@skaile/workspaces 6.6.0 → 6.7.0

package/dist/{chunk-JIQUF3X2.js → chunk-G7NMF5WQ.js}

@@ -1,4 +1,4 @@
-import { resolveSkWorkspaceConfig, readLinks, getGlobalCacheDir, sourceCacheKey } from './chunk-6SXSVKQY.js';
+import { resolveSkWorkspaceConfig, readLinks, getGlobalCacheDir, sourceCacheKey } from './chunk-O7ADRMCR.js';
 import { scanDirectory, tryWithFsDeadline } from './chunk-GNUA7XT2.js';
 import { existsSync, readFileSync } from 'fs';
 import { lstat, stat } from 'fs/promises';
@@ -240,5 +240,5 @@ function findCatalogEntry(entries, query) {
 }
 
 export { FACTORY_ASSETS_REPO_NAME, factoryAssetRoots, resolveFactoryAssetsRoot, resolveFactoryAssetsRootOrNull, resolvePackagedAssetsDir, resolveRuntimeAssets, resolveWorkspacesPackageRoot };
-//# sourceMappingURL=chunk-JIQUF3X2.js.map
-//# sourceMappingURL=chunk-JIQUF3X2.js.map
+//# sourceMappingURL=chunk-G7NMF5WQ.js.map
+//# sourceMappingURL=chunk-G7NMF5WQ.js.map

