@skaile/workspaces 6.0.0 → 6.2.0

package/dist/chunk-4DWBSTYA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../bridge/src/approval-card.ts","../bridge/src/cloud.ts","../bridge/src/harnesses/scrub-transcript.ts","../bridge/src/harnesses/resume-probe.ts","../bridge/src/agent-transcript.ts"],"names":["join"],"mappings":";;;;;;;;;;;AAUO,IAAM,YAAA,GAAe;AAErB,IAAM,IAAA,GAAO;AAab,SAAS,eAAe,KAAA,EAA6C;AAC1E,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,eAAA,IAAmB,CAAC,KAAA,CAAM,QAAQ,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,OAAO,MAAA;AACpF,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS;AACzC,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,UAAA,IAAc,KAAA,CAAM,SAAS,iBAAA,EAAmB;AACnE,IAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,IAAA,MAAM,WAAW,KAAA,EAAO,QAAA;AACxB,IAAA,MAAM,YAAY,KAAA,EAAO,SAAA;AACzB,IAAA,MAAM,QAAQ,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,GAAK,SAAA,CAAU,CAAC,CAAA,GAA+B,MAAA;AACpF,IAAA,IACE,CAAC,YACD,OAAO,KAAA,EAAO,aAAa,QAAA,IAC3B,CAAC,MAAM,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA,IAC/B,CAAC,SAAS,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAA,KAAM,OAAO,CAAA,KAAM,QAAQ,CAAA,EACpD;AACA,MAAA;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,GAAI,OAAO,KAAA,EAAO,SAAA,KAAc,QAAA,GAAW,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU,GAAI,EAAC;AAAA,MAC7E,MAAM,QAAA,CAAS,IAAA;AAAA,MACf,SAAS,QAAA,CAAS;AAAA,KACpB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;;;ACVA,IAAM,iBAAA,GAAoB,CAAC,mBAAA,EAAqB,sBAAA,EAAwB,oBAAoB,CAAA;AAQrF,IAAM,0BAAA,GAA6B;AAQ1C,IAAM,iBAAA,GAA0C;AAAA,EAC9C,mBAAA,EAAqB,IAAA;AAAA,EACrB,aAAA,EAAe,IAAA;AAAA,EACf,WAAA,EAAa;AACf,CAAA;AAcO,SAAS,mBAAmB,KAAA,EAA4C;AAC7E,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,eAAe,KAAK,CAAA;AACtC,EAAA,IAAI,OAAA,KAAY,yBAAA,IAA6B,SAAA,KAAc,SAAA,EAAW,OAAO,SAAA;AAC7E,EAAA,IAAI,OAAA,KAAY,eAAA,IAAmB,SAAA,KAAc,QAAA,EAAU,OAAO,QAAA;AAClE,EAAA,IAAI,SAAA,KAAc,WAAW,OAAO,SAAA;AACpC,EAAA,OAAO,WAAA;AACT;AA2CO,SAAS,uBAAuB,IAAA,EAAsD;AAC3F,EAAA,MAAM,EAAE,KAAA,EAAO,UAAA,EAAY,OAAA,EAAS,WAAU,GAAI,IAAA;AAClD,EAAA,MAAM,MAA8B,EAAE,GAAG,SAAS,GAAI,SAAA,IAAa,EAAC,EAAG;AAIvE,EAAA,MAAM,UAAU,EAAE,SAAA,EAAW,IAAI,oBAAA,EAAsB,MAAA,EAAQ,IAAI,iBAAA,EAAkB;AAErF,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,IAAA,IAAI,kBAAkB,QAAA,CAAS,GAAG,KAAK,GAAA,CAAI,UAAA,CAAW,kBAAkB,CAAA,EAAG;AACzE,MAAA,OAAO,IAAI,GAAG,CAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,CAAC,GAAA,EAAa,KAAA,KAA8B;AAGtD,IAAA,IAAI,KAAA,EAAO,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,EACxB,CAAA;AAEA,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,UAAA,EAAY,IAAA,IAAQ,MAAA;AACvC,EAAA,MAAM,SAAU,KAAA,CAA6B,MAAA;AAK7C,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,OAAA,IAAW,EAAE,CAAA,CAAE,MAAA;AAAA,IAClD,CAAC,CAAC,IAAI,CAAA,KAAM,CAAC,iBAAA,CAAkB,IAAA,CAAK,aAAa;AAAA,GACnD;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,GAAA,CAAI,wBAAA,GAA2B,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAK,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EAC9F;AAEA,EAAA,QAAQ,kBAAA,CAAmB,KAAK,CAAA;AAAG,IACjC,KAAK,SAAA,EAAW;AACd,MAAA,GAAA,CAAI,uBAAA,GAA0B,GAAA;AAG9B,MAAA,GAAA,CAAI,YAAA,EAAc,QAAQ,MAAM,CAAA;AAChC,MAAA;AAAA,IACF;AAAA,IACA,KAAK,QAAA,EAAU;AACb,MAAA,GAAA,CAAI,sBAAA,GAAyB,GAAA;AAG7B,MAAA,GAAA,CAAI,6BAAA,EAA+B,QAAQ,OAAO,CAAA;AAClD,MAAA,GAAA,CAAI,iBAAA,EAAmB,QAAQ,QAAQ,CAAA;AACvC,MAAA;AAAA,IACF;AAAA,IACA,KAAK,SAAA,EAAW;AACd,MAAA,GAAA,CAAI,uBAAA,GAA0B,GAAA;AAG9B,MAAA,IAAI,KAAA,CAAM,QAAA,EAAU,GAAA,CAAI,4BAAA,EAA8B,MAAM,QAAQ,CAAA;AAAA,WAC/D,GAAA,CAAI,4BAAA,EAA8B,MAAA,EAAQ,QAAQ,CAAA;AACvD,MAAA,GAAA,CAAI,6BAA6B,UAAU,CAAA;AAC3C,MAAA;AAAA,IACF;AAAA,IACA,KAAK,WAAA,EAAa;AAChB,MAAA,MAAM,OAAA,GAAU,yBAAA,CAA0B,mBAAA,CAAoB,KAAK,CAAC,CAAA;AACpE,MAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,WAAA,EAAY,KAAM,0BAAA,EAA4B;AACnE,QAAA,GAAA,CAAI,kBAAA,GAAqB,OAAA;AAAA,MAC3B;AACA,MAAA,IAAI,IAAA,KAAS,QAAA,EAAU,GAAA,CAAI,sBAAA,EAAwB,UAAU,CAAA;AAAA,WAAA,IACpD,IAAA,KAAS,gBAAA,EAAkB,GAAA,CAAI,mBAAA,EAAqB,UAAU,CAAA;AACvE,MAAA,IAAI,CAAC,UAAA,EAAY;AAGf,QAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,GAAA,CAAI,oBAAA,GAAuB,OAAA,CAAQ,SAAA;AAAA,aACrD,GAAA,CAAI,mBAAA,EAAqB,OAAA,CAAQ,MAAM,CAAA;AAAA,MAC9C;AACA,MAAA;AAAA,IACF;AAAA;AAGF,EAAA,OAAO,GAAA;AACT;AC3CA,IAAM,SAAA,GAAY,2CAAA;AAGlB,IAAM,mBAAA,GAAsB,kCAAA;AAO5B,IAAM,eAAA,GAAkB,IAAI,IAAA,GAAO,IAAA;AAa5B,SAAS,oBAAoB,MAAA,EAA+B;AACjE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AAEF,IAAA,GAAA,GAAM,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,EAAG,EAAE,GAAG,QAAQ,CAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AAClB,IAAA,OAAO,IAAA;AAAA,EACT;AAIA,EAAA,IAAI,IAAI,CAAC,CAAA,KAAM,OAAQ,GAAA,CAAI,CAAC,MAAM,GAAA,EAAM;AACtC,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,GAAA,IAAQ,IAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,MAAM,EAAA,EAAM;AAC5E,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,IAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,MAAM,EAAA,EAAM;AAC5E,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,IACE,GAAA,CAAI,MAAA,IAAU,EAAA,IACd,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IACX,GAAA,CAAI,CAAC,MAAM,EAAA,IACX,GAAA,CAAI,CAAC,CAAA,KAAM,MACX,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IACX,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IACX,IAAI,CAAC,CAAA,KAAM,EAAA,IACX,GAAA,CAAI,EAAE,CAAA,KAAM,EAAA,IACZ,GAAA,CAAI,EAAE,MAAM,EAAA,EACZ;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAyBA,SAAS,aAAa,CAAA,EAA0B;AAC9C,EAAA,OAAO,CAAA,CAAE,SAAA,GAAY,CAAA,CAAE,OAAA,GAAU,CAAA,CAAE,aAAA;AACrC;AAkBA,SAAS,UAAA,CAAW,OAAyB,QAAA,EAA2C;AACtF,EAAA,IAAI,MAAM,IAAA,KAAS,aAAA,IAAiB,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA,EAAG;AAChE,IAAA,OAAO;AAAA,MACL,GAAG,KAAA;AAAA,MACH,OAAA,EAAU,MAAM,OAAA,CAA+B,GAAA,CAAI,CAAC,KAAA,KAAU,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAC;AAAA,KAC3F;AAAA,EACF;AAKA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,IAAU,KAAA,CAAM,iBAAiB,IAAA,EAAM;AACxD,IAAA,MAAM,OAAO,OAAO,KAAA,CAAM,IAAA,KAAS,QAAA,GAAW,MAAM,IAAA,GAAO,EAAA;AAC3D,IAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,EAAA,EAAI;AACtB,MAAA,QAAA,CAAS,aAAA,EAAA;AACT,MAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,KAAA,EAAM;AACzB,MAAA,OAAO,KAAA,CAAM,aAAA;AACb,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IACE,KAAA,CAAM,IAAA,KAAS,OAAA,IACf,KAAA,CAAM,MAAA,EAAQ,IAAA,KAAS,QAAA,IACvB,OAAO,KAAA,CAAM,MAAA,CAAO,IAAA,KAAS,QAAA,EAC7B;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA;AAI1B,IAAA,IAAI,KAAK,KAAA,CAAO,IAAA,CAAK,SAAS,CAAA,GAAK,CAAC,IAAI,eAAA,EAAiB;AACvD,MAAA,QAAA,CAAS,OAAA,EAAA;AACT,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,mBAAA,EAAoB;AAAA,IACnD;AACA,IAAA,MAAM,OAAA,GAAU,oBAAoB,IAAI,CAAA;AACxC,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,QAAA,CAAS,OAAA,EAAA;AACT,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IACzC;AACA,IAAA,IAAI,OAAA,KAAY,KAAA,CAAM,MAAA,CAAO,UAAA,EAAY;AACvC,MAAA,QAAA,CAAS,SAAA,EAAA;AACT,MAAA,OAAO,EAAE,GAAG,KAAA,EAAO,MAAA,EAAQ,EAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,EAAE;AAAA,IACtE;AAAA,EACF;AAEA,EAAA,OAAO,KAAA;AACT;AAkBA,eAAsB,oBAAA,CACpB,SAAA,EACA,SAAA,EACA,SAAA,GAAoB,cAAa,EACT;AACxB,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,UAAU,CAAA;AAC9C,EAAA,MAAM,UAAU,MAAM,iBAAA;AAAA,IACpB,WAAW,WAAW,CAAA,CAAA;AAAA,IACtB,MAAM,QAAQ,WAAW,CAAA;AAAA,IACzB,IAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAM,YAAY,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAA,EAAG,SAAS,CAAA,MAAA,CAAQ,CAAA;AAC/D,IAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,MAClB,QAAQ,SAAS,CAAA,CAAA;AAAA,MACjB,YAAA,CAAa,MAAM,IAAA,CAAK,SAAS,GAAG,MAAA,EAAO;AAAA,MAC3C,KAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,OAAO,OAAO,SAAA;AAAA,EACpB;AACA,EAAA,OAAO,IAAA;AACT;AAiBA,gBAAgB,YAAY,MAAA,EAAuD;AACjF,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,IAAA,OAAA,IAAW,KAAA;AACX,IAAA,IAAI,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AAC9B,IAAA,OAAO,QAAQ,EAAA,EAAI;AACjB,MAAA,MAAM,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC1B,MAAA,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC/B,MAAA,GAAA,GAAM,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,IAC5B;AAAA,EACF;AACA,EAAA,MAAM,OAAA;AACR;AAOO,IAAM,oBAAA,GAAwC;AAAA,EACnD,MAAA,EAAQ,CAAC,SAAA,EAAW,SAAA,EAAW,cAC7B,oBAAA,CAAqB,SAAA,EAAW,WAAW,SAAS,CAAA;AAAA,EACtD,OAAO,KAAK,QAAA,EAAU;AACpB,IAAA,MAAM,SAAS,gBAAA,CAAiB,QAAA,EAAU,EAAE,QAAA,EAAU,QAAQ,CAAA;AAC9D,IAAA,IAAI;AACF,MAAA,WAAA,MAAiB,KAAA,IAAS,QAAQ,MAAM,KAAA;AAAA,IAC1C,CAAA,SAAE;AACA,MAAA,MAAA,CAAO,OAAA,EAAQ;AAAA,IACjB;AAAA,EACF,CAAA;AAAA,EACA,MAAM,OAAA,CAAQ,QAAA,EAAU,MAAA,EAAQ;AAC9B,IAAA,MAAM,OAAA,GAAU,GAAG,QAAQ,CAAA,UAAA,CAAA;AAC3B,IAAA,MAAM,QAAA,CAAS,QAAQ,iBAAA,CAAkB,OAAA,EAAS,EAAE,QAAA,EAAU,MAAA,EAAQ,CAAC,CAAA;AACvE,IAAA,MAAM,MAAA,CAAO,SAAS,QAAQ,CAAA;AAAA,EAChC,CAAA;AAAA,EACA,MAAM,YAAY,QAAA,EAAU;AAC1B,IAAA,MAAM,OAAA,GAAU,GAAG,QAAQ,CAAA,UAAA,CAAA;AAC3B,IAAA,MAAM,iBAAA,CAAkB,CAAA,OAAA,EAAU,OAAO,CAAA,CAAA,EAAI,MAAM,OAAO,OAAO,CAAA,EAAG,MAAA,EAAW,YAAA,EAAc,CAAA;AAAA,EAC/F;AACF;AAMA,IAAM,uBAAA,GAA0B;AAAA,EAC9B,aAAA;AAAA,EACA,cAAA;AAAA,EACA,sBAAA;AAAA,EACA,0BAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,QAAQ,KAAA,EAAiC;AAChD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,KAAK,KAAA,IAAS,CAAA;AACzE;AASA,SAAS,aAAA,CAAc,MAAc,SAAA,EAA+C;AAClF,EAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,cAAc,GAAG,OAAO,IAAA;AAC3C,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,KAAK,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAC,CAAA;AAAA,EAC7C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAM,IAAA,KAAS,YAAA,IAAgB,KAAA,CAAM,SAAA,KAAc,WAAW,OAAO,IAAA;AACzE,EAAA,MAAM,QAAQ,KAAA,CAAM,YAAA;AACpB,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,QAAQ,KAAA,CAAM,UAAA;AACpB,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,IAAA;AACxE,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACxC,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,IAAA;AAChD,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,IAAI,CAAC,uBAAA,CAAwB,KAAA,CAAM,CAAC,KAAA,KAAU,OAAA,CAAQ,QAAA,CAAS,KAAK,CAAC,CAAC,CAAA,EAAG,OAAO,IAAA;AAAA,EAClF;AACA,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,KAAA;AAAA,IACd,UAAA,EAAY;AAAA,GACd;AACF;AAYA,SAAS,UAAA,CAAW,MAAc,QAAA,EAAiC;AACjE,EAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,EAAA,EAAI,OAAO,IAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAI,IAAI,IAAA,GAAO,EAAA;AACzC,EAAA,MAAM,OAAO,GAAA,KAAQ,EAAA,GAAK,OAAO,IAAA,CAAK,KAAA,CAAM,GAAG,EAAE,CAAA;AACjD,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,MAAM,OAAA,EAAS,OAAA;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,GAAG,OAAO,IAAA;AACpC,EAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AACpC,EAAA,MAAM,QAAA,GAAY,QAA+B,GAAA,CAAI,CAAC,UAAU,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAC,CAAA;AAC3F,EAAA,IAAI,YAAA,CAAa,QAAQ,CAAA,KAAM,MAAA,EAAQ,OAAO,IAAA;AAC9C,EAAA,OAAO,GAAG,IAAA,CAAK,SAAA,CAAU,EAAE,GAAG,OAAO,OAAA,EAAS,EAAE,GAAG,KAAA,CAAM,SAAS,OAAA,EAAS,QAAA,IAAY,CAAC,GAAG,GAAG,CAAA,CAAA;AAChG;AAqBA,eAAsB,wBACpB,IAAA,EACgC;AAChC,EAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAW,GAAA,EAAI,GAAI,IAAA;AACtC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,oBAAA;AAC5B,EAAA,MAAM,YAAY,YAAA,EAAa;AAC/B,EAAA,MAAM,MAAA,GAAgC;AAAA,IACpC,QAAA,EAAU,IAAA;AAAA,IACV,SAAA,EAAW,CAAA;AAAA,IACX,OAAA,EAAS,CAAA;AAAA,IACT,aAAA,EAAe,CAAA;AAAA,IACf,OAAA,EAAS,KAAA;AAAA,IACT,SAAA,EAAW;AAAA,GACb;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,CAAO,SAAA,EAAW,WAAW,SAAS,CAAA;AAAA,EAC/D,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,EAAK,KAAK,+CAAA,EAAiD;AAAA,MACzD,SAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,GAAA,EAAK,IAAA,CAAK,uCAAA,EAAyC,EAAE,SAAA,EAAW,WAAW,CAAA;AAC3E,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAA,CAAO,QAAA,GAAW,QAAA;AAGlB,EAAA,MAAM,WAA0B,EAAE,SAAA,EAAW,GAAG,OAAA,EAAS,CAAA,EAAG,eAAe,CAAA,EAAE;AAC7E,EAAA,IAAI,SAAA,GAAwC,IAAA;AAC5C,EAAA,IAAI;AACF,IAAA,MAAM,cAAA;AAAA,MACJ,mBAAmB,QAAQ,CAAA,CAAA;AAAA,MAC3B,YAAY;AACV,QAAA,WAAA,MAAiB,QAAQ,WAAA,CAAY,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAC,CAAA,EAAG;AAC1D,UAAA,UAAA,CAAW,MAAM,QAAQ,CAAA;AACzB,UAAA,SAAA,GAAY,aAAA,CAAc,IAAA,EAAM,SAAS,CAAA,IAAK,SAAA;AAAA,QAChD;AAAA,MACF,CAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,EAAK,KAAK,6CAAA,EAA+C;AAAA,MACvD,QAAA;AAAA,MACA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAA,CAAO,YAAY,QAAA,CAAS,SAAA;AAC5B,EAAA,MAAA,CAAO,UAAU,QAAA,CAAS,OAAA;AAC1B,EAAA,MAAA,CAAO,gBAAgB,QAAA,CAAS,aAAA;AAChC,EAAA,MAAA,CAAO,SAAA,GAAY,SAAA;AAEnB,EAAA,IAAI,YAAA,CAAa,QAAQ,CAAA,KAAM,CAAA,EAAG;AAChC,IAAA,OAAO,MAAA;AAAA,EACT;AAKA,EAAA,MAAM,MAAA,GAAS,QAAA;AACf,EAAA,IAAI;AACF,IAAA,MAAM,cAAA;AAAA,MACJ,sBAAsB,MAAM,CAAA,CAAA;AAAA,MAC5B,YAAY;AACV,QAAA,MAAM,UAAyB,EAAE,SAAA,EAAW,GAAG,OAAA,EAAS,CAAA,EAAG,eAAe,CAAA,EAAE;AAC5E,QAAA,MAAM,KAAA,CAAM,OAAA;AAAA,UACV,MAAA;AAAA,UAAA,CACC,mBAAmB;AAClB,YAAA,IAAI,KAAA,GAAQ,IAAA;AACZ,YAAA,WAAA,MAAiB,QAAQ,WAAA,CAAY,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA,EAAG;AACxD,cAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,EAAM,OAAO,CAAA,GAAI;AAAA,EAAK,UAAA,CAAW,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA;AACxE,cAAA,KAAA,GAAQ,KAAA;AAAA,YACV;AAAA,UACF,CAAA;AAAG,SACL;AAAA,MACF,CAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,EAAK,KAAK,gDAAA,EAAkD;AAAA,MAC1D,QAAA;AAAA,MACA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AAGD,IAAA,MAAM,KAAA,CAAM,WAAA,CAAY,MAAM,CAAA,CAAE,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAC9C,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAA,CAAO,OAAA,GAAU,IAAA;AACjB,EAAA,GAAA,EAAK,KAAK,gDAAA,EAAkD;AAAA,IAC1D,QAAA;AAAA,IACA,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,eAAe,MAAA,CAAO;AAAA,GACvB,CAAA;AACD,EAAA,OAAO,MAAA;AACT;ACzkBA,IAAM,uBAAA,GAA0B,GAAA;AAwBzB,SAAS,uBAAuB,GAAA,EAAkD;AACvF,EAAA,OAAO,GAAA,EAAK,qBAAqB,OAAA,CAAQ,GAAA,CAAI,qBAAqBA,IAAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AAC7F;AAgBA,eAAsB,qBAAA,CACpB,WACA,IAAA,EAKyC;AACzC,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,IAAA,EAAM,GAAG,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,uBAAA;AACrC,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,oBAAA;AAC/B,EAAA,IAAI;AAIF,IAAA,MAAM,WAAW,MAAM,cAAA;AAAA,MACrB,gBAAgB,SAAS,CAAA,CAAA;AAAA,MACzB,MAAM,MAAA,CAAO,SAAA,EAAW,SAAS,CAAA;AAAA,MACjC;AAAA,KACF;AACA,IAAA,OAAO,WAAW,kBAAA,GAAqB,YAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AC1EO,SAAS,qBAAqB,IAAA,EAA+B;AAGlE,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA0B;AAE/C,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAY;AAClC,EAAA,MAAM,KAAA,GAAQ,CAAC,QAAA,EAAkB,KAAA,KAAwB;AACvD,IAAA,QAAA,CAAS,GAAA,CAAI,UAAU,KAAK,CAAA;AAC5B,IAAA,KAAA,CAAM,IAAA,CAAK,SAAS,MAAM;AACxB,MAAA,IAAI,SAAS,GAAA,CAAI,QAAQ,MAAM,KAAA,EAAO,QAAA,CAAS,OAAO,QAAQ,CAAA;AAAA,IAChE,CAAC,CAAA;AAAA,EACH,CAAA;AACA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,SAAA,EAAW,SAAA,EAAW,YAAY,GAAA,EAAQ;AAErD,MAAA,IAAI,CAAC,mBAAA,CAAoB,IAAA,CAAK,SAAS,GAAG,OAAO,IAAA;AACjD,MAAA,MAAM,WAAA,GAAcA,IAAAA,CAAK,SAAA,EAAW,UAAU,CAAA;AAG9C,MAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAA;AAAA,QACvB,WAAW,IAAA,EAAM;AAAA,UACf,IAAA;AAAA,UACA,IAAA;AAAA,UACA,uIAAA;AAAA,UAEA,IAAA;AAAA,UACA,WAAA;AAAA,UACA,GAAG,SAAS,CAAA,MAAA;AAAA,SACb,CAAA;AAAA,QACD;AAAA,OACF;AACA,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAEpD,MAAA,IAAI,KAAA,CAAM,QAAA,CAAS,eAAe,CAAA,EAAG,OAAO,IAAA;AAC5C,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,SAAS,CAAC,CAAA;AACxD,MAAA,IAAI,MAAA,KAAW,MAAA;AACb,QAAA,MAAM,IAAI,MAAM,yEAAyE,CAAA;AAE3F,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,GAAG,CAAC,CAAA;AACjD,MAAA,IAAI,OAAO,OAAO,KAAA;AAClB,MAAA,IAAI,MAAA,KAAW,UAAA;AACb,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,OAAO,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,CAAG,CAAA;AACtF,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IAEA,OAAO,KAAK,QAAA,EAAU;AACpB,MAAA,MAAM,QAAQ,UAAA,CAAW,IAAA,EAAM,CAAC,KAAA,EAAO,IAAA,EAAM,QAAQ,CAAC,CAAA;AACtD,MAAA,MAAM,MAAA,GAAS,OAAO,KAAK,CAAA;AAC3B,MAAA,MAAA,CAAO,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACrB,MAAA,MAAM,MAAA,GAAS,MAAM,KAAK,CAAA;AAC1B,MAAA,KAAA,CAAM,MAAA,EAAQ,YAAY,MAAM,CAAA;AAChC,MAAA,WAAA,MAAiB,KAAA,IAAS,KAAA,CAAM,MAAA,EAAiC,MAAM,KAAA;AACvE,MAAA,MAAM,OAAO,MAAM,MAAA;AACnB,MAAA,IAAI,IAAA,KAAS,CAAA;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,QAAQ,CAAA,0BAAA,EAA6B,MAAM,MAAM,CAAA,CAAE,CAAA;AAAA,IAClF,CAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,QAAA,EAAU,MAAA,EAAQ;AAC9B,MAAA,MAAM,KAAA,GAAQ,WAAW,IAAA,EAAM;AAAA,QAC7B,IAAA;AAAA,QACA,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,iCAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AACzB,MAAA,KAAA,CAAM,UAAU,KAAK,CAAA;AACrB,MAAA,MAAM,MAAA,GAAS,OAAO,KAAK,CAAA;AAC3B,MAAA,MAAA,CAAO,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACrB,MAAA,MAAM,MAAA,GAAS,MAAM,KAAK,CAAA;AAC1B,MAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAErD,MAAA,KAAA,CAAM,EAAA,CAAG,SAAS,MAAM;AAAA,MAAC,CAAC,CAAA;AAC1B,MAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAAA,QAClB,MAAM,MAAA;AAAA,QACN,MAAM;AAAA,OACR;AAGA,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,aAAa,CAAA,EAAE;AAC3C,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,IAAI;AACF,QAAA,WAAS;AACP,UAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,CAAK;AAAA,YAC9B,MAAM,IAAA,EAAK;AAAA,YACX,KAAK,IAAA,CAAK,OAAO,EAAE,IAAA,EAAM,MAAc,CAAE;AAAA,WAC1C,CAAA;AACD,UAAA,IAAI,MAAA,IAAU,IAAA,IAAQ,KAAA,CAAM,SAAA,EAAW;AACvC,UAAA,IAAI,KAAK,IAAA,EAAM;AACb,YAAA,OAAA,GAAU,IAAA;AACV,YAAA;AAAA,UACF;AACA,UAAA,IAAI,CAAC,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5B,YAAA,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,IAAI,QAAQ,CAAC,OAAA,KAAY,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS,OAAO,CAAC,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,UACnF;AAAA,QACF;AAAA,MACF,CAAA,SAAE;AACA,QAAA,KAAA,CAAM,GAAA,EAAI;AAGV,QAAA,IAAI,CAAC,OAAA,EAAS,KAAK,MAAM,MAAA,IAAS,EAAG,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MACrD;AACA,MAAA,MAAM,OAAO,MAAM,MAAA;AACnB,MAAA,IAAI,IAAA,KAAS,KAAK,CAAC,OAAA;AACjB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,QAAQ,CAAA,0BAAA,EAA6B,MAAM,MAAM,CAAA,CAAE,CAAA;AAClF,MAAA,IAAI,SAAA,CAAU,IAAI,QAAQ,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,QAAQ,CAAA,cAAA,CAAgB,CAAA;AACnF,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,EAAM,CAAC,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,CAAA,EAAG,QAAQ,CAAA,UAAA,CAAA,EAAc,QAAQ,CAAC,CAAA;AACpF,MAAA,KAAA,CAAM,UAAU,KAAK,CAAA;AACrB,MAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAM,CAAA;AACzC,MAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,QAAQ,CAAA,OAAA,CAAS,CAAA;AAAA,IACnF,CAAA;AAAA,IAEA,MAAM,YAAY,QAAA,EAAU;AAE1B,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AACrC,MAAA,IAAI,WAAW,OAAA,CAAQ,QAAA,KAAa,IAAA,IAAQ,OAAA,CAAQ,eAAe,IAAA,EAAM;AAGvE,QAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAQ,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,OAAO,CAAC,CAAA;AACtE,QAAA,OAAA,CAAQ,KAAK,SAAS,CAAA;AACtB,QAAA,MAAM,eAAe,CAAA,oBAAA,EAAuB,QAAQ,IAAI,MAAM,MAAA,EAAQ,cAAc,CAAA;AAAA,MACtF;AACA,MAAA,MAAM,OAAA,CAAQ,UAAA,CAAW,IAAA,EAAM,CAAC,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,CAAA,EAAG,QAAQ,CAAA,UAAA,CAAY,CAAC,CAAA,EAAG,GAAM,CAAA;AAAA,IACrF;AAAA,GACF;AACF;AAMO,SAAS,yBAAA,CACd,GAAA,GAA0C,OAAA,CAAQ,GAAA,EACjC;AACjB,EAAA,MAAM,IAAA,GAAO,iBAAiB,GAAG,CAAA;AACjC,EAAA,OAAO,IAAA,GAAO,oBAAA,CAAqB,IAAI,CAAA,GAAI,oBAAA;AAC7C;AAEA,SAAS,UAAA,CAAW,MAAc,IAAA,EAA8B;AAC9D,EAAA,OAAO,MAAM,IAAA,EAAM,CAAC,IAAA,EAAM,GAAG,IAAI,CAAA,EAAG;AAAA,IAClC,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK,EAAE,IAAA,EAAM,OAAA,CAAQ,IAAI,IAAA,IAAQ,eAAA,EAAiB,QAAQ,GAAA,EAAI;AAAA,IAC9D,KAAA,EAAO,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM;AAAA,GAC/B,CAAA;AACH;AAEA,SAAS,OAAO,KAAA,EAAsC;AACpD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,KAAA,CAAM,IAAA,CAAK,SAAS,MAAM,CAAA;AAC1B,IAAA,KAAA,CAAM,KAAK,OAAA,EAAS,CAAC,SAAS,OAAA,CAAQ,IAAA,IAAQ,CAAC,CAAC,CAAA;AAAA,EAClD,CAAC,CAAA;AACH;AAGA,SAAS,MAAM,KAAA,EAAsC;AACnD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,KAAA,CAAM,MAAA,EAAQ,YAAY,MAAM,CAAA;AAChC,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAc;AACtC,MAAA,IAAA,GAAA,CAAQ,IAAA,GAAO,CAAA,EAAG,KAAA,CAAM,KAAK,CAAA;AAAA,IAC/B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,KAAK,OAAA,EAAS,MAAM,QAAQ,IAAA,CAAK,IAAA,EAAM,CAAC,CAAA;AAAA,EACxD,CAAC,CAAA;AACH;AAEA,eAAe,OAAA,CACb,OACA,SAAA,EAC2C;AAC3C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,CAAM,MAAA,EAAQ,YAAY,MAAM,CAAA;AAChC,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAc;AACtC,IAAA,MAAA,IAAU,CAAA;AAAA,EACZ,CAAC,CAAA;AACD,EAAA,KAAK,MAAM,KAAK,CAAA;AAChB,EAAA,KAAA,CAAM,OAAO,GAAA,EAAI;AACjB,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,CAAK;AAAA,MAC9B,OAAO,KAAK,CAAA;AAAA,MACZ,IAAI,OAAA,CAAe,CAAC,CAAA,EAAG,MAAA,KAAW;AAChC,QAAA,KAAA,GAAQ,WAAW,MAAM;AACvB,UAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AACpB,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,SAAS,KAAK,CAAC,CAAA;AAAA,QACtE,GAAG,SAAS,CAAA;AAAA,MACd,CAAC;AAAA,KACF,CAAA;AACD,IAAA,OAAO,EAAE,MAAM,MAAA,EAAO;AAAA,EACxB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAAA,EACpB;AACF","file":"chunk-4DWBSTYA.js","sourcesContent":["/**\n * The tool-approval card a harness raises for `permissionMode: \"interactive\"`: a `message_start`\n * carrying an `AskUserQuestion` tool call whose input has an `approval` description. The\n * normalizer turns it into a `question` event with `approval`; a host that reads the harness's\n * events directly (the REPL, a single-shot run) recognises it with {@link approvalCardOf} and\n * answers with {@link APPROVE_ONCE} or {@link DENY} through `harness.answerQuestion`.\n */\nimport type { AgentEvent } from \"./types.js\";\n\n/** The one positive answer of an approval card. */\nexport const APPROVE_ONCE = \"Approve once\";\n/** The negative answer of an approval card. */\nexport const DENY = \"Deny\";\n\n/** What a host needs to ask and answer one approval card. */\nexport interface ApprovalCard {\n  /** The question text; the key `answerQuestion` takes. */\n  question: string;\n  requestId?: string;\n  kind: \"command\" | \"file\" | \"permissions\" | \"mcp\";\n  /** Bounded plain text of what the tool call is about to do. */\n  details: string[];\n}\n\n/** The approval card an event carries, else `undefined`. */\nexport function approvalCardOf(event: AgentEvent): ApprovalCard | undefined {\n  if (event.type !== \"message_start\" || !Array.isArray(event.message.content)) return undefined;\n  for (const block of event.message.content) {\n    if (block.type !== \"tool_use\" || block.name !== \"AskUserQuestion\") continue;\n    const input = block.input as Record<string, unknown> | undefined;\n    const approval = input?.approval as { kind?: unknown; details?: unknown } | undefined;\n    const questions = input?.questions;\n    const first = Array.isArray(questions) ? (questions[0] as { question?: unknown }) : undefined;\n    if (\n      !approval ||\n      typeof first?.question !== \"string\" ||\n      !Array.isArray(approval.details) ||\n      !approval.details.every((d) => typeof d === \"string\")\n    ) {\n      continue;\n    }\n    return {\n      question: first.question,\n      ...(typeof input?.requestId === \"string\" ? { requestId: input.requestId } : {}),\n      kind: approval.kind as ApprovalCard[\"kind\"],\n      details: approval.details as string[],\n    };\n  }\n  return undefined;\n}\n","/**\n * AI endpoint transport for the `claude-sdk` harness — the Claude Agent SDK's\n * child-process environment.\n *\n * {@link buildClaudeEndpointEnv} takes an **AI provider registry entry** and\n * is what the harness calls, on every transport. It is plan §2.3's\n * `buildEndpointEnv` for the claude-sdk row (named for the harness because the\n * vars it emits — `CLAUDE_CODE_USE_*`, `ANTHROPIC_*` — are the Claude Agent\n * SDK's own contract, not a portable one).\n *\n * A registry entry says what the deleted `cloud` axis said — Amazon Bedrock,\n * Google Vertex AI, Azure AI Foundry, a generic gateway — with `surface` +\n * `transport` + `base_url` + `credential`, and says it for the direct\n * endpoint too, which the `cloud` axis could not address at all.\n *\n * Cross-repo contract: env key names and semantics here are load-bearing —\n * the platform resolves credential bundles against the same key set.\n */\n\nimport {\n  type AIProviderEntry,\n  type AIProviderLlmEntry,\n  entryTransport,\n  normalizeAnthropicBaseUrl,\n  resolveEntryBaseUrl,\n} from \"@skaile/workspaces/core/provider-registry\";\n\n/**\n * Env vars scrubbed from the inherited environment before an endpoint env is\n * assembled. Ambient first-party credentials or a stale `CLAUDE_CODE_USE_*`\n * flag must never leak into a session whose entry points elsewhere (the\n * ambient carriers are restored explicitly when the entry has none of its\n * own).\n *\n * Deliberately NOT exhaustive: ambient transport-specific vars (AWS_*,\n * GOOGLE_*, ANTHROPIC_VERTEX_PROJECT_ID, ANTHROPIC_FOUNDRY_*) survive so a\n * standalone CLI inherits its own signing chain; the SDK ignores vars whose\n * transport flag is unset.\n */\nconst SCRUBBED_ENV_KEYS = [\"ANTHROPIC_API_KEY\", \"ANTHROPIC_AUTH_TOKEN\", \"ANTHROPIC_BASE_URL\"];\n\n/**\n * The Anthropic first-party endpoint. An entry that resolves to exactly this\n * host needs no `ANTHROPIC_BASE_URL`: the SDK already points there, and an\n * explicit value would make every default session look like a third-party\n * redirect to Claude Code's own telemetry and auth heuristics.\n */\nexport const ANTHROPIC_DEFAULT_BASE_URL = \"https://api.anthropic.com\";\n\n/**\n * Headers the SDK owns and an entry must not restate through\n * `ANTHROPIC_CUSTOM_HEADERS`: the protocol version it was built against, and\n * the two credential carriers (which are `credential.ref`'s job — a literal\n * secret in `headers` is a validation error anyway).\n */\nconst SDK_OWNED_HEADERS: Record<string, true> = {\n  \"anthropic-version\": true,\n  authorization: true,\n  \"x-api-key\": true,\n};\n\n/**\n * Which of the Claude Agent SDK's four native transports an entry addresses.\n *\n * The SDK has no `transport` field: it switches on a `CLAUDE_CODE_USE_*` flag.\n * Bedrock and Vertex are their own wire surfaces, so they are recognized by\n * `surface` as well as by `transport` — a legacy-derived entry that had no\n * region (and therefore no `params`, and therefore no `transport`) is still a\n * Bedrock session, exactly as it was before the registry existed.