------------------------------------------------------\n\n  addSink(sink: AuditSink): void {\n    this.sinks.push(sink);\n  }\n\n  private emit(ref: string, operation: CredentialAccessed[\"operation\"], providerId: string): void {\n    const event: CredentialAccessed = {\n      credential_ref: ref,\n      operation,\n      provider_id: providerId,\n      caller_session_id: this.callerSessionId,\n      caller_tool_call: this.callerToolCall,\n      timestamp: new Date(),\n    };\n    for (const sink of this.sinks) {\n      try {\n        sink(event);\n      } catch {\n        // Audit sink errors must not break the secret operation.\n      }\n    }\n  }\n\n  // -- Routing ---------------------------------------------------------------\n\n  private resolve(ref: string): ISecretsProvider {\n    // Check routing rules first\n    if (this.config.rules) {\n      for (const rule of this.config.rules) {\n        if (ref.startsWith(rule.prefix)) {\n          const provider = this.providers.get(rule.provider_id);\n          if (provider) return provider;\n        }\n      }\n    }\n\n    // Fall back to default\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) {\n      throw new ProviderUnavailableError(\n        this.config.default_provider,\n        `No provider registered for default id \"${this.config.default_provider}\"`,\n      );\n    }\n    return provider;\n  }\n\n  // -- Delegated operations --------------------------------------------------\n\n  async getSecret(ref: string): Promise<Uint8Array> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"get\", provider.id);\n    return provider.getSecret(ref);\n  }\n\n  async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"set\", provider.id);\n    return provider.setSecret(ref, value, opts);\n  }\n\n  async deleteSecret(ref: string): Promise<void> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"delete\", provider.id);\n    return provider.deleteSecret(ref);\n  }\n\n  async listSecrets(filter?: ListFilter): Promise<string[]> {\n    // List aggregates from the default provider only (per-provider listing\n    // would require iterating all providers; deferred to Phase 3 with\n    // federated catalogs).\n    const provider = this.providers.get(this.config.default_provider);\n    if (!provider) return [];\n    this.emit(\"*\", \"list\", provider.id);\n    return provider.listSecrets(filter);\n  }\n\n  async getMetadata(ref: string): Promise<SecretMetadata> {\n    const provider = this.resolve(ref);\n    this.emit(ref, \"metadata\", provider.id);\n    return provider.getMetadata(ref);\n  }\n\n  getCapabilities(providerId?: string): ProviderCapabilities | null {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    return provider?.getCapabilities() ?? null;\n  }\n\n  async testConnection(\n    providerId?: string,\n  ): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n    const id = providerId ?? this.config.default_provider;\n    const provider = this.providers.get(id);\n    if (!provider) {\n      return { ok: false, error: `Provider \"${id}\" not registered` };\n    }\n    return provider.testConnection();\n  }\n}\n","/** Package version of `@skaile/secrets`. */\nexport const VERSION = \"0.0.0\";\n\n// Re-export interface + errors from plugins (convenience for consumers)\nexport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nexport {\n  ProviderUnavailableError,\n  SecretAccessDeniedError,\n  SecretExpiredError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"@skaile/workspaces/plugins\";\nexport type { CredentialLifecycleConfig, RefreshResult } from \"./lifecycle.js\";\n// Lifecycle\nexport { CredentialLifecycleService } from \"./lifecycle.js\";\nexport { EnvSecretsProvider } from \"./providers/env.js\";\nexport type { KeyStrategy } from \"./providers/local.js\";\n// Built-in providers\nexport { LocalSecretsProvider } from \"./providers/local.js\";\nexport type { AuditSink, CredentialAccessed, RoutingRule, SecretsRouterConfig } from \"./router.js\";\n// Router\nexport { SecretsRouter } from \"./router.js\";\n"]}

package/dist/{chunk-OFNXRI4L.js → chunk-IDUGP4V7.js}

@@ -1,5 +1,5 @@
 import { classifyClaudeSdkError } from './chunk-XBSQ4KMC.js';
-import { toMergedRegistry, createDriver, getProviderPreset, resolvePresetBaseUrl, expandPreset, resolveProbeUrl, buildCredentialHeaders } from './chunk-3E2TIPBZ.js';
+import { toMergedRegistry, createDriver, getProviderPreset, resolvePresetBaseUrl, expandPreset, resolveProbeUrl, buildCredentialHeaders } from './chunk-AE42DHSH.js';
 import { stripActivityLabel, TOOL_ACTIVITY_LABEL_PARAM, TOOL_ACTIVITY_LABEL_MAX_CHARS } from './chunk-K2K7OF4P.js';
 
 // bridge/src/normalizer.ts
@@ -633,5 +633,5 @@ async function validateApiKey(provider, key, options = {}) {
 }
 
 export { BridgeRuntime, EventNormalizer, createRuntime, detectFileChange, detectFileChanges, labelToolCall, summarizeToolCall, summarizeToolResult, validateApiKey };
-//# sourceMappingURL=chunk-OFNXRI4L.js.map
-//# sourceMappingURL=chunk-OFNXRI4L.js.map
+//# sourceMappingURL=chunk-IDUGP4V7.js.map
+//# sourceMappingURL=chunk-IDUGP4V7.js.map

package/dist/{chunk-OFNXRI4L.js.map → chunk-IDUGP4V7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/normalizer.ts","../bridge/src/runtime.ts","../bridge/src/validation.ts"],"names":[],"mappings":";;;;;AAsBA,SAAS,kBACP,KAAA,EAIA;AACA,EAAA,OAAO;AAAA,IACL,GAAI,MAAM,MAAA,GAAS,EAAE,QAAQ,KAAA,CAAM,MAAA,KAAW,EAAC;AAAA,IAC/C,GAAI,MAAM,UAAA,GAAa,EAAE,YAAY,KAAA,CAAM,UAAA,KAAe,EAAC;AAAA,IAC3D,GAAI,OAAO,KAAA,CAAM,aAAA,KAAkB,QAAA,GAAW,EAAE,aAAA,EAAe,KAAA,CAAM,aAAA,EAAc,GAAI,EAAC;AAAA,IACxF,GAAI,OAAO,KAAA,CAAM,aAAA,KAAkB,QAAA,GAAW,EAAE,aAAA,EAAe,KAAA,CAAM,aAAA,EAAc,GAAI;AAAC,GAC1F;AACF;AAOA,IAAM,aAAA,GAAgB,iBAAA;AAEtB,IAAM,uBAAA,GAA0B,EAAA;AAMhC,SAAS,gBAAgB,KAAA,EAAyC;AAChE,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,KAAA,EAAM;AAAA,IACjB;AAAA,EACF;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA,EAAM;AAC5C;AAWO,IAAM,kBAAN,MAAsB;AAAA,EACnB,eAAA,uBAAsB,GAAA,EAAoB;AAAA,EAC1C,wBAAA,GAA2B,KAAA;AAAA,EAC3B,qBAAA,GAAwB,KAAA;AAAA;AAAA,EAExB,eAAA,GAAkB,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlB,iBAAA,GAAoB,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpB,oBAA0D,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnE,UAAU,KAAA,EAAuC;AAC/C,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,eAAA;AACH,QAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,CAAM,OAAO,CAAA;AAAA,MAE9C,KAAK,gBAAA;AACH,QAAA,OAAO,IAAA,CAAK,oBAAoB,KAAK,CAAA;AAAA,MAEvC,KAAK,aAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,iBAAA;AAGH,QAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,QAAA,OAAO,KAAA,CAAM,IAAA,GAAO,CAAC,EAAE,IAAA,EAAM,cAAA,EAAgB,OAAA,EAAS,KAAA,CAAM,IAAA,EAAM,CAAA,GAAI,EAAC;AAAA,MAEzE,KAAK,UAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,KAAA,CAAM,WAAW,CAAA;AAAA,MAE7C,KAAK,QAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAa,KAAK,CAAA;AAAA,MAEhC,KAAK,OAAA;AACH,QAAA,IAAA,CAAK,oBAAoB,EAAC;AAC1B,QAAA,OAAO;AAAA,UACL;AAAA,YACE,IAAA,EAAM,OAAA;AAAA,YACN,SAAS,KAAA,CAAM,KAAA;AAAA,YACf,KAAA,EAAO,MAAM,KAAA,IAAS,IAAA;AAAA,YACtB,QAAA,EAAU,MAAM,MAAA,EAAQ,QAAA;AAAA,YACxB,GAAI,KAAA,CAAM,MAAA,EAAQ,IAAA,GAAO,EAAE,MAAM,KAAA,CAAM,MAAA,CAAO,IAAA,EAAK,GAAI,EAAC;AAAA,YACxD,GAAG,kBAAkB,KAAK,CAAA;AAAA,YAC1B,GAAI,KAAA,CAAM,QAAA,KAAa,OACnB,EAAE,QAAA,EAAU,MAAM,GAAI,KAAA,CAAM,WAAA,GAAc,EAAE,aAAa,KAAA,CAAM,WAAA,KAAgB,EAAC,KAChF;AAAC;AACP,SACF;AAAA,MAEF,KAAK,WAAA,EAAa;AAIhB,QAAA,MAAM,QAAA,GAAW,KAAA,CAAM,IAAA,IAAQ,KAAA,CAAM,IAAA,EAAM,IAAA;AAC3C,QAAA,IAAI,QAAA,KAAa,aAAA,EAAe,OAAO,EAAC;AAGxC,QAAA,IAAI,CAAC,QAAA,IAAY,IAAA,CAAK,wBAAwB,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,EAAG;AACzE,UAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAAA,QAC9C;AACA,QAAA,OAAO,IAAA,CAAK,aAAA;AAAA,UACV;AAAA,YACE,IAAA,EAAM,UAAA;AAAA,YACN,IAAI,OAAO,KAAA,CAAM,UAAA,KAAe,QAAA,GAAW,MAAM,UAAA,GAAa,MAAA;AAAA,YAC9D,IAAA,EAAM,QAAA;AAAA,YACN,KAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,KAAK;AAAA,WACpC;AAAA,UACA,OAAO,KAAA,CAAM,eAAA,KAAoB,QAAA,GAAW,MAAM,eAAA,GAAkB;AAAA,SACtE;AAAA,MACF;AAAA,MAEA,KAAK,oBAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,oBAAoB,EAAC;AAC1B,QAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,QAAQ,CAAA;AAAA,MAE3C,KAAK,oBAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,cAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,WAAA;AAAA,MACL,KAAK,kBAAA;AAAA,MACL,KAAK,UAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C;AACE,QAAA,OAAO,EAAC;AAAA;AACZ,EACF;AAAA;AAAA,EAGA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,gBAAgB,KAAA,EAAM;AAC3B,IAAA,IAAA,CAAK,wBAAA,GAA2B,KAAA;AAChC,IAAA,IAAA,CAAK,qBAAA,GAAwB,KAAA;AAC7B,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AACzB,IAAA,IAAA,CAAK,oBAAoB,EAAC;AAAA,EAC5B;AAAA,EAEQ,uBAAA,CAAwB,MAAc,EAAA,EAAsB;AAClE,IAAA,MAAM,MAAA,GAAS,OAAO,EAAA,KAAO,QAAA,GAAW,EAAA,GAAK,MAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,KAAK,iBAAA,CAAkB,SAAA;AAAA,MACnC,CAAC,KAAA,KAAU,KAAA,CAAM,IAAA,KAAS,IAAA,KAAS,CAAC,MAAA,IAAU,CAAC,KAAA,CAAM,EAAA,IAAM,KAAA,CAAM,EAAA,KAAO,MAAA;AAAA,KAC1E;AACA,IAAA,IAAI,KAAA,KAAU,IAAI,OAAO,KAAA;AACzB,IAAA,IAAA,CAAK,iBAAA,CAAkB,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACtC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmB,OAAA,EAA0C;AAKnE,IAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa,OAAO,EAAC;AAI1C,IAAA,MAAM,kBAAkB,OAAA,CAAQ,eAAA;AAChC,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,gBAAA,CAAiB,OAAO,CAAA;AAE5C,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,IAAU,KAAA,CAAM,IAAA,EAAM;AACvC,QAAA,IAAI,eAAA,EAAiB;AAErB,QAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,UAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAQ,OAAA,EAAS,KAAA,CAAM,MAAM,CAAA;AAAA,QACnD;AAAA,MACF,CAAA,MAAA,IAAW,KAAA,CAAM,IAAA,KAAS,UAAA,IAAc,MAAM,IAAA,EAAM;AAClD,QAAA,IAAI,KAAA,CAAM,SAAS,aAAA,EAAe;AAChC,UAAA,IAAA,CAAK,iBAAA,CAAkB,KAAK,EAAE,EAAA,EAAI,MAAM,EAAA,EAAI,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,CAAA;AAE9D,UAAA,IAAI,IAAA,CAAK,iBAAA,CAAkB,MAAA,GAAS,uBAAA,EAAyB;AAC3D,YAAA,IAAA,CAAK,kBAAkB,KAAA,EAAM;AAAA,UAC/B;AAAA,QACF;AACA,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,aAAA,CAAc,KAAA,EAAO,eAAe,CAAC,CAAA;AAAA,MAC3D;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,eAAA,EAAiB,IAAA,CAAK,eAAA,GAAkB,KAAA;AAC7C,IAAA,IAAI,CAAC,eAAA,EAAiB,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAC/C,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,aAAA,CAAc,OAAqB,eAAA,EAA6C;AACtF,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,MAAM,KAAA,GAAS,KAAA,CAAM,KAAA,IAAS,EAAC;AAE/B,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,OAAO,IAAA,CAAK,sBAAsB,KAAK,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,SAAS,OAAA,EAAS;AACpB,MAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,IAC7C;AACA,IAAA,OAAO,IAAA,CAAK,oBAAA,CAAqB,IAAA,EAAM,KAAA,EAAO,eAAe,CAAA;AAAA,EAC/D;AAAA,EAEQ,sBAAsB,KAAA,EAAmD;AAC/E,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,YAAY,KAAA,CAAM,QAAA;AACxB,IAAA,MAAM,QAAA,GACJ,aACA,CAAC,SAAA,EAAW,QAAQ,aAAA,EAAe,KAAK,CAAA,CAAE,QAAA,CAAS,SAAA,CAAU,IAAA,IAAQ,EAAE,CAAA,IACvE,KAAA,CAAM,OAAA,CAAQ,SAAA,CAAU,OAAO,CAAA,IAC/B,UAAU,OAAA,CAAQ,MAAA,GAAS,CAAA,IAC3B,SAAA,CAAU,OAAA,CAAQ,MAAA,IAAU,MAC5B,SAAA,CAAU,OAAA,CAAQ,MAAM,CAAC,MAAA,KAAW,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,MAAA,IAAU,IAAI,CAAA,IACvF,UAAU,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,EAAO,MAAA,KAAW,KAAA,GAAQ,OAAO,MAAA,EAAQ,CAAC,CAAA,IAAK,KAAA,GACpE,SAAA,GACD,MAAA;AACN,IAAA,IAAI,MAAA,CAAO,OAAO,KAAA,EAAO,UAAU,KAAK,CAAC,QAAA,SAAiB,EAAC;AAG3D,IAAA,MAAM,YAAY,KAAA,CAAM,SAAA;AACxB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC5B,MAAA,KAAA,MAAW,KAAK,SAAA,EAAW;AACzB,QAAA,MAAM,IAAA,GAAO,CAAA;AACb,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,QAAA,IAAY,EAAE,CAAA;AAC3C,QAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,QAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GACjC,OAAA,CAAQ,IAAI,CAAC,CAAA,KAAY,OAAO,CAAA,KAAM,WAAW,CAAA,GAAI,MAAA,CAAO,EAAE,KAAA,IAAS,CAAC,CAAE,CAAA,GAC1E,MAAA;AACJ,QAAA,MAAA,CAAO,IAAA,CAAK;AAAA,UACV,IAAA,EAAM,UAAA;AAAA,UACN,QAAA;AAAA,UACA,OAAA;AAAA,UACA,GAAI,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,GAAW,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU,GAAI,EAAC;AAAA,UAC5E,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa;AAAC,SAChC,CAAA;AAAA,MACH;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,WAAW,MAAA,CAAO,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAQ,EAAE,CAAA;AAC1D,MAAA,MAAM,aAAa,KAAA,CAAM,OAAA;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAU,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,GAAI,MAAA;AACrE,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,IAAA,EAAM,UAAA;AAAA,QACN,QAAA;AAAA,QACA,OAAA;AAAA,QACA,GAAI,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,GAAW,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU,GAAI,EAAC;AAAA,QAC5E,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa;AAAC,OAChC,CAAA;AAAA,IACH;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,kBAAA,CACN,OACA,KAAA,EACmB;AACnB,IAAA,MAAM,YAAY,MAAA,CAAO,KAAA,CAAM,aAAA,IAAiB,KAAA,CAAM,eAAe,SAAS,CAAA;AAC9E,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,WAAA,IAAe,KAAA,CAAM,UAAU,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAChF,IAAA,IAAI,MAAM,EAAA,EAAI;AACZ,MAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,SAAS,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO;AAAA,MACL,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,WAAW,WAAA,EAAY;AAAA,MACpE,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,SAAA;AAAU,KACrC;AAAA,EACF;AAAA,EAEQ,oBAAA,CACN,IAAA,EACA,KAAA,EACA,eAAA,EACmB;AACnB,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,IAAA,EAAM,KAAK,CAAA;AACvC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,WAAA;AAAA,MACN,IAAA,EAAM,IAAA;AAAA,MACN,KAAA;AAAA;AAAA;AAAA,MAGA,OAAA,EAAS,iBAAA,CAAkB,IAAA,EAAM,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAAA,MAC1D,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU,EAAC;AAAA,MACzB,GAAI,eAAA,GAAkB,EAAE,eAAA,KAAoB;AAAC,KAC9C,CAAA;AACD,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAEhD,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACxD,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,uBAAA,CAAwB,KAAA,CAAM,OAAO,CAAA;AAC3D,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,KAAA,EAAuC;AAGjE,IAAA,MAAM,QAAS,KAAA,CAAc,UAAA;AAC7B,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AACzB,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,OAAO,CAAA;AAAA,IAC1C;AAIA,IAAA,MAAM,QAAA,GAAoB,gBAAA,IAAoB,KAAA,GAAQ,KAAA,CAAM,cAAA,GAAiB,MAAA;AAC7E,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,IAAY,CAAC,KAAK,iBAAA,EAAmB;AACvE,MAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AACzB,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,YAAY,CAAA;AAAA,IAC/C;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAMQ,cAAc,WAAA,EAAiD;AACrE,IAAA,IAAI,CAAC,WAAA,EAAa,MAAA,EAAQ,OAAO,EAAC;AAElC,IAAA,MAAM,SAA4B,EAAC;AAEnC,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AAChC,MAAA,MAAM,QAAA,GAAW,OAAO,QAAA,IAAY,SAAA;AACpC,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,OAAA;AACzC,MAAA,MAAM,SAAS,OAAO,UAAA,KAAe,WAAW,UAAA,GAAa,IAAA,CAAK,UAAU,UAAU,CAAA;AAGtF,MAAA,IAAI,QAAA,KAAa,OAAA,IAAW,IAAA,CAAK,gBAAA,CAAiB,MAAM,CAAA,EAAG;AACzD,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,oBAAA,CAAqB,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,MAC1D,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,IAAA,CAAK,GAAG,IAAA,CAAK,gBAAA,CAAiB,UAAU,UAAA,EAAY,MAAA,EAAQ,MAAA,CAAO,eAAe,CAAC,CAAA;AAAA,MAC5F;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,oBAAA,CAAqB,QAAsB,MAAA,EAAmC;AACpF,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,mBAAA,CAAoB,MAAM,CAAA;AACjD,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AACvC,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAY,WAAA,EAAa,CAAA;AAElF,IAAA,IAAI,cAAc,YAAA,EAAc;AAC9B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,gBAAA,CACN,QAAA,EACA,UAAA,EACA,MAAA,EACA,eAAA,EACmB;AACnB,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,aAAA;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,UAAA;AAAA,MACR,OAAA,EAAS,mBAAA,CAAoB,