@skaile/workspaces 6.9.1 → 6.10.0

package/dist/{chunk-MDCI4RSG.js → chunk-RZL4TOK3.js}

@@ -1,7 +1,7 @@
 import { isRetentionValue } from './chunk-C3CAXQMA.js';
 import { NoOpSink, StdoutSink, LogStore } from './chunk-BOFL7GIF.js';
-import { existsSync, readFileSync, writeFileSync, chmodSync, mkdirSync } from 'fs';
-import path, { join } from 'path';
+import { existsSync, readFileSync, writeFileSync, chmodSync, mkdirSync, realpathSync } from 'fs';
+import path, { join, resolve, dirname } from 'path';
 import { createRequire } from 'module';
 import { createHash } from 'crypto';
 
@@ -21,11 +21,25 @@ var WHOLE_SKAILE_FOLDER = [
   "/.skaile/",
   ".skaile/*"
 ];
+function insideGitWorkTree(dir) {
+  let current;
+  try {
+    current = realpathSync(resolve(dir));
+  } catch {
+    current = resolve(dir);
+  }
+  for (; ; ) {
+    if (existsSync(join(current, ".git"))) return true;
+    const parent = dirname(current);
+    if (parent === current) return false;
+    current = parent;
+  }
+}
 function ensureRunStateIgnored(projectDir) {
   const gitignore = join(projectDir, ".gitignore");
   try {
     if (!existsSync(join(projectDir, "skaile.yaml"))) return [];
-    if (!existsSync(join(projectDir, ".git"))) return [];
+    if (!insideGitWorkTree(projectDir)) return [];
     const existing = existsSync(gitignore) ? readFileSync(gitignore, "utf-8") : "";
     const have = new Set(existing.split("\n").map((l) => l.trim()));
     if (WHOLE_SKAILE_FOLDER.some((l) => have.has(l))) return [];
@@ -325,7 +339,7 @@ function resolveLogsRetention(configured) {
   };
 }
 function yieldToEventLoop() {
-  return new Promise((resolve) => setImmediate(resolve));
+  return new Promise((resolve2) => setImmediate(resolve2));
 }
 async function runBoundedTrim(stmt, params) {
   let deleted = 0;
@@ -478,5 +492,5 @@ var WsLogSink = class {
 };
 
 export { DEFAULT_LOGS_RETENTION, OnLogBridgeSink, RUN_STATE_GITIGNORE_ENTRIES, SqliteSink, WsLogSink, createLogStoreFromConfig, enforceLogsRetention, ensureRunStateIgnored, openSqlite, pathFingerprint, pathTag, resolveLogStoreConfig, resolveLogsRetention, scrubLogText };
-//# sourceMappingURL=chunk-MDCI4RSG.js.map
-//# sourceMappingURL=chunk-MDCI4RSG.js.map
+//# sourceMappingURL=chunk-RZL4TOK3.js.map
+//# sourceMappingURL=chunk-RZL4TOK3.js.map

package/dist/chunk-RZL4TOK3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/src/run-state-ignore.ts","../core/src/logging/sinks/sqlite-runtime.ts","../core/src/logging/sinks/sqlite-sink.ts","../core/src/logging/config.ts","../core/src/logging/retention.ts","../core/src/logging/log-safe-text.ts","../core/src/logging/sinks/on-log-bridge-sink.ts","../core/src/logging/sinks/ws-log-sink.ts"],"names":["path","resolve","existsSync"],"mappings":";;;;;;;AAUO,IAAM,2BAAA,GAAiD;AAAA,EAC5D,2BAAA;AAAA,EACA,sCAAA;AAAA;AAAA,EAEA,kBAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EAEA;AACF;AAGA,IAAM,mBAAA,GAAyC;AAAA,EAC7C,SAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA;AAMA,SAAS,kBAAkB,GAAA,EAAsB;AAC/C,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,EACrC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,GAAU,QAAQ,GAAG,CAAA;AAAA,EACvB;AACA,EAAA,WAAS;AACP,IAAA,IAAI,WAAW,IAAA,CAAK,OAAA,EAAS,MAAM,CAAC,GAAG,OAAO,IAAA;AAC9C,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAO,CAAA;AAC9B,IAAA,IAAI,MAAA,KAAW,SAAS,OAAO,KAAA;AAC/B,IAAA,OAAA,GAAU,MAAA;AAAA,EACZ;AACF;AAcO,SAAS,sBAAsB,UAAA,EAA8B;AAClE,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAC/C,EAAA,IAAI;AACF,IAAA,IAAI,CAAC,WAAW,IAAA,CAAK,UAAA,EAAY,aAAa,CAAC,CAAA,SAAU,EAAC;AAC1D,IAAA,IAAI,CAAC,iBAAA,CAAkB,UAAU,CAAA,SAAU,EAAC;AAC5C,IAAA,MAAM,WAAW,UAAA,CAAW,SAAS,IAAI,YAAA,CAAa,SAAA,EAAW,OAAO,CAAA,GAAI,EAAA;AAC5E,IAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC9D,IAAA,IAAI,mBAAA,CAAoB,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA,EAAG,OAAO,EAAC;AAC1D,IAAA,MAAM,OAAA,GAAU,4BAA4B,MAAA,CAAO,CAAC,MAAM,CAAC,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AACtE,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAClC,IAAA,MAAM,SAAS,QAAA,IAAY,CAAC,SAAS,QAAA,CAAS,IAAI,IAAI,IAAA,GAAO,EAAA;AAC7D,IAAA,aAAA,CAAc,SAAA,EAAW,GAAG,QAAQ,CAAA,EAAG,MAAM,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA;AACtE,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AC7DA,IAAM,WAAA,GAAc,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAGjD,IAAM,KAAA,GAAQ,OAAQ,UAAA,CAAiC,GAAA,KAAQ,WAAA;AAyC/D,SAAS,cAAc,IAAA,EAAuC;AAC5D,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,MAAA,KAAW;AACf,MAAA,MAAM,GAAA,GAAO,WAAW,MAAA,GAAY,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,IAAI,MAAM,CAAA;AAGhE,MAAA,OAAO,EAAE,OAAA,EAAS,MAAA,CAAO,GAAA,EAAK,OAAA,IAAW,CAAC,CAAA,EAAE;AAAA,IAC9C,CAAA;AAAA,IACA,GAAA,EAAK,CAAC,MAAA,KAAY,MAAA,KAAW,MAAA,GAAY,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAAA,IACrE,GAAA,EAAK,CAAC,MAAA,KAAY,MAAA,KAAW,MAAA,GAAY,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,GAAA,CAAI,MAAM;AAAA,GACvE;AACF;AAEA,SAAS,aAAA,CAAcA,OAAc,IAAA,EAA2C;AAC9E,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,WAAA,CAAY,YAAY,CAAA;AAQ7C,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAASA,KAAAA,EAAM,EAAE,QAAA,EAAU,IAAA,EAAM,CAAA,GAAI,IAAI,SAASA,KAAI,CAAA;AACrF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,CAAC,GAAA,KAAQ;AACb,MAAA,EAAA,CAAG,KAAK,GAAG,CAAA;AAAA,IACb,CAAA;AAAA,IACA,SAAS,CAAC,GAAA,KAAQ,cAAc,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,IAC/C,WAAA,EAAa,CAAC,EAAA,KAAO,EAAA,CAAG,YAAY,EAAE,CAAA;AAAA,IACtC,OAAO,MAAM;AACX,MAAA,EAAA,CAAG,KAAA,EAAM;AAAA,IACX;AAAA,GACF;AACF;AAQA,SAAS,iBAAA,GAEP;AACA,EAAA,MAAM,WAAW,OAAA,CAAQ,WAAA;AACzB,EAAA,OAAA,CAAQ,WAAA,GAAc,SAAyB,OAAA,EAAA,GAA4B,IAAA,EAAiB;AAC1F,IAAA,MAAM,KAAA,GAAQ,KAAK,CAAC,CAAA;AACpB,IAAA,MAAM,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,QAAS,KAAA,EAAyC,IAAA;AAC3F,IAAA,MAAM,IAAA,GAAO,OAAO,OAAA,KAAY,QAAA,GAAW,UAAU,OAAA,EAAS,OAAA;AAC9D,IAAA,IAAI,SAAS,qBAAA,IAAyB,SAAA,CAAU,IAAA,CAAK,IAAA,IAAQ,EAAE,CAAA,EAAG;AAClE,IAAA,OAAQ,QAAA,CAAuC,IAAA,CAAK,OAAA,EAAS,OAAA,EAAS,GAAG,IAAI,CAAA;AAAA,EAC/E,CAAA;AACA,EAAA,IAAI;AACF,IAAA,OAAO,YAAY,aAAa,CAAA;AAAA,EAClC,CAAA,SAAE;AACA,IAAA,OAAA,CAAQ,WAAA,GAAc,QAAA;AAAA,EACxB;AACF;AAEA,SAAS,cAAA,CAAeA,OAAc,IAAA,EAA2C;AAC/E,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,iBAAA,EAAkB;AAC3C,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,GAAW,IAAI,YAAA,CAAaA,KAAAA,EAAM,EAAE,QAAA,EAAU,IAAA,EAAM,CAAA,GAAI,IAAI,aAAaA,KAAI,CAAA;AAC7F,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,CAAC,GAAA,KAAQ;AACb,MAAA,EAAA,CAAG,KAAK,GAAG,CAAA;AAAA,IACb,CAAA;AAAA,IACA,SAAS,CAAC,GAAA,KAAQ,cAAc,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,IAC/C,WAAA,EACE,CAAC,EAAA,KACD,CAAA,GAAI,IAAA,KAAS;AACX,MAAA,EAAA,CAAG,KAAK,OAAO,CAAA;AACf,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,GAAG,IAAI,CAAA;AACV,QAAA,EAAA,CAAG,KAAK,QAAQ,CAAA;AAAA,MAClB,SAAS,GAAA,EAAK;AACZ,QAAA,EAAA,CAAG,KAAK,UAAU,CAAA;AAClB,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IACF,OAAO,MAAM;AACX,MAAA,EAAA,CAAG,KAAA,EAAM;AAAA,IACX;AAAA,GACF;AACF;AAMO,SAAS,UAAA,CAAWA,KAAAA,EAAc,IAAA,GAA0B,EAAC,EAAqB;AACvF,EAAA,OAAO,QAAQ,aAAA,CAAcA,KAAAA,EAAM,IAAI,CAAA,GAAI,cAAA,CAAeA,OAAM,IAAI,CAAA;AACtE;;;AC7IA,IAAM,MAAA,GAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA+BR,IAAM,aAAN,MAAoC;AAAA,EACjC,EAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA,GAAS,KAAA;AAAA,EAEjB,YAAY,IAAA,EAAyB;AACnC,IAAA,IAAA,CAAK,EAAA,GAAK,UAAA,CAAW,IAAA,CAAK,IAAI,CAAA;AAC9B,IAAA,IAAI,IAAA,CAAK,SAAS,UAAA,EAAY;AAE5B,MAAA,IAAA,CAAK,EAAA,CAAG,KAAK,4BAA4B,CAAA;AACzC,MAAA,IAAA,CAAK,EAAA,CAAG,KAAK,2BAA2B,CAAA;AAAA,IAC1C;AACA,IAAA,IAAA,CAAK,EAAA,CAAG,KAAK,MAAM,CAAA;AACnB,IAAA,IAAI,IAAA,CAAK,SAAS,UAAA,EAAY;AAE5B,MAAA,iBAAA,CAAkB,KAAK,IAAI,CAAA;AAAA,IAC7B;AACA,IAAA,IAAA,CAAK,UAAA,GAAa,KAAK,EAAA,CAAG,OAAA;AAAA,MACxB,CAAA;AAAA,mHAAA;AAAA,KAEF;AACA,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,EAAA,CAAG,WAAA,CAAY,CAAC,OAAA,KAAwB;AAC7D,MAAA,KAAA,MAAW,CAAA,IAAK,SAAS,IAAA,CAAK,UAAA,CAAW,IAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,IAC5D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,KAAA,EAAuB;AAC3B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,WAAW,OAAA,EAA2B;AACpC,IAAA,IAAI,IAAA,CAAK,MAAA,IAAU,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACzC,IAAA,IAAA,CAAK,WAAW,OAAO,CAAA;AAAA,EACzB;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,EAChB;AAAA,EAEA,MAAM,CAAA,EAA6B;AACjC,IAAA,IAAI,KAAK,MAAA,EAAQ,OAAO,EAAE,OAAA,EAAS,EAAC,EAAE;AACtC,IAAA,MAAM,KAAA,GAAkB,CAAC,yBAAyB,CAAA;AAClD,IAAA,MAAM,MAAA,GAAkC,EAAE,UAAA,EAAY,CAAA,CAAE,SAAA,EAAU;AAElE,IAAA,IAAI,CAAA,CAAE,QAAQ,IAAA,EAAM;AAClB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,MAAA,CAAO,KAAA,GAAQ,EAAE,MAAA,CAAO,IAAA;AAAA,IAC1B;AACA,IAAA,IAAI,CAAA,CAAE,QAAQ,OAAA,EAAS;AACrB,MAAA,KAAA,CAAM,KAAK,oBAAoB,CAAA;AAC/B,MAAA,MAAA,CAAO,QAAA,GAAW,EAAE,MAAA,CAAO,OAAA;AAAA,IAC7B;AACA,IAAA,IAAI,CAAA,CAAE,QAAQ,QAAA,EAAU;AACtB,MAAA,KAAA,CAAM,KAAK,sBAAsB,CAAA;AACjC,MAAA,MAAA,CAAO,SAAA,GAAY,EAAE,MAAA,CAAO,QAAA;AAAA,IAC9B;AACA,IAAA,IAAI,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,EAAG;AACnC,MAAA,MAAM,YAAA,GAAe,CAAA,CAAE,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AACnE,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,UAAA,EAAa,YAAY,CAAA,CAAA,CAAG,CAAA;AACvC,MAAA,CAAA,CAAE,MAAA,CAAO,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AAC3B,QAAA,MAAA,CAAO,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA,GAAI,GAAA;AAAA,MACzB,CAAC,CAAA;AAAA,IACH;AACA,IAAA,IAAI,EAAE,KAAA,EAAO;AACX,MAAA,KAAA,CAAM,KAAK,qBAAqB,CAAA;AAChC,MAAA,MAAA,CAAO,SAAS,CAAA,CAAE,KAAA;AAAA,IACpB;AACA,IAAA,IAAI,EAAE,KAAA,EAAO;AACX,MAAA,KAAA,CAAM,KAAK,oBAAoB,CAAA;AAC/B,MAAA,MAAA,CAAO,SAAS,CAAA,CAAE,KAAA;AAAA,IACpB;AACA,IAAA,IAAI,EAAE,MAAA,EAAQ;AAGZ,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,OAAA,CAAQ,WAAW,MAAM,CAAA;AAClD,MAAA,KAAA,CAAM,KAAK,kCAAkC,CAAA;AAC7C,MAAA,MAAA,CAAO,OAAA,GAAU,IAAI,OAAO,CAAA,CAAA,CAAA;AAAA,IAC9B;AACA,IAAA,IAAI,EAAE,MAAA,EAAQ;AACZ,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,MAAA,CAAO,UAAU,CAAA,CAAE,MAAA;AAAA,IACrB;AAEA,IAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,KAAA,IAAS,KAAK,GAAI,CAAA;AAC3C,IAAA,MAAA,CAAO,SAAS,KAAA,GAAQ,CAAA;AAExB,IAAA,MAAM,GAAA,GAAM,CAAA;AAAA;AAAA,YAAA,EAEF,KAAA,CAAM,IAAA,CAAK,OAAO,CAAC;AAAA;AAAA,kBAAA,CAAA;AAI7B,IAAA,MAAM,OAAO,IAAA,CAAK,EAAA,CAAG,QAAQ,GAAG,CAAA,CAAE,IAAiB,MAAM,CAAA;AAEzD,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,KAAA;AAC9B,