package/dist/{chunk-JIQUF3X2.js.map → chunk-G7NMF5WQ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../core/src/runtime-assets.ts"],"names":["resolvePath","require"],"mappings":";;;;;;;;AAsDA,SAAS,sBACP,OAAA,EACmC;AACnC,EAAA,MAAM,aAAa,iBAAA,EAAkB;AACrC,EAAA,MAAM,MAAyC,EAAC;AAChD,EAAA,KAAA,MAAW,CAAA,IAAK,OAAA,IAAW,EAAC,EAAG;AAC7B,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,CAAA,CAAE,GAAG,CAAA;AAChC,IAAA,IAAI,GAAA,CAAI,GAAG,CAAA,EAAG;AACd,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI;AAAA,MACT,IAAA,EAAM,IAAA,CAAK,UAAA,EAAY,GAAG,CAAA;AAAA,MAC1B,KAAK,CAAA,CAAE,GAAA;AAAA,MACP,QAAQ,CAAA,CAAE,GAAA;AAAA,MACV,GAAI,EAAE,SAAA,GAAY,EAAE,WAAW,CAAA,CAAE,SAAA,KAAc;AAAC,KAClD;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAqDO,IAAM,wBAAA,GAA2B;AAMxC,IAAM,iCAAA,GAAoC,yBAAA;AAkD1C,eAAsB,oBAAA,CACpB,UAAA,EACA,OAAA,GAAgC,EAAC,EACH;AAC9B,EAAA,MAAM,MAAA,GAA8B;AAAA,IAClC,gBAAgB,EAAC;AAAA,IACjB,cAAc,EAAC;AAAA,IACf,iBAAiB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,IAC9C,UAAU,EAAC;AAAA,IACX,SAAS,YAAY;AACnB,MAAA,MAAM,QAAA,CAAS,UAAA,EAAY,MAAA,EAAQ,OAAO,CAAA;AAAA,IAC5C,CAAA;AAAA,IACA,WAAW,CAAC,KAAA,KAAU,gBAAA,CAAiB,MAAA,CAAO,gBAAgB,KAAK;AAAA,GACrE;AAEA,EAAA,MAAM,QAAA,CAAS,UAAA,EAAY,MAAA,EAAQ,OAAO,CAAA;AAC1C,EAAA,OAAO,MAAA;AACT;AAmBO,SAAS,iBAAA,GAA8B;AAC5C,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,QAAQ,GAAA,CAAI,sBAAA;AAOpE,EAAA,IAAI,MAAA,IAAU,WAAW,MAAM,CAAA,QAAS,IAAA,CAAKA,OAAA,CAAY,MAAM,CAAC,CAAA;AAChE,EAAA,MAAM,OAAA,GAAU,yBAAyB,gBAAgB,CAAA;AACzD,EAAA,IAAI,OAAA,EAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAC/B,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,KAAK,CAAC,CAAA;AAC3B;AAYO,SAAS,wBAAA,GAAmC;AACjD,EAAA,MAAM,MAAM,8BAAA,EAA+B;AAC3C,EAAA,IAAI,KAAK,OAAO,GAAA;AAEhB,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,+LAAA;AAAA,GAIF;AACF;AAUO,SAAS,8BAAA,GAAgD;AAC9D,EAAA,OAAO,iBAAA,EAAkB,CAAE,CAAC,CAAA,IAAK,IAAA;AACnC;AAoBA,IAAI,0BAAA;AAEG,SAAS,4BAAA,GAA8C;AAC5D,EAAA,IAAI,0BAAA,KAA+B,QAAW,OAAO,0BAAA;AACrD,EAAA,0BAAA,GAA6B,4BAAA,EAA6B;AAC1D,EAAA,OAAO,0BAAA;AACT;AAEA,SAAS,4BAAA,GAA8C;AACrD,EAAA,IAAI;AACF,IAAA,MAAMC,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAC7C,IAAA,OAAO,OAAA,CAAQA,QAAAA,CAAQ,OAAA,CAAQ,iCAAiC,CAAC,CAAA;AAAA,EACnE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACxC,IAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,OAAA,EAAS,OAAO,CAAC,CAAA;AACrD,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,oBAAA,EAAsB,OAAO,GAAA;AAAA,MAChD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,QAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAiBO,SAAS,yBAAyB,MAAA,EAA+B;AACtE,EAAA,MAAM,OAAO,4BAAA,EAA6B;AAC1C,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAC,CAAA,EAAG;AACnE,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,IAAA;AAAA,EAC/B;AACA,EAAA,OAAO,IAAA;AACT;AAIA,IAAM,oBAAA,mBAA4C,IAAI,GAAA,CAAI,CAAC,WAAW,CAAC,CAAA;AAEvE,eAAe,QAAA,CACb,UAAA,EACA,MAAA,EACA,OAAA,EACe;AACf,EAAA,MAAA,CAAO,iBAAiB,EAAC;AACzB,EAAA,MAAA,CAAO,eAAe,EAAC;AACvB,EAAA,MAAA,CAAO,kBAAkB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AACtD,EAAA,MAAA,CAAO,WAAW,EAAC;AAEnB,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,MAAM,YAAA,GAAe,0BAAA,CAA2B,qBAAA,CAAsB,MAAA,CAAO,OAAO,CAAC,CAAA;AACrF,EAAA,MAAM,KAAA,GAAQ,UAAU,UAAU,CAAA;AAGlC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,IAAA,MAAM,UAAU,MAAM,cAAA,CAAe,IAAA,EAAM,IAAA,EAAM,YAAY,KAAK,CAAA;AAClE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,sBAAA,CAAuB,IAAA,EAAM,IAAI;AAAA,OAC3C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AAGF,MAAA,MAAM,QAAA,GAAW,IAAA,KAAS,iCAAA,GAAoC,wBAAA,GAA2B,IAAA;AAGzF,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,OAAA,EAAS,QAAA,EAAU;AAAA,QACrD,UAAA,EAAY,oBAAA;AAAA,QACZ,cAAc,MAAM;AAAA,QAAC;AAAA,OACtB,CAAA;AACD,MAAA,MAAM,UAAU,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,WAAW,CAAA;AAC5D,MAAA,MAAA,CAAO,cAAA,CAAe,IAAA,CAAK,GAAG,OAAO,CAAA;AAAA,IACvC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,CAAA,2BAAA,EAA8B,IAAI,CAAA,KAAA,EAAQ,OAAO,CAAA,EAAA,EACxD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF;AAMA,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAA,CAAO,cAAA,GAAiB,MAAA,CAAO,cAAA,CAAe,MAAA,CAAO,CAAC,CAAA,KAAM;AAC1D,IAAA,MAAM,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,CAAA;AAC/B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,KAAA;AAC1B,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AAGD,EAAA,KAAA,MAAW,CAAC,OAAO,CAAC,CAAA,IAAA,CAAM,OAAO,UAAA,IAAc,EAAC,EAAG,OAAA,EAAQ,EAAG;AAG5D,IAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAA,CAAE,WAAW,EAAA,EAAI;AACnD,MAAA,MAAM,SAAU,CAAA,CAAyC,OAAA;AACzD,MAAA,MAAM,KAAA,GAAQ,OAAO,CAAA,CAAE,EAAA,KAAO,YAAY,CAAA,CAAE,EAAA,KAAO,EAAA,GAAK,CAAA,CAAA,EAAI,CAAA,CAAE,EAAE,CAAA,CAAA,CAAA,GAAM,CAAA,CAAA,EAAI,QAAQ,CAAC,CAAA,CAAA;AACnF,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,gBAAA;AAAA,QACN,GAAI,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,IAAY,CAAA,CAAE,EAAA,KAAO,EAAA,GAAK,EAAE,aAAA,EAAe,CAAA,CAAE,EAAA,KAAO,EAAC;AAAA,QACzE,OAAA,EACE,MAAA,KAAW,MAAA,GACP,CAAA,UAAA,EAAa,KAAK,CAAA,iBAAA,EAAoB,MAAA,CAAO,MAAM,CAAC,CAAA,4DAAA,CAAA,GACpD,CAAA,UAAA,EAAa,KAAK,CAAA,uEAAA;AAAA,OACzB,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,CAAA,CAAE,MAAA,EAAQ,aAAA,EAAe,CAAA,CAAE,EAAA,EAAI,CAAA;AAAA,EACrF;AAGA,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,KAAA,MAAW,GAAA,IAAO,OAAO,YAAA,EAAc;AACrC,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,MAAA,CAAO,cAAA,EAAgB,GAAG,CAAA;AAEzD,IAAA,IAAI,CAAC,KAAA,IAAS,OAAA,CAAQ,kBAAA,GAAqB,GAAA,CAAI,IAAI,CAAA,EAAG;AACtD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,gBAAA;AAAA,QACN,eAAe,GAAA,CAAI,aAAA;AAAA,QACnB,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,OAAA,EACE,CAAA,QAAA,EAAW,GAAA,CAAI,IAAI,YAAY,GAAA,CAAI,IAAI,CAAA,gBAAA,EAAmB,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,aAAa,CAAA,gBAAA,EACxE,IAAI,IAAI,CAAA,sGAAA;AAAA,OAE3B,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAO,KAAA,CAAM,QAAA,EAAU,QAAA,IAAY,EAAC;AAC1C,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AACrD,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EACvD;AACA,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACjD,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACnD;AAUA,SAAS,2BACP,QAAA,EACmC;AACnC,EAAA,MAAM,MAAA,GAA4C,EAAE,GAAI,QAAA,IAAY,EAAC,EAAG;AACxE,EAAA,MAAM,QAAQ,iBAAA,EAAkB;AAChC,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AAItB,IAAA,IAAI,CAAC,OAAO,wBAAwB,CAAA,SAAU,wBAAwB,CAAA,GAAI,EAAE,IAAA,EAAM,EAAA,EAAG;AACrF,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,IAAA,GACJ,MAAM,MAAA,GAAS,CAAA,GACX,CAAC,iCAAA,EAAmC,wBAAwB,CAAA,GAC5D,CAAC,wBAAwB,CAAA;AAC/B,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AACxB,IAAA,MAAM,MAAM,IAAA,CAAK,CAAC,KAAK,CAAA,EAAG,wBAAwB,IAAI,CAAC,CAAA,CAAA;AACvD,IAAA,IAAI,CAAC,OAAO,GAAG,CAAA,SAAU,GAAG,CAAA,GAAI,EAAE,IAAA,EAAM,GAAA,EAAI;AAAA,EAC9C,CAAC,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAoBA,eAAe,cAAA,CACb,IAAA,EACA,IAAA,EACA,UAAA,EACA,KAAA,EACwB;AAExB,EAAA,MAAM,MAAA,GAAS,MAAM,IAAI,CAAA;AACzB,EAAA,IAAI,MAAA,IAAW,MAAM,UAAA,CAAW,MAAM,GAAI,OAAO,MAAA;AAGjD,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,MAAM,QAAA,GAAWD,OAAA,CAAY,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAClD,IAAA,OAAQ,MAAM,UAAA,CAAW,QAAQ,CAAA,GAAK,QAAA,GAAW,IAAA;AAAA,EACnD;AAKA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,MAAM,cAAc,IAAA,CAAK,UAAA,EAAY,SAAA,EAAW,OAAA,EAAS,WAAW,IAAI,CAAA;AAIxE,IAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,MAClB,SAAS,WAAW,CAAA,CAAA;AAAA,MACpB,YAAY;AACV,QAAA,MAAM,MAAM,WAAW,CAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACT,CAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,QAAQ,WAAA,GAAc,IAAA;AAAA,EAC/B;AAEA,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAW,IAAA,EAAgC;AAClD,EAAA,OAAO,iBAAA;AAAA,IACL,QAAQ,IAAI,CAAA,CAAA;AAAA,IACZ,YAAY;AACV,MAAA,MAAM,KAAK,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,sBAAA,CAAuB,MAAc,IAAA,EAAiC;AAC7E,EAAA,IAAI,SAAS,wBAAA,IAA4B,CAAC,KAAK,IAAA,IAAQ,CAAC,KAAK,GAAA,EAAK;AAChE,IAAA,OACE,CAAA,oHAAA,CAAA;AAAA,EAGJ;AACA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,GAAA,EAAM,IAAA,CAAK,GAAG,CAAA,8EAAA,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,kBAAA,EAAqB,IAAA,CAAK,IAAI,CAAA,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,eAAe,IAAI,CAAA,2BAAA,CAAA;AAC5B;AAEA,SAAS,gBAAA,CACP,SACA,KAAA,EACiC;AACjC,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAI,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,MAAM,IAAI,CAAA;AAC3D,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,QAAQ,CAAC,CAAA;AAE1C,EAAA,OAAO,MAAA;AACT","file":"chunk-JIQUF3X2.js","sourcesContent":["/**\n * Runtime asset resolution — read `skaile.yaml`, scan all declared repositories\n * (including the built-in `factory-assets/` directory as an implicit default),\n * and produce a unified view of connector catalog entries plus the implicit refs\n * that the `skaile.yaml` `connectors:` section adds to the dependency graph.\n *\n * This module is the single source of truth for \"which connectors does this\n * project see at runtime, and where do their implementations live on disk\".\n * Both the runner (serve, REPL, flow) and the platform's mid-session\n * `add_resource` flow consume `RuntimeAssetsResult.catalogEntries` and pass\n * it into `ConnectorManager` for catalog-based resolution.\n *\n * `factory-assets/` is the single first-party content tree (built-in connectors\n * + first-party skills + bundles) shipped inside the `@skaile/workspaces`\n * package — not a standalone package.\n *\n * It resolves to an **ordered list of roots** ({@link factoryAssetRoots}), not a\n * single dir. The bundled tree is always the baseline; an optional\n * `SKAILE_FACTORY_ASSETS_DIR` (legacy: `SKAILE_BASE_ASSETS_DIR`) is layered\n * **in front** as an additive override source — the agent container points it at\n * `/app/factory-assets/` (or a bind-mounted host dir) to ship updated skills /\n * flows / bundles / connector manifests without rebuilding the image. The two\n * roots resolve uniformly across every consumer (connector catalog scan, skill /\n * flow / completion discovery, the asset-manager factory source):\n *   1. `SKAILE_FACTORY_ASSETS_DIR` env dir, when set and existing (override layer).\n *   2. the bundled tree via {@link resolvePackagedAssetsDir} — the in-repo source\n *      `packages/workspaces/factory-assets/` during dev, else the published\n *      `dist/factory-assets/` after install (always-present baseline).\n *\n * Override semantics are **env-first**: on a name conflict the env root wins and\n * the bundled root fills the rest. Connector *code* still loads via the package's\n * static `exports` map, so the env root can override/add skills, flows, bundles,\n * and connector **manifests/metadata**, but cannot ship a new executable\n * connector — its `.js` is not on the package's import graph.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { lstat, stat } from \"node:fs/promises\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join, resolve as resolvePath } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { tryWithFsDeadline } from \"./fs-deadline.js\";\nimport { scanDirectory } from \"./manifest.js\";\nimport type { CatalogEntry } from \"./models.js\";\nimport { getGlobalCacheDir, readLinks, sourceCacheKey } from \"./repo-manager.js\";\nimport type { SourceDeclaration, SourceEntry } from \"./workspace-config.js\";\nimport { resolveSkWorkspaceConfig } from \"./workspace-config.js\";\n\n/**\n * Map declared `sources[]` to internal `SourceDeclaration`s keyed by the\n * collision-free {@link sourceCacheKey} (`<host>/<owner>/<repo>`), pointing at\n * the unified machine-cache clone path (`getGlobalCacheDir()/<key>/`). Keyed by\n * the same function every other cache writer/reader uses so the path resolves.\n */\nfunction sourcesToDeclarations(\n  sources: SourceEntry[] | undefined,\n): Record<string, SourceDeclaration> {\n  const sourcesDir = getGlobalCacheDir();\n  const out: Record<string, SourceDeclaration> = {};\n  for (const s of sources ?? []) {\n    const key = sourceCacheKey(s.url);\n    if (out[key]) continue;\n    out[key] = {\n      path: join(sourcesDir, key),\n      url: s.url,\n      branch: s.pin,\n      ...(s.publisher ? { publisher: s.publisher } : {}),\n    };\n  }\n  return out;\n}\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\n/**\n * Catalog entry filtered to mount/connector kinds. Same shape as `CatalogEntry`.\n * @docLink packages/core/concepts#runtime-catalog-entry\n */\nexport type RuntimeCatalogEntry = CatalogEntry;\n\n/**\n * Implicit catalog reference derived from a `connectors:` declaration in `skaile.yaml`.\n * Each connector driver becomes an implicit ref that must be resolved in the catalog.\n * @docLink packages/core/concepts#runtime-asset-ref\n */\nexport interface RuntimeAssetRef {\n  kind: \"connector\";\n  /** Driver name — matches `RuntimeCatalogEntry.name`. */\n  name: string;\n  /** Source declaration id from `skaile.yaml`. */\n  declarationId: string;\n}\n\n/**\n * Aggregated npm packages required by all resolved mount/connector adapters.\n * Populated from `metadata.npm_deps` in each matched catalog entry.\n * @docLink packages/core/concepts#runtime-npm-deps\n */\nexport interface RuntimeNpmDeps {\n  required: string[];\n  optional: string[];\n}\n\n/**\n * Non-fatal warning emitted during `resolveRuntimeAssets` when a repo is unavailable\n * or a driver is not found in any catalog.\n * @docLink packages/core/concepts#runtime-asset-warning\n */\nexport interface RuntimeAssetWarning {\n  /** Stable code for filtering / structured logging. */\n  code: \"missing_driver\" | \"repo_unavailable\" | \"invalid_repo_decl\";\n  message: string;\n  /** Declaration id when applicable. */\n  declarationId?: string;\n  /** Driver / repository name when applicable. */\n  name?: string;\n}\n\n/**\n * Repository name used for the implicit built-in `factory-assets` catalog entry\n * (the in-package connector tree).\n * @docLink packages/core/concepts#factory-assets-repo-name\n */\nexport const FACTORY_ASSETS_REPO_NAME = \"factory-assets\";\n\n/**\n * Repository name for the optional `SKAILE_FACTORY_ASSETS_DIR` override layer,\n * scanned ahead of (and overriding) the bundled {@link FACTORY_ASSETS_REPO_NAME}.\n */\nconst FACTORY_ASSETS_OVERRIDE_REPO_NAME = \"factory-assets:override\";\n\n/**\n * Result of `resolveRuntimeAssets`.\n * The same object is mutated in place by `refresh()`, allowing callers to hold\n * a stable reference and observe updates after a new repository is cloned or\n * a driver is installed mid-session.\n * @docLink packages/core/concepts#runtime-assets-result\n */\nexport interface RuntimeAssetsResult {\n  catalogEntries: RuntimeCatalogEntry[];\n  implicitRefs: RuntimeAssetRef[];\n  requiredNpmDeps: RuntimeNpmDeps;\n  warnings: RuntimeAssetWarning[];\n  /** Re-scan repositories and re-derive implicit refs. Mutates in place. */\n  refresh(): Promise<void>;\n  /**\n   * Catalog lookup. When `kind` is omitted and multiple entries share the\n   * `name`, returns `undefined` (caller must disambiguate).\n   */\n  findEntry(query: { kind?: \"connector\"; name: string }): RuntimeCatalogEntry | undefined;\n}\n\n/** Options of {@link resolveRuntimeAssets}. */\nexport interface RuntimeAssetsOptions {\n  /**\n   * True when a connector driver is registered in the process (built-in or loaded plugin).\n   * Core does not know the registry; the caller passes its lookup. Without it only the catalog\n   * counts, so a driver a plugin registers is reported as `missing_driver`.\n   */\n  isDriverRegistered?: (driver: string) => boolean;\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/**\n * Resolve all runtime assets visible to a project by scanning declared repositories.\n *\n * Reads `skaile.yaml`, scans every declared repository (plus the implicit\n * built-in `factory-assets` repo), and derives implicit refs from `mounts:` /\n * `connectors:` declarations. Does not clone or install anything — purely a\n * read-only scan of what is already on disk. URL-only repositories that have\n * not been cloned yet are reported as `repo_unavailable` warnings.\n *\n * @param projectDir - Absolute path to the project workspace root\n * @param options - `isDriverRegistered`: a driver that no catalog entry lists but a plugin\n *   registered is not reported as `missing_driver`\n * @returns `RuntimeAssetsResult` with catalog entries, implicit refs, npm deps, and warnings\n * @docLink packages/core/concepts#resolve-runtime-assets\n */\nexport async function resolveRuntimeAssets(\n  projectDir: string,\n  options: RuntimeAssetsOptions = {},\n): Promise<RuntimeAssetsResult> {\n  const result: RuntimeAssetsResult = {\n    catalogEntries: [],\n    implicitRefs: [],\n    requiredNpmDeps: { required: [], optional: [] },\n    warnings: [],\n    refresh: async () => {\n      await populate(projectDir, result, options);\n    },\n    findEntry: (query) => findCatalogEntry(result.catalogEntries, query),\n  };\n\n  await populate(projectDir, result, options);\n  return result;\n}\n\n/**\n * Resolve the ordered list of on-disk roots for the built-in `factory-assets`\n * tree (built-in connectors + first-party skills + bundles). This is the single\n * shared resolver every consumer goes through, so the env override and the\n * bundled baseline are honoured uniformly.\n *\n * Order (env-first = override-wins):\n * 1. `SKAILE_FACTORY_ASSETS_DIR` env dir (legacy: `SKAILE_BASE_ASSETS_DIR`),\n *    when set and existing — an additive override layer.\n * 2. {@link resolvePackagedAssetsDir} — the bundled tree (in-repo source in dev,\n *    `dist/factory-assets/` after install). Always-present baseline.\n *\n * Returns `[]` only when the package cannot be located at all. De-duplicated, so\n * pointing the env var at the bundled dir collapses to one root.\n *\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function factoryAssetRoots(): string[] {\n  const roots: string[] = [];\n  const envDir = process.env.SKAILE_FACTORY_ASSETS_DIR ?? process.env.SKAILE_BASE_ASSETS_DIR;\n  // Deliberately still synchronous after #454: both candidates are\n  // container-local (the image's `/app/factory-assets/`, or the installed\n  // package tree resolved by `resolvePackagedAssetsDir`), never the FUSE\n  // workspace mount. The mount-reachable probes on this module's scan path —\n  // the project-relative `sources[].path` candidates in `resolveRepoDir` — are\n  // async and deadline-bounded.\n  if (envDir && existsSync(envDir)) roots.push(resolvePath(envDir));\n  const bundled = resolvePackagedAssetsDir(\"factory-assets\");\n  if (bundled) roots.push(bundled);\n  return [...new Set(roots)];\n}\n\n/**\n * Resolve the primary on-disk root of the `factory-assets` tree — the first of\n * {@link factoryAssetRoots} (the env override when set, else the bundled tree).\n * Prefer {@link factoryAssetRoots} when you need to scan every layer; this\n * single-dir form is for callers that want one canonical path.\n *\n * @returns Absolute path to the highest-precedence `factory-assets` directory\n * @throws When no root can be located\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function resolveFactoryAssetsRoot(): string {\n  const hit = resolveFactoryAssetsRootOrNull();\n  if (hit) return hit;\n\n  throw new Error(\n    `Cannot resolve the factory-assets directory. ` +\n      `Set SKAILE_FACTORY_ASSETS_DIR to the on-disk path, ` +\n      `ensure @skaile/workspaces is installed, ` +\n      `or run from within the @skaile/workspaces package tree.`,\n  );\n}\n\n/**\n * Non-throwing variant of {@link resolveFactoryAssetsRoot}: the same\n * env-then-packaged resolution tiers, returning `null` instead of throwing when\n * none locate the directory. Callers that treat a missing factory tree as a\n * soft \"not present\" (e.g. the asset-manager's implicit-source injection) MUST\n * use this so they honour the `SKAILE_FACTORY_ASSETS_DIR` container override\n * identically to the runtime path.\n */\nexport function resolveFactoryAssetsRootOrNull(): string | null {\n  return factoryAssetRoots()[0] ?? null;\n}\n\n/**\n * Resolve the `@skaile/workspaces` package root — the directory containing its\n * `package.json`. Tries `require.resolve` first (works when installed as a\n * dependency *and* in-repo via the self-reference), then walks upward from this\n * module looking for a `package.json` whose `name` is `@skaile/workspaces`\n * (bounded to 8 levels). Returns `null` when neither locates it.\n *\n * The single source of truth for finding content shipped inside the package —\n * the unified `factory-assets/` tree (built-in connectors + first-party skills\n * + bundles) resolves through {@link resolvePackagedAssetsDir} on top of this.\n *\n * Memoized: the package location is immutable for the process lifetime, but\n * this sits on the CLI hot path (every `findSkills` / flow / completion call\n * funnels through here), so the `require.resolve` + upward `package.json` walk\n * runs once. `undefined` = not yet computed.\n *\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nlet workspacesPackageRootCache: string | null | undefined;\n\nexport function resolveWorkspacesPackageRoot(): string | null {\n  if (workspacesPackageRootCache !== undefined) return workspacesPackageRootCache;\n  workspacesPackageRootCache = computeWorkspacesPackageRoot();\n  return workspacesPackageRootCache;\n}\n\nfunction computeWorkspacesPackageRoot(): string | null {\n  try {\n    const require = createRequire(import.meta.url);\n    return dirname(require.resolve(\"@skaile/workspaces/package.json\"));\n  } catch {\n    // Fall through to the workspace walk.\n  }\n  let dir: string;\n  try {\n    dir = dirname(fileURLToPath(import.meta.url));\n  } catch {\n    return null;\n  }\n  for (let i = 0; i < 8; i++) {\n    const pkgPath = join(dir, \"package.json\");\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, \"utf-8\")) as { name?: string };\n        if (pkg.name === \"@skaile/workspaces\") return dir;\n      } catch {\n        // Ignore malformed package.json and keep walking.