\n */\nexport type ClaudeEndpointMode = \"anthropic\" | \"bedrock\" | \"vertex\" | \"foundry\";\n\n/** Classify a registry entry into its {@link ClaudeEndpointMode}. */\nexport function claudeEndpointMode(entry: AIProviderEntry): ClaudeEndpointMode {\n  const surface = (entry as AIProviderLlmEntry).surface;\n  const transport = entryTransport(entry);\n  if (surface === \"bedrock-converse-stream\" || transport === \"bedrock\") return \"bedrock\";\n  if (surface === \"google-vertex\" || transport === \"vertex\") return \"vertex\";\n  if (transport === \"foundry\") return \"foundry\";\n  return \"anthropic\";\n}\n\n/** Arguments for {@link buildClaudeEndpointEnv}. */\nexport interface ClaudeEndpointEnvInput {\n  /** The selected registry entry — the whole endpoint definition. */\n  entry: AIProviderEntry;\n  /**\n   * The entry's credential, already resolved from its `credential.ref`\n   * (`resolveEntryCredential`). Absent for `kind: none`, for an ambient\n   * `sigv4` / `google_adc` / `azure_entra` chain, for `oauth` (whose blob the\n   * runner writes to the Claude credentials file, never to the env), and for a\n   * reference that did not resolve.\n   */\n  credential?: string;\n  /**\n   * The harness's base environment — `process.env` with `undefined` dropped.\n   * The endpoint vars are layered **on top** of it, never instead of it, so\n   * `PATH`, `HOME` and `SKAILE_SESSION_ID` reach the child.\n   */\n  baseEnv: Record<string, string>;\n  /** `AgentConfig.env` plus any credential material the session carried. */\n  configEnv?: Record<string, string>;\n}\n\n/**\n * Assemble the Claude Agent SDK child env for one registry entry (plan §2.3).\n *\n * Pure (no external state read, no input mutated). Starts from `baseEnv`\n * merged with `configEnv`, scrubs the inherited Anthropic credential/routing\n * vars and every `CLAUDE_CODE_USE_*` flag, then writes exactly what the entry\n * describes: at most one transport flag, the endpoint, and the credential in\n * the carrier its `kind` names.\n *\n * Credential kinds (§1.4): `api_key_header` → `ANTHROPIC_API_KEY` (the SDK\n * sends it as `x-api-key`); `bearer` → `ANTHROPIC_AUTH_TOKEN` (sent as\n * `Authorization: Bearer`); `sigv4` / `google_adc` / `azure_entra` emit\n * nothing and let the AWS/Google/Azure chain sign — which is why the scrub\n * deliberately spares ambient `AWS_*` / `GOOGLE_*` values; `oauth` and `none`\n * emit nothing, and the pre-scrub ambient carriers are restored so an OAuth or\n * shell-configured session keeps the auth it had.\n *\n * Never returns `undefined` or empty values; absent settings are omitted.\n */\nexport function buildClaudeEndpointEnv(args: ClaudeEndpointEnvInput): Record<string, string> {\n  const { entry, credential, baseEnv, configEnv } = args;\n  const env: Record<string, string> = { ...baseEnv, ...(configEnv ?? {}) };\n\n  // Captured before the scrub — an entry with no credential material of its\n  // own falls back to these, the way the gateway branch always has.\n  const ambient = { authToken: env.ANTHROPIC_AUTH_TOKEN, apiKey: env.ANTHROPIC_API_KEY };\n\n  for (const key of Object.keys(env)) {\n    if (SCRUBBED_ENV_KEYS.includes(key) || key.startsWith(\"CLAUDE_CODE_USE_\")) {\n      delete env[key];\n    }\n  }\n\n  const set = (key: string, value: string | undefined) => {\n    // Falsy check is deliberate: an empty-string credential/setting is never\n    // valid env — dropping it beats shipping a key the SDK treats as set.\n    if (value) env[key] = value;\n  };\n\n  const kind = entry.credential?.kind ?? \"none\";\n  const params = (entry as AIProviderLlmEntry).params as Record<string, string> | undefined;\n\n  // Static headers ride as ANTHROPIC_CUSTOM_HEADERS (`Name: Value` per line),\n  // the only channel the SDK offers. An entry with none leaves an ambient\n  // value alone.\n  const headers = Object.entries(entry.headers ?? {}).filter(\n    ([name]) => !SDK_OWNED_HEADERS[name.toLowerCase()],\n  );\n  if (headers.length > 0) {\n    env.ANTHROPIC_CUSTOM_HEADERS = headers.map(([name, value]) => `${name}: ${value}`).join(\"\\n\");\n  }\n\n  switch (claudeEndpointMode(entry)) {\n    case \"bedrock\": {\n      env.CLAUDE_CODE_USE_BEDROCK = \"1\";\n      // The AWS credential bundle itself is `configEnv` material (AWS_*), and\n      // ambient AWS_* survived the scrub, so a standalone CLI keeps its own.\n      set(\"AWS_REGION\", params?.region);\n      break;\n    }\n    case \"vertex\": {\n      env.CLAUDE_CODE_USE_VERTEX = \"1\";\n      // GOOGLE_APPLICATION_CREDENTIALS is a path the runner materialized; it\n      // arrives through `configEnv` or ambient, never from `credential`.\n      set(\"ANTHROPIC_VERTEX_PROJECT_ID\", params?.project);\n      set(\"CLOUD_ML_REGION\", params?.location);\n      break;\n    }\n    case \"foundry\": {\n      env.CLAUDE_CODE_USE_FOUNDRY = \"1\";\n      // §1.3: an explicit `base_url` wins over the resource-derived endpoint,\n      // and the SDK has a separate var for each form.\n      if (entry.base_url) set(\"ANTHROPIC_FOUNDRY_BASE_URL\", entry.base_url);\n      else set(\"ANTHROPIC_FOUNDRY_RESOURCE\", params?.resource);\n      set(\"ANTHROPIC_FOUNDRY_API_KEY\", credential);\n      break;\n    }\n    case \"anthropic\": {\n      const baseUrl = normalizeAnthropicBaseUrl(resolveEntryBaseUrl(entry));\n      if (baseUrl && baseUrl.toLowerCase() !== ANTHROPIC_DEFAULT_BASE_URL) {\n        env.ANTHROPIC_BASE_URL = baseUrl;\n      }\n      if (kind === \"bearer\") set(\"ANTHROPIC_AUTH_TOKEN\", credential);\n      else if (kind === \"api_key_header\") set(\"ANTHROPIC_API_KEY\", credential);\n      if (!credential) {\n        // `oauth` / `none` / an unresolved ref: the ambient carriers are the\n        // only auth this session has, and the scrub just removed them.\n        if (ambient.authToken) env.ANTHROPIC_AUTH_TOKEN = ambient.authToken;\n        else set(\"ANTHROPIC_API_KEY\", ambient.apiKey);\n      }\n      break;\n    }\n  }\n\n  return env;\n}\n","/**\n * Poisoned-transcript repair for the Claude Agent SDK harness.\n *\n * The Anthropic Messages API can permanently reject a conversation once its\n * persisted history contains a malformed content block. Because the bad block\n * lives in the SDK's on-disk JSONL transcript, every replayed turn fails with\n * the same `400 invalid_request_error` and the session is bricked with no\n * in-band recovery.\n *\n * This module repairs the transcript in place, covering three known poison\n * classes:\n *\n * 1. **Image `media_type` mismatch / omission.** An image block whose declared\n *    `media_type` does not match — or is missing for — the actual bytes:\n *    `... The image was specified using the image/png media type, but the\n *    image appears to be a image/jpeg image`. Produced by the Claude Code\n *    `Read` tool's format fallback (anthropics/claude-code#55338, #30124,\n *    #33179). Repaired by sniffing the base64 magic bytes and correcting\n *    `media_type`.\n * 2. **Oversized image.** An image whose decoded payload exceeds the API's\n *    5 MB per-image limit (anthropics/claude-code#34566). Replaced with a\n *    text stub — the byte budget cannot be recovered any other way.\n * 3. **`cache_control` on an empty text block.** A text block carrying a\n *    `cache_control` marker with empty/whitespace `text`\n *    (anthropics/claude-code#59626). The `cache_control` field is stripped.\n *\n * Genuinely unidentifiable image blocks are also replaced with a text stub.\n *\n * Recovering by content scan (rather than parsing the API's `messages.N`\n * index) is deliberate: the index addresses the assembled API request, not a\n * JSONL line, and reproducing the SDK's message-assembly is fragile. A full\n * scan is index-free and repairs every poisoned block in one pass.\n *\n * **Async and line-streaming since #454.** A Claude Code transcript is routinely\n * multi-megabyte (base64 images inline in `tool_result` blocks), and this runs on\n * a failed turn *and before every resume* — inside the single-threaded `skaile\n * serve` loop. The previous `readFileSync` + `writeFileSync` + `renameSync` held\n * the loop for the whole file and materialised it twice over as one string. Both\n * passes now stream line by line off a `createReadStream`, so the loop is yielded\n * between lines and peak memory is one JSONL line rather than the whole file, and\n * every I/O phase is deadline-bounded.\n *\n * Streaming was chosen over a worker thread: the work is I/O-bound rather than\n * CPU-bound (per-line `JSON.parse` on a yielded loop is not what stalls a turn),\n * and a worker would add a structured-clone of the same multi-MB payload plus a\n * thread lifecycle to a path that must never block a turn.\n *\n * @module\n */\n\nimport { createReadStream, createWriteStream } from \"node:fs\";\nimport { readdir, rename, stat, unlink } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { pipeline } from \"node:stream/promises\";\nimport { fsDeadlineMs, tryWithFsDeadline, withFsDeadline } from \"@skaile/workspaces/core\";\n\n/**\n * Minimal logger shape accepted by {@link scrubPoisonedTranscript}. Compatible\n * with the bridge `Logger`, but narrowed so the helper stays unit-testable\n * without a real logger instance.\n *\n * @category Transcript repair\n */\nexport interface ScrubLogger {\n  info(message: string, data?: Record<string, unknown>): void;\n  warn(message: string, data?: Record<string, unknown>): void;\n}\n\n/**\n * Options for {@link scrubPoisonedTranscript}.\n *\n * @category Transcript repair\n */\nexport interface ScrubTranscriptOptions {\n  /**\n   * Claude Code config directory — the parent of `projects/`. Resolve from\n   * `CLAUDE_CONFIG_DIR`, falling back to `~/.claude`.\n   */\n  configDir: string;\n  /** SDK session id whose transcript JSONL should be repaired. */\n  sessionId: string;\n  /** Optional logger for diagnostics. */\n  log?: ScrubLogger;\n  /**\n   * Where the transcript is read and written. Defaults to this process's own\n   * filesystem access ({@link localTranscriptStore}); with the agent uid split\n   * the transcript belongs to the agent uid and must be reached through it.\n   */\n  store?: TranscriptStore;\n}\n\n/**\n * Filesystem access to Claude Code transcripts. The CLI creates them 0600 in\n * 0700 dirs, so when it runs as a different uid than the runner, only that uid\n * can locate, read or rewrite them (see `agent-transcript.ts`).\n *\n * @category Transcript repair\n */\nexport interface TranscriptStore {\n  /** Path of `<sessionId>.jsonl` under `<configDir>/projects/`, or `null` when absent. */\n  locate(configDir: string, sessionId: string, timeoutMs?: number): Promise<string | null>;\n  /** The file's contents as UTF-8 chunks. */\n  read(filePath: string): AsyncIterable<string>;\n  /** Atomically replace the file with `chunks` via a `.scrub-tmp` sibling. */\n  replace(filePath: string, chunks: AsyncIterable<string>): Promise<void>;\n  /** Remove the sibling a failed or abandoned {@link replace} left (best effort). */\n  discardTemp(filePath: string): Promise<void>;\n}\n\n/**\n * Outcome of a {@link scrubPoisonedTranscript} pass.\n *\n * @category Transcript repair\n */\nexport interface ScrubTranscriptResult {\n  /** The located JSONL transcript path, or `null` when not found. */\n  filePath: string | null;\n  /** Image blocks whose `media_type` was corrected (or filled in) to match the bytes. */\n  corrected: number;\n  /**\n   * Image blocks replaced with a text stub — either unidentifiable bytes or a\n   * payload over the API's 5 MB per-image limit.\n   */\n  stubbed: number;\n  /** Empty text blocks from which a rejected `cache_control` marker was stripped. */\n  cacheStripped: number;\n  /**\n   * `true` when the transcript was located, contained at least one poisoned\n   * block, and was rewritten. `false` means nothing needed repair (or the\n   * file was not found) — the caller should not retry the resume.\n   */\n  changed: boolean;\n  /**\n   * The last valid `cost-state` entry of this session, read during the same\n   * pass. The CLI restores its run totals from it on `--resume`, so it is the\n   * baseline of the resumed spawn's first `total_cost_usd` and `modelUsage`.\n   * `null` when the transcript holds none (the CLI then starts from zero) or\n   * could not be read.\n   */\n  costState: TranscriptCostState | null;\n}\n\n/**\n * The run totals the Claude Code CLI saves into a transcript as a\n * `{\"type\":\"cost-state\"}` entry and restores on `--resume`.\n *\n * @category Transcript repair\n */\nexport interface TranscriptCostState {\n  /** The CLI's run-cumulative `total_cost_usd` at the time of the save. */\n  totalCostUSD: number;\n  /** The CLI's run-cumulative per-model usage, keyed by model id, in SDK field names. */\n  modelUsage: Record<string, Record<string, number>>;\n}\n\n/** Text inserted in place of an image block whose format cannot be identified. */\nconst STUB_TEXT = \"[image removed: unprocessable image data]\";\n\n/** Text inserted in place of an image block that exceeds the API size limit. */\nconst STUB_TEXT_OVERSIZED = \"[image removed: image too large]\";\n\n/**\n * The Anthropic Messages API rejects any single image whose decoded payload\n * exceeds 5 MB. An image at or under this is left alone; a larger one is\n * stubbed (its byte budget cannot be recovered).\n */\nconst MAX_IMAGE_BYTES = 5 * 1024 * 1024;\n\n/**\n * Identify an image's media type from the leading bytes of its base64 payload.\n *\n * Recognises the four formats the Anthropic API accepts. Returns `null` when\n * the magic bytes match no known format — the caller treats that as a\n * genuinely corrupt block and stubs it.\n *\n * @param base64 - Base64-encoded image data (only the prefix is inspected).\n * @returns An `image/*` media type, or `null` when unrecognised.\n * @category Transcript repair\n */\nexport function sniffImageMediaType(base64: string): string | null {\n  let buf: Buffer;\n  try {\n    // 32 base64 chars decode to 24 bytes — enough for the WebP check at 12.\n    buf = Buffer.from(base64.slice(0, 32), \"base64\");\n  } catch {\n    return null;\n  }\n  if (buf.length < 4) {\n    return null;\n  }\n  // JPEG — SOI marker `FF D8`. Third byte varies (and may be corrupt), so a\n  // two-byte check is intentional: it still matches malformed JPEGs, which is\n  // exactly the poison case the API flags as \"appears to be image/jpeg\".\n  if (buf[0] === 0xff && buf[1] === 0xd8) {\n    return \"image/jpeg\";\n  }\n  // PNG — `89 50 4E 47`.\n  if (buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) {\n    return \"image/png\";\n  }\n  // GIF — `47 49 46 38` (\"GIF8\").\n  if (buf[0] === 0x47 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x38) {\n    return \"image/gif\";\n  }\n  // WebP — `RIFF` at 0..3 and `WEBP` at 8..11.\n  if (\n    buf.length >= 12 &&\n    buf[0] === 0x52 &&\n    buf[1] === 0x49 &&\n    buf[2] === 0x46 &&\n    buf[3] === 0x46 &&\n    buf[8] === 0x57 &&\n    buf[9] === 0x45 &&\n    buf[10] === 0x42 &&\n    buf[11] === 0x50\n  ) {\n    return \"image/webp\";\n  }\n  return null;\n}\n\n/** A base64 image source on a content block (shape is SDK-defined). */\ninterface Base64ImageSource {\n  type?: string;\n  media_type?: string;\n  data?: string;\n}\n\n/** Loosely-typed content block from a transcript message. */\ninterface ContentBlockLike {\n  type?: string;\n  source?: Base64ImageSource;\n  content?: unknown;\n  [k: string]: unknown;\n}\n\n/** Mutable counters threaded through one scrub pass. */\ninterface ScrubCounters {\n  corrected: number;\n  stubbed: number;\n  cacheStripped: number;\n}\n\n/** Total repairs recorded in a counter set — used to detect per-line changes. */\nfunction totalChanges(c: ScrubCounters): number {\n  return c.corrected + c.stubbed + c.cacheStripped;\n}\n\n/**\n * Repair a single content block. Returns the (possibly replaced) block.\n *\n * - A `tool_result` block recurses into its `content` array.\n * - A text block carrying a `cache_control` marker whose `text` is empty or\n *   whitespace has the marker stripped (the API rejects `cache_control` on\n *   empty text blocks).\n * - An image block whose decoded payload exceeds the API's 5 MB limit is\n *   replaced with a text stub.\n * - An image block whose bytes match no known format is replaced with a text\n *   stub (an image cannot simply be dropped — a `tool_result` must keep at\n *   least one content entry, and a bare `image` block is replaced 1:1).\n * - An image block whose declared `media_type` mismatches (or is missing for)\n *   the sniffed type is corrected in place.\n * - Every other block is returned untouched.\n */\nfunction scrubBlock(block: ContentBlockLike, counters: ScrubCounters): ContentBlockLike {\n  if (block.type === \"tool_result\" && Array.isArray(block.content)) {\n    return {\n      ...block,\n      content: (block.content as ContentBlockLike[]).map((inner) => scrubBlock(inner, counters)),\n    };\n  }\n\n  // A `cache_control` marker on a text block whose text is empty or whitespace\n  // is rejected by the API (\"cache_control cannot be set for empty text\n  // blocks\"). Strip the marker — the empty block itself is harmless.\n  if (block.type === \"text\" && block.cache_control != null) {\n    const text = typeof block.text === \"string\" ? block.text : \"\";\n    if (text.trim() === \"\") {\n      counters.cacheStripped++;\n      const clone = { ...block };\n      delete clone.cache_control;\n      return clone;\n    }\n  }\n\n  if (\n    block.type === \"image\" &&\n    block.source?.type === \"base64\" &&\n    typeof block.source.data === \"string\"\n  ) {\n    const data = block.source.data;\n    // The API rejects any image whose decoded payload exceeds 5 MB. The byte\n    // budget cannot be salvaged, so the whole block becomes a text stub.\n    // base64 encodes 3 bytes per 4 chars, so decoded length ≈ len * 3 / 4.\n    if (Math.floor((data.length * 3) / 4) > MAX_IMAGE_BYTES) {\n      counters.stubbed++;\n      return { type: \"text\", text: STUB_TEXT_OVERSIZED };\n    }\n    const sniffed = sniffImageMediaType(data);\n    if (sniffed === null) {\n      counters.stubbed++;\n      return { type: \"text\", text: STUB_TEXT };\n    }\n    if (sniffed !== block.source.media_type) {\n      counters.corrected++;\n      return { ...block, source: { ...block.source, media_type: sniffed } };\n    }\n  }\n\n  return block;\n}\n\n/**\n * Locate the JSONL transcript for `sessionId` under `<configDir>/projects/`.\n *\n * Claude Code encodes the project directory into the `projects/` subfolder\n * name; rather than reproduce that encoding, this scans every subfolder for\n * `<sessionId>.jsonl` (the session id is a UUID — globally unique).\n *\n * Async and deadline-bounded since #454. The `existsSync(projectsDir)` probe is\n * gone: `readdir` already fails on a missing directory, so the probe was a\n * second stat on the same path for no information.\n *\n * `timeoutMs` defaults to {@link fsDeadlineMs} so callers that only need the\n * path (the resume probe) can omit it.\n *\n * @category Transcript repair\n */\nexport async function locateTranscriptPath(\n  configDir: string,\n  sessionId: string,\n  timeoutMs: number = fsDeadlineMs(),\n): Promise<string | null> {\n  const projectsDir = join(configDir, \"projects\");\n  const entries = await tryWithFsDeadline(\n    `readdir ${projectsDir}`,\n    () => readdir(projectsDir),\n    null,\n    timeoutMs,\n  );\n  if (!entries) return null;\n  for (const entry of entries) {\n    const candidate = join(projectsDir, entry, `${sessionId}.jsonl`);\n    const found = await tryWithFsDeadline(\n      `stat ${candidate}`,\n      async () => (await stat(candidate)).isFile(),\n      false,\n      timeoutMs,\n    );\n    if (found) return candidate;\n  }\n  return null;\n}\n\n/**\n * Yield a file's contents line by line, reproducing `readFileSync(...).split(\"\\n\")`\n * exactly — including the final (possibly empty) segment, so a trailing newline\n * survives a rewrite byte for byte.\n *\n * Splits on `\\n` alone, so a line out of a CRLF transcript arrives with its\n * `\\r` still attached. That carrier byte is part of the line here, and\n * {@link repairLine} re-attaches it to a line it rewrites — the file keeps the\n * terminator style it arrived with. Deliberately not `node:readline`:\n * `crlfDelay` strips the `\\r` outright (rewriting a CRLF transcript to LF) and\n * the interface swallows the trailing-newline distinction, either of which\n * would make the \"clean transcript is left byte-for-byte untouched\" guarantee\n * false. Only one line is held in memory at a time, so a multi-MB transcript\n * never materialises as a single string.\n */\nasync function* streamLines(chunks: AsyncIterable<string>): AsyncGenerator<string> {\n  let pending = \"\";\n  for await (const chunk of chunks) {\n    pending += chunk;\n    let idx = pending.indexOf(\"\\n\");\n    while (idx !== -1) {\n      yield pending.slice(0, idx);\n      pending = pending.slice(idx + 1);\n      idx = pending.indexOf(\"\\n\");\n    }\n  }\n  yield pending;\n}\n\n/**\n * The runner's own filesystem access: the default {@link TranscriptStore}.\n *\n * @category Transcript repair\n */\nexport const localTranscriptStore: TranscriptStore = {\n  locate: (configDir, sessionId, timeoutMs) =>\n    locateTranscriptPath(configDir, sessionId, timeoutMs),\n  async *read(filePath) {\n    const stream = createReadStream(filePath, { encoding: \"utf8\" });\n    try {\n      for await (const chunk of stream) yield chunk as string;\n    } finally {\n      stream.destroy();\n    }\n  },\n  async replace(filePath, chunks) {\n    const tmpPath = `${filePath}.scrub-tmp`;\n    await pipeline(chunks, createWriteStream(tmpPath, { encoding: \"utf8\" }));\n    await rename(tmpPath, filePath);\n  },\n  async discardTemp(filePath) {\n    const tmpPath = `${filePath}.scrub-tmp`;\n    await tryWithFsDeadline(`unlink ${tmpPath}`, () => unlink(tmpPath), undefined, fsDeadlineMs());\n  },\n};\n\n/**\n * Per-model counters the CLI's `cost-state` schema requires (checked against\n * `@anthropic-ai/claude-agent-sdk` 0.3.289; `thinkingTokens` is optional there).\n */\nconst COST_STATE_MODEL_FIELDS = [\n  \"inputTokens\",\n  \"outputTokens\",\n  \"cacheReadInputTokens\",\n  \"cacheCreationInputTokens\",\n  \"webSearchRequests\",\n  \"costUSD\",\n] as const;\n\nfunction isCount(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value) && value >= 0;\n}\n\n/**\n * Read a `cost-state` entry of `sessionId` off one JSONL line, or `null` when\n * the line is anything else. Mirrors the CLI, which skips an entry that fails\n * its schema and keeps the last valid one, so an entry with a bad total or a\n * per-model counter that is not a non-negative number is not a restorable\n * state. Leading NUL bytes (a torn append) are stripped, as the CLI does.\n */\nfunction readCostState(line: string, sessionId: string): TranscriptCostState | null {\n  if (!line.includes('\"cost-state\"')) return null;\n  let entry: { type?: unknown; sessionId?: unknown; totalCostUSD?: unknown; modelUsage?: unknown };\n  try {\n    entry = JSON.parse(line.replace(/^\\0+/, \"\"));\n  } catch {\n    return null;\n  }\n  if (entry.type !== \"cost-state\" || entry.sessionId !== sessionId) return null;\n  const total = entry.totalCostUSD;\n  if (!isCount(total)) return null;\n  const usage = entry.modelUsage;\n  if (!usage || typeof usage !== \"object\" || Array.isArray(usage)) return null;\n  for (const model of Object.values(usage)) {\n    if (!model || typeof model !== \"object\") return null;\n    const counters = model as Record<string, unknown>;\n    if (!COST_STATE_MODEL_FIELDS.every((field) => isCount(counters[field]))) return null;\n  }\n  return {\n    totalCostUSD: total,\n    modelUsage: usage as Record<string, Record<string, number>>,\n  };\n}\n\n/**\n * Repair one JSONL line, returning the (possibly rewritten) line and mutating\n * `counters`. A non-JSON, blank, or content-less line is returned untouched.\n *\n * The reader splits on `\\n` only, so a line from a CRLF transcript still carries\n * its trailing `\\r`. An untouched line is returned verbatim and keeps it; a\n * rewritten one is rebuilt by `JSON.stringify`, which would drop it — leaving a\n * repaired CRLF transcript with mixed line endings. So the terminator is split\n * off before the parse and re-appended to the rewritten line.\n */\nfunction repairLine(line: string, counters: ScrubCounters): string {\n  if (line.trim() === \"\") return line;\n  const eol = line.endsWith(\"\\r\") ? \"\\r\" : \"\";\n  const body = eol === \"\" ? line : line.slice(0, -1);\n  let entry: { message?: { content?: unknown } };\n  try {\n    entry = JSON.parse(body);\n  } catch {\n    return line; // Not JSON — leave untouched.\n  }\n  const content = entry.message?.content;\n  if (!Array.isArray(content)) return line;\n  const before = totalChanges(counters);\n  const scrubbed = (content as ContentBlockLike[]).map((block) => scrubBlock(block, counters));\n  if (totalChanges(counters) === before) return line; // Nothing changed on this line.\n  return `${JSON.stringify({ ...entry, message: { ...entry.message, content: scrubbed } })}${eol}`;\n}\n\n/**\n * Scan a Claude Code SDK transcript for image content blocks whose declared\n * `media_type` does not match the actual bytes, repair them, and atomically\n * rewrite the file.\n *\n * Safe to call after a turn has failed: the SDK query is dead at that point,\n * and the next resume re-reads the transcript from disk.\n *\n * **Async since #454.** Two streaming passes rather than one whole-file read:\n * pass 1 counts repairs without writing anything, and pass 2 runs only when\n * pass 1 found something. The common case — the preventive scrub of a clean\n * transcript before every resume — is therefore one streaming read and zero\n * writes, and a clean transcript is still left byte-for-byte untouched.\n *\n * @param opts - Config directory, session id, and an optional logger.\n * @returns A {@link ScrubTranscriptResult}. When `changed` is `true` the\n *   caller may retry the resume with the same session id.