IAAA,MAAM,SAAS,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,IAAA;AAChD,IAAA,MAAM,OAAA,GAAsB,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MAC7C,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,WAAW,CAAA,CAAE,SAAA;AAAA,MACb,WAAW,CAAA,CAAE,UAAA;AAAA,MACb,MAAA,EAAQ;AAAA,QACN,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,QAAA,EAAU,EAAE,QAAA,IAAY;AAAA,OAC1B;AAAA,MACA,OAAO,CAAA,CAAE,KAAA;AAAA,MACT,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,MAAM,CAAA,CAAE,SAAA,GAAY,KAAK,KAAA,CAAM,CAAA,CAAE,SAAS,CAAA,GAAI,MAAA;AAAA,MAC9C,OAAO,CAAA,CAAE,UAAA,GAAa,KAAK,KAAA,CAAM,CAAA,CAAE,UAAU,CAAA,GAAI;AAAA,KACnD,CAAE,CAAA;AAEF,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,YAAY,OAAA,GAAU,OAAA,CAAQ,QAAQ,MAAA,GAAS,CAAC,EAAE,EAAA,GAAK;AAAA,KACzD;AAAA,EACF;AAAA;AAAA;AAAA,EAIQ,MAAM,CAAA,EAAsC;AAClD,IAAA,OAAO;AAAA,MACL,KAAK,CAAA,CAAE,EAAA;AAAA,MACP,YAAY,CAAA,CAAE,SAAA;AAAA,MACd,aAAa,CAAA,CAAE,SAAA;AAAA,MACf,KAAA,EAAO,EAAE,MAAA,CAAO,IAAA;AAAA,MAChB,QAAA,EAAU,EAAE,MAAA,CAAO,OAAA;AAAA,MACnB,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,QAAA,IAAY,IAAA;AAAA,MAChC,QAAQ,CAAA,CAAE,KAAA;AAAA,MACV,UAAU,CAAA,CAAE,OAAA;AAAA,MACZ,YAAY,CAAA,CAAE,IAAA,GAAO,KAAK,SAAA,CAAU,CAAA,CAAE,IAAI,CAAA,GAAI,IAAA;AAAA,MAC9C,aAAa,CAAA,CAAE,KAAA,GAAQ,KAAK,SAAA,CAAU,CAAA,CAAE,KAAK,CAAA,GAAI;AAAA,KACnD;AAAA,EACF;AACF;AAMA,SAAS,kBAAkB,MAAA,EAAsB;AAC/C,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,IAAA,CAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,IAAA,CAAM,CAAA,EAAG;AAC1D,IAAA,IAAI;AACF,MAAA,SAAA,CAAU,GAAG,GAAK,CAAA;AAAA,IACpB,CAAA,CAAA,MAAQ;AAAA,IAGR;AAAA,EACF;AACF;;;ACvLA,IAAM,WAAA,GAA8B,CAAC,YAAA,EAAc,WAAA,EAAa,KAAK,CAAA;AACrE,IAAM,YAAA,GAA2B,CAAC,OAAA,EAAS,MAAA,EAAQ,QAAQ,OAAO,CAAA;AAY3D,SAAS,sBAAsB,KAAA,EAAmD;AACvF,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,SAAA,IAAa,EAAC;AACjC,EAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,eAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,QAAQ,GAAA,CAAI,gBAAA;AAE7B,EAAA,MAAM,IAAA,GAAO,OAAA,IAAW,IAAA,CAAK,IAAA,IAAQ,YAAA;AACrC,EAAA,IAAI,CAAC,WAAA,CAAY,QAAA,CAAS,IAAI,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,IAAI,CAAA,CAAE,CAAA;AAAA,EACjD;AACA,EAAA,MAAM,KAAA,GAAQ,QAAA,IAAY,IAAA,CAAK,KAAA,IAAS,MAAA;AACxC,EAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,KAAK,CAAA,CAAE,CAAA;AAAA,EACnD;AAEA,EAAA,OAAO;AAAA,IACL,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,IAAA;AAAA,IACA,KAAA;AAAA,IACA,WAAW,IAAA,CAAK;AAAA,GAClB;AACF;AAWO,SAAS,wBAAA,CACd,GAAA,EACA,IAAA,GAA8B,EAAC,EACrB;AACV,EAAA,MAAM,QAAQ,EAAC;AACf,EAAA,IAAI,GAAA,CAAI,SAAS,KAAA,EAAO;AACtB,IAAA,KAAA,CAAM,IAAA,CAAK,IAAI,QAAA,EAAU,CAAA;AAAA,EAC3B,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,WAAA,EAAa;AACnC,IAAA,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,EAAE,IAAA,EAAM,UAAA,EAAY,CAAC,CAAA;AAAA,EACjD,CAAA,MAAO;AACL,IAAA,IAAI,CAAC,IAAI,aAAA,EAAe;AACtB,MAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,IAClE;AACA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,eAAe,SAAS,CAAA;AAClD,IAAA,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAClC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AACvC,IAAA,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAC,CAAA;AAC3C,IAAA,qBAAA,CAAsB,IAAI,aAAa,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,KAAK,MAAA,KAAW,KAAA,QAAa,IAAA,CAAK,IAAI,YAAY,CAAA;AACtD,EAAA,OAAO,IAAI,QAAA,CAAS;AAAA,IAClB,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,OAAO,GAAA,CAAI,KAAA;AAAA,IACX;AAAA,GACD,CAAA;AACH;ACtDO,IAAM,sBAAA,GAAgE,OAAO,MAAA,CAAO;AAAA,EACzF,UAAA,EAAY,GAAA;AAAA,EACZ,UAAA,EAAY;AACd,CAAC;AAED,IAAM,MAAA,GAAS,KAAA;AAGf,IAAM,UAAA,GAAa,GAAA;AAOnB,IAAM,eAAA,GAAkB,GAAA;AAGxB,IAAM,eAAA,GAAkB,GAAA;AAIxB,IAAM,YAAA,GAAe,CAAA;AAAA;AAAA,CAAA,CAAA;AAIrB,IAAM,cAAA,GAAiB,CAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAAA;AAYhB,SAAS,qBACd,UAAA,EAC6B;AAC7B,EAAA,OAAO;AAAA,IACL,YAAY,gBAAA,CAAiB,UAAA,EAAY,UAAU,CAAA,GAC/C,UAAA,CAAW,aACX,sBAAA,CAAuB,UAAA;AAAA,IAC3B,YAAY,gBAAA,CAAiB,UAAA,EAAY,UAAU,CAAA,GAC/C,UAAA,CAAW,aACX,sBAAA,CAAuB;AAAA,GAC7B;AACF;AAEA,SAAS,gBAAA,GAAkC;AACzC,EAAA,OAAO,IAAI,OAAA,CAAc,CAACC,QAAAA,KAAY,YAAA,CAAaA,QAAO,CAAC,CAAA;AAC7D;AAOA,eAAe,cAAA,CACb,MACA,MAAA,EACiB;AACjB,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,KAAA,IAAS,IAAA,GAAO,CAAA,EAAG,IAAA,GAAO,eAAA,EAAiB,IAAA,EAAA,EAAQ;AACjD,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,IAAA,CAAK,IAAI,MAAM,CAAA;AACnC,IAAA,OAAA,IAAW,OAAA;AACX,IAAA,IAAI,UAAU,UAAA,EAAY;AAC1B,IAAA,MAAM,gBAAA,EAAiB;AAAA,EACzB;AACA,EAAA,OAAO,OAAA;AACT;AAWA,eAAsB,oBAAA,CACpB,QACA,SAAA,EACqC;AACrC,EAAA,MAAM,MAAA,GAAqC,EAAE,YAAA,EAAc,CAAA,EAAG,gBAAgB,CAAA,EAAE;AAChF,EAAA,IAAI,CAACC,UAAAA,CAAW,MAAM,CAAA,EAAG,OAAO,MAAA;AAChC,EAAA,IAAI,UAAU,UAAA,IAAc,IAAA,IAAQ,SAAA,CAAU,UAAA,IAAc,MAAM,OAAO,MAAA;AAEzE,EAAA,MAAM,EAAA,GAAK,WAAW,MAAM,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,EAAA,CAAG,IAAA,CAAK,CAAA,sBAAA,EAAyB,eAAe,CAAA,CAAE,CAAA;AAClD,IAAA,IAAI,SAAA,CAAU,cAAc,IAAA,EAAM;AAChC,MAAA,MAAM,MAAA,GAAS,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,KAAQ,SAAA,CAAU,UAAA,GAAa,MAAM,CAAA,CAAE,WAAA,EAAY;AAChF,MAAA,MAAA,CAAO,eAAe,MAAM,cAAA,CAAe,EAAA,CAAG,OAAA,CAAQ,YAAY,CAAA,EAAG;AAAA,QACnE,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