\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Locate a content-asset directory inside the package. Prefers the in-repo\n * **source** dir `<pkgRoot>/<subdir>` when present — in a dev checkout it is the\n * full tree (e.g. `factory-assets/` keeps the connector `.ts` entry files that\n * `dist/` does not) — then the published `dist/<subdir>` copy (what\n * `files: [\"dist\"]` ships, the only one present after `npm i`). Returns `null`\n * when neither exists.\n *\n * `factory-assets/` resolves to the source tree in dev (code + skills + bundles)\n * and to `dist/factory-assets` post-install (compiled connectors + copied\n * manifests/skills/bundles).\n *\n * @param subdir - `\"factory-assets\"` | …\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function resolvePackagedAssetsDir(subdir: string): string | null {\n  const root = resolveWorkspacesPackageRoot();\n  if (!root) return null;\n  for (const cand of [join(root, subdir), join(root, \"dist\", subdir)]) {\n    if (existsSync(cand)) return cand;\n  }\n  return null;\n}\n\n// ─── Internals ────────────────────────────────────────────────────────────────\n\nconst CONNECTOR_SCAN_KINDS: ReadonlySet<string> = new Set([\"connector\"]);\n\nasync function populate(\n  projectDir: string,\n  target: RuntimeAssetsResult,\n  options: RuntimeAssetsOptions,\n): Promise<void> {\n  target.catalogEntries = [];\n  target.implicitRefs = [];\n  target.requiredNpmDeps = { required: [], optional: [] };\n  target.warnings = [];\n\n  const config = resolveSkWorkspaceConfig(projectDir);\n  // Connector catalog scan runs over the project's declared sources[] (resolved\n  // to their machine-cache clone paths) plus the implicit factory-assets repo.\n  const repositories = buildEffectiveRepositories(sourcesToDeclarations(config.sources));\n  const links = readLinks(projectDir);\n\n  // Scan each repository for connector entries.\n  for (const [name, decl] of Object.entries(repositories)) {\n    const repoDir = await resolveRepoDir(name, decl, projectDir, links);\n    if (!repoDir) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: repoUnavailableMessage(name, decl),\n      });\n      continue;\n    }\n    try {\n      // Both factory layers carry the same `factory-assets` provenance — the\n      // override repo is an internal scan-order device, not a distinct source.\n      const repoName = name === FACTORY_ASSETS_OVERRIDE_REPO_NAME ? FACTORY_ASSETS_REPO_NAME : name;\n      // Only connector descriptors are consumed here, so only that kind is\n      // \"known\": typed manifests of any other kind are irrelevant to this scan.\n      const scanned = await scanDirectory(repoDir, repoName, {\n        knownKinds: CONNECTOR_SCAN_KINDS,\n        onDiagnostic: () => {},\n      });\n      const entries = scanned.filter((e) => e.kind === \"connector\");\n      target.catalogEntries.push(...entries);\n    } catch (err) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: `Failed to scan repository \"${name}\" at ${repoDir}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      });\n    }\n  }\n\n  // De-duplicate by (kind, name), keeping the first occurrence. Scan order is\n  // declared sources → env override → bundled baseline, so an env-supplied\n  // connector manifest overrides the bundled one and the bundled one fills the\n  // rest (the override layer can refresh built-in manifests in place).\n  const seen = new Set<string>();\n  target.catalogEntries = target.catalogEntries.filter((e) => {\n    const key = `${e.kind}:${e.name}`;\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n\n  // Derive implicit refs from skaile.yaml connectors.\n  for (const [index, c] of (config.connectors ?? []).entries()) {\n    // No `driver` (a misspelt or old `adapter:` key): say so with the text `validate` prints,\n    // not a warning about the driver `\"undefined\"` (p1739).\n    if (typeof c.driver !== \"string\" || c.driver === \"\") {\n      const legacy = (c as unknown as Record<string, unknown>).adapter;\n      const label = typeof c.id === \"string\" && c.id !== \"\" ? `\"${c.id}\"` : `#${index + 1}`;\n      target.warnings.push({\n        code: \"missing_driver\",\n        ...(typeof c.id === \"string\" && c.id !== \"\" ? { declarationId: c.id } : {}),\n        message:\n          legacy !== undefined\n            ? `Connector ${label} sets \\`adapter: ${String(legacy)}\\`; the key is \\`driver\\`. Rename \\`adapter\\` to \\`driver\\`.`\n            : `Connector ${label} has no \\`driver\\`; the runner cannot mount it. Add \\`driver: <name>\\`.`,\n      });\n      continue;\n    }\n    target.implicitRefs.push({ kind: \"connector\", name: c.driver, declarationId: c.id });\n  }\n\n  // Validate refs and aggregate npm deps.\n  const requiredSet = new Set<string>();\n  const optionalSet = new Set<string>();\n  for (const ref of target.implicitRefs) {\n    const entry = findCatalogEntry(target.catalogEntries, ref);\n    // A plugin's connector has no catalog entry: the process registry knows it.\n    if (!entry && options.isDriverRegistered?.(ref.name)) continue;\n    if (!entry) {\n      target.warnings.push({\n        code: \"missing_driver\",\n        declarationId: ref.declarationId,\n        name: ref.name,\n        message:\n          `Unknown ${ref.kind} driver \"${ref.name}\" referenced by ${ref.kind} \"${ref.declarationId}\". ` +\n          `Run \\`skaile ${ref.kind} catalog\\` to see available drivers, ` +\n          `or declare a repository in skaile.yaml that provides this driver.`,\n      });\n      continue;\n    }\n    const npm = (entry.metadata?.npm_deps ?? {}) as { required?: string[]; optional?: string[] };\n    for (const p of npm.required ?? []) requiredSet.add(p);\n    for (const p of npm.optional ?? []) optionalSet.add(p);\n  }\n  target.requiredNpmDeps.required = [...requiredSet];\n  target.requiredNpmDeps.optional = [...optionalSet];\n}\n\n/**\n * Build the effective `repositories` map: caller's declarations first, then the\n * implicit built-in `factory-assets` repos. Each {@link factoryAssetRoots} layer\n * becomes its own repo, the env override inserted **before** the bundled\n * baseline so its connector entries win on the first-match dedup downstream.\n * When the package cannot be located at all, a path-less sentinel under\n * {@link FACTORY_ASSETS_REPO_NAME} drives the `repo_unavailable` warning.\n */\nfunction buildEffectiveRepositories(\n  declared: Record<string, SourceDeclaration> | undefined,\n): Record<string, SourceDeclaration> {\n  const result: Record<string, SourceDeclaration> = { ...(declared ?? {}) };\n  const roots = factoryAssetRoots();\n  if (roots.length === 0) {\n    // Surface as a warning during scan rather than throwing here — let the\n    // caller decide whether factory-assets is required. resolveRepoDir() /\n    // repoUnavailableMessage re-discover the failure and emit it.\n    if (!result[FACTORY_ASSETS_REPO_NAME]) result[FACTORY_ASSETS_REPO_NAME] = { path: \"\" };\n    return result;\n  }\n  // override-first when both layers exist, so the env root's entries are scanned\n  // (and matched) ahead of the bundled baseline.\n  const keys =\n    roots.length > 1\n      ? [FACTORY_ASSETS_OVERRIDE_REPO_NAME, FACTORY_ASSETS_REPO_NAME]\n      : [FACTORY_ASSETS_REPO_NAME];\n  roots.forEach((dir, i) => {\n    const key = keys[i] ?? `${FACTORY_ASSETS_REPO_NAME}:${i}`;\n    if (!result[key]) result[key] = { path: dir };\n  });\n  return result;\n}\n\n/**\n * Resolve a repository declaration to an on-disk directory. Order:\n *   1. Linked override (`.skaile/links.yaml`).\n *   2. Local `path` — relative to `projectDir`.\n *   3. Cloned URL repo at `.skaile/cache/sources/<name>/` (must already exist).\n *\n * Returns `null` when none of these resolve. Does not clone.\n *\n * **Async and deadline-bounded since #454.** Every candidate here is a\n * project-relative or operator-supplied path, so a `sources[].path` of\n * `workspace/my-assets` resolves onto the rclone FUSE mount — the same tree the\n * scan that follows walks. Probing it with `existsSync`/`lstatSync` would park\n * the `skaile serve` event loop *before* the (now async) scan ever ran, which\n * would leave the H2 fix meaningless on the very declaration that triggers it.\n * A probe that misses its deadline reads as \"unavailable\", which is what the\n * caller already does with an absent path — it becomes a `repo_unavailable`\n * warning rather than a stall.\n */\nasync function resolveRepoDir(\n  name: string,\n  decl: SourceDeclaration,\n  projectDir: string,\n  links: Record<string, string>,\n): Promise<string | null> {\n  // 1. Linked override\n  const linked = links[name];\n  if (linked && (await pathExists(linked))) return linked;\n\n  // 2. Local path\n  if (decl.path) {\n    const resolved = resolvePath(projectDir, decl.path);\n    return (await pathExists(resolved)) ? resolved : null;\n  }\n\n  // 3. URL repo cloned to project's .skaile/cache/sources/<name> — the\n  //    project-local clone dir (often a symlink into the global cache, which\n  //    lives at getGlobalCacheDir()); NOT the global clone root itself.\n  if (decl.url) {\n    const projectDest = join(projectDir, \".skaile\", \"cache\", \"sources\", name);\n    // One `lstat` answers both questions the pre-#454 `existsSync` + `lstatSync`\n    // pair asked, and `lstat` (not `stat`) keeps the \"a symlink into the global\n    // cache counts\" behaviour intact.\n    const found = await tryWithFsDeadline(\n      `lstat ${projectDest}`,\n      async () => {\n        await lstat(projectDest);\n        return true;\n      },\n      false,\n    );\n    return found ? projectDest : null;\n  }\n\n  return null;\n}\n\n/** Deadline-bounded `existsSync` replacement — a wedged mount reads as absent. */\nfunction pathExists(path: string): Promise<boolean> {\n  return tryWithFsDeadline(\n    `stat ${path}`,\n    async () => {\n      await stat(path);\n      return true;\n    },\n    false,\n  );\n}\n\nfunction repoUnavailableMessage(name: string, decl: SourceDeclaration): string {\n  if (name === FACTORY_ASSETS_REPO_NAME && !decl.path && !decl.url) {\n    return (\n      `Cannot resolve the built-in factory-assets. ` +\n      `Set SKAILE_FACTORY_ASSETS_DIR or ensure @skaile/workspaces is installed.`\n    );\n  }\n  if (decl.url) {\n    return `Repository \"${name}\" (${decl.url}) is not available. Register it as a Library Source via \\`skaile source add\\`.`;\n  }\n  if (decl.path) {\n    return `Repository \"${name}\" path not found: ${decl.path}`;\n  }\n  return `Repository \"${name}\" has neither url nor path.`;\n}\n\nfunction findCatalogEntry(\n  entries: RuntimeCatalogEntry[],\n  query: { kind?: \"connector\"; name: string },\n): RuntimeCatalogEntry | undefined {\n  if (query.kind) {\n    return entries.find((e) => e.kind === query.kind && e.name === query.name);\n  }\n  const matches = entries.filter((e) => e.name === query.name);\n  if (matches.length === 1) return matches[0];\n  // 0 or >1 with no kind — caller must disambiguate.\n  return undefined;\n}\n"]}
+{"version":3,"sources":["../core/src/runtime-assets.ts"],"names":["resolvePath","require"],"mappings":";;;;;;;;AAsDA,SAAS,sBACP,OAAA,EACmC;AACnC,EAAA,MAAM,aAAa,iBAAA,EAAkB;AACrC,EAAA,MAAM,MAAyC,EAAC;AAChD,EAAA,KAAA,MAAW,CAAA,IAAK,OAAA,IAAW,EAAC,EAAG;AAC7B,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,CAAA,CAAE,GAAG,CAAA;AAChC,IAAA,IAAI,GAAA,CAAI,GAAG,CAAA,EAAG;AACd,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI;AAAA,MACT,IAAA,EAAM,IAAA,CAAK,UAAA,EAAY,GAAG,CAAA;AAAA,MAC1B,KAAK,CAAA,CAAE,GAAA;AAAA,MACP,QAAQ,CAAA,CAAE,GAAA;AAAA,MACV,GAAI,EAAE,SAAA,GAAY,EAAE,WAAW,CAAA,CAAE,SAAA,KAAc;AAAC,KAClD;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAqDO,IAAM,wBAAA,GAA2B;AAMxC,IAAM,iCAAA,GAAoC,yBAAA;AAkD1C,eAAsB,oBAAA,CACpB,UAAA,EACA,OAAA,GAAgC,EAAC,EACH;AAC9B,EAAA,MAAM,MAAA,GAA8B;AAAA,IAClC,gBAAgB,EAAC;AAAA,IACjB,cAAc,EAAC;AAAA,IACf,iBAAiB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,IAC9C,UAAU,EAAC;AAAA,IACX,SAAS,YAAY;AACnB,MAAA,MAAM,QAAA,CAAS,UAAA,EAAY,MAAA,EAAQ,OAAO,CAAA;AAAA,IAC5C,CAAA;AAAA,IACA,WAAW,CAAC,KAAA,KAAU,gBAAA,CAAiB,MAAA,CAAO,gBAAgB,KAAK;AAAA,GACrE;AAEA,EAAA,MAAM,QAAA,CAAS,UAAA,EAAY,MAAA,EAAQ,OAAO,CAAA;AAC1C,EAAA,OAAO,MAAA;AACT;AAmBO,SAAS,iBAAA,GAA8B;AAC5C,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,yBAAA,IAA6B,QAAQ,GAAA,CAAI,sBAAA;AAOpE,EAAA,IAAI,MAAA,IAAU,WAAW,MAAM,CAAA,QAAS,IAAA,CAAKA,OAAA,CAAY,MAAM,CAAC,CAAA;AAChE,EAAA,MAAM,OAAA,GAAU,yBAAyB,gBAAgB,CAAA;AACzD,EAAA,IAAI,OAAA,EAAS,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAC/B,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,KAAK,CAAC,CAAA;AAC3B;AAYO,SAAS,wBAAA,GAAmC;AACjD,EAAA,MAAM,MAAM,8BAAA,EAA+B;AAC3C,EAAA,IAAI,KAAK,OAAO,GAAA;AAEhB,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,+LAAA;AAAA,GAIF;AACF;AAUO,SAAS,8BAAA,GAAgD;AAC9D,EAAA,OAAO,iBAAA,EAAkB,CAAE,CAAC,CAAA,IAAK,IAAA;AACnC;AAoBA,IAAI,0BAAA;AAEG,SAAS,4BAAA,GAA8C;AAC5D,EAAA,IAAI,0BAAA,KAA+B,QAAW,OAAO,0BAAA;AACrD,EAAA,0BAAA,GAA6B,4BAAA,EAA6B;AAC1D,EAAA,OAAO,0BAAA;AACT;AAEA,SAAS,4BAAA,GAA8C;AACrD,EAAA,IAAI;AACF,IAAA,MAAMC,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAC7C,IAAA,OAAO,OAAA,CAAQA,QAAAA,CAAQ,OAAA,CAAQ,iCAAiC,CAAC,CAAA;AAAA,EACnE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACxC,IAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,OAAA,EAAS,OAAO,CAAC,CAAA;AACrD,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,oBAAA,EAAsB,OAAO,GAAA;AAAA,MAChD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,QAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAiBO,SAAS,yBAAyB,MAAA,EAA+B;AACtE,EAAA,MAAM,OAAO,4BAAA,EAA6B;AAC1C,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAC,CAAA,EAAG;AACnE,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,IAAA;AAAA,EAC/B;AACA,EAAA,OAAO,IAAA;AACT;AAIA,IAAM,oBAAA,mBAA4C,IAAI,GAAA,CAAI,CAAC,WAAW,CAAC,CAAA;AAEvE,eAAe,QAAA,CACb,UAAA,EACA,MAAA,EACA,OAAA,EACe;AACf,EAAA,MAAA,CAAO,iBAAiB,EAAC;AACzB,EAAA,MAAA,CAAO,eAAe,EAAC;AACvB,EAAA,MAAA,CAAO,kBAAkB,EAAE,QAAA,EAAU,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AACtD,EAAA,MAAA,CAAO,WAAW,EAAC;AAEnB,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,MAAM,YAAA,GAAe,0BAAA,CAA2B,qBAAA,CAAsB,MAAA,CAAO,OAAO,CAAC,CAAA;AACrF,EAAA,MAAM,KAAA,GAAQ,UAAU,UAAU,CAAA;AAGlC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,EAAG;AACvD,IAAA,MAAM,UAAU,MAAM,cAAA,CAAe,IAAA,EAAM,IAAA,EAAM,YAAY,KAAK,CAAA;AAClE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,sBAAA,CAAuB,IAAA,EAAM,IAAI;AAAA,OAC3C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AAGF,MAAA,MAAM,QAAA,GAAW,IAAA,KAAS,iCAAA,GAAoC,wBAAA,GAA2B,IAAA;AAGzF,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,OAAA,EAAS,QAAA,EAAU;AAAA,QACrD,UAAA,EAAY,oBAAA;AAAA,QACZ,cAAc,MAAM;AAAA,QAAC;AAAA,OACtB,CAAA;AACD,MAAA,MAAM,UAAU,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,WAAW,CAAA;AAC5D,MAAA,MAAA,CAAO,cAAA,CAAe,IAAA,CAAK,GAAG,OAAO,CAAA;AAAA,IACvC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,kBAAA;AAAA,QACN,IAAA;AAAA,QACA,OAAA,EAAS,CAAA,2BAAA,EAA8B,IAAI,CAAA,KAAA,EAAQ,OAAO,CAAA,EAAA,EACxD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF;AAMA,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAA,CAAO,cAAA,GAAiB,MAAA,CAAO,cAAA,CAAe,MAAA,CAAO,CAAC,CAAA,KAAM;AAC1D,IAAA,MAAM,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,CAAA,CAAA;AAC/B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,KAAA;AAC1B,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AAGD,EAAA,KAAA,MAAW,CAAC,OAAO,CAAC,CAAA,IAAA,CAAM,OAAO,UAAA,IAAc,EAAC,EAAG,OAAA,EAAQ,EAAG;AAG5D,IAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,IAAY,CAAA,CAAE,WAAW,EAAA,EAAI;AACnD,MAAA,MAAM,SAAU,CAAA,CAAyC,OAAA;AACzD,MAAA,MAAM,KAAA,GAAQ,OAAO,CAAA,CAAE,EAAA,KAAO,YAAY,CAAA,CAAE,EAAA,KAAO,EAAA,GAAK,CAAA,CAAA,EAAI,CAAA,CAAE,EAAE,CAAA,CAAA,CAAA,GAAM,CAAA,CAAA,EAAI,QAAQ,CAAC,CAAA,CAAA;AACnF,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,gBAAA;AAAA,QACN,GAAI,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,IAAY,CAAA,CAAE,EAAA,KAAO,EAAA,GAAK,EAAE,aAAA,EAAe,CAAA,CAAE,EAAA,KAAO,EAAC;AAAA,QACzE,OAAA,EACE,MAAA,KAAW,MAAA,GACP,CAAA,UAAA,EAAa,KAAK,CAAA,iBAAA,EAAoB,MAAA,CAAO,MAAM,CAAC,CAAA,4DAAA,CAAA,GACpD,CAAA,UAAA,EAAa,KAAK,CAAA,uEAAA;AAAA,OACzB,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,CAAA,CAAE,MAAA,EAAQ,aAAA,EAAe,CAAA,CAAE,EAAA,EAAI,CAAA;AAAA,EACrF;AAGA,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,EAAA,KAAA,MAAW,GAAA,IAAO,OAAO,YAAA,EAAc;AACrC,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,MAAA,CAAO,cAAA,EAAgB,GAAG,CAAA;AAEzD,IAAA,IAAI,CAAC,KAAA,IAAS,OAAA,CAAQ,kBAAA,GAAqB,GAAA,CAAI,IAAI,CAAA,EAAG;AACtD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAA,CAAO,SAAS,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,gBAAA;AAAA,QACN,eAAe,GAAA,CAAI,aAAA;AAAA,QACnB,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,OAAA,EACE,CAAA,QAAA,EAAW,GAAA,CAAI,IAAI,YAAY,GAAA,CAAI,IAAI,CAAA,gBAAA,EAAmB,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,aAAa,CAAA,gBAAA,EACxE,IAAI,IAAI,CAAA,sGAAA;AAAA,OAE3B,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAO,KAAA,CAAM,QAAA,EAAU,QAAA,IAAY,EAAC;AAC1C,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AACrD,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,QAAA,IAAY,EAAC,EAAG,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EACvD;AACA,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACjD,EAAA,MAAA,CAAO,eAAA,CAAgB,QAAA,GAAW,CAAC,GAAG,WAAW,CAAA;AACnD;AAUA,SAAS,2BACP,QAAA,EACmC;AACnC,EAAA,MAAM,MAAA,GAA4C,EAAE,GAAI,QAAA,IAAY,EAAC,EAAG;AACxE,EAAA,MAAM,QAAQ,iBAAA,EAAkB;AAChC,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AAItB,IAAA,IAAI,CAAC,OAAO,wBAAwB,CAAA,SAAU,wBAAwB,CAAA,GAAI,EAAE,IAAA,EAAM,EAAA,EAAG;AACrF,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,MAAM,IAAA,GACJ,MAAM,MAAA,GAAS,CAAA,GACX,CAAC,iCAAA,EAAmC,wBAAwB,CAAA,GAC5D,CAAC,wBAAwB,CAAA;AAC/B,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AACxB,IAAA,MAAM,MAAM,IAAA,CAAK,CAAC,KAAK,CAAA,EAAG,wBAAwB,IAAI,CAAC,CAAA,CAAA;AACvD,IAAA,IAAI,CAAC,OAAO,GAAG,CAAA,SAAU,GAAG,CAAA,GAAI,EAAE,IAAA,EAAM,GAAA,EAAI;AAAA,EAC9C,CAAC,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAoBA,eAAe,cAAA,CACb,IAAA,EACA,IAAA,EACA,UAAA,EACA,KAAA,EACwB;AAExB,EAAA,MAAM,MAAA,GAAS,MAAM,IAAI,CAAA;AACzB,EAAA,IAAI,MAAA,IAAW,MAAM,UAAA,CAAW,MAAM,GAAI,OAAO,MAAA;AAGjD,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,MAAM,QAAA,GAAWD,OAAA,CAAY,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAClD,IAAA,OAAQ,MAAM,UAAA,CAAW,QAAQ,CAAA,GAAK,QAAA,GAAW,IAAA;AAAA,EACnD;AAKA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,MAAM,cAAc,IAAA,CAAK,UAAA,EAAY,SAAA,EAAW,OAAA,EAAS,WAAW,IAAI,CAAA;AAIxE,IAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,MAClB,SAAS,WAAW,CAAA,CAAA;AAAA,MACpB,YAAY;AACV,QAAA,MAAM,MAAM,WAAW,CAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACT,CAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,QAAQ,WAAA,GAAc,IAAA;AAAA,EAC/B;AAEA,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAW,IAAA,EAAgC;AAClD,EAAA,OAAO,iBAAA;AAAA,IACL,QAAQ,IAAI,CAAA,CAAA;AAAA,IACZ,YAAY;AACV,MAAA,MAAM,KAAK,IAAI,CAAA;AACf,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,sBAAA,CAAuB,MAAc,IAAA,EAAiC;AAC7E,EAAA,IAAI,SAAS,wBAAA,IAA4B,CAAC,KAAK,IAAA,IAAQ,CAAC,KAAK,GAAA,EAAK;AAChE,IAAA,OACE,CAAA,oHAAA,CAAA;AAAA,EAGJ;AACA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,GAAA,EAAM,IAAA,CAAK,GAAG,CAAA,8EAAA,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,KAAK,IAAA,EAAM;AACb,IAAA,OAAO,CAAA,YAAA,EAAe,IAAI,CAAA,kBAAA,EAAqB,IAAA,CAAK,IAAI,CAAA,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,eAAe,IAAI,CAAA,2BAAA,CAAA;AAC5B;AAEA,SAAS,gBAAA,CACP,SACA,KAAA,EACiC;AACjC,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,KAAA,CAAM,IAAI,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,MAAM,IAAI,CAAA;AAC3D,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,QAAQ,CAAC,CAAA;AAE1C,EAAA,OAAO,MAAA;AACT","file":"chunk-G7NMF5WQ.js","sourcesContent":["/**\n * Runtime asset resolution — read `skaile.yaml`, scan all declared repositories\n * (including the built-in `factory-assets/` directory as an implicit default),\n * and produce a unified view of connector catalog entries plus the implicit refs\n * that the `skaile.yaml` `connectors:` section adds to the dependency graph.\n *\n * This module is the single source of truth for \"which connectors does this\n * project see at runtime, and where do their implementations live on disk\".\n * Both the runner (serve, REPL, flow) and the platform's mid-session\n * `add_resource` flow consume `RuntimeAssetsResult.catalogEntries` and pass\n * it into `ConnectorManager` for catalog-based resolution.\n *\n * `factory-assets/` is the single first-party content tree (built-in connectors\n * + first-party skills + bundles) shipped inside the `@skaile/workspaces`\n * package — not a standalone package.\n *\n * It resolves to an **ordered list of roots** ({@link factoryAssetRoots}), not a\n * single dir. The bundled tree is always the baseline; an optional\n * `SKAILE_FACTORY_ASSETS_DIR` (legacy: `SKAILE_BASE_ASSETS_DIR`) is layered\n * **in front** as an additive override source — the agent container points it at\n * `/app/factory-assets/` (or a bind-mounted host dir) to ship updated skills /\n * flows / bundles / connector manifests without rebuilding the image. The two\n * roots resolve uniformly across every consumer (connector catalog scan, skill /\n * flow / completion discovery, the asset-manager factory source):\n *   1. `SKAILE_FACTORY_ASSETS_DIR` env dir, when set and existing (override layer).\n *   2. the bundled tree via {@link resolvePackagedAssetsDir} — the in-repo source\n *      `packages/workspaces/factory-assets/` during dev, else the published\n *      `dist/factory-assets/` after install (always-present baseline).\n *\n * Override semantics are **env-first**: on a name conflict the env root wins and\n * the bundled root fills the rest. Connector *code* still loads via the package's\n * static `exports` map, so the env root can override/add skills, flows, bundles,\n * and connector **manifests/metadata**, but cannot ship a new executable\n * connector — its `.js` is not on the package's import graph.