\n * @category Transcript repair\n */\nexport async function scrubPoisonedTranscript(\n  opts: ScrubTranscriptOptions,\n): Promise<ScrubTranscriptResult> {\n  const { configDir, sessionId, log } = opts;\n  const store = opts.store ?? localTranscriptStore;\n  const timeoutMs = fsDeadlineMs();\n  const result: ScrubTranscriptResult = {\n    filePath: null,\n    corrected: 0,\n    stubbed: 0,\n    cacheStripped: 0,\n    changed: false,\n    costState: null,\n  };\n\n  let filePath: string | null;\n  try {\n    filePath = await store.locate(configDir, sessionId, timeoutMs);\n  } catch (err) {\n    log?.warn(\"scrub-transcript: failed to locate transcript\", {\n      configDir,\n      sessionId,\n      error: err instanceof Error ? err.message : String(err),\n    });\n    return result;\n  }\n  if (!filePath) {\n    log?.warn(\"scrub-transcript: no transcript found\", { configDir, sessionId });\n    return result;\n  }\n  result.filePath = filePath;\n\n  // ── Pass 1: detect. Streams the transcript, counting repairs, writing nothing.\n  const counters: ScrubCounters = { corrected: 0, stubbed: 0, cacheStripped: 0 };\n  let costState: TranscriptCostState | null = null;\n  try {\n    await withFsDeadline(\n      `scan transcript ${filePath}`,\n      async () => {\n        for await (const line of streamLines(store.read(filePath))) {\n          repairLine(line, counters);\n          costState = readCostState(line, sessionId) ?? costState;\n        }\n      },\n      timeoutMs,\n    );\n  } catch (err) {\n    log?.warn(\"scrub-transcript: failed to read transcript\", {\n      filePath,\n      error: err instanceof Error ? err.message : String(err),\n    });\n    return result;\n  }\n\n  result.corrected = counters.corrected;\n  result.stubbed = counters.stubbed;\n  result.cacheStripped = counters.cacheStripped;\n  result.costState = costState;\n\n  if (totalChanges(counters) === 0) {\n    return result;\n  }\n\n  // ── Pass 2: rewrite. Atomic: stream a sibling temp file, then rename over the\n  // original. Line separators are re-emitted exactly as pass 1 split them, so a\n  // trailing newline and any blank lines survive verbatim.\n  const source = filePath;\n  try {\n    await withFsDeadline(\n      `rewrite transcript ${source}`,\n      async () => {\n        const discard: ScrubCounters = { corrected: 0, stubbed: 0, cacheStripped: 0 };\n        await store.replace(\n          source,\n          (async function* () {\n            let first = true;\n            for await (const line of streamLines(store.read(source))) {\n              yield first ? repairLine(line, discard) : `\\n${repairLine(line, discard)}`;\n              first = false;\n            }\n          })(),\n        );\n      },\n      timeoutMs,\n    );\n  } catch (err) {\n    log?.warn(\"scrub-transcript: failed to rewrite transcript\", {\n      filePath,\n      error: err instanceof Error ? err.message : String(err),\n    });\n    // Never leave a half-written `.scrub-tmp` in the SDK's projects dir, also\n    // when the deadline abandoned the replace mid-write.\n    await store.discardTemp(source).catch(() => {});\n    return result;\n  }\n\n  result.changed = true;\n  log?.info(\"scrub-transcript: repaired poisoned transcript\", {\n    filePath,\n    corrected: result.corrected,\n    stubbed: result.stubbed,\n    cacheStripped: result.cacheStripped,\n  });\n  return result;\n}\n","/**\n * Pre-first-turn resume probe for the Claude Agent SDK harness.\n *\n * A tier-1 native resume only hands its session id to the SDK inside the first\n * real turn, so the `jsonl_lost` outcome (\"No conversation found\") is invisible\n * until a turn is consumed. The runner shares the container filesystem with the\n * SDK, so a cheap `stat` of the on-disk JSONL transcript is an authoritative,\n * side-effect-free signal of whether the resume will find its history — no\n * probe query, no spurious model turn.\n *\n * @module\n */\n\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { withFsDeadline } from \"@skaile/workspaces/core\";\nimport { locateTranscriptPath } from \"./scrub-transcript.js\";\n\n/**\n * Overall wall-clock budget for the probe. Deliberately a small fraction of the\n * platform's `session_init_ack` timeout (`DEFAULT_INIT_ACK_TIMEOUT_MS`, 15s):\n * the probe runs synchronously on the pre-ack path, so a wedged\n * `CLAUDE_CONFIG_DIR` mount must never push the ack past its deadline.\n */\nconst RESUME_PROBE_TIMEOUT_MS = 2_000;\n\n/**\n * Outcome of {@link probeResumeTranscript}: whether the SDK transcript for a\n * requested tier-1 resume exists on disk.\n *\n * @category Resume probe\n */\nexport type ResumeProbeOutcome = \"transcript_found\" | \"jsonl_lost\";\n\n/**\n * Resolve the Claude Code config directory — the parent of `projects/` — from\n * an explicit env map, the process environment, or the `~/.claude` default.\n *\n * The runner's probe and the claude-sdk harness share this one resolver, so they\n * agree as long as they see the same `CLAUDE_CONFIG_DIR`. Today they do:\n * `CLAUDE_CONFIG_DIR` is container-scoped and neither side threads a per-session\n * override through `config.env`, so both fall through to `process.env`. If a\n * future change ever set the harness's `config.env.CLAUDE_CONFIG_DIR` to a\n * divergent path, the reactive `resume_failed { jsonl_lost }` turn remains the\n * safety net.\n *\n * @category Resume probe\n */\nexport function resolveClaudeConfigDir(env?: Record<string, string | undefined>): string {\n  return env?.CLAUDE_CONFIG_DIR || process.env.CLAUDE_CONFIG_DIR || join(homedir(), \".claude\");\n}\n\n/**\n * Probe whether the SDK JSONL transcript for `sessionId` exists on disk.\n *\n * Non-null locator result → `transcript_found`; null → `jsonl_lost`;\n * `undefined` → outcome unknown (the probe exceeded its budget or errored). The\n * caller leaves the ack field ABSENT on `undefined` so the reactive\n * `resume_failed { jsonl_lost }` turn stays the safety net — a timed-out probe\n * must never masquerade as a genuine `jsonl_lost` and force a needless downgrade.\n *\n * `opts.timeoutMs` overrides {@link RESUME_PROBE_TIMEOUT_MS}; `opts.locate`\n * overrides the transcript locator (used by tests / alternate stores).\n *\n * @category Resume probe\n */\nexport async function probeResumeTranscript(\n  sessionId: string,\n  opts?: {\n    env?: Record<string, string | undefined>;\n    timeoutMs?: number;\n    locate?: (configDir: string, sessionId: string) => Promise<string | null>;\n  },\n): Promise<ResumeProbeOutcome | undefined> {\n  const configDir = resolveClaudeConfigDir(opts?.env);\n  const timeoutMs = opts?.timeoutMs ?? RESUME_PROBE_TIMEOUT_MS;\n  const locate = opts?.locate ?? locateTranscriptPath;\n  try {\n    // Bound the whole probe on wall-clock and THROW on expiry: the inner per-op\n    // deadline swallows a timeout into a null path (a false `jsonl_lost`), so a\n    // wedged mount must yield \"unknown\" here rather than a spurious downgrade.\n    const filePath = await withFsDeadline(\n      `resume-probe ${sessionId}`,\n      () => locate(configDir, sessionId),\n      timeoutMs,\n    );\n    return filePath ? \"transcript_found\" : \"jsonl_lost\";\n  } catch {\n    return undefined;\n  }\n}\n","import { type ChildProcess, spawn } from \"node:child_process\";\nimport { join } from \"node:path\";\nimport { fsDeadlineMs, withFsDeadline } from \"@skaile/workspaces/core\";\nimport { resolveAgentExec } from \"./agent-exec.js\";\nimport { localTranscriptStore, type TranscriptStore } from \"./harnesses/scrub-transcript.js\";\n\n/**\n * Transcripts reached through the agent launch shim.\n *\n * With the uid split on, the Claude CLI runs as the agent uid and creates its\n * transcripts 0600 in 0700 dirs, so the runner can no longer list, read or\n * rewrite them itself. This store runs plain tools (`find`, `cat`, `sh`, `mv`)\n * as the agent uid through the shim instead. The child gets only `PATH` and\n * `LC_ALL`, never the runner's environment, and runs in `/` because the\n * runner's own cwd may not be enterable by the agent uid.\n */\nexport function agentTranscriptStore(shim: string): TranscriptStore {\n  // A replace the scrub's deadline abandoned keeps running; discardTemp stops\n  // it before removing its temp file.\n  const inFlight = new Map<string, ChildProcess>();\n  // Paths whose rewrite discardTemp gave up on: their rename must never run.\n  const cancelled = new Set<string>();\n  const track = (filePath: string, child: ChildProcess) => {\n    inFlight.set(filePath, child);\n    child.once(\"close\", () => {\n      if (inFlight.get(filePath) === child) inFlight.delete(filePath);\n    });\n  };\n  return {\n    async locate(configDir, sessionId, timeoutMs = 10_000) {\n      // A session id is a UUID; anything glob- or path-shaped is not ours.\n      if (!/^[A-Za-z0-9._-]+$/.test(sessionId)) return null;\n      const projectsDir = join(configDir, \"projects\");\n      // Markers on stdout, not exit codes, carry the answer: a shim or launcher\n      // failure has exit codes of its own and must never read as \"not found\".\n      const { stdout } = await collect(\n        runAsAgent(shim, [\n          \"sh\",\n          \"-c\",\n          '[ -d \"$1\" ] || { echo \"@@no-projects\"; exit 0; }; ' +\n            'find \"$1\" -mindepth 2 -maxdepth 2 -type f -name \"$2\" -print -quit; echo \"@@find:$?\"',\n          \"sh\",\n          projectsDir,\n          `${sessionId}.jsonl`,\n        ]),\n        timeoutMs,\n      );\n      const lines = stdout.split(\"\\n\").map((l) => l.trim());\n      // A missing projects/ is the same \"not found\" as a failed readdir locally.\n      if (lines.includes(\"@@no-projects\")) return null;\n      const status = lines.find((l) => l.startsWith(\"@@find:\"));\n      if (status === undefined)\n        throw new Error(\"locating a transcript as the agent uid failed (no answer from the shim)\");\n      // A path find printed counts even if it later hit an unreadable sibling.\n      const found = lines.find((l) => l.startsWith(\"/\"));\n      if (found) return found;\n      if (status !== \"@@find:0\")\n        throw new Error(`locating a transcript as the agent uid failed (${status.slice(2)})`);\n      return null;\n    },\n\n    async *read(filePath) {\n      const child = runAsAgent(shim, [\"cat\", \"--\", filePath]);\n      const exited = exitOf(child);\n      exited.catch(() => {}); // awaited below; this only stops an unhandled rejection\n      const stderr = drain(child);\n      child.stdout?.setEncoding(\"utf8\");\n      for await (const chunk of child.stdout as AsyncIterable<string>) yield chunk;\n      const code = await exited;\n      if (code !== 0)\n        throw new Error(`reading ${filePath} as the agent uid failed: ${await stderr}`);\n    },\n\n    async replace(filePath, chunks) {\n      const child = runAsAgent(shim, [\n        \"sh\",\n        \"-c\",\n        // 0600 like the CLI's own files. Only writes the temp file: the rename\n        // is a separate step below, run only after the input was fully sent,\n        // so a killed or starved writer can never commit a partial transcript.\n        'umask 077; cat > \"$1.scrub-tmp\"',\n        \"sh\",\n        filePath,\n      ]);\n      cancelled.delete(filePath);\n      track(filePath, child);\n      const exited = exitOf(child);\n      exited.catch(() => {}); // awaited below; this only stops an unhandled rejection\n      const stderr = drain(child);\n      const stdin = child.stdin;\n      if (!stdin) throw new Error(\"agent shim has no stdin\");\n      // A child that dies early surfaces through its exit code, not an EPIPE crash.\n      stdin.on(\"error\", () => {});\n      const gone = exited.then(\n        () => undefined,\n        () => undefined,\n      );\n      // Stop pulling input as soon as the child is gone (killed by discardTemp,\n      // or failed), instead of waiting on a producer that may never resume.\n      const input = chunks[Symbol.asyncIterator]();\n      let drained = false;\n      try {\n        for (;;) {\n          const next = await Promise.race([\n            input.next(),\n            gone.then(() => ({ dead: true as const })),\n          ]);\n          if (\"dead\" in next || stdin.destroyed) break;\n          if (next.done) {\n            drained = true;\n            break;\n          }\n          if (!stdin.write(next.value)) {\n            await Promise.race([new Promise((resolve) => stdin.once(\"drain\", resolve)), gone]);\n          }\n        }\n      } finally {\n        stdin.end();\n        // Close the producer too, so the reader feeding it (a `cat` through\n        // the shim) is torn down rather than left blocked on a full pipe.\n        if (!drained) void input.return?.()?.catch(() => {});\n      }\n      const code = await exited;\n      if (code !== 0 || !drained)\n        throw new Error(`rewriting ${filePath} as the agent uid failed: ${await stderr}`);\n      if (cancelled.has(filePath)) throw new Error(`rewrite of ${filePath} was abandoned`);\n      const mover = runAsAgent(shim, [\"mv\", \"-f\", \"--\", `${filePath}.scrub-tmp`, filePath]);\n      track(filePath, mover);\n      const moved = await collect(mover, 10_000);\n      if (moved.code !== 0) throw new Error(`renaming the rewritten ${filePath} failed`);\n    },\n\n    async discardTemp(filePath) {\n      // Before anything else, so a writer that is just finishing never renames.\n      cancelled.add(filePath);\n      const pending = inFlight.get(filePath);\n      if (pending && pending.exitCode === null && pending.signalCode === null) {\n        // The writer cannot commit (the rename is a separate step), so this only\n        // stops it; bounded, since a writer stuck on a hung mount may never die.\n        const closed = new Promise((resolve) => pending.once(\"close\", resolve));\n        pending.kill(\"SIGKILL\");\n        await withFsDeadline(`stop the rewrite of ${filePath}`, () => closed, fsDeadlineMs());\n      }\n      await collect(runAsAgent(shim, [\"rm\", \"-f\", \"--\", `${filePath}.scrub-tmp`]), 10_000);\n    },\n  };\n}\n\n/**\n * The transcript store for this runner: through the agent shim when\n * `SKAILE_AGENT_EXEC` is set, the runner's own filesystem otherwise.\n */\nexport function transcriptStoreForRuntime(\n  env: Record<string, string | undefined> = process.env,\n): TranscriptStore {\n  const shim = resolveAgentExec(env);\n  return shim ? agentTranscriptStore(shim) : localTranscriptStore;\n}\n\nfunction runAsAgent(shim: string, argv: string[]): ChildProcess {\n  return spawn(shim, [\"--\", ...argv], {\n    cwd: \"/\",\n    env: { PATH: process.env.PATH ?? \"/usr/bin:/bin\", LC_ALL: \"C\" },\n    stdio: [\"pipe\", \"pipe\", \"pipe\"],\n  });\n}\n\nfunction exitOf(child: ChildProcess): Promise<number> {\n  return new Promise((resolve, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"close\", (code) => resolve(code ?? 1));\n  });\n}\n\n/** Keep the last 1 KiB of stderr for the error message, and keep the pipe drained. */\nfunction drain(child: ChildProcess): Promise<string> {\n  return new Promise((resolve) => {\n    let tail = \"\";\n    child.stderr?.setEncoding(\"utf8\");\n    child.stderr?.on(\"data\", (c: string) => {\n      tail = (tail + c).slice(-1024);\n    });\n    child.stderr?.once(\"close\", () => resolve(tail.trim()));\n  });\n}\n\nasync function collect(\n  child: ChildProcess,\n  timeoutMs: number,\n): Promise<{ code: number; stdout: string }> {\n  let stdout = \"\";\n  child.stdout?.setEncoding(\"utf8\");\n  child.stdout?.on(\"data\", (c: string) => {\n    stdout += c;\n  });\n  void drain(child);\n  child.stdin?.end();\n  let timer: NodeJS.Timeout | undefined;\n  try {\n    const code = await Promise.race([\n      exitOf(child),\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => {\n          child.kill(\"SIGKILL\");\n          reject(new Error(`agent shim did not answer within ${timeoutMs} ms`));\n        }, timeoutMs);\n      }),\n    ]);\n    return { code, stdout };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n"]}

package/dist/chunk-4XWLB7JB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../bridge/src/harness-model-check.ts","../bridge/src/normalizer.ts","../bridge/src/runtime.ts","../bridge/src/validation.ts"],"names":["path"],"mappings":";;;;;;;;;;;;AAmCA,SAAS,gBAAgB,SAAA,EAAoD;AAC3E,EAAA,IAAI,cAAc,OAAA,EAAS,2BAAW,GAAA,CAAI,CAAC,QAAQ,CAAC,CAAA;AACpD,EAAA,IAAI,cAAc,YAAA,EAAc,2BAAW,GAAA,CAAI,CAAC,WAAW,CAAC,CAAA;AAC5D,EAAA,IAAI,SAAA,KAAc,OAAO,OAAO,IAAI,IAAI,MAAA,CAAO,IAAA,CAAK,mBAAmB,CAAC,CAAA;AACxE,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,UAAA,GAAoE;AAC3E,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,mBAAA,IAAuB,IAAA,CAAK,KAAK,EAAA,CAAG,OAAA,EAAQ,EAAG,MAAA,EAAQ,OAAO,CAAA;AACtF,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAY;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,IAAA,CAAK,KAAK,GAAA,EAAK,YAAY,CAAA,EAAG,OAAO,CAAC,CAAA;AAGrE,IAAA,MAAM,QAAQ,GAAA,EAAK,SAAA;AACnB,IAAA,IAAI,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/D,MAAA,KAAA,MAAW,MAAM,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,EAAG,SAAA,CAAU,IAAI,EAAE,CAAA;AAAA,IACvD;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,EAAE,WAAW,QAAA,EAAU,UAAA,CAAW,KAAK,IAAA,CAAK,GAAA,EAAK,UAAU,CAAC,CAAA,EAAE;AACvE;AAYO,SAAS,kBAAA,CACd,WACA,KAAA,EACoB;AACpB,EAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,EAAA,IAAI,QAAA,GAAW,KAAA,CAAM,KAAA,EAAO,IAAA,EAAK,IAAK,EAAA;AACtC,EAAA,IAAI,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA,EAAG,QAAA,GAAW,KAAA,CAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG,MAAK,IAAK,EAAA;AACrF,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAClC,EAAA,IAAI,CAAC,UAAU,KAAA,IAAS,CAAA,IAAK,SAAS,UAAA,CAAW,GAAG,GAAG,OAAO,MAAA;AAC9D,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AACpC,EAAA,IAAI,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA,EAAG,OAAO,MAAA;AAC7B,EAAA,MAAM,UAAU,KAAA,CAAM,QAAA,GAAW,gBAAgB,KAAA,CAAM,QAAQ,IAAI,EAAC;AACpE,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAC,CAAC,EAAE,CAAA,KAAM,EAAA,KAAO,IAAI,CAAA,EAAG,OAAO,MAAA;AAChD,EAAA,MAAM,eAAA,GACJ,SAAA,KAAc,OAAA,IACd,OAAA,CAAQ,IAAA;AAAA,IACN,CAAC,GAAG,KAAK,CAAA,KAAA,CAAO,KAAA,CAAM,IAAA,KAAS,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,OAAA,KAAY,cAAA,CAAe,KAAK;AAAA,GACzF;AACF,EAAA,IAAI,iBAAiB,OAAO,MAAA;AAC5B,EAAA,IAAI,cAAc,KAAA,EAAO;AAGvB,IAAA,MAAM,MAAM,UAAA,EAAW;AACvB,IAAA,IAAI,IAAI,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA,IAAK,GAAA,CAAI,UAAU,OAAO,MAAA;AAAA,EACtD;AACA,EAAA,OAAO,aAAa,IAAI,CAAA,8CAAA,CAAA;AAC1B;AAMO,SAAS,iBAAA,CACd,WACA,KAAA,EACoB;AACpB,EAAA,MAAM,eAAA,GAAkB,kBAAA,CAAmB,SAAA,EAAW,KAAK,CAAA;AAC3D,EAAA,IAAI,iBAAiB,OAAO,eAAA;AAC5B,EAAA,IAAI,cAAc,KAAA,EAAO;AACvB,IAAA,IAAI,QAAA,GAAW,KAAA,CAAM,KAAA,EAAO,IAAA,EAAK,IAAK,EAAA;AACtC,IAAA,IAAI,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA,EAAG,QAAA,GAAW,KAAA,CAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG,MAAK,IAAK,EAAA;AACrF,IAAA,OAAO,uBAAA,CAAwB,MAAM,QAAA,EAAU,QAAA,EAAU,gBAAgB,KAAK,CAAA,oBAAK,IAAI,GAAA,EAAK,CAAA;AAAA,EAC9F;AACA,EAAA,IAAI,SAAA,KAAc,SAAS,OAAO,MAAA;AAClC,EAAA,MAAM,QAAQ,wBAAA,CAAyB;AAAA,IACrC,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,GAAI,KAAA,CAAM,KAAA,GAAQ,EAAE,QAAA,EAAU,KAAA,CAAM,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,GAAI,EAAC;AAAA,IACnE,GAAI,MAAM,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,KAAA,KAAU;AAAC,GAC7C,CAAA;AACD,EAAA,IAAI,CAAC,KAAA,CAAM,aAAA,EAAe,OAAO,MAAA;AACjC,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAO,GAAI,KAAA,CAAM,aAAA;AAC7B,EAAA,OAAO,CAAA,aAAA,EAAgB,EAAE,CAAA,yCAAA,EAA4C,MAAM,CAAA,mCAAA,CAAA;AAC7E;;;ACxGA,SAAS,kBACP,KAAA,EAIA;AACA,EAAA,OAAO;AAAA,IACL,GAAI,MAAM,MAAA,GAAS,EAAE,QAAQ,KAAA,CAAM,MAAA,KAAW,EAAC;AAAA,IAC/C,GAAI,MAAM,UAAA,GAAa,EAAE,YAAY,KAAA,CAAM,UAAA,KAAe,EAAC;AAAA,IAC3D,GAAI,OAAO,KAAA,CAAM,aAAA,KAAkB,QAAA,GAAW,EAAE,aAAA,EAAe,KAAA,CAAM,aAAA,EAAc,GAAI,EAAC;AAAA,IACxF,GAAI,OAAO,KAAA,CAAM,aAAA,KAAkB,QAAA,GAAW,EAAE,aAAA,EAAe,KAAA,CAAM,aAAA,EAAc,GAAI;AAAC,GAC1F;AACF;AAOA,IAAM,aAAA,GAAgB,iBAAA;AAEtB,IAAM,uBAAA,GAA0B,EAAA;AAMhC,SAAS,gBAAgB,KAAA,EAAyC;AAChE,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,KAAA,EAAM;AAAA,IACjB;AAAA,EACF;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA,KAAU,MAAA,GAAY,EAAC,GAAI,EAAE,KAAA,EAAM;AAC5C;AAWO,IAAM,kBAAN,MAAsB;AAAA,EACnB,eAAA,uBAAsB,GAAA,EAAoB;AAAA,EAC1C,wBAAA,GAA2B,KAAA;AAAA,EAC3B,qBAAA,GAAwB,KAAA;AAAA;AAAA,EAExB,eAAA,GAAkB,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlB,iBAAA,GAAoB,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpB,oBAA0D,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnE,UAAU,KAAA,EAAuC;AAC/C,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,eAAA;AACH,QAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,CAAM,OAAO,CAAA;AAAA,MAE9C,KAAK,gBAAA;AACH,QAAA,OAAO,IAAA,CAAK,oBAAoB,KAAK,CAAA;AAAA,MAEvC,KAAK,aAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,iBAAA;AAGH,QAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,QAAA,OAAO,KAAA,CAAM,IAAA,GAAO,CAAC,EAAE,IAAA,EAAM,cAAA,EAAgB,OAAA,EAAS,KAAA,CAAM,IAAA,EAAM,CAAA,GAAI,EAAC;AAAA,MAEzE,KAAK,UAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,KAAA,CAAM,WAAW,CAAA;AAAA,MAE7C,KAAK,QAAA;AACH,QAAA,OAAO,IAAA,CAAK,aAAa,KAAK,CAAA;AAAA,MAEhC,KAAK,OAAA;AACH,QAAA,IAAA,CAAK,oBAAoB,EAAC;AAC1B,QAAA,OAAO;AAAA,UACL;AAAA,YACE,IAAA,EAAM,OAAA;AAAA,YACN,SAAS,KAAA,CAAM,KAAA;AAAA,YACf,KAAA,EAAO,MAAM,KAAA,IAAS,IAAA;AAAA,YACtB,QAAA,EAAU,MAAM,MAAA,EAAQ,QAAA;AAAA,YACxB,GAAI,KAAA,CAAM,MAAA,EAAQ,IAAA,GAAO,EAAE,MAAM,KAAA,CAAM,MAAA,CAAO,IAAA,EAAK,GAAI,EAAC;AAAA,YACxD,GAAG,kBAAkB,KAAK,CAAA;AAAA,YAC1B,GAAI,KAAA,CAAM,QAAA,KAAa,OACnB,EAAE,QAAA,EAAU,MAAM,GAAI,KAAA,CAAM,WAAA,GAAc,EAAE,aAAa,KAAA,CAAM,WAAA,KAAgB,EAAC,KAChF,EAAC;AAAA,YACL,GAAI,MAAM,WAAA,KAAgB,IAAA,GAAO,EAAE,WAAA,EAAa,IAAA,KAAkB;AAAC;AACrE,SACF;AAAA,MAEF,KAAK,yBAAA;AACH,QAAA,OAAO,CAAC,EAAE,IAAA,EAAM,2BAA2B,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAAA,MAEnE,KAAK,mBAAA;AACH,QAAA,OAAO,CAAC,EAAE,IAAA,EAAM,mBAAA,EAAqB,OAAA,EAAS,CAAC,GAAG,KAAA,CAAM,OAAO,CAAA,EAAG,CAAA;AAAA,MAEpE,KAAK,WAAA,EAAa;AAIhB,QAAA,MAAM,QAAA,GAAW,KAAA,CAAM,IAAA,IAAQ,KAAA,CAAM,IAAA,EAAM,IAAA;AAC3C,QAAA,IAAI,QAAA,KAAa,aAAA,EAAe,OAAO,EAAC;AAGxC,QAAA,IAAI,CAAC,QAAA,IAAY,IAAA,CAAK,wBAAwB,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,EAAG;AACzE,UAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAAA,QAC9C;AACA,QAAA,OAAO,IAAA,CAAK,aAAA;AAAA,UACV;AAAA,YACE,IAAA,EAAM,UAAA;AAAA,YACN,IAAI,OAAO,KAAA,CAAM,UAAA,KAAe,QAAA,GAAW,MAAM,UAAA,GAAa,MAAA;AAAA,YAC9D,IAAA,EAAM,QAAA;AAAA,YACN,KAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,KAAK;AAAA,WACpC;AAAA,UACA,OAAO,KAAA,CAAM,eAAA,KAAoB,QAAA,GAAW,MAAM,eAAA,GAAkB;AAAA,SACtE;AAAA,MACF;AAAA,MAEA,KAAK,oBAAA;AACH,QAAA,OAAO,EAAC;AAAA,MAEV,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,oBAAoB,EAAC;AAC1B,QAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,QAAQ,CAAA;AAAA,MAE3C,KAAK,oBAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,cAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C,KAAK,WAAA;AAAA,MACL,KAAK,kBAAA;AAAA,MACL,KAAK,UAAA;AAEH,QAAA,OAAO,CAAC,KAAmC,CAAA;AAAA,MAE7C;AACE,QAAA,OAAO,EAAC;AAAA;AACZ,EACF;AAAA;AAAA,EAGA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,gBAAgB,KAAA,EAAM;AAC3B,IAAA,IAAA,CAAK,wBAAA,GAA2B,KAAA;AAChC,IAAA,IAAA,CAAK,qBAAA,GAAwB,KAAA;AAC7B,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AACzB,IAAA,IAAA,CAAK,oBAAoB,EAAC;AAAA,EAC5B;AAAA,EAEQ,uBAAA,CAAwB,MAAc,EAAA,EAAsB;AAClE,IAAA,MAAM,MAAA,GAAS,OAAO,EAAA,KAAO,QAAA,GAAW,EAAA,GAAK,MAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,KAAK,iBAAA,CAAkB,SAAA;AAAA,MACnC,CAAC,KAAA,KAAU,KAAA,CAAM,IAAA,KAAS,IAAA,KAAS,CAAC,MAAA,IAAU,CAAC,KAAA,CAAM,EAAA,IAAM,KAAA,CAAM,EAAA,KAAO,MAAA;AAAA,KAC1E;AACA,IAAA,IAAI,KAAA,KAAU,IAAI,OAAO,KAAA;AACzB,IAAA,IAAA,CAAK,iBAAA,CAAkB,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACtC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmB,OAAA,EAA0C;AAKnE,IAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa,OAAO,EAAC;AAI1C,IAAA,MAAM,kBAAkB,OAAA,CAAQ,eAAA;AAChC,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,gBAAA,CAAiB,OAAO,CAAA;AAE5C,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,IAAU,KAAA,CAAM,IAAA,EAAM;AACvC,QAAA,IAAI,eAAA,EAAiB;AAErB,QAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,UAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAQ,OAAA,EAAS,KAAA,CAAM,MAAM,CAAA;AAAA,QACnD;AAAA,MACF,CAAA,MAAA,IAAW,KAAA,CAAM,IAAA,KAAS,UAAA,IAAc,MAAM,IAAA,EAAM;AAClD,QAAA,IAAI,KAAA,CAAM,SAAS,aAAA,EAAe;AAChC,UAAA,IAAA,CAAK,iBAAA,CAAkB,KAAK,EAAE,EAAA,EAAI,MAAM,EAAA,EAAI,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,CAAA;AAE9D,UAAA,IAAI,IAAA,CAAK,iBAAA,CAAkB,MAAA,GAAS,uBAAA,EAAyB;AAC3D,YAAA,IAAA,CAAK,kBAAkB,KAAA,EAAM;AAAA,UAC/B;AAAA,QACF;AACA,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,aAAA,CAAc,KAAA,EAAO,eAAe,CAAC,CAAA;AAAA,MAC3D;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,eAAA,EAAiB,IAAA,CAAK,eAAA,GAAkB,KAAA;AAC7C,IAAA,IAAI,CAAC,eAAA,EAAiB,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAC/C,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,aAAA,CAAc,OAAqB,eAAA,EAA6C;AACtF,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,MAAM,KAAA,GAAS,KAAA,CAAM,KAAA,IAAS,EAAC;AAE/B,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,OAAO,IAAA,CAAK,sBAAsB,KAAK,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,SAAS,OAAA,EAAS;AACpB,MAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,IAC7C;AACA,IAAA,OAAO,IAAA,CAAK,oBAAA,CAAqB,IAAA,EAAM,KAAA,EAAO,eAAe,CAAA;AAAA,EAC/D;AAAA,EAEQ,sBAAsB,KAAA,EAAmD;AAC/E,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,YAAY,KAAA,CAAM,QAAA;AACxB,IAAA,MAAM,QAAA,GACJ,aACA,CAAC,SAAA,EAAW,QAAQ,aAAA,EAAe,KAAK,CAAA,CAAE,QAAA,CAAS,SAAA,CAAU,IAAA,IAAQ,EAAE,CAAA,IACvE,KAAA,CAAM,OAAA,CAAQ,SAAA,CAAU,OAAO,CAAA,IAC/B,UAAU,OAAA,CAAQ,MAAA,GAAS,CAAA,IAC3B,SAAA,CAAU,OAAA,CAAQ,MAAA,IAAU,MAC5B,SAAA,CAAU,OAAA,CAAQ,MAAM,CAAC,MAAA,KAAW,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,MAAA,IAAU,IAAI,CAAA,IACvF,UAAU,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,EAAO,MAAA,KAAW,KAAA,GAAQ,OAAO,MAAA,EAAQ,CAAC,CAAA,IAAK,KAAA,GACpE,SAAA,GACD,MAAA;AACN,IAAA,IAAI,MAAA,CAAO,OAAO,KAAA,EAAO,UAAU,KAAK,CAAC,QAAA,SAAiB,EAAC;AAG3D,IAAA,MAAM,YAAY,KAAA,CAAM,SAAA;AACxB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC5B,MAAA,KAAA,MAAW,KAAK,SAAA,EAAW;AACzB,QAAA,MAAM,IAAA,GAAO,CAAA;AACb,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,QAAA,IAAY,EAAE,CAAA;AAC3C,QAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,QAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GACjC,OAAA,CAAQ,IAAI,CAAC,CAAA,KAAY,OAAO,CAAA,KAAM,WAAW,CAAA,GAAI,MAAA,CAAO,EAAE,KAAA,IAAS,CAAC,CAAE,CAAA,GAC1E,MAAA;AACJ,QAAA,MAAA,CAAO,IAAA,CAAK;AAAA,UACV,IAAA,EAAM,UAAA;AAAA,UACN,QAAA;AAAA,UACA,OAAA;AAAA,UACA,GAAI,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,GAAW,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU,GAAI,EAAC;AAAA,UAC5E,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa;AAAC,SAChC,CAAA;AAAA,MACH;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,WAAW,MAAA,CAAO,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAQ,EAAE,CAAA;AAC1D,MAAA,MAAM,aAAa,KAAA,CAAM,OAAA;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAU,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,GAAI,MAAA;AACrE,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,IAAA,EAAM,UAAA;AAAA,QACN,QAAA;AAAA,QACA,OAAA;AAAA,QACA,GAAI,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,GAAW,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU,GAAI,EAAC;AAAA,QAC5E,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa;AAAC,OAChC,CAAA;AAAA,IACH;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,kBAAA,CACN,OACA,KAAA,EACmB;AACnB,IAAA,MAAM,YAAY,MAAA,CAAO,KAAA,CAAM,aAAA,IAAiB,KAAA,CAAM,eAAe,SAAS,CAAA;AAC9E,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,WAAA,IAAe,KAAA,CAAM,UAAU,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAChF,IAAA,IAAI,MAAM,EAAA,EAAI;AACZ,MAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,SAAS,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO;AAAA,MACL,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,WAAW,WAAA,EAAY;AAAA,MACpE,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,SAAA;AAAU,KACrC;AAAA,EACF;AAAA,EAEQ,oBAAA,CACN,IAAA,EACA,KAAA,EACA,eAAA,EACmB;AACnB,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,IAAA,EAAM,KAAK,CAAA;AACvC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,WAAA;AAAA,MACN,IAAA,EAAM,IAAA;AAAA,MACN,KAAA;AAAA;AAAA;AAAA,MAGA,OAAA,EAAS,iBAAA,CAAkB,IAAA,EAAM,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAAA,MAC1D,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU,EAAC;AAAA,MACzB,GAAI,eAAA,GAAkB,EAAE,eAAA,KAAoB;AAAC,KAC9C,CAAA;AACD,IAAA,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,WAAW,CAAA;AAEhD,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACxD,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,uBAAA,CAAwB,KAAA,CAAM,OAAO,CAAA;AAC3D,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,KAAA,EAAuC;AAGjE,IAAA,MAAM,QAAS,KAAA,CAAc,UAAA;AAC7B,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AACzB,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,OAAO,CAAA;AAAA,IAC1C;AAIA,IAAA,MAAM,QAAA,GAAoB,gBAAA,IAAoB,KAAA,GAAQ,KAAA,CAAM,cAAA,GAAiB,MAAA;AAC7E,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,IAAY,CAAC,KAAK,iBAAA,EAAmB;AACvE,MAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AACzB,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,YAAY,CAAA;AAAA,IAC/C;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAMQ,cAAc,WAAA,EAAiD;AACrE,IAAA,IAAI,CAAC,WAAA,EAAa,MAAA,EAAQ,OAAO,EAAC;AAElC,IAAA,MAAM,SAA4B,EAAC;AAEnC,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AAChC,MAAA,MAAM,QAAA,GAAW,OAAO,QAAA,IAAY,SAAA;AACpC,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,OAAA;AACzC,MAAA,MAAM,SAAS,OAAO,UAAA,KAAe,WAAW,UAAA,GAAa,IAAA,CAAK,UAAU,UAAU,CAAA;AAGtF,MAAA,IAAI,QAAA,KAAa,OAAA,IAAW,IAAA,CAAK,gBAAA,CAAiB,MAAM,CAAA,EAAG;AACzD,QAAA,MAAA,CAAO,KAAK,GAAG,IAAA,CAAK,oBAAA,CAAqB,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,MAC1D,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,IAAA,CAAK,GAAG,IAAA,CAAK,gBAAA,CAAiB,UAAU,UAAA,EAAY,MAAA,EAAQ,MAAA,CAAO,eAAe,CAAC,CAAA;AAAA,MAC5F;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,oBAAA,CAAqB,QAAsB,MAAA,EAAmC;AACpF,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,mBAAA,CAAoB,MAAM,CAAA;AACjD,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AACvC,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAY,WAAA,EAAa,CAAA;AAElF,IAAA,IAAI,cAAc,YAAA,EAAc;AAC9B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,gBAAA,CACN,QAAA,EACA,UAAA,EACA,MAAA,EACA,eAAA,EACmB;AACnB,IAAA,MAAM,SAA4B,EAAC;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,aAAA;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,UAAA;AAAA,MACR,OAAA,EAAS,mBAAA,CAAoB,QAAA,EAAU,UAAU,CAAA;AAAA,MACjD,GAAI,eAAA,GAAkB,EAAE,eAAA,KAAoB;AAAC,KAC9C,CAAA;AAGD,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,QAAA,EAAU,UAAU,CAAA;AACzD,IAAA,IAAI,WAAW,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,IAAA,CAAK,GAAG,UAAU,CAAA;AAGpD,IAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA;AACjD,MAAA,IAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,iBAAiB,MAAA,EAA+B;AAEtD,IAAA,IAAI,MAAA,CAAO,YAAY,IAAA,CAAK,eAAA,CAAgB,IAAI,MAAA,CAAO,QAAQ,GAAG,OAAO,IAAA;AACzE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEQ,oBAAoB,MAAA,EAA8B;AAExD,IAAA,MAAM,IAAA,GAAO,OAAO,QAAA,GAAW,IAAA,CAAK,gBAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,GAAI,MAAA;AAC3E,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,MAAA,CAAO,QAAS,CAAA;AAC5C,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAO,QAAA,IAAY,SAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,KAAA,EAA4D;AAC/E,IAAA,MAAM,KAAA,GAAQ,kBAAkB,KAAK,CAAA;AACrC,IAAA,IAAI,KAAA,CAAM,YAAY,SAAA,EAAW;AAC/B,MAAA,OAAO;AAAA,QACL;AAAA,UACE,IAAA,EAAM,UAAA;AAAA,UACN,OAAA,EAAS,MAAM,OAAA,IAAW,gBAAA;AAAA,UAC1B,OAAA,EAAS,MAAM,OAAA,IAAW,CAAA;AAAA,UAC1B,GAAG,KAAA;AAAA,UACH,GAAI,MAAM,WAAA,KAAgB,IAAA,GAAO,EAAE,WAAA,EAAa,IAAA,KAAkB;AAAC;AACrE,OACF;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,IAAU,EAAC;AAKhC,IAAA,MAAM,SAAS,sBAAA,CAAuB,EAAE,QAAQ,OAAA,EAAS,KAAA,CAAM,SAAS,CAAA;AAIxE,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,OAAA,EAAS,CAAA,eAAA,EAAkB,KAAA,CAAM,OAAO,CAAA,EAAG,MAAA,CAAO,MAAA,GAAS,CAAA,QAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,KAAK,EAAE,CAAA,CAAA;AAAA,QACzF,KAAA,EAAO,MAAM,OAAA,KAAY,wBAAA;AAAA,QACzB,UAAU,MAAA,CAAO,QAAA;AAAA,QACjB,GAAI,OAAO,IAAA,GAAO,EAAE,MAAM,MAAA,CAAO,IAAA,KAAS,EAAC;AAAA,QAC3C,GAAI,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,GAAW,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAQ,GAAI,EAAC;AAAA,QACtE,GAAG,KAAA;AAAA,QACH,GAAI,MAAM,WAAA,KAAgB,IAAA,GAAO,EAAE,WAAA,EAAa,IAAA,KAAkB;AAAC;AACrE,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMQ,wBAAwB,OAAA,EAAyC;AACvE,IAAA,IAAI,IAAA,CAAK,0BAA0B,OAAO,IAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,IAAA,MAAM,mBACH,GAAA,CAAI,QAAA,CAAS,cAAc,CAAA,IAAK,GAAA,CAAI,SAAS,UAAU,CAAA,IAAK,IAAI,QAAA,CAAS,MAAM,OAC/E,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA,IAAK,GAAA,CAAI,SAAS,aAAa,CAAA,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,IAAA,CAAK,wBAAA,GAA2B,IAAA;AAChC,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,UAAA,EAAW;AAAA,IAChF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,qBAAqB,IAAA,EAAsC;AACjE,IAAA,IAAI,IAAA,CAAK,uBAAuB,OAAO,IAAA;AAEvC,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,wCAAwC,CAAA;AACzE,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,cAAc,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACvE;AAEA,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,qCAAqC,CAAA;AAClE,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,UAAU,CAAC,CAAA,EAAI,QAAQ,OAAA,EAAQ;AAAA,IACnE;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,gBAAgB,CAAA,EAAG;AACnC,MAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,MAAA,OAAO,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,uBAAA,EAAyB,QAAQ,OAAA,EAAQ;AAAA,IAC7E;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAiB,OAAA,EAAuC;AAC9D,IAAA,IAAI,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,SAAU,OAAA,CAAQ,OAAA;AACnD,IAAA,IAAI,OAAO,OAAA,CAAQ,OAAA,KAAY,QAAA,IAAY,QAAQ,OAAA,EAAS;AAC1D,MAAA,OAAO,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,OAAA,CAAQ,SAAS,CAAA;AAAA,IACjD;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAiBO,SAAS,iBAAA,CAAkB,MAAc,KAAA,EAAwC;AAEtF,EAAA,MAAM,GAAA,GAAM,CAAC,GAAA,KAAgB,MAAA,CAAO,MAAM,GAAG,CAAA,IAAK,MAAM,KAAK,CAAA;AAC7D,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,EAAA,EAAK,MAAA,CAAO,KAAA,CAAM,OAAA,IAAW,KAAA,CAAM,KAAA,IAAS,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAAA,IACtE,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA;AAAA,IACnC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA;AAAA,IACjC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA;AAAA,IACjC,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IAC/B,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,WAAA,EAAc,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IACrC,KAAK,YAAA,EAAc;AAEjB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA,GAAI,KAAA,CAAM,UAAU,EAAC;AAChE,MAAA,MAAM,KAAA,GAAQ,OAAA,CACX,GAAA,CAAI,CAAC,MAAA,KAAY,MAAA,EAAsC,IAAI,CAAA,CAC3D,MAAA,CAAO,CAACA,KAAAA,KAAyB,OAAOA,UAAS,QAAQ,CAAA;AAC5D,MAAA,OAAO,CAAA,KAAA,EAAQ,MAAM,IAAA,CAAK,IAAI,EAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,OAAO,CAAA,CAAA;AAAA,IAC1D;AAAA,IACA;AACE,MAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA;AAE3D;AAaO,SAAS,aAAA,CAAc,MAAc,KAAA,EAAoD;AAC9F,EAAA,MAAM,QAAA,GACJ,QAAA,CAAS,KAAA,CAAM,yBAAyB,CAAC,CAAA,KACxC,IAAA,KAAS,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,WAAW,CAAA,GAAI,MAAA,CAAA;AACnD,EAAA,MAAM,KAAA,GAAQ,QAAA,IAAY,gBAAA,CAAiB,IAAA,EAAM,KAAK,CAAA;AACtD,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,KAAA,CAAM,MAAA,GAAS,6BAAA,GAClB,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,6BAAA,GAAgC,CAAC,CAAA,CAAE,OAAA,EAAS,CAAA,MAAA,CAAA,GAC9D,KAAA;AACN;AAEA,SAAS,SAAS,KAAA,EAAoC;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA;AACtC,EAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,GAAG,EAAE,IAAA,EAAK;AAChD,EAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,GAAU,MAAA;AACxC;AAEA,SAAS,gBAAA,CAAiB,MAAc,KAAA,EAAoD;AAC1F,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA;AACH,MAAA,OAAO,UAAA,CAAW,SAAA,EAAW,QAAA,CAAS,KAAA,CAAM,SAAS,CAAC,CAAA;AAAA,IACxD,KAAK,MAAA;AAAA,IACL,KAAK,WAAA;AAAA,IACL,KAAK,cAAA;AACH,MAAA,OAAO,WAAW,SAAA,EAAW,QAAA,CAAS,MAAM,SAAA,IAAa,KAAA,CAAM,aAAa,CAAC,CAAA;AAAA,IAC/E,KAAK,OAAA;AACH,MAAA,OAAO,UAAA,CAAW,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,SAAS,CAAC,CAAA;AAAA,IACzD,KAAK,MAAA;AAAA,IACL,KAAK,MAAA;AACH,MAAA,OAAO,iBAAA;AAAA,IACT,KAAK,WAAA;AACH,MAAA,OAAO,mBAAA;AAAA,IACT,KAAK,UAAA;AACH,MAAA,OAAO,WAAW,UAAA,EAAY,MAAA,CAAO,KAAA,CAAM,GAAG,GAAG,YAAY,CAAA;AAAA,IAC/D,KAAK,WAAA;AACH,MAAA,OAAO,wBAAA;AAAA,IACT,KAAK,YAAA;AACH,MAAA,OAAO,eAAA;AAAA,IACT;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAEA,SAAS,UAAA,CAAW,IAAA,EAAc,MAAA,EAA4B,QAAA,GAAW,QAAA,EAAkB;AACzF,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAA,IAAU,QAAQ,CAAA,CAAA;AACtC;AAEA,SAAS,SAAS,KAAA,EAAoC;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,KAAW,GAAG,OAAO,MAAA;AAC5D,EAAA,OAAO,MAAM,KAAA,CAAM,OAAO,EAAE,MAAA,CAAO,OAAO,EAAE,GAAA,EAAI;AAClD;AAEA,SAAS,OAAO,KAAA,EAAoC;AAClD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA;AACtC,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,IAAA,IAAQ,KAAA,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGA,SAAS,wBAAwB,MAAA,EAAkC;AACjE,EAAA,MAAM,aAAa,MAAA,CAAO,MAAA;AAAA,IACxB,CAAC,CAAA,KACC,OAAO,CAAA,KAAM,QAAA,IACb,CAAA,KAAM,IAAA,IACL,CAAA,CAA8B,IAAA,KAAS,MAAA,IACxC,OAAQ,CAAA,CAA8B,IAAA,KAAS;AAAA,GACnD;AACA,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,UAAA,CAAW,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA,CAAE,KAAK,IAAI,CAAA;AAChD;AAaO,SAAS,mBAAA,CAAoB,MAAc,MAAA,EAAyB;AAEzE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,IAAA,MAAM,IAAA,GAAO,wBAAwB,MAAM,CAAA;AAC3C,IAAA,OAAA,CAAQ,QAAQ,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,EAAQ;AACzC,IAAA,OAAO,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACpC;AACA,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,MAAA,EAAQ;AACX,MAAA,MAAM,SAAS,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,EAAE,IAAA,EAAK;AAC3C,MAAA,IAAI,QAAQ,OAAO,CAAA,QAAA,EAAW,OAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAClD,MAAA,OACE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA,CAClB,MAAK,CACL,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,IAAK,aAAA;AAAA,IAExB;AAAA,IACA,KAAK,OAAA;AACH,MAAA,OAAO,CAAA,EAAG,OAAO,CAAA,CAAE,IAAI,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACjD,KAAK,MAAA;AACH,MAAA,OAAO,CAAA,OAAA,EAAU,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA;AAAA,IACrC,KAAK,YAAA;AACH,MAAA,OAAO,CAAA,EAAG,MAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,aAAA,CAAA;AAAA,IAC3D;AACE,MAAA,OAAO,KAAK,SAAA,CAAU,MAAM,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA;AAEhD;AAaO,SAAS,iBAAA,CAAkB,UAAkB,MAAA,EAAoC;AACtF,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,SAAe,EAAC;AACnD,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,QAAA,KAAa,OAAA,IAAW,CAAA,CAAE,QAAA,EAAU;AACtC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAAA,QACvB,MAAA,EAAQ,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,QAAA,GAAW;AAAA;AAC3C,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAA,KAAa,MAAA,IAAU,CAAA,CAAE,QAAA,EAAU;AACrC,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,cAAA,EAAgB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA,EAAG,MAAA,EAAQ,MAAA,EAAQ,CAAA;AAAA,EAC5E;AACA,EAAA,IAAI,aAAa,YAAA,IAAgB,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,EAAG;AACzD,IAAA,OAAO,EAAE,OAAA,CACN,MAAA;AAAA,MACC,CAAC,MAAA,KACC,OAAO,MAAA,KAAW,QAAA,IAClB,MAAA,KAAW,IAAA,IACX,OAAQ,MAAA,CAAmC,IAAA,KAAS,QAAA,IACpD,OAAQ,OAAmC,IAAA,KAAS;AAAA,KACxD,CACC,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,MAChB,IAAA,EAAM,cAAA;AAAA,MACN,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,MAAA,EAAQ,OAAO,IAAA,KAAS,KAAA,GAAQ,WAAW,MAAA,CAAO,IAAA,KAAS,WAAW,QAAA,GAAW;AAAA,KACnF,CAAE,CAAA;AAAA,EACN;AAEA,EAAA,OAAO,EAAC;AACV;AAYO,SAAS,gBAAA,CAAiB,UAAkB,MAAA,EAAyC;AAC1F,EAAA,OAAO,iBAAA,CAAkB,QAAA,EAAU,MAAM,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AACnD;;;AChvBO,IAAM,gBAAN,MAA6C;AAAA,EAC1C,OAAA,GAA+B,IAAA;AAAA,EAC/B,UAAA,GAAa,IAAI,eAAA,EAAgB;AAAA,EACjC,QAAA,uBAAe,GAAA,EAAiC;AAAA,EAChD,iBAAA,GAAmD,IAAA;AAAA,EACnD,SAAA;AAAA,EAER,WAAA,CAAY,YAAoB,YAAA,EAAc;AAC5C,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA,EAEA,MAAM,MAAM,MAAA,EAA2C;AAErD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,MAAM,KAAK,OAAA,EAAQ;AAAA,IACrB;AAEA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAEtB,IAAA,MAAM,YAAA,GAA4B;AAAA,MAChC,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,iBAAiB,MAAA,CAAO,eAAA;AAAA,MACxB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,GAAI,MAAA,CAAO,QAAA,GAAW,EAAE,QAAA,EAAU,gBAAA,CAAiB,MAAA,CAAO,QAAA,EAAU,SAAS,CAAA,EAAE,GAAI,EAAC;AAAA,MACpF,GAAI,OAAO,QAAA,GAAW,EAAE,UAAU,MAAA,CAAO,QAAA,KAAa;AAAC,KACzD;AAEA,IAAA,IAAA,CAAK,OAAA,GAAU,MAAM,aAAA,CAAc,IAAA,CAAK,WAAW,YAAY,CAAA;AAG/D,IAAA,IAAA,CAAK,iBAAA,GAAoB,CAAC,WAAA,KAAqB;AAC7C,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU,WAAW,CAAA;AACxD,MAAA,KAAA,MAAW,SAAS,UAAA,EAAY;AAC9B,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACnC,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf;AAAA,MACF;AAAA,IACF,CAAA;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,EAAA,CAAG,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AAErD,IAAA,MAAM,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EAC3B;AAAA,EAEA,MAAM,UAAU,OAAA,EAAiD;AAAA,EAGjE;AAAA,EAEA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAC7E,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,YAAY,KAAA,EAAwC;AACxD,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAC7E,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,KAAK,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,KAAA,CAAM,MAAA,EAAgB,QAAA,EAAmB,SAAA,EAAmC;AAChF,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,MAAM,IAAI,MAAM,+CAA0C,CAAA;AAG7E,IAAA,IACE,IAAA,CAAK,SAAS,kBAAA,EAAmB,IACjC,KAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,EAAQ,QAAA,EAAU,SAAS,CAAA;AAEvD,MAAA;AACF,IAAA,IAAI,KAAK,OAAA,EAAS,oBAAA,EAAsB,MAAM,IAAA,CAAK,OAAO,MAAM,CAAA;AAAA,EAClE;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,MAAM,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,QAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA;AACtD,QAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AAAA,MAC3B;AACA,MAAA,IAAA,CAAK,QAAQ,IAAA,EAAK;AAClB,MAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,IACjB;AACA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAAA,EACxB;AAAA,EAEA,QAAQ,OAAA,EAA4C;AAClD,IAAA,IAAA,CAAK,QAAA,CAAS,IAAI,OAAO,CAAA;AAAA,EAC3B;AAAA,EAEA,SAAS,OAAA,EAA4C;AACnD,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAS,SAAA,IAAa,KAAA;AAAA,EACpC;AACF;AASO,SAAS,aAAA,CAAc,YAAoB,YAAA,EAA6B;AAC7E,EAAA,OAAO,IAAI,cAAc,SAAS,CAAA;AACpC;;;AC5GA,eAAsB,cAAA,CACpB,QAAA,EACA,GAAA,EACA,OAAA,GAA0E,EAAC,EAChD;AAC3B,EAAA,MAAM,MAAA,GAAS,kBAAkB,QAAQ,CAAA;AACzC,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,QAAQ,CAAA,CAAA,EAAG;AAIxE,EAAA,MAAM,OAAA,GAAU,qBAAqB,MAAA,EAAQ;AAAA,IAC3C,GAAI,QAAQ,OAAA,GAAU,EAAE,SAAS,OAAA,CAAQ,OAAA,KAAY,EAAC;AAAA,IACtD,GAAA,EAAK,OAAA,CAAQ,GAAA,IAAO,OAAA,CAAQ;AAAA,GAC7B,CAAA;AACD,EAAA,MAAM,KAAA,GAAQ,aAAa,MAAA,EAAQ,OAAA,GAAU,EAAE,OAAA,EAAQ,GAAI,EAAE,CAAA;AAC7D,EAAA,MAAM,GAAA,GAAM,gBAAgB,KAAK,CAAA;AACjC,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,CAAA,SAAA,EAAY,QAAQ,CAAA,2BAAA,CAAA,EAA8B;AAGvF,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,KAAA,CAAM,SAAS,GAAG,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAE;AAE1E,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,UAAU,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,GAAI,CAAA;AAEzD,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA;AAAA,MACA,QAAQ,UAAA,CAAW;AAAA,KACpB,CAAA;AAED,IAAA,YAAA,CAAa,OAAO,CAAA;AAEpB,IAAA,IAAI,QAAA,CAAS,EAAA,EAAI,OAAO,EAAE,IAAI,IAAA,EAAK;AAEnC,IAAA,MAAM,SAAS,QAAA,CAAS,MAAA;AACxB,IAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK;AACpC,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,yCAAA,EAA0C;AAAA,IACvE;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,kBAAA,EAAqB,MAAM,CAAA,CAAA,EAAG;AAAA,EAC3D,SAAS,GAAA,EAAU;AACjB,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,wBAAA,EAAyB;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,WAAW,eAAA,EAAgB;AAAA,EAC5D;AACF","file":"chunk-4XWLB7JB.js","sourcesContent":["/**\n * Pre-flight model check: would the harness refuse the selected model before it starts a turn?\n *\n * `skaile run --dry-run` uses it so a setup check learns about a refusal that a real run would\n * print. The codex harness refuses a selection up front when it cannot address the AI provider\n * surface; codex, omp and the Claude SDK refuse a provider nothing serves\n * ({@link checkModelProvider}); every other harness answers `undefined`.\n */\nimport { existsSync, readFileSync } from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport {\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport { parse } from \"yaml\";\nimport { buildCodexConfigDocument } from \"./codex/config-toml.js\";\nimport { ompRegistryModelRefusal } from \"./harnesses/omp-models-yml.js\";\nimport { AI_PROVIDER_PRESETS } from \"./provider-catalog.js\";\n\n/** What {@link checkHarnessModel} reads. */\nexport interface HarnessModelCheckInput {\n  registry?: AIProviderRegistry | MergedAIProviderRegistry;\n  /** The model selector: `<providerId>/<modelId>`, a bare id or `@role`. */\n  model?: string;\n  roles?: Record<string, string>;\n}\n\n/**\n * Providers a harness reaches with its own login, without a registry entry: codex talks to\n * OpenAI, the Claude SDK to Anthropic, omp to every vendor it ships a login for. A harness not\n * listed here (a plugin's, `echo`) is not checked.\n */\nfunction nativeProviders(harnessId: string): ReadonlySet<string> | undefined {\n  if (harnessId === \"codex\") return new Set([\"openai\"]);\n  if (harnessId === \"claude-sdk\") return new Set([\"anthropic\"]);\n  if (harnessId === \"omp\") return new Set(Object.keys(AI_PROVIDER_PRESETS));\n  return undefined;\n}\n\n/**\n * What omp can serve on the user's own agent directory (`PI_CODING_AGENT_DIR`, else\n * `~/.omp/agent`): the provider ids their `models.yml` defines, and whether they have a login\n * (`agent.db`), which may carry built-in providers this list cannot name (p1111).\n */\nfunction ompOwnHome(): { providers: ReadonlySet<string>; hasLogin: boolean } {\n  const dir = process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), \".omp\", \"agent\");\n  const providers = new Set<string>();\n  try {\n    const doc = parse(readFileSync(path.join(dir, \"models.yml\"), \"utf-8\")) as {\n      providers?: unknown;\n    } | null;\n    const block = doc?.providers;\n    if (block && typeof block === \"object\" && !Array.isArray(block)) {\n      for (const id of Object.keys(block)) providers.add(id);\n    }\n  } catch {\n    // no models.yml, or one omp itself will reject\n  }\n  return { providers, hasLogin: existsSync(path.join(dir, \"agent.db\")) };\n}\n\n/**\n * `<provider>/<model>` whose provider nothing can serve: not a registry entry and not a\n * provider the harness has its own login for. Without this the id goes to the harness's default\n * provider verbatim and fails there with a message that blames the login.\n *\n * The rule differs per harness (p1111). omp and the Claude SDK route through a registry entry,\n * so while any enabled registry entry is left they take an unknown head as a vendor-scoped\n * model id (`meta-llama/Llama-3.3-70B`). codex talks to OpenAI only and cannot, so it refuses\n * a head that is neither a registered provider nor `openai`, whatever else is registered.\n */\nexport function checkModelProvider(\n  harnessId: string,\n  input: HarnessModelCheckInput,\n): string | undefined {\n  const native = nativeProviders(harnessId);\n  let selector = input.model?.trim() ?? \"\";\n  if (selector.startsWith(\"@\")) selector = input.roles?.[selector.slice(1)]?.trim() ?? \"\";\n  const slash = selector.indexOf(\"/\");\n  if (!native || slash <= 0 || selector.startsWith(\"@\")) return undefined;\n  const head = selector.slice(0, slash);\n  if (native.has(head)) return undefined;\n  const entries = input.registry ? registryEntries(input.registry) : [];\n  if (entries.some(([id]) => id === head)) return undefined;\n  const servesVendorIds =\n    harnessId !== \"codex\" &&\n    entries.some(\n      ([, entry]) => (entry.kind === \"llm\" || entry.kind === \"embed\") && isEntryEnabled(entry),\n    );\n  if (servesVendorIds) return undefined;\n  if (harnessId === \"omp\") {\n    // With no registry entry omp runs on the user's own agent directory: their `models.yml`\n    // providers and the logins omp ships are served there.\n    const own = ompOwnHome();\n    if (own.providers.has(head) || own.hasLogin) return undefined;\n  }\n  return `provider '${head}' is not configured: run skaile providers list`;\n}\n\n/**\n * The refusal message the harness prints for this model, or `undefined` when it takes it.\n * The text matches the one the harness throws at start.\n */\nexport function checkHarnessModel(\n  harnessId: string,\n  input: HarnessModelCheckInput,\n): string | undefined {\n  const unknownProvider = checkModelProvider(harnessId, input);\n  if (unknownProvider) return unknownProvider;\n  if (harnessId === \"omp\") {\n    let selector = input.model?.trim() ?? \"\";\n    if (selector.startsWith(\"@\")) selector = input.roles?.[selector.slice(1)]?.trim() ?? \"\";\n    return ompRegistryModelRefusal(input.registry, selector, nativeProviders(\"omp\") ?? new Set());\n  }\n  if (harnessId !== \"codex\") return undefined;\n  const build = buildCodexConfigDocument({\n    registry: input.registry,\n    ...(input.model ? { modelRef: input.model, model: input.model } : {}),\n    ...(input.roles ? { roles: input.roles } : {}),\n  });\n  if (!build.unaddressable) return undefined;\n  const { id, reason } = build.unaddressable;\n  return `AI provider '${id}' cannot be used with the codex harness: ${reason}. Pick a model of another provider.`;\n}\n","/**\n * EventNormalizer — converts bridge-level AgentEvent (raw harness events) to\n * skaile-agent-types AgentEvent (normalized, human-readable events).\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call reset() between sessions.\n */\n\nimport {\n  type AgentEvent as NormalizedEvent,\n  type NativeApprovalDescription,\n  stripActivityLabel,\n  TOOL_ACTIVITY_LABEL_MAX_CHARS,\n  TOOL_ACTIVITY_LABEL_PARAM,\n} from \"@skaile/workspaces/types\";\nimport { classifyClaudeSdkError } from \"./error-classifier.js\";\nimport type { AgentMessage, AgentEvent as BridgeEvent, ContentBlock } from \"./types.js\";\n\n/**\n * The optional usage keys a `result` event carries, in the shape both\n * `finished` and a result-sourced `error` emit them. Absent keys stay absent.\n */\nfunction resultUsageFields(\n  event: Pick<\n    Extract<BridgeEvent, { type: \"result\" | \"error\" }>,\n    \"tokens\" | \"modelUsage\" | \"contextTokens\" | \"contextWindow\"\n  >,\n) {\n  return {\n    ...(event.tokens ? { tokens: event.tokens } : {}),\n    ...(event.modelUsage ? { modelUsage: event.modelUsage } : {}),\n    ...(typeof event.contextTokens === \"number\" ? { contextTokens: event.contextTokens } : {}),\n    ...(typeof event.contextWindow === \"number\" ? { contextWindow: event.contextWindow } : {}),\n  };\n}\n\n/**\n * The tool a harness uses to park a turn on a human answer. Both branches that\n * recognise it must use this constant: `message_start` turns it into a\n * `question`, and `tool_call` must then stay silent about it.\n */\nconst QUESTION_TOOL = \"AskUserQuestion\";\n\nconst MAX_ANNOUNCED_TOOL_USES = 64;\n\n/**\n * Bridge `tool_call` inputs are loosely typed: Codex MCP arguments may arrive\n * as a JSON string, and the echo harness passes a bare path.\n */\nfunction toolInputRecord(input: unknown): Record<string, unknown> {\n  let value = input;\n  if (typeof value === \"string\") {\n    try {\n      value = JSON.parse(value);\n    } catch {\n      return { input };\n    }\n  }\n  if (typeof value === \"object\" && value !== null && !Array.isArray(value)) {\n    return value as Record<string, unknown>;\n  }\n  return value === undefined ? {} : { input };\n}\n\n/**\n * Converts raw bridge-level {@link BridgeEvent} payloads into normalized\n * `@skaile/workspaces/types` `AgentEvent` payloads consumed by the runner and transport.\n *\n * Stateful: tracks active subagents and dev-server detection across a session.\n * Call {@link EventNormalizer.reset} between sessions to clear accumulated state.