QAAA,EAAU,UAAU,CAAA;AAAA,MACjD,GAAI,eAAA,GAAkB,EAAE,eAAA,KAAoB;AAAC,KAC9C,CAAA;AAGD,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,QAAA,EAAU,UAAU,CAAA;AACzD,IAAA,IAAI,WAAW,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,IAAA,CAAK,GAAG,UAAU,CAAA;AAGpD,IAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,iBAAiB,MAAA,EAA+B;AAEtD,IAAA,IAAI,MAAA,CAAO,YAAY,IAAA,CAAK,eAAA,CAAgB,IAAI,MAAA,CAAO,QAAQ,GAAG,OAAO,IAAA;AACzE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEQ,oBAAoB,MAAA,EAA8B;AAExD,IAAA,MAAM,IAAA,GAAO,OAAO,QAAA,GAAW,IAAA,CAAK,gBAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,GAAI,MAAA;AAC3E,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,MAAA,CAAO,QAAS,CAAA;AAC5C,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAO,QAAA,IAAY,SAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,KAAA,EAA4D;AAC/E,IAAA,MAAM,KAAA,GAAQ,kBAAkB,KAAK,CAAA;AACrC,IAAA,IAAI,KAAA,CAAM,YAAY,SAAA,EAAW;AAC/B,MAAA,OAAO;AAAA,QACL;AAAA,UACE,IAAA,EAAM,UAAA;AAAA,UACN,OAAA,EAAS,MAAM,OAAA,IAAW,gBAAA;AAAA,UAC1B,OAAA,EAAS,MAAM,OAAA,IAAW,CAAA;AAAA,UAC1B,GAAG;AAAA;AACL,OACF;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,IAAU,EAAC;AAKhC,IAAA,MAAM,SAAS,sBAAA,CAAuB,EAAE,QAAQ,OAAA,EAAS,KAAA,CAAM,SAAS,CAAA;AAIxE,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,OAAA,EAAS,CAAA,eAAA,EAAkB,KAAA,CAAM,OAAO,CAAA,EAAG,MAAA,CAAO,MAAA,GAAS,CAAA,QAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,KAAK,EAAE,CAAA,CAAA;AAAA,QACzF,KAAA,EAAO,MAAM,OAAA,KAAY,wBAAA;AAAA,QACzB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,GAAI,OAAO,IAAA,GAAO,EAAE,MAAM,MAAA,CAAO,IAAA,KAAS,EAAC;AAAA,QAC3C,GAAI,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,GAAW,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAQ,GAAI,EAAC;AAAA,QACtE,GAAG;AAAA;AACL,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMQ,wBAAwB,OAAA,EAAyC;AACvE,IAAA,IAAI,IAAA,CAAK,0BAA0B,OAAO,IAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,IAAA,MAAM,mBACH,GAAA,CAAI,QAAA,CAAS,cAAc,CAAA,IAAK,GAAA,CAAI,SAAS,UAAU,CAAA,IAAK,IAAI,QAAA,CAAS,MAAM,OAC/E,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA,IAAK,GAAA,CAAI,SAAS,aAAa,CAAA,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,IAAA,CAAK,wBAAA,GAA2B,IAAA;AAChC,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,UAAA,EAAW;AAAA,IAChF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,qBAAqB,IAAA,EAAsC;AACjE,IAAA,IAAI,IAAA,CAAK,uBAAuB,OAAO,IAAA;AAEvC,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,wCAAwC,CAAA;AACzE,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,cAAc,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACvE;AAEA,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,qCAAqC,CAAA;AAClE,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,UAAU,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACnE;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,gBAAgB,CAAA,EAAG;AACnC,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,OAAA,EAAQ;AAAA,IAC7E;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAiB,OAAA,EAAuC;AAC9D,IAAA,IAAI,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,SAAU,OAAA,CAAQ,OAAA;AACnD,IAAA,IAAI,OAAO,OAAA,CAAQ,OAAA,KAAY,QAAA,IAAY,QAAQ,OAAA,EAAS;AAC1D,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,OAAA,CAAQ,SAAS,CAAA;AAAA,IACjD;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAiBO,SAAS,iBAAA,CAAkB,MAAc,KAAA,EAAwC;AAEtF,EAAA,MAAM,GAAA,GAAM,CAAC,GAAA,KAAgB,MAAA,CAAO,MAAM,GAAG,CAAA,IAAK,MAAM,KAAK,CAAA;AAC7D,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,EAAA,EAAK,MAAA,CAAO,KAAA,CAAM,OAAA,IAAW,KAAA,CAAM,KAAA,IAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAAA,IACtE,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA;AAAA,IACnC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA;AAAA,IACjC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA;AAAA,IACjC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IAC/B,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,WAAA,EAAc,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IACrC,KAAK,YAAA,EAAc;AAEjB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA,GAAI,KAAA,CAAM,UAAU,EAAC;AAChE,MAAA,MAAM,KAAA,GAAQ,OAAA,CACX,GAAA,CAAI,CAAC,MAAA,KAAY,MAAA,EAAsC,IAAI,CAAA,CAC3D,MAAA,CAAO,CAAC,IAAA,KAAyB,OAAO,SAAS,QAAQ,CAAA;AAC5D,MAAA,OAAO,CAAA,KAAA,EAAQ,MAAM,IAAA,CAAK,IAAI,EAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,OAAO,CAAA,CAAA;AAAA,IAC1D;AAAA,IACA;AACE,MAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA;AAE3D;AAaO,SAAS,aAAA,CAAc,MAAc,KAAA,EAAoD;AAC9F,EAAA,MAAM,QAAA,GACJ,QAAA,CAAS,KAAA,CAAM,yBAAyB,CAAC,CAAA,KACxC,IAAA,KAAS,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,WAAW,CAAA,GAAI,MAAA,CAAA;AACnD,EAAA,MAAM,KAAA,GAAQ,QAAA,IAAY,gBAAA,CAAiB,IAAA,EAAM,KAAK,CAAA;AACtD,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,KAAA,CAAM,MAAA,GAAS,6BAAA,GAClB,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,6BAAA,GAAgC,CAAC,CAAA,CAAE,OAAA,EAAS,CAAA,MAAA,CAAA,GAC9D,KAAA;AACN;AAEA,SAAS,SAAS,KAAA,EAAoC;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA;AACtC,EAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,GAAG,EAAE,IAAA,EAAK;AAChD,EAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,GAAU,MAAA;AACxC;AAEA,SAAS,gBAAA,CAAiB,MAAc,KAAA,EAAoD;AAC1F,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA;AACH,MAAA,OAAO,UAAA,CAAW,SAAA,EAAW,QAAA,CAAS,KAAA,CAAM,SAAS,CAAC,CAAA;AAAA,IACxD,KAAK,MAAA;AAAA,IACL,KAAK,WAAA;AAAA,IACL,KAAK,cAAA;AACH,MAAA,OAAO,WAAW,SAAA,EAAW,QAAA,CAAS,MAAM,SAAA,IAAa,KAAA,CAAM,aAAa,CAAC,CAAA;AAAA,IAC/E,KAAK,OAAA;AACH,MAAA,OAAO,UAAA,CAAW,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,SAAS,CAAC,CAAA;AAAA,IACzD,KAAK,MAAA;AAAA,IACL,KAAK,MAAA;AACH,MAAA,OAAO,iBAAA;AAAA,IACT,KAAK,WAAA;AACH,MAAA,OAAO,mBAAA;AAAA,IACT,KAAK,UAAA;AACH,MAAA,OAAO,WAAW,UAAA,EAAY,MAAA,CAAO,KAAA,CAAM,GAAG,GAAG,YAAY,CAAA;AAAA,IAC/D,KAAK,WAAA;AACH,MAAA,OAAO,wBAAA;AAAA,IACT,KAAK,YAAA;AACH,MAAA,OAAO,eAAA;AAAA,IACT;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAEA,SAAS,UAAA,CAAW,IAAA,EAAc,MAAA,EAA4B,QAAA,GAAW,QAAA,EAAkB;AACzF,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAA,IAAU,QAAQ,CAAA,CAAA;AACtC;AAEA,SAAS,SAAS,KAAA,EAAoC;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,KAAW,GAAG,OAAO,MAAA;AAC5D,EAAA,OAAO,MAAM,KAAA,CAAM,OAAO,EAAE,MAAA,CAAO,OAAO,EAAE,GAAA,EAAI;AAClD;AAEA,SAAS,OAAO,KAAA,EAAoC;AAClD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA;AACtC,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,IAAA,IAAQ,KAAA,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGA,SAAS,wBAAwB,MAAA,EAAkC;AACjE,EAAA,MAAM,aAAa,MAAA,CAAO,MAAA;AAAA,IACxB,CAAC,CAAA,KACC,OAAO,CAAA,KAAM,QAAA,IACb,CAAA,KAAM,IAAA,IACL,CAAA,CAA8B,IAAA,KAAS,MAAA,IACxC,OAAQ,CAAA,CAA8B,IAAA,KAAS;AAAA,GACnD;AACA,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,UAAA,CAAW,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA,CAAE,KAAK,IAAI,CAAA;AAChD;AAaO,SAAS,mBAAA,CAAoB,MAAc,MAAA,EAAyB;AAEzE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,IAAA,MAAM,IAAA,GAAO,wBAAwB,MAAM,CAAA;AAC3C,IAAA,OAAA,CAAQ,QAAQ,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,EAAQ;AACzC,IAAA,OAAO,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACpC;AACA,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA,EAAQ;AACX,MAAA,MAAM,SAAS,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,EAAE,IAAA,EAAK;AAC3C,MAAA,IAAI,QAAQ,OAAO,CAAA,QAAA,EAAW,OAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAClD,MAAA,OACE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA,CAClB,MAAK,CACL,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,aAAA;AAAA,IAExB;AAAA,IACA,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,EAAG,OAAO,CAAA,CAAE,IAAI,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACjD,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACrC,KAAK,YAAA;AACH,MAAA,OAAO,CAAA,EAAG,MAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,aAAA,CAAA;AAAA,IAC3D;AACE,MAAA,OAAO,KAAK,SAAA,CAAU,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA;AAEhD;AAaO,SAAS,iBAAA,CAAkB,UAAkB,MAAA,EAAoC;AACtF,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,SAAe,EAAC;AACnD,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,QAAA,KAAa,OAAA,IAAW,CAAA,CAAE,QAAA,EAAU;AACtC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAAA,QACvB,MAAA,EAAQ,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,QAAA,GAAW;AAAA;AAC3C,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAA,KAAa,MAAA,IAAU,CAAA,CAAE,QAAA,EAAU;AACrC,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,cAAA,EAAgB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA,EAAG,MAAA,EAAQ,MAAA,EAAQ,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,aAAa,YAAA,IAAgB,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,EAAG;AACzD,IAAA,OAAO,EAAE,OAAA,CACN,MAAA;AAAA,MACC,CAAC,MAAA,KACC,OAAO,MAAA,KAAW,QAAA,IAClB,MAAA,KAAW,IAAA,IACX,OAAQ,MAAA,CAAmC,IAAA,KAAS,QAAA,IACpD,OAAQ,OAAmC,IAAA,KAAS;AAAA,KACxD,CACC,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,MAChB,IAAA,EAAM,cAAA;AAAA,MACN,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAA,EAAQ,OAAO,IAAA,KAAS,KAAA,GAAQ,WAAW,MAAA,CAAO,IAAA,KAAS,WAAW,QAAA,GAAW;AAAA,KACnF,CAAE,CAAA;AAAA,EACN;AAEA,EAAA,OAAO,EAAC;AACV;AAYO,SAAS,gBAAA,CAAiB,UAAkB,MAAA,EAAyC;AAC1F,EAAA,OAAO,iBAAA,CAAkB,QAAA,EAAU,MAAM,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AACnD;;;ACvuBO,IAAM,gBAAN,MAA6C;AAAA,EAC1C,MAAA,GAA6B,IAAA;AAAA,EAC7B,UAAA,GAAa,IAAI,eAAA,EAAgB;AAAA,EACjC,QAAA,uBAAe,GAAA,EAAiC;AAAA,EAChD,iBAAA,GAAmD,IAAA;AAAA,EACnD,QAAA;AAAA,EAER,WAAA,CAAY,WAAmB,YAAA,EAAc;AAC3C,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,MAAM,MAAM,MAAA,EAA2C;AAErD,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,KAAK,OAAA,EAAQ;AAAA,IACrB;AAEA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAEtB,IAAA,MAAM,YAAA,GAA4B;AAAA,MAChC,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,iBAAiB,MAAA,CAAO,eAAA;AAAA,MACxB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,GAAI,MAAA,CAAO,QAAA,GAAW,EAAE,QAAA,EAAU,gBAAA,CAAiB,MAAA,CAAO,QAAA,EAAU,SAAS,CAAA,EAAE,GAAI,EAAC;AAAA,MACpF,GAAI,OAAO,QAAA,GAAW,EAAE,UAAU,MAAA,CAAO,QAAA,KAAa;AAAC,KACzD;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,YAAY,CAAA;AAG5D,IAAA,IAAA,CAAK,iBAAA,GAAoB,CAAC,WAAA,KAAqB;AAC7C,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU,WAAW,CAAA;AACxD,MAAA,KAAA,MAAW,SAAS,UAAA,EAAY;AAC9B,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACnC,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf;AAAA,MACF;AAAA,IACF,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AAEpD,IAAA,MAAM,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EAC1B;AAAA,EAEA,MAAM,UAAU,OAAA,EAAiD;AAAA,EAGjE;AAAA,EAEA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAC5E,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,KAAA,EAAwC;AACxD,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAC5E,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,KAAK,CAAA;AAAA,EACrC;AAAA,EAEA,MAAM,KAAA,CAAM,MAAA,EAAgB,QAAA,EAAmB,SAAA,EAAmC;AAChF,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAG5E,IAAA,IACE,IAAA,CAAK,QAAQ,kBAAA,EAAmB,IAChC,KAAK,MAAA,CAAO,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,SAAS,CAAA;AAEtD,MAAA;AACF,IAAA,IAAI,KAAK,MAAA,EAAQ,oBAAA,EAAsB,MAAM,IAAA,CAAK,OAAO,MAAM,CAAA;AAAA,EACjE;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,QAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AACrD,QAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AAAA,MAC3B;AACA,MAAA,IAAA,CAAK,OAAO,IAAA,EAAK;AACjB,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAAA,EACxB;AAAA,EAEA,QAAQ,OAAA,EAA4C;AAClD,IAAA,IAAA,CAAK,QAAA,CAAS,IAAI,OAAO,CAAA;AAAA,EAC3B;AAAA,EAEA,SAAS,OAAA,EAA4C;AACnD,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,IAAa,KAAA;AAAA,EACnC;AACF;AASO,SAAS,aAAA,CAAc,WAAmB,YAAA,EAA6B;AAC5E,EAAA,OAAO,IAAI,cAAc,QAAQ,CAAA;AACnC;;;AC5GA,eAAsB,cAAA,CACpB,QAAA,EACA,GAAA,EACA,OAAA,GAA0E,EAAC,EAChD;AAC3B,EAAA,MAAM,MAAA,GAAS,kBAAkB,QAAQ,CAAA;AACzC,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,QAAQ,CAAA,CAAA,EAAG;AAIxE,EAAA,MAAM,OAAA,GAAU,qBAAqB,MAAA,EAAQ;AAAA,IAC3C,GAAI,QAAQ,OAAA,GAAU,EAAE,SAAS,OAAA,CAAQ,OAAA,KAAY,EAAC;AAAA,IACtD,GAAA,EAAK,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ;AAAA,GAC7B,CAAA;AACD,EAAA,MAAM,KAAA,GAAQ,aAAa,MAAA,EAAQ,OAAA,GAAU,EAAE,OAAA,EAAQ,GAAI,EAAE,CAAA;AAC7D,EAAA,MAAM,GAAA,GAAM,gBAAgB,KAAK,CAAA;AACjC,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,CAAA,SAAA,EAAY,QAAQ,CAAA,2BAAA,CAAA,EAA8B;AAGvF,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,KAAA,CAAM,SAAS,GAAG,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAE;AAE1E,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,UAAU,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,GAAI,CAAA;AAEzD,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA;AAAA,MACA,QAAQ,UAAA,CAAW;AAAA,KACpB,CAAA;AAED,IAAA,YAAA,CAAa,OAAO,CAAA;AAEpB,IAAA,IAAI,QAAA,CAAS,EAAA,EAAI,OAAO,EAAE,IAAI,IAAA,EAAK;AAEnC,IAAA,MAAM,SAAS,QAAA,CAAS,MAAA;AACxB,IAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK;AACpC,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,yCAAA,EAA0C;AAAA,IACvE;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,CAAA,EAAG;AAAA,EAC3D,SAAS,GAAA,EAAU;AACjB,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,wBAAA,EAAyB;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,WAAW,eAAA,EAAgB;AAAA,EAC5D;AACF","file":"chunk-OFNXRI4L.js","sourcesContent":["/**\n * EventNormalizer — converts bridge-level AgentEvent (raw driver events) to\n * skaile-agent-types AgentEvent (normalized, human-readable events).\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call reset() between sessions.\n */\n\nimport {\n  type AgentEvent as NormalizedEvent,\n  type NativeApprovalDescription,\n  stripActivityLabel,\n  TOOL_ACTIVITY_LABEL_MAX_CHARS,\n  TOOL_ACTIVITY_LABEL_PARAM,\n} from \"@skaile/workspaces/types\";\nimport { classifyClaudeSdkError } from \"./error-classifier.js\";\nimport type { AgentMessage, AgentEvent as BridgeEvent, ContentBlock } from \"./types.js\";\n\n/**\n * The optional usage keys a `result` event carries, in the shape both\n * `finished` and a result-sourced `error` emit them. Absent keys stay absent.\n */\nfunction resultUsageFields(\n  event: Pick<\n    Extract<BridgeEvent, { type: \"result\" | \"error\" }>,\n    \"tokens\" | \"modelUsage\" | \"contextTokens\" | \"contextWindow\"\n  >,\n) {\n  return {\n    ...(event.tokens ? { tokens: event.tokens } : {}),\n    ...(event.modelUsage ? { modelUsage: event.modelUsage } : {}),\n    ...(typeof event.contextTokens === \"number\" ? { contextTokens: event.contextTokens } : {}),\n    ...(typeof event.contextWindow === \"number\" ? { contextWindow: event.contextWindow } : {}),\n  };\n}\n\n/**\n * The tool a driver uses to park a turn on a human answer. Both branches that\n * recognise it must use this constant: `message_start` turns it into a\n * `question`, and `tool_call` must then stay silent about it.\n */\nconst QUESTION_TOOL = \"AskUserQuestion\";\n\nconst MAX_ANNOUNCED_TOOL_USES = 64;\n\n/**\n * Bridge `tool_call` inputs are loosely typed: Codex MCP arguments may arrive\n * as a JSON string, and the echo driver passes a bare path.\n */\nfunction toolInputRecord(input: unknown): Record<string, unknown> {\n  let value = input;\n  if (typeof value === \"string\") {\n    try {\n      value = JSON.parse(value);\n    } catch {\n      return { input };\n    }\n  }\n  if (typeof value === \"object\" && value !== null && !Array.isArray(value)) {\n    return value as Record<string, unknown>;\n  }\n  return value === undefined ? {} : { input };\n}\n\n/**\n * Converts raw bridge-level {@link BridgeEvent} payloads into normalized\n * `@skaile/workspaces/types` `AgentEvent` payloads consumed by the runner and transport.\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call {@link EventNormalizer.reset} between sessions to clear accumulated state.\n *\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport class EventNormalizer {\n  private activeSubagents = new Map<string, string>();\n  private devServerStartingEmitted = false;\n  private devServerReadyEmitted = false;\n  /** True when message_update deltas have been emitted for the current message. */\n  private hasStreamedText = false;\n  /**\n   * True once a `_thinkingDelta` run has been reported as `status: thinking`;\n   * cleared by the next text delta or assistant message, so a run reports once.