@skaile/workspaces 6.8.0 → 6.9.0

package/dist/chunk-ZBA4P5TD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../connectors/src/connector-types.ts","../connectors/src/materialized-connectors.ts","../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;;;;AAqHO,SAAS,sBAAsB,KAAA,EAA+C;AACnF,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,OAAO,OAAO,MAAA;AACrE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAM;AAC7E,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,EAAE,QAAQ,aAAA,EAAc;AAC9D,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAC3B,EAAA,MAAM,MAAA,GAA4B;AAAA,IAChC,MAAA,EAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,IAAA,EAAK,KAAM,KAAK,MAAA,GAAS;AAAA,GACxE;AACA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,CAAO,MAAK,KAAM,EAAA,SAAW,MAAA,GAAS,MAAA;AACxE,EAAA,OAAO,MAAA;AACT;AAmIO,IAAM,0BAAA,GAAN,cAAyC,KAAA,CAAM;AAAA,EAC3C,WAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,kBAAA;AAAA,EAET,YAAY,IAAA,EAKT;AACD,IAAA,KAAA;AAAA,MACE,cAAc,IAAA,CAAK,WAAW,CAAA,6BAAA,EAAgC,IAAA,CAAK,MAAM,GAAG,CAAA,UAAA,EAC/D,IAAA,CAAK,QAAA,IAAY,QAAQ,CAAA,wBAAA,EACZ,IAAA,CAAK,mBAAmB,IAAA,CAAK,IAAI,KAAK,QAAQ,CAAA;AAAA,KAC1E;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,4BAAA;AACZ,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AAClB,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,QAAA;AACrB,IAAA,IAAA,CAAK,qBAAqB,IAAA,CAAK,kBAAA;AAAA,EACjC;AACF;AAoSO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EACtC,MAAA;AAAA,EACA,eAAA;AAAA,EACT,WAAA,CACE,OAAA,EACA,MAAA,EACA,eAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AACF;ACvjBO,SAAS,2BAAA,CAA4B,UAAkB,IAAA,EAAoC;AAChG,EAAA,MAAM,EAAE,MAAM,IAAA,EAAM,IAAA,KAAS,gBAAA,CAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAC5E,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,IAAI,CAAA;AACnC,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,EAAA;AAAA,IACA,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,MAAA,KAAW,YAAA,GAAe,YAAA,GAAe;AAAA,GACxD;AACA,EAAA,IAAI,KAAK,MAAA,KAAW,YAAA,IAAgB,KAAK,MAAA,KAAW,WAAA,OAAkB,eAAA,GAAkB,IAAA;AACxF,EAAA,IAAI,OAAO,KAAK,KAAA,KAAU,QAAA,IAAY,KAAK,KAAA,EAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AACpE,EAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpD,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,QAAA,IAAY,KAAK,cAAA,EAAgB;AAClE,IAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,cAAA;AAAA,EAC7B;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,OAAA,IAAW,IAAA,CAAK,SAAS,MAAA,EAAQ,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpE,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACpF,IAAA,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AAAA,EACtB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,IAAA,CAAK,KAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA;AAAA,MAC7B,GAAI,CAAA,CAAE,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA,EAAE,GAAI,EAAC;AAAA,MAC7D,GAAI,OAAO,CAAA,CAAE,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,MACzD,GAAI,OAAO,CAAA,CAAE,iBAAA,KAAsB,SAAA,GAC/B,EAAE,iBAAA,EAAmB,CAAA,CAAE,iBAAA,EAAkB,GACzC,EAAC;AAAA,MACL,GAAI,OAAO,CAAA,CAAE,cAAA,KAAmB,QAAA,GAAW,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI;AAAC,KACrF;AAAA,EACF;AACA,EAAA,MAAM,WAAA,GAAc,KAAK,IAAA,EAAK;AAC9B,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,YAAA,GAAe,WAAA;AAChD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,kBAAA,CAAmB,MAA4B,YAAA,EAA4B;AAClF,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,YAAA,EAAc,MAAM,CAAC,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACpE,EAAA,IAAA,CAAK,OAAA,GAAU,EAAE,GAAI,MAAA,EAAoC,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACnF;AAGO,SAAS,4CAAA,CACd,oBACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,kBAAA,EAAoB,IAAI,CAAA;AACzC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACnC,EAAA,IAAI,CAAC,UAAA,CAAW,EAAE,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,2BAAA,CAA4B,EAAA,EAAI,IAAI,CAAA;AACjD,EAAA,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,gBAAgB,CAAC,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,sCAAsC,UAAA,EAA4C;AAChG,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,0BAA0B,CAAA;AACxD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAC/B,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAC3B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,CAAE,aAAY,EAAG;AAClC,MAAA,MAAM,IAAA,GAAO,4CAAA,CAA6C,IAAA,EAAM,IAAI,CAAA;AACpE,MAAA,IAAI,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;;;ACrFA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAIT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,GAAA,IAAO,EAAE,CAAA,EAAG;AAC9D,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,EAAO,EAAE,IAAI,IAAI,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,GAAA,CAAI,IAAA,EAAqC,EAAA,EAAY,IAAA,EAAiC;AACpF,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAAqC,EAAA,EAAqB;AAC9D,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAAqC,EAAA,EAA6C;AACxF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,CAAA;AACrF,MAAA,OAAO,MAAA;AACT,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB;AAAA,EACrB,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,SAAS,iBAAiB,KAAA,EAAwB;AACvD,EAAA,OAAO,SAAA,CAAU,KAAK,CAAA,KAAM,MAAA;AAC9B;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AC3bA,IAAM,YAAY,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,UAAU,CAAA;AAahE,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,OAAO,qCAAA;AAAA,IACL,8BAA8B,UAAU,CAAA;AAAA,IACxC;AAAA,GACF;AACF;AAUO,SAAS,8BAA8B,UAAA,EAA4C;AACxF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAO,UAAA,IAAc,MAAA,CAAO,UAAA,CAAW,MAAA,GAAS,IACnD,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,CAAC,MAAM,+BAAA,CAAgC,CAAA,EAAG,UAAU,CAAC,IAC3E,EAAC;AACP;AAQO,SAAS,qCAAA,CACd,MACA,UAAA,EACwB;AACxB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,KAAA,MAAW,KAAK,IAAA,EAAM,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AACtC,EAAA,KAAA,MAAW,CAAA,IAAK,qCAAA,CAAsC,UAAU,CAAA,EAAG;AACjE,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AAClB,MAAA,SAAA,CAAU,IAAA,CAAK,CAAA,wBAAA,EAA2B,CAAA,CAAE,EAAE,CAAA,mCAAA,CAAqC,CAAA;AACnF,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAA,EAAI,CAAC,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAEA,SAAS,+BAAA,CACP,GACA,UAAA,EACsB;AACtB,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,IACpB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AACA,EAAA,IAAI,CAAA,CAAE,MAAA,IAAU,IAAA,EAAM,IAAA,CAAK,eAAA,GAAkB,IAAA;AAG7C,EAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAE9C,EAAA,MAAM,WAAA,GAAc,qBAAA,CAAsB,CAAA,CAAE,WAAW,CAAA;AACvD,EAAA,IAAI,WAAA,OAAkB,WAAA,GAAc,WAAA;AAGpC,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF,CAAA,MAAA,IAAW,CAAA,CAAE,MAAA,KAAW,OAAA,EAAS;AAG/B,IAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,CAAA,EAAG,UAAU,CAAA;AACnD,IAAA,IAAI,MAAA,EAAQ,IAAA,CAAK,KAAA,GAAQ,EAAE,MAAA,EAAO;AAAA,EACpC;AAEA,EAAA,OAAO,IAAA;AACT;AAsBO,SAAS,6BACd,QAAA,EACwB;AAGxB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,EAA6B,IAAA,KAAqC;AAC7F,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG;AACrB,MAAA,SAAA,CAAU,IAAA,CAAK,CAAA,kCAAA,EAAqC,IAAI,CAAA,sBAAA,CAAA,EAA0B;AAAA,QAChF,IAAI,IAAA,CAAK;AAAA,OACV,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAA,EAAI,IAAI,CAAA;AAAA,EACxB,CAAA;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AAErC,IAAA,IACE,OAAO,CAAA,EAAG,EAAA,KAAO,QAAA,IACjB,OAAO,CAAA,EAAG,MAAA,KAAW,QAAA,IACrB,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EACpB;AACA,MAAA,SAAA,CAAU,KAAK,oEAAA,EAAsE;AAAA,QACnF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,MACpB,GAAI,EAAE,MAAA,IAAU,IAAA,GAAO,EAAE,eAAA,EAAiB,IAAA,KAAkB,EAAC;AAAA,MAC7D,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,KAAA,EAAO;AAAA,QACL,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,OAAO,CAAA,CAAE,KAAA;AAAA,QACT,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE;AAAA;AACpB,KACF;AAEA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,SAAS,IAAI,CAAA;AAAA,EACnC;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,UAAA,IAAc,EAAC,EAAG;AACzC,IAAA,IAAI,OAAO,CAAA,EAAG,EAAA,KAAO,YAAY,OAAO,CAAA,EAAG,WAAW,QAAA,EAAU;AAC9D,MAAA,SAAA,CAAU,KAAK,iEAAA,EAAmE;AAAA,QAChF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,EAAE,MAAA,IAAU,WAAA;AAAA,MACpB,GAAI,EAAE,MAAA,IAAU,IAAA,GAAO,EAAE,eAAA,EAAiB,IAAA,KAAkB,EAAC;AAAA,MAC7D,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE;AAAA,KACb;AACA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,aAAa,IAAI,CAAA;AAAA,EACvC;AAEA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD","file":"chunk-ZBA4P5TD.js","sourcesContent":["/**\n * Connector adapter infrastructure types.\n *\n * Connectors are external backends (databases, KV stores, object stores,\n * in-process state, git repos, etc.). A connector exposes up to two faces: a\n * `ToolFace` (agents access it through injected tools) and/or a\n * `FilesystemFace` (the connector projects content into a mounted directory).\n *\n * @docLink packages/connectors/concepts#connector-types\n */\n\nimport type {\n  ConnectorContent,\n  ConnectorEntry,\n  ListOptions,\n  OperationDescriptor,\n  SearchOptions,\n  SearchResult,\n  SyncOptions,\n  SyncResult,\n  WatchHandle,\n  WatchOptions,\n} from \"./shared-types.js\";\n\nexport type { OperationDescriptor } from \"./shared-types.js\";\n\nimport type { ConnectorPushState, Logger } from \"@skaile/workspaces/types\";\nimport type { SecretProvider } from \"./secrets.js\";\n\n// ── Connector declaration (runtime config, resolved from skaile.yaml) ────────\n\n/**\n * Parsed connector configuration from `skaile.yaml`, passed to `ConnectorAdapter.connect()` and held by `ConnectorManager`.\n * @docLink packages/connectors/concepts#connector-declaration\n */\nexport interface ConnectorDeclaration {\n  /** Unique identifier for this connector instance. */\n  id: string;\n  /** Driver type: \"postgres\", \"redis\", \"memory\", \"xstate\", \"yjs\", etc. */\n  driver: string;\n  /**\n   * Human-readable connection name, projected from the materialized CONNECTOR.md\n   * frontmatter `label`. The platform resource-explorer tab renders this over the\n   * driver name when present; absent for connectors with no configured name.\n   */\n  label?: string;\n  /** Access level enforced by the manager. */\n  access: \"read-only\" | \"read-write\";\n  /**\n   * True when the source set no `access` and the parser filled in the\n   * `read-only` default. The git driver's read-only mode (discard edits, never\n   * push) runs only on an explicit `read-only`, so an undeclared mount keeps\n   * its earlier behaviour.\n   */\n  accessDefaulted?: true;\n  /** Credential reference: \"env:VAR_NAME\" or inline value. */\n  auth?: string;\n  /**\n   * Backend provider link id for `auth: \"backend\"` connectors. The runner's\n   * token-refresh mediator passes this as the `host.refresh_credential` `id` so\n   * the platform resolves the credential against the right provider link.\n   */\n  providerLinkId?: string;\n  /**\n   * Operating mode for connectors that manage a working copy. Orthogonal to\n   * faces. `agent` = the agent drives the source natively (e.g. native git) and\n   * the connector only provisions short-lived credentials. `sync` = the\n   * connector owns the working copy (clone + watch + auto-commit/pull). Absent =\n   * the driver's legacy `options.{session,sync,lifecycle}` blocks decide.\n   */\n  mode?: \"agent\" | \"sync\";\n  /** Driver-specific configuration. */\n  options?: Record<string, unknown>;\n  /**\n   * Owner-authored instruction text projected from the materialized\n   * CONNECTOR.md body (preset custom instructions). Injected eagerly into the\n   * agent system prompt. Absent when the body is empty.\n   */\n  instructions?: string;\n  /** Filesystem-face config — only meaningful for mountable connectors. */\n  mount?: {\n    /** Source URL or path (repo URL, bucket name, host path). */\n    source: string;\n    /** Override mount target directory (default: `.mounts/<id>/`). */\n    target?: string;\n    /** Watch flag: omitted → watch read-write, skip read-only. */\n    watch?: boolean;\n    /** Expert-only: expose the resolved credential to the agent CLI. */\n    exposeAccessToken?: boolean;\n    /** Optional access-token TTL override (seconds). */\n    accessTokenTTL?: number;\n  };\n  /**\n   * Set by the host when it has already decided this connector cannot be\n   * attached (e.g. a cloud mount whose host-side build failed). The manager\n   * never calls the driver for it and reports it as failed with this reason.\n   */\n  unavailable?: UnavailableMarker;\n}\n\n/**\n * Why the host declared a connector without making it available. `reason` is\n * a short machine-readable token chosen by the host; `detail` is its prose.\n * @docLink packages/connectors/concepts#connector-declaration\n */\nexport interface UnavailableMarker {\n  reason: string;\n  detail?: string;\n}\n\n/**\n * Read an `unavailable:` value from an untyped declaration. Absent, `null` and\n * `false` mean \"not marked\". Any other value marks the connector unavailable —\n * a host that wrote the key meant it. A plain string is taken as the reason;\n * anything else that is not a `{ reason, detail? }` object gets a generic one.\n * @docLink packages/connectors/concepts#connector-declaration\n */\nexport function readUnavailableMarker(value: unknown): UnavailableMarker | undefined {\n  if (value === undefined || value === null || value === false) return undefined;\n  if (typeof value === \"string\" && value.trim() !== \"\") return { reason: value };\n  if (typeof value !== \"object\") return { reason: \"unavailable\" };\n  const { reason, detail } = value as { reason?: unknown; detail?: unknown };\n  const marker: UnavailableMarker = {\n    reason: typeof reason === \"string\" && reason.trim() !== \"\" ? reason : \"unavailable\",\n  };\n  if (typeof detail === \"string\" && detail.trim() !== \"\") marker.detail = detail;\n  return marker;\n}\n\n// ── Connector handle (returned by adapter.connect) ───────────────────────────\n\n/**\n * Live state of a connected backend, returned by `Connector.connect()` (or the\n * legacy `ConnectorAdapter.connect()`) and held by `ConnectorManager`.\n * @docLink packages/connectors/concepts#connector-handle\n */\nexport interface ConnectorHandle {\n  /** Connector declaration ID. */\n  readonly id: string;\n  /** Driver name. */\n  readonly driver: string;\n  /** Effective access level. */\n  readonly access: \"read-only\" | \"read-write\";\n  /** Lifecycle status. Set by every `Connector`. */\n  status: \"connecting\" | \"connected\" | \"error\" | \"disconnected\";\n  /** Present iff the connector has a filesystem face and is mounted. */\n  mountPath?: string;\n  /** Adapter-specific state (connection pool, client, etc.). Opaque to callers. */\n  state: unknown;\n}\n\n/** Optional capability a filesystem-face connector attaches to its handle state\n * when reads need an authoritative remote byte size rather than trusting local\n * filesystem metadata.