\n *\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport class EventNormalizer {\n  private activeSubagents = new Map<string, string>();\n  private devServerStartingEmitted = false;\n  private devServerReadyEmitted = false;\n  /** True when message_update deltas have been emitted for the current message. */\n  private hasStreamedText = false;\n  /**\n   * True once a `_thinkingDelta` run has been reported as `status: thinking`;\n   * cleared by the next text delta or assistant message, so a run reports once.\n   */\n  private thinkingAnnounced = false;\n  /**\n   * tool_use blocks `message_start` already reported, awaiting the harness's\n   * matching bridge `tool_call` — which must then not report the call again.\n   */\n  private announcedToolUses: Array<{ id?: string; name: string }> = [];\n\n  /**\n   * Convert a single bridge event into zero or more normalized events.\n   * One bridge event can produce multiple normalized events (e.g., a message_start\n   * with text + tool_use blocks produces both text and tool_call events).\n   */\n  normalize(event: BridgeEvent): NormalizedEvent[] {\n    switch (event.type) {\n      case \"message_start\":\n        return this.handleMessageStart(event.message);\n\n      case \"message_update\":\n        return this.handleMessageUpdate(event);\n\n      case \"message_end\":\n        return [];\n\n      case \"message_retract\":\n        // The replay streams its reply afresh, so its deltas (or, failing\n        // those, its message_start text) must count as a new message.\n        this.hasStreamedText = false;\n        return event.text ? [{ type: \"text_retract\", content: event.text }] : [];\n\n      case \"turn_end\":\n        return this.handleTurnEnd(event.toolResults);\n\n      case \"result\":\n        return this.handleResult(event);\n\n      case \"error\":\n        this.announcedToolUses = [];\n        return [\n          {\n            type: \"error\",\n            message: event.error,\n            fatal: event.fatal ?? true,\n            category: event.detail?.category,\n            ...(event.detail?.hint ? { hint: event.detail.hint } : {}),\n            ...resultUsageFields(event),\n            ...(event.retrying === true\n              ? { retrying: true, ...(event.retryReason ? { retryReason: event.retryReason } : {}) }\n              : {}),\n            ...(event.selfStarted === true ? { selfStarted: true as const } : {}),\n          },\n        ];\n\n      case \"background_task_started\":\n        return [{ type: \"background_task_started\", taskId: event.taskId }];\n\n      case \"self_turn_started\":\n        return [{ type: \"self_turn_started\", taskIds: [...event.taskIds] }];\n\n      case \"tool_call\": {\n        // The question tool parks the turn on the user's answer, so reporting\n        // work here would undo the idle its `question` event just set, and\n        // nothing follows to correct it while the user reads the prompt.\n        const toolName = event.name ?? event.tool?.name;\n        if (toolName === QUESTION_TOOL) return [];\n        // A harness that also sent the call as a `message_start` tool_use block\n        // (Claude) was already reported there; the rest only ever send this.\n        if (!toolName || this.consumeAnnouncedToolUse(toolName, event.toolCallId)) {\n          return [{ type: \"status\", phase: \"working\" }];\n        }\n        return this.handleToolUse(\n          {\n            type: \"tool_use\",\n            id: typeof event.toolCallId === \"string\" ? event.toolCallId : undefined,\n            name: toolName,\n            input: toolInputRecord(event.input),\n          },\n          typeof event.parentToolUseId === \"string\" ? event.parentToolUseId : undefined,\n        );\n      }\n\n      case \"tool_execution_end\":\n        return [];\n\n      case \"agent_end\":\n        this.announcedToolUses = [];\n        return [{ type: \"status\", phase: \"idle\" }];\n\n      case \"commands_available\":\n        // Pass through to transport — the gateway caches this event\n        return [event as unknown as NormalizedEvent];\n\n      case \"session_info\":\n        // Pass through to transport — the forge layer stores the OMP session ID\n        return [event as unknown as NormalizedEvent];\n\n      case \"ui_render\":\n      case \"ui_render_update\":\n      case \"ui_clear\":\n        // Pass through verbatim — harnesses that implement the Agent UI Protocol emit these directly\n        return [event as unknown as NormalizedEvent];\n\n      default:\n        return [];\n    }\n  }\n\n  /** Clear all stateful tracking between sessions. */\n  reset(): void {\n    this.activeSubagents.clear();\n    this.devServerStartingEmitted = false;\n    this.devServerReadyEmitted = false;\n    this.hasStreamedText = false;\n    this.thinkingAnnounced = false;\n    this.announcedToolUses = [];\n  }\n\n  private consumeAnnouncedToolUse(name: string, id: unknown): boolean {\n    const callId = typeof id === \"string\" ? id : undefined;\n    const index = this.announcedToolUses.findIndex(\n      (entry) => entry.name === name && (!callId || !entry.id || entry.id === callId),\n    );\n    if (index === -1) return false;\n    this.announcedToolUses.splice(index, 1);\n    return true;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_start → text, tool_call, question, subagent\n  // ---------------------------------------------------------------------------\n\n  private handleMessageStart(message: AgentMessage): NormalizedEvent[] {\n    // Only process assistant messages. Harnesses (e.g. omp) may echo the user's\n    // message as a message_start with role:\"user\" before streaming the response.\n    // Emitting a text event for that echo would prepend the user's input to the\n    // assistant bubble on the frontend.\n    if (message.role !== \"assistant\") return [];\n\n    // A subagent's message is not the main reply: its text belongs to the\n    // subagent's own result, and it must not reset the main stream's state.\n    const parentToolUseId = message.parentToolUseId;\n    const events: NormalizedEvent[] = [];\n    const blocks = this.getContentBlocks(message);\n\n    for (const block of blocks) {\n      if (block.type === \"text\" && block.text) {\n        if (parentToolUseId) continue;\n        // Skip full text if we already streamed it via message_update deltas\n        if (!this.hasStreamedText) {\n          events.push({ type: \"text\", content: block.text });\n        }\n      } else if (block.type === \"tool_use\" && block.name) {\n        if (block.name !== QUESTION_TOOL) {\n          this.announcedToolUses.push({ id: block.id, name: block.name });\n          // Bounded in case a harness never echoes a block as a tool_call.\n          if (this.announcedToolUses.length > MAX_ANNOUNCED_TOOL_USES) {\n            this.announcedToolUses.shift();\n          }\n        }\n        events.push(...this.handleToolUse(block, parentToolUseId));\n      }\n    }\n\n    if (!parentToolUseId) this.hasStreamedText = false;\n    if (!parentToolUseId) this.thinkingAnnounced = false;\n    return events;\n  }\n\n  private handleToolUse(block: ContentBlock, parentToolUseId?: string): NormalizedEvent[] {\n    const name = block.name!;\n    const input = (block.input ?? {}) as Record<string, unknown>;\n\n    if (name === QUESTION_TOOL) {\n      return this.handleAskUserQuestion(input);\n    }\n    if (name === \"Agent\") {\n      return this.handleAgentToolUse(block, input);\n    }\n    return this.handleGenericToolUse(name, input, parentToolUseId);\n  }\n\n  private handleAskUserQuestion(input: Record<string, unknown>): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const candidate = input.approval as Partial<NativeApprovalDescription> | undefined;\n    const approval =\n      candidate &&\n      [\"command\", \"file\", \"permissions\", \"mcp\"].includes(candidate.kind ?? \"\") &&\n      Array.isArray(candidate.details) &&\n      candidate.details.length > 0 &&\n      candidate.details.length <= 64 &&\n      candidate.details.every((detail) => typeof detail === \"string\" && detail.length <= 8192) &&\n      candidate.details.reduce((total, detail) => total + detail.length, 0) <= 65536\n        ? (candidate as NativeApprovalDescription)\n        : undefined;\n    if (Object.hasOwn(input, \"approval\") && !approval) return [];\n    // Claude SDK sends { questions: [{ question, header, options: [{ label, description }] }] }\n    // Legacy/simple format sends { question: string, options?: string[] }\n    const questions = input.questions;\n    if (Array.isArray(questions)) {\n      for (const q of questions) {\n        const qObj = q as Record<string, unknown>;\n        const question = String(qObj.question ?? \"\");\n        const rawOpts = qObj.options;\n        const options = Array.isArray(rawOpts)\n          ? rawOpts.map((o: any) => (typeof o === \"string\" ? o : String(o.label ?? o)))\n          : undefined;\n        events.push({\n          type: \"question\",\n          question,\n          options,\n          ...(typeof input.requestId === \"string\" ? { requestId: input.requestId } : {}),\n          ...(approval ? { approval } : {}),\n        });\n      }\n    } else {\n      const question = String(input.question ?? input.text ?? \"\");\n      const rawOptions = input.options;\n      const options = Array.isArray(rawOptions) ? rawOptions.map(String) : undefined;\n      events.push({\n        type: \"question\",\n        question,\n        options,\n        ...(typeof input.requestId === \"string\" ? { requestId: input.requestId } : {}),\n        ...(approval ? { approval } : {}),\n      });\n    }\n    return events;\n  }\n\n  private handleAgentToolUse(\n    block: ContentBlock,\n    input: Record<string, unknown>,\n  ): NormalizedEvent[] {\n    const agentName = String(input.subagent_type ?? input.description ?? \"unknown\");\n    const description = String(input.description ?? input.prompt ?? \"\").slice(0, 200);\n    if (block.id) {\n      this.activeSubagents.set(block.id, agentName);\n    }\n    return [\n      { type: \"subagent\", name: agentName, status: \"started\", description },\n      { type: \"status\", phase: \"working\" },\n    ];\n  }\n\n  private handleGenericToolUse(\n    name: string,\n    input: Record<string, unknown>,\n    parentToolUseId?: string,\n  ): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const label = labelToolCall(name, input);\n    events.push({\n      type: \"tool_call\",\n      tool: name,\n      input,\n      // Summarize without the label: it would eat the default branch's\n      // 100-char argument budget and push the real args out.\n      summary: summarizeToolCall(name, stripActivityLabel(input)),\n      ...(label ? { label } : {}),\n      ...(parentToolUseId ? { parentToolUseId } : {}),\n    });\n    events.push({ type: \"status\", phase: \"working\" });\n\n    if (name === \"Bash\" && typeof input.command === \"string\") {\n      const devEvent = this.detectDevServerStarting(input.command);\n      if (devEvent) events.push(devEvent);\n    }\n\n    return events;\n  }\n\n  // ---------------------------------------------------------------------------\n  // message_update → streaming text\n  // ---------------------------------------------------------------------------\n\n  private handleMessageUpdate(event: BridgeEvent): NormalizedEvent[] {\n    // Bridge deltas carry no subagent tag: a harness must drop a subagent's\n    // partials itself (claude-sdk does in handleStreamEvent), or they read as main text.\n    const delta = (event as any)._textDelta as string | undefined;\n    if (delta) {\n      this.hasStreamedText = true;\n      this.thinkingAnnounced = false;\n      return [{ type: \"text\", content: delta }];\n    }\n    // The protocol has no thinking-content event, so reasoning surfaces as the\n    // existing `thinking` phase, once per run. The text is never forwarded as\n    // `text`; a harness keeps it out of `_textDelta`.\n    const thinking: unknown = \"_thinkingDelta\" in event ? event._thinkingDelta : undefined;\n    if (typeof thinking === \"string\" && thinking && !this.thinkingAnnounced) {\n      this.thinkingAnnounced = true;\n      return [{ type: \"status\", phase: \"thinking\" }];\n    }\n    return [];\n  }\n\n  // ---------------------------------------------------------------------------\n  // turn_end → tool_result, subagent finished, file_changed, dev_server\n  // ---------------------------------------------------------------------------\n\n  private handleTurnEnd(toolResults?: AgentMessage[]): NormalizedEvent[] {\n    if (!toolResults?.length) return [];\n\n    const events: NormalizedEvent[] = [];\n\n    for (const result of toolResults) {\n      const toolName = result.toolName ?? \"unknown\";\n      const outputData = result.data ?? result.content;\n      const output = typeof outputData === \"string\" ? outputData : JSON.stringify(outputData);\n\n      // Check if this is a subagent result\n      if (toolName === \"Agent\" || this.isSubagentResult(result)) {\n        events.push(...this.handleSubagentResult(result, output));\n      } else {\n        events.push(...this.handleToolResult(toolName, outputData, output, result.parentToolUseId));\n      }\n    }\n\n    return events;\n  }\n\n  private handleSubagentResult(result: AgentMessage, output: string): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    const agentName = this.resolveSubagentName(result);\n    const description = output.slice(0, 200);\n    events.push({ type: \"subagent\", name: agentName, status: \"finished\", description });\n\n    if (agentName === \"dev-server\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private handleToolResult(\n    toolName: string,\n    outputData: unknown,\n    output: string,\n    parentToolUseId?: string,\n  ): NormalizedEvent[] {\n    const events: NormalizedEvent[] = [];\n    events.push({\n      type: \"tool_result\",\n      tool: toolName,\n      output: outputData,\n      summary: summarizeToolResult(toolName, outputData),\n      ...(parentToolUseId ? { parentToolUseId } : {}),\n    });\n\n    // Detect file changes from Write/Edit results\n    const fileEvents = detectFileChanges(toolName, outputData);\n    if (fileEvents.length > 0) events.push(...fileEvents);\n\n    // Detect dev server from Bash output\n    if (toolName === \"Bash\") {\n      const devEvent = this.detectDevServerReady(output);\n      if (devEvent) events.push(devEvent);\n    }\n    return events;\n  }\n\n  private isSubagentResult(result: AgentMessage): boolean {\n    // Check if the tool result's id maps to a tracked subagent\n    if (result.toolName && this.activeSubagents.has(result.toolName)) return true;\n    return false;\n  }\n\n  private resolveSubagentName(result: AgentMessage): string {\n    // toolName on bridge AgentMessage is resolved from toolIdToName in the harness\n    const name = result.toolName ? this.activeSubagents.get(result.toolName) : undefined;\n    if (name) {\n      this.activeSubagents.delete(result.toolName!);\n      return name;\n    }\n    return result.toolName ?? \"unknown\";\n  }\n\n  // ---------------------------------------------------------------------------\n  // result → finished or error\n  // ---------------------------------------------------------------------------\n\n  private handleResult(event: BridgeEvent & { type: \"result\" }): NormalizedEvent[] {\n    const usage = resultUsageFields(event);\n    if (event.subtype === \"success\") {\n      return [\n        {\n          type: \"finished\",\n          summary: event.summary ?? \"Task completed\",\n          costUsd: event.costUsd ?? 0,\n          ...usage,\n          ...(event.selfStarted === true ? { selfStarted: true as const } : {}),\n        },\n      ];\n    }\n\n    const errors = event.errors ?? [];\n    // Run the same classifier the claude-sdk harness uses on its `error`\n    // event so the result-error path also surfaces a category and hint\n    // (harnesses other than claude-sdk emit `result` without a paired\n    // `error`, so this is the only place they get classified).\n    const detail = classifyClaudeSdkError({ errors, subtype: event.subtype });\n    // The turn billed even though it failed: carry its usage so a ledger\n    // that only writes on `finished` can write here too. Unlike the finished\n    // branch, no `costUsd: 0` fallback — an absent figure stays absent.\n    return [\n      {\n        type: \"error\",\n        message: `Agent stopped: ${event.subtype}${errors.length ? ` — ${errors.join(\"; \")}` : \"\"}`,\n        fatal: event.subtype === \"error_during_execution\",\n        category: detail.category,\n        ...(detail.hint ? { hint: detail.hint } : {}),\n        ...(typeof event.costUsd === \"number\" ? { costUsd: event.costUsd } : {}),\n        ...usage,\n        ...(event.selfStarted === true ? { selfStarted: true as const } : {}),\n      },\n    ];\n  }\n\n  // ---------------------------------------------------------------------------\n  // Dev server detection\n  // ---------------------------------------------------------------------------\n\n  private detectDevServerStarting(command: string): NormalizedEvent | null {\n    if (this.devServerStartingEmitted) return null;\n    const cmd = command.toLowerCase();\n    const isFrontendStart =\n      (cmd.includes(\"pnpm run dev\") || cmd.includes(\"pnpm dev\") || cmd.includes(\"vite\")) &&\n      (cmd.includes(\"frontend\") || cmd.includes(\"dev:preview\"));\n    if (isFrontendStart) {\n      this.devServerStartingEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"starting\" };\n    }\n    return null;\n  }\n\n  private detectDevServerReady(text: string): NormalizedEvent | null {\n    if (this.devServerReadyEmitted) return null;\n\n    const explicitMatch = text.match(/DEVSERVER_READY:(https?:\\/\\/[^\\s\"\\\\]+)/);\n    if (explicitMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: explicitMatch[1]!, status: \"ready\" };\n    }\n\n    const viteMatch = text.match(/Local:\\s+(https?:\\/\\/localhost:\\d+)/);\n    if (viteMatch) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: viteMatch[1]!, status: \"ready\" };\n    }\n\n    if (text.includes(\"FRONTEND_READY\")) {\n      this.devServerReadyEmitted = true;\n      return { type: \"dev_server\", url: \"http://localhost:3000\", status: \"ready\" };\n    }\n\n    return null;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Helpers\n  // ---------------------------------------------------------------------------\n\n  private getContentBlocks(message: AgentMessage): ContentBlock[] {\n    if (Array.isArray(message.content)) return message.content;\n    if (typeof message.content === \"string\" && message.content) {\n      return [{ type: \"text\", text: message.content }];\n    }\n    return [];\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Pure helper functions (exported for reuse)\n// ---------------------------------------------------------------------------\n\n/**\n * Produce a human-readable one-line summary of a tool call for the activity log.\n *\n * Returns a string like `$ git status` for Bash, `Read src/index.ts` for Read, etc.\n * Falls back to `ToolName({...input...})` for unrecognised tools.\n *\n * @param tool - Tool name (e.g. `\"Bash\"`, `\"Write\"`, `\"Grep\"`).\n * @param input - Tool input record passed to the call.\n * @returns A short display string suitable for the activity feed.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolCall(tool: string, input: Record<string, unknown>): string {\n  // A harness that sent a bare value instead of named args has it under `input`.\n  const arg = (key: string) => String(input[key] ?? input.input);\n  switch (tool) {\n    case \"Bash\":\n      return `$ ${String(input.command ?? input.input ?? \"\").slice(0, 200)}`;\n    case \"Write\":\n      return `Create ${arg(\"file_path\")}`;\n    case \"Edit\":\n      return `Edit ${arg(\"file_path\")}`;\n    case \"Read\":\n      return `Read ${arg(\"file_path\")}`;\n    case \"Glob\":\n      return `Find ${arg(\"pattern\")}`;\n    case \"Grep\":\n      return `Search for ${arg(\"pattern\")}`;\n    case \"ApplyPatch\": {\n      // Paths only: stringifying the input would serialize every full diff.\n      const changes = Array.isArray(input.changes) ? input.changes : [];\n      const paths = changes\n        .map((change) => (change as { path?: unknown } | null)?.path)\n        .filter((path): path is string => typeof path === \"string\");\n      return `Edit ${paths.join(\", \").slice(0, 200) || \"files\"}`;\n    }\n    default:\n      return `${tool}(${JSON.stringify(input).slice(0, 100)})`;\n  }\n}\n\n/**\n * Produce the plain-language label shown to non-technical users while a tool\n * call runs: the agent's own `activity_label`, Bash's `description`, else a\n * derived phrase for Claude Code built-ins. `undefined` for any other tool —\n * the UI then falls back to a generic \"working\" line rather than raw input.\n *\n * @param tool - Tool name as the model called it.\n * @param input - Tool input record, still carrying `activity_label`.\n * @returns A trimmed label capped at `TOOL_ACTIVITY_LABEL_MAX_CHARS`, or `undefined`.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function labelToolCall(tool: string, input: Record<string, unknown>): string | undefined {\n  const authored =\n    nonEmpty(input[TOOL_ACTIVITY_LABEL_PARAM]) ??\n    (tool === \"Bash\" ? nonEmpty(input.description) : undefined);\n  const label = authored ?? builtinToolLabel(tool, input);\n  if (!label) return undefined;\n  return label.length > TOOL_ACTIVITY_LABEL_MAX_CHARS\n    ? `${label.slice(0, TOOL_ACTIVITY_LABEL_MAX_CHARS - 1).trimEnd()}…`\n    : label;\n}\n\nfunction nonEmpty(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.replace(/\\s+/g, \" \").trim();\n  return trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction builtinToolLabel(tool: string, input: Record<string, unknown>): string | undefined {\n  switch (tool) {\n    case \"Read\":\n      return withTarget(\"Reading\", baseName(input.file_path));\n    case \"Edit\":\n    case \"MultiEdit\":\n    case \"NotebookEdit\":\n      return withTarget(\"Editing\", baseName(input.file_path ?? input.notebook_path));\n    case \"Write\":\n      return withTarget(\"Creating\", baseName(input.file_path));\n    case \"Grep\":\n    case \"Glob\":\n      return \"Searching files\";\n    case \"WebSearch\":\n      return \"Searching the web\";\n    case \"WebFetch\":\n      return withTarget(\"Fetching\", hostOf(input.url), \"a web page\");\n    case \"TodoWrite\":\n      return \"Updating the task list\";\n    case \"ApplyPatch\":\n      return \"Editing files\";\n    default:\n      return undefined;\n  }\n}\n\nfunction withTarget(verb: string, target: string | undefined, fallback = \"a file\"): string {\n  return `${verb} ${target ?? fallback}`;\n}\n\nfunction baseName(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n  return value.split(/[\\\\/]/).filter(Boolean).pop();\n}\n\nfunction hostOf(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  try {\n    return new URL(value).host || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Extract plain text from an Anthropic content-block array (e.g. tool results returned by Claude SDK). */\nfunction extractContentBlockText(blocks: unknown[]): string | null {\n  const textBlocks = blocks.filter(\n    (b): b is { type: \"text\"; text: string } =>\n      typeof b === \"object\" &&\n      b !== null &&\n      (b as Record<string, unknown>).type === \"text\" &&\n      typeof (b as Record<string, unknown>).text === \"string\",\n  );\n  if (textBlocks.length === 0) return null;\n  return textBlocks.map((b) => b.text).join(\"\\n\");\n}\n\n/**\n * Produce a human-readable one-line summary of a tool result for the activity log.\n *\n * Handles Bash stdout/stderr, Write/Edit file paths, ApplyPatch change counts, and\n * Anthropic content-block arrays. Falls back to `JSON.stringify` for unknown shapes.\n *\n * @param tool - Tool name.\n * @param result - Raw tool result payload.\n * @returns A short display string, truncated to 200 characters.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function summarizeToolResult(tool: string, result: unknown): string {\n  // Handle Anthropic content-block arrays: [{ type: \"text\", text: \"...\" }, ...]\n  if (Array.isArray(result)) {\n    const text = extractContentBlockText(result);\n    return (text ?? JSON.stringify(result)).slice(0, 200);\n  }\n  if (typeof result !== \"object\" || !result) {\n    return String(result).slice(0, 200);\n  }\n  const r = result as Record<string, unknown>;\n  switch (tool) {\n    case \"Bash\": {\n      const stderr = String(r.stderr ?? \"\").trim();\n      if (stderr) return `stderr: ${stderr.slice(0, 200)}`;\n      return (\n        String(r.stdout ?? \"\")\n          .trim()\n          .slice(0, 200) || \"(no output)\"\n      );\n    }\n    case \"Write\":\n      return `${String(r.type)}: ${String(r.filePath)}`;\n    case \"Edit\":\n      return `Edited ${String(r.filePath)}`;\n    case \"ApplyPatch\":\n      return `${Array.isArray(r.changes) ? r.changes.length : 0} file changes`;\n    default:\n      return JSON.stringify(result).slice(0, 200);\n  }\n}\n\n/**\n * Detect file-change events from a tool result, returning zero or more `file_changed` events.\n *\n * Handles `Write` (single create/edit), `Edit` (single edit), and `ApplyPatch` (multi-file\n * patch with per-change `kind` classification). Returns an empty array for all other tools.\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns Array of `file_changed` normalized events.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChanges(toolName: string, result: unknown): NormalizedEvent[] {\n  if (typeof result !== \"object\" || !result) return [];\n  const r = result as Record<string, unknown>;\n\n  if (toolName === \"Write\" && r.filePath) {\n    return [\n      {\n        type: \"file_changed\",\n        path: String(r.filePath),\n        action: r.type === \"create\" ? \"create\" : \"edit\",\n      },\n    ];\n  }\n  if (toolName === \"Edit\" && r.filePath) {\n    return [{ type: \"file_changed\", path: String(r.filePath), action: \"edit\" }];\n  }\n  if (toolName === \"ApplyPatch\" && Array.isArray(r.changes)) {\n    return r.changes\n      .filter(\n        (change): change is { path: string; kind: \"add\" | \"delete\" | \"update\" } =>\n          typeof change === \"object\" &&\n          change !