AACA,IAAA,IAAI,SAAA,CAAU,cAAc,IAAA,EAAM;AAChC,MAAA,MAAA,CAAO,iBAAiB,MAAM,cAAA,CAAe,EAAA,CAAG,OAAA,CAAQ,cAAc,CAAA,EAAG;AAAA,QACvE,OAAO,SAAA,CAAU,UAAA;AAAA,QACjB,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,SAAE;AACA,IAAA,EAAA,CAAG,KAAA,EAAM;AAAA,EACX;AACF;AC1HA,IAAM,kBAAA,GAAqB,EAAA;AAE3B,IAAM,cAAA,GAAiB,iBAAA;AAEvB,IAAM,MAAA,GAAS,UAAA;AACf,IAAM,QAAA,GAAW,oDAAA;AAIjB,IAAM,YAAA,GAAyB;AAAA,EAC7B,+BAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAA;AAGA,IAAM,GAAA,GAAM,sDAAA;AACZ,IAAM,cAAA,GAAiB,cAAA;AACvB,IAAM,aAAA,GAAgB,SAAA;AACtB,IAAM,aAAA,GAAgB,oBAAA;AACtB,IAAM,MAAA,GAAS,qCAAA;AAEf,IAAM,UAAA,GACJ,kGAAA;AAGF,IAAM,SAAA,GAAY,gCAAA;AAClB,IAAM,kBAAA,GAAqB,UAAA;AAC3B,IAAM,aAAA,GACJ,yPAAA;AAGF,SAAS,cAAc,KAAA,EAAuB;AAC5C,EAAA,IAAI,UAAA,GAAa,MAAM,IAAA,EAAK;AAC5B,EAAA,WAAS;AACP,IAAA,IAAI,WAAW,UAAA,CAAW,IAAI,GAAG,UAAA,GAAa,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,SAAA,IACvD,WAAW,UAAA,CAAW,GAAG,GAAG,UAAA,GAAa,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,SAC/D;AAAA,EACP;AACA,EAAA,OAAO,UAAA,CAAW,SAAS,GAAG,CAAA,eAAgB,UAAA,CAAW,KAAA,CAAM,GAAG,EAAE,CAAA;AACpE,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,gBAAgB,KAAA,EAAuB;AACrD,EAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,CACvB,MAAA,CAAO,cAAc,KAAK,CAAA,EAAG,MAAM,CAAA,CACnC,MAAA,CAAO,KAAK,CAAA,CACZ,KAAA,CAAM,GAAG,kBAAkB,CAAA;AAChC;AAQO,SAAS,QAAQ,KAAA,EAAuB;AAC7C,EAAA,MAAM,UAAA,GAAa,cAAc,KAAK,CAAA;AACtC,EAAA,IAAI,CAAC,YAAY,OAAO,aAAA;AACxB,EAAA,MAAM,IAAA,GAAO,gBAAgB,UAAU,CAAA;AACvC,EAAA,MAAM,WAAW,UAAA,CAAW,KAAA,CAAM,WAAW,WAAA,CAAY,GAAG,IAAI,CAAC,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AACpC,EAAA,MAAM,GAAA,GAAM,MAAM,CAAA,GAAI,QAAA,CAAS,MAAM,GAAA,GAAM,CAAC,CAAA,CAAE,WAAA,EAAY,GAAI,EAAA;AAC9D,EAAA,OAAO,cAAA,CAAe,IAAA,CAAK,GAAG,CAAA,GAAI,CAAA,MAAA,EAAS,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,CAAA,GAAK,CAAA,MAAA,EAAS,IAAI,CAAA,CAAA,CAAA;AAC3E;AAEA,SAAS,QAAA,CAAS,KAAA,EAAe,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAsB;AACnF,EAAA,MAAM,WAAW,IAAA,CAAK,KAAA,CAAM,cAAc,CAAA,GAAI,CAAC,CAAA,IAAK,EAAA;AACpD,EAAA,MAAM,IAAA,GAAO,WAAW,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,QAAA,CAAS,MAAM,CAAA,GAAI,IAAA;AAC1D,EAAA,IAAI,IAAA,KAAS,EAAA,IAAM,IAAA,KAAS,GAAA,IAAO,QAAA,CAAS,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG,OAAO,KAAA;AACxE,EAAA,MAAMF,QAAO,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAC,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACzC,EAAA,OAAO,CAAA,EAAG,MAAM,CAAA,EAAG,IAAI,IAAI,OAAA,CAAQA,KAAI,CAAC,CAAA,EAAG,QAAQ,CAAA,CAAA;AACrD;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,aAAa,CAAA,GAAI,CAAC,CAAA,IAAK,EAAA;AACnD,EAAA,MAAM,YAAA,GAAe,KAAA,CAAM,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,CAAa,KAAA,CAAM,cAAc,CAAA,GAAI,CAAC,CAAA,IAAK,EAAA;AAC5D,EAAA,MAAM,IAAA,GAAO,WAAW,YAAA,CAAa,KAAA,CAAM,GAAG,CAAC,QAAA,CAAS,MAAM,CAAA,GAAI,YAAA;AAElE,EAAA,IAAI,SAAS,MAAA,IAAU,QAAA,CAAS,IAAA,CAAK,IAAI,GAAG,OAAO,KAAA;AACnD,EAAA,IAAI,CAAC,IAAA,IAAQ,kBAAA,CAAmB,IAAA,CAAK,IAAI,KAAK,UAAA,CAAW,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,KAAA;AAC5E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AACrC,EAAA,IAAI,UAAU,OAAO,CAAA,EAAG,OAAO,CAAA,EAAG,SAAS,CAAC,CAAC,CAAA,CAAA,EAAI,UAAA,CAAW,SAAS,CAAC,CAAA,IAAK,EAAE,CAAC,GAAG,QAAQ,CAAA,CAAA;AACzF,EAAA,MAAM,SAAS,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA,IAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AAC3D,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,cAAc,IAAA,CAAK,IAAI,GAAG,OAAO,KAAA;AACjD,EAAA,OAAO,GAAG,OAAO,CAAA,EAAG,QAAQ,IAAI,CAAC,GAAG,QAAQ,CAAA,CAAA;AAC9C;AAWO,SAAS,aAAa,IAAA,EAAsB;AACjD,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,MAAW,QAAQ,YAAA,EAAc;AAC/B,IAAA,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AAAA,EAChC;AACA,EAAA,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAA,EAAK,QAAQ,CAAA;AAC/B,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,UAAU,CAAA;AACvC;;;ACnHO,IAAM,kBAAN,MAAyC;AAAA,EAC9C,YAA6B,KAAA,EAA+B;AAA/B,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgC;AAAA,EAAhC,KAAA;AAAA,EAE7B,MAAM,KAAA,EAAuB;AAC3B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,MAAA,CAAO,QAAA,GACrB,CAAA,EAAG,MAAM,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,MAAA,CAAO,OAAO,IAAI,KAAA,CAAM,MAAA,CAAO,QAAQ,CAAA,CAAA,GACrE,CAAA,EAAG,KAAA,CAAM,OAAO,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,CAAA;AAChD,IAAA,IAAI,IAAA,GAAO,IAAI,KAAA,CAAM,KAAK,MAAM,GAAG,CAAA,EAAA,EAAK,MAAM,OAAO,CAAA,CAAA;AACrD,IAAA,IAAI,KAAA,CAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,IAAI,CAAA,CAAE,SAAS,CAAA,EAAG;AACpD,MAAA,IAAA,IAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA,CAAA;AAAA,IACxC;AACA,IAAA,IAAI,KAAA,CAAM,OAAO,OAAA,EAAS;AACxB,MAAA,IAAA,IAAQ,CAAA,QAAA,EAAM,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA,CAAA;AAAA,IACnC;AACA,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACjB;AAAA,EAEA,WAAW,OAAA,EAA2B;AACpC,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AAAA,EAEd;AACF;;;ACfO,IAAM,YAAN,MAAmC;AAAA,EACvB,IAAA;AAAA,EAEjB,YAAY,IAAA,EAAwB;AAClC,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AAAA,EACnB;AAAA,EAEA,MAAM,KAAA,EAAuB;AAC3B,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,OAAO,CAAA;AAAA,IACxC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAW,OAAA,EAA2B;AACpC,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AAAA,EAEd;AACF","file":"chunk-RZL4TOK3.js","sourcesContent":["/**\n * Run state `skaile` writes into a project and that belongs to one machine: the compiled-prompt\n * snapshot of every run, the ledger of the agent files an install wrote, the log database of a\n * run and the install history. The generated `.gitignore` lists them.