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { lstat, stat } from \"node:fs/promises\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join, resolve as resolvePath } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { tryWithFsDeadline } from \"./fs-deadline.js\";\nimport { scanDirectory } from \"./manifest.js\";\nimport type { CatalogEntry } from \"./models.js\";\nimport { getGlobalCacheDir, readLinks, sourceCacheKey } from \"./repo-manager.js\";\nimport type { SourceDeclaration, SourceEntry } from \"./workspace-config.js\";\nimport { resolveSkWorkspaceConfig } from \"./workspace-config.js\";\n\n/**\n * Map declared `sources[]` to internal `SourceDeclaration`s keyed by the\n * collision-free {@link sourceCacheKey} (`<host>/<owner>/<repo>`), pointing at\n * the unified machine-cache clone path (`getGlobalCacheDir()/<key>/`). Keyed by\n * the same function every other cache writer/reader uses so the path resolves.\n */\nfunction sourcesToDeclarations(\n  sources: SourceEntry[] | undefined,\n): Record<string, SourceDeclaration> {\n  const sourcesDir = getGlobalCacheDir();\n  const out: Record<string, SourceDeclaration> = {};\n  for (const s of sources ?? []) {\n    const key = sourceCacheKey(s.url);\n    if (out[key]) continue;\n    out[key] = {\n      path: join(sourcesDir, key),\n      url: s.url,\n      branch: s.pin,\n      ...(s.publisher ? { publisher: s.publisher } : {}),\n    };\n  }\n  return out;\n}\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\n/**\n * Catalog entry filtered to mount/connector kinds. Same shape as `CatalogEntry`.\n * @docLink packages/core/concepts#runtime-catalog-entry\n */\nexport type RuntimeCatalogEntry = CatalogEntry;\n\n/**\n * Implicit catalog reference derived from a `connectors:` declaration in `skaile.yaml`.\n * Each connector driver becomes an implicit ref that must be resolved in the catalog.\n * @docLink packages/core/concepts#runtime-asset-ref\n */\nexport interface RuntimeAssetRef {\n  kind: \"connector\";\n  /** Driver name — matches `RuntimeCatalogEntry.name`. */\n  name: string;\n  /** Source declaration id from `skaile.yaml`. */\n  declarationId: string;\n}\n\n/**\n * Aggregated npm packages required by all resolved mount/connector adapters.\n * Populated from `metadata.npm_deps` in each matched catalog entry.\n * @docLink packages/core/concepts#runtime-npm-deps\n */\nexport interface RuntimeNpmDeps {\n  required: string[];\n  optional: string[];\n}\n\n/**\n * Non-fatal warning emitted during `resolveRuntimeAssets` when a repo is unavailable\n * or a driver is not found in any catalog.\n * @docLink packages/core/concepts#runtime-asset-warning\n */\nexport interface RuntimeAssetWarning {\n  /** Stable code for filtering / structured logging. */\n  code: \"missing_driver\" | \"repo_unavailable\" | \"invalid_repo_decl\";\n  message: string;\n  /** Declaration id when applicable. */\n  declarationId?: string;\n  /** Driver / repository name when applicable. */\n  name?: string;\n}\n\n/**\n * Repository name used for the implicit built-in `factory-assets` catalog entry\n * (the in-package connector tree).\n * @docLink packages/core/concepts#factory-assets-repo-name\n */\nexport const FACTORY_ASSETS_REPO_NAME = \"factory-assets\";\n\n/**\n * Repository name for the optional `SKAILE_FACTORY_ASSETS_DIR` override layer,\n * scanned ahead of (and overriding) the bundled {@link FACTORY_ASSETS_REPO_NAME}.\n */\nconst FACTORY_ASSETS_OVERRIDE_REPO_NAME = \"factory-assets:override\";\n\n/**\n * Result of `resolveRuntimeAssets`.\n * The same object is mutated in place by `refresh()`, allowing callers to hold\n * a stable reference and observe updates after a new repository is cloned or\n * a driver is installed mid-session.\n * @docLink packages/core/concepts#runtime-assets-result\n */\nexport interface RuntimeAssetsResult {\n  catalogEntries: RuntimeCatalogEntry[];\n  implicitRefs: RuntimeAssetRef[];\n  requiredNpmDeps: RuntimeNpmDeps;\n  warnings: RuntimeAssetWarning[];\n  /** Re-scan repositories and re-derive implicit refs. Mutates in place. */\n  refresh(): Promise<void>;\n  /**\n   * Catalog lookup. When `kind` is omitted and multiple entries share the\n   * `name`, returns `undefined` (caller must disambiguate).\n   */\n  findEntry(query: { kind?: \"connector\"; name: string }): RuntimeCatalogEntry | undefined;\n}\n\n/** Options of {@link resolveRuntimeAssets}. */\nexport interface RuntimeAssetsOptions {\n  /**\n   * True when a connector driver is registered in the process (built-in or loaded plugin).\n   * Core does not know the registry; the caller passes its lookup. Without it only the catalog\n   * counts, so a driver a plugin registers is reported as `missing_driver`.\n   */\n  isDriverRegistered?: (driver: string) => boolean;\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/**\n * Resolve all runtime assets visible to a project by scanning declared repositories.\n *\n * Reads `skaile.yaml`, scans every declared repository (plus the implicit\n * built-in `factory-assets` repo), and derives implicit refs from `mounts:` /\n * `connectors:` declarations. Does not clone or install anything — purely a\n * read-only scan of what is already on disk. URL-only repositories that have\n * not been cloned yet are reported as `repo_unavailable` warnings.\n *\n * @param projectDir - Absolute path to the project workspace root\n * @param options - `isDriverRegistered`: a driver that no catalog entry lists but a plugin\n *   registered is not reported as `missing_driver`\n * @returns `RuntimeAssetsResult` with catalog entries, implicit refs, npm deps, and warnings\n * @docLink packages/core/concepts#resolve-runtime-assets\n */\nexport async function resolveRuntimeAssets(\n  projectDir: string,\n  options: RuntimeAssetsOptions = {},\n): Promise<RuntimeAssetsResult> {\n  const result: RuntimeAssetsResult = {\n    catalogEntries: [],\n    implicitRefs: [],\n    requiredNpmDeps: { required: [], optional: [] },\n    warnings: [],\n    refresh: async () => {\n      await populate(projectDir, result, options);\n    },\n    findEntry: (query) => findCatalogEntry(result.catalogEntries, query),\n  };\n\n  await populate(projectDir, result, options);\n  return result;\n}\n\n/**\n * Resolve the ordered list of on-disk roots for the built-in `factory-assets`\n * tree (built-in connectors + first-party skills + bundles). This is the single\n * shared resolver every consumer goes through, so the env override and the\n * bundled baseline are honoured uniformly.\n *\n * Order (env-first = override-wins):\n * 1. `SKAILE_FACTORY_ASSETS_DIR` env dir (legacy: `SKAILE_BASE_ASSETS_DIR`),\n *    when set and existing — an additive override layer.\n * 2. {@link resolvePackagedAssetsDir} — the bundled tree (in-repo source in dev,\n *    `dist/factory-assets/` after install). Always-present baseline.\n *\n * Returns `[]` only when the package cannot be located at all. De-duplicated, so\n * pointing the env var at the bundled dir collapses to one root.\n *\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function factoryAssetRoots(): string[] {\n  const roots: string[] = [];\n  const envDir = process.env.SKAILE_FACTORY_ASSETS_DIR ?? process.env.SKAILE_BASE_ASSETS_DIR;\n  // Deliberately still synchronous after #454: both candidates are\n  // container-local (the image's `/app/factory-assets/`, or the installed\n  // package tree resolved by `resolvePackagedAssetsDir`), never the FUSE\n  // workspace mount. The mount-reachable probes on this module's scan path —\n  // the project-relative `sources[].path` candidates in `resolveRepoDir` — are\n  // async and deadline-bounded.\n  if (envDir && existsSync(envDir)) roots.push(resolvePath(envDir));\n  const bundled = resolvePackagedAssetsDir(\"factory-assets\");\n  if (bundled) roots.push(bundled);\n  return [...new Set(roots)];\n}\n\n/**\n * Resolve the primary on-disk root of the `factory-assets` tree — the first of\n * {@link factoryAssetRoots} (the env override when set, else the bundled tree).\n * Prefer {@link factoryAssetRoots} when you need to scan every layer; this\n * single-dir form is for callers that want one canonical path.\n *\n * @returns Absolute path to the highest-precedence `factory-assets` directory\n * @throws When no root can be located\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function resolveFactoryAssetsRoot(): string {\n  const hit = resolveFactoryAssetsRootOrNull();\n  if (hit) return hit;\n\n  throw new Error(\n    `Cannot resolve the factory-assets directory. ` +\n      `Set SKAILE_FACTORY_ASSETS_DIR to the on-disk path, ` +\n      `ensure @skaile/workspaces is installed, ` +\n      `or run from within the @skaile/workspaces package tree.`,\n  );\n}\n\n/**\n * Non-throwing variant of {@link resolveFactoryAssetsRoot}: the same\n * env-then-packaged resolution tiers, returning `null` instead of throwing when\n * none locate the directory. Callers that treat a missing factory tree as a\n * soft \"not present\" (e.g. the asset-manager's implicit-source injection) MUST\n * use this so they honour the `SKAILE_FACTORY_ASSETS_DIR` container override\n * identically to the runtime path.\n */\nexport function resolveFactoryAssetsRootOrNull(): string | null {\n  return factoryAssetRoots()[0] ?? null;\n}\n\n/**\n * Resolve the `@skaile/workspaces` package root — the directory containing its\n * `package.json`. Tries `require.resolve` first (works when installed as a\n * dependency *and* in-repo via the self-reference), then walks upward from this\n * module looking for a `package.json` whose `name` is `@skaile/workspaces`\n * (bounded to 8 levels). Returns `null` when neither locates it.\n *\n * The single source of truth for finding content shipped inside the package —\n * the unified `factory-assets/` tree (built-in connectors + first-party skills\n * + bundles) resolves through {@link resolvePackagedAssetsDir} on top of this.\n *\n * Memoized: the package location is immutable for the process lifetime, but\n * this sits on the CLI hot path (every `findSkills` / flow / completion call\n * funnels through here), so the `require.resolve` + upward `package.json` walk\n * runs once. `undefined` = not yet computed.\n *\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nlet workspacesPackageRootCache: string | null | undefined;\n\nexport function resolveWorkspacesPackageRoot(): string | null {\n  if (workspacesPackageRootCache !== undefined) return workspacesPackageRootCache;\n  workspacesPackageRootCache = computeWorkspacesPackageRoot();\n  return workspacesPackageRootCache;\n}\n\nfunction computeWorkspacesPackageRoot(): string | null {\n  try {\n    const require = createRequire(import.meta.url);\n    return dirname(require.resolve(\"@skaile/workspaces/package.json\"));\n  } catch {\n    // Fall through to the workspace walk.\n  }\n  let dir: string;\n  try {\n    dir = dirname(fileURLToPath(import.meta.url));\n  } catch {\n    return null;\n  }\n  for (let i = 0; i < 8; i++) {\n    const pkgPath = join(dir, \"package.json\");\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, \"utf-8\")) as { name?: string };\n        if (pkg.name === \"@skaile/workspaces\") return dir;\n      } catch {\n        // Ignore malformed package.json and keep walking.\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Locate a content-asset directory inside the package. Prefers the in-repo\n * **source** dir `<pkgRoot>/<subdir>` when present — in a dev checkout it is the\n * full tree (e.g. `factory-assets/` keeps the connector `.ts` entry files that\n * `dist/` does not) — then the published `dist/<subdir>` copy (what\n * `files: [\"dist\"]` ships, the only one present after `npm i`). Returns `null`\n * when neither exists.\n *\n * `factory-assets/` resolves to the source tree in dev (code + skills + bundles)\n * and to `dist/factory-assets` post-install (compiled connectors + copied\n * manifests/skills/bundles).\n *\n * @param subdir - `\"factory-assets\"` | …\n * @docLink packages/core/concepts#resolve-factory-assets-root\n */\nexport function resolvePackagedAssetsDir(subdir: string): string | null {\n  const root = resolveWorkspacesPackageRoot();\n  if (!root) return null;\n  for (const cand of [join(root, subdir), join(root, \"dist\", subdir)]) {\n    if (existsSync(cand)) return cand;\n  }\n  return null;\n}\n\n// ─── Internals ────────────────────────────────────────────────────────────────\n\nconst CONNECTOR_SCAN_KINDS: ReadonlySet<string> = new Set([\"connector\"]);\n\nasync function populate(\n  projectDir: string,\n  target: RuntimeAssetsResult,\n  options: RuntimeAssetsOptions,\n): Promise<void> {\n  target.catalogEntries = [];\n  target.implicitRefs = [];\n  target.requiredNpmDeps = { required: [], optional: [] };\n  target.warnings = [];\n\n  const config = resolveSkWorkspaceConfig(projectDir);\n  // Connector catalog scan runs over the project's declared sources[] (resolved\n  // to their machine-cache clone paths) plus the implicit factory-assets repo.\n  const repositories = buildEffectiveRepositories(sourcesToDeclarations(config.sources));\n  const links = readLinks(projectDir);\n\n  // Scan each repository for connector entries.\n  for (const [name, decl] of Object.entries(repositories)) {\n    const repoDir = await resolveRepoDir(name, decl, projectDir, links);\n    if (!repoDir) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: repoUnavailableMessage(name, decl),\n      });\n      continue;\n    }\n    try {\n      // Both factory layers carry the same `factory-assets` provenance — the\n      // override repo is an internal scan-order device, not a distinct source.\n      const repoName = name === FACTORY_ASSETS_OVERRIDE_REPO_NAME ? FACTORY_ASSETS_REPO_NAME : name;\n      // Only connector descriptors are consumed here, so only that kind is\n      // \"known\": typed manifests of any other kind are irrelevant to this scan.\n      const scanned = await scanDirectory(repoDir, repoName, {\n        knownKinds: CONNECTOR_SCAN_KINDS,\n        onDiagnostic: () => {},\n      });\n      const entries = scanned.filter((e) => e.kind === \"connector\");\n      target.catalogEntries.push(...entries);\n    } catch (err) {\n      target.warnings.push({\n        code: \"repo_unavailable\",\n        name,\n        message: `Failed to scan repository \"${name}\" at ${repoDir}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      });\n    }\n  }\n\n  // De-duplicate by (kind, name), keeping the first occurrence. Scan order is\n  // declared sources → env override → bundled baseline, so an env-supplied\n  // connector manifest overrides the bundled one and the bundled one fills the\n  // rest (the override layer can refresh built-in manifests in place).\n  const seen = new Set<string>();\n  target.catalogEntries = target.catalogEntries.filter((e) => {\n    const key = `${e.kind}:${e.name}`;\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n\n  // Derive implicit refs from skaile.yaml connectors.\n  for (const [index, c] of (config.connectors ?? []).entries()) {\n    // No `driver` (a misspelt or old `adapter:` key): say so with the text `validate` prints,\n    // not a warning about the driver `\"undefined\"` (p1739).\n    if (typeof c.driver !== \"string\" || c.driver === \"\") {\n      const legacy = (c as unknown as Record<string, unknown>).adapter;\n      const label = typeof c.id === \"string\" && c.id !== \"\" ? `\"${c.id}\"` : `#${index + 1}`;\n      target.warnings.push({\n        code: \"missing_driver\",\n        ...(typeof c.id === \"string\" && c.id !== \"\" ? { declarationId: c.id } : {}),\n        message:\n          legacy !== undefined\n            ? `Connector ${label} sets \\`adapter: ${String(legacy)}\\`; the key is \\`driver\\`. Rename \\`adapter\\` to \\`driver\\`.`\n            : `Connector ${label} has no \\`driver\\`; the runner cannot mount it. Add \\`driver: <name>\\`.`,\n      });\n      continue;\n    }\n    target.implicitRefs.push({ kind: \"connector\", name: c.driver, declarationId: c.id });\n  }\n\n  // Validate refs and aggregate npm deps.\n  const requiredSet = new Set<string>();\n  const optionalSet = new Set<string>();\n  for (const ref of target.implicitRefs) {\n    const entry = findCatalogEntry(target.catalogEntries, ref);\n    // A plugin's connector has no catalog entry: the process registry knows it.\n    if (!entry && options.isDriverRegistered?.(ref.name)) continue;\n    if (!entry) {\n      target.warnings.push({\n        code: \"missing_driver\",\n        declarationId: ref.declarationId,\n        name: ref.name,\n        message:\n          `Unknown ${ref.kind} driver \"${ref.name}\" referenced by ${ref.kind} \"${ref.declarationId}\". ` +\n          `Run \\`skaile ${ref.kind} catalog\\` to see available drivers, ` +\n          `or declare a repository in skaile.yaml that provides this driver.`,\n      });\n      continue;\n    }\n    const npm = (entry.metadata?.npm_deps ?? {}) as { required?: string[]; optional?: string[] };\n    for (const p of npm.required ?? []) requiredSet.add(p);\n    for (const p of npm.optional ?? []) optionalSet.add(p);\n  }\n  target.requiredNpmDeps.required = [...requiredSet];\n  target.requiredNpmDeps.optional = [...optionalSet];\n}\n\n/**\n * Build the effective `repositories` map: caller's declarations first, then the\n * implicit built-in `factory-assets` repos. Each {@link factoryAssetRoots} layer\n * becomes its own repo, the env override inserted **before** the bundled\n * baseline so its connector entries win on the first-match dedup downstream.\n * When the package cannot be located at all, a path-less sentinel under\n * {@link FACTORY_ASSETS_REPO_NAME} drives the `repo_unavailable` warning.\n */\nfunction buildEffectiveRepositories(\n  declared: Record<string, SourceDeclaration> | undefined,\n): Record<string, SourceDeclaration> {\n  const result: Record<string, SourceDeclaration> = { ...(declared ?? {}) };\n  const roots = factoryAssetRoots();\n  if (roots.length === 0) {\n    // Surface as a warning during scan rather than throwing here — let the\n    // caller decide whether factory-assets is required. resolveRepoDir() /\n    // repoUnavailableMessage re-discover the failure and emit it.\n    if (!result[FACTORY_ASSETS_REPO_NAME]) result[FACTORY_ASSETS_REPO_NAME] = { path: \"\" };\n    return result;\n  }\n  // override-first when both layers exist, so the env root's entries are scanned\n  // (and matched) ahead of the bundled baseline.\n  const keys =\n    roots.length > 1\n      ? [FACTORY_ASSETS_OVERRIDE_REPO_NAME, FACTORY_ASSETS_REPO_NAME]\n      : [FACTORY_ASSETS_REPO_NAME];\n  roots.forEach((dir, i) => {\n    const key = keys[i] ?? `${FACTORY_ASSETS_REPO_NAME}:${i}`;\n    if (!result[key]) result[key] = { path: dir };\n  });\n  return result;\n}\n\n/**\n * Resolve a repository declaration to an on-disk directory. Order:\n *   1. Linked override (`.skaile/links.yaml`).\n *   2. Local `path` — relative to `projectDir`.\n *   3. Cloned URL repo at `.skaile/cache/sources/<name>/` (must already exist).\n *\n * Returns `null` when none of these resolve. Does not clone.\n *\n * **Async and deadline-bounded since #454.** Every candidate here is a\n * project-relative or operator-supplied path, so a `sources[].path` of\n * `workspace/my-assets` resolves onto the rclone FUSE mount — the same tree the\n * scan that follows walks. Probing it with `existsSync`/`lstatSync` would park\n * the `skaile serve` event loop *before* the (now async) scan ever ran, which\n * would leave the H2 fix meaningless on the very declaration that triggers it.\n * A probe that misses its deadline reads as \"unavailable\", which is what the\n * caller already does with an absent path — it becomes a `repo_unavailable`\n * warning rather than a stall.\n */\nasync function resolveRepoDir(\n  name: string,\n  decl: SourceDeclaration,\n  projectDir: string,\n  links: Record<string, string>,\n): Promise<string | null> {\n  // 1. Linked override\n  const linked = links[name];\n  if (linked && (await pathExists(linked))) return linked;\n\n  // 2. Local path\n  if (decl.path) {\n    const resolved = resolvePath(projectDir, decl.path);\n    return (await pathExists(resolved)) ? resolved : null;\n  }\n\n  // 3. URL repo cloned to project's .skaile/cache/sources/<name> — the\n  //    project-local clone dir (often a symlink into the global cache, which\n  //    lives at getGlobalCacheDir()); NOT the global clone root itself.\n  if (decl.url) {\n    const projectDest = join(projectDir, \".skaile\", \"cache\", \"sources\", name);\n    // One `lstat` answers both questions the pre-#454 `existsSync` + `lstatSync`\n    // pair asked, and `lstat` (not `stat`) keeps the \"a symlink into the global\n    // cache counts\" behaviour intact.\n    const found = await tryWithFsDeadline(\n      `lstat ${projectDest}`,\n      async () => {\n        await lstat(projectDest);\n        return true;\n      },\n      false,\n    );\n    return found ? projectDest : null;\n  }\n\n  return null;\n}\n\n/** Deadline-bounded `existsSync` replacement — a wedged mount reads as absent. */\nfunction pathExists(path: string): Promise<boolean> {\n  return tryWithFsDeadline(\n    `stat ${path}`,\n    async () => {\n      await stat(path);\n      return true;\n    },\n    false,\n  );\n}\n\nfunction repoUnavailableMessage(name: string, decl: SourceDeclaration): string {\n  if (name === FACTORY_ASSETS_REPO_NAME && !decl.path && !decl.url) {\n    return (\n      `Cannot resolve the built-in factory-assets. ` +\n      `Set SKAILE_FACTORY_ASSETS_DIR or ensure @skaile/workspaces is installed.`\n    );\n  }\n  if (decl.url) {\n    return `Repository \"${name}\" (${decl.url}) is not available. Register it as a Library Source via \\`skaile source add\\`.`;\n  }\n  if (decl.path) {\n    return `Repository \"${name}\" path not found: ${decl.path}`;\n  }\n  return `Repository \"${name}\" has neither url nor path.`;\n}\n\nfunction findCatalogEntry(\n  entries: RuntimeCatalogEntry[],\n  query: { kind?: \"connector\"; name: string },\n): RuntimeCatalogEntry | undefined {\n  if (query.kind) {\n    return entries.find((e) => e.kind === query.kind && e.name === query.name);\n  }\n  const matches = entries.filter((e) => e.name === query.name);\n  if (matches.length === 1) return matches[0];\n  // 0 or >1 with no kind — caller must disambiguate.\n  return undefined;\n}\n"]}