\n   */\n  private thinkingAnnounced = false;\n  /**\n   * tool_use blocks `message_start` already reported, awaiting the driver's\n   * matching bridge `tool_call` — which must then not report the call again.\n   */\n  private announcedToolUses: Array<{ id?: string; name: string }> = [];\n\n  /**\n   * Convert a single bridge event into zero or more normalized events.\n   * One bridge event can produce multiple normalized events (e.g., a message_start\n   * with text + tool_use blocks produces both text and tool_call events).\n   */\n  normalize(event: BridgeEvent): NormalizedEvent[] {\n    switch (event.type) {\n      case \"message_start\":\n        return this.handleMessageStart(event.message);\n\n      case \"message_update\":\n        return this.handleMessageUpdate(event);\n\n      case \"message_end\":\n        return [];\n\n      case \"message_retract\":\n        // The replay streams its reply afresh, so its deltas (or, failing\n        // those, its message_start text) must count as a new message.\n        this.hasStreamedText = false;\n        return event.text ? [{ type: \"text_retract\", content: event.text }] : [];\n\n      case \"turn_end\":\n        return this.handleTurnEnd(event.toolResults);\n\n      case \"result\":\n        return this.handleResult(event);\n\n      case \"error\":\n        this.announcedToolUses = [];\n        return [\n          {\n            type: \"error\",\n            message: event.error,\n            fatal: event.fatal ?? true,\n            category: event.detail?.category,\n            ...(event.detail?.hint ? { hint: event.detail.hint } : {}),\n            ...resultUsageFields(event),\n            ...(event.retrying === true\n              ? { retrying: true, ...(event.retryReason ? { retryReason: event.retryReason } : {}) }\n              : {}),\n          },\n        ];\n\n      case \"tool_call\": {\n        // The question tool parks the turn on the user's answer, so reporting\n        // work here would undo the idle its `question` event just set, and\n        // nothing follows to correct it while the user reads the prompt.\n        const toolName = event.name ?? event.tool?.name;\n        if (toolName === QUESTION_TOOL) return [];\n        // A driver that also sent the call as a `message_start` tool_use block\n        // (Claude) was already reported there; the rest only ever send this.\n        if (!toolName || this.consumeAnnouncedToolUse(toolName, event.toolCallId)) {\n          return [{ type: \"status\", phase: \"working\" }];\n        }\n        return this.handleToolUse(\n          {\n            type: \"tool_use\",\n            id: typeof event.toolCallId === \"string\" ? event.toolCallId : undefined,\n            name: toolName,\n            input: toolInputRecord(event.input),\n          },\n          typeof event.parentToolUseId === \"string\" ? event.parentToolUseId : undefined,\n        );\n      }\n\n      case \"tool_execution_end\":\n        return [];\n\n      case \"agent_end\":\n        this.announcedToolUses = [];\n        return [{ type: \"status\", phase: \"idle\" }];\n\n      case \"commands_available\":\n        // Pass through to transport — the gateway caches this event\n        return [event as unknown as NormalizedEvent];\n\n      case \"session_info\":\n        // Pass through to transport — the forge layer stores the OMP session ID\n        return [event as unknown as NormalizedEvent];\n\n      case \"ui_render\":\n      case \"ui_render_update\":\n      case \"ui_clear\":\n        // Pass through verbatim — drivers that implement the Agent UI Protocol emit these directly\n        return [event as unknown as NormalizedEvent];\n\n      default:\n        return [];\n    }\n  }\n\n  /** Clear all stateful tracking between sessions. */\n  reset(): void {\n    this.activeSubagents.clear();\n    this.devServerStartingEmitted = false;\n    this.devServerReadyEmitted = false;\n    this.hasStreamedText = false;\n    this.thinkingAnnounced = false;\n    this.announcedToolUses = [];\n  }\n\n  private consumeAnnouncedToolUse(name: string, id: unknown): boolean {\n    const callId = typeof id === \"string\" ? id : undefined;\n    const index = this.announcedToolUses.findIndex(\n      (entry) => entry.name === name && (!callId || !entry.id || entry.id === callId),\n    );\n    if (index === -1) return false;\n    this.announcedToolUses.splice(index, 1);\n    return true;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_start → text, tool_call, question, subagent\n  // ---------------------------------------------------------------------------\n\n  private handleMessageStart(message: AgentMessage): NormalizedEvent[] {\n    // Only process assistant messages. Drivers (e.g. omp) may echo the user's\n    // message as a message_start with role:\"user\" before streaming the response.\n    // Emitting a text event for that echo would prepend the user's input to the\n    // assistant bubble on the frontend.\n    if (message.role !== \"assistant\") return [];\n\n    // A subagent's message is not the main reply: its text belongs to the\n    // subagent's own result, and it must not reset the main stream's state.\n    const parentToolUseId = message.parentToolUseId;\n    const events: NormalizedEvent[] = [];\n    const blocks = this.getContentBlocks(message);\n\n    for (const block of blocks) {\n      if (block.type === \"text\" && block.text) {\n        if (parentToolUseId) continue;\n        // Skip full text if we already streamed it via message_update deltas\n        if (!this.hasStreamedText) {\n          events.push({ type: \"text\", content: block.text });\n        }\n      } else if (block.type === \"tool_use\" && block.name) {\n        if (block.name !== QUESTION_TOOL) {\n          this.announcedToolUses.push({ id: block.id, name: block.name });\n          // Bounded in case a driver never echoes a block as a tool_call.\n          if (this.announcedToolUses.length > MAX_ANNOUNCED_TOOL_USES) {\n            this.announcedToolUses.shift();\n          }\n        }\n        events.push(...this.handleToolUse(block, parentToolUseId));\n      }\n    }\n\n    if (!parentToolUseId) this.hasStreamedText = false;\n    if (!parentToolUseId) this.thinkingAnnounced = false;\n    return events;\n  }\n\n  private handleToolUse(block: ContentBlock, parentToolUseId?: string): NormalizedEvent[] {\n    const name = block.name!;\n    const input = (block.input ?? {}) as Record<string, unknown>;\n\n    if (name === QUESTION_TOOL) {\n      return this.handleAskUserQuestion(input);\n    }\n    if (name === \"Agent\") {\n      return this.handleAgentToolUse(block, input);\n    }\n    return this.handleGenericToolUse(name, input, parentToolUseId);\n  }\n\n  private handleAskUserQuestion(input: Record<string, unknown>): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const candidate = input.approval as Partial<NativeApprovalDescription> | undefined;\n    const approval =\n      candidate &&\n      [\"command\", \"file\", \"permissions\", \"mcp\"].includes(candidate.kind ?? \"\") &&\n      Array.isArray(candidate.details) &&\n      candidate.details.length > 0 &&\n      candidate.details.length <= 64 &&\n      candidate.details.every((detail) => typeof detail === \"string\" && detail.length <= 8192) &&\n      candidate.details.reduce((total, detail) => total + detail.length, 0) <= 65536\n        ? (candidate as NativeApprovalDescription)\n        : undefined;\n    if (Object.hasOwn(input, \"approval\") && !approval) return [];\n    // Claude SDK sends { questions: [{ question, header, options: [{ label, description }] }] }\n    // Legacy/simple format sends { question: string, options?: string[] }\n    const questions = input.questions;\n    if (Array.isArray(questions)) {\n      for (const q of questions) {\n        const qObj = q as Record<string, unknown>;\n        const question = String(qObj.question ?? \"\");\n        const rawOpts = qObj.options;\n        const options = Array.isArray(rawOpts)\n          ? rawOpts.map((o: any) => (typeof o === \"string\" ? o : String(o.label ?? o)))\n          : undefined;\n        events.push({\n          type: \"question\",\n          question,\n          options,\n          ...(typeof input.requestId === \"string\" ? { requestId: input.requestId } : {}),\n          ...(approval ? { approval } : {}),\n        });\n      }\n    } else {\n      const question = String(input.question ?? input.text ?? \"\");\n      const rawOptions = input.options;\n      const options = Array.isArray(rawOptions) ? rawOptions.map(String) : undefined;\n      events.push({\n        type: \"question\",\n        question,\n        options,\n        ...(typeof input.requestId === \"string\" ? { requestId: input.requestId } : {}),\n        ...(approval ? { approval } : {}),\n      });\n    }\n    return events;\n  }\n\n  private handleAgentToolUse(\n    block: ContentBlock,\n    input: Record<string, unknown>,\n  ): NormalizedEvent[] {\n    const agentName = String(input.subagent_type ?? input.description ?? \"unknown\");\n    const description = String(input.description ?? input.prompt ?? \"\").slice(0, 200);\n    if (block.id) {\n      this.activeSubagents.set(block.id, agentName);\n    }\n    return [\n      { type: \"subagent\", name: agentName, status: \"started\", description },\n      { type: \"status\", phase: \"working\" },\n    ];\n  }\n\n  private handleGenericToolUse(\n    name: string,\n    input: Record<string, unknown>,\n    parentToolUseId?: string,\n  ): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const label = labelToolCall(name, input);\n    events.push({\n      type: \"tool_call\",\n      tool: name,\n      input,\n      // Summarize without the label: it would eat the default branch's\n      // 100-char argument budget and push the real args out.\n      summary: summarizeToolCall(name, stripActivityLabel(input)),\n      ...(label ? { label } : {}),\n      ...(parentToolUseId ? { parentToolUseId } : {}),\n    });\n    events.push({ type: \"status\", phase: \"working\" });\n\n    if (name === \"Bash\" && typeof input.command === \"string\") {\n      const devEvent = this.detectDevServerStarting(input.command);\n      if (devEvent) events.push(devEvent);\n    }\n\n    return events;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_update → streaming text\n  // ---------------------------------------------------------------------------\n\n  private handleMessageUpdate(event: BridgeEvent): NormalizedEvent[] {\n    // Bridge deltas carry no subagent tag: a driver must drop a subagent's\n    // partials itself (claude-sdk does in handleStreamEvent), or they read as main text.\n    const delta = (event as any)._textDelta as string | undefined;\n    if (delta) {\n      this.hasStreamedText = true;\n      this.thinkingAnnounced = false;\n      return [{ type: \"text\", content: delta }];\n    }\n    // The protocol has no thinking-content event, so reasoning surfaces as the\n    // existing `thinking` phase, once per run. The text is never forwarded as\n    // `text`; a driver keeps it out of `_textDelta`.\n    const thinking: unknown = \"_thinkingDelta\" in event ? event._thinkingDelta : undefined;\n    if (typeof thinking === \"string\" && thinking && !this.thinkingAnnounced) {\n      this.thinkingAnnounced = true;\n      return [{ type: \"status\", phase: \"thinking\" }];\n    }\n    return [];\n  }\n\n  // ---------------------------------------------------------------------------\n  // turn_end → tool_result, subagent finished, file_changed, dev_server\n  // ---------------------------------------------------------------------------\n\n  private handleTurnEnd(toolResults?: AgentMessage[]): NormalizedEvent[] {\n    if (!toolResults?.length) return [];\n\n    const events: NormalizedEvent[] = [];\n\n    for (const result of toolResults) {\n      const toolName = result.toolName ?? \"unknown\";\n      const outputData = result.data ?? result.content;\n      const output = typeof outputData === \"string\" ? outputData : JSON.stringify(outputData);\n\n      // Check if this is a subagent result\n      if (toolName === \"Agent\" || this.isSubagentResult(result)) {\n        events.push(...this.handleSubagentResult(result, output));\n      } else {\n        events.push(...this.handleToolResult(toolName, outputData, output, result.parentToolUseId));\n      }\n    }\n\n    return events;\n  }\n\n  private handleSubagentResult(result: AgentMessage, output: string): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const agentName = this.resolveSubagentName(result);\n    const description = output.slice(0, 200);\n    events.push({ type: \"subagent\", name: agentName, status: \"finished\", description });\n\n    if (agentName === \"dev-server\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private handleToolResult(\n    toolName: string,\n    outputData: unknown,\n    output: string,\n    parentToolUseId?: string,\n  ): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    events.push({\n      type: \"tool_result\",\n      tool: toolName,\n      output: outputData,\n      summary: summarizeToolResult(toolName, outputData),\n      ...(parentToolUseId ? { parentToolUseId } : {}),\n    });\n\n    // Detect file changes from Write/Edit results\n    const fileEvents = detectFileChanges(toolName, outputData);\n    if (fileEvents.length > 0) events.push(...fileEvents);\n\n    // Detect dev server from Bash output\n    if (toolName === \"Bash\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private isSubagentResult(result: AgentMessage): boolean {\n    // Check if the tool result's id maps to a tracked subagent\n    if (result.toolName && this.activeSubagents.has(result.toolName)) return true;\n    return false;\n  }\n\n  private resolveSubagentName(result: AgentMessage): string {\n    // toolName on bridge AgentMessage is resolved from toolIdToName in the driver\n    const name = result.toolName ? this.activeSubagents.get(result.toolName) : undefined;\n    if (name) {\n      this.activeSubagents.delete(result.toolName!);\n      return name;\n    }\n    return result.toolName ?? \"unknown\";\n  }\n\n  // ---------------------------------------------------------------------------\n  // result → finished or error\n  // ---------------------------------------------------------------------------\n\n  private handleResult(event: BridgeEvent & { type: \"result\" }): NormalizedEvent[] {\n    const usage = resultUsageFields(event);\n    if (event.subtype === \"success\") {\n      return [\n        {\n          type: \"finished\",\n          summary: event.summary ?? \"Task completed\",\n          costUsd: event.costUsd ?? 0,\n          ...usage,\n        },\n      ];\n    }\n\n    const errors = event.errors ?? [];\n    // Run the same classifier the claude-sdk driver uses on its `error`\n    // event so the result-error path also surfaces a category and hint\n    // (drivers other than claude-sdk emit `result` without a paired\n    // `error`, so this is the only place they get classified).\n    const detail = classifyClaudeSdkError({ errors, subtype: event.subtype });\n    // The turn billed even though it failed: carry its usage so a ledger\n    // that only writes on `finished` can write here too. Unlike the finished\n    // branch, no `costUsd: 0` fallback — an absent figure stays absent.\n    return [\n      {\n        type: \"error\",\n        message: `Agent stopped: ${event.subtype}${errors.length ? ` — ${errors.join(\"; \")}` : \"\"}`,\n        fatal: event.subtype === \"error_during_execution\",\n        category: detail.category,\n        ...(detail.hint ? { hint: detail.hint } : {}),\n        ...