\n */\n\nimport { existsSync, readFileSync, realpathSync, writeFileSync } from \"node:fs\";\nimport { dirname, join, resolve } from \"node:path\";\n\n/** `.gitignore` lines for the run state files; `skaile init` writes them too. */\nexport const RUN_STATE_GITIGNORE_ENTRIES: readonly string[] = [\n  \".skaile/composition-runs/\",\n  \".skaile/agent-instances-managed.json\",\n  // The per-session log database (SQLite, with its -shm/-wal files) and the install history.\n  \".skaile/logs.db*\",\n  \".skaile/history.yaml\",\n  // Agent-file hashes of the harness a project left, kept until `harness set --clean` runs.\n  \".skaile/harness-switch-hashes.json\",\n];\n\n/** Lines of a `.gitignore` that already ignore the whole `.skaile/` folder. */\nconst WHOLE_SKAILE_FOLDER: readonly string[] = [\n  \".skaile\",\n  \".skaile/\",\n  \"/.skaile\",\n  \"/.skaile/\",\n  \".skaile/*\",\n];\n\n/**\n * Whether `dir` sits in a git work tree: a `.git` (folder or file) in it or in a parent. The path\n * is resolved first, so a relative or symlinked project folder walks its real parents.\n */\nfunction insideGitWorkTree(dir: string): boolean {\n  let current: string;\n  try {\n    current = realpathSync(resolve(dir));\n  } catch {\n    current = resolve(dir);\n  }\n  for (;;) {\n    if (existsSync(join(current, \".git\"))) return true;\n    const parent = dirname(current);\n    if (parent === current) return false;\n    current = parent;\n  }\n}\n\n/**\n * Add the run state files to the project's `.gitignore` when it misses them: existing projects get\n * the lines on the next write of one of the files. Only a skaile project (a `skaile.yaml` in\n * `projectDir`) inside a git work tree (a `.git` in `projectDir` or a parent folder) is touched:\n * a folder that is neither, or an unrelated repository the command happens to run in, keeps its\n * `.gitignore` as it is. The lines go into the `.gitignore` of the project folder itself, so a\n * project in a subfolder of a repository never touches the repository's own file. A project\n * without a `.gitignore` gets one; a failed write is ignored (the entries are a courtesy).\n *\n * @param projectDir - Project folder that holds `.skaile/`.\n * @returns The lines added, empty when none were missing.\n */\nexport function ensureRunStateIgnored(projectDir: string): string[] {\n  const gitignore = join(projectDir, \".gitignore\");\n  try {\n    if (!existsSync(join(projectDir, \"skaile.yaml\"))) return [];\n    if (!insideGitWorkTree(projectDir)) return [];\n    const existing = existsSync(gitignore) ? readFileSync(gitignore, \"utf-8\") : \"\";\n    const have = new Set(existing.split(\"\\n\").map((l) => l.trim()));\n    if (WHOLE_SKAILE_FOLDER.some((l) => have.has(l))) return [];\n    const missing = RUN_STATE_GITIGNORE_ENTRIES.filter((e) => !have.has(e));\n    if (missing.length === 0) return [];\n    const prefix = existing && !existing.endsWith(\"\\n\") ? \"\\n\" : \"\";\n    writeFileSync(gitignore, `${existing}${prefix}${missing.join(\"\\n\")}\\n`);\n    return missing;\n  } catch {\n    return [];\n  }\n}\n","/**\n * Runtime-portable embedded SQLite for the logging sink.\n *\n * The log store needs a synchronous, embedded SQLite driver. Bun ships\n * `bun:sqlite`; Node 22.5+ ships `node:sqlite`. This shim selects the right\n * one at runtime so the CLI and runtime run unmodified under either — no Bun\n * dependency baked into the published build.\n *\n * Both drivers accept `$`-prefixed named-parameter keys directly, so callers\n * use one binding convention. The only API gap is transactions: `bun:sqlite`\n * has `db.transaction()`, `node:sqlite` does not — {@link openSqlite}\n * synthesizes it with manual `BEGIN`/`COMMIT`/`ROLLBACK`.\n */\nimport { createRequire } from \"node:module\";\n\nconst nodeRequire = createRequire(import.meta.url);\n\n/** True when executing under the Bun runtime. */\nconst isBun = typeof (globalThis as { Bun?: unknown }).Bun !