== null &&\n          typeof (change as Record<string, unknown>).path === \"string\" &&\n          typeof (change as Record<string, unknown>).kind === \"string\",\n      )\n      .map((change) => ({\n        type: \"file_changed\" as const,\n        path: change.path,\n        action: change.kind === \"add\" ? \"create\" : change.kind === \"delete\" ? \"delete\" : \"edit\",\n      }));\n  }\n\n  return [];\n}\n\n/**\n * Backward-compatible single-event helper; returns the first `file_changed` event or `null`.\n *\n * Prefer {@link detectFileChanges} for multi-file patches (e.g. `ApplyPatch`).\n *\n * @param toolName - Name of the tool that produced the result.\n * @param result - Raw tool result payload.\n * @returns First detected `file_changed` event, or `null`.\n * @docLink packages/bridge/api-reference#normalizer\n */\nexport function detectFileChange(toolName: string, result: unknown): NormalizedEvent | null {\n  return detectFileChanges(toolName, result)[0] ?? null;\n}\n","/**\n * BridgeRuntime — implements IAgentRuntime from @skaile/workspaces/types by wrapping\n * an AgentHarness + EventNormalizer. This is the primary integration point for\n * consumers that want normalized events from any harness.\n */\n\nimport type {\n  AgentEvent,\n  AgentPromptInput,\n  AgentReconfigureOptions,\n  AgentRuntimeConfig,\n  IAgentRuntime,\n} from \"@skaile/workspaces/types\";\n\nimport { EventNormalizer } from \"./normalizer.js\";\nimport { toMergedRegistry } from \"./provider-registry-derive.js\";\nimport { createHarness } from \"./registry.js\";\nimport type { AgentConfig, AgentHarness } from \"./types.js\";\n\n/**\n * Implements `IAgentRuntime` from `@skaile/workspaces/types` by wrapping an {@link AgentHarness}\n * and an {@link EventNormalizer}.\n *\n * This is the primary integration point for consumers that want normalized `AgentEvent`\n * payloads from any harness without managing the harness lifecycle directly. Create via\n * {@link createRuntime} to avoid coupling to `BridgeRuntime` directly.\n *\n * @docLink packages/bridge/api-reference#runtime\n */\nexport class BridgeRuntime implements IAgentRuntime {\n  private harness: AgentHarness | null = null;\n  private normalizer = new EventNormalizer();\n  private handlers = new Set<(event: AgentEvent) => void>();\n  private boundEventHandler: ((event: any) => void) | null = null;\n  private harnessId: string;\n\n  constructor(harnessId: string = \"claude-sdk\") {\n    this.harnessId = harnessId;\n  }\n\n  async start(config: AgentRuntimeConfig): Promise<void> {\n    // Dispose previous harness if any\n    if (this.harness) {\n      await this.dispose();\n    }\n\n    this.normalizer.reset();\n\n    const bridgeConfig: AgentConfig = {\n      cwd: config.cwd,\n      model: config.model,\n      systemPrompt: config.systemPrompt,\n      env: config.env,\n      agentDir: config.agentDir,\n      sessionId: config.sessionId,\n      resumeSessionId: config.resumeSessionId,\n      maxTurns: config.maxTurns,\n      ...(config.registry ? { registry: toMergedRegistry(config.registry, \"runtime\") } : {}),\n      ...(config.modelRef ? { modelRef: config.modelRef } : {}),\n    };\n\n    this.harness = await createHarness(this.harnessId, bridgeConfig);\n\n    // Wire bridge events through normalizer to handlers\n    this.boundEventHandler = (bridgeEvent: any) => {\n      const normalized = this.normalizer.normalize(bridgeEvent);\n      for (const event of normalized) {\n        for (const handler of this.handlers) {\n          handler(event);\n        }\n      }\n    };\n    this.harness.on(\"agent-event\", this.boundEventHandler);\n\n    await this.harness.start();\n  }\n\n  async configure(_config: AgentReconfigureOptions): Promise<void> {\n    // Runtime reconfiguration for BridgeRuntime is a no-op for now.\n    // Future: reconnect connectors, reload ai-assets, update subagents.\n  }\n\n  async prompt(message: string): Promise<void> {\n    if (!this.harness) throw new Error(\"Runtime not started — call start() first\");\n    await this.harness.prompt(message);\n  }\n\n  async promptInput(input: AgentPromptInput): Promise<void> {\n    if (!this.harness) throw new Error(\"Runtime not started — call start() first\");\n    await this.harness.promptInput(input);\n  }\n\n  async reply(answer: string, question?: string, requestId?: string): Promise<void> {\n    if (!this.harness) throw new Error(\"Runtime not started — call start() first\");\n    // Mirror serve.ts handleReply: an answer must resume the paused turn. Falling through to\n    // prompt() would deny the question as superseded and drop the structured answer.\n    if (\n      this.harness?.hasPendingQuestion() &&\n      this.harness.answerQuestion(answer, question, requestId)\n    )\n      return;\n    if (this.harness?.acceptsReplyAsPrompt) await this.prompt(answer);\n  }\n\n  async abort(): Promise<void> {\n    if (this.harness) {\n      await this.harness.abort();\n    }\n  }\n\n  async dispose(): Promise<void> {\n    if (this.harness) {\n      if (this.boundEventHandler) {\n        this.harness.off(\"agent-event\", this.boundEventHandler);\n        this.boundEventHandler = null;\n      }\n      this.harness.kill();\n      this.harness = null;\n    }\n    this.normalizer.reset();\n  }\n\n  onEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.add(handler);\n  }\n\n  offEvent(handler: (event: AgentEvent) => void): void {\n    this.handlers.delete(handler);\n  }\n\n  get isRunning(): boolean {\n    return this.harness?.isRunning ?? false;\n  }\n}\n\n/**\n * Factory function to create a {@link BridgeRuntime} with the specified harness.\n *\n * @param harnessId - Registered harness id (default: `\"claude-sdk\"`).\n * @returns A new `IAgentRuntime` wrapping the selected harness with event normalization.\n * @docLink packages/bridge/api-reference#runtime\n */\nexport function createRuntime(harnessId: string = \"claude-sdk\"): IAgentRuntime {\n  return new BridgeRuntime(harnessId);\n}\n","/** Provider API key validation — hits each provider's models endpoint to verify the key works. */\n\nimport {\n  buildCredentialHeaders,\n  expandPreset,\n  getProviderPreset,\n  resolvePresetBaseUrl,\n  resolveProbeUrl,\n} from \"./provider-catalog.js\";\n\n/**\n * Result of an API key validation check performed by {@link validateApiKey}.\n *\n * @docLink packages/bridge/api-reference#validation\n */\nexport interface ValidationResult {\n  /** `true` when the API key was accepted by the provider's models endpoint. */\n  ok: boolean;\n  /** Human-readable error description when `ok` is `false`. */\n  error?: string;\n}\n\n/**\n * Validate an API key by sending a lightweight GET request to the provider's models endpoint.\n *\n * Returns `{ ok: true }` when the provider accepts the key (HTTP 2xx). Returns\n * `{ ok: false, error }` on 401/403 (invalid key), other HTTP errors, network failures,\n * or unsupported providers. Requests time out after 8 seconds.\n *\n * @param provider - Catalog preset id (e.g. `\"anthropic\"`, `\"openai\"`, `\"google\"`).\n * @param key - API key to validate.\n * @param options - Optional base-URL / environment overrides; defaults to the\n *   provider's own API, or its `base_url_env` value when one is set.\n * @returns Validation result with optional error description.\n * @docLink packages/bridge/api-reference#validation\n */\nexport async function validateApiKey(\n  provider: string,\n  key: string,\n  options: { baseUrl?: string; env?: Record<string, string | undefined> } = {},\n): Promise<ValidationResult> {\n  const preset = getProviderPreset(provider);\n  if (!preset) return { ok: false, error: `Unknown provider: ${provider}` };\n\n  // Validate against the same endpoint discovery/dispatch use: behind a gateway\n  // the key is the gateway's, and the provider's public API would reject it.\n  const baseUrl = resolvePresetBaseUrl(preset, {\n    ...(options.baseUrl ? { baseUrl: options.baseUrl } : {}),\n    env: options.env ?? process.env,\n  });\n  const entry = expandPreset(preset, baseUrl ? { baseUrl } : {});\n  const url = resolveProbeUrl(entry);\n  if (!url) return { ok: false, error: `Provider ${provider} exposes no models endpoint` };\n  // Static non-secret headers (Anthropic's `anthropic-version`) plus the\n  // credential carrier the preset's `auth_header` names.\n  const headers = { ...entry.headers, ...buildCredentialHeaders(entry, key) };\n\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), 8000);\n\n    const response = await fetch(url, {\n      method: \"GET\",\n      headers,\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeout);\n\n    if (response.ok) return { ok: true };\n\n    const status = response.status;\n    if (status === 401 || status === 403) {\n      return { ok: false, error: \"Invalid API key (authentication failed)\" };\n    }\n    return { ok: false, error: `API returned HTTP ${status}` };\n  } catch (err: any) {\n    if (err.name === \"AbortError\") return { ok: false, error: \"Request timed out (8s)\" };\n    return { ok: false, error: err.message ?? \"Network error\" };\n  }\n}\n"]}

package/dist/chunk-7XSAW5OC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../library/src/install/install-from-manifest.ts"],"names":[],"mappings":";;;;;;AAgDO,SAAS,sBAAA,CAAuB,aAAqB,CAAA,EAAiB;AAC3E,EAAA,MAAM,MAAM,MAAa;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,CAAC,CAAA,CAAE,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,IAAI,CAAC,CAAA,IAAK,CAAA,CAAE,MAAA,KAAW,GAAG,GAAA,EAAI;AAC9B,EAAA,IAAI,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,GAAA,EAAI;AAClE,EAAA,MAAM,QAAA,GAAW,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,IAAI,GAAG,GAAA,EAAI;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,EAAa,CAAC,CAAA;AACvC,EAAA,IAAI,QAAA,KAAa,eAAe,CAAC,QAAA,CAAS,WAAW,WAAA,GAAc,GAAG,GAAG,GAAA,EAAI;AAC/E;AAgBA,SAAS,sBAAA,CAAuB,MAAc,KAAA,EAAqB;AAIjE,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,EAAI,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,UAAA,CAAW,GAAG,KAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,IAAK,cAAA,EAAgB;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAI,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACF;AAcO,SAAS,uBAAuB,KAAA,EAAkC;AACvE,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAC9D,EAAA,IAAI,MAAA,GAAS,YAAY,CAAC,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,WAAA,CAAY,UAAU,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AAChE,IAAA,MAAM,IAAA,GAAO,YAAY,CAAC,CAAA;AAC1B,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,MAAA,CAAO,MAAA,IAAU,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,CAAC,CAAA,KAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAA;AACtE,IAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxB;AAsDA,eAAsB,oBAAoB,IAAA,EAA2C;AACnF,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,IAAA;AAClC,EAAA,MAAM,UACJ,IAAA,CAAK,OAAA,IAAA,CAAY,MAAM,OAAO,mCAA0B,CAAA,EAAG,yBAAA;AAK7D,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AAAA,EACtD;AAQA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,aAAA,CAAc,SAAS,GAAG,CAAA;AAAA,EACrC,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,EAAA,EAAK,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA;AACvB,EAAA,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,oBAAA,CAAsB,CAAA;AAClF,EAAA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,QAAA,CAAS,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAClF,EAAA,sBAAA,CAAuB,aAAa,SAAS,CAAA;AAC7C,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,sBAAA,CAAuB,WAAW,OAAO,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,QAAQ,IAAA,CAAK,IAAA,EAAM,IAAI,SAAS,CAAA,CAAA,EAAI,IAAA,EAAM,OAAO,CAAC,CAAA;AAGtE,EAAA,IAAI,gBAAgB,IAAA,IAAQ,CAAC,YAAY,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,QAAA,CAAS,GAAG,CAAA,mCAAA,CAAqC,CAAA;AAAA,EAChG;AAKA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAAA,EAC5C;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAID,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,WAAA,EAAa,EAAE,IAAI,CAAA;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,QAAA,CAAS,KAAK,CAAA;AACtD,EAAA,IAAI,eAAA,KAAoB,SAAS,MAAA,EAAQ;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,MAAA,EAAS,eAAe,CAAA,CAAE,CAAA;AAAA,EAChG;AAMA,EAAA,MAAM,GAAG,WAAA,EAAa,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,EAAa,CAAA,CAAE,IAAI,CAAA;AACvC,MAAA,MAAM,MAAM,OAAA,CAAQ,MAAM,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAA,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAA,CAAM,CAAA,CAAE,IAAI,CAAE,CAAA;AAAA,IACxC;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,EAAA,CAAG,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AACtE,IAAA,MAAM,CAAA;AAAA,EACR;AAEA,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AASA,eAAe,WAAA,CACb,QAAA,EACA,SAAA,EACA,OAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS,QAAQ,SAAS,CAAA;AAGhC,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,sBAAA,CAAuB,MAAA,EAAQ,EAAE,IAAI,CAAA;AAAA,EACvC;AAGA,EAAA,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,IAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,IACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,IAC3B;AAAA,GACD,CAAA;AAKD,EAAA,MAAM,SAAA,GAAY,uBAAuB,KAAK,CAAA;AAE9C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAS,KAAA,EAAO;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AACxB,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,EAAE,MAAA,EAAQ;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,cAAc,CAAA,CAAE,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,YAAY,CAAA,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,CAAE,IAAA;AAEnE,IAAA,sBAAA,CAAuB,QAAQ,OAAO,CAAA;AACtC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAA;AACjC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,MAAM,SAAA,CAAU,MAAM,GAAG,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAC/B","file":"chunk-7XSAW5OC.js","sourcesContent":["/**\n * Pointer-only install path.\n *\n * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands\n * clients), this:\n *\n *   1. fetches the asset bytes directly from the upstream repo at the pinned\n *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});\n *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;\n *   3. verifies the composite SHA256 rollup over the sorted\n *      `<path>:<sha256>\\n` lines against `manifest.sha256`;\n *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.\n *\n * Any hash mismatch is a hard failure — bytes are not written if per-file\n * verification fails, and the composite check is the second gate.\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseAssetRef } from \"../../../core/src/models.js\";\nimport { compositeSha256 } from \"../../../core/src/publish-manifest.js\";\n\n/**\n * Validate a single manifest-supplied file path against path traversal.\n *\n * `manifest.files[].path` comes off the network — the attacker controls the\n * entire manifest (and therefore every hash in it), so hash verification can\n * NEVER mitigate a malicious *destination*. A path like\n * `../../../../home/user/.bashrc` or an absolute path would escape\n * `installPath` and yield an arbitrary file write. Every path is checked\n * BEFORE any fetch or write happens; the first bad path aborts the entire\n * install with a hard throw.\n *\n * A path is rejected if ANY of:\n *   - it is empty;\n *   - it is absolute (`path.isAbsolute`) or has a leading slash;\n *   - it contains a `..` segment;\n *   - `path.resolve(installPath, p)` is not `installPath` itself and does not\n *     start with `installPath + path.sep` (escapes the install dir).\n *\n * @throws An error matching `/unsafe path in manifest/` on the first bad path.\n */\nexport function assertSafeManifestPath(installPath: string, p: string): void {\n  const bad = (): never => {\n    throw new Error(`unsafe path in manifest: ${p}`);\n  };\n  if (!p || p.length === 0) bad();\n  if (isAbsolute(p) || p.startsWith(\"/\") || p.startsWith(\"\\\\\")) bad();\n  const segments = p.split(/[/\\\\]/);\n  if (segments.some((s) => s === \"..\")) bad();\n  const resolved = resolve(installPath, p);\n  if (resolved !== installPath && !resolved.startsWith(installPath + sep)) bad();\n}\n\n/**\n * Validate one component (publisher / name / version) of the attacker-controlled\n * `manifest.ref`.\n *\n * `installPath` is built by joining these components onto `libraryRoot`. A\n * component containing a path separator or a `..` / leading-dot segment would\n * let `installPath` itself escape `libraryRoot` — yielding an arbitrary file\n * write AND, via the pre-write `rm(installPath, { recursive })`, an arbitrary\n * recursive delete. The per-file `assertSafeManifestPath` guard cannot catch\n * this: it only validates each `f.path` *relative to* `installPath`, never\n * `installPath` itself. Components must be plain identifier-like strings.\n *\n * @throws An error matching `/unsafe ref/` on a bad component.\n */\nfunction assertSafeRefComponent(kind: string, value: string): void {\n  // Reject empty, leading-dot (covers `.` and `..`), path separators, and\n  // ASCII control characters (NUL et al.) — fails a malformed segment fast\n  // with a domain-specific error rather than a raw EINVAL deeper in.\n  const hasControlChar = [...value].some((c) => c.charCodeAt(0) < 0x20);\n  if (!value || value.startsWith(\".\") || /[/\\\\]/.test(value) || hasControlChar) {\n    throw new Error(`unsafe ref ${kind} component in manifest: '${value}'`);\n  }\n}\n\n/**\n * Longest common **directory** prefix across manifest paths, compared by whole\n * slash-delimited segments (never raw-string — so `app/` and `app-data/` never\n * collide). Each path's basename is excluded, so the result is always a\n * directory prefix and every path keeps a non-empty remainder after stripping.\n *\n * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:\n * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)\n * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,\n * so this prefix is stripped from the WRITE path while the fetch keeps the full\n * repo path. Returns `''` when there is no common directory (a no-op strip).\n */\nexport function longestCommonDirPrefix(paths: readonly string[]): string {\n  if (paths.length === 0) return \"\";\n  const dirSegments = paths.map((p) => p.split(\"/\").slice(0, -1));\n  let common = dirSegments[0]!;\n  for (let i = 1; i < dirSegments.length && common.length > 0; i++) {\n    const segs = dirSegments[i]!;\n    let n = 0;\n    while (n < common.length && n < segs.length && common[n] === segs[n]) n++;\n    common = common.slice(0, n);\n  }\n  return common.join(\"/\");\n}\n\n/**\n * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at\n * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default\n * production implementation; tests inject a mock.\n */\nexport type AssetFetcher = (opts: {\n  url: string;\n  commitSha: string;\n  paths: string[];\n}) => Promise<Record<string, Buffer>>;\n\n/**\n * Options for {@link installFromManifest}.\n */\nexport interface InstallOpts {\n  /** The pointer-only install manifest from the Catalog. */\n  manifest: InstallManifest;\n  /** Filesystem root the asset is installed under (ref-derived mode). */\n  libraryRoot: string;\n  /**\n   * Pluggable fetcher so tests can inject mock data. Defaults to\n   * {@link fetchAssetFilesFromGitHub} in production.\n   */\n  fetcher?: AssetFetcher;\n  /**\n   * Flat-layout mode. When set, install-core reproduces the platform\n   * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does\n   * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips\n   * the longest-common-dir prefix from each path, per-file sha256-verifies, and\n   * writes the stripped paths as immediate children of `targetDir` (what the\n   * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is\n   * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`\n   * layout with composite verify.\n   */\n  targetDir?: string;\n}\n\n/**\n * Result of a successful {@link installFromManifest} call.\n */\nexport interface InstallResult {\n  /** Absolute path the asset files were written to. */\n  installPath: string;\n}\n\n/**\n * Fetch, verify, and write an asset's files per its {@link InstallManifest}.\n *\n * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.\n * @throws An error matching `/composite hash mismatch/i` if the rollup differs.\n * @throws An error if the ref is malformed or the fetcher omits a file.\n */\nexport async function installFromManifest(opts: InstallOpts): Promise<InstallResult> {\n  const { manifest, libraryRoot } = opts;\n  const fetcher =\n    opts.fetcher ?? (await import(\"./source-fetch-github.js\")).fetchAssetFilesFromGitHub;\n\n  // Flat mode: reproduce the platform pointer-installer's asset-rooted layout.\n  // No ref parse, no composite verify — the platform store may not satisfy a\n  // ref-grammar or composite, and the runner only needs immediate-child files.\n  if (opts.targetDir !== undefined) {\n    return installFlat(manifest, opts.targetDir, fetcher);\n  }\n\n  // 1. Parse ref into install path: `skill:@x/git#1.0.0` → `<root>/@x/git/1.0.0`.\n  // Done first so the C1 path-traversal guard can resolve against installPath\n  // BEFORE any network fetch happens. The ref is attacker-controlled, so each\n  // segment is further validated as a safe path component (H1) after parsing.\n  // `parseAssetRef` is the single canonical grammar (`kind:@publisher/name#version`);\n  // the legacy trailing-`@version` shape was removed in core and is rejected here.\n  let parsed: ReturnType<typeof parseAssetRef>;\n  try {\n    parsed = parseAssetRef(manifest.ref);\n  } catch (e) {\n    throw new Error(`invalid ref: ${manifest.ref}: ${e instanceof Error ? e.message : String(e)}`);\n  }\n  const publisher = parsed.publisher;\n  const name = parsed.name;\n  const version = parsed.pin;\n  if (!publisher) throw new Error(`invalid ref: ${manifest.ref} (missing publisher)`);\n  if (!version) throw new Error(`invalid ref: ${manifest.ref} (missing version pin)`);\n  assertSafeRefComponent(\"publisher\", publisher);\n  assertSafeRefComponent(\"name\", name);\n  assertSafeRefComponent(\"version\", version);\n  const root = resolve(libraryRoot);\n  const installPath = resolve(join(root, `@${publisher}`, name, version));\n  // Defense in depth: even with the segment guards above, assert the built\n  // installPath stays strictly inside libraryRoot before any write or `rm`.\n  if (installPath !== root && !installPath.startsWith(root + sep)) {\n    throw new Error(`unsafe install path: ref '${manifest.ref}' resolves outside the library root`);\n  }\n\n  // 2. [C1] Validate EVERY manifest path against traversal BEFORE fetching.\n  // The attacker controls the manifest (and thus all hashes) — hashes verify\n  // content, never destination. Reject the whole install on the first bad path.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n  }\n\n  // 3. Fetch all files at the pinned commit.\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // 4. Verify per-file SHA256 — hard fail before writing anything. The path\n  // key used to read from the fetcher result is re-guarded as defense in depth.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(installPath, f.path);\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n  }\n\n  // 5. Verify composite SHA256 over the sorted `<path>:<sha256>\\n` lines.\n  const actualComposite = compositeSha256(manifest.files);\n  if (actualComposite !== manifest.sha256) {\n    throw new Error(`composite hash mismatch: expected ${manifest.sha256}, got ${actualComposite}`);\n  }\n\n  // 6. [M1] Write all verified files. A failed install must leave NO partial\n  // directory: any prior `installPath` is removed first (clean overwrite), and\n  // a mid-loop write failure removes the partially-written tree before\n  // rethrowing.\n  await rm(installPath, { recursive: true, force: true });\n  try {\n    for (const f of manifest.files) {\n      const target = join(installPath, f.path);\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, bytes[f.path]!);\n    }\n  } catch (e) {\n    await rm(installPath, { recursive: true, force: true }).catch(() => {});\n    throw e;\n  }\n\n  return { installPath };\n}\n\n/**\n * Flat-layout install — the platform pointer-installer's behavior, made canonical\n * in install-core. Validates every path, fetches with the FULL repo paths, per-file\n * sha256-verifies, then strips the longest-common-dir prefix and writes each file\n * as `join(targetDir, path.slice(assetRoot.length + 1))` — immediate children of\n * `targetDir`. No ref parse, no composite check.\n */\nasync function installFlat(\n  manifest: InstallManifest,\n  targetDir: string,\n  fetcher: AssetFetcher,\n): Promise<InstallResult> {\n  const target = resolve(targetDir);\n\n  // Gate every path before any fetch — the attacker controls the whole manifest.\n  for (const f of manifest.files) {\n    assertSafeManifestPath(target, f.path);\n  }\n\n  // Fetch keys off the FULL repo path (matches the upstream tree).\n  const paths = manifest.files.map((f) => f.path);\n  const bytes = await fetcher({\n    url: manifest.source.url,\n    commitSha: manifest.source.commitSha,\n    paths,\n  });\n\n  // Strip the asset-root dir prefix from the WRITE path only — the fetch above\n  // still keyed off the full repo path. Stripping removes leading whole segments\n  // (never the basename), so a non-empty remainder always survives.\n  const assetRoot = longestCommonDirPrefix(paths);\n\n  for (const f of manifest.files) {\n    const buf = bytes[f.path];\n    if (!buf) throw new Error(`fetcher returned no bytes for ${f.path}`);\n    const actual = createHash(\"sha256\").update(buf).digest(\"hex\");\n    if (actual !== f.sha256) {\n      throw new Error(`hash mismatch for ${f.path}: expected ${f.sha256}, got ${actual}`);\n    }\n    const relPath = assetRoot ? f.path.slice(assetRoot.length + 1) : f.path;\n    // Re-guard the post-strip destination — it is what we actually write.\n    assertSafeManifestPath(target, relPath);\n    const dest = join(target, relPath);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, buf);\n  }\n\n  return { installPath: target };\n}\n"]}