package/dist/{chunk-SHTXMERQ.js → chunk-GAIMSCZ7.js}

@@ -1,8 +1,10 @@
-import { SubprocessCliHarness, extractText, extractCost, extractTokens } from './chunk-I5IF3JCG.js';
-import { getStaticModels, fetchProviderModels } from './chunk-OY22B7E2.js';
-import { getBridgeLogger, registryHarnessConfig } from './chunk-WW5NAU6N.js';
-import { resolveEnvHarnessSession, bindSingleProviderEntry, resolveRegistryBinding } from './chunk-F4CZQD3T.js';
-import { getProviderPreset, BUILTIN_HARNESS_CATALOG, entryCredentialValue } from './chunk-BSMW3PX2.js';
+import { SubprocessCliHarness, extractText, extractCost, extractTokens } from './chunk-AO57IFME.js';
+import { getStaticModels, fetchProviderModels } from './chunk-SBNUXJ6E.js';
+import { HARNESS_BINARIES } from './chunk-WWSRIT3J.js';
+import { resolveEnvHarnessSession, bindSingleProviderEntry, resolveRegistryBinding } from './chunk-4C2E5QUP.js';
+import { getBridgeLogger, registryHarnessConfig } from './chunk-PLLZSKOO.js';
+import { BUILTIN_HARNESS_CATALOG, entryCredentialValue } from './chunk-XON6ODIC.js';
+import { getProviderPreset } from './chunk-6UP2EDFN.js';
 import * as z from 'zod';
 
