@skaile/workspaces 5.2.0 → 5.4.0

package/dist/tui/index.js

@@ -1,12 +1,12 @@
-import { createAgentSession } from '../chunk-ZSFTCMZL.js';
-import '../chunk-XIYXBHLN.js';
-import '../chunk-2MEMXBLC.js';
-import '../chunk-FJTC5YFO.js';
+import { createAgentSession } from '../chunk-VETH6MDG.js';
+import '../chunk-DTV7HL5R.js';
+import '../chunk-BHUHGLNS.js';
+import '../chunk-XMQAV6T3.js';
 import '../chunk-R6O6YWU7.js';
-import '../chunk-BJQUSAGB.js';
-import '../chunk-7Y43UXKA.js';
+import '../chunk-GCYD4EGY.js';
+import '../chunk-JELTQ4H7.js';
 import '../chunk-4ZTPYIBE.js';
-import '../chunk-DD3OZLRD.js';
+import '../chunk-OXE5A6H6.js';
 import '../chunk-X5YPJV4N.js';
 import '../chunk-O7SG5PC2.js';
 import '../chunk-7QBNJTTQ.js';
@@ -15,45 +15,45 @@ import '../chunk-5LKOAX7I.js';
 import '../chunk-32NA4TVC.js';
 import '../chunk-W3UDISS2.js';
 import '../chunk-HCYS7GFP.js';
-import '../chunk-IOUIC2ZD.js';
+import '../chunk-SQBPE66C.js';
 import '../chunk-4R6DROGN.js';
-import '../chunk-ANWHAGM7.js';
-import '../chunk-XOTJVCJB.js';
+import '../chunk-JAJG4G5E.js';
+import '../chunk-JKWU6ULI.js';
 import '../chunk-CT6NQSA4.js';
-import '../chunk-MGHUSFYQ.js';
+import '../chunk-ONWTPXVU.js';
 import '../chunk-QMWMSZQ4.js';
-import { loadConnectorDeclarations } from '../chunk-UDBN3LZU.js';
-import '../chunk-OFNXRI4L.js';
-import '../chunk-2QZG5VJQ.js';
+import { loadConnectorDeclarations } from '../chunk-RD6GE4HU.js';
+import '../chunk-IDUGP4V7.js';
+import '../chunk-LAI7X6I2.js';
 import '../chunk-EINLFFP6.js';
 import '../chunk-LOO5CB5M.js';
 import '../chunk-BNUZEYC3.js';
-import '../chunk-BUNBKRJZ.js';
+import '../chunk-LUBS5DXY.js';
 import '../chunk-XBSQ4KMC.js';
 import '../chunk-YROR332M.js';
-import '../chunk-3E2TIPBZ.js';
+import '../chunk-AE42DHSH.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-IFGTRL2I.js';
-import '../chunk-RXPC4KBW.js';
+import '../chunk-UAAAERXI.js';
 import '../chunk-37FTLYFP.js';
 import '../chunk-QZLWJETK.js';
 import '../chunk-XUUYAS3Z.js';
 import '../chunk-NFGRW3L7.js';
 import '../chunk-QCI6D7E4.js';
 import '../chunk-K2K7OF4P.js';
-import { resolveSettings } from '../chunk-BIMEKYOE.js';
+import { resolveSettings } from '../chunk-QEXEHXX5.js';
 import '../chunk-4GY63JU6.js';
-import '../chunk-PU5VY7KF.js';
-import '../chunk-U6K3I3AX.js';
+import '../chunk-JCATNLY3.js';
+import '../chunk-XGIS325V.js';
 import { DEFAULT_DRIVER_ID } from '../chunk-5BEFNLOR.js';
 import '../chunk-A2ULN3KX.js';
-import { resolveAgentDir } from '../chunk-P2EM6FNQ.js';
-import '../chunk-TLKM4M47.js';
+import { resolveAgentDir } from '../chunk-6IGFSUTE.js';
+import '../chunk-MFHKHXDE.js';
 import '../chunk-TOSHZX4C.js';
-import '../chunk-YRF5CYHR.js';
+import '../chunk-SR4RFKHM.js';
 import '../chunk-RVRB27AN.js';
-import '../chunk-YANDJSMN.js';
-import '../chunk-OABIGSUY.js';
+import '../chunk-LFMX2UEF.js';
+import '../chunk-WX74MVNA.js';
 import '../chunk-ICSCSM5D.js';
 import '../chunk-JMKB7IB4.js';
 import '../chunk-MJHSLODD.js';