== \"undefined\";\n\n/** A prepared statement bound with `$`-prefixed named parameters. */\nexport interface PortableStatement {\n  /** Returns the number of rows the statement changed. */\n  run(params?: Record<string, unknown>): PortableRunResult;\n  all<T = unknown>(params?: Record<string, unknown>): T[];\n  get<T = unknown>(params?: Record<string, unknown>): T | undefined;\n}\n\n/** Outcome of {@link PortableStatement.run}, normalised across drivers. */\nexport interface PortableRunResult {\n  changes: number;\n}\n\n/** A synchronous embedded SQLite handle, uniform across Bun and Node. */\nexport interface PortableDatabase {\n  exec(sql: string): void;\n  prepare(sql: string): PortableStatement;\n  /** Wrap `fn` so the statements it runs commit as one transaction. */\n  transaction<A extends unknown[]>(fn: (...args: A) => void): (...args: A) => void;\n  close(): void;\n}\n\nexport interface OpenSqliteOptions {\n  /** Open read-only. The database file must already exist. */\n  readonly?: boolean;\n}\n\n/** Minimal structural shape shared by `bun:sqlite` and `node:sqlite` handles. */\ninterface RawStatement {\n  run(params?: unknown): unknown;\n  all(params?: unknown): unknown[];\n  get(params?: unknown): unknown;\n}\ninterface RawDatabase {\n  exec(sql: string): unknown;\n  prepare(sql: string): RawStatement;\n  close(): void;\n}\n\nfunction wrapStatement(stmt: RawStatement): PortableStatement {\n  return {\n    run: (params) => {\n      const raw = (params === undefined ? stmt.run() : stmt.run(params)) as\n        | { changes?: number | bigint }\n        | undefined;\n      return { changes: Number(raw?.changes ?? 0) };\n    },\n    all: (params) => (params === undefined ? stmt.all() : stmt.all(params)) as never,\n    get: (params) => (params === undefined ? stmt.get() : stmt.get(params)) as never,\n  };\n}\n\nfunction openBunSqlite(path: string, opts: OpenSqliteOptions): PortableDatabase {\n  const { Database } = nodeRequire(\"bun:sqlite\") as {\n    Database: new (\n      p: string,\n      o?: { readonly?: boolean },\n    ) => RawDatabase & {\n      transaction<A extends unknown[]>(fn: (...args: A) => void): (...args: A) => void;\n    };\n  };\n  const db = opts.readonly ? new Database(path, { readonly: true }) : new Database(path);\n  return {\n    exec: (sql) => {\n      db.exec(sql);\n    },\n    prepare: (sql) => wrapStatement(db.prepare(sql)),\n    transaction: (fn) => db.transaction(fn),\n    close: () => {\n      db.close();\n    },\n  };\n}\n\n/**\n * Load `node:sqlite` without Node's \"SQLite is an experimental feature\"\n * `ExperimentalWarning` (Node 22.5–23). The warning is emitted synchronously by\n * the `require`, so the filter is installed for that one call only; every other\n * warning, before or after, is passed through untouched.\n */\nfunction requireNodeSqlite(): {\n  DatabaseSync: new (p: string, o?: { readOnly?: boolean }) => RawDatabase;\n} {\n  const original = process.emitWarning;\n  process.emitWarning = function (this: unknown, warning: string | Error, ...args: unknown[]) {\n    const first = args[0];\n    const type = typeof first === \"string\" ? first : (first as { type?: string } | undefined)?.type;\n    const text = typeof warning === \"string\" ? warning : warning?.message;\n    if (type === \"ExperimentalWarning\" && /sqlite/i.test(text ?? \"\")) return;\n    return (original as (...a: unknown[]) => void).call(process, warning, ...args);\n  } as typeof process.emitWarning;\n  try {\n    return nodeRequire(\"node:sqlite\");\n  } finally {\n    process.emitWarning = original;\n  }\n}\n\nfunction openNodeSqlite(path: string, opts: OpenSqliteOptions): PortableDatabase {\n  const { DatabaseSync } = requireNodeSqlite();\n  const db = opts.readonly ? new DatabaseSync(path, { readOnly: true }) : new DatabaseSync(path);\n  return {\n    exec: (sql) => {\n      db.exec(sql);\n    },\n    prepare: (sql) => wrapStatement(db.prepare(sql)),\n    transaction:\n      (fn) =>\n      (...args) => {\n        db.exec(\"BEGIN\");\n        try {\n          fn(...args);\n          db.exec(\"COMMIT\");\n        } catch (err) {\n          db.exec(\"ROLLBACK\");\n          throw err;\n        }\n      },\n    close: () => {\n      db.close();\n    },\n  };\n}\n\n/**\n * Open an embedded SQLite database using the runtime's native driver —\n * `bun:sqlite` under Bun, `node:sqlite` under Node 22.5+.\n */\nexport function openSqlite(path: string, opts: OpenSqliteOptions = {}): PortableDatabase {\n  return isBun ? openBunSqlite(path, opts) : openNodeSqlite(path, opts);\n}\n","import { chmodSync } from \"node:fs\";\nimport type { LogEntry, LogQuery, LogQueryResult } from \"@skaile/workspaces/types\";\nimport { openSqlite, type PortableDatabase, type PortableStatement } from \"./sqlite-runtime.js\";\nimport type { LogSink } from \"./types.js\";\n\nexport interface SqliteSinkOptions {\n  path: string; // ':memory:' or filesystem path\n}\n\nconst SCHEMA = `\nCREATE TABLE IF NOT EXISTS log_entries (\n  id            TEXT PRIMARY KEY,\n  timestamp     TEXT NOT NULL,\n  session_id    TEXT NOT NULL,\n  kind          TEXT NOT NULL,\n  subkind       TEXT NOT NULL,\n  instance      TEXT,\n  level         TEXT NOT NULL,\n  message       TEXT NOT NULL,\n  data_json     TEXT,\n  error_json    TEXT\n);\nCREATE INDEX IF NOT EXISTS idx_logs_timestamp ON log_entries(timestamp);\nCREATE INDEX IF NOT EXISTS idx_logs_kind_level ON log_entries(kind, level);\nCREATE INDEX IF NOT EXISTS idx_logs_source ON log_entries(kind, subkind, instance);\n`;\n\ninterface LogEntryRow {\n  id: string;\n  timestamp: string;\n  session_id: string;\n  kind: string;\n  subkind: string;\n  instance: string | null;\n  level: string;\n  message: string;\n  data_json: string | null;\n  error_json: string | null;\n}\n\nexport class SqliteSink implements LogSink {\n  private db: PortableDatabase;\n  private insertStmt: PortableStatement;\n  private insertMany: (entries: LogEntry[]) => void;\n  private closed = false;\n\n  constructor(opts: SqliteSinkOptions) {\n    this.db = openSqlite(opts.path);\n    if (opts.path !