 var GOOGLE_DEFAULT_BASE_URL = getProviderPreset("google")?.base_url;
@@ -137,7 +139,7 @@ var GeminiHarness = class extends GeminiFamilyHarness {
     return env;
   }
   installHint() {
-    return "Gemini CLI is not installed or not on your PATH. Install it with `npm i -g @google/gemini-cli` (\u2265 v0.6.1).";
+    return HARNESS_BINARIES.gemini.hint;
   }
   classifyExit(code, signal) {
     if (code === 42) {
@@ -184,5 +186,5 @@ var geminiHarnessTarget = {
 };
 
 export { GeminiFamilyHarness, GeminiHarness, geminiHarnessTarget };
-//# sourceMappingURL=chunk-SHTXMERQ.js.map
-//# sourceMappingURL=chunk-SHTXMERQ.js.map
+//# sourceMappingURL=chunk-GAIMSCZ7.js.map
+//# sourceMappingURL=chunk-GAIMSCZ7.js.map

package/dist/chunk-GAIMSCZ7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/harnesses/gemini.ts"],"names":[],"mappings":";;;;;;;;;AA6BA,IAAM,uBAAA,GAA0B,iBAAA,CAAkB,QAAQ,CAAA,EAAG,QAAA;AAWtD,IAAe,mBAAA,GAAf,cAA2C,oBAAA,CAAqB;AAAA,EAC3D,WAAW,IAAA,EAAiB;AACpC,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,MAAA;AAAA,MACL,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,eAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAA,IAAc,KAAK,EAAE,CAAA;AAChE,QAAA;AAAA,MAEF,KAAK,SAAA;AAAA,MACL,KAAK,WAAA,EAAa;AAChB,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,SAAS,IAAA,IAAQ,WAAA;AAChD,QAAA,IAAI,SAAS,WAAA,EAAa;AAC1B,QAAA,MAAM,IAAA,GAAO,YAAY,IAAI,CAAA;AAC7B,QAAA,IAAI,IAAA,CAAK,SAAS,IAAA,IAAQ,IAAA,CAAK,UAAU,IAAA,IAAQ,IAAA,CAAK,aAAa,IAAA,EAAM;AACvE,UAAA,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,QAC5B,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,mBAAmB,IAAI,CAAA;AAAA,QAC9B;AACA,QAAA;AAAA,MACF;AAAA,MAEA,KAAK,UAAA;AAAA,MACL,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA,EAAQ,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,IAAA,IAAQ,EAAE,CAAA;AACjF,QAAA;AAAA,MAEF,KAAK,aAAA;AACH,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,IAAQ,MAAA;AAAA,UAC1B,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,OAAA;AAAA,UACnC,QAAQ,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,OAAA,IAAW,KAAK,KAAK;AAAA,SACrD;AACA,QAAA;AAAA,MAEF,KAAK,OAAA;AACH,QAAA,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,WAAW,IAAA,CAAK,KAAA,IAAS,OAAO,CAAC,CAAC,CAAA;AAClF,QAAA;AAAA,MAEF,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,UAAU,CAAA;AACrD,QAAA,IAAA,CAAK,UAAA,CAAW;AAAA,UACd,MAAA,EAAQ,cAAc,IAAI,CAAA;AAAA,UAC1B,OAAA,EAAS,YAAY,IAAI,CAAA;AAAA,UACzB,OAAA,EAAS,WAAA,CAAY,IAAI,CAAA,IAAK;AAAA,SAC/B,CAAA;AACD,QAAA;AAAA;AACJ,EACF;AAAA;AAAA,EAIQ,SAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA,GAAkB,KAAA;AAAA;AAAA,EAGhB,eAAA,GAAqC;AAC7C,IAAA,IAAA,CAAK,SAAA,KAAc,wBAAA,CAAyB,IAAA,CAAK,MAAM,CAAA;AACvD,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWU,eAAA,GAAoD;AAC5D,IAAA,IAAI,IAAA,CAAK,eAAA,EAAiB,OAAO,IAAA,CAAK,UAAA;AACtC,IAAA,MAAM,OAAA,GAAU,uBAAA;AAAA,MACd,KAAK,WAAA,CAAY,EAAA;AAAA,MACjB,IAAA,CAAK,WAAA;AAAA,MACL,KAAK,eAAA;AAAgB,KACvB;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,QAAA,IAAY,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,OAAO,CAAA;AACpE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA;AAClB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAe,KAAA,GAAuB;AACpC,IAAA,IAAA,CAAK,eAAA,EAAgB;AACrB,IAAA,MAAM,MAAM,KAAA,EAAM;AAAA,EACpB;AAAA,EAEmB,eAAe,OAAA,EAAmC;AACnE,IAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,MAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AAAA,IACzB;AAAA,EACF;AAAA;AAAA,EAGS,QAAA,GAA+B;AACtC,IAAA,OAAO,uBAAuB,IAAA,CAAK,eAAA,EAAiB,CAAA,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AAAA,EACxF;AACF;AAuBO,IAAM,aAAA,GAAN,cAA4B,mBAAA,CAAoB;AAAA,EAC5C,WAAA,GAA2B;AAAA,IAClC,EAAA,EAAI,QAAA;AAAA,IACJ,IAAA,EAAM,YAAA;AAAA,IACN,aAAA,EAAe,KAAA;AAAA,IACf,mBAAA,EAAqB;AAAA,GACvB;AAAA,EAEmB,GAAA,GAAc,gBAAgB,QAAQ,CAAA;AAAA,EACtC,UAAA,GAAa,QAAA;AAAA,EACb,WAAA,GAAc,YAAA;AAAA,EACd,SAAA,GAAY,QAAA;AAAA,EAErB,SAAA,CAAU,SAAiB,QAAA,EAAwC;AAC3E,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,kEAAA,EAAoE;AAAA,QAChF;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,MAAM,IAAA,GAAO,CAAC,IAAA,EAAM,OAAA,EAAS,mBAAmB,aAAa,CAAA;AAC7D,IAAA,MAAM,QAAQ,IAAA,CAAK,eAAA,EAAgB,EAAG,eAAA,IAAmB,KAAK,MAAA,CAAO,KAAA;AACrE,IAAA,IAAI,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,KAAK,CAAA;AAChC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEU,QAAA,GAAmC;AAC3C,IAAA,MAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,gBAAA,EAAkB,gBAAA,EAAkB,wBAAwB,CAAC,CAAA;AACvF,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,IAAI,CAAC,SAAS,OAAO,GAAA;AAIrB,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,cAAA;AACX,IAAA,OAAO,GAAA,CAAI,sBAAA;AACX,IAAA,MAAM,GAAA,GAAM,oBAAA,CAAqB,OAAA,CAAQ,UAAA,EAAY,QAAQ,KAAA,EAAO;AAAA,MAClE,GAAA,EAAK,IAAA,CAAK,eAAA,EAAgB,CAAE;AAAA,KAC7B,CAAA;AACD,IAAA,IAAI,GAAA,MAAS,cAAA,GAAiB,GAAA;AAG9B,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,EAAyB;AAClE,MAAA,GAAA,CAAI,yBAAyB,OAAA,CAAQ,OAAA;AAAA,IACvC;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEU,WAAA,GAAsB;AAC9B,IAAA,OAAO,iBAAiB,MAAA,CAAO,IAAA;AAAA,EACjC;AAAA,EAEmB,YAAA,CAAa,MAAqB,MAAA,EAA+B;AAClF,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,8CAAA;AAAA,QACT,QAAA,EAAU,YAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM;AAAA,OACR;AAAA,IACF;AACA,IAAA,IAAI,IAAA,KAAS,IAAI,OAAO,IAAA;AACxB,IAAA,OAAO,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAe,UAAA,GAAoC;AACjD,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,MAAM,OAAA,GAAU,uBAAuB,OAAO,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,OAAA,GACR,oBAAA,CAAqB,OAAA,CAAQ,YAAY,OAAA,CAAQ,KAAA,EAAO,EAAE,GAAA,EAAK,OAAA,CAAQ,SAAA,EAAW,CAAA,GAClF,QAAQ,SAAA,CAAU,cAAA;AACtB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,eAAA,CAAgB,QAAQ,CAAA;AACzC,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,QAAA;AAAA,MACA,GAAA;AAAA,MACA,OAAA,EAAS,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,uBAAA,GACpC,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAC3B;AAAC,KACP;AACA,IAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,GAAI,MAAA,CAAO,MAAA,GAAS,eAAA,CAAgB,QAAQ,CAAA;AAAA,EACzF;AACF;AAMO,IAAM,mBAAA,GAAkD;AAAA,EAC7D,EAAA,EAAI,QAAA;AAAA,EACJ,WAAA,EAAa,uBAAA,CAAwB,MAAA,EAAQ,IAAA,IAAQ,YAAA;AAAA,EACrD,UAAA,EAAY,CAAA;AAAA,EACZ,YAAA,EAAgB,CAAA,CAAA,MAAA,CAAoB,MAAM,IAAI,CAAA;AAAA,EAC9C,QAAQ,OAAO,MAAA,EAAQ,IAAA,KAAS,IAAI,cAAc,MAAM,CAAA;AAAA,EACxD,UAAA,EAAY,OAAO,QAAA,EAAU,OAAA,KAC3B,IAAI,aAAA,CAAc;AAAA,IAChB,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IACjB,SAAA,EAAW,YAAA;AAAA,IACX,GAAG,qBAAA,CAAsB,QAAA,EAAU,OAAO;AAAA,GAC3C,EAAE,UAAA;AACP","file":"chunk-GAIMSCZ7.js","sourcesContent":["import type { HarnessTarget } from \"@skaile/workspaces/plugin-registry\";\nimport type { Logger } from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nimport { HARNESS_BINARIES } from \"../harness-binaries.js\";\nimport { getBridgeLogger } from \"../logger.js\";\nimport { fetchProviderModels, getStaticModels, type ModelEntry } from \"../models.js\";\nimport { getProviderPreset } from \"../provider-catalog.js\";\nimport { entryCredentialValue } from \"../provider-materialize/credential-env.js\";\nimport {\n  bindSingleProviderEntry,\n  type EnvHarnessSession,\n  type RegistryModelBinding,\n  resolveEnvHarnessSession,\n  resolveRegistryBinding,\n} from \"../provider-materialize/env-harnesses.js\";\nimport { registryHarnessConfig } from \"../provider-registry-derive.js\";\nimport { BUILTIN_HARNESS_CATALOG } from \"../registry.js\";\nimport type { AgentConfig, HarnessInfo, ReconfigureApplied } from \"../types.js\";\nimport {\n  extractCost,\n  extractText,\n  extractTokens,\n  SubprocessCliHarness,\n} from \"./_subprocess-cli.js\";\n\n/**\n * The Gemini API host the CLI talks to unless told otherwise — the catalog's\n * `google` preset, so the two can never drift apart.\n */\nconst GOOGLE_DEFAULT_BASE_URL = getProviderPreset(\"google\")?.base_url;\n\n/**\n * Shared base for the Gemini-CLI event family. Gemini CLI and Qwen Code (a fork\n * of Gemini CLI) emit the same `stream-json` event shape, so both dispatch the\n * same {@link handleJson}: `init`/`system` → session capture, `message`/\n * `assistant` → streamed assistant text, `tool_use` / `tool_result` → tool\n * events, `result` → tokens + cost.\n *\n * @docLink packages/bridge/harnesses#gemini-harness\n */\nexport abstract class GeminiFamilyHarness extends SubprocessCliHarness {\n  protected handleJson(json: any): void {\n    switch (json?.type) {\n      case \"init\":\n      case \"system\":\n        this.captureSession(json.sessionId ?? json.session_id ?? json.id);\n        break;\n\n      case \"message\":\n      case \"assistant\": {\n        const role = json.role ?? json.message?.role ?? \"assistant\";\n        if (role !== \"assistant\") break;\n        const text = extractText(json);\n        if (json.done === true || json.final === true || json.finished === true) {\n          this.pushAssistantEnd(text);\n        } else {\n          this.pushAssistantDelta(text);\n        }\n        break;\n      }\n\n      case \"tool_use\":\n      case \"tool_call\":\n        this.pushToolCall(json.name ?? json.tool ?? \"tool\", json.input ?? json.args ?? {});\n        break;\n\n      case \"tool_result\":\n        this.pushToolResult(\n          json.name ?? json.tool ?? \"tool\",\n          json.result ?? json.output ?? json.content,\n          Boolean(json.is_error ?? json.isError ?? json.error),\n        );\n        break;\n\n      case \"error\":\n        this.pushError(this.classifyMessage(String(json.message ?? json.error ?? \"error\")));\n        break;\n\n      case \"result\":\n        this.captureSession(json.sessionId ?? json.session_id);\n        this.pushResult({\n          tokens: extractTokens(json),\n          costUsd: extractCost(json),\n          summary: extractText(json) || \"Task completed\",\n        });\n        break;\n    }\n  }\n\n  // ── Registry binding ──────────────────────────────────────────────────────\n\n  private providers?: EnvHarnessSession;\n  private boundEntry?: RegistryModelBinding;\n  private bindingResolved = false;\n\n  /** This session's AI providers, resolved once from the config. */\n  protected providerSession(): EnvHarnessSession {\n    this.providers ??= resolveEnvHarnessSession(this.config);\n    return this.providers;\n  }\n\n  /**\n   * The AI provider entry this session's model selector names, memoized until\n   * the model changes.\n   *\n   * Gemini CLI and Qwen Code are `single`-plurality harnesses (§2.3): they\n   * address one endpoint, so the bound entry supplies both the credential and\n   * the base URL. Resolving through {@link bindSingleProviderEntry} is what\n   * puts the surface check — which throws — on the start path.\n   */\n  protected registryBinding(): RegistryModelBinding | undefined {\n    if (this.bindingResolved) return this.boundEntry;\n    const binding = bindSingleProviderEntry(\n      this.harnessInfo.id,\n      this.productName,\n      this.providerSession(),\n    );\n    for (const warning of binding?.warnings ?? []) this.log.warn(warning);\n    this.boundEntry = binding;\n    this.bindingResolved = true;\n    return binding;\n  }\n\n  /**\n   * Fail before the first spawn when the bound entry speaks a surface this\n   * harness cannot — the error names the surface.\n   */\n  override async start(): Promise<void> {\n    this.registryBinding();\n    await super.start();\n  }\n\n  protected override onReconfigured(applied: ReconfigureApplied): void {\n    if (applied.model !== undefined) {\n      this.providers = undefined;\n      this.bindingResolved = false;\n    }\n  }\n\n  /** The provider-side model id the harness is actually run with. */\n  override getModel(): string | undefined {\n    return resolveRegistryBinding(this.providerSession())?.providerModelId ?? this.config.model;\n  }\n}\n\n/**\n * Agent harness for the Google **Gemini CLI** (`gemini`).\n *\n * Spawns `gemini -p \"<prompt>\" --output-format stream-json` per turn and maps\n * the stream-json events to the unified {@link AgentEvent} stream. Google\n * models only (`surface: google-generative-ai`): the AI provider entry the\n * session's model selector names supplies `GEMINI_API_KEY`, the `-m` model id\n * and — for a non-default endpoint — `GOOGLE_GEMINI_BASE_URL`.\n *\n * @remarks\n * - **Requires Gemini CLI ≥ v0.6.1** — earlier versions reject\n *   `--output-format`. A too-old CLI surfaces as a `process`-category exit error.\n * - **Session resume is not available in headless (`-p`) mode** — the CLI errors\n *   if asked to resume non-interactively, so this harness runs single-turn per\n *   process and logs a warning when a resume id is present.\n * - Exit codes: `42` → input/validation error, `53` → turn-limit (treated as a\n *   completed turn).\n *\n * @see https://github.com/google-gemini/gemini-cli\n * @docLink packages/bridge/harnesses#gemini-harness\n */\nexport class GeminiHarness extends GeminiFamilyHarness {\n  readonly harnessInfo: HarnessInfo = {\n    id: \"gemini\",\n    name: \"Gemini CLI\",\n    modelAgnostic: false,\n    supportsInBandAbort: false,\n  };\n\n  protected readonly log: Logger = getBridgeLogger(\"gemini\");\n  protected readonly defaultBin = \"gemini\";\n  protected readonly productName = \"Gemini CLI\";\n  protected readonly envPrefix = \"GEMINI\";\n\n  protected buildArgs(message: string, resumeId: string | undefined): string[] {\n    if (resumeId) {\n      this.log.warn(\"Gemini CLI cannot resume in headless mode; starting a fresh turn\", {\n        resumeId,\n      });\n    }\n    const args = [\"-p\", message, \"--output-format\", \"stream-json\"];\n    const model = this.registryBinding()?.providerModelId ?? this.config.model;\n    if (model) args.push(\"-m\", model);\n    return args;\n  }\n\n  protected buildEnv(): Record<string, string> {\n    const env = this.baseEnv([\"GEMINI_API_KEY\", \"GOOGLE_API_KEY\", \"GOOGLE_GEMINI_BASE_URL\"]);\n    const binding = this.registryBinding();\n    if (!binding) return env;\n\n    // The entry is the authority: inherited Google carriers are dropped so an\n    // ambient key cannot authenticate a session pointed somewhere else.\n    delete env.GEMINI_API_KEY;\n    delete env.GOOGLE_API_KEY;\n    delete env.GOOGLE_GEMINI_BASE_URL;\n    const key = entryCredentialValue(binding.providerId, binding.entry, {\n      env: this.providerSession().lookupEnv,\n    });\n    if (key) env.GEMINI_API_KEY = key;\n    // Only a non-default endpoint is worth naming: Gemini CLI reads\n    // GOOGLE_GEMINI_BASE_URL as an override of its own default host.\n    if (binding.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL) {\n      env.GOOGLE_GEMINI_BASE_URL = binding.baseUrl;\n    }\n    return env;\n  }\n\n  protected installHint(): string {\n    return HARNESS_BINARIES.gemini.hint;\n  }\n\n  protected override classifyExit(code: number | null, signal: NodeJS.Signals | null) {\n    if (code === 42) {\n      return {\n        message: \"Gemini CLI reported an input error (exit 42)\",\n        category: \"validation\" as const,\n        retryable: false,\n        hint: \"The prompt or flags were rejected by Gemini CLI. Check the model name and arguments.\",\n      };\n    }\n    if (code === 53) return null; // turn-limit — the result was already emitted.\n    return super.classifyExit(code, signal);\n  }\n\n  /**\n   * Discovery runs against the bound entry: its credential and, for a\n   * non-default endpoint, its base URL. Without an entry the ambient\n   * `GEMINI_API_KEY` is the last resort, and an unreachable API falls back to\n   * the static Google catalog.\n   */\n  override async listModels(): Promise<ModelEntry[]> {\n    const session = this.providerSession();\n    const binding = resolveRegistryBinding(session);\n    const key = binding\n      ? entryCredentialValue(binding.providerId, binding.entry, { env: session.lookupEnv })\n      : session.lookupEnv.GEMINI_API_KEY;\n    if (!key) return getStaticModels(\"google\");\n    const result = await fetchProviderModels(\n      \"google\",\n      key,\n      binding?.baseUrl && binding.baseUrl !== GOOGLE_DEFAULT_BASE_URL\n        ? { baseUrl: binding.baseUrl }\n        : {},\n    );\n    return result.ok && result.models.length > 0 ? result.models : getStaticModels(\"google\");\n  }\n}\n\n/**\n * `HarnessTarget` wrapper for the gemini harness. Registered into the plugin\n * registry by `registerBuiltinHarnesses()`.\n */\nexport const geminiHarnessTarget: HarnessTarget<AgentConfig> = {\n  id: \"gemini\",\n  displayName: BUILTIN_HARNESS_CATALOG.gemini?.name ?? \"Gemini CLI\",\n  apiVersion: 1,\n  configSchema: z.custom<AgentConfig>(() => true),\n  create: async (config, _ctx) => new GeminiHarness(config),\n  listModels: async (registry, options) =>\n    new GeminiHarness({\n      cwd: process.cwd(),\n      sessionId: \"model-list\",\n      ...registryHarnessConfig(registry, options),\n    }).listModels(),\n};\n"]}

package/dist/{chunk-6A6HE5LW.js → chunk-HLAEYFUN.js}

@@ -1,5 +1,5 @@
 import { decodeBearerFromHeader, tokensEqual } from './chunk-32NA4TVC.js';
-import { listenWithProbe } from './chunk-6ARPZHOV.js';
+import { listenWithProbe } from './chunk-TMJBEGS4.js';
 import { createServer } from 'http';
 import { WebSocketServer } from 'ws';
 