package/dist/workspace-plugin/adapters/mcp.js

@@ -1,47 +1,47 @@
-export { buildWorkspaceMcpServer, buildWorkspaceMcpStdioServer, buildWorkspaceToolDefs, runMcpServerStdio } from '../../chunk-2MEMXBLC.js';
-import '../../chunk-FJTC5YFO.js';
+export { buildWorkspaceMcpServer, buildWorkspaceMcpStdioServer, buildWorkspaceToolDefs, runMcpServerStdio } from '../../chunk-BHUHGLNS.js';
+import '../../chunk-XMQAV6T3.js';
 import '../../chunk-R6O6YWU7.js';
-import '../../chunk-BJQUSAGB.js';
-import '../../chunk-7Y43UXKA.js';
+import '../../chunk-GCYD4EGY.js';
+import '../../chunk-JELTQ4H7.js';
 import '../../chunk-4ZTPYIBE.js';
-import '../../chunk-DD3OZLRD.js';
+import '../../chunk-OXE5A6H6.js';
 import '../../chunk-X5YPJV4N.js';
-import '../../chunk-ANWHAGM7.js';
-import '../../chunk-XOTJVCJB.js';
-import '../../chunk-MGHUSFYQ.js';
+import '../../chunk-JAJG4G5E.js';
+import '../../chunk-JKWU6ULI.js';
+import '../../chunk-ONWTPXVU.js';
 import '../../chunk-QMWMSZQ4.js';
-import '../../chunk-UDBN3LZU.js';
-import '../../chunk-OFNXRI4L.js';
-import '../../chunk-2QZG5VJQ.js';
+import '../../chunk-RD6GE4HU.js';
+import '../../chunk-IDUGP4V7.js';
+import '../../chunk-LAI7X6I2.js';
 import '../../chunk-EINLFFP6.js';
 import '../../chunk-LOO5CB5M.js';
 import '../../chunk-BNUZEYC3.js';
-import '../../chunk-BUNBKRJZ.js';
+import '../../chunk-LUBS5DXY.js';
 import '../../chunk-XBSQ4KMC.js';
 import '../../chunk-YROR332M.js';
-import '../../chunk-3E2TIPBZ.js';
+import '../../chunk-AE42DHSH.js';
 import '../../chunk-6E6PKKAD.js';
 import '../../chunk-IFGTRL2I.js';
-import '../../chunk-RXPC4KBW.js';
+import '../../chunk-UAAAERXI.js';
 import '../../chunk-37FTLYFP.js';
 import '../../chunk-QZLWJETK.js';
 import '../../chunk-XUUYAS3Z.js';
 import '../../chunk-NFGRW3L7.js';
 import '../../chunk-QCI6D7E4.js';
 import '../../chunk-K2K7OF4P.js';
-import '../../chunk-BIMEKYOE.js';
+import '../../chunk-QEXEHXX5.js';
 import '../../chunk-4GY63JU6.js';
-import '../../chunk-PU5VY7KF.js';
-import '../../chunk-U6K3I3AX.js';
+import '../../chunk-JCATNLY3.js';
+import '../../chunk-XGIS325V.js';
 import '../../chunk-5BEFNLOR.js';
 import '../../chunk-A2ULN3KX.js';
-import '../../chunk-P2EM6FNQ.js';
-import '../../chunk-TLKM4M47.js';
+import '../../chunk-6IGFSUTE.js';
+import '../../chunk-MFHKHXDE.js';
 import '../../chunk-TOSHZX4C.js';
-import '../../chunk-YRF5CYHR.js';
+import '../../chunk-SR4RFKHM.js';
 import '../../chunk-RVRB27AN.js';
-import '../../chunk-YANDJSMN.js';
-import '../../chunk-OABIGSUY.js';
+import '../../chunk-LFMX2UEF.js';
+import '../../chunk-WX74MVNA.js';
 import '../../chunk-ICSCSM5D.js';
 import '../../chunk-JMKB7IB4.js';
 import '../../chunk-MJHSLODD.js';