\n */\nexport interface AuthoritativeSizeProvider {\n  authoritativeSize(relPath: string): Promise<number | null>;\n}\n\n// ── Connector change event ────────────────────────────────────────────────────\n\n/**\n * Change event emitted by a connector adapter's `watch()` implementation.\n * @docLink packages/connectors/concepts#connector-change-event\n */\nexport interface ConnectorChangeEvent {\n  /** Relative path, key, table name, node ID, etc. */\n  path: string;\n  /** What happened. */\n  action: \"create\" | \"edit\" | \"delete\" | \"conflict\";\n  /** What caused the change. */\n  source: \"filesystem\" | \"operation\" | \"remote\" | \"sync\";\n}\n\n// ── ConnectorManager info ────────────────────────────────────────────────────\n\n/**\n * Summary of a connected connector returned by `ConnectorManager.listConnectors()`.\n * @docLink packages/connectors/concepts#connector-info\n */\nexport interface ConnectorInfo {\n  id: string;\n  driver: string;\n  /** Human-readable connection name; the resource-explorer tab renders this over `id`/`driver` when present. */\n  label?: string;\n  access: \"read-only\" | \"read-write\";\n  /** Operation names this connector exposes as agent tools (via describeOperations). */\n  operations: string[];\n}\n\n/**\n * Bulk connect/disconnect result returned by `ConnectorManager.connectAll()` and `disconnectAll()`.\n * @docLink packages/connectors/concepts#connector-report\n */\nexport interface ConnectorReport {\n  results: Array<{ id: string; connected: boolean; error?: string }>;\n}\n\n// ── Field spec (connector credential/config declarations) ────────────────────\n\n/**\n * Input types for `ConnectorFieldSpec`. Controls validation rules and the Forge UI affordance.\n * @docLink packages/connectors/concepts#field-type\n */\nexport type FieldType =\n  | \"text\" // plain string\n  | \"password\" // sensitive; always stored via SecretProvider\n  | \"api-key\" // alias for password with specific UI affordance\n  | \"url\" // validated URL string\n  | \"oauth\" // triggers OAuth flow; oauthService required\n  | \"select\" // enum; choices required and non-empty\n  | \"boolean\" // default must be \"true\" or \"false\" if provided\n  | \"number\"; // default must be a parseable numeric string if provided\n\n/**\n * Declares one credential or configuration field that a connector adapter requires.\n * Used by `ConnectorManager.resolveFields()` and the Forge settings UI.\n * @docLink packages/connectors/concepts#connector-field-spec\n */\nexport interface ConnectorFieldSpec {\n  /** Machine name used as the options key in skaile.yaml. */\n  key: string;\n  /** Human-readable label for the forge settings UI. */\n  label: string;\n  /** Tooltip / help text. */\n  description?: string;\n  /** Input type. Controls validation rules and UI affordance in the forge settings panel. */\n  type: FieldType;\n  /** Whether the adapter refuses to connect when this field is missing. */\n  required: boolean;\n  /** String fallback used when not provided and not required. */\n  default?: string;\n  /** Forge UI masks the value; value is never logged. */\n  sensitive: boolean;\n  /** UI grouping: \"Authentication\", \"Connection\", \"Options\". */\n  group?: string;\n  /**\n   * Required when type === \"select\"; must be non-empty.\n   */\n  choices?: string[];\n  /**\n   * Required when type === \"oauth\".\n   * Identifies the OAuth service, e.g. \"google\".\n   * Used to call OAuthSecretProvider.initiateFlow(oauthService, account).\n   * oauth fields must be declared AFTER any field they reference (e.g., \"account\").\n   */\n  oauthService?: string;\n  /** Example value shown as placeholder text in the forge settings UI. */\n  example?: string;\n}\n\n/**\n * Thrown by `ConnectorManager.connectAll()` and `resolveFields()` when a required\n * adapter field cannot be resolved through the `SecretProviderChain`. Carries the\n * connector ID, the missing field spec, the ref that was tried, and the available\n * providers for actionable error messages.\n * @docLink packages/connectors/concepts#connector-field-missing-error\n */\nexport class ConnectorFieldMissingError extends Error {\n  readonly connectorId: string;\n  readonly field: ConnectorFieldSpec;\n  readonly triedRef: string;\n  readonly availableProviders: string[];\n\n  constructor(opts: {\n    connectorId: string;\n    field: ConnectorFieldSpec;\n    triedRef: string;\n    availableProviders: string[];\n  }) {\n    super(\n      `Connector \"${opts.connectorId}\" is missing required field \"${opts.field.key}\" ` +\n        `(tried: ${opts.triedRef || \"(none)\"}). ` +\n        `Available providers: ${opts.availableProviders.join(\", \") || \"(none)\"}`,\n    );\n    this.name = \"ConnectorFieldMissingError\";\n    this.connectorId = opts.connectorId;\n    this.field = opts.field;\n    this.triedRef = opts.triedRef;\n    this.availableProviders = opts.availableProviders;\n  }\n}\n\n// ── Runtime skill descriptor ──────────────────────────────────────────────────\n\n/**\n * Instance-specific skill descriptor returned by `ConnectorAdapter.describeSkill()`.\n * Returned by `ConnectorManager.listSkills()` to surface connector capabilities to the agent.\n * @docLink packages/connectors/concepts#runtime-skill-descriptor\n */\nexport interface RuntimeSkillDescriptor {\n  /** Connector instance id, e.g. \"gmail-work\". */\n  id: string;\n  /** Short label: \"Gmail — work@company.com\". */\n  name: string;\n  /** Instance-specific description: \"Read and write email for work@company.com\". */\n  description: string;\n  /** Category for grouping in the forge UI. */\n  category: string;\n  access: \"read-only\" | \"read-write\";\n  /** Operation names (without loading full defs) for agent planning. */\n  toolNames: string[];\n}\n\n// ── Token mediator (Tier-2 credential mediation) ─────────────────────────────\n\n/**\n * Result of a single `TokenMediator` call. Mirrors\n * `AccessTokenResponseEvent.result` from `@skaile/workspaces/types` so the runner\n * can pass it straight through.\n *\n * @docLink packages/connectors/api-reference#token-mediator\n */\nexport type TokenMediatorResult =\n  | {\n      ok: true;\n      /** Access token to use for the next git operation. */\n      token: string;\n      /**\n       * ISO-8601 expiry, or `null` for indefinite tokens (static PATs). Drives\n       * whether the driver schedules a refresh tick.\n       */\n      expiresAt: string | null;\n      /** Optional scope/permissions list, surfaced in audit logs. */\n      scope?: string[];\n    }\n  | {\n      ok: false;\n      code: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\" | \"timeout\";\n      /** Human-readable detail, never carries secrets. */\n      message: string;\n    };\n\n/**\n * Function signature mountable connectors use to acquire a fresh access token\n * from the runner-owned backend mediator. Implemented by the runner: emits a\n * `request_access_token` command over the transport and resolves with the\n * matching `access_token_response` payload.\n *\n * Connectors MUST treat this as the only token source when the parsed\n * `MountAuthRef.kind === 'backend'`. Local minting (PAT, OAuth, GitHub App)\n * has been removed from the runner — provider dispatch lives on the platform.\n *\n * @docLink packages/connectors/api-reference#token-mediator\n */\nexport type TokenMediator = (input: {\n  connectorId: string;\n  reason: \"initial\" | \"refresh\" | \"retry-401\";\n  /**\n   * Connector driver, used by the runner mediator to pick the platform refresh\n   * `kind`; absent on `initial` and for legacy callers.\n   */\n  driver?: string;\n  /**\n   * Backend provider link id — the `id` the platform `host.refresh_credential`\n   * capability resolves the credential against. Absent on `initial` and for\n   * legacy callers.\n   */\n  providerLinkId?: string;\n  /**\n   * The connector's declaration id, bound from the declaration like `driver`\n   * and `providerLinkId`. The runner sends it next to the link id on a git\n   * refresh, so a read-only reference sharing its link with a read-write\n   * mount is refreshed read-only. Absent on `initial` and for legacy callers.\n   */\n  declarationId?: string;\n}) => Promise<TokenMediatorResult>;\n\n// ── S3 presigner (backend-signed S3 reads) ───────────────────────────────────\n\n/**\n * Request to the platform's runtime capability `host.s3_presign`. `mountId` is\n * the connector id of an `auth: backend` S3 mount in this session; bucket,\n * prefix and endpoint come from the platform's copy of that declaration.\n */\nexport type S3PresignRequest =\n  | { mountId: string; op: \"list\"; continuationToken?: string }\n  | { mountId: string; op: \"get\"; keys: string[] };\n\n/**\n * Answer from `host.s3_presign`. `list` carries one ListObjectsV2 URL, `get`\n * one GetObject URL per key; folder markers (keys ending in `/`) are listed in\n * `skipped` instead. Every URL expires at `expiresAt` (ten minutes today).\n */\nexport type S3PresignResult =\n  | { ok: true; op: \"list\"; url: string; expiresAt: string }\n  | {\n      ok: true;\n      op: \"get\";\n      urls: { key: string; url: string }[];\n      skipped: { key: string; reason: string }[];\n      expiresAt: string;\n    }\n  | { ok: false; code: string; message: string };\n\n/**\n * Presign client for `auth: backend` S3 mounts, implemented by the runner over\n * the same remote-capability channel as {@link TokenMediator}. The S3 keys stay\n * in the backend; the container only ever sees short-lived read URLs.\n * Never throws: transport failures resolve as `{ ok: false, code: \"backend-error\" }`.\n */\nexport type S3Presigner = (request: S3PresignRequest) => Promise<S3PresignResult>;\n\n// ── Unified connector types ───────────────────────────────────────────────────\n\n/**\n * Context passed to `Connector.connect()` by `ConnectorManager`.\n * @docLink packages/connectors/concepts#connect-context\n */\nexport interface ConnectContext {\n  /**\n   * Absolute project directory the owning `ConnectorManager` runs for (always set by the manager). A connector that needs\n   * an optional npm peer looks in this project's `node_modules` first.\n   */\n  projectDir?: string;\n  /** Secret provider for resolving credential references. */\n  secrets?: SecretProvider;\n  /**\n   * Backend token mediator — present for `auth: backend` connectors of either\n   * face (filesystem or tool), so mount refresh and tool-face OAuth flows share\n   * one path.\n   */\n  tokenMediator?: TokenMediator;\n  /**\n   * Backend S3 presigner — the read path for `auth: backend` S3 mounts. Absent\n   * outside a platform-connected runner.\n   */\n  s3Presigner?: S3Presigner;\n  /**\n   * Absolute directory the manager allocated for the filesystem face.\n   * Present iff `connector.filesystem != null`. The connector projects its\n   * content here during `connect()` and sets `handle.mountPath`.\n   */\n  mountTarget?: string;\n  /** Resolved credential/config fields (from `describeFields()`). */\n  resolvedFields?: Record<string, string>;\n  /**\n   * Aborted when the owning `ConnectorManager` is disposed. Long-running\n   * `connect()` implementations — notably background (deferred) filesystem\n   * mounts — should observe this and bail out promptly so session cleanup\n   * does not wait on a wedged remote.\n   */\n  abortSignal?: AbortSignal;\n}\n\n/**\n * Filesystem face — present ⇒ the connector is \"mountable\".\n * @docLink packages/connectors/concepts#filesystem-face\n */\nexport interface FilesystemFace {\n  /** Pull latest remote state into the mounted directory. */\n  sync(handle: ConnectorHandle, options?: SyncOptions): Promise<SyncResult>;\n}\n\n/**\n * Tool face — present ⇒ the connector exposes agent tools.\n * @docLink packages/connectors/concepts#tool-face\n */\nexport interface ToolFace {\n  read?(handle: ConnectorHandle, path: string): Promise<ConnectorContent | null>;\n  write?(handle: ConnectorHandle, path: string, content: ConnectorContent): Promise<void>;\n  delete?(handle: ConnectorHandle, path: string): Promise<boolean>;\n  list?(handle: ConnectorHandle, path?: string, options?: ListOptions): Promise<ConnectorEntry[]>;\n  search?(handle: ConnectorHandle, query: string, options?: SearchOptions): Promise<SearchResult[]>;\n  describeOperations(handle: ConnectorHandle): OperationDescriptor[];\n  executeOp(\n    handle: ConnectorHandle,\n    operation: string,\n    args: Record<string, unknown>,\n  ): Promise<string>;\n  describeSkill?(\n    handle: ConnectorHandle,\n    declaration: ConnectorDeclaration,\n  ): RuntimeSkillDescriptor;\n}\n\n/**\n * The unified connector contract. A connector should expose at least one face\n * (`filesystem` and/or `tools`); `ConnectorManager` rejects a faceless\n * connector at connect time.\n * @docLink packages/connectors/concepts#connector\n */\nexport interface Connector {\n  readonly name: string;\n  /**\n   * True when `connect()` for this declaration can only get its credential from\n   * `ctx.tokenMediator`. A manager with neither a mediator nor a pre-mint then\n   * fails the connect without calling the driver, whose failure path may write\n   * shared state (the git driver's credential helper) the live session uses.\n   */\n  requiresTokenMediator?(declaration: ConnectorDeclaration): boolean;\n  connect(declaration: ConnectorDeclaration, ctx: ConnectContext): Promise<ConnectorHandle>;\n  disconnect(handle: ConnectorHandle): Promise<void>;\n  readonly filesystem?: FilesystemFace;\n  readonly tools?: ToolFace;\n  describeFields?(): ConnectorFieldSpec[];\n  setLogger?(logger: Logger): void;\n  watch?(\n    handle: ConnectorHandle,\n    callback: (e: ConnectorChangeEvent) => void,\n    options?: WatchOptions,\n  ): WatchHandle;\n  onHibernate?(handle: ConnectorHandle): Promise<ConnectorHookOutcome>;\n  onSessionClose?(handle: ConnectorHandle): Promise<ConnectorHookOutcome>;\n}\n\n/**\n * Structured return of a lifecycle hook (`onHibernate` / `onSessionClose`).\n * `detail` is the same human-readable line a hook can return as a plain string;\n * `pushState` is what the connector can prove about its working copy, copied\n * onto the hook's `LifecycleResult`.\n */\nexport interface ConnectorHookReport {\n  detail?: string;\n  pushState?: ConnectorPushState;\n}\n\n/** What a lifecycle hook may return: a detail line, a structured report, or nothing. */\nexport type ConnectorHookOutcome = string | ConnectorHookReport | undefined;\n\n/**\n * Factory used by the connector registry.\n * @docLink packages/connectors/api-reference#connector-factory\n */\nexport type ConnectorFactory = () => Connector;\n\n/**\n * Per-connector bulk-connect result returned by `ConnectorManager.connectAll()`.\n * @docLink packages/connectors/concepts#connector-startup-report\n */\nexport interface ConnectorStartupReport {\n  results: Array<{\n    id: string;\n    connected: boolean;\n    mountPath?: string;\n    error?: string;\n    access?: \"read-only\" | \"read-write\";\n  }>;\n}\n\n/**\n * A connector that failed to connect, as returned by\n * `ConnectorManager.listFailedConnectors()`.