@@ -256,5 +256,5 @@ var WebSocketServerTransport = class {
 };
 
 export { WebSocketServerTransport };
-//# sourceMappingURL=chunk-6A6HE5LW.js.map
-//# sourceMappingURL=chunk-6A6HE5LW.js.map
+//# sourceMappingURL=chunk-HLAEYFUN.js.map
+//# sourceMappingURL=chunk-HLAEYFUN.js.map

package/dist/{chunk-6A6HE5LW.js.map → chunk-HLAEYFUN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../transport/src/ws/server.ts"],"names":[],"mappings":";;;;;AAiDA,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,wBAAA,GAA2B,CAAA;AAkBjC,SAAS,yBAAyB,GAAA,EAA6C;AAC7E,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB,OAAO,6BAAA;AAExC,EAAA,MAAM,WAAW,GAAA,CAAI,QAAA;AACrB,EAAA,IAAI,CAAC,YAAY,OAAO,QAAA,KAAa,YAAY,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxE,IAAA,OAAO,4BAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,WAAA,KAAgB,QAAA,EAAU,OAAO,uCAAA;AACrD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AACnD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AAEnD,EAAA,MAAM,kBAAkB,GAAA,CAAI,eAAA;AAC5B,EAAA,IAAI,CAAC,mBAAmB,OAAO,eAAA,KAAoB,YAAY,KAAA,CAAM,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC7F,IAAA,OAAO,mCAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AAEtD,EAAA,IACE,CAAC,GAAA,CAAI,cAAA,IACL,OAAO,GAAA,CAAI,cAAA,KAAmB,QAAA,IAC9B,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAChC;AACA,IAAA,OAAO,kCAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,GAAA,CAAI,WAAA,IAAe,OAAO,GAAA,CAAI,WAAA,KAAgB,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAC7F,IAAA,OAAO,+BAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAyBO,IAAM,2BAAN,MAA0D;AAAA,EACvD,UAAA,GAAgC,IAAA;AAAA,EAChC,GAAA,GAA8B,IAAA;AAAA,EAC9B,YAAA,GAAiC,IAAA;AAAA,EACxB,IAAA;AAAA,EACA,GAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EAEA,WAAA;AAAA,EACA,eAAA,uBAAsB,GAAA,EAAqC;AAAA,EAC3D,eAAA,uBAAsB,GAAA,EAAgB;AAAA,EACtC,kBAAA,uBAAyB,GAAA,EAAgB;AAAA,EAE1D,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA;AACpC,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAC3B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC1C,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,cAAA,IAAkB,wBAAA;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,MAAA,GAAwB;AAC5B,IAAA,MAAM,UAAA,GAAa,YAAA,CAAa,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC7C,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,cAAc,CAAA;AACnD,MAAA,GAAA,CAAI,IAAI,qBAAqB,CAAA;AAAA,IAC/B,CAAC,CAAA;AAKD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA;AACtB,IAAA,MAAM,GAAA,GAAM,IAAI,eAAA,CAAgB;AAAA,MAC9B,MAAA,EAAQ,UAAA;AAAA,MACR,YAAA,EAAc,QAAA,GACV,CAAC,IAAA,EAAM,EAAA,KAAO;AACZ,QAAA,MAAM,YAAY,sBAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,wBAAwB,CAAC,CAAA;AACnF,QAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,WAAA,CAAY,SAAA,EAAW,QAAQ,CAAA,EAAG;AAC1D,UAAA,EAAA,CAAG,IAAI,CAAA;AAAA,QACT,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,IAAI,+CAA+C,CAAA;AACxD,UAAA,EAAA,CAAG,KAAA,EAAO,KAAK,cAAc,CAAA;AAAA,QAC/B;AAAA,MACF,CAAA,GACA;AAAA,KACL,CAAA;AACD,IAAA,GAAA,CAAI,GAAG,YAAA,EAAc,CAAC,OAAO,IAAA,CAAK,gBAAA,CAAiB,EAAE,CAAC,CAAA;AAItD,IAAA,MAAM,mBAAmB,MAAM;AAAA,IAAC,CAAA;AAChC,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,gBAAgB,CAAA;AAChC,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAEX,IAAA,IAAI;AACF,MAAA,MAAM,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAA,EAAM,KAAK,IAAI,CAAA;AAAA,IACxD,SAAS,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,KAAA,EAAM;AACV,MAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,MAAA,IAAI,eAAe,KAAA,IAAS,MAAA,IAAU,GAAA,IAAO,GAAA,CAAI,SAAS,YAAA,EAAc;AACtE,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,GAAK,CAAA,KAAA,EAAQ,IAAA,CAAK,IAAI,CAAA,CAAA;AACzE,QAAA,MAAM,MAAA,CAAO,MAAA;AAAA,UACX,IAAI,KAAA;AAAA,YACF,GAAG,KAAK,CAAA,qEAAA;AAAA,WACV;AAAA,UACA,EAAE,MAAM,YAAA;AAAa,SACvB;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,SAAS,gBAAgB,CAAA;AAAA,IACnC;AAEA,IAAA,MAAM,IAAA,GAAO,WAAW,OAAA,EAAQ;AAChC,IAAA,MAAM,YAAY,OAAO,IAAA,KAAS,YAAY,IAAA,GAAO,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACtE,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,gBAAA;AAC1B,IAAA,IAAA,CAAK,GAAA;AAAA,MACH,CAAA,8BAAA,EAAiC,SAAS,CAAA,EAAA,EAAK,IAAI,KAAK,IAAA,CAAK,SAAA,GAAY,mBAAmB,mBAAmB,CAAA,CAAA;AAAA,KACjH;AAEA,IAAA,MAAM,OAAA,GACJ,CAAC,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,SAAA,IAAa,IAAA,CAAK,IAAA,KAAS,IAAA,GACnD,WAAA,GACA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAClD,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,CAAA,GACb,IAAA,CAAK,IAAA;AACb,IAAA,IAAA,CAAK,WAAA,GAAc;AAAA,MACjB,GAAA,EAAK,CAAA,KAAA,EAAQ,OAAO,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AAAA,MACjC,IAAA,EAAM,SAAA;AAAA,MACN,aAAA,EAAe,KAAK,SAAA,KAAc;AAAA,KACnC,CAAA;AAAA,EACH;AAAA,EAEQ,iBAAiB,EAAA,EAAqB;AAC5C,IAAA,IAAI,KAAK,YAAA,EAAc;AAIrB,MAAA,IAAA,CAAK,IAAI,2CAA2C,CAAA;AACpD,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,IAAA,EAAM,4BAA4B,CAAA;AAAA,MAC5D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,IAAI,8BAA8B,CAAA;AACvC,IAAA,IAAA,CAAK,YAAA,GAAe,EAAA;AACpB,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,MAAA,OAAA,EAAQ;AAAA,IACV;AAEA,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,cAAA,CAAe,EAAE,CAAA;AAE5C,IAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAS;AACzB,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAC,CAAA;AAKtC,QAAA,IAAI,UAAU,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,SAAS,cAAA,EAAgB;AAC1E,UAAA,MAAM,MAAA,GAAS,yBAAyB,MAAM,CAAA;AAC9C,UAAA,IAAI,WAAW,IAAA,EAAM;AACnB,YAAA,IAAA,CAAK,GAAA,CAAI,CAAA,4CAAA,EAA+C,MAAM,CAAA,CAAE,CAAA;AAChE,YAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,cACX,IAAA,EAAM,OAAA;AAAA,cACN,OAAA,EAAS,yBAAyB,MAAM,CAAA,CAAA;AAAA,cACxC,KAAA,EAAO;AAAA,aACR,CAAA;AACD,YAAA;AAAA,UACF;AAAA,QACF;AACA,QAAA,MAAM,GAAA,GAAM,MAAA;AACZ,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,UAAA,OAAA,CAAQ,GAAG,CAAA;AAAA,QACb;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,UACX,IAAA,EAAM,OAAA;AAAA,UACN,OAAA,EAAS,oBAAoB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,UAC7E,KAAA,EAAO;AAAA,SACR,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,MAAA,aAAA,EAAc;AACd,MAAA,IAAA,CAAK,IAAI,iCAAiC,CAAA;AAC1C,MAAA,IAAI,IAAA,CAAK,iBAAiB,EAAA,EAAI;AAC5B,QAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,kBAAA,EAAoB;AAC7C,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,EAAA,EAA2B;AAChD,IAAA,IAAI,IAAA,CAAK,cAAA,IAAkB,CAAA,EAAG,OAAO,MAAM;AAAA,IAAC,CAAA;AAC5C,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,MAAM,YAAY,MAAM;AACtB,MAAA,MAAA,GAAS,CAAA;AAAA,IACX,CAAA;AACA,IAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,SAAS,CAAA;AACvB,IAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,YAAY,MAAM;AAC9B,MAAA,IAAI,EAAA,CAAG,UAAA,KAAe,EAAA,CAAG,IAAA,EAAM;AAC/B,MAAA,IAAI,MAAA,IAAU,KAAK,cAAA,EAAgB;AACjC,QAAA,IAAA,CAAK,GAAA;AAAA,UACH,CAAA,wBAAA,EAA2B,MAAM,CAAA,eAAA,EAAkB,IAAA,CAAK,WAAW,CAAA,sBAAA;AAAA,SACrE;AACA,QAAA,aAAA,CAAc,KAAK,CAAA;AACnB,QAAA,EAAA,CAAG,SAAA,EAAU;AACb,QAAA;AAAA,MACF;AACA,MAAA,MAAA,EAAA;AACA,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,IAAA,EAAK;AAAA,MACV,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA,EAAG,KAAK,WAAW,CAAA;AACnB,IAAA,KAAA,CAAM,KAAA,IAAQ;AACd,IAAA,OAAO,MAAM,cAAc,KAAK,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAc,SAAA,EAAU;AAAA,IAC/B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,KAAK,KAAA,EAAM;AAChB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,IAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,UAAA,CAAW,mBAAA,EAAoB;AAC/B,MAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,KAAA,CAAM,MAAM,OAAA,EAAS,CAAC,CAAA;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,KAAK,KAAA,EAAyB;AAC5B,IAAA,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,EACpB;AAAA,EAEA,UAAU,OAAA,EAAsD;AAC9D,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,UAAU,OAAA,EAAiC;AACzC,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,aAAa,OAAA,EAAiC;AAC5C,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAI,OAAO,CAAA;AACnC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,kBAAA,CAAmB,OAAO,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,EACF;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,KAAK,YAAA,KAAiB,IAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,IAAI,SAAA,GAAgC;AAClC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,OAAA,EAAQ;AACtC,IAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,GAAO,KAAK,IAAA,GAAO,MAAA;AAAA,EACxD;AAAA,EAEQ,QAAQ,IAAA,EAAqB;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AACpB,MAAA,IAAI,MAAA,IAAU,MAAA,CAAO,UAAA,KAAe,CAAA,EAAG;AACrC,QAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-6A6HE5LW.js","sourcesContent":["/**\n * WebSocketServerTransport — `ws`-based WebSocket server.\n *\n * Accepts one client at a time. Implements ServerTransport from @skaile/workspaces/types.\n * Built on the `ws` package + `node:http`, both of which run under Node and Bun.\n */\n\nimport { createServer, type Server as HttpServer } from \"node:http\";\nimport { listenWithProbe } from \"@skaile/workspaces/core\";\nimport type { AgentCommand, AgentEvent, ServerTransport } from \"@skaile/workspaces/types\";\nimport { type WebSocket, WebSocketServer } from \"ws\";\nimport { decodeBearerFromHeader, tokensEqual } from \"./auth.js\";\n\n/** @deprecated Moved to `@skaile/workspaces/core`, where `portIsHeld` replaces it. */\nexport { needsWildcardProbe } from \"@skaile/workspaces/core\";\n\n/**\n * Options for {@link WebSocketServerTransport}.\n *\n * @param port - TCP port to bind to; `0` picks a free port (read it back via `boundPort`).\n * @param onLog - Optional callback for internal log lines (client connect/disconnect events).\n * @param host - Address to bind. Default: every interface (Node's unspecified address).\n *   `127.0.0.1` accepts local clients only.\n * @param authToken - When set, every upgrade must present this token via the\n *   `skaile-bearer.<base64url>` subprotocol or the handshake is rejected with\n *   HTTP 401. When unset, no auth is enforced (back-compatible default).\n * @param onListening - Called once the socket is bound, with the address a client\n *   connects to (`url`) and whether it needs a token. For a plain-text ready line\n *   (the `onLog` record carries the port only inside a log sentence).\n * @param heartbeatMs - Interval in milliseconds between pings to the active\n *   client. Default: 30 000.\n * @param maxMissedPongs - Heartbeat ticks the client may go without a pong (or\n *   any inbound frame) before its socket is terminated, so a client lost behind a\n *   dead path (no FIN) fires `onDisconnect` instead of swallowing every event\n *   sent to it. Default: 2, i.e. detection within 3 x `heartbeatMs`. `0` turns\n *   the heartbeat off. Every WebSocket client answers pings on its own.\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport interface WebSocketServerOptions {\n  port: number;\n  host?: string;\n  onLog?: (line: string) => void;\n  authToken?: string;\n  onListening?: (info: { url: string; port: number; tokenRequired: boolean }) => void;\n  heartbeatMs?: number;\n  maxMissedPongs?: number;\n}\n\nconst DEFAULT_HEARTBEAT_MS = 30_000;\nconst DEFAULT_MAX_MISSED_PONGS = 2;\n\n/**\n * Shape-validate a `session_init` frame at ingress before forwarding to the\n * runner. Protocol v3 requires the deterministic bootstrap envelope to carry\n * an identity tuple, a semver-shaped `protocolVersion`, a resolved config\n * object, and a `credentials` map keyed by `mounts` / `connectors`. Frames\n * that fail the guard are rejected on the wire so the runner never sees a\n * malformed boot envelope.\n *\n * Returns `null` when the frame is well-formed, or a human-readable reason\n * when it should be rejected.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`\n * § \"SessionInitCommand schema\".\n *\n * @internal\n */\nfunction validateSessionInitShape(cmd: Record<string, unknown>): string | null {\n  if (cmd.type !== \"session_init\") return \"type must be 'session_init'\";\n\n  const identity = cmd.identity as Record<string, unknown> | undefined;\n  if (!identity || typeof identity !== \"object\" || Array.isArray(identity)) {\n    return \"identity must be an object\";\n  }\n  if (typeof identity.containerId !== \"string\") return \"identity.containerId must be a string\";\n  if (typeof identity.sessionId !== \"string\") return \"identity.sessionId must be a string\";\n  if (typeof identity.projectId !== \"string\") return \"identity.projectId must be a string\";\n\n  const protocolVersion = cmd.protocolVersion as Record<string, unknown> | undefined;\n  if (!protocolVersion || typeof protocolVersion !== \"object\" || Array.isArray(protocolVersion)) {\n    return \"protocolVersion must be an object\";\n  }\n  if (typeof protocolVersion.major !== \"number\") return \"protocolVersion.major must be a number\";\n  if (typeof protocolVersion.minor !== \"number\") return \"protocolVersion.minor must be a number\";\n  if (typeof protocolVersion.patch !== \"number\") return \"protocolVersion.patch must be a number\";\n\n  if (\n    !cmd.resolvedConfig ||\n    typeof cmd.resolvedConfig !== \"object\" ||\n    Array.isArray(cmd.resolvedConfig)\n  ) {\n    return \"resolvedConfig must be an object\";\n  }\n\n  if (!cmd.credentials || typeof cmd.credentials !== \"object\" || Array.isArray(cmd.credentials)) {\n    return \"credentials must be an object\";\n  }\n\n  return null;\n}\n\n/**\n * `ServerTransport` implementation backed by the `ws` package on top of a\n * `node:http` server.\n *\n * Enforces a single-client policy: if a new connection arrives while a client is\n * already connected, the stale connection is closed with code 4001 and replaced.\n * Incoming frames are parsed as JSON `AgentCommand` messages and fanned out to\n * registered `onCommand` handlers; outgoing `AgentEvent` objects are JSON-serialised\n * before sending. Call `listen()` to start accepting connections and `close()` to\n * shut down cleanly — `close()` terminates the active socket immediately rather\n * than keeping the event loop alive.\n *\n * @example\n * ```ts\n * const server = new WebSocketServerTransport({ port: 8080 });\n * await server.listen();\n * server.onCommand((cmd) => console.log(cmd));\n * server.send({ type: 'agent_end' });\n * await server.close();\n * ```\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport class WebSocketServerTransport implements ServerTransport {\n  private httpServer: HttpServer | null = null;\n  private wss: WebSocketServer | null = null;\n  private activeClient: WebSocket | null = null;\n  private readonly port: number;\n  private readonly log: (line: string) => void;\n  private readonly host?: string;\n  private readonly authToken?: string;\n  private readonly heartbeatMs: number;\n  private readonly maxMissedPongs: number;\n\n  private readonly onListening: WebSocketServerOptions[\"onListening\"];\n  private readonly commandHandlers = new Set<(command: AgentCommand) => void>();\n  private readonly connectHandlers = new Set<() => void>();\n  private readonly disconnectHandlers = new Set<() => void>();\n\n  constructor(options: WebSocketServerOptions) {\n    this.port = options.port;\n    this.log = options.onLog ?? console.log;\n    this.host = options.host;\n    this.authToken = options.authToken;\n    this.onListening = options.onListening;\n    this.heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;\n    this.maxMissedPongs = options.maxMissedPongs ?? DEFAULT_MAX_MISSED_PONGS;\n  }\n\n  /** Start the server and accept connections. */\n  async listen(): Promise<void> {\n    const httpServer = createServer((_req, res) => {\n      res.writeHead(200, { \"content-type\": \"text/plain\" });\n      res.end(\"skaile agent server\");\n    });\n    // When an auth token is configured, reject the upgrade at handshake time\n    // (HTTP 401) unless the client presents the matching bearer subprotocol.\n    // Rejecting here — before `connection` — keeps unauthenticated sockets from\n    // ever reaching the command handlers.\n    const expected = this.authToken;\n    const wss = new WebSocketServer({\n      server: httpServer,\n      verifyClient: expected\n        ? (info, cb) => {\n            const presented = decodeBearerFromHeader(info.req.headers[\"sec-websocket-protocol\"]);\n            if (presented !== null && tokensEqual(presented, expected)) {\n              cb(true);\n            } else {\n              this.log(\"[ws-server] rejecting unauthenticated upgrade\");\n              cb(false, 401, \"Unauthorized\");\n            }\n          }\n        : undefined,\n    });\n    wss.on(\"connection\", (ws) => this.handleConnection(ws));\n    // `ws` re-emits the http server's errors on `wss`; unhandled during the bind,\n    // that throws before the reject below runs and `listen()` hangs. Scoped to the\n    // bind so a post-startup server error still surfaces loudly.\n    const swallowBindError = () => {};\n    wss.on(\"error\", swallowBindError);\n    this.httpServer = httpServer;\n    this.wss = wss;\n\n    try {\n      await listenWithProbe(httpServer, this.port, this.host);\n    } catch (err) {\n      wss.close();\n      this.wss = null;\n      this.httpServer = null;\n      if (err instanceof Error && \"code\" in err && err.code === \"EADDRINUSE\") {\n        const where = this.host ? `${this.host}:${this.port}` : `port ${this.port}`;\n        throw Object.assign(\n          new Error(\n            `${where} is already in use: another process listens there. Pick another port.`,\n          ),\n          { code: \"EADDRINUSE\" },\n        );\n      }\n      throw err;\n    } finally {\n      wss.off(\"error\", swallowBindError);\n    }\n\n    const addr = httpServer.address();\n    const boundPort = typeof addr === \"object\" && addr ? addr.port : this.port;\n    const bind = this.host ?? \"all interfaces\";\n    this.log(\n      `[ws-server] listening on port ${boundPort} (${bind}; ${this.authToken ? \"token required\" : \"no authentication\"})`,\n    );\n    // A wildcard bind is reachable on loopback; that is the URL worth printing.\n    const urlHost =\n      !this.host || this.host === \"0.0.0.0\" || this.host === \"::\"\n        ? \"127.0.0.1\"\n        : this.host.includes(\":\") && !this.host.startsWith(\"[\")\n          ? `[${this.host}]`\n          : this.host;\n    this.onListening?.({\n      url: `ws://${urlHost}:${boundPort}`,\n      port: boundPort,\n      tokenRequired: this.authToken !== undefined,\n    });\n  }\n\n  private handleConnection(ws: WebSocket): void {\n    if (this.activeClient) {\n      // Close the stale connection instead of rejecting the new one.\n      // This handles the race where waitForWsReady's probe hasn't\n      // fully disconnected before the real gateway client connects.\n      this.log(\"[ws-server] replacing previous connection\");\n      try {\n        this.activeClient.close(4001, \"Replaced by new connection\");\n      } catch {\n        // already closed\n      }\n    }\n    this.log(\"[ws-server] client connected\");\n    this.activeClient = ws;\n    for (const handler of this.connectHandlers) {\n      handler();\n    }\n\n    const stopHeartbeat = this.startHeartbeat(ws);\n\n    ws.on(\"message\", (data) => {\n      try {\n        const parsed = JSON.parse(String(data)) as Record<string, unknown>;\n        // Protocol v3: shape-validate `session_init` at ingress so the\n        // runner never receives a malformed boot envelope. Other command\n        // shapes pass through unchanged — invalid `AgentCommand`s surface\n        // through the existing per-command handlers in serve.ts.\n        if (parsed && typeof parsed === \"object\" && parsed.type === \"session_init\") {\n          const reason = validateSessionInitShape(parsed);\n          if (reason !== null) {\n            this.log(`[ws-server] rejecting invalid session_init: ${reason}`);\n            this.sendRaw({\n              type: \"error\",\n              message: `Invalid session_init: ${reason}`,\n              fatal: false,\n            });\n            return;\n          }\n        }\n        const cmd = parsed as unknown as AgentCommand;\n        for (const handler of this.commandHandlers) {\n          handler(cmd);\n        }\n      } catch (err) {\n        this.sendRaw({\n          type: \"error\",\n          message: `Invalid message: ${err instanceof Error ? err.message : String(err)}`,\n          fatal: false,\n        });\n      }\n    });\n\n    ws.on(\"close\", () => {\n      stopHeartbeat();\n      this.log(\"[ws-server] client disconnected\");\n      if (this.activeClient === ws) {\n        this.activeClient = null;\n        for (const handler of this.disconnectHandlers) {\n          handler();\n        }\n      }\n    });\n  }\n\n  /**\n   * Ping `ws` every {@link heartbeatMs}; terminate it after\n   * {@link maxMissedPongs} unanswered ticks. `terminate()` makes `ws` emit\n   * `close`, which runs the normal disconnect path. Returns the stop function.\n   */\n  private startHeartbeat(ws: WebSocket): () => void {\n    if (this.maxMissedPongs <= 0) return () => {};\n    let missed = 0;\n    const markAlive = () => {\n      missed = 0;\n    };\n    ws.on(\"pong\", markAlive);\n    ws.on(\"message\", markAlive);\n    const timer = setInterval(() => {\n      if (ws.readyState !== ws.OPEN) return;\n      if (missed >= this.maxMissedPongs) {\n        this.log(\n          `[ws-server] no pong for ${missed} heartbeats of ${this.heartbeatMs}ms; terminating client`,\n        );\n        clearInterval(timer);\n        ws.terminate();\n        return;\n      }\n      missed++;\n      try {\n        ws.ping();\n      } catch {\n        // socket closing underneath us; the close event cleans up\n      }\n    }, this.heartbeatMs);\n    timer.unref?.();\n    return () => clearInterval(timer);\n  }\n\n  /**\n   * Stop the server.\n   *\n   * Terminates the active socket immediately — otherwise a still-connected\n   * client would keep the event loop alive and block process shutdown.\n   */\n  async close(): Promise<void> {\n    try {\n      this.activeClient?.terminate();\n    } catch {\n      // already closed\n    }\n    this.activeClient = null;\n    this.wss?.close();\n    this.wss = null;\n    const httpServer = this.httpServer;\n    this.httpServer = null;\n    if (httpServer) {\n      httpServer.closeAllConnections();\n      await new Promise<void>((resolve) => httpServer.close(() => resolve()));\n    }\n  }\n\n  send(event: AgentEvent): void {\n    this.sendRaw(event);\n  }\n\n  onCommand(handler: (command: AgentCommand) => void): () => void {\n    this.commandHandlers.add(handler);\n    return () => {\n      this.commandHandlers.delete(handler);\n    };\n  }\n\n  onConnect(handler: () => void): () => void {\n    this.connectHandlers.add(handler);\n    return () => {\n      this.connectHandlers.delete(handler);\n    };\n  }\n\n  onDisconnect(handler: () => void): () => void {\n    this.disconnectHandlers.add(handler);\n    return () => {\n      this.disconnectHandlers.delete(handler);\n    };\n  }\n\n  get connected(): boolean {\n    return this.activeClient !== null;\n  }\n\n  /** The port actually bound by `listen()` (resolves `port: 0`); `undefined` when not listening. */\n  get boundPort(): number | undefined {\n    const addr = this.httpServer?.address();\n    return typeof addr === \"object\" && addr ? addr.port : undefined;\n  }\n\n  private sendRaw(data: unknown): void {\n    try {\n      const client = this.activeClient;\n      if (client && client.readyState === 1) {\n        client.send(JSON.stringify(data));\n      }\n    } catch {\n      // Silently ignore send failures\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../transport/src/ws/server.ts"],"names":[],"mappings":";;;;;AAiDA,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,wBAAA,GAA2B,CAAA;AAkBjC,SAAS,yBAAyB,GAAA,EAA6C;AAC7E,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB,OAAO,6BAAA;AAExC,EAAA,MAAM,WAAW,GAAA,CAAI,QAAA;AACrB,EAAA,IAAI,CAAC,YAAY,OAAO,QAAA,KAAa,YAAY,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxE,IAAA,OAAO,4BAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,WAAA,KAAgB,QAAA,EAAU,OAAO,uCAAA;AACrD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AACnD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AAEnD,EAAA,MAAM,kBAAkB,GAAA,CAAI,eAAA;AAC5B,EAAA,IAAI,CAAC,mBAAmB,OAAO,eAAA,KAAoB,YAAY,KAAA,CAAM,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC7F,IAAA,OAAO,mCAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AAEtD,EAAA,IACE,CAAC,GAAA,CAAI,cAAA,IACL,OAAO,GAAA,CAAI,cAAA,KAAmB,QAAA,IAC9B,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAChC;AACA,IAAA,OAAO,kCAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,GAAA,CAAI,WAAA,IAAe,OAAO,GAAA,CAAI,WAAA,KAAgB,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAC7F,IAAA,OAAO,+BAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAyBO,IAAM,2BAAN,MAA0D;AAAA,EACvD,UAAA,GAAgC,IAAA;AAAA,EAChC,GAAA,GAA8B,IAAA;AAAA,EAC9B,YAAA,GAAiC,IAAA;AAAA,EACxB,IAAA;AAAA,EACA,GAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EAEA,WAAA;AAAA,EACA,eAAA,uBAAsB,GAAA,EAAqC;AAAA,EAC3D,eAAA,uBAAsB,GAAA,EAAgB;AAAA,EACtC,kBAAA,uBAAyB,GAAA,EAAgB;AAAA,EAE1D,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA;AACpC,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAC3B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC1C,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,cAAA,IAAkB,wBAAA;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,MAAA,GAAwB;AAC5B,IAAA,MAAM,UAAA,GAAa,YAAA,CAAa,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC7C,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,cAAc,CAAA;AACnD,MAAA,GAAA,CAAI,IAAI,qBAAqB,CAAA;AAAA,IAC/B,CAAC,CAAA;AAKD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA;AACtB,IAAA,MAAM,GAAA,GAAM,IAAI,eAAA,CAAgB;AAAA,MAC9B,MAAA,EAAQ,UAAA;AAAA,MACR,YAAA,EAAc,QAAA,GACV,CAAC,IAAA,EAAM,EAAA,KAAO;AACZ,QAAA,MAAM,YAAY,sBAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,wBAAwB,CAAC,CAAA;AACnF,QAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,WAAA,CAAY,SAAA,EAAW,QAAQ,CAAA,EAAG;AAC1D,UAAA,EAAA,CAAG,IAAI,CAAA;AAAA,QACT,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,IAAI,+CAA+C,CAAA;AACxD,UAAA,EAAA,CAAG,KAAA,EAAO,KAAK,cAAc,CAAA;AAAA,QAC/B;AAAA,MACF,CAAA,GACA;AAAA,KACL,CAAA;AACD,IAAA,GAAA,CAAI,GAAG,YAAA,EAAc,CAAC,OAAO,IAAA,CAAK,gBAAA,CAAiB,EAAE,CAAC,CAAA;AAItD,IAAA,MAAM,mBAAmB,MAAM;AAAA,IAAC,CAAA;AAChC,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,gBAAgB,CAAA;AAChC,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAEX,IAAA,IAAI;AACF,MAAA,MAAM,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAA,EAAM,KAAK,IAAI,CAAA;AAAA,IACxD,SAAS,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,KAAA,EAAM;AACV,MAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,MAAA,IAAI,eAAe,KAAA,IAAS,MAAA,IAAU,GAAA,IAAO,GAAA,CAAI,SAAS,YAAA,EAAc;AACtE,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,GAAK,CAAA,KAAA,EAAQ,IAAA,CAAK,IAAI,CAAA,CAAA;AACzE,QAAA,MAAM,MAAA,CAAO,MAAA;AAAA,UACX,IAAI,KAAA;AAAA,YACF,GAAG,KAAK,CAAA,qEAAA;AAAA,WACV;AAAA,UACA,EAAE,MAAM,YAAA;AAAa,SACvB;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,SAAS,gBAAgB,CAAA;AAAA,IACnC;AAEA,IAAA,MAAM,IAAA,GAAO,WAAW,OAAA,EAAQ;AAChC,IAAA,MAAM,YAAY,OAAO,IAAA,KAAS,YAAY,IAAA,GAAO,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACtE,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,gBAAA;AAC1B,IAAA,IAAA,CAAK,GAAA;AAAA,MACH,CAAA,8BAAA,EAAiC,SAAS,CAAA,EAAA,EAAK,IAAI,KAAK,IAAA,CAAK,SAAA,GAAY,mBAAmB,mBAAmB,CAAA,CAAA;AAAA,KACjH;AAEA,IAAA,MAAM,OAAA,GACJ,CAAC,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,SAAA,IAAa,IAAA,CAAK,IAAA,KAAS,IAAA,GACnD,WAAA,GACA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAClD,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAA,CAAA,GACb,IAAA,CAAK,IAAA;AACb,IAAA,IAAA,CAAK,WAAA,GAAc;AAAA,MACjB,GAAA,EAAK,CAAA,KAAA,EAAQ,OAAO,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AAAA,MACjC,IAAA,EAAM,SAAA;AAAA,MACN,aAAA,EAAe,KAAK,SAAA,KAAc;AAAA,KACnC,CAAA;AAAA,EACH;AAAA,EAEQ,iBAAiB,EAAA,EAAqB;AAC5C,IAAA,IAAI,KAAK,YAAA,EAAc;AAIrB,MAAA,IAAA,CAAK,IAAI,2CAA2C,CAAA;AACpD,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,IAAA,EAAM,4BAA4B,CAAA;AAAA,MAC5D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,IAAI,8BAA8B,CAAA;AACvC,IAAA,IAAA,CAAK,YAAA,GAAe,EAAA;AACpB,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,MAAA,OAAA,EAAQ;AAAA,IACV;AAEA,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,cAAA,CAAe,EAAE,CAAA;AAE5C,IAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAS;AACzB,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAC,CAAA;AAKtC,QAAA,IAAI,UAAU,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,SAAS,cAAA,EAAgB;AAC1E,UAAA,MAAM,MAAA,GAAS,yBAAyB,MAAM,CAAA;AAC9C,UAAA,IAAI,WAAW,IAAA,EAAM;AACnB,YAAA,IAAA,CAAK,GAAA,CAAI,CAAA,4CAAA,EAA+C,MAAM,CAAA,CAAE,CAAA;AAChE,YAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,cACX,IAAA,EAAM,OAAA;AAAA,cACN,OAAA,EAAS,yBAAyB,MAAM,CAAA,CAAA;AAAA,cACxC,KAAA,EAAO;AAAA,aACR,CAAA;AACD,YAAA;AAAA,UACF;AAAA,QACF;AACA,QAAA,MAAM,GAAA,GAAM,MAAA;AACZ,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,UAAA,OAAA,CAAQ,GAAG,CAAA;AAAA,QACb;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,UACX,IAAA,EAAM,OAAA;AAAA,UACN,OAAA,EAAS,oBAAoB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,UAC7E,KAAA,EAAO;AAAA,SACR,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,MAAA,aAAA,EAAc;AACd,MAAA,IAAA,CAAK,IAAI,iCAAiC,CAAA;AAC1C,MAAA,IAAI,IAAA,CAAK,iBAAiB,EAAA,EAAI;AAC5B,QAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,kBAAA,EAAoB;AAC7C,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,EAAA,EAA2B;AAChD,IAAA,IAAI,IAAA,CAAK,cAAA,IAAkB,CAAA,EAAG,OAAO,MAAM;AAAA,IAAC,CAAA;AAC5C,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,MAAM,YAAY,MAAM;AACtB,MAAA,MAAA,GAAS,CAAA;AAAA,IACX,CAAA;AACA,IAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,SAAS,CAAA;AACvB,IAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,YAAY,MAAM;AAC9B,MAAA,IAAI,EAAA,CAAG,UAAA,KAAe,EAAA,CAAG,IAAA,EAAM;AAC/B,MAAA,IAAI,MAAA,IAAU,KAAK,cAAA,EAAgB;AACjC,QAAA,IAAA,CAAK,GAAA;AAAA,UACH,CAAA,wBAAA,EAA2B,MAAM,CAAA,eAAA,EAAkB,IAAA,CAAK,WAAW,CAAA,sBAAA;AAAA,SACrE;AACA,QAAA,aAAA,CAAc,KAAK,CAAA;AACnB,QAAA,EAAA,CAAG,SAAA,EAAU;AACb,QAAA;AAAA,MACF;AACA,MAAA,MAAA,EAAA;AACA,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,IAAA,EAAK;AAAA,MACV,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA,EAAG,KAAK,WAAW,CAAA;AACnB,IAAA,KAAA,CAAM,KAAA,IAAQ;AACd,IAAA,OAAO,MAAM,cAAc,KAAK,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAc,SAAA,EAAU;AAAA,IAC/B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,KAAK,KAAA,EAAM;AAChB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,IAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,UAAA,CAAW,mBAAA,EAAoB;AAC/B,MAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,KAAA,CAAM,MAAM,OAAA,EAAS,CAAC,CAAA;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,KAAK,KAAA,EAAyB;AAC5B,IAAA,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,EACpB;AAAA,EAEA,UAAU,OAAA,EAAsD;AAC9D,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,UAAU,OAAA,EAAiC;AACzC,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,aAAa,OAAA,EAAiC;AAC5C,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAI,OAAO,CAAA;AACnC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,kBAAA,CAAmB,OAAO,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,EACF;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,KAAK,YAAA,KAAiB,IAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,IAAI,SAAA,GAAgC;AAClC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,OAAA,EAAQ;AACtC,IAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,GAAO,KAAK,IAAA,GAAO,MAAA;AAAA,EACxD;AAAA,EAEQ,QAAQ,IAAA,EAAqB;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AACpB,MAAA,IAAI,MAAA,IAAU,MAAA,CAAO,UAAA,KAAe,CAAA,EAAG;AACrC,QAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-HLAEYFUN.js","sourcesContent":["/**\n * WebSocketServerTransport — `ws`-based WebSocket server.\n *\n * Accepts one client at a time. Implements ServerTransport from @skaile/workspaces/types.\n * Built on the `ws` package + `node:http`, both of which run under Node and Bun.\n */\n\nimport { createServer, type Server as HttpServer } from \"node:http\";\nimport { listenWithProbe } from \"@skaile/workspaces/core\";\nimport type { AgentCommand, AgentEvent, ServerTransport } from \"@skaile/workspaces/types\";\nimport { type WebSocket, WebSocketServer } from \"ws\";\nimport { decodeBearerFromHeader, tokensEqual } from \"./auth.js\";\n\n/** @deprecated Moved to `@skaile/workspaces/core`, where `portIsHeld` replaces it. */\nexport { needsWildcardProbe } from \"@skaile/workspaces/core\";\n\n/**\n * Options for {@link WebSocketServerTransport}.\n *\n * @param port - TCP port to bind to; `0` picks a free port (read it back via `boundPort`).\n * @param onLog - Optional callback for internal log lines (client connect/disconnect events).\n * @param host - Address to bind. Default: every interface (Node's unspecified address).\n *   `127.0.0.1` accepts local clients only.\n * @param authToken - When set, every upgrade must present this token via the\n *   `skaile-bearer.<base64url>` subprotocol or the handshake is rejected with\n *   HTTP 401. When unset, no auth is enforced (back-compatible default).\n * @param onListening - Called once the socket is bound, with the address a client\n *   connects to (`url`) and whether it needs a token. For a plain-text ready line\n *   (the `onLog` record carries the port only inside a log sentence).\n * @param heartbeatMs - Interval in milliseconds between pings to the active\n *   client. Default: 30 000.\n * @param maxMissedPongs - Heartbeat ticks the client may go without a pong (or\n *   any inbound frame) before its socket is terminated, so a client lost behind a\n *   dead path (no FIN) fires `onDisconnect` instead of swallowing every event\n *   sent to it. Default: 2, i.e. detection within 3 x `heartbeatMs`. `0` turns\n *   the heartbeat off. Every WebSocket client answers pings on its own.\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport interface WebSocketServerOptions {\n  port: number;\n  host?: string;\n  onLog?: (line: string) => void;\n  authToken?: string;\n  onListening?: (info: { url: string; port: number; tokenRequired: boolean }) => void;\n  heartbeatMs?: number;\n  maxMissedPongs?: number;\n}\n\nconst DEFAULT_HEARTBEAT_MS = 30_000;\nconst DEFAULT_MAX_MISSED_PONGS = 2;\n\n/**\n * Shape-validate a `session_init` frame at ingress before forwarding to the\n * runner. Protocol v3 requires the deterministic bootstrap envelope to carry\n * an identity tuple, a semver-shaped `protocolVersion`, a resolved config\n * object, and a `credentials` map keyed by `mounts` / `connectors`. Frames\n * that fail the guard are rejected on the wire so the runner never sees a\n * malformed boot envelope.\n *\n * Returns `null` when the frame is well-formed, or a human-readable reason\n * when it should be rejected.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`\n * § \"SessionInitCommand schema\".\n *\n * @internal\n */\nfunction validateSessionInitShape(cmd: Record<string, unknown>): string | null {\n  if (cmd.type !== \"session_init\") return \"type must be 'session_init'\";\n\n  const identity = cmd.identity as Record<string, unknown> | undefined;\n  if (!identity || typeof identity !== \"object\" || Array.isArray(identity)) {\n    return \"identity must be an object\";\n  }\n  if (typeof identity.containerId !== \"string\") return \"identity.containerId must be a string\";\n  if (typeof identity.sessionId !== \"string\") return \"identity.sessionId must be a string\";\n  if (typeof identity.projectId !== \"string\") return \"identity.projectId must be a string\";\n\n  const protocolVersion = cmd.protocolVersion as Record<string, unknown> | undefined;\n  if (!protocolVersion || typeof protocolVersion !== \"object\" || Array.isArray(protocolVersion)) {\n    return \"protocolVersion must be an object\";\n  }\n  if (typeof protocolVersion.major !== \"number\") return \"protocolVersion.major must be a number\";\n  if (typeof protocolVersion.minor !== \"number\") return \"protocolVersion.minor must be a number\";\n  if (typeof protocolVersion.patch !== \"number\") return \"protocolVersion.patch must be a number\";\n\n  if (\n    !cmd.resolvedConfig ||\n    typeof cmd.resolvedConfig !== \"object\" ||\n    Array.isArray(cmd.resolvedConfig)\n  ) {\n    return \"resolvedConfig must be an object\";\n  }\n\n  if (!cmd.credentials || typeof cmd.credentials !== \"object\" || Array.isArray(cmd.credentials)) {\n    return \"credentials must be an object\";\n  }\n\n  return null;\n}\n\n/**\n * `ServerTransport` implementation backed by the `ws` package on top of a\n * `node:http` server.\n *\n * Enforces a single-client policy: if a new connection arrives while a client is\n * already connected, the stale connection is closed with code 4001 and replaced.\n * Incoming frames are parsed as JSON `AgentCommand` messages and fanned out to\n * registered `onCommand` handlers; outgoing `AgentEvent` objects are JSON-serialised\n * before sending. Call `listen()` to start accepting connections and `close()` to\n * shut down cleanly — `close()` terminates the active socket immediately rather\n * than keeping the event loop alive.\n *\n * @example\n * ```ts\n * const server = new WebSocketServerTransport({ port: 8080 });\n * await server.listen();\n * server.onCommand((cmd) => console.log(cmd));\n * server.send({ type: 'agent_end' });\n * await server.close();\n * ```\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport class WebSocketServerTransport implements ServerTransport {\n  private httpServer: HttpServer | null = null;\n  private wss: WebSocketServer | null = null;\n  private activeClient: WebSocket | null = null;\n  private readonly port: number;\n  private readonly log: (line: string) => void;\n  private readonly host?: string;\n  private readonly authToken?: string;\n  private readonly heartbeatMs: number;\n  private readonly maxMissedPongs: number;\n\n  private readonly onListening: WebSocketServerOptions[\"onListening\"];\n  private readonly commandHandlers = new Set<(command: AgentCommand) => void>();\n  private readonly connectHandlers = new Set<() => void>();\n  private readonly disconnectHandlers = new Set<() => void>();\n\n  constructor(options: WebSocketServerOptions) {\n    this.port = options.port;\n    this.log = options.onLog ?? console.log;\n    this.host = options.host;\n    this.authToken = options.authToken;\n    this.onListening = options.onListening;\n    this.heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;\n    this.maxMissedPongs = options.maxMissedPongs ?? DEFAULT_MAX_MISSED_PONGS;\n  }\n\n  /** Start the server and accept connections. */\n  async listen(): Promise<void> {\n    const httpServer = createServer((_req, res) => {\n      res.writeHead(200, { \"content-type\": \"text/plain\" });\n      res.end(\"skaile agent server\");\n    });\n    // When an auth token is configured, reject the upgrade at handshake time\n    // (HTTP 401) unless the client presents the matching bearer subprotocol.\n    // Rejecting here — before `connection` — keeps unauthenticated sockets from\n    // ever reaching the command handlers.\n    const expected = this.authToken;\n    const wss = new WebSocketServer({\n      server: httpServer,\n      verifyClient: expected\n        ? (info, cb) => {\n            const presented = decodeBearerFromHeader(info.req.headers[\"sec-websocket-protocol\"]);\n            if (presented !== null && tokensEqual(presented, expected)) {\n              cb(true);\n            } else {\n              this.log(\"[ws-server] rejecting unauthenticated upgrade\");\n              cb(false, 401, \"Unauthorized\");\n            }\n          }\n        : undefined,\n    });\n    wss.on(\"connection\", (ws) => this.handleConnection(ws));\n    // `ws` re-emits the http server's errors on `wss`; unhandled during the bind,\n    // that throws before the reject below runs and `listen()` hangs. Scoped to the\n    // bind so a post-startup server error still surfaces loudly.\n    const swallowBindError = () => {};\n    wss.on(\"error\", swallowBindError);\n    this.httpServer = httpServer;\n    this.wss = wss;\n\n    try {\n      await listenWithProbe(httpServer, this.port, this.host);\n    } catch (err) {\n      wss.close();\n      this.wss = null;\n      this.httpServer = null;\n      if (err instanceof Error && \"code\" in err && err.code === \"EADDRINUSE\") {\n        const where = this.host ? `${this.host}:${this.port}` : `port ${this.port}`;\n        throw Object.assign(\n          new Error(\n            `${where} is already in use: another process listens there. Pick another port.`,\n          ),\n          { code: \"EADDRINUSE\" },\n        );\n      }\n      throw err;\n    } finally {\n      wss.off(\"error\", swallowBindError);\n    }\n\n    const addr = httpServer.address();\n    const boundPort = typeof addr === \"object\" && addr ? addr.port : this.port;\n    const bind = this.host ?? \"all interfaces\";\n    this.log(\n      `[ws-server] listening on port ${boundPort} (${bind}; ${this.authToken ? \"token required\" : \"no authentication\"})`,\n    );\n    // A wildcard bind is reachable on loopback; that is the URL worth printing.\n    const urlHost =\n      !this.host || this.host === \"0.0.0.0\" || this.host === \"::\"\n        ? \"127.0.0.1\"\n        : this.host.includes(\":\") && !this.host.startsWith(\"[\")\n          ? `[${this.host}]`\n          : this.host;\n    this.onListening?.({\n      url: `ws://${urlHost}:${boundPort}`,\n      port: boundPort,\n      tokenRequired: this.authToken !== undefined,\n    });\n  }\n\n  private handleConnection(ws: WebSocket): void {\n    if (this.activeClient) {\n      // Close the stale connection instead of rejecting the new one.\n      // This handles the race where waitForWsReady's probe hasn't\n      // fully disconnected before the real gateway client connects.\n      this.log(\"[ws-server] replacing previous connection\");\n      try {\n        this.activeClient.close(4001, \"Replaced by new connection\");\n      } catch {\n        // already closed\n      }\n    }\n    this.log(\"[ws-server] client connected\");\n    this.activeClient = ws;\n    for (const handler of this.connectHandlers) {\n      handler();\n    }\n\n    const stopHeartbeat = this.startHeartbeat(ws);\n\n    ws.on(\"message\", (data) => {\n      try {\n        const parsed = JSON.parse(String(data)) as Record<string, unknown>;\n        // Protocol v3: shape-validate `session_init` at ingress so the\n        // runner never receives a malformed boot envelope. Other command\n        // shapes pass through unchanged — invalid `AgentCommand`s surface\n        // through the existing per-command handlers in serve.ts.\n        if (parsed && typeof parsed === \"object\" && parsed.type === \"session_init\") {\n          const reason = validateSessionInitShape(parsed);\n          if (reason !== null) {\n            this.log(`[ws-server] rejecting invalid session_init: ${reason}`);\n            this.sendRaw({\n              type: \"error\",\n              message: `Invalid session_init: ${reason}`,\n              fatal: false,\n            });\n            return;\n          }\n        }\n        const cmd = parsed as unknown as AgentCommand;\n        for (const handler of this.commandHandlers) {\n          handler(cmd);\n        }\n      } catch (err) {\n        this.sendRaw({\n          type: \"error\",\n          message: `Invalid message: ${err instanceof Error ? err.message : String(err)}`,\n          fatal: false,\n        });\n      }\n    });\n\n    ws.on(\"close\", () => {\n      stopHeartbeat();\n      this.log(\"[ws-server] client disconnected\");\n      if (this.activeClient === ws) {\n        this.activeClient = null;\n        for (const handler of this.disconnectHandlers) {\n          handler();\n        }\n      }\n    });\n  }\n\n  /**\n   * Ping `ws` every {@link heartbeatMs}; terminate it after\n   * {@link maxMissedPongs} unanswered ticks. `terminate()` makes `ws` emit\n   * `close`, which runs the normal disconnect path. Returns the stop function.\n   */\n  private startHeartbeat(ws: WebSocket): () => void {\n    if (this.maxMissedPongs <= 0) return () => {};\n    let missed = 0;\n    const markAlive = () => {\n      missed = 0;\n    };\n    ws.on(\"pong\", markAlive);\n    ws.on(\"message\", markAlive);\n    const timer = setInterval(() => {\n      if (ws.readyState !== ws.OPEN) return;\n      if (missed >= this.maxMissedPongs) {\n        this.log(\n          `[ws-server] no pong for ${missed} heartbeats of ${this.heartbeatMs}ms; terminating client`,\n        );\n        clearInterval(timer);\n        ws.terminate();\n        return;\n      }\n      missed++;\n      try {\n        ws.ping();\n      } catch {\n        // socket closing underneath us; the close event cleans up\n      }\n    }, this.heartbeatMs);\n    timer.unref?.();\n    return () => clearInterval(timer);\n  }\n\n  /**\n   * Stop the server.\n   *\n   * Terminates the active socket immediately — otherwise a still-connected\n   * client would keep the event loop alive and block process shutdown.\n   */\n  async close(): Promise<void> {\n    try {\n      this.activeClient?.terminate();\n    } catch {\n      // already closed\n    }\n    this.activeClient = null;\n    this.wss?.close();\n    this.wss = null;\n    const httpServer = this.httpServer;\n    this.httpServer = null;\n    if (httpServer) {\n      httpServer.closeAllConnections();\n      await new Promise<void>((resolve) => httpServer.close(() => resolve()));\n    }\n  }\n\n  send(event: AgentEvent): void {\n    this.sendRaw(event);\n  }\n\n  onCommand(handler: (command: AgentCommand) => void): () => void {\n    this.commandHandlers.add(handler);\n    return () => {\n      this.commandHandlers.delete(handler);\n    };\n  }\n\n  onConnect(handler: () => void): () => void {\n    this.connectHandlers.add(handler);\n    return () => {\n      this.connectHandlers.delete(handler);\n    };\n  }\n\n  onDisconnect(handler: () => void): () => void {\n    this.disconnectHandlers.add(handler);\n    return () => {\n      this.disconnectHandlers.delete(handler);\n    };\n  }\n\n  get connected(): boolean {\n    return this.activeClient !== null;\n  }\n\n  /** The port actually bound by `listen()` (resolves `port: 0`); `undefined` when not listening. */\n  get boundPort(): number | undefined {\n    const addr = this.httpServer?.address();\n    return typeof addr === \"object\" && addr ? addr.port : undefined;\n  }\n\n  private sendRaw(data: unknown): void {\n    try {\n      const client = this.activeClient;\n      if (client && client.readyState === 1) {\n        client.send(JSON.stringify(data));\n      }\n    } catch {\n      // Silently ignore send failures\n    }\n  }\n}\n"]}