(typeof event.costUsd === \"number\" ? { costUsd: event.costUsd } : {}),\n        ...usage,\n      },\n    ];\n  }\n\n  // ---------------------------------------------------------------------------\n  // Dev server detection\n  // ---------------------------------------------------------------------------\n\n  private detectDevServerStarting(command: string): NormalizedEvent | null {\n    if (this.devServerStartingEmitted) return null;\n    const cmd = command.toLowerCase();\n    const isFrontendStart =\n      (cmd.includes(\"pnpm run dev\") || cmd.includes(\"pnpm dev\") || cmd.includes(\"vite\")) &&\n      (cmd.includes(\"frontend\") || cmd.includes(\"dev:preview\"));\n    if (isFrontendStart) {\n      this.devServerStartingEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"starting\" };\n    }\n    return null;\n  }\n\n  private detectDevServerReady(text: string): NormalizedEvent | null {\n    if (this.devServerReadyEmitted) return null;\n\n    const explicitMatch = text.match(/DEVSERVER_READY:(https?:\\/\\/[^\\s\"\\\\]+)/);\n    if (explicitMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: explicitMatch[1]!, status: \"ready\" };\n    }\n\n    const viteMatch = text.match(/Local:\\s+(https?:\\/\\/localhost:\\d+)/);\n    if (viteMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: viteMatch[1]!, status: \"ready\" };\n    }\n\n    if (text.includes(\"FRONTEND_READY\")) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"ready\" };\n    }\n\n    return null;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Helpers\n  // ---------------------------------------------------------------------------\n\n  private getContentBlocks(message: AgentMessage): ContentBlock[] {\n    if (Array.isArray(message.content)) return message.content;\n    if (typeof message.content === \"string\" && message.content) {\n      return [{ type: \"text\", text: message.content }];\n    }\n    return [];\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Pure helper functions (exported for reuse)\n// ---------------------------------------------------------------------------\n\n/**\n * Produce a human-readable one-line summary of a tool call for the activity log.\n *\n * Returns a string like `$ git status` for Bash, `Read src/index.ts` for Read, etc.\n * Falls back to `ToolName({...input...})` for unrecognised tools.\n *\n * @param tool - Tool name (e.g. `\"Bash\"`, `\"Write\"`, `\"Grep\"`).\n * @param input - Tool input record passed to the call.\n * @returns A short display string suitable for the activity feed.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolCall(tool: string, input: Record<string, unknown>): string {\n  // A driver that sent a bare value instead of named args has it under `input`.\n  const arg = (key: string) => String(input[key] ?? input.input);\n  switch (tool) {\n    case \"Bash\":\n      return `$ ${String(input.command ?? input.input ?? \"\").slice(0, 200)}`;\n    case \"Write\":\n      return `Create ${arg(\"file_path\")}`;\n    case \"Edit\":\n      return `Edit ${arg(\"file_path\")}`;\n    case \"Read\":\n      return `Read ${arg(\"file_path\")}`;\n    case \"Glob\":\n      return `Find ${arg(\"pattern\")}`;\n    case \"Grep\":\n      return `Search for ${arg(\"pattern\")}`;\n    case \"ApplyPatch\": {\n      // Paths only: stringifying the input would serialize every full diff.\n      const changes = Array.isArray(input.changes) ? input.changes : [];\n      const paths = changes\n        .map((change) => (change as { path?: unknown } | null)?.path)\n        .filter((path): path is string => typeof path === \"string\");\n      return `Edit ${paths.join(\", \").slice(0, 200) || \"files\"}`;\n    }\n    default:\n      return `${tool}(${JSON.stringify(input).slice(0, 100)})`;\n  }\n}\n\n/**\n * Produce the plain-language label shown to non-technical users while a tool\n * call runs: the agent's own `activity_label`, Bash's `description`, else a\n * derived phrase for Claude Code built-ins. `undefined` for any other tool —\n * the UI then falls back to a generic \"working\" line rather than raw input.\n *\n * @param tool - Tool name as the model called it.\n * @param input - Tool input record, still carrying `activity_label`.\n * @returns A trimmed label capped at `TOOL_ACTIVITY_LABEL_MAX_CHARS`, or `undefined`.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function labelToolCall(tool: string, input: Record<string, unknown>): string | undefined {\n  const authored =\n    nonEmpty(input[TOOL_ACTIVITY_LABEL_PARAM]) ??\n    (tool === \"Bash\" ? nonEmpty(input.description) : undefined);\n  const label = authored ?? builtinToolLabel(tool, input);\n  if (!label) return undefined;\n  return label.length > TOOL_ACTIVITY_LABEL_MAX_CHARS\n    ? `${label.slice(0, TOOL_ACTIVITY_LABEL_MAX_CHARS - 1).trimEnd()}…`\n    : label;\n}\n\nfunction nonEmpty(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.replace(/\\s+/g, \" \").trim();\n  return trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction builtinToolLabel(tool: string, input: Record<string, unknown>): string | undefined {\n  switch (tool) {\n    case \"Read\":\n      return withTarget(\"Reading\", baseName(input.file_path));\n    case \"Edit\":\n    case \"MultiEdit\":\n    case \"NotebookEdit\":\n      return withTarget(\"Editing\", baseName(input.file_path ?? input.notebook_path));\n    case \"Write\":\n      return withTarget(\"Creating\", baseName(input.file_path));\n    case \"Grep\":\n    case \"Glob\":\n      return \"Searching files\";\n    case \"WebSearch\":\n      return \"Searching the web\";\n    case \"WebFetch\":\n      return withTarget(\"Fetching\", hostOf(input.url), \"a web page\");\n    case \"TodoWrite\":\n      return \"Updating the task list\";\n    case \"ApplyPatch\":\n      return \"Editing files\";\n    default:\n      return undefined;\n  }\n}\n\nfunction withTarget(verb: string, target: string | undefined, fallback = \"a file\"): string {\n  return `${verb} ${target ?? fallback}`;\n}\n\nfunction baseName(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n  return value.split(/[\\\\/]/).filter(Boolean).pop();\n}\n\nfunction hostOf(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  try {\n    return new URL(value).host || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Extract plain text from an Anthropic content-block array (e.g. tool results returned by Claude SDK). */\nfunction extractContentBlockText(blocks: unknown[]): string | null {\n  const textBlocks = blocks.filter(\n    (b): b is { type: \"text\"; text: string } =>\n      typeof b === \"object\" &&\n      b !== null &&\n      (b as Record<string, unknown>).type === \"text\" &&\n      typeof (b as Record<string, unknown>).text === \"string\",\n  );\n  if (textBlocks.length === 0) return null;\n  return textBlocks.map((b) => b.text).join(\"\\n\");\n}\n\n/**\n * Produce a human-readable one-line summary of a tool result for the activity log.\n *\n * Handles Bash stdout/stderr, Write/Edit file paths, ApplyPatch change counts, and\n * Anthropic content-block arrays. Falls back to `JSON.stringify` for unknown shapes.\n *\n * @param tool - Tool name.\n * @param result - Raw tool result payload.\n * @returns A short display string, truncated to 200 characters.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolResult(tool: string, result: unknown): string {\n  // Handle Anthropic content-block arrays: [{ type: \"text\", text: \"...\" }, ...]\n  if (Array.isArray(result)) {\n    const text = extractContentBlockText(result);\n    return (text ?? JSON.stringify(result)).slice(0, 200);\n  }\n  if (typeof result !== \"object\" || !result) {\n    return String(result).slice(0, 200);\n  }\n  const r = result as Record<string, unknown>;\n  switch (tool) {\n    case \"Bash\": {\n      const stderr = String(r.stderr ?? \"\").trim();\n      if (stderr) return `stderr: ${stderr.slice(0, 200)}`;\n      return (\n        String(r.stdout ?? \"\")\n          .trim()\n          .slice(0, 200) || \"(no output)\"\n      );\n    }\n    case \"Write\":\n      return `${String(r.type)}: ${String(r.filePath)}`;\n    case \"Edit\":\n      return `Edited ${String(r.filePath)}`;\n    case \"ApplyPatch\":\n      return `${Array.isArray(r.changes) ? r.changes.length : 0} file changes`;\n    default:\n      return JSON.stringify(result).slice(0, 200);\n  }\n}\n\n/**\n * Detect file-change events from a tool result, returning zero or more `file_changed` events.\n *\n * Handles `Write` (single create/edit), `Edit` (single edit), and `ApplyPatch` (multi-file\n * patch with per-change `kind` classification). Returns an empty array for all other tools.\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns Array of `file_changed` normalized events.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChanges(toolName: string, result: unknown): NormalizedEvent[] {\n  if (typeof result !== \"object\" || !result) return [];\n  const r = result as Record<string, unknown>;\n\n  if (toolName === \"Write\" && r.filePath) {\n    return [\n      {\n        type: \"file_changed\",\n        path: String(r.filePath),\n        action: r.type === \"create\" ? \"create\" : \"edit\",\n      },\n    ];\n  }\n  if (toolName === \"Edit\" && r.filePath) {\n    return [{ type: \"file_changed\", path: String(r.filePath), action: \"edit\" }];\n  }\n  if (toolName === \"ApplyPatch\" && Array.isArray(r.changes)) {\n    return r.changes\n      .filter(\n        (change): change is { path: string; kind: \"add\" | \"delete\" | \"update\" } =>\n          typeof change === \"object\" &&\n          change !== null &&\n          typeof (change as Record<string, unknown>).path === \"string\" &&\n          typeof (change as Record<string, unknown>).kind === \"string\",\n      )\n      .map((change) => ({\n        type: \"file_changed\" as const,\n        path: change.path,\n        action: change.kind === \"add\" ? \"create\" : change.kind === \"delete\" ? \"delete\" : \"edit\",\n      }));\n  }\n\n  return [];\n}\n\n/**\n * Backward-compatible single-event helper; returns the first `file_changed` event or `null`.\n *\n * Prefer {@link detectFileChanges} for multi-file patches (e.g. `ApplyPatch`).\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns First detected `file_changed` event, or `null`.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChange(toolName: string, result: unknown): NormalizedEvent | null {\n  return detectFileChanges(toolName, result)[0] ?? null;\n}\n","/**\n * BridgeRuntime — implements IAgentRuntime from @skaile/workspaces/types by wrapping\n * an AgentDriver + EventNormalizer. This is the primary integration point for\n * consumers that want normalized events from any driver.\n */\n\nimport type {\n  AgentEvent,\n  AgentPromptInput,\n  AgentReconfigureOptions,\n  AgentRuntimeConfig,\n  IAgentRuntime,\n} from \"@skaile/workspaces/types\";\n\nimport { EventNormalizer } from \"./normalizer.js\";\nimport { toMergedRegistry } from \"./provider-registry-derive.js\";\nimport { createDriver } from \"./registry.js\";\nimport type { AgentConfig, AgentDriver } from \"./types.js\";\n\n/**\n * Implements `IAgentRuntime` from `@skaile/workspaces/types` by wrapping an {@link AgentDriver}\n * and an {@link EventNormalizer}.\n *\n * This is the primary integration point for consumers that want normalized `AgentEvent`\n * payloads from any driver without managing the driver lifecycle directly. Create via\n * {@link createRuntime} to avoid coupling to `BridgeRuntime` directly.\n *\n * @docLink packages/bridge/api-reference#runtime\n */\nexport class BridgeRuntime implements IAgentRuntime {\n  private driver: AgentDriver | null = null;\n  private normalizer = new EventNormalizer();\n  private handlers = new Set<(event: AgentEvent) => void>();\n  private boundEventHandler: ((event: any) => void) | null = null;\n  private driverId: string;\n\n  constructor(driverId: string = \"claude-sdk\") {\n    this.driverId = driverId;\n  }\n\n  async start(config: AgentRuntimeConfig): Promise<void> {\n    // Dispose previous driver if any\n    if (this.driver) {\n      await this.dispose();\n    }\n\n    this.normalizer.reset();\n\n    const bridgeConfig: AgentConfig = {\n      cwd: config.cwd,\n      model: config.model,\n      systemPrompt: config.systemPrompt,\n      env: config.env,\n      agentDir: config.agentDir,\n      sessionId: config.sessionId,\n      resumeSessionId: config.resumeSessionId,\n      maxTurns: config.maxTurns,\n      ...(config.registry ? { registry: toMergedRegistry(config.registry, \"runtime\") } : {}),\n      ...(config.modelRef ? { modelRef: config.modelRef } : {}),\n    };\n\n    this.driver = await createDriver(this.driverId, bridgeConfig);\n\n    // Wire bridge events through normalizer to handlers\n    this.boundEventHandler = (bridgeEvent: any) => {\n      const normalized = this.normalizer.normalize(bridgeEvent);\n      for (const event of normalized) {\n        for (const handler of this.handlers) {\n          handler(event);\n        }\n      }\n    };\n    this.driver.on(\"agent-event\", this.boundEventHandler);\n\n    await this.driver.start();\n  }\n\n  async configure(_config: AgentReconfigureOptions): Promise<void> {\n    // Runtime reconfiguration for BridgeRuntime is a no-op for now.\n    // Future: reconnect connectors, reload ai-assets, update subagents.\n  }\n\n  async prompt(message: string): Promise<void> {\n    if (!this.driver) throw new Error(\"Runtime not started — call start() first\");\n    await this.driver.prompt(message);\n  }\n\n  async promptInput(input: AgentPromptInput): Promise<void> {\n    if (!this.driver) throw new Error(\"Runtime not started — call start() first\");\n    await this.driver.promptInput(input);\n  }\n\n  async reply(answer: string, question?: string, requestId?: string): Promise<void> {\n    if (!this.driver) throw new Error(\"Runtime not started — call start() first\");\n    // Mirror serve.ts handleReply: an answer must resume the paused turn. Falling through to\n    // prompt() would deny the question as superseded and drop the structured answer.\n    if (\n      this.driver?.hasPendingQuestion() &&\n      this.driver.answerQuestion(answer, question, requestId)\n    )\n      return;\n    if (this.driver?.acceptsReplyAsPrompt) await this.prompt(answer);\n  }\n\n  async abort(): Promise<void> {\n    if (this.driver) {\n      await this.driver.abort();\n    }\n  }\n\n  async dispose(): Promise<void> {\n    if (this.driver) {\n      if (this.boundEventHandler) {\n        this.driver.off(\"agent-event\", this.boundEventHandler);\n        this.boundEventHandler = null;\n      }\n      this.driver.kill();\n      this.driver = null;\n    }\n    this.normalizer.reset();\n  }\n\n  onEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.add(handler);\n  }\n\n  offEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.delete(handler);\n  }\n\n  get isRunning(): boolean {\n    return this.driver?.isRunning ?? false;\n  }\n}\n\n/**\n * Factory function to create a {@link BridgeRuntime} with the specified driver.\n *\n * @param driverId - Registered driver id (default: `\"claude-sdk\"`).\n * @returns A new `IAgentRuntime` wrapping the selected driver with event normalization.\n * @docLink packages/bridge/api-reference#runtime\n */\nexport function createRuntime(driverId: string = \"claude-sdk\"): IAgentRuntime {\n  return new BridgeRuntime(driverId);\n}\n","/** Provider API key validation — hits each provider's models endpoint to verify the key works. */\n\nimport {\n  buildCredentialHeaders,\n  expandPreset,\n  getProviderPreset,\n  resolvePresetBaseUrl,\n  resolveProbeUrl,\n} from \"./provider-catalog.js\";\n\n/**\n * Result of an API key validation check performed by {@link validateApiKey}.\n *\n * @docLink packages/bridge/api-reference#validation\n */\nexport interface ValidationResult {\n  /** `true` when the API key was accepted by the provider's models endpoint. */\n  ok: boolean;\n  /** Human-readable error description when `ok` is `false`. */\n  error?: string;\n}\n\n/**\n * Validate an API key by sending a lightweight GET request to the provider's models endpoint.\n *\n * Returns `{ ok: true }` when the provider accepts the key (HTTP 2xx). Returns\n * `{ ok: false, error }` on 401/403 (invalid key), other HTTP errors, network failures,\n * or unsupported providers. Requests time out after 8 seconds.\n *\n * @param provider - Catalog preset id (e.g. `\"anthropic\"`, `\"openai\"`, `\"google\"`).\n * @param key - API key to validate.\n * @param options - Optional base-URL / environment overrides; defaults to the\n *   provider's own API, or its `base_url_env` value when one is set.\n * @returns Validation result with optional error description.\n * @docLink packages/bridge/api-reference#validation\n */\nexport async function validateApiKey(\n  provider: string,\n  key: string,\n  options: { baseUrl?: string; env?: Record<string, string | undefined> } = {},\n): Promise<ValidationResult> {\n  const preset = getProviderPreset(provider);\n  if (!preset) return { ok: false, error: `Unknown provider: ${provider}` };\n\n  // Validate against the same endpoint discovery/dispatch use: behind a gateway\n  // the key is the gateway's, and the provider's public API would reject it.\n  const baseUrl = resolvePresetBaseUrl(preset, {\n    ...(options.baseUrl ? { baseUrl: options.baseUrl } : {}),\n    env: options.env ?? process.env,\n  });\n  const entry = expandPreset(preset, baseUrl ? { baseUrl } : {});\n  const url = resolveProbeUrl(entry);\n  if (!url) return { ok: false, error: `Provider ${provider} exposes no models endpoint` };\n  // Static non-secret headers (Anthropic's `anthropic-version`) plus the\n  // credential carrier the preset's `auth_header` names.\n  const headers = { ...entry.headers, ...buildCredentialHeaders(entry, key) };\n\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), 8000);\n\n    const response = await fetch(url, {\n      method: \"GET\",\n      headers,\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeout);\n\n    if (response.ok) return { ok: true };\n\n    const status = response.status;\n    if (status === 401 || status === 403) {\n      return { ok: false, error: \"Invalid API key (authentication failed)\" };\n    }\n    return { ok: false, error: `API returned HTTP ${status}` };\n  } catch (err: any) {\n    if (err.name === \"AbortError\") return { ok: false, error: \"Request timed out (8s)\" };\n    return { ok: false, error: err.message ?? \"Network error\" };\n  }\n}\n"]}