\n *\n * A failed connector never enters the manager's active map, so it is absent\n * from `listConnectors()` and `get()` by design — those describe what the agent\n * can actually use. This record is the second list that keeps the failure\n * itself visible.\n *\n * @docLink packages/connectors/concepts#connector-manager\n */\nexport interface FailedConnectorInfo {\n  id: string;\n  driver: string;\n  access: \"read-only\" | \"read-write\";\n  label?: string;\n  /** `mount.source` when declared. */\n  source?: string;\n  /** Resolved absolute mount target, when the declaration has a mount. */\n  mountPath?: string;\n  /** True when the failure is fail-fast material: read-write AND mount-bearing. */\n  required: boolean;\n  /** The connect error message. */\n  error: string;\n  /** Present when the host declared the connector unavailable; no connect was attempted. */\n  unavailable?: UnavailableMarker;\n}\n\n/**\n * Thrown by `connectAll` when a read-write mountable connector fails and\n * `failOnReadWriteError` was set.\n * @docLink packages/connectors/concepts#connector-startup-error\n */\nexport class ConnectorStartupError extends Error {\n  readonly report: ConnectorStartupReport;\n  readonly failedReadWrite: ReadonlyArray<{ id: string; error: string }>;\n  constructor(\n    message: string,\n    report: ConnectorStartupReport,\n    failedReadWrite: ReadonlyArray<{ id: string; error: string }>,\n  ) {\n    super(message);\n    this.name = \"ConnectorStartupError\";\n    this.report = report;\n    this.failedReadWrite = failedReadWrite;\n  }\n}\n","/**\n * Derive runtime connector declarations from the platform-materialized\n * `.skaile/assets/connector/<name>/CONNECTOR.md` projection.\n *\n * Connector mirror of MCP's `loadMaterializedMcpDeclarations` /\n * `deriveSingleMaterializedMcpDeclaration`. The generated `CONNECTOR.md` carries\n * a RUNTIME declaration (driver/access/auth/mode/options/mount) — distinct from\n * the catalog `CONNECTOR.md` parsed by `core/manifest.ts:fromConnectorMd`\n * (entry/fields). Driver is referenced by name (first-party; resolved via the\n * connector registry — no code-loading).\n */\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseFrontmatter } from \"../../core/src/manifest.js\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/** Parse a generated CONNECTOR.md (runtime projection) into a ConnectorDeclaration. */\nexport function fromMaterializedConnectorMd(filePath: string, name: string): ConnectorDeclaration {\n  const { data: meta, body } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n  const id = String(meta.name ?? name);\n  const decl: ConnectorDeclaration = {\n    id,\n    driver: String(meta.driver ?? \"\"),\n    access: meta.access === \"read-write\" ? \"read-write\" : \"read-only\",\n  };\n  if (meta.access !== \"read-write\" && meta.access !== \"read-only\") decl.accessDefaulted = true;\n  if (typeof meta.label === \"string\" && meta.label) decl.label = meta.label;\n  if (typeof meta.auth === \"string\") decl.auth = meta.auth;\n  if (typeof meta.providerLinkId === \"string\" && meta.providerLinkId) {\n    decl.providerLinkId = meta.providerLinkId;\n  }\n  if (meta.mode === \"agent\" || meta.mode === \"sync\") decl.mode = meta.mode;\n  if (meta.options && typeof meta.options === \"object\" && !Array.isArray(meta.options)) {\n    decl.options = meta.options as Record<string, unknown>;\n  }\n  if (meta.mount && typeof meta.mount === \"object\" && !Array.isArray(meta.mount)) {\n    const m = meta.mount as Record<string, unknown>;\n    decl.mount = {\n      source: String(m.source ?? \"\"),\n      ...(m.target !== undefined ? { target: String(m.target) } : {}),\n      ...(typeof m.watch === \"boolean\" ? { watch: m.watch } : {}),\n      ...(typeof m.exposeAccessToken === \"boolean\"\n        ? { exposeAccessToken: m.exposeAccessToken }\n        : {}),\n      ...(typeof m.accessTokenTTL === \"number\" ? { accessTokenTTL: m.accessTokenTTL } : {}),\n    };\n  }\n  const trimmedBody = body.trim();\n  if (trimmedBody.length > 0) decl.instructions = trimmedBody;\n  return decl;\n}\n\n/** Provide `.instance.json` config entries as defaults under the declaration's options (the CONNECTOR.md declaration wins on key collision). */\nfunction foldInstanceConfig(decl: ConnectorDeclaration, instancePath: string): void {\n  if (!existsSync(instancePath)) return;\n  let parsed: { config?: Record<string, unknown> };\n  try {\n    parsed = JSON.parse(readFileSync(instancePath, \"utf8\"));\n  } catch {\n    return;\n  }\n  const config = parsed.config;\n  if (!config || typeof config !== \"object\" || Array.isArray(config)) return;\n  decl.options = { ...(config as Record<string, unknown>), ...(decl.options ?? {}) };\n}\n\n/** Derive a single materialized connector declaration; null when no CONNECTOR.md. */\nexport function deriveSingleMaterializedConnectorDeclaration(\n  connectorAssetsDir: string,\n  name: string,\n): ConnectorDeclaration | null {\n  const sub = join(connectorAssetsDir, name);\n  const md = join(sub, \"CONNECTOR.md\");\n  if (!existsSync(md)) return null;\n  const decl = fromMaterializedConnectorMd(md, name);\n  foldInstanceConfig(decl, join(sub, \".instance.json\"));\n  return decl;\n}\n\n/** Scan `<projectDir>/.skaile/assets/connector/*` for materialized connectors. */\nexport function loadMaterializedConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const root = join(projectDir, \".skaile/assets/connector\");\n  if (!existsSync(root)) return [];\n  const out: ConnectorDeclaration[] = [];\n  for (const name of readdirSync(root)) {\n    try {\n      const sub = join(root, name);\n      if (!statSync(sub).isDirectory()) continue;\n      const decl = deriveSingleMaterializedConnectorDeclaration(root, name);\n      if (decl) out.push(decl);\n    } catch {\n      // Per-directory failure is isolated — one bad asset never aborts the scan.\n    }\n  }\n  return out;\n}\n","/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\n// Narrow module, not the `core/logging` barrel: it re-exports the SQLite sink,\n// whose `import.meta` breaks consumers that transpile this entry to CommonJS.\nimport { createLogger } from \"../../core/src/logging/create-logger.js\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>`, `connector:<id>`, and `mcp:<id>`.\n * Returns `undefined` for any other ref so the chain falls through to the\n * next provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capabilities\n * stay strictly in-process — no round trip to the platform to mint while\n * the resource is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors, mcp }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n    mcp?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.mcp ?? {})) {\n      this.mints.set(`mcp:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capability\n   * handlers when the platform delivers new credentials mid-session.\n   */\n  set(kind: \"mount\" | \"connector\" | \"mcp\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\" | \"mcp\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` / `mcp:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\" | \"mcp\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\") || ref.startsWith(\"mcp:\")))\n      return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\n  \"env:\",\n  \"vault:\",\n  \"forge:\",\n  \"op:\",\n  \"kp:\",\n  \"oauth:\",\n  \"mount:\",\n  \"connector:\",\n  \"mcp:\",\n] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * True when `value` starts with a known secret-ref prefix (`env:`, `oauth:`,\n * `mcp:`, ...). Lets callers distinguish an intended-but-unresolved ref from a\n * plain literal — e.g. the runner refuses to forward an unresolved ref into\n * MCP transport headers/env, where the literal would otherwise leak onto the\n * wire and produce a misleading upstream error.\n */\nexport function isKnownSecretRef(value: string): boolean {\n  return getPrefix(value) !== undefined;\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ResolvedSkaileConfig } from \"@skaile/workspaces/types\";\n// Narrow modules, not the `core` barrels: their chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { createLogger } from \"../../core/src/logging/create-logger.js\";\nimport {\n  localConnectorMountDir,\n  resolveSkWorkspaceConfig,\n  type ConnectorDeclaration as WorkspaceConnector,\n} from \"../../core/src/workspace-config.js\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\nimport { readUnavailableMarker } from \"./connector-types.js\";\nimport { loadMaterializedConnectorDeclarations } from \"./materialized-connectors.js\";\n\nconst configLog = createLogger({ kind: \"connector\", subkind: \"config\" });\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Merged array of connector declarations from `skaile.yaml` and the materialized\n *   `.skaile/assets/connector/*` disk projection (Phase 2.5); empty array if neither source\n *   contributes any entries. `skaile.yaml` wins on id collision.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  return withMaterializedConnectorDeclarations(\n    loadYamlConnectorDeclarations(projectDir),\n    projectDir,\n  );\n}\n\n/**\n * The `skaile.yaml` half of {@link loadConnectorDeclarations}: only the `connectors:` entries,\n * without the materialized projection. The runner needs it on its own because in broker mode the\n * session root keeps materialized connectors across wakes while its yaml declares nothing, and the\n * `session_init` wire set must then stand in for the yaml half, not for both.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n */\nexport function loadYamlConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  return config.connectors && config.connectors.length > 0\n    ? config.connectors.map((c) => workspaceConnectorToDeclaration(c, projectDir))\n    : [];\n}\n\n/**\n * Add the materialized `.skaile/assets/connector/*` projection to `base`. Library-assigned\n * connectors reach the runner only through that projection. `base` is explicit config (the\n * skaile.yaml entries, or the `session_init` wire set standing in for them) and wins on id\n * collision; the shadowed materialized connector is logged, not silently dropped.\n */\nexport function withMaterializedConnectorDeclarations(\n  base: ConnectorDeclaration[],\n  projectDir: string,\n): ConnectorDeclaration[] {\n  const byId = new Map<string, ConnectorDeclaration>();\n  for (const d of base) byId.set(d.id, d);\n  for (const d of loadMaterializedConnectorDeclarations(projectDir)) {\n    if (byId.has(d.id)) {\n      configLog.warn(`materialized connector '${d.id}' shadowed by an explicit connector`);\n      continue;\n    }\n    byId.set(d.id, d);\n  }\n  return [...byId.values()];\n}\n\nfunction workspaceConnectorToDeclaration(\n  c: WorkspaceConnector,\n  projectDir: string,\n): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: c.access ?? \"read-only\",\n    auth: c.auth,\n    options: c.options,\n  };\n  if (c.access == null) decl.accessDefaulted = true;\n\n  // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n  if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n\n  const unavailable = readUnavailableMarker(c.unavailable);\n  if (unavailable) decl.unavailable = unavailable;\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  } else if (c.driver === \"local\") {\n    // `mountPath:` names the host directory. An absolute source with no target makes the manager\n    // bind the connector straight to it, so reads and writes land in that directory.\n    const source = localConnectorMountDir(c, projectDir);\n    if (source) decl.mount = { source };\n  }\n\n  return decl;\n}\n\n/**\n * Map a Protocol v3 `session_init` `resolvedConfig` to `ConnectorDeclaration[]`.\n *\n * Wire mounts are flat (`source` / `target` / `watch` top-level per\n * `ResolvedSkaileConfig`); declarations carry them in the `mount:` sub-block.\n * Wire `connectors` (tool-face) map without a mount block. Malformed entries\n * (missing `id`, `driver`, or — for mounts — `source`) are logged and dropped,\n * never thrown: one bad wire entry must not kill session boot. Duplicate ids\n * (within or across the two arrays) keep the FIRST occurrence — mounts precede\n * connectors — and the shadowed entry is logged and dropped the same way.\n *\n * Pure function, no I/O. Used by the runner in place of the `skaile.yaml`\n * entries when `skaile.yaml` declares no connectors (broker mode, where the\n * delivered yaml carries no declarations). Materialized connectors are added\n * on top either way.\n *\n * @param resolved - `mounts` / `connectors` arrays from the platform-resolved config.\n * @returns Declarations in wire order — mounts first, then connectors.\n * @docLink packages/connectors/api-reference#resolved-config-to-declarations\n */\nexport function resolvedConfigToDeclarations(\n  resolved: Pick<ResolvedSkaileConfig, \"mounts\" | \"connectors\">,\n): ConnectorDeclaration[] {\n  // Keyed by id: the wire carries no well-formedness guarantee, and a duplicate\n  // id downstream would collide on mount paths / tool namespaces. First wins.\n  const byId = new Map<string, ConnectorDeclaration>();\n  const pushUnlessDuplicate = (kind: \"mount\" | \"connector\", decl: ConnectorDeclaration): void => {\n    if (byId.has(decl.id)) {\n      configLog.warn(`dropping duplicate resolvedConfig ${kind} (id already declared)`, {\n        id: decl.id,\n      });\n      return;\n    }\n    byId.set(decl.id, decl);\n  };\n\n  for (const m of resolved.mounts ?? []) {\n    // A mount without a source cannot connect — drop it with the malformed ones.\n    if (\n      typeof m?.id !== \"string\" ||\n      typeof m?.driver !== \"string\" ||\n      typeof m.source !== \"string\"\n    ) {\n      configLog.warn(\"dropping malformed resolvedConfig mount (missing id/driver/source)\", {\n        id: (m as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: m.id,\n      driver: m.driver,\n      access: m.access ?? \"read-only\",\n      ...(m.access == null ? { accessDefaulted: true as const } : {}),\n      auth: m.auth,\n      options: m.options,\n      mount: {\n        source: m.source,\n        target: m.target,\n        watch: m.watch,\n        exposeAccessToken: m.exposeAccessToken,\n        accessTokenTTL: m.accessTokenTTL,\n      },\n    };\n    // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n    if (m.providerLinkId) decl.providerLinkId = m.providerLinkId;\n    pushUnlessDuplicate(\"mount\", decl);\n  }\n\n  for (const c of resolved.connectors ?? []) {\n    if (typeof c?.id !== \"string\" || typeof c?.driver !== \"string\") {\n      configLog.warn(\"dropping malformed resolvedConfig connector (missing id/driver)\", {\n        id: (c as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: c.id,\n      driver: c.driver,\n      access: c.access ?? \"read-only\",\n      ...(c.access == null ? { accessDefaulted: true as const } : {}),\n      auth: c.auth,\n      options: c.options,\n    };\n    if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n    pushUnlessDuplicate(\"connector\", decl);\n  }\n\n  return [...byId.values()];\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n"]}