package/dist/workspace-plugin/adapters/omp.js

@@ -57,7 +57,7 @@ function buildOmpToolSet(plugin) {
       description: "List all mounts declared in skaile.yaml with their mount status.",
       parameters: {},
       handler: async () => {
-        const { mountList } = await import('../../connectors-GUN4MRWR.js');
+        const { mountList } = await import('../../connectors-OB3OAZTK.js');
         return (await mountList(plugin.connectorManager)).content[0].text;
       }
     },
@@ -66,7 +66,7 @@ function buildOmpToolSet(plugin) {
       description: "Sync a mount (pull latest from remote).",
       parameters: { mount_id: { type: "string" } },
       handler: async ({ mount_id }) => {
-        const { mountSync } = await import('../../connectors-GUN4MRWR.js');
+        const { mountSync } = await import('../../connectors-OB3OAZTK.js');
         return (await mountSync(plugin.connectorManager, mount_id)).content[0].text;
       }
     },
@@ -75,7 +75,7 @@ function buildOmpToolSet(plugin) {
       description: "List all available flow definitions from ai-assets.",
       parameters: {},
       handler: async () => {
-        const { flowList } = await import('../../flows-BOB5YA5R.js');
+        const { flowList } = await import('../../flows-DTADYIXH.js');
         return (await flowList(plugin.projectDir)).content[0].text;
       }
     },
@@ -84,7 +84,7 @@ function buildOmpToolSet(plugin) {
       description: "List past flow run sessions for this workspace.",
       parameters: {},
       handler: async () => {
-        const { flowListSessions } = await import('../../flows-BOB5YA5R.js');
+        const { flowListSessions } = await import('../../flows-DTADYIXH.js');
         return (await flowListSessions(plugin.projectDir)).content[0].text;
       }
     },
@@ -93,7 +93,7 @@ function buildOmpToolSet(plugin) {
       description: "List all skills in the ai-assets catalog.",
       parameters: {},
       handler: async () => {
-        const { skillList } = await import('../../skills-CL45F7AG.js');
+        const { skillList } = await import('../../skills-M7OU3WMP.js');
         return (await skillList(plugin.projectDir)).content[0].text;
       }
     },
@@ -102,7 +102,7 @@ function buildOmpToolSet(plugin) {
       description: "Search skills by name, description, or keywords.",
       parameters: { query: { type: "string" } },
       handler: async ({ query }) => {
-        const { skillSearch } = await import('../../skills-CL45F7AG.js');
+        const { skillSearch } = await import('../../skills-M7OU3WMP.js');
         return (await skillSearch(plugin.projectDir, query)).content[0].text;
       }
     },
@@ -111,7 +111,7 @@ function buildOmpToolSet(plugin) {
       description: "Show the full SKILL.md content for a skill.",
       parameters: { skill_id: { type: "string" } },
       handler: async ({ skill_id }) => {
-        const { skillShow } = await import('../../skills-CL45F7AG.js');
+        const { skillShow } = await import('../../skills-M7OU3WMP.js');
         return (await skillShow(plugin.projectDir, skill_id)).content[0].text;
       }
     },
@@ -120,7 +120,7 @@ function buildOmpToolSet(plugin) {
       description: "List connectors declared in skaile.yaml as {connected, failed, notice?}. A host-managed mount in `connected` carries `health` {status: ok|stale|failed, errorClass, checkedAt}; if it is not ok, tell the user and do not write to it. `failed` holds connectors that did not connect this session, with the failure reason \u2014 their mount paths are dead directories, not synced workspaces.",
       parameters: {},
       handler: async () => {
-        const { connectorList } = await import('../../connectors-GUN4MRWR.js');
+        const { connectorList } = await import('../../connectors-OB3OAZTK.js');
         return (await connectorList(plugin.connectorManager)).content[0].text;
       }
     },
@@ -129,7 +129,7 @@ function buildOmpToolSet(plugin) {
       description: "Read content from a connector by path.",
       parameters: { connector_id: { type: "string" }, path: { type: "string" } },
       handler: async ({ connector_id, path }) => {
-        const { connectorRead } = await import('../../connectors-GUN4MRWR.js');
+        const { connectorRead } = await import('../../connectors-OB3OAZTK.js');
         return (await connectorRead(plugin.connectorManager, connector_id, path)).content[0].text;
       }
     },
@@ -146,7 +146,7 @@ function buildOmpToolSet(plugin) {
         operation,
         args
       }) => {
-        const { connectorExec } = await import('../../connectors-GUN4MRWR.js');
+        const { connectorExec } = await import('../../connectors-OB3OAZTK.js');
         return (await connectorExec(plugin.connectorManager, connector_id, operation, args ?? {})).content[0].text;
       }
     },
@@ -202,7 +202,7 @@ async function handleSlashCommand(plugin, group, args) {
   }
 }
 async function handleFlowCommand(plugin, sub, rest) {
-  const { flowList, flowShow, flowListSessions, flowGetSession } = await import('../../flows-BOB5YA5R.js');
+  const { flowList, flowShow, flowListSessions, flowGetSession } = await import('../../flows-DTADYIXH.js');
   if (!sub || sub === "list") return (await flowList(plugin.projectDir)).content[0].text;
   if (sub === "show" && rest[0])
     return (await flowShow(plugin.projectDir, rest[0])).content[0].text;
@@ -212,7 +212,7 @@ async function handleFlowCommand(plugin, sub, rest) {
   return "Usage: /flow list | show <id> | sessions | session <runId>";
 }
 async function handleConnectorCommand(plugin, sub, rest) {
-  const { connectorList, connectorRead, connectorExec, connectorDescribe } = await import('../../connectors-GUN4MRWR.js');
+  const { connectorList, connectorRead, connectorExec, connectorDescribe } = await import('../../connectors-OB3OAZTK.js');
   if (!sub || sub === "list") return (await connectorList(plugin.connectorManager)).content[0].text;
   if (sub === "read" && rest[0] && rest[1])
     return (await connectorRead(plugin.connectorManager, rest[0], rest[1])).content[0].text;
@@ -231,7 +231,7 @@ async function handleConnectorCommand(plugin, sub, rest) {
   return "Usage: /connector list | read <id> <path> | exec <id> <op> [json-args] | describe <id>";
 }
 async function handleSkillCommand(plugin, sub, rest) {
-  const { skillList, skillShow, skillSearch } = await import('../../skills-CL45F7AG.js');
+  const { skillList, skillShow, skillSearch } = await import('../../skills-M7OU3WMP.js');
   if (sub === "run" && rest[0])
     return (await skillShow(plugin.projectDir, rest[0])).content[0].text;
   if (!sub || sub === "list") return (await skillList(plugin.projectDir)).content[0].text;
@@ -242,7 +242,7 @@ async function handleSkillCommand(plugin, sub, rest) {
   return "Usage: /skill list | show <id> | search <query> | run <id>";
 }
 async function handleMountsCommand(plugin, sub, rest) {
-  const { mountList, mountSync, mountStatus } = await import('../../connectors-GUN4MRWR.js');
+  const { mountList, mountSync, mountStatus } = await import('../../connectors-OB3OAZTK.js');
   if (!sub || sub === "list") return (await mountList(plugin.connectorManager)).content[0].text;
   if (sub === "sync" && rest[0])
     return (await mountSync(plugin.connectorManager, rest[0])).content[0].text;