+{"version":3,"sources":["../bridge/src/normalizer.ts","../bridge/src/runtime.ts","../bridge/src/validation.ts"],"names":[],"mappings":";;;;;AAsBA,SAAS,kBACP,KAAA,EAIA;AACA,EAAA,OAAO;AAAA,IACL,GAAI,MAAM,MAAA,GAAS,EAAE,QAAQ,KAAA,CAAM,MAAA,KAAW,EAAC;AAAA,IAC/C,GAAI,MAAM,UAAA,GAAa,EAAE,YAAY,KAAA,CAAM,UAAA,KAAe,EAAC;AAAA,IAC3D,GAAI,OAAO,KAAA,CAAM,aAAA,KAAkB,QAAA,GAAW,EAAE,aAAA,EAAe,KAAA,CAAM,aAAA,EAAc,GAAI,EAAC;AAAA,IACxF,GAAI,OAAO,KAAA,CAAM,aAAA,KAAkB,QAAA,GAAW,EAAE,aAAA,EAAe,KAAA,CAAM,aAAA,EAAc,GAAI;AAAC,GAC1F;AACF;AAOA,IAAM,aAAA,GAAgB,iBAAA;AAEtB,IAAM,uBAAA,GAA0B,EAAA;AAMhC,SAAS,gBAAgB,KAAA,EAAyC;AAChE,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,KAAA,EAAM;AAAA,IACjB;AAAA,EACF;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA,EAAM;AAC5C;AAWO,IAAM,kBAAN,MAAsB;AAAA,EACnB,eAAA,uBAAsB,GAAA,EAAoB;AAAA,EAC1C,wBAAA,GAA2B,KAAA;AAAA,EAC3B,qBAAA,GAAwB,KAAA;AAAA;AAAA,EAExB,eAAA,GAAkB,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlB,iBAAA,GAAoB,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpB,oBAA0D,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnE,UAAU,KAAA,EAAuC;AAC/C,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,eAAA;AACH,QAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,CAAM,OAAO,CAAA;AAAA,MAE9C,KAAK,gBAAA;AACH,QAAA,OAAO,IAAA,CAAK,oBAAoB,KAAK,CAAA;AAAA,MAEvC,KAAK,aAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,iBAAA;AAGH,QAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,QAAA,OAAO,KAAA,CAAM,IAAA,GAAO,CAAC,EAAE,IAAA,EAAM,cAAA,EAAgB,OAAA,EAAS,KAAA,CAAM,IAAA,EAAM,CAAA,GAAI,EAAC;AAAA,MAEzE,KAAK,UAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,KAAA,CAAM,WAAW,CAAA;AAAA,MAE7C,KAAK,QAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAa,KAAK,CAAA;AAAA,MAEhC,KAAK,OAAA;AACH,QAAA,IAAA,CAAK,oBAAoB,EAAC;AAC1B,QAAA,OAAO;AAAA,UACL;AAAA,YACE,IAAA,EAAM,OAAA;AAAA,YACN,SAAS,KAAA,CAAM,KAAA;AAAA,YACf,KAAA,EAAO,MAAM,KAAA,IAAS,IAAA;AAAA,YACtB,QAAA,EAAU,MAAM,MAAA,EAAQ,QAAA;AAAA,YACxB,GAAI,KAAA,CAAM,MAAA,EAAQ,IAAA,GAAO,EAAE,MAAM,KAAA,CAAM,MAAA,CAAO,IAAA,EAAK,GAAI,EAAC;AAAA,YACxD,GAAG,kBAAkB,KAAK,CAAA;AAAA,YAC1B,GAAI,KAAA,CAAM,QAAA,KAAa,OACnB,EAAE,QAAA,EAAU,MAAM,GAAI,KAAA,CAAM,WAAA,GAAc,EAAE,aAAa,KAAA,CAAM,WAAA,KAAgB,EAAC,KAChF;AAAC;AACP,SACF;AAAA,MAEF,KAAK,WAAA,EAAa;AAIhB,QAAA,MAAM,QAAA,GAAW,KAAA,CAAM,IAAA,IAAQ,KAAA,CAAM,IAAA,EAAM,IAAA;AAC3C,QAAA,IAAI,QAAA,KAAa,aAAA,EAAe,OAAO,EAAC;AAGxC,QAAA,IAAI,CAAC,QAAA,IAAY,IAAA,CAAK,wBAAwB,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,EAAG;AACzE,UAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAAA,QAC9C;AACA,QAAA,OAAO,IAAA,CAAK,aAAA;AAAA,UACV;AAAA,YACE,IAAA,EAAM,UAAA;AAAA,YACN,IAAI,OAAO,KAAA,CAAM,UAAA,KAAe,QAAA,GAAW,MAAM,UAAA,GAAa,MAAA;AAAA,YAC9D,IAAA,EAAM,QAAA;AAAA,YACN,KAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,KAAK;AAAA,WACpC;AAAA,UACA,OAAO,KAAA,CAAM,eAAA,KAAoB,QAAA,GAAW,MAAM,eAAA,GAAkB;AAAA,SACtE;AAAA,MACF;AAAA,MAEA,KAAK,oBAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,oBAAoB,EAAC;AAC1B,QAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,QAAQ,CAAA;AAAA,MAE3C,KAAK,oBAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,cAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,WAAA;AAAA,MACL,KAAK,kBAAA;AAAA,MACL,KAAK,UAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C;AACE,QAAA,OAAO,EAAC;AAAA;AACZ,EACF;AAAA;AAAA,EAGA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,gBAAgB,KAAA,EAAM;AAC3B,IAAA,IAAA,CAAK,wBAAA,GAA2B,KAAA;AAChC,IAAA,IAAA,CAAK,qBAAA,GAAwB,KAAA;AAC7B,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AACzB,IAAA,IAAA,CAAK,oBAAoB,EAAC;AAAA,EAC5B;AAAA,EAEQ,uBAAA,CAAwB,MAAc,EAAA,EAAsB;AAClE,IAAA,MAAM,MAAA,GAAS,OAAO,EAAA,KAAO,QAAA,GAAW,EAAA,GAAK,MAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,KAAK,iBAAA,CAAkB,SAAA;AAAA,MACnC,CAAC,KAAA,KAAU,KAAA,CAAM,IAAA,KAAS,IAAA,KAAS,CAAC,MAAA,IAAU,CAAC,KAAA,CAAM,EAAA,IAAM,KAAA,CAAM,EAAA,KAAO,MAAA;AAAA,KAC1E;AACA,IAAA,IAAI,KAAA,KAAU,IAAI,OAAO,KAAA;AACzB,IAAA,IAAA,CAAK,iBAAA,CAAkB,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACtC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmB,OAAA,EAA0C;AAKnE,IAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa,OAAO,EAAC;AAI1C,IAAA,MAAM,kBAAkB,OAAA,CAAQ,eAAA;AAChC,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,gBAAA,CAAiB,OAAO,CAAA;AAE5C,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,IAAU,KAAA,CAAM,IAAA,EAAM;AACvC,QAAA,IAAI,eAAA,EAAiB;AAErB,QAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,UAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAQ,OAAA,EAAS,KAAA,CAAM,MAAM,CAAA;AAAA,QACnD;AAAA,MACF,CAAA,MAAA,IAAW,KAAA,CAAM,IAAA,KAAS,UAAA,IAAc,MAAM,IAAA,EAAM;AAClD,QAAA,IAAI,KAAA,CAAM,SAAS,aAAA,EAAe;AAChC,UAAA,IAAA,CAAK,iBAAA,CAAkB,KAAK,EAAE,EAAA,EAAI,MAAM,EAAA,EAAI,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,CAAA;AAE9D,UAAA,IAAI,IAAA,CAAK,iBAAA,CAAkB,MAAA,GAAS,uBAAA,EAAyB;AAC3D,YAAA,IAAA,CAAK,kBAAkB,KAAA,EAAM;AAAA,UAC/B;AAAA,QACF;AACA,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,aAAA,CAAc,KAAA,EAAO,eAAe,CAAC,CAAA;AAAA,MAC3D;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,eAAA,EAAiB,IAAA,CAAK,eAAA,GAAkB,KAAA;AAC7C,IAAA,IAAI,CAAC,eAAA,EAAiB,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAC/C,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,aAAA,CAAc,OAAqB,eAAA,EAA6C;AACtF,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,MAAM,KAAA,GAAS,KAAA,CAAM,KAAA,IAAS,EAAC;AAE/B,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,OAAO,IAAA,CAAK,sBAAsB,KAAK,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,SAAS,OAAA,EAAS;AACpB,MAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,IAC7C;AACA,IAAA,OAAO,IAAA,CAAK,oBAAA,CAAqB,IAAA,EAAM,KAAA,EAAO,eAAe,CAAA;AAAA,EAC/D;AAAA,EAEQ,sBAAsB,KAAA,EAAmD;AAC/E,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,YAAY,KAAA,CAAM,QAAA;AACxB,IAAA,MAAM,QAAA,GACJ,aACA,CAAC,SAAA,EAAW,QAAQ,aAAA,EAAe,KAAK,CAAA,CAAE,QAAA,CAAS,SAAA,CAAU,IAAA,IAAQ,EAAE,CAAA,IACvE,KAAA,CAAM,OAAA,CAAQ,SAAA,CAAU,OAAO,CAAA,IAC/B,UAAU,OAAA,CAAQ,MAAA,GAAS,CAAA,IAC3B,SAAA,CAAU,OAAA,CAAQ,MAAA,IAAU,MAC5B,SAAA,CAAU,OAAA,CAAQ,MAAM,CAAC,MAAA,KAAW,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,MAAA,IAAU,IAAI,CAAA,IACvF,UAAU,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,EAAO,MAAA,KAAW,KAAA,GAAQ,OAAO,MAAA,EAAQ,CAAC,CAAA,IAAK,KAAA,GACpE,SAAA,GACD,MAAA;AACN,IAAA,IAAI,MAAA,CAAO,OAAO,KAAA,EAAO,UAAU,KAAK,CAAC,QAAA,SAAiB,EAAC;AAG3D,IAAA,MAAM,YAAY,KAAA,CAAM,SAAA;AACxB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC5B,MAAA,KAAA,MAAW,KAAK,SAAA,EAAW;AACzB,QAAA,MAAM,IAAA,GAAO,CAAA;AACb,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,QAAA,IAAY,EAAE,CAAA;AAC3C,QAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,QAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GACjC,OAAA,CAAQ,IAAI,CAAC,CAAA,KAAY,OAAO,CAAA,KAAM,WAAW,CAAA,GAAI,MAAA,CAAO,EAAE,KAAA,IAAS,CAAC,CAAE,CAAA,GAC1E,MAAA;AACJ,QAAA,MAAA,CAAO,IAAA,CAAK;AAAA,UACV,IAAA,EAAM,UAAA;AAAA,UACN,QAAA;AAAA,UACA,OAAA;AAAA,UACA,GAAI,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,GAAW,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU,GAAI,EAAC;AAAA,UAC5E,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa;AAAC,SAChC,CAAA;AAAA,MACH;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,WAAW,MAAA,CAAO,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAQ,EAAE,CAAA;AAC1D,MAAA,MAAM,aAAa,KAAA,CAAM,OAAA;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAU,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,GAAI,MAAA;AACrE,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,IAAA,EAAM,UAAA;AAAA,QACN,QAAA;AAAA,QACA,OAAA;AAAA,QACA,GAAI,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,GAAW,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU,GAAI,EAAC;AAAA,QAC5E,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa;AAAC,OAChC,CAAA;AAAA,IACH;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,kBAAA,CACN,OACA,KAAA,EACmB;AACnB,IAAA,MAAM,YAAY,MAAA,CAAO,KAAA,CAAM,aAAA,IAAiB,KAAA,CAAM,eAAe,SAAS,CAAA;AAC9E,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,WAAA,IAAe,KAAA,CAAM,UAAU,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAChF,IAAA,IAAI,MAAM,EAAA,EAAI;AACZ,MAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,SAAS,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO;AAAA,MACL,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,WAAW,WAAA,EAAY;AAAA,MACpE,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,SAAA;AAAU,KACrC;AAAA,EACF;AAAA,EAEQ,oBAAA,CACN,IAAA,EACA,KAAA,EACA,eAAA,EACmB;AACnB,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,IAAA,EAAM,KAAK,CAAA;AACvC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,WAAA;AAAA,MACN,IAAA,EAAM,IAAA;AAAA,MACN,KAAA;AAAA;AAAA;AAAA,MAGA,OAAA,EAAS,iBAAA,CAAkB,IAAA,EAAM,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAAA,MAC1D,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU,EAAC;AAAA,MACzB,GAAI,eAAA,GAAkB,EAAE,eAAA,KAAoB;AAAC,KAC9C,CAAA;AACD,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAEhD,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACxD,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,uBAAA,CAAwB,KAAA,CAAM,OAAO,CAAA;AAC3D,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,KAAA,EAAuC;AAGjE,IAAA,MAAM,QAAS,KAAA,CAAc,UAAA;AAC7B,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AACzB,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,OAAO,CAAA;AAAA,IAC1C;AAIA,IAAA,MAAM,QAAA,GAAoB,gBAAA,IAAoB,KAAA,GAAQ,KAAA,CAAM,cAAA,GAAiB,MAAA;AAC7E,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,IAAY,CAAC,KAAK,iBAAA,EAAmB;AACvE,MAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AACzB,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,YAAY,CAAA;AAAA,IAC/C;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAMQ,cAAc,WAAA,EAAiD;AACrE,IAAA,IAAI,CAAC,WAAA,EAAa,MAAA,EAAQ,OAAO,EAAC;AAElC,IAAA,MAAM,SAA4B,EAAC;AAEnC,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AAChC,MAAA,MAAM,QAAA,GAAW,OAAO,QAAA,IAAY,SAAA;AACpC,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,OAAA;AACzC,MAAA,MAAM,SAAS,OAAO,UAAA,KAAe,WAAW,UAAA,GAAa,IAAA,CAAK,UAAU,UAAU,CAAA;AAGtF,MAAA,IAAI,QAAA,KAAa,OAAA,IAAW,IAAA,CAAK,gBAAA,CAAiB,MAAM,CAAA,EAAG;AACzD,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,oBAAA,CAAqB,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,MAC1D,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,IAAA,CAAK,GAAG,IAAA,CAAK,gBAAA,CAAiB,UAAU,UAAA,EAAY,MAAA,EAAQ,MAAA,CAAO,eAAe,CAAC,CAAA;AAAA,MAC5F;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,oBAAA,CAAqB,QAAsB,MAAA,EAAmC;AACpF,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,mBAAA,CAAoB,MAAM,CAAA;AACjD,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AACvC,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAY,WAAA,EAAa,CAAA;AAElF,IAAA,IAAI,cAAc,YAAA,EAAc;AAC9B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,gBAAA,CACN,QAAA,EACA,UAAA,EACA,MAAA,EACA,eAAA,EACmB;AACnB,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,aAAA;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,UAAA;AAAA,MACR,OAAA,EAAS,mBAAA,CAAoB,QAAA,EAAU,UAAU,CAAA;AAAA,MACjD,GAAI,eAAA,GAAkB,EAAE,eAAA,KAAoB;AAAC,KAC9C,CAAA;AAGD,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,QAAA,EAAU,UAAU,CAAA;AACzD,IAAA,IAAI,WAAW,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,IAAA,CAAK,GAAG,UAAU,CAAA;AAGpD,IAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,iBAAiB,MAAA,EAA+B;AAEtD,IAAA,IAAI,MAAA,CAAO,YAAY,IAAA,CAAK,eAAA,CAAgB,IAAI,MAAA,CAAO,QAAQ,GAAG,OAAO,IAAA;AACzE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEQ,oBAAoB,MAAA,EAA8B;AAExD,IAAA,MAAM,IAAA,GAAO,OAAO,QAAA,GAAW,IAAA,CAAK,gBAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,GAAI,MAAA;AAC3E,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,MAAA,CAAO,QAAS,CAAA;AAC5C,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAO,QAAA,IAAY,SAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,KAAA,EAA4D;AAC/E,IAAA,MAAM,KAAA,GAAQ,kBAAkB,KAAK,CAAA;AACrC,IAAA,IAAI,KAAA,CAAM,YAAY,SAAA,EAAW;AAC/B,MAAA,OAAO;AAAA,QACL;AAAA,UACE,IAAA,EAAM,UAAA;AAAA,UACN,OAAA,EAAS,MAAM,OAAA,IAAW,gBAAA;AAAA,UAC1B,OAAA,EAAS,MAAM,OAAA,IAAW,CAAA;AAAA,UAC1B,GAAG;AAAA;AACL,OACF;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,IAAU,EAAC;AAKhC,IAAA,MAAM,SAAS,sBAAA,CAAuB,EAAE,QAAQ,OAAA,EAAS,KAAA,CAAM,SAAS,CAAA;AAIxE,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,OAAA,EAAS,CAAA,eAAA,EAAkB,KAAA,CAAM,OAAO,CAAA,EAAG,MAAA,CAAO,MAAA,GAAS,CAAA,QAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,KAAK,EAAE,CAAA,CAAA;AAAA,QACzF,KAAA,EAAO,MAAM,OAAA,KAAY,wBAAA;AAAA,QACzB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,GAAI,OAAO,IAAA,GAAO,EAAE,MAAM,MAAA,CAAO,IAAA,KAAS,EAAC;AAAA,QAC3C,GAAI,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,GAAW,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAQ,GAAI,EAAC;AAAA,QACtE,GAAG;AAAA;AACL,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMQ,wBAAwB,OAAA,EAAyC;AACvE,IAAA,IAAI,IAAA,CAAK,0BAA0B,OAAO,IAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,IAAA,MAAM,mBACH,GAAA,CAAI,QAAA,CAAS,cAAc,CAAA,IAAK,GAAA,CAAI,SAAS,UAAU,CAAA,IAAK,IAAI,QAAA,CAAS,MAAM,OAC/E,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA,IAAK,GAAA,CAAI,SAAS,aAAa,CAAA,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,IAAA,CAAK,wBAAA,GAA2B,IAAA;AAChC,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,UAAA,EAAW;AAAA,IAChF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,qBAAqB,IAAA,EAAsC;AACjE,IAAA,IAAI,IAAA,CAAK,uBAAuB,OAAO,IAAA;AAEvC,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,wCAAwC,CAAA;AACzE,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,cAAc,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACvE;AAEA,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,qCAAqC,CAAA;AAClE,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,UAAU,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACnE;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,gBAAgB,CAAA,EAAG;AACnC,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,OAAA,EAAQ;AAAA,IAC7E;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAiB,OAAA,EAAuC;AAC9D,IAAA,IAAI,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,SAAU,OAAA,CAAQ,OAAA;AACnD,IAAA,IAAI,OAAO,OAAA,CAAQ,OAAA,KAAY,QAAA,IAAY,QAAQ,OAAA,EAAS;AAC1D,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,OAAA,CAAQ,SAAS,CAAA;AAAA,IACjD;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAiBO,SAAS,iBAAA,CAAkB,MAAc,KAAA,EAAwC;AAEtF,EAAA,MAAM,GAAA,GAAM,CAAC,GAAA,KAAgB,MAAA,CAAO,MAAM,GAAG,CAAA,IAAK,MAAM,KAAK,CAAA;AAC7D,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,EAAA,EAAK,MAAA,CAAO,KAAA,CAAM,OAAA,IAAW,KAAA,CAAM,KAAA,IAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAAA,IACtE,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA;AAAA,IACnC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA;AAAA,IACjC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA;AAAA,IACjC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IAC/B,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,WAAA,EAAc,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IACrC,KAAK,YAAA,EAAc;AAEjB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA,GAAI,KAAA,CAAM,UAAU,EAAC;AAChE,MAAA,MAAM,KAAA,GAAQ,OAAA,CACX,GAAA,CAAI,CAAC,MAAA,KAAY,MAAA,EAAsC,IAAI,CAAA,CAC3D,MAAA,CAAO,CAAC,IAAA,KAAyB,OAAO,SAAS,QAAQ,CAAA;AAC5D,MAAA,OAAO,CAAA,KAAA,EAAQ,MAAM,IAAA,CAAK,IAAI,EAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,OAAO,CAAA,CAAA;AAAA,IAC1D;AAAA,IACA;AACE,MAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA;AAE3D;AAaO,SAAS,aAAA,CAAc,MAAc,KAAA,EAAoD;AAC9F,EAAA,MAAM,QAAA,GACJ,QAAA,CAAS,KAAA,CAAM,yBAAyB,CAAC,CAAA,KACxC,IAAA,KAAS,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,WAAW,CAAA,GAAI,MAAA,CAAA;AACnD,EAAA,MAAM,KAAA,GAAQ,QAAA,IAAY,gBAAA,CAAiB,IAAA,EAAM,KAAK,CAAA;AACtD,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,KAAA,CAAM,MAAA,GAAS,6BAAA,GAClB,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,6BAAA,GAAgC,CAAC,CAAA,CAAE,OAAA,EAAS,CAAA,MAAA,CAAA,GAC9D,KAAA;AACN;AAEA,SAAS,SAAS,KAAA,EAAoC;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA;AACtC,EAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,GAAG,EAAE,IAAA,EAAK;AAChD,EAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,GAAU,MAAA;AACxC;AAEA,SAAS,gBAAA,CAAiB,MAAc,KAAA,EAAoD;AAC1F,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA;AACH,MAAA,OAAO,UAAA,CAAW,SAAA,EAAW,QAAA,CAAS,KAAA,CAAM,SAAS,CAAC,CAAA;AAAA,IACxD,KAAK,MAAA;AAAA,IACL,KAAK,WAAA;AAAA,IACL,KAAK,cAAA;AACH,MAAA,OAAO,WAAW,SAAA,EAAW,QAAA,CAAS,MAAM,SAAA,IAAa,KAAA,CAAM,aAAa,CAAC,CAAA;AAAA,IAC/E,KAAK,OAAA;AACH,MAAA,OAAO,UAAA,CAAW,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,SAAS,CAAC,CAAA;AAAA,IACzD,KAAK,MAAA;AAAA,IACL,KAAK,MAAA;AACH,MAAA,OAAO,iBAAA;AAAA,IACT,KAAK,WAAA;AACH,MAAA,OAAO,mBAAA;AAAA,IACT,KAAK,UAAA;AACH,MAAA,OAAO,WAAW,UAAA,EAAY,MAAA,CAAO,KAAA,CAAM,GAAG,GAAG,YAAY,CAAA;AAAA,IAC/D,KAAK,WAAA;AACH,MAAA,OAAO,wBAAA;AAAA,IACT,KAAK,YAAA;AACH,MAAA,OAAO,eAAA;AAAA,IACT;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAEA,SAAS,UAAA,CAAW,IAAA,EAAc,MAAA,EAA4B,QAAA,GAAW,QAAA,EAAkB;AACzF,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAA,IAAU,QAAQ,CAAA,CAAA;AACtC;AAEA,SAAS,SAAS,KAAA,EAAoC;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,KAAW,GAAG,OAAO,MAAA;AAC5D,EAAA,OAAO,MAAM,KAAA,CAAM,OAAO,EAAE,MAAA,CAAO,OAAO,EAAE,GAAA,EAAI;AAClD;AAEA,SAAS,OAAO,KAAA,EAAoC;AAClD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA;AACtC,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,IAAA,IAAQ,KAAA,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGA,SAAS,wBAAwB,MAAA,EAAkC;AACjE,EAAA,MAAM,aAAa,MAAA,CAAO,MAAA;AAAA,IACxB,CAAC,CAAA,KACC,OAAO,CAAA,KAAM,QAAA,IACb,CAAA,KAAM,IAAA,IACL,CAAA,CAA8B,IAAA,KAAS,MAAA,IACxC,OAAQ,CAAA,CAA8B,IAAA,KAAS;AAAA,GACnD;AACA,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,UAAA,CAAW,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA,CAAE,KAAK,IAAI,CAAA;AAChD;AAaO,SAAS,mBAAA,CAAoB,MAAc,MAAA,EAAyB;AAEzE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,IAAA,MAAM,IAAA,GAAO,wBAAwB,MAAM,CAAA;AAC3C,IAAA,OAAA,CAAQ,QAAQ,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,EAAQ;AACzC,IAAA,OAAO,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACpC;AACA,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA,EAAQ;AACX,MAAA,MAAM,SAAS,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,EAAE,IAAA,EAAK;AAC3C,MAAA,IAAI,QAAQ,OAAO,CAAA,QAAA,EAAW,OAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAClD,MAAA,OACE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA,CAClB,MAAK,CACL,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,aAAA;AAAA,IAExB;AAAA,IACA,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,EAAG,OAAO,CAAA,CAAE,IAAI,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACjD,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACrC,KAAK,YAAA;AACH,MAAA,OAAO,CAAA,EAAG,MAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,aAAA,CAAA;AAAA,IAC3D;AACE,MAAA,OAAO,KAAK,SAAA,CAAU,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA;AAEhD;AAaO,SAAS,iBAAA,CAAkB,UAAkB,MAAA,EAAoC;AACtF,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,SAAe,EAAC;AACnD,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,QAAA,KAAa,OAAA,IAAW,CAAA,CAAE,QAAA,EAAU;AACtC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAAA,QACvB,MAAA,EAAQ,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,QAAA,GAAW;AAAA;AAC3C,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAA,KAAa,MAAA,IAAU,CAAA,CAAE,QAAA,EAAU;AACrC,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,cAAA,EAAgB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA,EAAG,MAAA,EAAQ,MAAA,EAAQ,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,aAAa,YAAA,IAAgB,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,EAAG;AACzD,IAAA,OAAO,EAAE,OAAA,CACN,MAAA;AAAA,MACC,CAAC,MAAA,KACC,OAAO,MAAA,KAAW,QAAA,IAClB,MAAA,KAAW,IAAA,IACX,OAAQ,MAAA,CAAmC,IAAA,KAAS,QAAA,IACpD,OAAQ,OAAmC,IAAA,KAAS;AAAA,KACxD,CACC,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,MAChB,IAAA,EAAM,cAAA;AAAA,MACN,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAA,EAAQ,OAAO,IAAA,KAAS,KAAA,GAAQ,WAAW,MAAA,CAAO,IAAA,KAAS,WAAW,QAAA,GAAW;AAAA,KACnF,CAAE,CAAA;AAAA,EACN;AAEA,EAAA,OAAO,EAAC;AACV;AAYO,SAAS,gBAAA,CAAiB,UAAkB,MAAA,EAAyC;AAC1F,EAAA,OAAO,iBAAA,CAAkB,QAAA,EAAU,MAAM,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AACnD;;;ACvuBO,IAAM,gBAAN,MAA6C;AAAA,EAC1C,MAAA,GAA6B,IAAA;AAAA,EAC7B,UAAA,GAAa,IAAI,eAAA,EAAgB;AAAA,EACjC,QAAA,uBAAe,GAAA,EAAiC;AAAA,EAChD,iBAAA,GAAmD,IAAA;AAAA,EACnD,QAAA;AAAA,EAER,WAAA,CAAY,WAAmB,YAAA,EAAc;AAC3C,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,MAAM,MAAM,MAAA,EAA2C;AAErD,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,KAAK,OAAA,EAAQ;AAAA,IACrB;AAEA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAEtB,IAAA,MAAM,YAAA,GAA4B;AAAA,MAChC,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,iBAAiB,MAAA,CAAO,eAAA;AAAA,MACxB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,GAAI,MAAA,CAAO,QAAA,GAAW,EAAE,QAAA,EAAU,gBAAA,CAAiB,MAAA,CAAO,QAAA,EAAU,SAAS,CAAA,EAAE,GAAI,EAAC;AAAA,MACpF,GAAI,OAAO,QAAA,GAAW,EAAE,UAAU,MAAA,CAAO,QAAA,KAAa;AAAC,KACzD;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,YAAY,CAAA;AAG5D,IAAA,IAAA,CAAK,iBAAA,GAAoB,CAAC,WAAA,KAAqB;AAC7C,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU,WAAW,CAAA;AACxD,MAAA,KAAA,MAAW,SAAS,UAAA,EAAY;AAC9B,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACnC,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf;AAAA,MACF;AAAA,IACF,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AAEpD,IAAA,MAAM,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EAC1B;AAAA,EAEA,MAAM,UAAU,OAAA,EAAiD;AAAA,EAGjE;AAAA,EAEA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAC5E,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,KAAA,EAAwC;AACxD,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAC5E,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,KAAK,CAAA;AAAA,EACrC;AAAA,EAEA,MAAM,KAAA,CAAM,MAAA,EAAgB,QAAA,EAAmB,SAAA,EAAmC;AAChF,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAG5E,IAAA,IACE,IAAA,CAAK,QAAQ,kBAAA,EAAmB,IAChC,KAAK,MAAA,CAAO,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,SAAS,CAAA;AAEtD,MAAA;AACF,IAAA,IAAI,KAAK,MAAA,EAAQ,oBAAA,EAAsB,MAAM,IAAA,CAAK,OAAO,MAAM,CAAA;AAAA,EACjE;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,QAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AACrD,QAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AAAA,MAC3B;AACA,MAAA,IAAA,CAAK,OAAO,IAAA,EAAK;AACjB,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAAA,EACxB;AAAA,EAEA,QAAQ,OAAA,EAA4C;AAClD,IAAA,IAAA,CAAK,QAAA,CAAS,IAAI,OAAO,CAAA;AAAA,EAC3B;AAAA,EAEA,SAAS,OAAA,EAA4C;AACnD,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,IAAa,KAAA;AAAA,EACnC;AACF;AASO,SAAS,aAAA,CAAc,WAAmB,YAAA,EAA6B;AAC5E,EAAA,OAAO,IAAI,cAAc,QAAQ,CAAA;AACnC;;;AC5GA,eAAsB,cAAA,CACpB,QAAA,EACA,GAAA,EACA,OAAA,GAA0E,EAAC,EAChD;AAC3B,EAAA,MAAM,MAAA,GAAS,kBAAkB,QAAQ,CAAA;AACzC,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,QAAQ,CAAA,CAAA,EAAG;AAIxE,EAAA,MAAM,OAAA,GAAU,qBAAqB,MAAA,EAAQ;AAAA,IAC3C,GAAI,QAAQ,OAAA,GAAU,EAAE,SAAS,OAAA,CAAQ,OAAA,KAAY,EAAC;AAAA,IACtD,GAAA,EAAK,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ;AAAA,GAC7B,CAAA;AACD,EAAA,MAAM,KAAA,GAAQ,aAAa,MAAA,EAAQ,OAAA,GAAU,EAAE,OAAA,EAAQ,GAAI,EAAE,CAAA;AAC7D,EAAA,MAAM,GAAA,GAAM,gBAAgB,KAAK,CAAA;AACjC,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,CAAA,SAAA,EAAY,QAAQ,CAAA,2BAAA,CAAA,EAA8B;AAGvF,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,KAAA,CAAM,SAAS,GAAG,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAE;AAE1E,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,UAAU,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,GAAI,CAAA;AAEzD,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA;AAAA,MACA,QAAQ,UAAA,CAAW;AAAA,KACpB,CAAA;AAED,IAAA,YAAA,CAAa,OAAO,CAAA;AAEpB,IAAA,IAAI,QAAA,CAAS,EAAA,EAAI,OAAO,EAAE,IAAI,IAAA,EAAK;AAEnC,IAAA,MAAM,SAAS,QAAA,CAAS,MAAA;AACxB,IAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK;AACpC,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,yCAAA,EAA0C;AAAA,IACvE;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,CAAA,EAAG;AAAA,EAC3D,SAAS,GAAA,EAAU;AACjB,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,wBAAA,EAAyB;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,WAAW,eAAA,EAAgB;AAAA,EAC5D;AACF","file":"chunk-IDUGP4V7.js","sourcesContent":["/**\n * EventNormalizer — converts bridge-level AgentEvent (raw driver events) to\n * skaile-agent-types AgentEvent (normalized, human-readable events).\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call reset() between sessions.\n */\n\nimport {\n  type AgentEvent as NormalizedEvent,\n  type NativeApprovalDescription,\n  stripActivityLabel,\n  TOOL_ACTIVITY_LABEL_MAX_CHARS,\n  TOOL_ACTIVITY_LABEL_PARAM,\n} from \"@skaile/workspaces/types\";\nimport { classifyClaudeSdkError } from \"./error-classifier.js\";\nimport type { AgentMessage, AgentEvent as BridgeEvent, ContentBlock } from \"./types.js\";\n\n/**\n * The optional usage keys a `result` event carries, in the shape both\n * `finished` and a result-sourced `error` emit them. Absent keys stay absent.\n */\nfunction resultUsageFields(\n  event: Pick<\n    Extract<BridgeEvent, { type: \"result\" | \"error\" }>,\n    \"tokens\" | \"modelUsage\" | \"contextTokens\" | \"contextWindow\"\n  >,\n) {\n  return {\n    ...(event.tokens ? { tokens: event.tokens } : {}),\n    ...(event.modelUsage ? { modelUsage: event.modelUsage } : {}),\n    ...(typeof event.contextTokens === \"number\" ? { contextTokens: event.contextTokens } : {}),\n    ...(typeof event.contextWindow === \"number\" ? { contextWindow: event.contextWindow } : {}),\n  };\n}\n\n/**\n * The tool a driver uses to park a turn on a human answer. Both branches that\n * recognise it must use this constant: `message_start` turns it into a\n * `question`, and `tool_call` must then stay silent about it.\n */\nconst QUESTION_TOOL = \"AskUserQuestion\";\n\nconst MAX_ANNOUNCED_TOOL_USES = 64;\n\n/**\n * Bridge `tool_call` inputs are loosely typed: Codex MCP arguments may arrive\n * as a JSON string, and the echo driver passes a bare path.\n */\nfunction toolInputRecord(input: unknown): Record<string, unknown> {\n  let value = input;\n  if (typeof value === \"string\") {\n    try {\n      value = JSON.parse(value);\n    } catch {\n      return { input };\n    }\n  }\n  if (typeof value === \"object\" && value !== null && !Array.isArray(value)) {\n    return value as Record<string, unknown>;\n  }\n  return value === undefined ? {} : { input };\n}\n\n/**\n * Converts raw bridge-level {@link BridgeEvent} payloads into normalized\n * `@skaile/workspaces/types` `AgentEvent` payloads consumed by the runner and transport.\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call {@link EventNormalizer.reset} between sessions to clear accumulated state.\n *\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport class EventNormalizer {\n  private activeSubagents = new Map<string, string>();\n  private devServerStartingEmitted = false;\n  private devServerReadyEmitted = false;\n  /** True when message_update deltas have been emitted for the current message. */\n  private hasStreamedText = false;\n  /**\n   * True once a `_thinkingDelta` run has been reported as `status: thinking`;\n   * cleared by the next text delta or assistant message, so a run reports once.\n   */\n  private thinkingAnnounced = false;\n  /**\n   * tool_use blocks `message_start` already reported, awaiting the driver's\n   * matching bridge `tool_call` — which must then not report the call again.\n   */\n  private announcedToolUses: Array<{ id?: string; name: string }> = [];\n\n  /**\n   * Convert a single bridge event into zero or more normalized events.\n   * One bridge event can produce multiple normalized events (e.g., a message_start\n   * with text + tool_use blocks produces both text and tool_call events).\n   */\n  normalize(event: BridgeEvent): NormalizedEvent[] {\n    switch (event.type) {\n      case \"message_start\":\n        return this.handleMessageStart(event.message);\n\n      case \"message_update\":\n        return this.handleMessageUpdate(event);\n\n      case \"message_end\":\n        return [];\n\n      case \"message_retract\":\n        // The replay streams its reply afresh, so its deltas (or, failing\n        // those, its message_start text) must count as a new message.\n        this.hasStreamedText = false;\n        return event.text ? [{ type: \"text_retract\", content: event.text }] : [];\n\n      case \"turn_end\":\n        return this.handleTurnEnd(event.toolResults);\n\n      case \"result\":\n        return this.handleResult(event);\n\n      case \"error\":\n        this.announcedToolUses = [];\n        return [\n          {\n            type: \"error\",\n            message: event.error,\n            fatal: event.fatal ?? true,\n            category: event.detail?.category,\n            ...(event.detail?.hint ? { hint: event.detail.hint } : {}),\n            ...resultUsageFields(event),\n            ...(event.retrying === true\n              ? { retrying: true, ...(event.retryReason ? { retryReason: event.retryReason } : {}) }\n              : {}),\n          },\n        ];\n\n      case \"tool_call\": {\n        // The question tool parks the turn on the user's answer, so reporting\n        // work here would undo the idle its `question` event just set, and\n        // nothing follows to correct it while the user reads the prompt.\n        const toolName = event.name ?? event.tool?.name;\n        if (toolName === QUESTION_TOOL) return [];\n        // A driver that also sent the call as a `message_start` tool_use block\n        // (Claude) was already reported there; the rest only ever send this.