package/dist/library-publish-B5HL4OBE.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../cli/src/commands/library-publish.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,IAAM,iBAAA,GAAoB,sBAAA;AAG1B,SAAS,YAAY,GAAA,EAAkC;AACrD,EAAA,IAAI,GAAA,CAAI,OAAA,KAAY,KAAA,EAAO,OAAO,MAAA;AAClC,EAAA,OAAQ,IAAI,aAAA,CAAmC,GAAA;AACjD;AAGA,SAAS,SAAS,GAAA,EAAsB;AACtC,EAAA,IAAI,GAAA,CAAI,OAAA,KAAY,KAAA,EAAO,OAAO,MAAA;AAClC,EAAA,OAAQ,GAAA,CAAI,cAAmC,MAAA,IAAU,MAAA;AAC3D;AAMA,SAAS,aAAa,OAAA,EAAoC;AACxD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,iBAAiB,GAAG,OAAO,CAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,MAAA;AAAA,MACE,CAAA,GAAA,EAAM,CAAA,CAAE,GAAA,CAAI,iBAAiB,CAAC,CAAA,+GAAA;AAAA,KAEhC;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,MAAM,EAAE,QAAA,EAAU,WAAA,EAAY,GAAI,qBAAqB,IAAI,CAAA;AAC3D,EAAA,MAAM,SAAS,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,OAAO,CAAA;AAC/D,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,MAAA,CAAO,CAAA,EAAG,EAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACxD,IAAA,MAAA,CAAO,mFAA8E,CAAA;AACrF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,MAAA,CAAO,KAAA,EAAkB,GAAA,EAAa,IAAA,EAAgB;AAC7D,EAAA,OAAO,KAAA,CAAM,KAAA,EAAO,CAAC,IAAA,EAAM,GAAA,EAAK,GAAG,IAAI,CAAA,EAAG,EAAE,QAAA,EAAU,OAAA,EAAS,CAAA;AACjE;AAYA,SAAS,gBAAA,CAAiB,OAAA,EAAiB,OAAA,EAAiB,GAAA,EAAa,KAAA,EAAwB;AAC/F,EAAA,MAAM,aACJ,CAAC,GAAA,CAAI,WAAW,GAAG,CAAA,IACnB,MAAM,KAAA,EAAO,CAAC,kBAAA,EAAoB,kBAAA,EAAoB,GAAG,CAAA,EAAG,EAAE,UAAU,OAAA,EAAS,EAAE,MAAA,KAAW,CAAA;AAChG,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAA;AAAA,MACE,UAAU,GAAG,CAAA,4HAAA;AAAA,KAEf;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACA,EAAA,IAAI,MAAA,CAAO,OAAO,OAAA,EAAS,CAAC,aAAa,WAAW,CAAC,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG;AACrE,EAAA,MAAM,SAAS,CAAC,GAAA,EAAK,CAAA,oBAAA,EAAuB,GAAG,EAAE,CAAA,CAAE,IAAA;AAAA,IACjD,CAAC,SAAA,KACC,MAAA,CAAO,KAAA,EAAO,SAAS,CAAC,WAAA,EAAa,UAAA,EAAY,SAAA,EAAW,CAAA,EAAG,SAAS,CAAA,SAAA,CAAW,CAAC,EACjF,MAAA,KAAW;AAAA,GAClB;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA;AAAA,MACE,CAAA,OAAA,EAAU,GAAG,CAAA,6CAAA,EAAgD,OAAO,4CACzB,OAAO,CAAA,oCAAA;AAAA,KACpD;AACA,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAQA,SAAS,cAAc,IAAA,EAKd;AACP,EAAA,MAAM,EAAE,OAAA,EAAS,SAAA,EAAW,MAAA,EAAQ,OAAM,GAAI,IAAA;AAE9C,EAAA,MAAM,SAAS,MAAA,CAAO,KAAA,EAAO,SAAS,CAAC,WAAA,EAAa,WAAW,CAAC,CAAA;AAChE,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,OAAO,MAAA,CAAO,KAAA,EAAO,OAAA,EAAS,CAAC,MAAM,CAAC,CAAA;AAC5C,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,iBAAA,EAAA,CAAqB,IAAA,CAAK,MAAA,IAAU,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,OACpF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,MAAA,GAAS,OAAO,KAAA,EAAO,OAAA,EAAS,CAAC,QAAA,EAAU,SAAA,EAAW,QAAQ,CAAC,CAAA;AACrE,EAAA,MAAM,UAAA,GACJ,MAAA,CAAO,MAAA,KAAW,CAAA,GACd,CAAC,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,SAAS,CAAA,GACzC,CAAC,QAAA,EAAU,KAAA,EAAO,UAAU,SAAS,CAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,KAAA,EAAO,OAAA,EAAS,UAAU,CAAA;AACnD,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mBAAA,EAAA,CAAuB,SAAA,CAAU,MAAA,IAAU,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,CAAA,KAAA,EAAQ,SAAA,CAAU,MAAM,CAAA,CAAE,CAAA;AAAA,KAChG;AAAA,EACF;AAEA,EAAA,MAAM,MAAM,MAAA,CAAO,KAAA,EAAO,SAAS,CAAC,KAAA,EAAO,IAAI,CAAC,CAAA;AAChD,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,gBAAA,EAAA,CAAoB,GAAA,CAAI,MAAA,IAAU,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,KACjF;AAAA,EACF;AAIA,EAAA,MAAM,MAAA,GAAS,KAAA;AAAA,IACb,KAAA;AAAA,IACA;AAAA,MACE,IAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA;AAAA,MACA,iCAAA;AAAA,MACA,IAAA;AAAA,MACA,kBAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,EAAE,UAAU,OAAA;AAAQ,GACtB;AACA,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,GAAA,GAAM,GAAG,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA,EAAG,MAAA,CAAO,UAAU,EAAE,CAAA,CAAA;AACxD,IAAA,IAAI,CAAC,oBAAA,CAAqB,IAAA,CAAK,GAAG,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,GAAA,CAAI,IAAA,MAAU,CAAA,KAAA,EAAQ,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA,CAAE,CAAA;AAAA,IAC/E;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,EAAO,OAAA,EAAS,CAAC,QAAQ,QAAA,EAAU,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAE,CAAC,CAAA;AACxE,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,iBAAA,EAAA,CAAqB,IAAA,CAAK,MAAA,IAAU,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,KACpF;AAAA,EACF;AACF;AAQO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,OAAO,yGAAA,CAA0G,IAAA;AAAA,IAC/G,IAAI,IAAA;AAAK,GACX;AACF;AAGO,SAAS,sBAAA,CAAuB,MAAc,GAAA,EAAqB;AACxE,EAAA,OACE,CAAA,uBAAA,EAA0B,IAAI,CAAA,uBAAA,EAA0B,GAAG,gGAEnC,IAAI,CAAA,uDAAA,CAAA;AAEhC;AAGA,IAAM,oBAAA,GAAuB,EAAA;AAiB7B,SAAS,UAAA,CACP,OAAA,EACA,QAAA,EACA,UAAA,EACA,WAAA,EACa;AACb,EAAA,MAAM,MAAmB,EAAC;AAC1B,EAAA,MAAM,WAAW,eAAA,EAAgB;AACjC,EAAA,KAAA,MAAW,KAAA,IAAS,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AACzC,IAAA,IAAI,UAAA,IAAc,KAAA,CAAM,IAAA,KAAS,UAAA,EAAY;AAC7C,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,QAAA,CAAS,MAAA,EAAQ;AACrC,IAAA,MAAM,IAAA,GAAO,qBAAA,CAAsB,OAAA,EAAS,KAAK,CAAA;AACjD,IAAA,IAAI,CAAC,IAAA,EAAM;AACX,IAAA,MAAM,IAAA,GAAO,YAAA,CAAa,IAAA,EAAM,OAAO,CAAA;AACvC,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,IAAA,EAAM,IAAI,CAAA;AAC3C,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,OAAO,EAAA,EAAI;AACb,MAAA,OAAA,GAAU,UAAA;AAAA,QACR,KAAA,CAAM,IAAA;AAAA,QACN,MAAA,CAAO,IAAA;AAAA,QACP,aAAA,CAAc,MAAM,IAAI,CAAA;AAAA,QACxB,QAAA,CAAS,OAAA,CAAQ,IAAI,CAAC,CAAA;AAAA,QACtB,QAAA;AAAA,QACA,IAAA;AAAA,QACA,SAAS,IAAI,CAAA;AAAA,QACb,EAAE,GAAA,EAAK,OAAA,CAAQ,IAAI,CAAA,EAAG,WAAA,EAAa,SAAS,WAAA;AAAY,OAC1D;AAAA,IACF;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,EAAK,QAAA,CAAS,SAAS,IAAI,CAAA,EAAG,MAAA,EAAQ,OAAA,EAAS,CAAA;AAAA,EACnE;AACA,EAAA,OAAO,GAAA;AACT;AAOA,SAAS,wBAAA,CACP,UACA,MAAA,EACmB;AACnB,EAAA,OAAO;AAAA,IACL,GAAG,QAAA;AAAA,IACH,MAAA,EAAQ,QAAA,CAAS,MAAA,EAAQ,GAAA,CAAI,CAAC,KAAA,KAAU;AACtC,MAAA,MAAM,UAAU,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,KAAK,CAAA;AACpD,MAAA,MAAM,WAAA,GAAc,SAAS,MAAA,CAAO,EAAA,GAAK,gBAAgB,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA;AAChF,MAAA,OAAO,gBAAgB,MAAA,GAAY,KAAA,GAAQ,EAAE,GAAG,KAAA,EAAO,SAAS,WAAA,EAAY;AAAA,IAC9E,CAAC;AAAA,GACH;AACF;AAiBA,SAAS,YAAA,CAAa,QAAqB,QAAA,EAA6C;AACtF,EAAA,MAAM,MAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAI,CAAC,KAAA,CAAM,MAAA,CAAO,EAAA,EAAI;AACtB,IAAA,MAAM,WAAA,GAAc,eAAA,CAAgB,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA;AACrD,IAAA,MAAM,YAAA,GAAe,KAAA,CAAM,KAAA,CAAM,OAAA,IAAW,QAAA,CAAS,OAAA;AACrD,IAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,YAAA,EAAc;AAC7D,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,EAAK,aAAA,CAAc,KAAA,CAAM,KAAA,EAAO,QAAQ,CAAA,EAAG,YAAA,EAAc,WAAA,EAAa,CAAA;AAAA,IAC1F;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAEA,IAAM,aAAA,GAAgB,CAAC,CAAA,KACrB,CAAA,EAAG,EAAE,GAAG,CAAA,mBAAA,EAAsB,CAAA,CAAE,YAAA,IAAgB,QAAQ,CAAA,QAAA,EAAM,EAAE,WAAW,CAAA,EAAA,EAAK,EAAE,KAAA,CAAM,GAAA,CAAI,MAAM,GAAG,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAWlH,SAAS,aAAA,CAAc,QAAqB,QAAA,EAAuC;AACjF,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,EAAE,KAAA,EAAO,GAAA,EAAK,MAAA,EAAQ,OAAA,MAAa,MAAA,EAAQ;AACpD,IAAA,MAAM,GAAA,GAAM,aAAA,CAAc,KAAA,EAAO,QAAQ,CAAA;AACzC,IAAA,IAAI,CAAC,MAAA,CAAO,EAAA,IAAM,CAAC,OAAA,EAAS;AAC1B,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,EAAA,GAAK,qCAAA,GAAwC,MAAA,CAAO,MAAA;AAC1E,MAAA,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,EAAA,EAAK,GAAG,CAAA,GAAA,EAAM,KAAA,CAAM,IAAI,CAAA,SAAA,EAAO,sBAAA,CAAuB,MAAM,CAAC,CAAA,CAAE,CAAA;AACnF,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,CAAQ,MAAA,EAAQ,QAAA,CAAS,KAAK,CAAA,EAAG,GAAG,CAAA,EAAA,EAAK,GAAG,MAAM,CAAA,CAAE,GAAG,CAAA,SAAA,EAAO,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAGtF,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,YAAY,CAAA,EAAG;AAChE,MAAA,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,EAAA,EAAK,GAAG,CAAA,GAAA,EAAM,CAAA,CAAE,GAAG,CAAA,SAAA,EAAO,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,KAAS,MAAA,GAAS,OAAO,IAAA,CAAK,EAAA,GAAK,OAAO,IAAA,CAAK,IAAA;AACtE,IAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,aAAa,EAAA,IAAM,QAAA,KAAa,MAAM,IAAA,EAAM;AAC9E,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,CAAA,EAAG,GAAG,CAAA,EAAA,EAAK,GAAG,sCAAiC,QAAQ,CAAA,yEAAA;AAAA,OACzD;AAAA,IACF;AAEA,IAAA,MAAM,eAAe,KAAA,CAAM,OAAA,KAAY,SAAY,MAAA,GAAY,iBAAA,CAAkB,MAAM,OAAO,CAAA;AAC9F,IAAA,IAAI,gBAAgB,KAAA,CAAM,OAAA,KAAY,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAA,EAAG;AAClE,MAAA,QAAA,CAAS,KAAK,CAAA,EAAG,GAAG,KAAK,GAAG,CAAA,SAAA,EAAO,YAAY,CAAA,CAAE,CAAA;AAAA,IACnD;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AASA,SAAS,aAAA,CAAc,QAAqB,QAAA,EAAuC;AACjF,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,EAAE,KAAA,EAAO,GAAA,EAAK,MAAA,EAAQ,OAAA,MAAa,MAAA,EAAQ;AACpD,IAAA,IAAI,CAAC,MAAA,CAAO,EAAA,IAAM,CAAC,OAAA,IAAW,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG;AACrE,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,CAAQ,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,YAAA,IAAgB,CAAC,CAAA,CAAE,SAAS,CAAA,EAAG;AACjF,MAAA,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,aAAA,CAAc,KAAA,EAAO,QAAQ,CAAC,CAAA,EAAA,EAAK,GAAG,CAAA,GAAA,EAAM,CAAA,CAAE,GAAG,CAAA,SAAA,EAAO,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAAA,IACnF;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAKA,eAAe,cAAc,GAAA,EAA+B;AAC1D,EAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,EAAE,YAAY,OAAA,CAAQ,GAAA,IAAO,CAAA;AACpE,EAAA,OAAQ,MAAM,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,KAAO,IAAA;AACzC;AAIA,eAAe,WAAA,CAAY,OAAmB,GAAA,EAAoC;AAChF,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,MAAA,EAAQ,MAAM,KAAA,CAAM,GAAG,CAAA,EAAE;AAAA,EACpC,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO,EAAE,OAAO,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAA,EAAE;AAAA,EACnE;AACF;AASA,eAAe,mBAAA,CACb,MAAA,EACA,QAAA,EACA,YAAA,EACA,KAAA,EACqD;AACrD,EAAA,MAAM,SAA8D,EAAC;AACrE,EAAA,KAAA,MAAW,EAAE,KAAA,EAAO,GAAA,EAAK,OAAA,MAAa,MAAA,EAAQ;AAC5C,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,EAAS,UAAA,IAAc,EAAC,EAAG;AACzC,MAAA,IAAI,CAAC,EAAE,SAAA,EAAW;AAClB,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,KAAA,EAAO,CAAA,EAAG,aAAA,CAAc,KAAA,EAAO,QAAQ,CAAC,CAAA,EAAA,EAAK,GAAG,CAAA,GAAA,EAAM,CAAA,CAAE,GAAG,CAAA,CAAA,CAAA;AAAA,QAC3D,IAAA,EAAM,UAAA;AAAA,QACN,KAAK,CAAA,CAAE;AAAA,OACR,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,KAAA,MAAW,KAAK,YAAA,EAAc;AAC5B,IAAA,IAAI,CAAC,EAAE,SAAA,EAAW;AAClB,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,KAAA,EAAO,CAAA,EAAG,iBAAiB,CAAA,iBAAA,EAAe,EAAE,KAAK,CAAA,CAAA;AAAA,MACjD,IAAA,EAAM,YAAA;AAAA,MACN,KAAK,CAAA,CAAE;AAAA,KACR,CAAA;AAAA,EACH;AACA,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA0B;AAC9C,EAAA,MAAM,MAAM,EAAE,QAAA,EAAU,EAAC,EAAe,QAAA,EAAU,EAAC,EAAc;AACjE,EAAA,KAAA,MAAW,EAAE,KAAA,EAAO,IAAA,EAAM,GAAA,MAAS,MAAA,EAAQ;AACzC,IAAA,IAAI,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC5B,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,MAAA,GAAS,MAAM,WAAA,CAAY,KAAA,EAAO,GAAG,CAAA;AACrC,MAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,MAAM,CAAA;AAAA,IACzB;AACA,IAAA,IAAI,QAAA,IAAY,MAAA,IAAU,MAAA,CAAO,MAAA,EAAQ;AACzC,IAAA,MAAM,OAAO,CAAA,EAAG,KAAK,CAAA,QAAA,EAAM,IAAI,KAAK,GAAG,CAAA,uCAAA,CAAA;AACvC,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,GAAA,CAAI,QAAA,CAAS,IAAA;AAAA,QACX,CAAA,EAAG,IAAI,CAAA,mCAAA,EAAsC,MAAA,CAAO,MAAM,KAAA,CAAM,IAAI,CAAA,CAAE,CAAC,CAAC,CAAA,wFAAA;AAAA,OAC1E;AAAA,IACF,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,QAAA,CAAS,IAAA;AAAA,QACX,CAAA,EAAG,IAAI,CAAA,oEAAA,EAAuE,IAAI,iGAA4F,IAAI,CAAA,CAAA;AAAA,OACpL;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAQA,SAAS,eAAA,CACP,OAAA,EACA,KAAA,EACA,QAAA,EACA,UACA,MAAA,EACU;AACV,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,OAAA,EAAS,SAAS,CAAC,CAAA,IAAK,CAAC,UAAA,CAAW,IAAA,CAAK,OAAA,EAAS,YAAY,CAAC,CAAA,EAAG;AACrF,IAAA,QAAA,CAAS,IAAA;AAAA,MACP;AAAA,KACF;AAAA,EACF;AACA,EAAA,QAAA,CAAS,IAAA,CAAK,GAAG,aAAA,CAAc,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAChD,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,MAAA,GAAS,OAAO,KAAA,EAAO,OAAA,EAAS,CAAC,QAAA,EAAU,aAAA,EAAe,uBAAuB,CAAC,CAAA;AACxF,IAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,MAAA,MAAM,SAAS,MAAA,CAAO,MAAA,IAAU,IAAI,QAAA,EAAS,CAAE,MAAM,IAAI,CAAA;AACzD,MAAA,MAAM,YAAY,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,KAAK,CAAC,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,CAAC,CAAC,CAAA;AAChF,MAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,QAAA,MAAM,QAAQ,SAAA,CAAU,KAAA,CAAM,GAAG,oBAAoB,CAAA,CAAE,KAAK,IAAI,CAAA;AAChE,QAAA,MAAM,IAAA,GACJ,UAAU,MAAA,GAAS,oBAAA,GACf,QAAQ,SAAA,CAAU,MAAA,GAAS,oBAAoB,CAAA,KAAA,CAAA,GAC/C,EAAA;AACN,QAAA,QAAA,CAAS,IAAA;AAAA,UACP,GAAG,SAAA,CAAU,MAAM,CAAA,sEAAA,EAAyE,KAAK,GAAG,IAAI,CAAA,CAAA;AAAA,SAC1G;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MACb,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,GAAS,KAAK,CAAC,CAAA,CAAE,WAAW,KAAK,CAAA,IAAK,CAAC,CAAA,CAAE,UAAA,CAAW,KAAK,CAAC,CAAA,CAC1E,GAAA,CAAI,CAAC,CAAA,KAAM;AACV,QAAA,MAAM,IAAA,GAAO,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AACzB,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,GAAG,IAC3B,SAAA,GACA,IAAA,CAAK,QAAA,CAAS,GAAG,IACf,SAAA,GACA,IAAA,CAAK,QAAA,CAAS,GAAG,IACf,OAAA,GACA,UAAA;AACR,QAAA,OAAO,GAAG,KAAK,CAAA,CAAA,EAAI,CAAA,CAAE,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA;AAAA,MAC/B,CAAC,CAAA;AACH,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA,CAAM,GAAG,oBAAoB,CAAA,CAAE,KAAK,IAAI,CAAA;AAC9D,QAAA,MAAM,IAAA,GACJ,QAAQ,MAAA,GAAS,oBAAA,GACb,QAAQ,OAAA,CAAQ,MAAA,GAAS,oBAAoB,CAAA,KAAA,CAAA,GAC7C,EAAA;AACN,QAAA,QAAA,CAAS,IAAA;AAAA,UACP,GAAG,OAAA,CAAQ,MAAM,CAAA,4EAAA,EAA+E,KAAK,GAAG,IAAI,CAAA,CAAA;AAAA,SAC9G;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MACb,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,GAAS,CAAA,IAAK,CAAC,CAAA,CAAE,UAAA,CAAW,KAAK,CAAA,IAAK,CAAC,EAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,QAAA,CAAS,GAAG,CAAC,CAAA,CAClF,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA,CAAE,MAAM,MAAM,CAAA,CAAE,GAAA,EAAI,IAAK,EAAE,CAAA,CAC/C,OAAO,CAAC,IAAA,KAAS,iBAAiB,QAAA,CAAS,IAAA,CAAK,QAAQ,QAAA,EAAU,EAAE,CAAC,CAAC,CAAC,CAAA;AAC1E,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,QAAA,CAAS,IAAA;AAAA,UACP,GAAG,OAAA,CAAQ,MAAM,qFAAqF,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,wCAAA;AAAA,SAC1H;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAMA,IAAM,oBAAA,GACJ,6PAAA;AAQF,SAAS,eAAA,CAAgB,IAAA,EAAc,KAAA,EAAkB,SAAA,EAA4B;AACnF,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