== \":memory:\") {\n      // Wait for a concurrent skaile process on the same logs.db instead of SQLITE_BUSY.\n      this.db.exec(\"PRAGMA busy_timeout = 5000\");\n      this.db.exec(\"PRAGMA journal_mode = WAL\");\n    }\n    this.db.exec(SCHEMA);\n    if (opts.path !== \":memory:\") {\n      // Group-writable so a co-grouped host process can open read-write for retention.\n      makeGroupWritable(opts.path);\n    }\n    this.insertStmt = this.db.prepare(\n      `INSERT INTO log_entries (id, timestamp, session_id, kind, subkind, instance, level, message, data_json, error_json)\n       VALUES ($id, $timestamp, $session_id, $kind, $subkind, $instance, $level, $message, $data_json, $error_json)`,\n    );\n    this.insertMany = this.db.transaction((entries: LogEntry[]) => {\n      for (const e of entries) this.insertStmt.run(this.toRow(e));\n    });\n  }\n\n  write(entry: LogEntry): void {\n    if (this.closed) return;\n    this.insertStmt.run(this.toRow(entry));\n  }\n\n  writeBatch(entries: LogEntry[]): void {\n    if (this.closed || entries.length === 0) return;\n    this.insertMany(entries);\n  }\n\n  close(): void {\n    if (this.closed) return;\n    this.closed = true;\n    this.db.close();\n  }\n\n  query(q: LogQuery): LogQueryResult {\n    if (this.closed) return { entries: [] };\n    const where: string[] = [\"session_id = $sessionId\"];\n    const params: Record<string, unknown> = { $sessionId: q.sessionId };\n\n    if (q.source?.kind) {\n      where.push(\"kind = $kind\");\n      params.$kind = q.source.kind;\n    }\n    if (q.source?.subkind) {\n      where.push(\"subkind = $subkind\");\n      params.$subkind = q.source.subkind;\n    }\n    if (q.source?.instance) {\n      where.push(\"instance = $instance\");\n      params.$instance = q.source.instance;\n    }\n    if (q.levels && q.levels.length > 0) {\n      const placeholders = q.levels.map((_, i) => `$level${i}`).join(\", \");\n      where.push(`level IN (${placeholders})`);\n      q.levels.forEach((lvl, i) => {\n        params[`$level${i}`] = lvl;\n      });\n    }\n    if (q.since) {\n      where.push(\"timestamp >= $since\");\n      params.$since = q.since;\n    }\n    if (q.until) {\n      where.push(\"timestamp < $until\");\n      params.$until = q.until;\n    }\n    if (q.search) {\n      // Escape SQL LIKE wildcards so a search for \"100%\" matches the literal string,\n      // not \"100<anything>\". \\\\ is also escaped because it's the escape character itself.\n      const escaped = q.search.replace(/[\\\\%_]/g, \"\\\\$&\");\n      where.push(\"message LIKE $search ESCAPE '\\\\'\");\n      params.$search = `%${escaped}%`;\n    }\n    if (q.cursor) {\n      where.push(\"id < $cursor\");\n      params.$cursor = q.cursor;\n    }\n\n    const limit = Math.min(q.limit ?? 500, 5000);\n    params.$limit = limit + 1;\n\n    const sql = `SELECT id, timestamp, session_id, kind, subkind, instance, level, message, data_json, error_json\n      FROM log_entries\n      WHERE ${where.join(\" AND \")}\n      ORDER BY id DESC\n      LIMIT $limit`;\n\n    const rows = this.db.prepare(sql).all<LogEntryRow>(params);\n\n    const hasMore = rows.length > limit;\n    const sliced = hasMore ? rows.slice(0, limit) : rows;\n    const entries: LogEntry[] = sliced.map((r) => ({\n      id: r.id,\n      timestamp: r.timestamp,\n      sessionId: r.session_id,\n      source: {\n        kind: r.kind as LogEntry[\"source\"][\"kind\"],\n        subkind: r.subkind,\n        instance: r.instance ?? undefined,\n      },\n      level: r.level as LogEntry[\"level\"],\n      message: r.message,\n      data: r.data_json ? JSON.parse(r.data_json) : undefined,\n      error: r.error_json ? JSON.parse(r.error_json) : undefined,\n    }));\n\n    return {\n      entries,\n      nextCursor: hasMore ? entries[entries.length - 1].id : undefined,\n    };\n  }\n\n  // Both bun:sqlite and node:sqlite bind `$name` SQL placeholders from\n  // matching `$`-prefixed object keys.\n  private toRow(e: LogEntry): Record<string, unknown> {\n    return {\n      $id: e.id,\n      $timestamp: e.timestamp,\n      $session_id: e.sessionId,\n      $kind: e.source.kind,\n      $subkind: e.source.subkind,\n      $instance: e.source.instance ?? null,\n      $level: e.level,\n      $message: e.message,\n      $data_json: e.data ? JSON.stringify(e.data) : null,\n      $error_json: e.error ? JSON.stringify(e.error) : null,\n    };\n  }\n}\n\n/**\n * Best-effort `chmod 0664` on the db file and its WAL/SHM siblings. Swallows all\n * errors (missing sibling, EPERM when not the owner) so logging never throws.\n */\nfunction makeGroupWritable(dbPath: string): void {\n  for (const p of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {\n    try {\n      chmodSync(p, 0o664);\n    } catch {\n      // Sibling may not exist yet, or this process may not own the file.\n      // Either way, retention degrades cleanly — never break logging.