package/dist/chunk-BFMYYNDT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../library/src/install/source-fetch-github.ts"],"names":[],"mappings":";;;AAmBO,IAAM,cAAA,GAAiB;AAsB9B,SAAS,UAAU,GAAA,EAA8C;AAI/D,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,0DAA0D,CAAA;AAC9E,EAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AACxD,EAAA,OAAO,EAAE,OAAO,CAAA,CAAE,CAAC,GAAI,IAAA,EAAM,CAAA,CAAE,CAAC,CAAA,EAAG;AACrC;AAYA,eAAsB,0BAA0B,IAAA,EAAkD;AAMhG,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mDAAA,EAAsD,KAAK,SAAS,CAAA,uDAAA;AAAA,KAEtE;AAAA,EACF;AACA,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,SAAA,CAAU,KAAK,GAAG,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAC,CAAA;AAKlD,EAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,MAAA,EAAQ;AAC5B,IAAA,OAAO,gBAAA,CAAiB,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,CAAA;AAAA,EACvF;AAGA,EAAA,MAAM,KAAA,GAAQ,EAAE,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAG,MAAM,MAAM;AAAA,EAAC,CAAA,EAAG,MAAM,MAAM;AAAA,EAAC,CAAA,EAAG,OAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACjF,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,IAAW,IAAI,OAAA,CAAQ,EAAE,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAAG,GAAA,EAAK,OAAO,CAAA;AAE1F,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ;AAAA,MACjC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAU,IAAA,CAAK,SAAA;AAAA,MACf,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AAIV,IAAA,IAAK,CAAA,CAA0B,WAAW,GAAA,EAAK;AAC7C,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,gBAAA,CAAiB;AAAA,UAC5B,KAAA;AAAA,UACA,IAAA;AAAA,UACA,WAAW,IAAA,CAAK,SAAA;AAAA,UAChB,OAAO,IAAA,CAAK;AAAA,SACb,CAAA;AAAA,MACH,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,oCAAoC,IAAA,CAAK,SAAS,KAAK,mBAAA,CAAoB,CAAA,EAAG,MAAM,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oCAAoC,IAAA,CAAK,SAAS,KAAK,mBAAA,CAAoB,CAAA,EAAG,MAAM,CAAC,CAAA;AAAA,KACvF;AAAA,EACF;AAGA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM;AACjC,IAAA,IAAI,KAAK,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,IAAA,IAAQ,KAAK,GAAA,EAAK;AACjD,MAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,GAAG,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,OAAA,EAAS;AAKZ,MAAA,IAAI,IAAA,CAAK,KAAK,SAAA,EAAW;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,8DAAA,EAA4D,KAAK,SAAS,CAAA;AAAA,SAC5E;AAAA,MACF;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+BAAA,EAAkC,IAAI,CAAA,CAAE,CAAA;AAAA,IAC1D;AACA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,EAAE,KAAA,EAAO,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,CAAA;AAAA,IACvE,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,yBAAA,EAA4B,IAAI,KAAK,mBAAA,CAAoB,CAAA,EAAG,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,IACvF;AAGA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,QAAA,KAAa,QAAA,EAAU;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kBAAA,EAAqB,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAK,QAAQ,CAAA,oBAAA;AAAA,OAC3E;AAAA,IACF;AACA,IAAA,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA,CAAO,KAAK,IAAA,CAAK,IAAA,CAAK,SAAS,QAAQ,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,MAAA;AACT;AAGA,IAAM,sBAAA,GAAyB,GAAA;AAE/B,IAAM,eAAA,GAAkB,CAAA;AAMxB,SAAS,mBAAA,CAAoB,GAAY,MAAA,EAAyB;AAChE,EAAA,MAAM,GAAA,GAAM,CAAA;AAKZ,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,IAAA,OAAO,MAAA,GACH,CAAA,EAAG,cAAc,CAAA,4EAAA,CAAA,GACjB,uDAAA;AAAA,EACN;AACA,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,QAAA,EAAU,OAAA,IAAW,EAAC;AAC1C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,OAAA,CAAQ,uBAAuB,CAAC,CAAA,KAAM,GAAA;AAC/D,EAAA,IACE,GAAA,CAAI,MAAA,KAAW,GAAA,IACd,GAAA,CAAI,MAAA,KAAW,GAAA,KAAQ,SAAA,IAAa,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,CAAA,EACzE;AACA,IAAA,OAAO,gBAAA,CAAiB,OAAA,CAAQ,mBAAmB,CAAA,EAAG,MAAM,CAAA;AAAA,EAC9D;AACA,EAAA,OAAO,GAAA,CAAI,OAAA,IAAW,MAAA,CAAO,CAAC,CAAA;AAChC;AAEA,SAAS,gBAAA,CAAiB,OAAoC,MAAA,EAAyB;AACrF,EAAA,MAAM,EAAA,GAAK,OAAO,KAAK,CAAA;AACvB,EAAA,MAAM,IAAA,GACJ,MAAA,CAAO,QAAA,CAAS,EAAE,KAAK,EAAA,GAAK,CAAA,GAAI,CAAA,SAAA,EAAY,IAAI,KAAK,EAAA,GAAK,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,CAAA,GAAM,EAAA;AACrF,EAAA,OAAO,SACH,CAAA,0BAAA,EAA6B,IAAI,yBACjC,CAAA,0BAAA,EAA6B,IAAI,SAAS,cAAc,CAAA,8BAAA,CAAA;AAC9D;AAOA,eAAe,iBAAiB,IAAA,EAKI;AAClC,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,IAAA,CAAK,KAAK,CAAA;AAC5B,EAAA,MAAM,SAAS,YAA2B;AACxC,IAAA,KAAA,IAAS,IAAA,GAAO,MAAM,KAAA,EAAM,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,KAAA,CAAM,KAAA,EAAM,EAAG;AACvE,MAAA,MAAM,MACJ,CAAA,kCAAA,EAAqC,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,CAAA,CAAA,GAC9E,IAAA,CAAK,MAAM,GAAG,CAAA,CAAE,IAAI,kBAAkB,CAAA,CAAE,KAAK,GAAG,CAAA;AAClD,MAAA,IAAI,GAAA;AACJ,MAAA,IAAI;AACF,QAAA,GAAA,GAAM,MAAM,MAAM,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,sBAAsB,CAAA,EAAG,CAAA;AAAA,MAChF,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,KAAA,GAAS,CAAA,CAAoC,KAAA,EAAO,IAAA,IAAS,CAAA,CAAY,OAAA;AAC/E,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,yBAAA,EAA4B,IAAI,CAAA,iCAAA,EAAoC,KAAK,CAAA;AAAA,SAC3E;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,+BAAA,EAAkC,IAAI,CAAA,SAAA,EAAY,IAAA,CAAK,SAAS,CAAA,IAAA,EAAO,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,uBAAA,EACpE,cAAc,CAAA,CAAA;AAAA,SAC1C;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,QAAA,MAAM,QAAQ,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AACnD,QAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,KAAK,KAAK,KAAA,GAAQ,CAAA,GAAI,CAAA,WAAA,EAAc,KAAK,CAAA,GAAA,CAAA,GAAQ,EAAA;AAC9E,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,4BAAA,EAA+B,IAAI,CAAA,MAAA,EAAS,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,SAAS,cAAc,CAAA,kBAAA;AAAA,SACtF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,IAAI,CAAA,kBAAA,EAAqB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACnF;AACA,MAAA,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA,CAAO,KAAK,MAAM,GAAA,CAAI,aAAa,CAAA;AAAA,IACpD;AAAA,EACF,CAAA;AACA,EAAA,MAAM,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,KAAA,CAAM,MAAM,CAAA,EAAE,EAAG,MAAM,CAAC,CAAA;AACzF,EAAA,OAAO,MAAA;AACT","file":"chunk-BFMYYNDT.js","sourcesContent":["/**\n * GitHub asset-byte fetcher for the pointer-only install path.\n *\n * Given an upstream repo URL and a pinned commit SHA, walks the recursive\n * git tree at that commit and fetches the blob bytes for each requested path.\n * The Catalog never serves asset bytes — it only hands clients the Pointer\n * Triple (`source.url` + `source.commitSha` + per-file `{path, sha256}`),\n * and `installFromManifest` verifies every byte against those hashes.\n *\n * Authentication: an optional GitHub PAT is read from the `SKAILE_GITHUB_PAT`\n * environment variable when no `octokit` instance is injected. Public repos\n * work unauthenticated (subject to GitHub's anonymous rate limit).\n *\n * @docLink packages/library/concepts#install\n */\n\nimport { Octokit } from \"@octokit/rest\";\n\n/** GitHub PAT environment variable used when no Octokit is injected. */\nexport const GITHUB_PAT_ENV = \"SKAILE_GITHUB_PAT\";\n\n/**\n * Options for {@link fetchAssetFilesFromGitHub}.\n */\nexport interface FetchOpts {\n  /** Upstream repo URL (e.g. `https://github.com/skaile-ai/skaile-ai-assets`). */\n  url: string;\n  /** Immutable 40-char git commit SHA the asset version was pinned at. */\n  commitSha: string;\n  /** Repo-relative paths to fetch. */\n  paths: string[];\n  /** Optional Octokit instance — injectable for tests. */\n  octokit?: Octokit;\n}\n\n/**\n * Parse `{ owner, repo }` out of a GitHub repo URL.\n *\n * Accepts both HTTPS (`https://github.com/owner/repo[.git]`) and SCP-style\n * SSH (`git@github.com:owner/repo[.git]`) forms.\n */\nfunction parseRepo(url: string): { owner: string; repo: string } {\n  // Repo names may contain dots (e.g. `skaile-ai/www.skaile.ai`). Capture the\n  // full repo segment up to a path separator / end-of-string, and strip an\n  // optional trailing `.git` suffix only.\n  const m = url.match(/github\\.com[/:]([^/]+)\\/([^/]+?)(?:\\.git)?(?:[/#?].*)?$/i);\n  if (!m) throw new Error(`unsupported source URL: ${url}`);\n  return { owner: m[1]!, repo: m[2]! };\n}\n\n/**\n * Fetch the bytes of each requested path from a GitHub repo at a pinned commit.\n *\n * Reads the recursive git tree at `commitSha`, maps each blob path to its blob\n * SHA, then fetches each requested path's blob and base64-decodes it.\n *\n * @returns A `{ path → Buffer }` map covering every requested path.\n * @throws An error whose message matches `/unreachable/i` if the tree cannot\n *   be read or any requested path is absent from the tree.\n */\nexport async function fetchAssetFilesFromGitHub(opts: FetchOpts): Promise<Record<string, Buffer>> {\n  // The pointer-only integrity model depends on `commitSha` being an immutable\n  // git commit SHA. GitHub's tree API also accepts branch/tag names, which\n  // would produce a mutable fetch and a non-pinned `Instance.sourceCommitSha` —\n  // silently breaking the auditable/re-verifiable guarantee. Reject anything\n  // that is not exactly 40 hex characters.\n  if (!/^[0-9a-f]{40}$/i.test(opts.commitSha)) {\n    throw new Error(\n      `pinned commit must be a 40-character hex SHA, got '${opts.commitSha}' — ` +\n        \"a branch or tag would make the install mutable\",\n    );\n  }\n  const { owner, repo } = parseRepo(opts.url);\n  const hasPat = Boolean(process.env[GITHUB_PAT_ENV]);\n  // Anonymous reads of a public repo go to the raw-content host: one request per file, and\n  // none counts against the 60-calls-per-hour anonymous limit of the REST API (the tree +\n  // blob route spent about six API calls per skill). A token, or an injected Octokit, uses\n  // the API (a private repo is only readable there).\n  if (!opts.octokit && !hasPat) {\n    return fetchFromRawHost({ owner, repo, commitSha: opts.commitSha, paths: opts.paths });\n  }\n  // Octokit logs every failed request (`GET /repos/... - 401 with id ...`) through its\n  // default console logger; the thrown error below is the one message the user gets.\n  const quiet = { debug: () => {}, info: () => {}, warn: () => {}, error: () => {} };\n  const octo = opts.octokit ?? new Octokit({ auth: process.env[GITHUB_PAT_ENV], log: quiet });\n\n  let tree: Awaited<ReturnType<typeof octo.rest.git.getTree>>;\n  try {\n    tree = await octo.rest.git.getTree({\n      owner,\n      repo,\n      tree_sha: opts.commitSha,\n      recursive: \"true\",\n    });\n  } catch (e) {\n    // A rejected token (a stale or mistyped `SKAILE_GITHUB_PAT`) must not fail a public repo:\n    // the raw-content host needs no token. A private repo is a 404 there, and the error then\n    // says the token was the problem.\n    if ((e as { status?: number }).status === 401) {\n      try {\n        return await fetchFromRawHost({\n          owner,\n          repo,\n          commitSha: opts.commitSha,\n          paths: opts.paths,\n        });\n      } catch {\n        throw new Error(\n          `unreachable: cannot read tree at ${opts.commitSha}: ${describeGitHubError(e, hasPat)}`,\n        );\n      }\n    }\n    throw new Error(\n      `unreachable: cannot read tree at ${opts.commitSha}: ${describeGitHubError(e, hasPat)}`,\n    );\n  }\n\n  // path → blob SHA\n  const byPath = new Map<string, string>();\n  for (const node of tree.data.tree) {\n    if (node.type === \"blob\" && node.path && node.sha) {\n      byPath.set(node.path, node.sha);\n    }\n  }\n\n  const result: Record<string, Buffer> = {};\n  for (const path of opts.paths) {\n    const blobSha = byPath.get(path);\n    if (!blobSha) {\n      // [H1] A recursive tree listing is truncated for large repos\n      // (`data.truncated: true`). A path missing from a truncated listing is\n      // not necessarily absent from the repo — surface a distinct, accurate\n      // error rather than the misleading \"path not in tree\".\n      if (tree.data.truncated) {\n        throw new Error(\n          `tree truncated — repo too large for recursive listing at ${opts.commitSha}`,\n        );\n      }\n      throw new Error(`unreachable: path not in tree: ${path}`);\n    }\n    let blob: Awaited<ReturnType<typeof octo.rest.git.getBlob>>;\n    try {\n      blob = await octo.rest.git.getBlob({ owner, repo, file_sha: blobSha });\n    } catch (e) {\n      throw new Error(`unreachable: cannot read ${path}: ${describeGitHubError(e, hasPat)}`);\n    }\n    // [L2] GitHub returns `encoding: \"none\"` (with empty content) for blobs\n    // larger than ~1MB. Only base64 is decodable here — fail loudly otherwise.\n    if (blob.data.encoding !== \"base64\") {\n      throw new Error(\n        `unreachable: blob ${path} has unsupported encoding '${blob.data.encoding}' (likely too large)`,\n      );\n    }\n    result[path] = Buffer.from(blob.data.content, \"base64\");\n  }\n  return result;\n}\n\n/** Per-request ceiling for the raw-content host. */\nconst RAW_REQUEST_TIMEOUT_MS = 30_000;\n/** Files fetched at once from the raw-content host. */\nconst RAW_CONCURRENCY = 8;\n\n/**\n * The text for a failed GitHub API call. An exhausted rate limit names the fix\n * (`SKAILE_GITHUB_PAT`) and when the window resets; any other error keeps GitHub's message.\n */\nfunction describeGitHubError(e: unknown, hasPat: boolean): string {\n  const err = e as {\n    status?: number;\n    message?: string;\n    response?: { headers?: Record<string, string | number | undefined> };\n  };\n  if (err.status === 401) {\n    return hasPat\n      ? `${GITHUB_PAT_ENV} is set but GitHub rejected it (401 Bad credentials); unset it or replace it`\n      : \"GitHub rejected the credentials (401 Bad credentials)\";\n  }\n  const headers = err.response?.headers ?? {};\n  const exhausted = String(headers[\"x-ratelimit-remaining\"]) === \"0\";\n  if (\n    err.status === 429 ||\n    (err.status === 403 && (exhausted || /rate limit/i.test(err.message ?? \"\")))\n  ) {\n    return rateLimitMessage(headers[\"x-ratelimit-reset\"], hasPat);\n  }\n  return err.message ?? String(e);\n}\n\nfunction rateLimitMessage(reset: string | number | undefined, hasPat: boolean): string {\n  const at = Number(reset);\n  const when =\n    Number.isFinite(at) && at > 0 ? ` (resets ${new Date(at * 1000).toISOString()})` : \"\";\n  return hasPat\n    ? `GitHub rate limit exceeded${when}; wait for the reset`\n    : `GitHub rate limit exceeded${when}; set ${GITHUB_PAT_ENV} to a GitHub token to raise it`;\n}\n\n/**\n * Read each path from `raw.githubusercontent.com/<owner>/<repo>/<sha>/<path>`. The commit\n * is a full SHA, so the bytes are as immutable as through the API; `installFromManifest`\n * still verifies every file against the pinned hashes.\n */\nasync function fetchFromRawHost(args: {\n  owner: string;\n  repo: string;\n  commitSha: string;\n  paths: string[];\n}): Promise<Record<string, Buffer>> {\n  const result: Record<string, Buffer> = {};\n  const queue = [...args.paths];\n  const worker = async (): Promise<void> => {\n    for (let path = queue.shift(); path !== undefined; path = queue.shift()) {\n      const url =\n        `https://raw.githubusercontent.com/${args.owner}/${args.repo}/${args.commitSha}/` +\n        path.split(\"/\").map(encodeURIComponent).join(\"/\");\n      let res: Response;\n      try {\n        res = await fetch(url, { signal: AbortSignal.timeout(RAW_REQUEST_TIMEOUT_MS) });\n      } catch (e) {\n        const cause = (e as { cause?: { code?: string } }).cause?.code ?? (e as Error).message;\n        throw new Error(\n          `unreachable: cannot read ${path} from raw.githubusercontent.com: ${cause}`,\n        );\n      }\n      if (res.status === 404) {\n        throw new Error(\n          `unreachable: path not in tree: ${path} (not at ${args.commitSha} in ${args.owner}/${args.repo}; ` +\n            `a private repo needs ${GITHUB_PAT_ENV})`,\n        );\n      }\n      if (res.status === 429 || res.status === 403) {\n        const retry = Number(res.headers.get(\"retry-after\"));\n        const when = Number.isFinite(retry) && retry > 0 ? ` (retry in ${retry} s)` : \"\";\n        throw new Error(\n          `unreachable: GitHub refused ${path} with ${res.status}${when}; set ${GITHUB_PAT_ENV} to a GitHub token`,\n        );\n      }\n      if (!res.ok) {\n        throw new Error(`unreachable: cannot read ${path}: GitHub answered ${res.status}`);\n      }\n      result[path] = Buffer.from(await res.arrayBuffer());\n    }\n  };\n  await Promise.all(Array.from({ length: Math.min(RAW_CONCURRENCY, queue.length) }, worker));\n  return result;\n}\n"]}

package/dist/chunk-DUMTLYSO.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../asset-manager/src/renderers.ts"],"names":["stringifyYaml"],"mappings":";;;;;;AA4GA,SAAS,YAAY,IAAA,EAAoB;AACvC,EAAA,IAAI;AACF,IAAA,IAAI,UAAU,IAAI,CAAA,CAAE,cAAA,EAAe,aAAc,IAAI,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQA,SAAS,UAAA,CACP,QAAA,EACA,OAAA,EACA,aAAA,EACA,SACA,OAAA,EACM;AACN,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,aAAA,EAAe,QAAQ,CAAA;AAC5C,EAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAChB,EAAA,WAAA,CAAY,QAAQ,CAAA;AACpB,EAAA,IAAI,UAAA,CAAW,QAAQ,CAAA,EAAG;AACxB,IAAA,IAAI;AACF,MAAA,IAAI,YAAA,CAAa,QAAA,EAAU,OAAO,CAAA,KAAM,OAAA,EAAS;AAAA,IACnD,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,SAAA,CAAU,QAAQ,QAAQ,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,EAAA,aAAA,CAAc,QAAA,EAAU,SAAS,OAAO,CAAA;AACxC,EAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAClB;AAeA,SAAS,kBACP,IAAA,EACA,KAAA,EACA,QACA,WAAA,EACA,YAAA,EACA,oBACA,gBAAA,EACQ;AACR,EAAA,MAAM,WAAW,wBAAA,CAAyB;AAAA,IACxC,IAAA;AAAA,IACA,WAAA,EAAa,KAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA,EAAW,WAAA;AAAA,IACX,SAAA,EAAW,YAAA;AAAA,IACX,kBAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,OAAO,CAAA,EAAG,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA,CAAE,IAAA,CAAK,MAAM,CAAC;AAAA,CAAA;AACpD;AAGA,SAAS,sBAAsB,CAAA,EAAmB;AAEhD,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,WAAW,CAAA;AACtC;AASA,SAAS,aAAa,KAAA,EAAmE;AACvF,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,MAAM,UAAA,GAAa,CAAC,CAAA,KACjB,uBAAA,CAA8C,SAAS,CAAC,CAAA;AAC3D,EAAA,MAAM,EAAE,SAAA,EAAW,QAAA,EAAU,GAAG,MAAK,GAAI,KAAA;AACzC,EAAA,MAAM,IAAA,GAA4C,EAAE,GAAG,IAAA,EAAK;AAC5D,EAAA,IAAI,aAAa,CAAC,UAAA,CAAW,SAAS,CAAA,OAAQ,SAAA,GAAY,SAAA;AAC1D,EAAA,MAAM,SAAA,GAAA,CAAa,QAAA,IAAY,EAAC,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,UAAA,CAAW,CAAC,CAAC,CAAA;AAC/D,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,QAAA,GAAW,SAAA;AAC1C,EAAA,OAAO,OAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,GAAS,IAAI,IAAA,GAAO,MAAA;AAC/C;AAGA,IAAM,SAAA,uBAAgB,GAAA,CAAI,CAAC,QAAQ,WAAA,EAAa,cAAA,EAAgB,aAAa,CAAC,CAAA;AAG9E,SAAS,QAAA,CAAS,IAAA,EAAc,EAAA,EAAY,aAAA,EAAuB,OAAA,EAAyB;AAC1F,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,IAAA,CAAK,gBAAe,EAAG;AAC3B,EAAA,IAAI,IAAA,CAAK,aAAY,EAAG;AACtB,IAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AACpC,MAAA,IAAI,UAAU,GAAA,CAAI,IAAI,KAAK,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,MAAM,IAAI,CAAA,EAAG,KAAK,EAAA,EAAI,IAAI,CAAA,EAAG,aAAA,EAAe,OAAO,CAAA;AAAA,IACnE;AACA,IAAA;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,EAAG;AACpB,EAAA,MAAM,KAAA,GAAQ,aAAa,IAAI,CAAA;AAC/B,EAAA,WAAA,CAAY,EAAE,CAAA;AACd,EAAA,IAAI,UAAA,CAAW,EAAE,CAAA,EAAG;AAClB,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,CAAM,MAAA,CAAO,YAAA,CAAa,EAAE,CAAC,CAAA,EAAG;AAAA,IACtC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,SAAA,CAAU,QAAQ,EAAE,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1C,EAAA,aAAA,CAAc,IAAI,KAAK,CAAA;AACvB,EAAA,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,aAAA,EAAe,EAAE,CAAC,CAAA;AAC1C;AAQA,SAAS,oBACP,QAAA,EACA,MAAA,EACA,OAAA,EACA,aAAA,EACA,SACA,QAAA,EACwC;AACxC,EAAA,IAAI,CAAC,QAAQ,OAAO,QAAA;AACpB,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,CAAC,IAAA,KAAS;AAC5B,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,IAAK,CAAC,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,IAAA;AACtE,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,EAAQ,IAAA,CAAK,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG;AACrB,MAAA,QAAA,CAAS,IAAA,CAAK,eAAe,IAAA,CAAK,GAAG,iBAAiB,IAAI,CAAA,kBAAA,EAAqB,OAAO,CAAA,CAAE,CAAA;AACxF,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,GAAA,GAAM,SAAA,CAAU,IAAA,CAAK,GAAG,CAAA;AAC9B,IAAA,MAAM,MAAA,GAAS,CAAC,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA;AACnC,IAAA,MAAM,SAAS,MAAA,GAAS,GAAA,GAAM,KAAK,UAAA,EAAY,QAAA,CAAS,IAAI,CAAC,CAAA;AAC7D,IAAA,QAAA,CAAS,MAAM,IAAA,CAAK,OAAA,EAAS,MAAM,CAAA,EAAG,eAAe,OAAO,CAAA;AAC5D,IAAA,OAAO,MAAA,GAAS,OAAO,EAAE,GAAG,MAAM,GAAA,EAAK,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,EAAG;AAAA,EACvD,CAAC,CAAA;AACH;AAyBO,IAAM,qBAAoC,CAAC;AAAA,EAChD,QAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA,KAAM;AACJ,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,IAAA,EAAM,SAAA;AAAA,IACN,WAAA,EAAa,QAAA,CAAS,WAAA,IAAe,CAAA,EAAG,SAAS,CAAA,MAAA;AAAA,GACnD;AAKA,EAAA,IAAI,QAAA,CAAS,OAAO,SAAA,EAAW;AAC7B,IAAA,MAAM,GAAA,GAAM,SAAS,KAAA,CAAM,SAAA;AAC3B,IAAA,MAAM,UAAA,GAAa,wBAAwB,GAAG,CAAA;AAC9C,IAAA,IAAI,eAAe,GAAA,EAAK;AACtB,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,CAAA,MAAA,EAAS,SAAS,CAAA,SAAA,EAAY,GAAG,0DAA0D,UAAU,CAAA,qBAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,WAAA,CAAY,KAAA,GAAQ,UAAA;AAAA,EACtB;AAGA,EAAA,IAAI,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,MAAA,EAAQ;AACnC,IAAA,WAAA,CAAY,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,QAAA,CAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ;AAClC,IAAA,WAAA,CAAY,eAAA,GAAkB,QAAA,CAAS,KAAA,CAAM,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,EAC/D;AAEA,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,MAAA,GAAS,MAAA;AAC5C,EAAA,IAAI,UAAA,CAAW,MAAA,GAAS,CAAA,EAAG,WAAA,CAAY,UAAA,GAAa,UAAA;AAGpD,EAAA,IAAI,QAAA,CAAS,SAAS,SAAA,EAAW;AAC/B,IAAA,WAAA,CAAY,QAAA,GAAW,SAAS,OAAA,CAAQ,SAAA;AAAA,EAC1C;AACA,EAAA,IAAI,SAAA,KAAc,MAAA,IAAU,QAAA,CAAS,OAAA,EAAS,eAAe,IAAA,EAAM;AACjE,IAAA,WAAA,CAAY,UAAA,GAAa,IAAA;AAAA,EAC3B;AAGA,EAAA,IAAI,SAAS,QAAA,EAAU,KAAA,EAAO,WAAA,CAAY,KAAA,GAAQ,SAAS,QAAA,CAAS,KAAA;AACpE,EAAA,IAAI,SAAS,QAAA,EAAU,MAAA,EAAQ,WAAA,CAAY,MAAA,GAAS,SAAS,QAAA,CAAS,MAAA;AACtE,EAAA,IAAI,SAAS,QAAA,EAAU,SAAA,EAAW,WAAA,CAAY,SAAA,GAAY,SAAS,QAAA,CAAS,SAAA;AAE5E,EAAA,MAAM,IAAA,GAAO,iBAAA;AAAA,IACX,IAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,CAAA;AAAA,EAAQA,SAAA,CAAc,WAAW,CAAA,CAAE,IAAA,EAAM;AAAA;;AAAA,EAAY,IAAI,CAAA,CAAA;AACzE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,cAAA,EAAgB,CAAA,EAAG,SAAS,CAAA,GAAA,CAAK,CAAA;AACvD,EAAA,UAAA,CAAW,QAAA,EAAU,OAAA,EAAS,aAAA,EAAe,OAAA,EAAS,OAAO,CAAA;AAE7D,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,EAAS;AACtC;AAYA,IAAM,iBAAiB,CAAC,OAAA,EAAS,MAAA,EAAQ,WAAA,EAAa,gBAAgB,MAAM,CAAA;AAG5E,SAAS,iBAAiB,KAAA,EAAwD;AAChF,EAAA,MAAM,OAAA,GAAU,KAAA,EAAO,OAAA,IAAW,EAAC;AACnC,EAAA,MAAM,SAAS,IAAI,GAAA,CAAI,KAAA,EAAO,MAAA,IAAU,EAAE,CAAA;AAC1C,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,IAAM,cAAA,CAAqC,QAAA,CAAS,CAAC,CAAC,IAC1F,MAAA,GACA,WAAA;AAAA,EACN;AAEA,EAAA,OAAO,cAAA,CAAe,MAAM,CAAC,CAAA,KAAM,OAAO,GAAA,CAAI,CAAC,CAAC,CAAA,GAAI,WAAA,GAAc,MAAA;AACpE;AAGO,IAAM,kBAAA,GAAqB;AAiB3B,IAAM,gBAA+B,CAAC;AAAA,EAC3C,QAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAA,KAAM;AACJ,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,YAAA,GAAe,iBAAA;AAAA,IACnB,IAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,OAAA,GAAU,sBAAsB,YAAY,CAAA;AAElD,EAAA,MAAM,KAAA,GAAkB;AAAA,IACtB,CAAA,OAAA,EAAU,IAAA,CAAK,SAAA,CAAU,SAAS,CAAC,CAAA,CAAA;AAAA,IACnC,CAAA,cAAA,EAAiB,KAAK,SAAA,CAAU,QAAA,CAAS,eAAe,CAAA,EAAG,SAAS,QAAQ,CAAC,CAAA;AAAA,GAC/E;AAEA,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA,EAAG,SAAA;AAC5C,EAAA,IAAI,KAAA,QAAa,IAAA,CAAK,CAAA,QAAA,EAAW,KAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AACxD,EAAA,MAAM,WAAA,GAAc,gBAAA,CAAiB,QAAA,CAAS,KAAK,CAAA;AACnD,EAAA,IAAI,WAAA,QAAmB,IAAA,CAAK,CAAA,eAAA,EAAkB,KAAK,SAAA,CAAU,WAAW,CAAC,CAAA,CAAE,CAAA;AAC3E,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,4BAAA,CAAA,EAAgC,OAAA,CAAQ,IAAA,IAAQ,CAAA,GAAA,CAAK,CAAA;AAEhE,EAAA,MAAM,OAAA,GAAU,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAA;AACnC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,cAAA,EAAgB,CAAA,EAAG,SAAS,CAAA,KAAA,CAAO,CAAA;AACzD,EAAA,UAAA,CAAW,QAAA,EAAU,OAAA,EAAS,aAAA,EAAe,OAAA,EAAS,OAAO,CAAA;AAK7D,EAAA,MAAM,WAAA,GAAc,KAAK,OAAA,CAAQ,cAAc,GAAG,kBAAA,EAAoB,CAAA,EAAG,SAAS,CAAA,GAAA,CAAK,CAAA;AACvF,EAAA,UAAA,CAAW,WAAA,EAAa,YAAA,EAAc,aAAA,EAAe,OAAA,EAAS,OAAO,CAAA;AAErE,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,EAAS;AACtC;AA4BO,IAAM,cAA6B,CAAC;AAAA,EACzC,QAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA,KAAM;AACJ,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,cAAA,EAAgB,SAAS,CAAA;AAG9C,EAAA,MAAM,SAAA,GAAqC;AAAA,IACzC,YAAA,EAAc,SAAS,YAAA,IAAgB,KAAA;AAAA,IACvC,IAAA,EAAM,SAAA;AAAA,IACN,OAAA,EAAS,SAAS,OAAA,IAAW,OAAA;AAAA,IAC7B,WAAA,EAAa,QAAA,CAAS,WAAA,IAAe,CAAA,EAAG,SAAS,CAAA,MAAA,CAAA;AAAA,IACjD;AAAA,GACF;AAUA,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA;AACzC,EAAA,IAAI,KAAA,YAAiB,KAAA,GAAQ,KAAA;AAC7B,EAAA,IAAI,QAAA,CAAS,KAAA,EAAO,SAAA,CAAU,KAAA,GAAQ,QAAA,CAAS,KAAA;AAC/C,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,SAAA,CAAU,UAAA,GAAa,QAAA,CAAS,UAAA;AACzD,EAAA,IAAI,QAAA,CAAS,OAAA,EAAS,SAAA,CAAU,OAAA,GAAU,QAAA,CAAS,OAAA;AACnD,EAAA,IAAI,QAAA,CAAS,EAAA,EAAI,SAAA,CAAU,EAAA,GAAK,QAAA,CAAS,EAAA;AACzC,EAAA,IAAI,QAAA,CAAS,MAAA,EAAQ,SAAA,CAAU,MAAA,GAAS,QAAA,CAAS,MAAA;AACjD,EAAA,IAAI,QAAA,CAAS,QAAA,EAAU,MAAA,EAAQ,SAAA,CAAU,WAAW,QAAA,CAAS,QAAA;AAC7D,EAAA,IAAI,QAAA,CAAS,YAAA,EAAc,MAAA,EAAQ,SAAA,CAAU,eAAe,QAAA,CAAS,YAAA;AACrE,EAAA,IAAI,QAAA,CAAS,UAAU,MAAA,EAAQ;AAC7B,IAAA,SAAA,CAAU,QAAA,GAAW,mBAAA;AAAA,MACnB,QAAA,CAAS,QAAA;AAAA,MACT,MAAA;AAAA,MACA,OAAA;AAAA,MACA,aAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,IAAA,EAAM,MAAA,EAAQ,SAAA,CAAU,OAAO,QAAA,CAAS,IAAA;AACrD,EAAA,IAAI,QAAA,CAAS,QAAA,EAAU,SAAA,CAAU,QAAA,GAAW,QAAA,CAAS,QAAA;AAErD,EAAA,UAAA,CAAW,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA,EAAGA,SAAA,CAAc,SAAS,CAAA,EAAG,aAAA,EAAe,EAAC,EAAG,OAAO,CAAA;AAG5F,EAAA,MAAM,YAAA,GAAe,iBAAA;AAAA,IACnB,IAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,UAAA,CAAW,IAAA,CAAK,SAAS,SAAS,CAAA,EAAG,cAAc,aAAA,EAAe,IAAI,OAAO,CAAA;AAK7E,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,IAAA,EAAM,SAAA;AAAA,IACN,WAAA,EAAa,QAAA,CAAS,WAAA,IAAe,CAAA,EAAG,SAAS,CAAA,MAAA;AAAA,GACnD;AACA,EAAA,IAAI,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,MAAA,EAAQ,WAAA,CAAY,QAAQ,QAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA;AACzF,EAAA,MAAM,WAAW,KAAA,EAAO,SAAA;AACxB,EAAA,IAAI,QAAA,cAAsB,KAAA,GAAQ,QAAA;AAClC,EAAA,UAAA;AAAA,IACE,IAAA,CAAK,cAAA,EAAgB,CAAA,EAAG,SAAS,CAAA,GAAA,CAAK,CAAA;AAAA,IACtC,CAAA;AAAA,EAAQA,SAAA,CAAc,WAAW,CAAA,CAAE,IAAA,EAAM;AAAA;;AAAA,EAAY,YAAY,CAAA,CAAA;AAAA,IACjE,aAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,aAAA,EAAe,OAAO,CAAC,CAAA;AAC7C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,EAAS;AACtC;AAKA,IAAM,OAAY,MAAM;AAAC,CAAA;AAalB,SAAS,sBAAA,CACd,KAAA,EACA,aAAA,EACA,GAAA,GAAW,IAAA,EACQ;AACnB,EAAA,MAAM,QAAA,GAAW,gBAAgB,aAAa,CAAA;AAC9C,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,OAAO;AAAA,MACL,SAAS,EAAC;AAAA,MACV,SAAS,EAAC;AAAA,MACV,QAAA,EAAU,CAAC,CAAA,2BAAA,EAA8B,aAAa,CAAA,CAAA,CAAG;AAAA,KAC3D;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,SAAS,KAAK,CAAA;AAC7B,EAAA,KAAA,MAAW,KAAK,MAAA,CAAO,OAAA,EAAS,GAAA,CAAI,CAAA,kBAAA,EAAqB,CAAC,CAAA,CAAE,CAAA;AAC5D,EAAA,KAAA,MAAW,KAAK,MAAA,CAAO,QAAA,EAAU,GAAA,CAAI,CAAA,QAAA,EAAW,CAAC,CAAA,CAAE,CAAA;AACnD,EAAA,OAAO,MAAA;AACT;AAUO,IAAM,eAAA,GAAiD;AAAA,EAC5D,aAAA,EAAe,kBAAA;AAAA,EACf,GAAA,EAAK,WAAA;AAAA,EACL,KAAA,EAAO;AACT;AASO,SAAS,4BAA4B,aAAA,EAAgC;AAC1E,EAAA,OAAO,aAAA,IAAiB,eAAA;AAC1B","file":"chunk-DUMTLYSO.js","sourcesContent":["/**\n * Framework-specific renderers for GitAgent packages.