,EAAM,CAAC,MAAA,EAAQ,UAAU,IAAA,EAAM,SAAA,GAAY,WAAA,GAAc,UAAU,CAAA,EAAG;AAAA,IACtF,QAAA,EAAU;AAAA,GACX,CAAA;AACD,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,UAAU,GAAA,CAAI,MAAA,IAAU,EAAA,EAAI,QAAA,GAAW,IAAA,EAAK;AAClD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,IAAI,CAAA,SAAA,EAAY,UAAU,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA,CAAE,CAAA;AAAA,EACpF;AAIA,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,GAAA,CAAI,MAAA,IAAU,EAAE;AAAA,EAAK,GAAA,CAAI,UAAU,EAAE,CAAA,CAAA;AACpD,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,+BAA+B,CAAA;AACvD,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,IAAI,CAAA;AAAA,EAAwC,GAAA,CAAI,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,MAAM,CAAC,CAAA,CAAE,QAAQ,QAAA,EAAU,EAAE,EAAE,IAAA,EAAK;AAC7C;AAUA,SAAS,oBAAoB,GAAA,EAA6B;AACxD,EAAA,MAAM,CAAC,MAAM,GAAG,QAAQ,IAAI,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,GAAG,CAAA;AAChD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,IAAK,MAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC9B,EAAA,MAAM,OAAO,KAAA,GAAQ,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,MAAA;AAChD,EAAA,MAAM,OAAO,KAAA,GAAQ,CAAA,GAAI,KAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,GAAI,IAAA;AACjD,EAAA,MAAM,MAAA,GAAS,KAAK,UAAA,CAAW,GAAG,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,GAAI,EAAA;AAC1D,EAAA,MAAM,YAAY,MAAA,GAAS,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA,EAAG,MAAM,CAAA,GAAI,MAAA;AACvD,EAAA,MAAM,OAAO,MAAA,GAAS,CAAA,GAAI,KAAK,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,GAAI,IAAA;AACnD,EAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,GAAA,EAAI;AACtC;AAGA,SAAS,eAAA,CAAgB,UAA6B,GAAA,EAAmC;AACvF,EAAA,OAAA,CAAQ,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG,MAAA;AAAA,IAC7B,CAAC,MACC,CAAA,CAAE,IAAA,KAAS,IAAI,IAAA,KACd,CAAC,IAAI,IAAA,IAAQ,CAAA,CAAE,SAAS,GAAA,CAAI,IAAA,CAAA,KAC5B,CAAC,GAAA,CAAI,SAAA,IAAa,eAAe,CAAA,EAAG,QAAQ,MAAM,GAAA,CAAI,SAAA;AAAA,GAC3D;AACF;AAUA,eAAe,qBAAA,CACb,OAAA,EACA,QAAA,EACA,OAAA,EACA,YACA,WAAA,EACmB;AACnB,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,MAAM,WAAW,eAAA,EAAgB;AACjC,EAAA,MAAM,WAAW,MAAM,kBAAA;AAAA,IACrB,OAAA;AAAA,IACA,SAAS,SAAA,IAAa,OAAA;AAAA,IACtB,QAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAI,UAAA,IAAc,CAAA,CAAE,KAAA,CAAM,IAAA,KAAS,UAAA,EAAY;AAC/C,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,OAAA,EAAS,CAAA,CAAE,MAAM,MAAM,CAAA;AAC5C,IAAA,IAAI,EAAE,YAAA,EAAc;AAClB,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,qBAAA;AAAA,UACE,EAAE,KAAA,CAAM,IAAA;AAAA,UACR,EAAE,KAAA,CAAM,IAAA;AAAA,UACR,CAAA,CAAE,IAAA;AAAA,UACF,CAAA,uBAAA,EAA0B,EAAE,YAAY,CAAA,CAAA,CAAA;AAAA,UACxC;AAAA;AACF,OACF;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,EAAE,YAAA,EAAc;AAElB,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,GAAG,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,MAAM,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,GAAA,EAAM,EAAE,KAAA,CAAM,IAAI,YAAO,sBAAA,CAAuB,CAAA,CAAE,YAAY,CAAC,CAAA;AAAA,OACxG;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,CAAA,CAAE,KAAA,CAAM,MAAA,EAAQ,EAAE,KAAA,CAAM,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,WAAW,CAAA;AAC1F,IAAA,KAAA,MAAW,CAAA,IAAK,MAAA;AACd,MAAA,QAAA,CAAS,KAAK,CAAA,EAAG,CAAA,CAAE,KAAA,CAAM,IAAI,IAAI,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,GAAA,EAAM,CAAA,CAAE,GAAG,CAAA,SAAA,EAAO,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AACjF,IAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,CAAA,EAAG,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,yFAAA,EAA4F,OAAO,CAAA,GAAA;AAAA,OAC5I;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAGA,eAAe,cAAA,CACb,IAAA,EACA,IAAA,EAUA,MAAA,EACA,QAAmB,SAAA,EACJ;AACf,EAAA,gBAAA,CAAiB,KAAK,KAAK,CAAA;AAC3B,EAAA,MAAM,WAAW,MAAA,KAAW,MAAA;AAC5B,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,iBAAA,CAAkB,IAAI,CAAA;AAChD,IAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AAItC,IAAA,+BAAA,CAAgC,GAAA,CAAI,MAAM,IAAI,CAAA;AAE9C,IAAA,qBAAA,CAAsB,GAAA,CAAI,IAAA,EAAM,CAAA,uBAAA,EAA0B,IAAI,CAAA,CAAE,CAAA;AAEhE,IAAA,0BAAA,CAA2B,GAAA,CAAI,IAAA,EAAM,CAAA,uBAAA,EAA0B,IAAI,CAAA,CAAE,CAAA;AAIrE,IAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,GAAA,CAAI,IAAA,EAAM,QAAQ,CAAA;AACpD,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,QAAA,MAAA,CAAO,CAAA,EAAG,cAAc,CAAA,EAAG,QAAQ,CAAC,CAAA,cAAA,EAAY,CAAA,CAAE,IAAI,CAAA,gCAAA,CAAkC,CAAA;AAAA,MAC1F;AACA,MAAA,MAAA;AAAA,QACE,oFAC4B,IAAI,CAAA,+CAAA;AAAA,OAClC;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAGA,IAAA,MAAM,YAAY,IAAA,CAAK,KAAA,GAAQ,mBAAA,CAAoB,IAAA,CAAK,KAAK,CAAA,GAAI,KAAA,CAAA;AACjE,IAAA,IAAI,IAAA,CAAK,SAAS,SAAA,IAAa,eAAA,CAAgB,UAAU,SAAS,CAAA,CAAE,WAAW,CAAA,EAAG;AAChF,MAAA,MAAM,MAAA,GAAA,CAAU,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,aAAA,CAAc,CAAA,EAAG,QAAQ,CAAC,CAAA;AAC5E,MAAA,MAAA;AAAA,QACE,CAAA,kBAAA,EAAqB,IAAA,CAAK,KAAK,CAAA,cAAA,EAAiB,IAAI,CAAA,CAAA,CAAA,IACjD,MAAA,CAAO,MAAA,GAAS,CAAA,GACb,CAAA,sBAAA,EAAyB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,EAAA,CAAA,GAC1C,kCAAA;AAAA,OACR;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAIA,IAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,CAAA,EAAW,gBAAA,CAAiB,IAAI,IAAA,EAAM,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA;AAI5E,IAAA,IAAI,SAAA,GAAY,YAAY,GAAG,CAAA;AAC/B,IAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,IAAA,IAAI,IAAA,CAAK,OAAA,IAAW,CAAC,IAAA,CAAK,UAAA,EAAY;AACpC,MAAA,MAAA;AAAA,QACE;AAAA,OACF;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AACA,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,GAAU,SAAA,GAAY,QAAA;AAC9C,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,IAAI,KAAK,UAAA,EAAY;AACnB,QAAA,IAAI,IAAA,CAAK,OAAA,EAAS,OAAA,CAAQ,oBAAoB,CAAA;AAC9C,QAAA,IAAI,KAAK,MAAA,EAAQ;AAGf,UAAA,eAAA,GAAkB,IAAA;AAClB,UAAA,SAAA,GAAY,CAAA,kCAAA,EAAqC,IAAI,IAAI,CAAA,CAAA;AAAA,QAC3D,CAAA,MAAO;AACL,UAAA,SAAA,GAAY,gBAAgB,GAAA,CAAI,IAAA,EAAM,KAAA,EAAO,IAAA,CAAK,YAAY,IAAI,CAAA;AAClE,UAAA,MAAM,OAAA,CAAQ,cAAc,IAAA,EAAM;AAAA,YAChC,OAAA,EAAS,KAAA;AAAA,YACT,eAAe,EAAE,GAAA,EAAK,WAAW,MAAA,EAAQ,MAAA,EAAQ,UAAU,KAAA;AAAM,WAClE,CAAA;AACD,UAAA,KAAA,CAAM,oBAAoB,CAAA,CAAE,GAAA,CAAI,SAAS,CAAC,CAAA,EAAA,EAAK,UAAU,CAAA,EAAA,CAAI,CAAA;AAAA,QAC/D;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAA;AAAA,UACE,CAAA,SAAA,EAAY,IAAI,CAAA,2BAAA,EAAyB,CAAA,CAAE,IAAI,CAAA,oBAAA,EAAuB,IAAI,QAAQ,CAAC,CAAA,6DAAA;AAAA,SAErF;AACA,QAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,MAChB;AAAA,IACF,CAAA,MAAA,IAAW,CAAC,cAAA,CAAe,SAAS,CAAA,EAAG;AAIrC,MAAA,MAAA,CAAO,sBAAA,CAAuB,IAAA,EAAM,SAAS,CAAC,CAAA;AAC9C,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAIA,IAAA,MAAM,aAAa,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,GAAI,KAAA,CAAA;AACvD,IAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,QAAA,EAAU,UAAU,CAAA;AAK1D,IAAA,MAAM,WAAA,GAAc,iBAAA;AAAA,MAClB,cAAA,CAAe,IAAI,IAAI,CAAA;AAAA,MACvB,MAAM,mBAAA,CAAoB,GAAA,CAAI,IAAI,CAAA;AAAA,MAClC,QAAA,CAAS;AAAA,KACX;AACA,IAAA,MAAM,SAAS,UAAA,CAAW,GAAA,CAAI,IAAA,EAAM,QAAA,EAAU,YAAY,WAAW,CAAA;AACrE,IAAA,MAAM,cAAc,WAAA,CAAY,wBAAA,CAAyB,QAAA,EAAU,MAAM,GAAG,UAAU,CAAA;AACtF,IAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,CAAsB,GAAA,CAAI,MAAM,QAAA,EAAU,IAAA,EAAM,YAAY,WAAW,CAAA;AAE9F,IAAA,MAAM,mBAAmB,wBAAA,CAAyB,GAAA,CAAI,IAAI,CAAA,CACvD,OAAO,CAAC,CAAA,KAAM,CAAC,UAAA,IAAc,EAAE,KAAA,CAAM,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,CAAC,CAAA,CAC/D,GAAA;AAAA,MACC,CAAC,MACC,CAAA,EAAG,iBAAiB,oBAAe,CAAA,CAAE,KAAK,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,oDAAA;AAAA,KAE5D;AAEF,IAAA,MAAM,kBAAA,GAAA,CAAsB,MAAM,0BAAA,CAA2B,GAAA,CAAI,IAAI,CAAA,EAAG,MAAA;AAAA,MACtE,CAAC,CAAA,KAAM,CAAA,CAAE,SAAA,KAAc,CAAC,UAAA,IAAc,CAAA,CAAE,KAAA,CAAM,QAAA,CAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE,CAAA;AAAA,KACzE;AACA,IAAA,MAAM,gBAAgB,MAAM,mBAAA;AAAA,MAC1B,MAAA;AAAA,MACA,QAAA;AAAA,MACA,kBAAA;AAAA,MACA,KAAK,UAAA,IAAc;AAAA,KACrB;AACA,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,GAAG,aAAA,CAAc,MAAA,EAAQ,QAAQ,CAAA;AAAA,MACjC,GAAG,gBAAA;AAAA,MACH,GAAG,QAAA;AAAA,MACH,GAAG,aAAA,CAAc;AAAA,KACnB;AACA,IAAA,IAAI,SAAA,EAAW,QAAQ,KAAA,CAAA,EAAW;AAChC,MAAA,MAAM,OAAO,eAAA,CAAgB,QAAA,EAAU,SAAS,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM;AAC3D,QAAA,MAAM,UAAU,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,CAAC,CAAA;AAChD,QAAA,MAAM,WAAA,GAAc,SAAS,MAAA,CAAO,EAAA,GAAK,gBAAgB,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,GAAI,KAAA,CAAA;AAChF,QAAA,OAAO,WAAA,IAAe,CAAA,CAAE,OAAA,IAAW,QAAA,CAAS,OAAA;AAAA,MAC9C,CAAC,CAAA;AACD,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,KAAA,CAAA,IAAa,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,CAAC,CAAC,CAAA,EAAG;AACpE,QAAA,MAAA;AAAA,UACE,GAAG,IAAA,CAAK,KAAK,CAAA,oBAAA,EAAuB,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,KAAK,IAAI,CAAA,IAAK,YAAY,CAAA,qBAAA,EAAwB,UAAU,GAAG,CAAA,yFAAA;AAAA,SAE3H;AACA,QAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,MAChB;AAAA,IACF;AACA,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,KAAA,MAAW,CAAA,IAAK,QAAA,EAAU,MAAA,CAAO,CAAC,CAAA;AAClC,MAAA,MAAA;AAAA,QACE,yGAC4B,IAAI,CAAA,cAAA;AAAA,OAClC;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAMA,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,MAAA,EAAQ,QAAQ,CAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,IAAK,IAAA,CAAK,QAAA,EAAU;AACrC,MAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,MAAA,CAAO,aAAA,CAAc,CAAC,CAAC,CAAA;AAC9C,MAAA,MAAA;AAAA,QACE,mJAC8D,IAAI,CAAA,iCAAA;AAAA,OACpE;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAEA,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,IAAO,QAAA,CAAS,GAAG,CAAA;AAC1C,IAAA,MAAM,QAAA,GAAW;AAAA,MACf,GAAG,gBAAgB,GAAA,CAAI,IAAA,EAAM,OAAO,IAAA,CAAK,QAAA,EAAU,UAAU,MAAM,CAAA;AAAA,MACnE,GAAG,aAAA,CAAc;AAAA,KACnB;AAEA,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,OAAA,CAAQ,CAAA,iBAAA,EAAoB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAC3C,MAAA,OAAA;AAAA,QACE,CAAA,cAAA,EAAiB,SAAS,CAAA,EAAG,eAAA,GAAkB,uBAAuB,UAAU,CAAA,wBAAA,EAA2B,UAAU,CAAA,GAAA,CAAA,GAAQ,EAAE,CAAA;AAAA,OACjI;AACA,MAAA,OAAA;AAAA,QACE,CAAA,cAAA,EAAiB,WAAW,MAAA,GAAS,CAAA,GAAI,WAAW,IAAA,CAAK,IAAI,IAAI,sBAAsB,CAAA;AAAA,OACzF;AAGA,MAAA,MAAM,QAAA,GAAW,YAAY,oBAAA,EAAqB;AAClD,MAAA,IAAI,CAAC,QAAA,EAAU;AAEb,QAAA,OAAA,CAAQ,mEAAmE,CAAA;AAAA,MAC7E,CAAA,MAAA,IAAW,UAAA,CAAW,MAAA,GAAS,CAAA,EAAG;AAChC,QAAA,KAAA,MAAW,MAAM,UAAA,EAAY;AAC3B,UAAA,IAAI;AACF,YAAA,MAAM,QAAQ,MAAA,CAAO,MAAA,IAAU,uBAAA,EAAwB,EAAG,sBAAsB,EAAE,CAAA;AAClF,YAAA,MAAM,SAAS,UAAA,CAAW,MAAA,GAAS,CAAA,GAAI,CAAA,CAAA,EAAI,EAAE,CAAA,QAAA,CAAA,GAAQ,EAAA;AACrD,YAAA,OAAA,CAAQ,iBAAiB,MAAM,CAAA,EAAG,2BAAA,CAA4B,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,UACxE,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,CAAA,cAAA,EAAiB,SAAS,CAAA,CAAE,CAAA;AACpC,MAAA,OAAA,CAAQ,CAAA,gBAAA,EAAmB,WAAA,CAAY,MAAM,CAAA,UAAA,CAAY,CAAA;AACzD,MAAA,KAAA,MAAW,CAAA,IAAK,WAAA,EAAa,OAAA,CAAQ,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAC/C,MAAA,KAAA,MAAW,KAAK,KAAA,EAAO,OAAA,CAAQ,gCAAgC,aAAA,CAAc,CAAC,CAAC,CAAA,CAAE,CAAA;AACjF,MAAA,KAAA,MAAW,CAAA,IAAK,QAAA,EAAU,OAAA,CAAQ,CAAC,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,KAAA,MAAW,CAAA,IAAK,QAAA,EAAU,OAAA,CAAQ,CAAC,CAAA;AAGnC,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,oBAAA,EAAqB,EAAG;AACxC,MAAA,MAAA,CAAO,sDAAiD,CAAA;AACxD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAEA,IAAA,MAAM,GAAA,GAAM,UAAU,uBAAA,EAAwB;AAI9C,IAAA,KAAA,MAAW,MAAM,UAAA,EAAY;AAC3B,MAAA,MAAM,IAAA,GAAO,MAAM,kBAAA,CAAmB,GAAA,EAAK,EAAE,CAAA;AAC7C,MAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,QAAA,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,CAAA,sBAAA,EAAyB,EAAE,CAAA,CAAA,CAAG,CAAA;AACrD,QAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,MAChB;AAAA,IACF;AAGA,IAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,MAAA,mBAAA,CAAoB,IAAI,IAAA,EAAM;AAAA,QAC5B,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,KAAA,CAAM,IAAA;AAAA,QACpB,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,KAAA,CAAM,IAAA;AAAA,QACpB,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,KAAA,CAAM,IAAA,IAAQ,EAAA;AAAA,QAC5B,SAAS,CAAA,CAAE;AAAA,OACZ,CAAA;AACD,MAAA,OAAA,CAAQ,CAAA,sBAAA,EAAyB,aAAA,CAAc,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,IACrD;AAGA,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAGlB,MAAA,OAAA;AAAA,QACE,CAAA,wDAAA,EAA2D,CAAA,CAAE,GAAA,CAAI,SAAS,CAAC,CAAA,wEAAA;AAAA,OAE7E;AACA,MAAA,aAAA,CAAc,EAAE,OAAA,EAAS,GAAA,CAAI,IAAA,EAAM,SAAA,EAAW,QAAQ,QAAA,CAAS,GAAG,CAAA,EAAG,KAAA,EAAO,CAAA;AAC5E,MAAA,KAAA,CAAM,CAAA,OAAA,EAAU,CAAA,CAAE,GAAA,CAAI,IAAI,CAAC,OAAO,CAAA,CAAE,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,cAAA,CAAe;AAAA,MACzC,SAAA,EAAW,SAAA;AAAA,MACX,GAAA,EAAK,SAAA;AAAA,MACL,QAAA,EAAU,wBAAA,CAAyB,QAAA,EAAU,MAAM,CAAA;AAAA,MACnD,SAAA,EAAW,UAAA;AAAA,MACX,MAAA,EAAQ;AAAA,KACT,CAAA;AAED,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,MAAA,OAAA,CAAQ,CAAA,+BAAA,EAAkC,SAAA,CAAU,CAAC,CAAC,CAAA,GAAA,CAAK,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACF;AAOA,eAAsB,iBAAA,CACpB,IAAA,EACA,IAAA,EAQA,MAAA,EACA,QAAmB,SAAA,EACJ;AACf,EAAA,MAAM,cAAA,CAAe,MAAM,EAAE,GAAG,MAAM,QAAA,EAAU,KAAA,EAAM,EAAG,MAAA,EAAQ,KAAK,CAAA;AACxE;AAOA,eAAsB,kBAAA,CACpB,IAAA,EACA,IAAA,EACA,MAAA,EACA,QAAmB,SAAA,EACJ;AACf,EAAA,MAAM,cAAA,CAAe,MAAM,EAAE,GAAG,MAAM,QAAA,EAAU,IAAA,EAAK,EAAG,MAAA,EAAQ,KAAK,CAAA;AACvE;AAOA,eAAsB,cAAA,CACpB,IAAA,EACA,IAAA,EACA,MAAA,EACe;AACf,EAAA,gBAAA,CAAiB,KAAK,KAAK,CAAA;AAC3B,EAAA,MAAM,WAAW,MAAA,KAAW,MAAA;AAC5B,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,cAAA,CAAe,IAAI,CAAA;AAC7C,IAAA,MAAM,SAAA,GAAY,YAAY,GAAG,CAAA;AACjC,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAA,CAAO,CAAA,SAAA,EAAY,IAAI,CAAA,iDAAA,CAA8C,CAAA;AACrE,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAEA,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,oBAAA,EAAqB,EAAG;AACxC,MAAA,MAAA,CAAO,sDAAiD,CAAA;AACxD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAEA,IAAA,MAAM,GAAA,GAAM,UAAU,uBAAA,EAAwB;AAC9C,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,IAAA,MAAM,SAAS,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,SAAS,CAAA;AACnD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAA,CAAO,CAAA,SAAA,EAAY,IAAI,CAAA,wDAAA,CAAqD,CAAA;AAC5E,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAEA,IAAA,MAAM,aAAa,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,GAAI,KAAA,CAAA;AACvD,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,gBAAA,CAAiB,MAAA,CAAO,EAAE,CAAA,EAAG,MAAA;AAAA,MACzD,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAC,UAAA,IAAc,EAAE,IAAA,KAAS,UAAA;AAAA,KACnD;AACA,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,MAAA,OAAA,CAAQ,qDAAgD,CAAA;AACxD,MAAA;AAAA,IACF;AAKA,IAAA,MAAM,QAAA,GAAW,qBAAA,CAAsB,GAAA,CAAI,IAAI,CAAA;AAC/C,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,CAAI,cAAA,CAAe,CAAA,CAAE,EAAE,CAAA;AAC7B,QAAA,MAAM,KAAA,GAAQ,QAAA,EAAU,MAAA,EAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,CAAA,CAAE,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,EAAE,IAAI,CAAA;AAClF,QAAA,MAAM,KAAK,QAAA,IAAY,KAAA,GAAQ,cAAA,CAAe,KAAA,EAAO,QAAQ,CAAA,GAAI,KAAA,CAAA;AACjE,QAAA,MAAA,CAAO,KAAK,EAAA,GAAK,MAAA,CAAO,CAAA,CAAE,IAAA,EAAM,IAAI,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,IAAI,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAAA,MAChF,SAAS,GAAA,EAAK;AACZ,QAAA,MAAA;AAAA,UACE,CAAA,eAAA,EAAkB,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SACzF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,UAAA,CAAY,CAAA;AACzC,IAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,OAAA,CAAQ,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC1C,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACF","file":"library-publish-B5HL4OBE.js","sourcesContent":["/**\n * `skaile library publish / register / yank` — the first-party publish flow.