package/dist/{chunk-YN6N3RBM.js → chunk-HMVAGPYR.js}

@@ -1,9 +1,12 @@
-import { ompRegistryModelRefusal } from './chunk-TCH5UDKT.js';
-import { buildCodexConfigDocument } from './chunk-65UAC3ZR.js';
+import { ompRegistryModelRefusal } from './chunk-UCB7FK25.js';
+import { sessionSurfaceNotice } from './chunk-HPXONAI2.js';
+import { buildCodexConfigDocument } from './chunk-N6ZGB5ES.js';
+import { bindSingleProviderEntry } from './chunk-4C2E5QUP.js';
 import { classifyClaudeSdkError } from './chunk-5DE3DGVR.js';
-import { toMergedRegistry } from './chunk-WW5NAU6N.js';
-import { createHarness, getProviderPreset, resolvePresetBaseUrl, expandPreset, resolveProbeUrl, buildCredentialHeaders, AI_PROVIDER_PRESETS } from './chunk-BSMW3PX2.js';
-import { stripActivityLabel, TOOL_ACTIVITY_LABEL_PARAM, TOOL_ACTIVITY_LABEL_MAX_CHARS } from './chunk-G5SYFFMD.js';
+import { toMergedRegistry } from './chunk-PLLZSKOO.js';
+import { BUILTIN_HARNESS_CATALOG, createHarness } from './chunk-XON6ODIC.js';
+import { getProviderPreset, resolvePresetBaseUrl, expandPreset, resolveProbeUrl, buildCredentialHeaders, AI_PROVIDER_PRESETS } from './chunk-6UP2EDFN.js';
+import { stripActivityLabel, TOOL_ACTIVITY_LABEL_PARAM, TOOL_ACTIVITY_LABEL_MAX_CHARS } from './chunk-ASBZOTEO.js';
 import { registryEntries, isEntryEnabled, parseModelRef } from './chunk-RXGPFAMN.js';
 import { openSqlite } from './chunk-SGI5MRKP.js';
 import { execFile } from 'child_process';
@@ -64,6 +67,34 @@ function checkModelProvider(harnessId, input) {
   }
   return `provider '${head}' is not configured: run skaile providers list`;
 }
+function checkModelSurface(harnessId, input) {
+  const registry = input.registry;
+  if (!registry) return void 0;
+  let selector = input.model?.trim() ?? "";
+  if (selector.startsWith("@")) selector = input.roles?.[selector.slice(1)]?.trim() ?? "";
+  if (harnessId === "claude-sdk")
+    return selector ? sessionSurfaceNotice(registry, selector) : void 0;
+  if (harnessId !== "gemini" && harnessId !== "qwen") return void 0;
+  const merged = Array.isArray(
+    registry.order
+  ) ? registry : {
+    version: 1,
+    providers: registry,
+    order: Object.keys(registry),
+    origin: {},
+    locked: []
+  };
+  try {
+    bindSingleProviderEntry(harnessId, BUILTIN_HARNESS_CATALOG[harnessId]?.name ?? harnessId, {
+      registry: merged,
+      lookupEnv: process.env,
+      ...selector ? { modelRef: selector } : {}
+    });
+  } catch (err) {
+    return err instanceof Error ? err.message : String(err);
+  }
+  return void 0;
+}
 function checkHarnessModel(harnessId, input) {
   const unknownProvider = checkModelProvider(harnessId, input);
   if (unknownProvider) return unknownProvider;
@@ -88,14 +119,19 @@ function checkOmpServeModel(input) {
   if (selector.startsWith("@")) selector = input.roles?.[selector.slice(1)]?.trim() ?? "";
   if (!registry || !selector) return void 0;
   const ref = parseModelRef(selector, registry, input.roles);
-  if (!ref?.providerModelId) return void 0;
+  if (!ref?.providerModelId || ref.fallback) return void 0;
   const sent = `${ref.providerId}/${ref.providerModelId}`;
   const refusal = ompRegistryModelRefusal(registry, sent, nativeProviders("omp") ?? /* @__PURE__ */ new Set());
   if (!refusal) return void 0;
   if (sent === selector) return refusal;
   const detail = refusal.slice(refusal.indexOf("': ") + 3);
-  const why = selector.includes("/") ? ` (no registry entry is named '${selector.slice(0, selector.indexOf("/"))}')` : "";
-  return `omp cannot serve model '${selector}': it is sent to omp as '${sent}'${why}; ${detail}`;
+  return `omp cannot serve model '${selector}': it is sent to omp as '${sent}'; ${detail}`;
+}
+function isUnlistedModel(input) {
+  let selector = input.model?.trim() ?? "";
+  if (selector.startsWith("@")) selector = input.roles?.[selector.slice(1)]?.trim() ?? "";
+  if (!input.registry || !selector) return false;
+  return parseModelRef(selector, input.registry, input.roles)?.fallback === true;
 }
 var OMP_THINKING_SUFFIX = /:(off|minimal|low|medium|high|xhigh)$/i;
 function ompModels(args, timeoutMs) {
@@ -783,6 +819,6 @@ async function validateApiKey(provider, key, options = {}) {
   }
 }
 
-export { BridgeRuntime, EventNormalizer, checkHarnessModel, checkModelProvider, checkOmpListedModel, checkOmpServeModel, createRuntime, detectFileChange, detectFileChanges, labelToolCall, summarizeToolCall, summarizeToolResult, validateApiKey };
-//# sourceMappingURL=chunk-YN6N3RBM.js.map
-//# sourceMappingURL=chunk-YN6N3RBM.js.map
+export { BridgeRuntime, EventNormalizer, checkHarnessModel, checkModelProvider, checkModelSurface, checkOmpListedModel, checkOmpServeModel, createRuntime, detectFileChange, detectFileChanges, isUnlistedModel, labelToolCall, summarizeToolCall, summarizeToolResult, validateApiKey };
+//# sourceMappingURL=chunk-HMVAGPYR.js.map
+//# sourceMappingURL=chunk-HMVAGPYR.js.map