package/dist/workspace-plugin/index.js

@@ -1,4 +1,4 @@
-export { PluginStore, WorkspacePlugin, buildClaudePluginFiles, resolveProjectDir } from '../chunk-XIYXBHLN.js';
+export { PluginStore, WorkspacePlugin, buildClaudePluginFiles, resolveProjectDir } from '../chunk-DTV7HL5R.js';
 export { err, ok, okJson } from '../chunk-X5YPJV4N.js';
 import '../chunk-5BEFNLOR.js';
 import '../chunk-JMKB7IB4.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaile/workspaces",
-  "version": "5.2.0",
+  "version": "5.4.0",
   "description": "Skaile workspaces runtime — types, core, bridge, runner, store, connectors, and supporting layers as one publishable package",
   "type": "module",
   "packageManager": "bun@1.3.9",

package/dist/chunk-4YE7OYTB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;AA+CO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,KAAA,CAC1B,KAAA,EAAM,CACN,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,EAAE,IAAI,CAAC,CAAA,CAC3C,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,MAAM;AAAA,CAAI,CAAA,CACpC,KAAK,EAAE,CAAA;AACV,EAAA,MAAM,eAAA,GAAkB,WAAW,QAAQ,CAAA,CAAE,OAAO,WAAA,EAAa,OAAO,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACtF,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AAAA,IACxC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-4YE7OYTB.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const sortedLines = manifest.files\n    .slice()\n    .sort((a, b) => a.path.localeCompare(b.path))\n    .map((e) => `${e.path}:${e.sha256}\\n`)\n    .join(\"\");\n  const actualComposite = createHash(\"sha256\").update(sortedLines, \"utf-8\").digest(\"hex\");\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n  }\n\n  return { installPath: target };\n}\n"]}