\n * A git-backed library you own carries an in-repo `skaile.manifest.yaml`; this\n * commits + pushes the library repo (publish), or takes the current remote HEAD\n * as-is (register), then registers + syncs it as a store source and publishes\n * the manifest's assets, each under its own namespace — `assets[].publisher`,\n * else the manifest's top-level `publisher` (no namespace remap — first-party\n * authors intend their declared namespace). Every distinct namespace is\n * preflighted before the push. The plan phase (dry-run and real) also requires the\n * remote to be a GitHub url and warns about a missing LICENSE and, for `publish`,\n * untracked files that `git add -A` would make public.\n *\n *   - `publish`  = commit (if dirty) + push + register + sync + publish.\n *   - `register` = same, but skip the commit/push (bytes already on GitHub).\n *   - `yank`     = unpublish the library's published assets (all, or one).\n *\n * The store REST surface is reached through the injectable {@link PublisherClient}\n * (default HTTP); git side-effects go through an injectable `spawn`. Both seams\n * keep the flow unit/integration-testable without a live store or a real remote.\n *\n * @docLink cli/commands/library\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { basename, dirname, join, relative, sep } from \"node:path\";\nimport {\n  type AssetEntry,\n  decodeSkaileManifest,\n  loadSkPublishManifest,\n  matchPin,\n  type SkPublishManifest,\n  readAssetBody,\n} from \"@skaile/workspaces/core\";\nimport { isSecretFileName } from \"@skaile/workspaces/core/publish-manifest\";\nimport { type ParseManifestResult, parseManifestFile } from \"@skaile/workspaces/discovery\";\nimport {\n  type GitBackendConfig,\n  type Library,\n  missingRootAssets,\n  scanUnlistedAssets,\n  UNLISTED_SCAN_SKIP_DIRS,\n  upsertManifestAsset,\n} from \"@skaile/workspaces/library\";\nimport { type ComposeRefContext, composeRefContext } from \"../agent-checks.ts\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport { openCatalogSource, openLibraryManager } from \"../open-library.ts\";\nimport { getKindRegistry } from \"../open-registry.ts\";\nimport {\n  type AssetCheckResult,\n  checkAsset,\n  checkAssetFile,\n  declaredVersion,\n  duplicateAssetMessage,\n  findEntryManifestFile,\n  invalidSemverText,\n  manifestParseErrorText,\n} from \"../skill-checks.ts\";\nimport { isStoreAuthenticated } from \"../store-client.ts\";\nimport { makeHttpPublisherClient, type PublisherClient } from \"../store-publisher.ts\";\nimport {\n  exitOnLibrarySymlinks,\n  exitOnManifestPublisherProblems,\n  exitOnManifestPathProblems,\n  type ManifestDependencyProblem,\n  manifestDependencyProblems,\n  manifestRequiresProblems,\n  registeredAssetKeys,\n} from \"./library-index.ts\";\nimport { scanIdentities } from \"./validate.ts\";\nimport {\n  assetEntryRef,\n  assetNamespace,\n  bareName,\n  exitOnEmptyAsset,\n  formatNamespaceAvailability,\n  manifestNamespaces,\n  plannedRefs,\n  preflightNamespace,\n  publishToStore,\n  refFor,\n} from \"./publish-core.ts\";\n\n/** Injectable spawn contract — the subset of `spawnSync` these helpers use. */\ntype SpawnLike = typeof spawnSync;\n\n/** The fixed filename a library carries at its root for publication. */\nconst MANIFEST_FILENAME = \"skaile.manifest.yaml\";\n\n/** The remote url of a git-backed library, or `undefined` for a local one. */\nfunction remoteUrlOf(lib: Library): string | undefined {\n  if (lib.backend !== \"git\") return undefined;\n  return (lib.backendConfig as GitBackendConfig).url;\n}\n\n/** The publish branch of a git-backed library (defaults to `main`). */\nfunction branchOf(lib: Library): string {\n  if (lib.backend !== \"git\") return \"main\";\n  return (lib.backendConfig as GitBackendConfig).branch ?? \"main\";\n}\n\n/**\n * Read + decode the in-repo `skaile.manifest.yaml`. Prints each error\n * diagnostic and exits (1) — mirroring the sidecar flow's validation gate.\n */\nfunction loadManifest(libPath: string): SkPublishManifest {\n  let text: string;\n  try {\n    text = readFileSync(join(libPath, MANIFEST_FILENAME), \"utf-8\");\n  } catch {\n    logErr(\n      `No ${S.dim(MANIFEST_FILENAME)} in the library — author it (see \\`skaile library create\\`) ` +\n        \"and run `skaile validate` before publishing.\",\n    );\n    process.exit(1);\n  }\n  const { manifest, diagnostics } = decodeSkaileManifest(text);\n  const errors = diagnostics.filter((d) => d.severity === \"error\");\n  if (errors.length > 0) {\n    for (const d of errors) logErr(`${d.code}: ${d.message}`);\n    logErr(\"The manifest has errors — fix them with `skaile validate` before publishing.\");\n    process.exit(1);\n  }\n  return manifest;\n}\n\n/** Run a git command in `cwd` via the injected spawn; returns the result. */\nfunction runGit(spawn: SpawnLike, cwd: string, args: string[]) {\n  return spawn(\"git\", [\"-C\", cwd, ...args], { encoding: \"utf-8\" });\n}\n\n/**\n * Refuse (exit 1) a `--ref` that is not a valid git ref name, or that names no branch, tag\n * or commit of the library repo (local, or fetched from `origin`). A library directory that\n * is not a git repo yet has nothing to check against and passes: `publish` creates the repo.\n *\n * The ref is sent to the store as a plain string and the store ingests the GitHub repo at that\n * name, so only what GitHub resolves by name is accepted: a branch, a tag or a commit id. A\n * revision expression (`HEAD~1`, `v1.0^{}`) resolves locally but not in the store, so it is\n * refused here rather than published under a ref the store cannot read.\n */\nfunction exitOnUnknownRef(libPath: string, libName: string, ref: string, spawn: SpawnLike): void {\n  const wellFormed =\n    !ref.startsWith(\"-\") &&\n    spawn(\"git\", [\"check-ref-format\", \"--allow-onelevel\", ref], { encoding: \"utf-8\" }).status === 0;\n  if (!wellFormed) {\n    logErr(\n      `--ref \"${ref}\" is not a valid git ref name; pass a branch or tag name or a commit id ` +\n        \"(revision expressions like HEAD~1 are not accepted).\",\n    );\n    process.exit(1);\n  }\n  if (runGit(spawn, libPath, [\"rev-parse\", \"--git-dir\"]).status !== 0) return;\n  const exists = [ref, `refs/remotes/origin/${ref}`].some(\n    (candidate) =>\n      runGit(spawn, libPath, [\"rev-parse\", \"--verify\", \"--quiet\", `${candidate}^{commit}`])\n        .status === 0,\n  );\n  if (!exists) {\n    logErr(\n      `--ref \"${ref}\" is not a branch, tag or commit of library \"${libName}\"; ` +\n        `fetch it first (\\`skaile library pull ${libName}\\`) if it only exists on the remote.`,\n    );\n    process.exit(1);\n  }\n}\n\n/**\n * Ensure `libPath` is a git repo whose `origin` points at `remoteUrl`, then\n * commit any changes and push to `branch`. Idempotent re-publish: an unchanged\n * tree makes `git commit` fail with \"nothing to commit\" — swallowed. Push (or\n * any other git) failures surface as thrown Errors carrying git's stderr.\n */\nfunction commitAndPush(opts: {\n  libPath: string;\n  remoteUrl: string;\n  branch: string;\n  spawn: SpawnLike;\n}): void {\n  const { libPath, remoteUrl, branch, spawn } = opts;\n\n  const gitDir = runGit(spawn, libPath, [\"rev-parse\", \"--git-dir\"]);\n  if (gitDir.status !== 0) {\n    const init = runGit(spawn, libPath, [\"init\"]);\n    if (init.status !== 0) {\n      throw new Error(\n        `git init failed: ${(init.stderr ?? \"\").toString().trim() || `exit ${init.status}`}`,\n      );\n    }\n  }\n\n  // Point origin at the resolved remote (add if absent, else set-url).\n  const getUrl = runGit(spawn, libPath, [\"remote\", \"get-url\", \"origin\"]);\n  const originArgs =\n    getUrl.status === 0\n      ? [\"remote\", \"set-url\", \"origin\", remoteUrl]\n      : [\"remote\", \"add\", \"origin\", remoteUrl];\n  const setOrigin = runGit(spawn, libPath, originArgs);\n  if (setOrigin.status !== 0) {\n    throw new Error(\n      `git remote failed: ${(setOrigin.stderr ?? \"\").toString().trim() || `exit ${setOrigin.status}`}`,\n    );\n  }\n\n  const add = runGit(spawn, libPath, [\"add\", \"-A\"]);\n  if (add.status !== 0) {\n    throw new Error(\n      `git add failed: ${(add.stderr ?? \"\").toString().trim() || `exit ${add.status}`}`,\n    );\n  }\n\n  // Fixed bot identity via -c so the commit succeeds regardless of the author's\n  // git config (the publish commit is a machine action).\n  const commit = spawn(\n    \"git\",\n    [\n      \"-C\",\n      libPath,\n      \"-c\",\n      \"user.email=publish@skaile.store\",\n      \"-c\",\n      \"user.name=skaile\",\n      \"commit\",\n      \"-m\",\n      \"chore: publish\",\n    ],\n    { encoding: \"utf-8\" },\n  );\n  if (commit.status !== 0) {\n    const out = `${commit.stdout ?? \"\"}${commit.stderr ?? \"\"}`;\n    if (!/nothing to commit/i.test(out)) {\n      throw new Error(`git commit failed: ${out.trim() || `exit ${commit.status}`}`);\n    }\n  }\n\n  const push = runGit(spawn, libPath, [\"push\", \"origin\", `HEAD:${branch}`]);\n  if (push.status !== 0) {\n    throw new Error(\n      `git push failed: ${(push.stderr ?? \"\").toString().trim() || `exit ${push.status}`}`,\n    );\n  }\n}\n\n/**\n * `true` when `url` is a GitHub repo remote the store can fetch: `https://github.com/<o>/<r>[.git]`,\n * `git@github.com:<o>/<r>[.git]` or `ssh://git@github.com/<o>/<r>[.git]`. The store is\n * pointer-only and fetches bytes from GitHub, so any other remote (a local path, a `file://`\n * url, another host) can be pushed to but never published.\n */\nexport function isGithubRemote(url: string): boolean {\n  return /^(?:https:\\/\\/github\\.com\\/|git@github\\.com:|ssh:\\/\\/git@github\\.com\\/)[^/\\s]+\\/[^/\\s]+?(?:\\.git)?\\/?$/i.test(\n    url.trim(),\n  );\n}\n\n/** The advisory for a remote `library publish` cannot use (see {@link isGithubRemote}). */\nexport function notGithubRemoteMessage(name: string, url: string): string {\n  return (\n    `The remote of library \"${name}\" is not a GitHub url: ${url}. ` +\n    \"The store fetches published assets from GitHub — repoint it with \" +\n    `\\`skaile library set ${name} backendConfig.url=https://github.com/<owner>/<repo>\\`.`\n  );\n}\n\n/** How many untracked paths the publish plan lists before collapsing to \"and N more\". */\nconst MAX_LISTED_UNTRACKED = 10;\n\n/** A first-party manifest asset resolved to its on-disk manifest file, read and parsed. */\ninterface PlanAsset {\n  entry: AssetEntry;\n  /** Path relative to the library root, for messages. */\n  rel: string;\n  parsed: ParseManifestResult;\n  /** The shared per-asset checks ({@link checkAsset}); `undefined` when the file did not parse. */\n  checked: AssetCheckResult | undefined;\n}\n\n/**\n * The first-party assets the plan covers (a `root:` entry or a `files:` list), each with its\n * manifest file read. Curated entries (`source`) carry no library directory and a root with no\n * manifest file is `missingRootAssets`' concern, so both are left out.\n */\nfunction planAssets(\n  libPath: string,\n  manifest: SkPublishManifest,\n  targetName: string | undefined,\n  composeRefs: ComposeRefContext,\n): PlanAsset[] {\n  const out: PlanAsset[] = [];\n  const registry = getKindRegistry();\n  for (const entry of manifest.assets ?? []) {\n    if (targetName && entry.name !== targetName) continue;\n    if (entry.source || manifest.source) continue;\n    const file = findEntryManifestFile(libPath, entry);\n    if (!file) continue;\n    const text = readFileSync(file, \"utf-8\");\n    const parsed = parseManifestFile(file, text);\n    let checked: AssetCheckResult | undefined;\n    if (parsed.ok) {\n      checked = checkAsset(\n        entry.kind,\n        parsed.data,\n        readAssetBody(file, text),\n        basename(dirname(file)),\n        registry,\n        text,\n        basename(file),\n        { dir: dirname(file), libraryRoot: libPath, composeRefs },\n      );\n    }\n    out.push({ entry, rel: relative(libPath, file), parsed, checked });\n  }\n  return out;\n}\n\n/**\n * The manifest with every entry's `version` replaced by the one in its asset\n * file — the version a publish ships (the file is the source of truth; the\n * entry only mirrors it after `skaile library index`).\n */\nfunction manifestWithFileVersions(\n  manifest: SkPublishManifest,\n  assets: PlanAsset[],\n): SkPublishManifest {\n  return {\n    ...manifest,\n    assets: manifest.assets?.map((entry) => {\n      const planned = assets.find((a) => a.entry === entry);\n      const fileVersion = planned?.parsed.ok ? declaredVersion(planned.parsed.data) : undefined;\n      return fileVersion === undefined ? entry : { ...entry, version: fileVersion };\n    }),\n  };\n}\n\n/** A manifest entry whose version differs from the one in its asset file. */\ninterface VersionDrift {\n  asset: PlanAsset;\n  ref: string;\n  /** The version the manifest records (`assets[].version ?? version`), `undefined` when none. */\n  entryVersion: string | undefined;\n  fileVersion: string;\n}\n\n/**\n * The planned assets whose manifest entry does not carry the version of their asset\n * file. The store reads the manifest it finds in the pushed repo, so a publish\n * records the entry's version — {@link manifestWithFileVersions} is what the plan\n * shows, and these are the entries a real publish has to rewrite to match it.\n */\nfunction versionDrift(assets: PlanAsset[], manifest: SkPublishManifest): VersionDrift[] {\n  const out: VersionDrift[] = [];\n  for (const asset of assets) {\n    if (!asset.parsed.ok) continue;\n    const fileVersion = declaredVersion(asset.parsed.data);\n    const entryVersion = asset.entry.version ?? manifest.version;\n    if (fileVersion !== undefined && fileVersion !== entryVersion) {\n      out.push({ asset, ref: assetEntryRef(asset.entry, manifest), entryVersion, fileVersion });\n    }\n  }\n  return out;\n}\n\nconst describeDrift = (d: VersionDrift): string =>\n  `${d.ref}: manifest version ${d.entryVersion ?? \"(none)\"} → ${d.fileVersion} (${d.asset.rel.split(sep).join(\"/\")})`;\n\n/**\n * Reasons the plan cannot publish an asset: its manifest file cannot be parsed (an\n * empty `SKILL.md`), or it fails the errors of the shared per-asset check list\n * ({@link checkAsset}: version not semver, the kind's manifest schema — the skill\n * schema refuses the scaffold `TODO:` description — and the flow definition parser),\n * or its manifest entry carries a version that is not semver. These are the cases\n * `skaile validate` fails on and `skaile library index` keeps out of the manifest;\n * a hand-edited manifest can still list one, so the plan stops rather than ships it.