\n        if (!toolName || this.consumeAnnouncedToolUse(toolName, event.toolCallId)) {\n          return [{ type: \"status\", phase: \"working\" }];\n        }\n        return this.handleToolUse(\n          {\n            type: \"tool_use\",\n            id: typeof event.toolCallId === \"string\" ? event.toolCallId : undefined,\n            name: toolName,\n            input: toolInputRecord(event.input),\n          },\n          typeof event.parentToolUseId === \"string\" ? event.parentToolUseId : undefined,\n        );\n      }\n\n      case \"tool_execution_end\":\n        return [];\n\n      case \"agent_end\":\n        this.announcedToolUses = [];\n        return [{ type: \"status\", phase: \"idle\" }];\n\n      case \"commands_available\":\n        // Pass through to transport — the gateway caches this event\n        return [event as unknown as NormalizedEvent];\n\n      case \"session_info\":\n        // Pass through to transport — the forge layer stores the OMP session ID\n        return [event as unknown as NormalizedEvent];\n\n      case \"ui_render\":\n      case \"ui_render_update\":\n      case \"ui_clear\":\n        // Pass through verbatim — drivers that implement the Agent UI Protocol emit these directly\n        return [event as unknown as NormalizedEvent];\n\n      default:\n        return [];\n    }\n  }\n\n  /** Clear all stateful tracking between sessions. */\n  reset(): void {\n    this.activeSubagents.clear();\n    this.devServerStartingEmitted = false;\n    this.devServerReadyEmitted = false;\n    this.hasStreamedText = false;\n    this.thinkingAnnounced = false;\n    this.announcedToolUses = [];\n  }\n\n  private consumeAnnouncedToolUse(name: string, id: unknown): boolean {\n    const callId = typeof id === \"string\" ? id : undefined;\n    const index = this.announcedToolUses.findIndex(\n      (entry) => entry.name === name && (!callId || !entry.id || entry.id === callId),\n    );\n    if (index === -1) return false;\n    this.announcedToolUses.splice(index, 1);\n    return true;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_start → text, tool_call, question, subagent\n  // ---------------------------------------------------------------------------\n\n  private handleMessageStart(message: AgentMessage): NormalizedEvent[] {\n    // Only process assistant messages. Drivers (e.g. omp) may echo the user's\n    // message as a message_start with role:\"user\" before streaming the response.\n    // Emitting a text event for that echo would prepend the user's input to the\n    // assistant bubble on the frontend.\n    if (message.role !== \"assistant\") return [];\n\n    // A subagent's message is not the main reply: its text belongs to the\n    // subagent's own result, and it must not reset the main stream's state.\n    const parentToolUseId = message.parentToolUseId;\n    const events: NormalizedEvent[] = [];\n    const blocks = this.getContentBlocks(message);\n\n    for (const block of blocks) {\n      if (block.type === \"text\" && block.text) {\n        if (parentToolUseId) continue;\n        // Skip full text if we already streamed it via message_update deltas\n        if (!this.hasStreamedText) {\n          events.push({ type: \"text\", content: block.text });\n        }\n      } else if (block.type === \"tool_use\" && block.name) {\n        if (block.name !== QUESTION_TOOL) {\n          this.announcedToolUses.push({ id: block.id, name: block.name });\n          // Bounded in case a driver never echoes a block as a tool_call.\n          if (this.announcedToolUses.length > MAX_ANNOUNCED_TOOL_USES) {\n            this.announcedToolUses.shift();\n          }\n        }\n        events.push(...this.handleToolUse(block, parentToolUseId));\n      }\n    }\n\n    if (!parentToolUseId) this.hasStreamedText = false;\n    if (!parentToolUseId) this.thinkingAnnounced = false;\n    return events;\n  }\n\n  private handleToolUse(block: ContentBlock, parentToolUseId?: string): NormalizedEvent[] {\n    const name = block.name!;\n    const input = (block.input ?? {}) as Record<string, unknown>;\n\n    if (name === QUESTION_TOOL) {\n      return this.handleAskUserQuestion(input);\n    }\n    if (name === \"Agent\") {\n      return this.handleAgentToolUse(block, input);\n    }\n    return this.handleGenericToolUse(name, input, parentToolUseId);\n  }\n\n  private handleAskUserQuestion(input: Record<string, unknown>): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const candidate = input.approval as Partial<NativeApprovalDescription> | undefined;\n    const approval =\n      candidate &&\n      [\"command\", \"file\", \"permissions\", \"mcp\"].includes(candidate.kind ?? \"\") &&\n      Array.isArray(candidate.details) &&\n      candidate.details.length > 0 &&\n      candidate.details.length <= 64 &&\n      candidate.details.every((detail) => typeof detail === \"string\" && detail.length <= 8192) &&\n      candidate.details.reduce((total, detail) => total + detail.length, 0) <= 65536\n        ? (candidate as NativeApprovalDescription)\n        : undefined;\n    if (Object.hasOwn(input, \"approval\") && !approval) return [];\n    // Claude SDK sends { questions: [{ question, header, options: [{ label, description }] }] }\n    // Legacy/simple format sends { question: string, options?: string[] }\n    const questions = input.questions;\n    if (Array.isArray(questions)) {\n      for (const q of questions) {\n        const qObj = q as Record<string, unknown>;\n        const question = String(qObj.question ?? \"\");\n        const rawOpts = qObj.options;\n        const options = Array.isArray(rawOpts)\n          ? rawOpts.map((o: any) => (typeof o === \"string\" ? o : String(o.label ?? o)))\n          : undefined;\n        events.push({\n          type: \"question\",\n          question,\n          options,\n          ...(typeof input.requestId === \"string\" ? { requestId: input.requestId } : {}),\n          ...(approval ? { approval } : {}),\n        });\n      }\n    } else {\n      const question = String(input.question ?? input.text ?? \"\");\n      const rawOptions = input.options;\n      const options = Array.isArray(rawOptions) ? rawOptions.map(String) : undefined;\n      events.push({\n        type: \"question\",\n        question,\n        options,\n        ...(typeof input.requestId === \"string\" ? { requestId: input.requestId } : {}),\n        ...(approval ? { approval } : {}),\n      });\n    }\n    return events;\n  }\n\n  private handleAgentToolUse(\n    block: ContentBlock,\n    input: Record<string, unknown>,\n  ): NormalizedEvent[] {\n    const agentName = String(input.subagent_type ?? input.description ?? \"unknown\");\n    const description = String(input.description ?? input.prompt ?? \"\").slice(0, 200);\n    if (block.id) {\n      this.activeSubagents.set(block.id, agentName);\n    }\n    return [\n      { type: \"subagent\", name: agentName, status: \"started\", description },\n      { type: \"status\", phase: \"working\" },\n    ];\n  }\n\n  private handleGenericToolUse(\n    name: string,\n    input: Record<string, unknown>,\n    parentToolUseId?: string,\n  ): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const label = labelToolCall(name, input);\n    events.push({\n      type: \"tool_call\",\n      tool: name,\n      input,\n      // Summarize without the label: it would eat the default branch's\n      // 100-char argument budget and push the real args out.\n      summary: summarizeToolCall(name, stripActivityLabel(input)),\n      ...(label ? { label } : {}),\n      ...(parentToolUseId ? { parentToolUseId } : {}),\n    });\n    events.push({ type: \"status\", phase: \"working\" });\n\n    if (name === \"Bash\" && typeof input.command === \"string\") {\n      const devEvent = this.detectDevServerStarting(input.command);\n      if (devEvent) events.push(devEvent);\n    }\n\n    return events;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_update → streaming text\n  // ---------------------------------------------------------------------------\n\n  private handleMessageUpdate(event: BridgeEvent): NormalizedEvent[] {\n    // Bridge deltas carry no subagent tag: a driver must drop a subagent's\n    // partials itself (claude-sdk does in handleStreamEvent), or they read as main text.\n    const delta = (event as any)._textDelta as string | undefined;\n    if (delta) {\n      this.hasStreamedText = true;\n      this.thinkingAnnounced = false;\n      return [{ type: \"text\", content: delta }];\n    }\n    // The protocol has no thinking-content event, so reasoning surfaces as the\n    // existing `thinking` phase, once per run. The text is never forwarded as\n    // `text`; a driver keeps it out of `_textDelta`.\n    const thinking: unknown = \"_thinkingDelta\" in event ? event._thinkingDelta : undefined;\n    if (typeof thinking === \"string\" && thinking && !this.thinkingAnnounced) {\n      this.thinkingAnnounced = true;\n      return [{ type: \"status\", phase: \"thinking\" }];\n    }\n    return [];\n  }\n\n  // ---------------------------------------------------------------------------\n  // turn_end → tool_result, subagent finished, file_changed, dev_server\n  // ---------------------------------------------------------------------------\n\n  private handleTurnEnd(toolResults?: AgentMessage[]): NormalizedEvent[] {\n    if (!toolResults?.length) return [];\n\n    const events: NormalizedEvent[] = [];\n\n    for (const result of toolResults) {\n      const toolName = result.toolName ?? \"unknown\";\n      const outputData = result.data ?? result.content;\n      const output = typeof outputData === \"string\" ? outputData : JSON.stringify(outputData);\n\n      // Check if this is a subagent result\n      if (toolName === \"Agent\" || this.isSubagentResult(result)) {\n        events.push(...this.handleSubagentResult(result, output));\n      } else {\n        events.push(...this.handleToolResult(toolName, outputData, output, result.parentToolUseId));\n      }\n    }\n\n    return events;\n  }\n\n  private handleSubagentResult(result: AgentMessage, output: string): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const agentName = this.resolveSubagentName(result);\n    const description = output.slice(0, 200);\n    events.push({ type: \"subagent\", name: agentName, status: \"finished\", description });\n\n    if (agentName === \"dev-server\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private handleToolResult(\n    toolName: string,\n    outputData: unknown,\n    output: string,\n    parentToolUseId?: string,\n  ): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    events.push({\n      type: \"tool_result\",\n      tool: toolName,\n      output: outputData,\n      summary: summarizeToolResult(toolName, outputData),\n      ...(parentToolUseId ? { parentToolUseId } : {}),\n    });\n\n    // Detect file changes from Write/Edit results\n    const fileEvents = detectFileChanges(toolName, outputData);\n    if (fileEvents.length > 0) events.push(...fileEvents);\n\n    // Detect dev server from Bash output\n    if (toolName === \"Bash\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private isSubagentResult(result: AgentMessage): boolean {\n    // Check if the tool result's id maps to a tracked subagent\n    if (result.toolName && this.activeSubagents.has(result.toolName)) return true;\n    return false;\n  }\n\n  private resolveSubagentName(result: AgentMessage): string {\n    // toolName on bridge AgentMessage is resolved from toolIdToName in the driver\n    const name = result.toolName ? this.activeSubagents.get(result.toolName) : undefined;\n    if (name) {\n      this.activeSubagents.delete(result.toolName!);\n      return name;\n    }\n    return result.toolName ?? \"unknown\";\n  }\n\n  // ---------------------------------------------------------------------------\n  // result → finished or error\n  // ---------------------------------------------------------------------------\n\n  private handleResult(event: BridgeEvent & { type: \"result\" }): NormalizedEvent[] {\n    const usage = resultUsageFields(event);\n    if (event.subtype === \"success\") {\n      return [\n        {\n          type: \"finished\",\n          summary: event.summary ?? \"Task completed\",\n          costUsd: event.costUsd ?? 0,\n          ...usage,\n        },\n      ];\n    }\n\n    const errors = event.errors ?? [];\n    // Run the same classifier the claude-sdk driver uses on its `error`\n    // event so the result-error path also surfaces a category and hint\n    // (drivers other than claude-sdk emit `result` without a paired\n    // `error`, so this is the only place they get classified).\n    const detail = classifyClaudeSdkError({ errors, subtype: event.subtype });\n    // The turn billed even though it failed: carry its usage so a ledger\n    // that only writes on `finished` can write here too. Unlike the finished\n    // branch, no `costUsd: 0` fallback — an absent figure stays absent.\n    return [\n      {\n        type: \"error\",\n        message: `Agent stopped: ${event.subtype}${errors.length ? ` — ${errors.join(\"; \")}` : \"\"}`,\n        fatal: event.subtype === \"error_during_execution\",\n        category: detail.category,\n        ...(detail.hint ? { hint: detail.hint } : {}),\n        ...(typeof event.costUsd === \"number\" ? { costUsd: event.costUsd } : {}),\n        ...usage,\n      },\n    ];\n  }\n\n  // ---------------------------------------------------------------------------\n  // Dev server detection\n  // ---------------------------------------------------------------------------\n\n  private detectDevServerStarting(command: string): NormalizedEvent | null {\n    if (this.devServerStartingEmitted) return null;\n    const cmd = command.toLowerCase();\n    const isFrontendStart =\n      (cmd.includes(\"pnpm run dev\") || cmd.includes(\"pnpm dev\") || cmd.includes(\"vite\")) &&\n      (cmd.includes(\"frontend\") || cmd.includes(\"dev:preview\"));\n    if (isFrontendStart) {\n      this.devServerStartingEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"starting\" };\n    }\n    return null;\n  }\n\n  private detectDevServerReady(text: string): NormalizedEvent | null {\n    if (this.devServerReadyEmitted) return null;\n\n    const explicitMatch = text.match(/DEVSERVER_READY:(https?:\\/\\/[^\\s\"\\\\]+)/);\n    if (explicitMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: explicitMatch[1]!, status: \"ready\" };\n    }\n\n    const viteMatch = text.match(/Local:\\s+(https?:\\/\\/localhost:\\d+)/);\n    if (viteMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: viteMatch[1]!, status: \"ready\" };\n    }\n\n    if (text.includes(\"FRONTEND_READY\")) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"ready\" };\n    }\n\n    return null;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Helpers\n  // ---------------------------------------------------------------------------\n\n  private getContentBlocks(message: AgentMessage): ContentBlock[] {\n    if (Array.isArray(message.content)) return message.content;\n    if (typeof message.content === \"string\" && message.content) {\n      return [{ type: \"text\", text: message.content }];\n    }\n    return [];\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Pure helper functions (exported for reuse)\n// ---------------------------------------------------------------------------\n\n/**\n * Produce a human-readable one-line summary of a tool call for the activity log.\n *\n * Returns a string like `$ git status` for Bash, `Read src/index.ts` for Read, etc.\n * Falls back to `ToolName({...input...})` for unrecognised tools.\n *\n * @param tool - Tool name (e.g. `\"Bash\"`, `\"Write\"`, `\"Grep\"`).\n * @param input - Tool input record passed to the call.\n * @returns A short display string suitable for the activity feed.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolCall(tool: string, input: Record<string, unknown>): string {\n  // A driver that sent a bare value instead of named args has it under `input`.\n  const arg = (key: string) => String(input[key] ?? input.input);\n  switch (tool) {\n    case \"Bash\":\n      return `$ ${String(input.command ?? input.input ?? \"\").slice(0, 200)}`;\n    case \"Write\":\n      return `Create ${arg(\"file_path\")}`;\n    case \"Edit\":\n      return `Edit ${arg(\"file_path\")}`;\n    case \"Read\":\n      return `Read ${arg(\"file_path\")}`;\n    case \"Glob\":\n      return `Find ${arg(\"pattern\")}`;\n    case \"Grep\":\n      return `Search for ${arg(\"pattern\")}`;\n    case \"ApplyPatch\": {\n      // Paths only: stringifying the input would serialize every full diff.