\n *\n * Each renderer transforms a parsed GitAgent package (agent.yaml + SOUL.md + RULES.md)\n * into the native file format that the target agent framework natively reads.\n *\n * Only harnesses with a full bridge harness (runtime execution) are included:\n *   claude-code → .claude/agents/<name>.md     (YAML frontmatter + markdown body)\n *   omp         → .omp/agents/<name>/          (directory with agent.yaml + SOUL.md)\n *   codex       → .codex/agents/<name>.toml    (TOML)\n *\n * Removed (no bridge harness): cursor, roo, github-copilot, gemini, amp.\n * Add them back when a bridge harness is implemented.\n */\n\nimport {\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { basename, dirname, join, normalize, relative, resolve } from \"node:path\";\nimport { buildAgentPromptSections } from \"@skaile/workspaces/core\";\nimport {\n  ANTHROPIC_MODEL_ALIASES,\n  type AgentLifecycle,\n  type AgentManifest,\n  normalizeAnthropicModel,\n} from \"@skaile/workspaces/types/manifests\";\nimport { stringify as stringifyYaml } from \"yaml\";\nimport type { AbilityRef, ContractRef } from \"./fragments.js\";\n\n// ── Types ─────────────────────────────────��───────────────────────────────────\n\nexport type { AgentManifest };\n\n/**\n * All data an {@link AgentRenderer} needs to produce a native agent definition file.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport interface AgentRenderInput {\n  /** Parsed `agent.yaml` manifest for the GitAgent being rendered. */\n  manifest: AgentManifest;\n  /** Raw content of `SOUL.md`, or `null` if absent. */\n  soul: string | null;\n  /** Raw content of `RULES.md`, or `null` if absent. */\n  rules: string | null;\n  /** Raw content of `DUTIES.md`, or `null` if absent. */\n  duties: string | null;\n  /** Agent name used as the output filename and frontmatter `name` field. */\n  agentName: string;\n  /** Resolved absolute path to the framework's agent deploy directory (e.g. `.claude/agents/`). */\n  agentDeployDir: string;\n  /** Absolute path to the workspace root. */\n  workspaceRoot: string;\n  /** Resolved ability refs — installed skills referenced in the `## Installed Abilities` section. */\n  abilityRefs: AbilityRef[];\n  /** Resolved contract refs — installed in the skills dir, listed in the `## Contracts` section. */\n  contractRefs: ContractRef[];\n  /** Resolved framework fragment markdown blocks (agent-mode, handoff, skill-discovery, etc.). */\n  frameworkFragments: string[];\n  /** Per-project prompt extension markdown blocks loaded from `skaile.yaml` `agent.prompt-extensions`. */\n  promptExtensions: string[];\n  /** `standing` (long-running identity) or `role` (short-lived, callable). */\n  lifecycle: AgentLifecycle;\n  /** Names of the skills the agent composes (`composes[{kind: skill}]`), as installed. */\n  skills: string[];\n  /** Names of the MCP servers the agent's `mcp-server` slots are bound to. */\n  mcpServers: string[];\n  /**\n   * Absolute path of the agent's source directory (where `agent.yaml` lives). The omp renderer\n   * copies the local `composes` directories out of it.\n   */\n  srcDir?: string;\n}\n\n/**\n * Result returned by every {@link AgentRenderer}.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport interface AgentRenderResult {\n  /** Paths to files/dirs rendered, relative to `workspaceRoot`. */\n  created: string[];\n  /** The subset of `created` whose bytes differ from what was on disk before (new or edited); an identical rewrite is skipped. */\n  changed: string[];\n  /** Non-fatal warnings (e.g. experimental feature notices). */\n  warnings: string[];\n}\n\n/**\n * A function that transforms an {@link AgentRenderInput} into framework-native agent definition files.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport type AgentRenderer = (input: AgentRenderInput) => AgentRenderResult;\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\n/**\n * Unlink a symlink (dangling or not) at a path skaile is about to write. `writeFileSync` follows\n * a link, so the write would land in the file the link points at: the user's own file, outside\n * the project (p1060). The link is replaced by the rendered file instead.\n */\nfunction dropSymlink(path: string): void {\n  try {\n    if (lstatSync(path).isSymbolicLink()) unlinkSync(path);\n  } catch {\n    // nothing at the path: the write creates it\n  }\n}\n\n/**\n * Write an agent definition file. Agents are compiled artifacts — they must\n * reflect the current canonical source — but a file that already holds exactly\n * these bytes is left untouched (mtime included), so a repeat install is a no-op.\n * `created` lists every rendered path; `changed` only those that were (re)written.\n */\nfunction writeAgent(\n  filePath: string,\n  content: string,\n  workspaceRoot: string,\n  created: string[],\n  changed: string[],\n): void {\n  const rel = relative(workspaceRoot, filePath);\n  created.push(rel);\n  dropSymlink(filePath);\n  if (existsSync(filePath)) {\n    try {\n      if (readFileSync(filePath, \"utf-8\") === content) return;\n    } catch {\n      // unreadable (e.g. a directory in the way): fall through to the write\n    }\n  }\n  mkdirSync(dirname(filePath), { recursive: true });\n  writeFileSync(filePath, content, \"utf-8\");\n  changed.push(rel);\n}\n\n/**\n * Build the full agent system prompt body baked into the framework-native agent file.\n *\n * This is the sole source of the agent's system prompt body. Agent identity is rendered at install time; the harness reads it natively at runtime.\n * The rendered output ends up in .claude/agents/<name>.md, .omp/agents/<name>/SOUL.md,\n * .codex/agents/<name>.toml and is read natively by the framework on every agent invocation.\n *\n * Section order is owned by the shared builder (`buildAgentPromptSections` in\n * core, the same one the runner assembles its system prompt with):\n * soul → `<MEMORY>` → framework fragments → `## Constraints` (RULES) →\n * `## Duties` → `## Installed Abilities` → `## Contracts` → composed inline\n * blocks → prompt extensions.\n */\nfunction buildMarkdownBody(\n  soul: string | null,\n  rules: string | null,\n  duties: string | null,\n  abilityRefs: AbilityRef[],\n  contractRefs: ContractRef[],\n  frameworkFragments: string[],\n  promptExtensions: string[],\n): string {\n  const sections = buildAgentPromptSections({\n    soul,\n    constraints: rules,\n    duties,\n    abilities: abilityRefs,\n    contracts: contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  });\n  return `${sections.map((s) => s.text).join(\"\\n\\n\")}\\n`;\n}\n\n/** Escape a string for use as a TOML multi-line basic string (triple-quote). */\nfunction toTomlMultilineString(s: string): string {\n  // Replace \"\"\" with \\\\\"\"\" to avoid breaking the TOML literal\n  return s.replace(/\"\"\"/g, '\\\\\"\\\\\"\\\\\"');\n}\n\n/**\n * The manifest's `model` as a harness other than Claude Code can take it: the Claude Code\n * aliases (`inherit`, `opus`, `sonnet`, `haiku`) name no model of another harness' provider, so a\n * `preferred` that is one of them is dropped (the harness starts the agent on its own default) and\n * so is a `fallback` entry that is. Any other selector (`provider/model`, a full id, `@role`) is\n * the author's choice and is passed through. `undefined` when nothing is left.\n */\nfunction harnessModel(model: AgentManifest[\"model\"]): AgentManifest[\"model\"] | undefined {\n  if (!model) return undefined;\n  const claudeOnly = (m: string): boolean =>\n    (ANTHROPIC_MODEL_ALIASES as readonly string[]).includes(m);\n  const { preferred, fallback, ...rest } = model;\n  const kept: NonNullable<AgentManifest[\"model\"]> = { ...rest };\n  if (preferred && !claudeOnly(preferred)) kept.preferred = preferred;\n  const fallbacks = (fallback ?? []).filter((m) => !claudeOnly(m));\n  if (fallbacks.length > 0) kept.fallback = fallbacks;\n  return Object.keys(kept).length > 0 ? kept : undefined;\n}\n\n/** Directory entries that are never part of an asset (build and OS leftovers). */\nconst COPY_SKIP = new Set([\".git\", \".DS_Store\", \"node_modules\", \"__pycache__\"]);\n\n/** Copy a file or directory tree byte for byte; a file that already holds these bytes is left alone. */\nfunction copyTree(from: string, to: string, workspaceRoot: string, changed: string[]): void {\n  const stat = lstatSync(from);\n  if (stat.isSymbolicLink()) return;\n  if (stat.isDirectory()) {\n    for (const name of readdirSync(from)) {\n      if (COPY_SKIP.has(name) || name.endsWith(\".pyc\")) continue;\n      copyTree(join(from, name), join(to, name), workspaceRoot, changed);\n    }\n    return;\n  }\n  if (!stat.isFile()) return;\n  const bytes = readFileSync(from);\n  dropSymlink(to);\n  if (existsSync(to)) {\n    try {\n      if (bytes.equals(readFileSync(to))) return;\n    } catch {\n      // unreadable (e.g. a directory in the way): fall through to the write\n    }\n  }\n  mkdirSync(dirname(to), { recursive: true });\n  writeFileSync(to, bytes);\n  changed.push(relative(workspaceRoot, to));\n}\n\n/**\n * Make the `composes` of an omp `agent.yaml` resolvable from where it is written: every local ref\n * (`./rules-local/house-rules`) is copied next to the `agent.yaml`, at the path the ref names, and a\n * local ref that climbs out of the agent directory (`../shared/rules`) is copied to\n * `composes/<name>` and rewritten to that path. Catalog refs (`skill:@pub/name`) are kept as written.\n */\nfunction bundleLocalComposes(\n  composes: NonNullable<AgentManifest[\"composes\"]>,\n  srcDir: string | undefined,\n  destDir: string,\n  workspaceRoot: string,\n  changed: string[],\n  warnings: string[],\n): NonNullable<AgentManifest[\"composes\"]> {\n  if (!srcDir) return composes;\n  return composes.map((item) => {\n    if (!item.ref.startsWith(\"./\") && !item.ref.startsWith(\"../\")) return item;\n    const from = resolve(srcDir, item.ref);\n    if (!existsSync(from)) {\n      warnings.push(`compose ref ${item.ref} not found at ${from}: not copied into ${destDir}`);\n      return item;\n    }\n    const rel = normalize(item.ref);\n    const inside = !rel.startsWith(\"..\");\n    const target = inside ? rel : join(\"composes\", basename(from));\n    copyTree(from, join(destDir, target), workspaceRoot, changed);\n    return inside ? item : { ...item, ref: `./${target}` };\n  });\n}\n\n// ── Claude Code ────────────��──────────────────────────────────────────────────\n// Format: .claude/agents/<name>.md\n// Sub-agent support: automatic (description-based) + @-mention\n// Required frontmatter: name, description\n//\n// Installation → runtime handoff:\n//   skaile install (claudeCodeRenderer) creates the .md file from GitAgent source\n//   ClaudeSdkHarness.startQuery() passes options.agent = agentName to the SDK query\n//   The SDK reads .claude/agents/<agentName>.md to get model, tools, and system prompt\n//   This is equivalent to running: claude --agent <agentName>\n\n/**\n * Render a GitAgent to Claude Code's `.claude/agents/<name>.md` format.\n *\n * Writes YAML frontmatter (name, description, model, tools, skills, mcpServers,\n * maxTurns, background) followed by the enriched system prompt body. `skills`\n * lists the composed skills, `mcpServers` the MCP servers the agent's\n * `mcp-server` slots are bound to, and `background: true` marks a `role`\n * instance whose `runtime.background` is set. Always overwrites to reflect\n * current source.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport const claudeCodeRenderer: AgentRenderer = ({\n  manifest,\n  soul,\n  rules,\n  duties,\n  agentName,\n  agentDeployDir,\n  workspaceRoot,\n  abilityRefs,\n  contractRefs,\n  frameworkFragments,\n  promptExtensions,\n  lifecycle,\n  skills,\n  mcpServers,\n}) => {\n  const created: string[] = [];\n  const changed: string[] = [];\n  const warnings: string[] = [];\n\n  const frontmatter: Record<string, unknown> = {\n    name: agentName,\n    description: manifest.description ?? `${agentName} agent`,\n  };\n\n  // Model: map to Claude Code's model field. Accepts aliases (sonnet/opus/haiku/inherit)\n  // or a full Anthropic ID. Unrecognized values (e.g. legacy `claude-opus-4`) are\n  // coerced to the matching family alias so the agent still loads.\n  if (manifest.model?.preferred) {\n    const raw = manifest.model.preferred;\n    const normalized = normalizeAnthropicModel(raw);\n    if (normalized !== raw) {\n      warnings.push(\n        `agent ${agentName}: model \"${raw}\" is not a valid Claude model ID; normalized to alias \"${normalized}\". Update agent.yaml.`,\n      );\n    }\n    frontmatter.model = normalized;\n  }\n\n  // Tool restrictions\n  if (manifest.tools?.allowed?.length) {\n    frontmatter.tools = manifest.tools.allowed.join(\", \");\n  }\n  if (manifest.tools?.denied?.length) {\n    frontmatter.disallowedTools = manifest.tools.denied.join(\", \");\n  }\n\n  if (skills.length > 0) frontmatter.skills = skills;\n  if (mcpServers.length > 0) frontmatter.mcpServers = mcpServers;\n\n  // Runtime\n  if (manifest.runtime?.max_turns) {\n    frontmatter.maxTurns = manifest.runtime.max_turns;\n  }\n  if (lifecycle === \"role\" && manifest.runtime?.background === true) {\n    frontmatter.background = true;\n  }\n\n  // Metadata pass-through for Claude Code-specific fields\n  if (manifest.metadata?.color) frontmatter.color = manifest.metadata.color;\n  if (manifest.metadata?.effort) frontmatter.effort = manifest.metadata.effort;\n  if (manifest.metadata?.isolation) frontmatter.isolation = manifest.metadata.isolation;\n\n  const body = buildMarkdownBody(\n    soul,\n    rules,\n    duties,\n    abilityRefs,\n    contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  );\n  const content = `---\\n${stringifyYaml(frontmatter).trim()}\\n---\\n\\n${body}`;\n  const filePath = join(agentDeployDir, `${agentName}.md`);\n  writeAgent(filePath, content, workspaceRoot, created, changed);\n\n  return { created, changed, warnings };\n};\n\n// ── OpenAI Codex ──────────────────────────────────────────────────────────────\n// Format: .codex/agents/<name>.toml\n// Sub-agent support: explicit user request only (not automatic)\n// Required fields: name, description, developer_instructions\n\n/**\n * Tools that change the workspace or run commands. Codex has no per-agent tool\n * allowlist; the closest per-agent control is `sandbox_mode`, so an agent whose\n * declared tool surface contains none of these is rendered `read-only`.\n */\nconst MUTATING_TOOLS = [\"Write\", \"Edit\", \"MultiEdit\", \"NotebookEdit\", \"Bash\"] as const;\n\n/** `read-only` when the manifest's tool surface cannot mutate anything, else `undefined` (inherit). */\nfunction codexSandboxMode(tools: AgentManifest[\"tools\"]): \"read-only\" | undefined {\n  const allowed = tools?.allowed ?? [];\n  const denied = new Set(tools?.denied ?? []);\n  if (allowed.length > 0) {\n    return allowed.some((t) => !denied.has(t) && (MUTATING_TOOLS as readonly string[]).includes(t))\n      ? undefined\n      : \"read-only\";\n  }\n  // No allowlist: everything not denied is available.\n  return MUTATING_TOOLS.every((t) => denied.has(t)) ? \"read-only\" : undefined;\n}\n\n/** Directory (next to `agents/`) holding each Codex agent's markdown identity, one file per agent. */\nexport const CODEX_IDENTITY_DIR = \"skaile-agents\";\n\n/**\n * Render a GitAgent to OpenAI Codex's `.codex/agents/<name>.toml` format.\n *\n * Produces a TOML file with `name`, `description`, `model`, `sandbox_mode` and\n * `developer_instructions`. `sandbox_mode = \"read-only\"` is the per-agent tool\n * restriction: it is emitted when the manifest's `tools` leave the agent no way\n * to write or run commands (Codex has no per-tool allowlist). Triple-quoted\n * TOML multi-line strings are escaped to avoid syntax errors.\n *\n * Also writes the agent's identity as `.codex/skaile-agents/<name>.md`, which\n * the Codex harness combines with the session's runtime prompt (one file per\n * agent, so several instances never overwrite each other).\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport const codexRenderer: AgentRenderer = ({\n  manifest,\n  soul,\n  rules,\n  duties,\n  agentName,\n  agentDeployDir,\n  workspaceRoot,\n  abilityRefs,\n  contractRefs,\n  frameworkFragments,\n  promptExtensions,\n}) => {\n  const created: string[] = [];\n  const changed: string[] = [];\n  const warnings: string[] = [];\n\n  const instructions = buildMarkdownBody(\n    soul,\n    rules,\n    duties,\n    abilityRefs,\n    contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  );\n  const escaped = toTomlMultilineString(instructions);\n\n  const lines: string[] = [\n    `name = ${JSON.stringify(agentName)}`,\n    `description = ${JSON.stringify(manifest.description ?? `${agentName} agent`)}`,\n  ];\n  // A Claude Code alias (`sonnet`) names no Codex model: leave `model` out and Codex uses its own.\n  const model = harnessModel(manifest.model)?.preferred;\n  if (model) lines.push(`model = ${JSON.stringify(model)}`);\n  const sandboxMode = codexSandboxMode(manifest.tools);\n  if (sandboxMode) lines.push(`sandbox_mode = ${JSON.stringify(sandboxMode)}`);\n  lines.push(`developer_instructions = \"\"\"`, escaped.trim(), `\"\"\"`);\n\n  const content = `${lines.join(\"\\n\")}\\n`;\n  const filePath = join(agentDeployDir, `${agentName}.toml`);\n  writeAgent(filePath, content, workspaceRoot, created, changed);\n\n  // Write the full agent identity as markdown for the Codex harness to read at runtime.\n  // The harness combines this with the session's dynamic content (resources, context)\n  // and passes the result via model_instructions_file.\n  const agentMdPath = join(dirname(agentDeployDir), CODEX_IDENTITY_DIR, `${agentName}.md`);\n  writeAgent(agentMdPath, instructions, workspaceRoot, created, changed);\n\n  return { created, changed, warnings };\n};\n\n// ── oh-my-pi ─��────────────��────────────────────────────────��─────────────────\n// Format: .omp/agents/<name>/ (directory with agent.yaml + SOUL.md + RULES.md)\n// oh-my-pi reads GitAgent directories natively via PI_CODING_AGENT_DIR.\n// The renderer copies/enriches the source directory rather than flattening to .md.\n//\n// Installation → runtime handoff:\n//   skaile install (ompRenderer) creates .omp/agents/<name>/ from GitAgent source\n//   OmpHarness._start() sets env.PI_CODING_AGENT_DIR = agentDir in the child process\n//   omp reads SOUL.md/RULES.md/knowledge/ from that directory natively on startup\n//\n// Note: REPL mode can bypass the install step — agentDir can point directly to the\n// GitAgent source directory, and omp will read it natively via PI_CODING_AGENT_DIR.\n// The rendered .omp/agents/ copy is only needed when the source is not accessible\n// from the project cwd (e.g. different repo, remote workspace).\n\n/**\n * Render a GitAgent to oh-my-pi's `.omp/agents/<name>/` directory format.\n *\n * Writes `agent.yaml` (resolved model/tools/delegation plus the 0.2\n * declaration — `composes` verbatim, `lifecycle`, `io`, `memory`, `triggers`,\n * `capabilities`) and an enriched `SOUL.md` that includes fragments and\n * extensions. omp reads this directory natively via the `PI_CODING_AGENT_DIR`\n * environment variable.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport const ompRenderer: AgentRenderer = ({\n  manifest,\n  soul,\n  rules,\n  duties,\n  agentName,\n  agentDeployDir,\n  workspaceRoot,\n  abilityRefs,\n  contractRefs,\n  frameworkFragments,\n  promptExtensions,\n  lifecycle,\n  srcDir,\n}) => {\n  const created: string[] = [];\n  const changed: string[] = [];\n  const warnings: string[] = [];\n\n  const destDir = join(agentDeployDir, agentName);\n\n  // Write agent.yaml with tools resolved\n  const agentYaml: Record<string, unknown> = {\n    spec_version: manifest.spec_version ?? \"0.2\",\n    name: agentName,\n    version: manifest.version ?? \"1.0.0\",\n    description: manifest.description ?? `${agentName} agent`,\n    lifecycle,\n  };\n  // The model: omp takes provider-prefixed full IDs and `@role` selectors, and resolves the\n  // family aliases it knows (verified live 2026-09-20 against omp v18.1.10 through\n  // teamclaude.postxl.com: `--model anthropic/opus` produced\n  // `model_change {\"model\":\"anthropic/claude-opus-5\",\"resolvedModelIsFallback\":false}`).\n  // The Claude Code aliases the manifest writes (`sonnet`, `haiku`, `opus`, `inherit`) name no\n  // model of an omp deployment on another provider, so they are left out and omp starts the agent\n  // on its own default. Any other selector is passed through verbatim: it is not checked here, and\n  // not coerced by `normalizeAnthropicModel`, which would substitute a different model on any\n  // provider but Anthropic (see `resolveManifestModel` in `@skaile/workspaces/bridge`).\n  const model = harnessModel(manifest.model);\n  if (model) agentYaml.model = model;\n  if (manifest.tools) agentYaml.tools = manifest.tools;\n  if (manifest.delegation) agentYaml.delegation = manifest.delegation;\n  if (manifest.runtime) agentYaml.runtime = manifest.runtime;\n  if (manifest.io) agentYaml.io = manifest.io;\n  if (manifest.memory) agentYaml.memory = manifest.memory;\n  if (manifest.triggers?.length) agentYaml.triggers = manifest.triggers;\n  if (manifest.capabilities?.length) agentYaml.capabilities = manifest.capabilities;\n  if (manifest.composes?.length) {\n    agentYaml.composes = bundleLocalComposes(\n      manifest.composes,\n      srcDir,\n      destDir,\n      workspaceRoot,\n      changed,\n      warnings,\n    );\n  }\n  if (manifest.tags?.length) agentYaml.tags = manifest.tags;\n  if (manifest.metadata) agentYaml.metadata = manifest.metadata;\n\n  writeAgent(join(destDir, \"agent.yaml\"), stringifyYaml(agentYaml), workspaceRoot, [], changed);\n\n  // Write SOUL.md (enriched with fragments and extensions, like other renderers)\n  const enrichedSoul = buildMarkdownBody(\n    soul,\n    rules,\n    duties,\n    abilityRefs,\n    contractRefs,\n    frameworkFragments,\n    promptExtensions,\n  );\n  writeAgent(join(destDir, \"SOUL.md\"), enrichedSoul, workspaceRoot, [], changed);\n\n  // omp lists the agents it can spawn from flat `.omp/agents/<name>.md` files only (verified live\n  // against omp 18.12.5: a `<name>/agent.yaml` directory is not listed, a flat file is), so the\n  // directory above carries the full GitAgent package and this file is what omp loads.\n  const frontmatter: Record<string, unknown> = {\n    name: agentName,\n    description: manifest.description ?? `${agentName} agent`,\n  };\n  if (manifest.tools?.allowed?.length) frontmatter.tools = manifest.tools.allowed.join(\", \");\n  const selector = model?.preferred;\n  if (selector) frontmatter.model = selector;\n  writeAgent(\n    join(agentDeployDir, `${agentName}.md`),\n    `---\\n${stringifyYaml(frontmatter).trim()}\\n---\\n\\n${enrichedSoul}`,\n    workspaceRoot,\n    created,\n    changed,\n  );\n\n  created.push(relative(workspaceRoot, destDir));\n  return { created, changed, warnings };\n};\n\n// ── Renderer registry ──────────────────────────────���──────────────────────────\n\nexport type Log = (msg: string) => void;\nconst noop: Log = () => {};\n\n/**\n * Render an agent to framework-native format via the renderer registry.\n *\n * Shared by both the simple deploy path (`deployAsset`) and the enriched scaffold path (agents layer).\n *\n * @param input - Full render input including manifest, SOUL/RULES text, and resolved refs.\n * @param harnessTarget - Agent framework ID to look up in {@link AGENT_RENDERERS}.\n * @param log - Optional logger callback for progress messages.\n * @returns Object with `created` file paths and `warnings` list.\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport function renderAgentToFramework(\n  input: AgentRenderInput,\n  harnessTarget: string,\n  log: Log = noop,\n): AgentRenderResult {\n  const renderer = AGENT_RENDERERS[harnessTarget];\n  if (!renderer) {\n    return {\n      created: [],\n      changed: [],\n      warnings: [`No renderer for framework \"${harnessTarget}\"`],\n    };\n  }\n  const result = renderer(input);\n  for (const c of result.created) log(`  rendered agent: ${c}`);\n  for (const w of result.warnings) log(`  warn: ${w}`);\n  return result;\n}\n\n/**\n * Registry mapping framework IDs to their {@link AgentRenderer} functions.\n *\n * Only harnesses with a full bridge harness are registered. Add new entries\n * when a bridge harness is implemented in `workspaces/bridge/src/harnesses/`.\n *\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport const AGENT_RENDERERS: Record<string, AgentRenderer> = {\n  \"claude-code\": claudeCodeRenderer,\n  omp: ompRenderer,\n  codex: codexRenderer,\n};\n\n/**\n * Returns `true` if the given harness target supports file-based sub-agent installation.\n *\n * @param harnessTarget - Agent framework ID to check.\n * @returns `true` when `harnessTarget` has a registered entry in {@link AGENT_RENDERERS}.\n * @docLink packages/asset-manager/api-reference#renderers\n */\nexport function harnessTargetSupportsAgents(harnessTarget: string): boolean {\n  return harnessTarget in AGENT_RENDERERS;\n}\n"]}