\n */\nfunction assetRefusals(assets: PlanAsset[], manifest: SkPublishManifest): string[] {\n  const refusals: string[] = [];\n  for (const { entry, rel, parsed, checked } of assets) {\n    const ref = assetEntryRef(entry, manifest);\n    if (!parsed.ok || !checked) {\n      const reason = parsed.ok ? \"the manifest file could not be read\" : parsed.reason;\n      refusals.push(`${ref} (${rel}) [${entry.kind}] — ${manifestParseErrorText(reason)}`);\n      continue;\n    }\n    for (const f of checked.errors) refusals.push(`${ref} (${rel}) [${f.tag}] — ${f.text}`);\n    // An untouched scaffold body is an error in `validate` too: a publish would ship an empty asset.\n    // (A `requires:` ref no registered library holds is judged against the store: see `storeHolderVerdicts`.)\n    for (const f of checked.advisories.filter((a) => a.scaffoldBody)) {\n      refusals.push(`${ref} (${rel}) [${f.tag}] — ${f.text}`);\n    }\n    // The asset file renamed in place: the entry is a ref `add` cannot resolve (p700).\n    const fileName = entry.kind === \"flow\" ? parsed.data.id : parsed.data.name;\n    if (typeof fileName === \"string\" && fileName !== \"\" && fileName !== entry.name) {\n      refusals.push(\n        `${ref} (${rel}) — the asset file now names \"${fileName}\": run \\`skaile library index\\` to rename the entry, or restore the name.`,\n      );\n    }\n    // The file's own version is checked above; the entry's can differ from it.\n    const entryInvalid = entry.version === undefined ? undefined : invalidSemverText(entry.version);\n    if (entryInvalid && entry.version !== declaredVersion(parsed.data)) {\n      refusals.push(`${ref} (${rel}) — ${entryInvalid}`);\n    }\n  }\n  return refusals;\n}\n\n/**\n * Per-asset advisories for the assets the plan would publish — the advisories of the\n * shared check list `skaile validate` runs (agentskills.io conformance for skills, the\n * untouched `library create` scaffold for skill, agent, prompt, contract, flow and\n * preset), one line per asset/finding. An unparsable manifest is {@link assetRefusals}'\n * to report.\n */\nfunction assetWarnings(assets: PlanAsset[], manifest: SkPublishManifest): string[] {\n  const warnings: string[] = [];\n  for (const { entry, rel, parsed, checked } of assets) {\n    if (!parsed.ok || !checked || Object.keys(parsed.data).length === 0) continue;\n    for (const f of checked.advisories.filter((a) => !a.scaffoldBody && !a.unheldRef)) {\n      warnings.push(`${assetEntryRef(entry, manifest)} (${rel}) [${f.tag}] — ${f.text}`);\n    }\n  }\n  return warnings;\n}\n\n/** Asks the store whether it lists `ref` (`kind:@publisher/name`); rejects when it cannot be asked. */\ntype StoreHolds = (ref: string) => Promise<boolean>;\n\nasync function storeListsRef(ref: string): Promise<boolean> {\n  const remote = await openCatalogSource({ projectDir: process.cwd() });\n  return (await remote.resolve(ref)) !== null;\n}\n\ntype HolderAnswer = { listed: true } | { listed: false } | { error: string };\n\nasync function holdsAnswer(holds: StoreHolds, ref: string): Promise<HolderAnswer> {\n  try {\n    return { listed: await holds(ref) };\n  } catch (err) {\n    return { error: err instanceof Error ? err.message : String(err) };\n  }\n}\n\n/**\n * What the publish plan says about every `requires:` (asset file) and `dependencies:` (manifest)\n * ref that no registered library holds (p1200). `validate` and `library index` warn from what is\n * registered on this machine alone; the plan also asks the store. A store that lists the ref\n * says nothing; one that does not refuses the plan, since `add` would fail on the consumer's\n * side; one that cannot be asked only warns.\n */\nasync function storeHolderVerdicts(\n  assets: PlanAsset[],\n  manifest: SkPublishManifest,\n  dependencies: ManifestDependencyProblem[],\n  holds: StoreHolds,\n): Promise<{ refusals: string[]; warnings: string[] }> {\n  const wanted: Array<{ where: string; what: string; ref: string }> = [];\n  for (const { entry, rel, checked } of assets) {\n    for (const f of checked?.advisories ?? []) {\n      if (!f.unheldRef) continue;\n      wanted.push({\n        where: `${assetEntryRef(entry, manifest)} (${rel}) [${f.tag}]`,\n        what: \"requires\",\n        ref: f.unheldRef,\n      });\n    }\n  }\n  for (const p of dependencies) {\n    if (!p.unheldRef) continue;\n    wanted.push({\n      where: `${MANIFEST_FILENAME} [assets] — ${p.asset}`,\n      what: \"dependency\",\n      ref: p.unheldRef,\n    });\n  }\n  const answers = new Map<string, HolderAnswer>();\n  const out = { refusals: [] as string[], warnings: [] as string[] };\n  for (const { where, what, ref } of wanted) {\n    let answer = answers.get(ref);\n    if (answer === undefined) {\n      answer = await holdsAnswer(holds, ref);\n      answers.set(ref, answer);\n    }\n    if (\"listed\" in answer && answer.listed) continue;\n    const base = `${where} — ${what} \"${ref}\" is not held by any registered library`;\n    if (\"error\" in answer) {\n      out.warnings.push(\n        `${base} and the store could not be asked (${answer.error.split(\"\\n\")[0]}). \\`skaile add\\` fails for a consumer unless the store or a registered library holds it`,\n      );\n    } else {\n      out.refusals.push(\n        `${base} and the store does not list it, so \\`skaile add\\` would fail with \"${what} … not found\". Publish that asset first, register the library that holds it, or drop the ${what}.`,\n      );\n    }\n  }\n  return out;\n}\n\n/**\n * Advisory publish-plan warnings: a missing LICENSE (a public repo without one grants\n * consumers no rights), per-asset skill warnings ({@link assetWarnings}) and — for `publish`,\n * which runs `git add -A` — untracked files that would become public. Never throws; a\n * non-git directory simply yields no untracked warning.\n */\nfunction publishWarnings(\n  libPath: string,\n  spawn: SpawnLike,\n  skipPush: boolean,\n  manifest: SkPublishManifest,\n  assets: PlanAsset[],\n): string[] {\n  const warnings: string[] = [];\n  if (!existsSync(join(libPath, \"LICENSE\")) && !existsSync(join(libPath, \"LICENSE.md\"))) {\n    warnings.push(\n      \"No LICENSE or LICENSE.md in the library root — a public repo without a license grants consumers no rights to use it.\",\n    );\n  }\n  warnings.push(...assetWarnings(assets, manifest));\n  if (!skipPush) {\n    const status = runGit(spawn, libPath, [\"status\", \"--porcelain\", \"--untracked-files=all\"]);\n    if (status.status === 0) {\n      const lines = (status.stdout ?? \"\").toString().split(\"\\n\");\n      const untracked = lines.filter((l) => l.startsWith(\"?? \")).map((l) => l.slice(3));\n      if (untracked.length > 0) {\n        const shown = untracked.slice(0, MAX_LISTED_UNTRACKED).join(\", \");\n        const more =\n          untracked.length > MAX_LISTED_UNTRACKED\n            ? ` and ${untracked.length - MAX_LISTED_UNTRACKED} more`\n            : \"\";\n        warnings.push(\n          `${untracked.length} untracked file(s) will be committed by \\`git add -A\\` and published: ${shown}${more}.`,\n        );\n      }\n      // `git add -A` also stages every change of a tracked file: name them too.\n      const changed = lines\n        .filter((l) => l.length > 3 && !l.startsWith(\"?? \") && !l.startsWith(\"!! \"))\n        .map((l) => {\n          const code = l.slice(0, 2);\n          const label = code.includes(\"D\")\n            ? \"deleted\"\n            : code.includes(\"R\")\n              ? \"renamed\"\n              : code.includes(\"A\")\n                ? \"added\"\n                : \"modified\";\n          return `${label} ${l.slice(3)}`;\n        });\n      if (changed.length > 0) {\n        const shown = changed.slice(0, MAX_LISTED_UNTRACKED).join(\", \");\n        const more =\n          changed.length > MAX_LISTED_UNTRACKED\n            ? ` and ${changed.length - MAX_LISTED_UNTRACKED} more`\n            : \"\";\n        warnings.push(\n          `${changed.length} changed tracked file(s) will be committed by \\`git add -A\\` and published: ${shown}${more}.`,\n        );\n      }\n      // A secret the commit would publish: a `.env`, a private key (p704).\n      const secrets = lines\n        .filter((l) => l.length > 3 && !l.startsWith(\"!! \") && !l.slice(0, 2).includes(\"D\"))\n        .map((l) => l.slice(3).split(\" -> \").pop() ?? \"\")\n        .filter((file) => isSecretFileName(basename(file.replace(/^\"|\"$/g, \"\"))));\n      if (secrets.length > 0) {\n        warnings.push(\n          `${secrets.length} file(s) look like secrets and will be committed by \\`git add -A\\` and published: ${secrets.join(\", \")}. Delete them or add them to .gitignore.`,\n        );\n      }\n    }\n  }\n  return warnings;\n}\n\n/**\n * The store only registers PUBLIC repos (the backend rejects a private one with \"must be\n * public\"), so a repo provisioned with `--private` can be created and linked but not published.\n */\nconst PRIVATE_REPO_WARNING =\n  \"--private: the store only accepts PUBLIC repos — registering a private repo is rejected. \" +\n  \"The repo will be created private, but publishing it will fail; share it directly \" +\n  \"(`skaile source add <url>` with the consumer's own git credentials) instead.\";\n\n/**\n * Provision a GitHub repo `github.com/<you>/<name>` via `gh` (public unless `isPrivate`) and\n * return its https url. Parses the url `gh` prints on success. Throws on failure.\n */\nfunction createRepoViaGh(name: string, spawn: SpawnLike, isPrivate: boolean): string {\n  const res = spawn(\"gh\", [\"repo\", \"create\", name, isPrivate ? \"--private\" : \"--public\"], {\n    encoding: \"utf-8\",\n  });\n  if (res.status !== 0) {\n    const stderr = (res.stderr ?? \"\").toString().trim();\n    throw new Error(`gh repo create ${name} failed: ${stderr || `exit ${res.status}`}`);\n  }\n  // `gh repo create` prints the repo url (e.g. `https://github.com/<owner>/<name>`);\n  // scan combined output for the first github.com url so we capture whatever\n  // owner gh resolved (the authed user).\n  const out = `${res.stdout ?? \"\"}\\n${res.stderr ?? \"\"}`;\n  const match = out.match(/https:\\/\\/github\\.com\\/[^\\s]+/);\n  if (!match) {\n    throw new Error(`gh repo create ${name} succeeded but printed no repo url:\\n${out.trim()}`);\n  }\n  return match[0].replace(/\\.git$/, \"\").trim();\n}\n\n/** `--asset <ref>` split into its parts: `[kind:][@publisher/]name[#pin]`. */\ninterface AssetSelection {\n  kind?: string;\n  publisher?: string;\n  name: string;\n  pin?: string;\n}\n\nfunction parseAssetSelection(ref: string): AssetSelection {\n  const [head, ...pinParts] = ref.trim().split(\"#\");\n  const pin = pinParts.join(\"#\") || undefined;\n  const colon = head.indexOf(\":\");\n  const kind = colon > 0 ? head.slice(0, colon) : undefined;\n  const rest = colon > 0 ? head.slice(colon + 1) : head;\n  const scoped = rest.startsWith(\"@\") ? rest.indexOf(\"/\") : -1;\n  const publisher = scoped > 0 ? rest.slice(1, scoped) : undefined;\n  const name = scoped > 0 ? rest.slice(scoped + 1) : rest;\n  return { kind, publisher, name, pin };\n}\n\n/** The manifest entries `--asset` selects: same name, and kind / publisher when the ref names them. */\nfunction selectedEntries(manifest: SkPublishManifest, sel: AssetSelection): AssetEntry[] {\n  return (manifest.assets ?? []).filter(\n    (a) =>\n      a.name === sel.name &&\n      (!sel.kind || a.kind === sel.kind) &&\n      (!sel.publisher || assetNamespace(a, manifest) === sel.publisher),\n  );\n}\n\n/**\n * What the plan says about asset directories the manifest does not list - the ones\n * `skaile library index` would add or skip. A directory holding a kind + name the manifest\n * already names elsewhere is refused (index skips it and exits 1); a new asset the shared\n * checks reject is refused with the same finding text `validate` prints; a valid new asset is\n * refused as well, as `validate` does: the plan would not ship it, but `git add -A` would commit\n * its files (p1193).\n */\nasync function unlistedAssetProblems(\n  libPath: string,\n  manifest: SkPublishManifest,\n  libName: string,\n  targetName: string | undefined,\n  composeRefs: ComposeRefContext,\n): Promise<string[]> {\n  const refusals: string[] = [];\n  const registry = getKindRegistry();\n  const unlisted = await scanUnlistedAssets(\n    libPath,\n    manifest.publisher ?? libName,\n    registry,\n    UNLISTED_SCAN_SKIP_DIRS,\n  );\n  for (const u of unlisted) {\n    if (targetName && u.entry.name !== targetName) continue;\n    const rel = relative(libPath, u.entry.source);\n    if (u.registeredAt) {\n      refusals.push(\n        duplicateAssetMessage(\n          u.entry.kind,\n          u.entry.name,\n          u.root,\n          `already registered at \"${u.registeredAt}\"`,\n          libName,\n        ),\n      );\n      continue;\n    }\n    if (u.parseFailure) {\n      // `library index` rejects the file too: send the author to the file, not to the command.\n      refusals.push(\n        `${u.entry.kind}:${u.entry.name} (${rel}) [${u.entry.kind}] — ${manifestParseErrorText(u.parseFailure)}`,\n      );\n      continue;\n    }\n    const errors = checkAssetFile(u.entry.source, u.entry.kind, registry, libPath, composeRefs);\n    for (const f of errors)\n      refusals.push(`${u.entry.kind}:${u.entry.name} (${rel}) [${f.tag}] — ${f.text}`);\n    if (errors.length === 0) {\n      refusals.push(\n        `${u.entry.kind}:${u.entry.name} (${rel}) is on disk but not in the manifest, so it is not published; run \\`skaile library index ${libName}\\`.`,\n      );\n    }\n  }\n  return refusals;\n}\n\n/** Shared publish body for `publish` (pushes) and `register` (skips the push). */\nasync function publishLibrary(\n  name: string,\n  opts: {\n    asset?: string;\n    createRepo?: boolean;\n    private?: boolean;\n    ref?: string;\n    dryRun?: boolean;\n    skipPush: boolean;\n    /** Asks the store whether it lists a ref; injected by tests. */\n    storeHolds?: StoreHolds;\n  },\n  client?: PublisherClient,\n  spawn: SpawnLike = spawnSync,\n): Promise<void> {\n  exitOnEmptyAsset(opts.asset);\n  const injected = client !== undefined;\n  const { manager, close } = await openLibraryManager();\n  try {\n    const lib = await manager.requireLibraryDir(name);\n    const manifest = loadManifest(lib.path);\n\n    // A publisher that is not a valid slug would publish refs `add` cannot parse: refuse\n    // (dry-run included) with the text `library index` and `validate` print.\n    exitOnManifestPublisherProblems(lib.path, name);\n    // The same symlink refusal as `validate` and `library index`.