\n      const changes = Array.isArray(input.changes) ? input.changes : [];\n      const paths = changes\n        .map((change) => (change as { path?: unknown } | null)?.path)\n        .filter((path): path is string => typeof path === \"string\");\n      return `Edit ${paths.join(\", \").slice(0, 200) || \"files\"}`;\n    }\n    default:\n      return `${tool}(${JSON.stringify(input).slice(0, 100)})`;\n  }\n}\n\n/**\n * Produce the plain-language label shown to non-technical users while a tool\n * call runs: the agent's own `activity_label`, Bash's `description`, else a\n * derived phrase for Claude Code built-ins. `undefined` for any other tool —\n * the UI then falls back to a generic \"working\" line rather than raw input.\n *\n * @param tool - Tool name as the model called it.\n * @param input - Tool input record, still carrying `activity_label`.\n * @returns A trimmed label capped at `TOOL_ACTIVITY_LABEL_MAX_CHARS`, or `undefined`.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function labelToolCall(tool: string, input: Record<string, unknown>): string | undefined {\n  const authored =\n    nonEmpty(input[TOOL_ACTIVITY_LABEL_PARAM]) ??\n    (tool === \"Bash\" ? nonEmpty(input.description) : undefined);\n  const label = authored ?? builtinToolLabel(tool, input);\n  if (!label) return undefined;\n  return label.length > TOOL_ACTIVITY_LABEL_MAX_CHARS\n    ? `${label.slice(0, TOOL_ACTIVITY_LABEL_MAX_CHARS - 1).trimEnd()}…`\n    : label;\n}\n\nfunction nonEmpty(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.replace(/\\s+/g, \" \").trim();\n  return trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction builtinToolLabel(tool: string, input: Record<string, unknown>): string | undefined {\n  switch (tool) {\n    case \"Read\":\n      return withTarget(\"Reading\", baseName(input.file_path));\n    case \"Edit\":\n    case \"MultiEdit\":\n    case \"NotebookEdit\":\n      return withTarget(\"Editing\", baseName(input.file_path ?? input.notebook_path));\n    case \"Write\":\n      return withTarget(\"Creating\", baseName(input.file_path));\n    case \"Grep\":\n    case \"Glob\":\n      return \"Searching files\";\n    case \"WebSearch\":\n      return \"Searching the web\";\n    case \"WebFetch\":\n      return withTarget(\"Fetching\", hostOf(input.url), \"a web page\");\n    case \"TodoWrite\":\n      return \"Updating the task list\";\n    case \"ApplyPatch\":\n      return \"Editing files\";\n    default:\n      return undefined;\n  }\n}\n\nfunction withTarget(verb: string, target: string | undefined, fallback = \"a file\"): string {\n  return `${verb} ${target ?? fallback}`;\n}\n\nfunction baseName(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n  return value.split(/[\\\\/]/).filter(Boolean).pop();\n}\n\nfunction hostOf(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  try {\n    return new URL(value).host || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Extract plain text from an Anthropic content-block array (e.g. tool results returned by Claude SDK). */\nfunction extractContentBlockText(blocks: unknown[]): string | null {\n  const textBlocks = blocks.filter(\n    (b): b is { type: \"text\"; text: string } =>\n      typeof b === \"object\" &&\n      b !== null &&\n      (b as Record<string, unknown>).type === \"text\" &&\n      typeof (b as Record<string, unknown>).text === \"string\",\n  );\n  if (textBlocks.length === 0) return null;\n  return textBlocks.map((b) => b.text).join(\"\\n\");\n}\n\n/**\n * Produce a human-readable one-line summary of a tool result for the activity log.\n *\n * Handles Bash stdout/stderr, Write/Edit file paths, ApplyPatch change counts, and\n * Anthropic content-block arrays. Falls back to `JSON.stringify` for unknown shapes.\n *\n * @param tool - Tool name.\n * @param result - Raw tool result payload.\n * @returns A short display string, truncated to 200 characters.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolResult(tool: string, result: unknown): string {\n  // Handle Anthropic content-block arrays: [{ type: \"text\", text: \"...\" }, ...]\n  if (Array.isArray(result)) {\n    const text = extractContentBlockText(result);\n    return (text ?? JSON.stringify(result)).slice(0, 200);\n  }\n  if (typeof result !== \"object\" || !result) {\n    return String(result).slice(0, 200);\n  }\n  const r = result as Record<string, unknown>;\n  switch (tool) {\n    case \"Bash\": {\n      const stderr = String(r.stderr ?? \"\").trim();\n      if (stderr) return `stderr: ${stderr.slice(0, 200)}`;\n      return (\n        String(r.stdout ?? \"\")\n          .trim()\n          .slice(0, 200) || \"(no output)\"\n      );\n    }\n    case \"Write\":\n      return `${String(r.type)}: ${String(r.filePath)}`;\n    case \"Edit\":\n      return `Edited ${String(r.filePath)}`;\n    case \"ApplyPatch\":\n      return `${Array.isArray(r.changes) ? r.changes.length : 0} file changes`;\n    default:\n      return JSON.stringify(result).slice(0, 200);\n  }\n}\n\n/**\n * Detect file-change events from a tool result, returning zero or more `file_changed` events.\n *\n * Handles `Write` (single create/edit), `Edit` (single edit), and `ApplyPatch` (multi-file\n * patch with per-change `kind` classification). Returns an empty array for all other tools.\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns Array of `file_changed` normalized events.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChanges(toolName: string, result: unknown): NormalizedEvent[] {\n  if (typeof result !== \"object\" || !result) return [];\n  const r = result as Record<string, unknown>;\n\n  if (toolName === \"Write\" && r.filePath) {\n    return [\n      {\n        type: \"file_changed\",\n        path: String(r.filePath),\n        action: r.type === \"create\" ? \"create\" : \"edit\",\n      },\n    ];\n  }\n  if (toolName === \"Edit\" && r.filePath) {\n    return [{ type: \"file_changed\", path: String(r.filePath), action: \"edit\" }];\n  }\n  if (toolName === \"ApplyPatch\" && Array.isArray(r.changes)) {\n    return r.changes\n      .filter(\n        (change): change is { path: string; kind: \"add\" | \"delete\" | \"update\" } =>\n          typeof change === \"object\" &&\n          change !== null &&\n          typeof (change as Record<string, unknown>).path === \"string\" &&\n          typeof (change as Record<string, unknown>).kind === \"string\",\n      )\n      .map((change) => ({\n        type: \"file_changed\" as const,\n        path: change.path,\n        action: change.kind === \"add\" ? \"create\" : change.kind === \"delete\" ? \"delete\" : \"edit\",\n      }));\n  }\n\n  return [];\n}\n\n/**\n * Backward-compatible single-event helper; returns the first `file_changed` event or `null`.\n *\n * Prefer {@link detectFileChanges} for multi-file patches (e.g. `ApplyPatch`).\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns First detected `file_changed` event, or `null`.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChange(toolName: string, result: unknown): NormalizedEvent | null {\n  return detectFileChanges(toolName, result)[0] ?? null;\n}\n","/**\n * BridgeRuntime — implements IAgentRuntime from @skaile/workspaces/types by wrapping\n * an AgentDriver + EventNormalizer. This is the primary integration point for\n * consumers that want normalized events from any driver.\n */\n\nimport type {\n  AgentEvent,\n  AgentPromptInput,\n  AgentReconfigureOptions,\n  AgentRuntimeConfig,\n  IAgentRuntime,\n} from \"@skaile/workspaces/types\";\n\nimport { EventNormalizer } from \"./normalizer.js\";\nimport { toMergedRegistry } from \"./provider-registry-derive.js\";\nimport { createDriver } from \"./registry.js\";\nimport type { AgentConfig, AgentDriver } from \"./types.js\";\n\n/**\n * Implements `IAgentRuntime` from `@skaile/workspaces/types` by wrapping an {@link AgentDriver}\n * and an {@link EventNormalizer}.\n *\n * This is the primary integration point for consumers that want normalized `AgentEvent`\n * payloads from any driver without managing the driver lifecycle directly. Create via\n * {@link createRuntime} to avoid coupling to `BridgeRuntime` directly.\n *\n * @docLink packages/bridge/api-reference#runtime\n */\nexport class BridgeRuntime implements IAgentRuntime {\n  private driver: AgentDriver | null = null;\n  private normalizer = new EventNormalizer();\n  private handlers = new Set<(event: AgentEvent) => void>();\n  private boundEventHandler: ((event: any) => void) | null = null;\n  private driverId: string;\n\n  constructor(driverId: string = \"claude-sdk\") {\n    this.driverId = driverId;\n  }\n\n  async start(config: AgentRuntimeConfig): Promise<void> {\n    // Dispose previous driver if any\n    if (this.driver) {\n      await this.dispose();\n    }\n\n    this.normalizer.reset();\n\n    const bridgeConfig: AgentConfig = {\n      cwd: config.cwd,\n      model: config.model,\n      systemPrompt: config.systemPrompt,\n      env: config.env,\n      agentDir: config.agentDir,\n      sessionId: config.sessionId,\n      resumeSessionId: config.resumeSessionId,\n      maxTurns: config.maxTurns,\n      ...(config.registry ? { registry: toMergedRegistry(config.registry, \"runtime\") } : {}),\n      ...(config.modelRef ? { modelRef: config.modelRef } : {}),\n    };\n\n    this.driver = await createDriver(this.driverId, bridgeConfig);\n\n    // Wire bridge events through normalizer to handlers\n    this.boundEventHandler = (bridgeEvent: any) => {\n      const normalized = this.normalizer.normalize(bridgeEvent);\n      for (const event of normalized) {\n        for (const handler of this.handlers) {\n          handler(event);\n        }\n      }\n    };\n    this.driver.on(\"agent-event\", this.boundEventHandler);\n\n    await this.driver.start();\n  }\n\n  async configure(_config: AgentReconfigureOptions): Promise<void> {\n    // Runtime reconfiguration for BridgeRuntime is a no-op for now.\n    // Future: reconnect connectors, reload ai-assets, update subagents.\n  }\n\n  async prompt(message: string): Promise<void> {\n    if (!this.driver) throw new Error(\"Runtime not started — call start() first\");\n    await this.driver.prompt(message);\n  }\n\n  async promptInput(input: AgentPromptInput): Promise<void> {\n    if (!this.driver) throw new Error(\"Runtime not started — call start() first\");\n    await this.driver.promptInput(input);\n  }\n\n  async reply(answer: string, question?: string, requestId?: string): Promise<void> {\n    if (!this.driver) throw new Error(\"Runtime not started — call start() first\");\n    // Mirror serve.ts handleReply: an answer must resume the paused turn. Falling through to\n    // prompt() would deny the question as superseded and drop the structured answer.\n    if (\n      this.driver?.hasPendingQuestion() &&\n      this.driver.answerQuestion(answer, question, requestId)\n    )\n      return;\n    if (this.driver?.acceptsReplyAsPrompt) await this.prompt(answer);\n  }\n\n  async abort(): Promise<void> {\n    if (this.driver) {\n      await this.driver.abort();\n    }\n  }\n\n  async dispose(): Promise<void> {\n    if (this.driver) {\n      if (this.boundEventHandler) {\n        this.driver.off(\"agent-event\", this.boundEventHandler);\n        this.boundEventHandler = null;\n      }\n      this.driver.kill();\n      this.driver = null;\n    }\n    this.normalizer.reset();\n  }\n\n  onEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.add(handler);\n  }\n\n  offEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.delete(handler);\n  }\n\n  get isRunning(): boolean {\n    return this.driver?.isRunning ?? false;\n  }\n}\n\n/**\n * Factory function to create a {@link BridgeRuntime} with the specified driver.\n *\n * @param driverId - Registered driver id (default: `\"claude-sdk\"`).\n * @returns A new `IAgentRuntime` wrapping the selected driver with event normalization.\n * @docLink packages/bridge/api-reference#runtime\n */\nexport function createRuntime(driverId: string = \"claude-sdk\"): IAgentRuntime {\n  return new BridgeRuntime(driverId);\n}\n","/** Provider API key validation — hits each provider's models endpoint to verify the key works. */\n\nimport {\n  buildCredentialHeaders,\n  expandPreset,\n  getProviderPreset,\n  resolvePresetBaseUrl,\n  resolveProbeUrl,\n} from \"./provider-catalog.js\";\n\n/**\n * Result of an API key validation check performed by {@link validateApiKey}.\n *\n * @docLink packages/bridge/api-reference#validation\n */\nexport interface ValidationResult {\n  /** `true` when the API key was accepted by the provider's models endpoint. */\n  ok: boolean;\n  /** Human-readable error description when `ok` is `false`. */\n  error?: string;\n}\n\n/**\n * Validate an API key by sending a lightweight GET request to the provider's models endpoint.\n *\n * Returns `{ ok: true }` when the provider accepts the key (HTTP 2xx). Returns\n * `{ ok: false, error }` on 401/403 (invalid key), other HTTP errors, network failures,\n * or unsupported providers. Requests time out after 8 seconds.\n *\n * @param provider - Catalog preset id (e.g. `\"anthropic\"`, `\"openai\"`, `\"google\"`).\n * @param key - API key to validate.\n * @param options - Optional base-URL / environment overrides; defaults to the\n *   provider's own API, or its `base_url_env` value when one is set.\n * @returns Validation result with optional error description.\n * @docLink packages/bridge/api-reference#validation\n */\nexport async function validateApiKey(\n  provider: string,\n  key: string,\n  options: { baseUrl?: string; env?: Record<string, string | undefined> } = {},\n): Promise<ValidationResult> {\n  const preset = getProviderPreset(provider);\n  if (!preset) return { ok: false, error: `Unknown provider: ${provider}` };\n\n  // Validate against the same endpoint discovery/dispatch use: behind a gateway\n  // the key is the gateway's, and the provider's public API would reject it.\n  const baseUrl = resolvePresetBaseUrl(preset, {\n    ...(options.baseUrl ? { baseUrl: options.baseUrl } : {}),\n    env: options.env ?? process.env,\n  });\n  const entry = expandPreset(preset, baseUrl ? { baseUrl } : {});\n  const url = resolveProbeUrl(entry);\n  if (!url) return { ok: false, error: `Provider ${provider} exposes no models endpoint` };\n  // Static non-secret headers (Anthropic's `anthropic-version`) plus the\n  // credential carrier the preset's `auth_header` names.\n  const headers = { ...entry.headers, ...buildCredentialHeaders(entry, key) };\n\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), 8000);\n\n    const response = await fetch(url, {\n      method: \"GET\",\n      headers,\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeout);\n\n    if (response.ok) return { ok: true };\n\n    const status = response.status;\n    if (status === 401 || status === 403) {\n      return { ok: false, error: \"Invalid API key (authentication failed)\" };\n    }\n    return { ok: false, error: `API returned HTTP ${status}` };\n  } catch (err: any) {\n    if (err.name === \"AbortError\") return { ok: false, error: \"Request timed out (8s)\" };\n    return { ok: false, error: err.message ?? \"Network error\" };\n  }\n}\n"]}

package/dist/{chunk-ANWHAGM7.js → chunk-JAJG4G5E.js}

@@ -1,4 +1,4 @@
-import { withFsDeadline, tryWithFsDeadline, walkDir } from './chunk-YANDJSMN.js';
+import { withFsDeadline, tryWithFsDeadline, walkDir } from './chunk-LFMX2UEF.js';
 import { createLogger } from './chunk-BOFL7GIF.js';
 import { parse } from 'yaml';
 import { readFile, stat } from 'fs/promises';
@@ -329,5 +329,5 @@ function validateFlowVersions(nodes, skillVersions) {
 }
 
 export { buildRequiresPreamble, parseCompactionDirectives, parseSkillFrontmatter, parseSkillRequirements, validateConnectorRequirements, validateFlowVersions, validateRequirements };
-//# sourceMappingURL=chunk-ANWHAGM7.js.map
-//# sourceMappingURL=chunk-ANWHAGM7.js.map
+//# sourceMappingURL=chunk-JAJG4G5E.js.map
+//# sourceMappingURL=chunk-JAJG4G5E.js.map