\n    exitOnLibrarySymlinks(lib.path, `skaile library publish ${name}`);\n    // A `root:` or `files:` entry outside the library, through a symlink or naming a missing file is never found by `add` (p701, p1403, p1404).\n    exitOnManifestPathProblems(lib.path, `skaile library publish ${name}`);\n\n    // A manifest entry whose directory is gone would publish a catalog entry\n    // that points at nothing — refuse (dry-run included) rather than plan it.\n    const missing = missingRootAssets(lib.path, manifest);\n    if (missing.length > 0) {\n      for (const a of missing) {\n        logErr(`${assetEntryRef(a, manifest)} — root \"${a.root}\" does not exist in the library.`);\n      }\n      logErr(\n        \"The manifest lists assets that are no longer on disk. Run \" +\n          `\\`skaile library index ${name}\\` to drop them from the manifest, then re-run.`,\n      );\n      process.exit(1);\n    }\n\n    // `--asset` must select something: a plan of 0 assets that exits 0 reads as a publish.\n    const selection = opts.asset ? parseAssetSelection(opts.asset) : undefined;\n    if (opts.asset && selection && selectedEntries(manifest, selection).length === 0) {\n      const listed = (manifest.assets ?? []).map((a) => assetEntryRef(a, manifest));\n      logErr(\n        `No asset matches \"${opts.asset}\" in library \"${name}\"` +\n          (listed.length > 0\n            ? ` (the manifest lists: ${listed.join(\", \")}).`\n            : \" (the manifest lists no assets).\"),\n      );\n      process.exit(1);\n    }\n\n    // `--ref` must name a ref the library repo has: a plan for `source ref: nosuchref` reads as a\n    // publish of it.\n    if (opts.ref !== undefined) exitOnUnknownRef(lib.path, name, opts.ref, spawn);\n\n    // Resolve the remote: git-backed → its url; local + --create-repo → provision\n    // and link; else stop with a hint.\n    let remoteUrl = remoteUrlOf(lib);\n    let wouldCreateRepo = false;\n    if (opts.private && !opts.createRepo) {\n      logErr(\n        \"--private only applies together with --create-repo (it sets the new repo's visibility).\",\n      );\n      process.exit(1);\n    }\n    const visibility = opts.private ? \"private\" : \"public\";\n    if (!remoteUrl) {\n      if (opts.createRepo) {\n        if (opts.private) logWarn(PRIVATE_REPO_WARNING);\n        if (opts.dryRun) {\n          // A dry-run must not provision anything — defer the real\n          // `gh repo create` to the live run and just show the would-be remote.\n          wouldCreateRepo = true;\n          remoteUrl = `https://github.com/<your-account>/${lib.name}`;\n        } else {\n          remoteUrl = createRepoViaGh(lib.name, spawn, opts.private === true);\n          await manager.updateLibrary(name, {\n            backend: \"git\",\n            backendConfig: { url: remoteUrl, branch: \"main\", authHint: \"ssh\" },\n          });\n          logOk(`Created + linked ${S.dim(remoteUrl)} (${visibility}).`);\n        }\n      } else {\n        logErr(\n          `Library \"${name}\" has no remote — run ${S.cmd(`skaile library link ${name} <url>`)} ` +\n            \"first, or pass `--create-repo` to provision a public repo.\",\n        );\n        process.exit(1);\n      }\n    } else if (!isGithubRemote(remoteUrl)) {\n      // Plan-phase gate (dry-run and real): the store fetches from GitHub, so a\n      // local-path / other-host remote can never be published. A remote here means\n      // the library is already git-backed, where `library link` refuses.\n      logErr(notGithubRemoteMessage(name, remoteUrl));\n      process.exit(1);\n    }\n\n    // Each asset publishes under `assets[].publisher ?? manifest.publisher`\n    // (first-party — no remap), so one library can span several namespaces.\n    const targetName = opts.asset ? bareName(opts.asset) : undefined;\n    const namespaces = manifestNamespaces(manifest, targetName);\n\n    // An asset whose manifest file cannot be parsed or carries a non-semver version\n    // must not be planned (dry-run included): it would publish as a broken entry.\n    // An agent's `composes:` refs resolve as in `validate` and `library index` (p415).\n    const composeRefs = composeRefContext(\n      scanIdentities(lib.path),\n      await registeredAssetKeys(lib.path),\n      manifest.publisher,\n    );\n    const assets = planAssets(lib.path, manifest, targetName, composeRefs);\n    const wouldBeRefs = plannedRefs(manifestWithFileVersions(manifest, assets), targetName);\n    const unlisted = await unlistedAssetProblems(lib.path, manifest, name, targetName, composeRefs);\n    // A manifest `dependencies:` entry `validate` and `index` reject would ship as an unresolvable ref.\n    const requiresRefusals = manifestRequiresProblems(lib.path)\n      .filter((p) => !targetName || p.asset.endsWith(`:${targetName}`))\n      .map(\n        (p) =>\n          `${MANIFEST_FILENAME} [assets] — ${p.asset}: ${p.message}. ` +\n          \"Use the `kind:@<publisher>/name[#version]` form.\",\n      );\n    // A `requires:` / `dependencies:` ref no registered library holds: the store has the last word.\n    const unheldDependencies = (await manifestDependencyProblems(lib.path)).filter(\n      (p) => p.unheldRef && (!targetName || p.asset.endsWith(`:${targetName}`)),\n    );\n    const storeVerdicts = await storeHolderVerdicts(\n      assets,\n      manifest,\n      unheldDependencies,\n      opts.storeHolds ?? storeListsRef,\n    );\n    const refusals = [\n      ...assetRefusals(assets, manifest),\n      ...requiresRefusals,\n      ...unlisted,\n      ...storeVerdicts.refusals,\n    ];\n    if (selection?.pin !== undefined) {\n      const held = selectedEntries(manifest, selection).map((e) => {\n        const planned = assets.find((a) => a.entry === e);\n        const fileVersion = planned?.parsed.ok ? declaredVersion(planned.parsed.data) : undefined;\n        return fileVersion ?? e.version ?? manifest.version;\n      });\n      if (!held.some((v) => v !== undefined && matchPin(selection.pin, v))) {\n        logErr(\n          `${opts.asset}: the library holds ${held.filter((v) => v).join(\", \") || \"no version\"} of this asset, not #${selection.pin}. ` +\n            \"A publish ships the version in the asset file; drop the pin or change the file version.\",\n        );\n        process.exit(1);\n      }\n    }\n    if (refusals.length > 0) {\n      for (const r of refusals) logErr(r);\n      logErr(\n        \"These assets cannot be published. Fix them (see `skaile validate`), then run \" +\n          `\\`skaile library index ${name}\\` and re-run.`,\n      );\n      process.exit(1);\n    }\n\n    // The store records the version of the manifest it finds in the pushed repo, so\n    // the plan (file versions) and the publish only agree when the entries match the\n    // files. `publish` rewrites them before it commits; `register` pushes nothing,\n    // so it cannot, and stops instead.\n    const drift = versionDrift(assets, manifest);\n    if (drift.length > 0 && opts.skipPush) {\n      for (const d of drift) logErr(describeDrift(d));\n      logErr(\n        \"register publishes the remote HEAD as-is, so these manifest versions would be recorded \" +\n          `instead of the file versions. Run \\`skaile library index ${name}\\`, commit and push, then re-run.`,\n      );\n      process.exit(1);\n    }\n\n    const sourceRef = opts.ref ?? branchOf(lib);\n    const warnings = [\n      ...publishWarnings(lib.path, spawn, opts.skipPush, manifest, assets),\n      ...storeVerdicts.warnings,\n    ];\n\n    if (opts.dryRun) {\n      logInfo(`Publish plan for ${S.bold(name)}:`);\n      logInfo(\n        `  remote:     ${remoteUrl}${wouldCreateRepo ? `  (would be created ${visibility} via \\`gh repo create --${visibility}\\`)` : \"\"}`,\n      );\n      logInfo(\n        `  publisher:  ${namespaces.length > 0 ? namespaces.join(\", \") : \"<manifest publisher>\"}`,\n      );\n      // Best-effort namespace-availability probe — a read-only GET, only when\n      // signed in (or a client is injected). A failure keeps dry-run offline-safe.\n      const canCheck = injected || isStoreAuthenticated();\n      if (!canCheck) {\n        // The real run stops at \"Not signed in\" before any namespace check.\n        logWarn(\"namespace check skipped: not signed in (run `skaile store login`)\");\n      } else if (namespaces.length > 0) {\n        for (const ns of namespaces) {\n          try {\n            const avail = await (client ?? makeHttpPublisherClient()).namespaceAvailability(ns);\n            const prefix = namespaces.length > 1 ? `@${ns} — ` : \"\";\n            logInfo(`  namespace:  ${prefix}${formatNamespaceAvailability(avail)}`);\n          } catch {\n            // Store unreachable / not signed in — skip the advisory, never fail.\n          }\n        }\n      }\n      logInfo(`  source ref: ${sourceRef}`);\n      logInfo(`  would publish ${wouldBeRefs.length} asset(s):`);\n      for (const r of wouldBeRefs) logInfo(`    ${r}`);\n      for (const d of drift) logInfo(`  would update the manifest: ${describeDrift(d)}`);\n      for (const w of warnings) logWarn(w);\n      return;\n    }\n\n    // Real run: surface the same advisories before anything is pushed.\n    for (const w of warnings) logWarn(w);\n\n    // A real publish makes store calls, so it needs a token (injected fakes bypass).\n    if (!injected && !isStoreAuthenticated()) {\n      logErr(\"Not signed in — run `skaile store login` first.\");\n      process.exit(1);\n    }\n\n    const pub = client ?? makeHttpPublisherClient();\n\n    // Preflight EVERY distinct namespace BEFORE the public git push, so a\n    // reserved/unclaimed one fails fast with guidance instead of after publishing bytes.\n    for (const ns of namespaces) {\n      const gate = await preflightNamespace(pub, ns);\n      if (!gate.ok) {\n        logErr(gate.message ?? `Cannot publish under @${ns}.`);\n        process.exit(1);\n      }\n    }\n\n    // Bring the entries to the file versions the plan showed, before they are committed.\n    for (const d of drift) {\n      upsertManifestAsset(lib.path, {\n        kind: d.asset.entry.kind,\n        name: d.asset.entry.name,\n        root: d.asset.entry.root ?? \"\",\n        version: d.fileVersion,\n      });\n      logInfo(`Updated the manifest: ${describeDrift(d)}`);\n    }\n\n    // publish commits + pushes the library repo; register takes the remote HEAD as-is.\n    if (!opts.skipPush) {\n      // `git add -A` stages every non-ignored file → a PUBLIC push. Surface it so\n      // an unexpected file in the working tree is not silently published.\n      logInfo(\n        `Committing the library and pushing to the PUBLIC remote ${S.dim(remoteUrl)} ` +\n          \"(.gitignore honored; anything else in the working tree becomes public).\",\n      );\n      commitAndPush({ libPath: lib.path, remoteUrl, branch: branchOf(lib), spawn });\n      logOk(`Pushed ${S.dim(name)} to ${S.dim(remoteUrl)}.`);\n    }\n\n    const { published } = await publishToStore({\n      sourceUrl: remoteUrl,\n      ref: sourceRef,\n      manifest: manifestWithFileVersions(manifest, assets),\n      assetName: targetName,\n      client: pub,\n    });\n\n    if (published.length > 0) {\n      logInfo(`Consumers can now \\`skaile add ${published[0]}\\`.`);\n    }\n  } finally {\n    close();\n  }\n}\n\n/**\n * `skaile library publish <lib>` — commit + push the library repo, register +\n * sync it as a store source, and publish its manifest's assets under the\n * manifest publisher. See the module header for the full flow.\n */\nexport async function runLibraryPublish(\n  name: string,\n  opts: {\n    asset?: string;\n    createRepo?: boolean;\n    private?: boolean;\n    ref?: string;\n    dryRun?: boolean;\n    storeHolds?: StoreHolds;\n  },\n  client?: PublisherClient,\n  spawn: SpawnLike = spawnSync,\n): Promise<void> {\n  await publishLibrary(name, { ...opts, skipPush: false }, client, spawn);\n}\n\n/**\n * `skaile library register <lib>` — same as publish but skips the commit/push\n * (the bytes are already on GitHub at the current remote HEAD). Still requires a\n * git-backed remote.\n */\nexport async function runLibraryRegister(\n  name: string,\n  opts: { asset?: string; ref?: string; dryRun?: boolean },\n  client?: PublisherClient,\n  spawn: SpawnLike = spawnSync,\n): Promise<void> {\n  await publishLibrary(name, { ...opts, skipPush: true }, client, spawn);\n}\n\n/**\n * `skaile library yank <lib>` — unpublish the library's published assets from\n * the store (all, or the single asset matching `opts.asset`'s name).\n * Auth-gated like publish.\n */\nexport async function runLibraryYank(\n  name: string,\n  opts: { asset?: string },\n  client?: PublisherClient,\n): Promise<void> {\n  exitOnEmptyAsset(opts.asset);\n  const injected = client !== undefined;\n  const { manager, close } = await openLibraryManager();\n  try {\n    const lib = await manager.requireLibrary(name);\n    const remoteUrl = remoteUrlOf(lib);\n    if (!remoteUrl) {\n      logErr(`Library \"${name}\" has no remote — nothing published to yank.`);\n      process.exit(1);\n    }\n\n    if (!injected && !isStoreAuthenticated()) {\n      logErr(\"Not signed in — run `skaile store login` first.\");\n      process.exit(1);\n    }\n\n    const pub = client ?? makeHttpPublisherClient();\n    const rows = await pub.sourcesList();\n    const source = rows.find((r) => r.url === remoteUrl);\n    if (!source) {\n      logErr(`Library \"${name}\" is not registered in the store — nothing to yank.`);\n      process.exit(1);\n    }\n\n    const targetName = opts.asset ? bareName(opts.asset) : undefined;\n    const candidates = (await pub.sourceCandidates(source.id)).filter(\n      (c) => c.published && (!targetName || c.name === targetName),\n    );\n    if (candidates.length === 0) {\n      logInfo(\"No published assets matched — nothing to yank.\");\n      return;\n    }\n\n    // Report each yanked asset under its own namespace\n    // (`assets[].publisher ?? manifest.publisher`); fall back to `kind:name`\n    // when the manifest is absent or declares no namespace for it.\n    const manifest = loadSkPublishManifest(lib.path);\n    const yanked: string[] = [];\n    for (const c of candidates) {\n      try {\n        await pub.assetUnpublish(c.id);\n        const entry = manifest?.assets?.find((a) => a.kind === c.kind && a.name === c.name);\n        const ns = manifest && entry ? assetNamespace(entry, manifest) : undefined;\n        yanked.push(ns ? refFor(c.kind, ns, c.name, c.version) : `${c.kind}:${c.name}`);\n      } catch (err) {\n        logErr(\n          `Failed to yank ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`,\n        );\n      }\n    }\n\n    logOk(`Yanked ${yanked.length} asset(s):`);\n    for (const r of yanked) logInfo(`  ${r}`);\n  } finally {\n    close();\n  }\n}\n"]}