\n    }\n  }\n}\n","import { mkdirSync } from \"node:fs\";\nimport path from \"node:path\";\nimport type { LogLevel, LogStoreConfig, LogStoreMode } from \"@skaile/workspaces/types\";\nimport { ensureRunStateIgnored } from \"../run-state-ignore.js\";\nimport { LogStore } from \"./log-store.js\";\nimport { NoOpSink } from \"./sinks/no-op-sink.js\";\nimport { SqliteSink } from \"./sinks/sqlite-sink.js\";\nimport { StdoutSink } from \"./sinks/stdout-sink.js\";\n\nconst VALID_MODES: LogStoreMode[] = [\"persistent\", \"ephemeral\", \"off\"];\nconst VALID_LEVELS: LogLevel[] = [\"debug\", \"info\", \"warn\", \"error\"];\n\nexport interface ResolveLogStoreConfigInput {\n  sessionId: string;\n  workspacePath?: string;\n  yamlBlock?: Partial<{\n    mode: LogStoreMode;\n    level: LogLevel;\n    retention: { maxEntries?: number; maxAgeDays?: number };\n  }>;\n}\n\nexport function resolveLogStoreConfig(input: ResolveLogStoreConfigInput): LogStoreConfig {\n  const yaml = input.yamlBlock ?? {};\n  const envMode = process.env.SKAILE_LOG_MODE as LogStoreMode | undefined;\n  const envLevel = process.env.SKAILE_LOG_LEVEL as LogLevel | undefined;\n\n  const mode = envMode ?? yaml.mode ?? \"persistent\";\n  if (!VALID_MODES.includes(mode)) {\n    throw new Error(`Invalid logging.mode: ${mode}`);\n  }\n  const level = envLevel ?? yaml.level ?? \"info\";\n  if (!VALID_LEVELS.includes(level)) {\n    throw new Error(`Invalid logging.level: ${level}`);\n  }\n\n  return {\n    sessionId: input.sessionId,\n    workspacePath: input.workspacePath,\n    mode,\n    level,\n    retention: yaml.retention,\n  };\n}\n\nexport interface CreateLogStoreOptions {\n  /**\n   * Mirror every entry to stdout as well (default `true`, for container logs).\n   * A CLI host that already renders the entries itself passes `false` so a\n   * record is not printed twice.\n   */\n  stdout?: boolean;\n}\n\nexport function createLogStoreFromConfig(\n  cfg: LogStoreConfig,\n  opts: CreateLogStoreOptions = {},\n): LogStore {\n  const sinks = [];\n  if (cfg.mode === \"off\") {\n    sinks.push(new NoOpSink());\n  } else if (cfg.mode === \"ephemeral\") {\n    sinks.push(new SqliteSink({ path: \":memory:\" }));\n  } else {\n    if (!cfg.workspacePath) {\n      throw new Error(\"logging.mode=persistent requires workspacePath\");\n    }\n    const dir = path.join(cfg.workspacePath, \".skaile\");\n    mkdirSync(dir, { recursive: true });\n    const dbPath = path.join(dir, \"logs.db\");\n    sinks.push(new SqliteSink({ path: dbPath }));\n    ensureRunStateIgnored(cfg.workspacePath);\n  }\n  // Include stdout for live container logs (dev-friendly) unless the host opts out.\n  if (opts.stdout !== false) sinks.push(new StdoutSink());\n  return new LogStore({\n    sessionId: cfg.sessionId,\n    level: cfg.level,\n    sinks,\n  });\n}\n","/**\n * Retention for the per-session structured-log SQLite store (`logs.db`).\n *\n * Mirrors the platform's `enforceLogsRetention`\n * (`platform/backend/libs/session/src/logs-retention.utils.ts`): the same\n * age-then-count semantics, batch size, pass ceiling and busy timeout. The\n * platform trims the host copy of the file once per wake; in broker mode that\n * copy is not the file the runner writes, so the runner trims its own file at\n * boot. In docker mode both trim the same file with the same rules, which is\n * harmless: a second pass finds nothing left to delete.\n */\nimport { existsSync } from \"node:fs\";\nimport type { LogStoreRetention } from \"@skaile/workspaces/types\";\nimport { isRetentionValue } from \"./retention-value.js\";\nimport { openSqlite, type PortableStatement } from \"./sinks/sqlite-runtime.js\";\n\n/** Rows removed by one {@link enforceLogsRetention} run. */\nexport interface EnforceLogsRetentionResult {\n  deletedByAge: number;\n  deletedByCount: number;\n}\n\n/**\n * The platform's cloud-mode retention defaults (docker and broker). Used when\n * `skaile.yaml` has no `logging.retention` value for a field.\n */\nexport const DEFAULT_LOGS_RETENTION: Readonly<Required<LogStoreRetention>> = Object.freeze({\n  maxEntries: 100_000,\n  maxAgeDays: 7,\n});\n\nconst DAY_MS = 86_400_000;\n\n/** Rows deleted per statement. Caps both the write lock and the loop stall. */\nconst BATCH_SIZE = 500;\n\n/**\n * Pass ceiling per statement. Concurrent inserts keep refilling the count-trim\n * delete-set, so \"loop until a short batch\" is not a guaranteed bound;\n * leftovers are trimmed on the next boot.\n */\nconst MAX_TRIM_PASSES = 200;\n\n/** Wait on a lock held by another connection instead of failing with SQLITE_BUSY. */\nconst BUSY_TIMEOUT_MS = 2_000;\n\n// `LIMIT` directly on `DELETE` needs SQLITE_ENABLE_UPDATE_DELETE_LIMIT; the\n// `id IN (SELECT ... LIMIT)` form works under both bun:sqlite and node:sqlite.\nconst AGE_TRIM_SQL = `DELETE FROM log_entries WHERE id IN (\n  SELECT id FROM log_entries WHERE timestamp < $cutoff ORDER BY id LIMIT $batch\n)`;\n\nconst COUNT_TRIM_SQL = `DELETE FROM log_entries WHERE id IN (\n  SELECT id FROM log_entries\n  WHERE id NOT IN (SELECT id FROM log_entries ORDER BY id DESC LIMIT $keep)\n  ORDER BY id LIMIT $batch\n)`;\n\n/**\n * Overlay the configured retention on {@link DEFAULT_LOGS_RETENTION}, field by\n * field. A value that is not a non-negative finite number counts as unset.\n * `0` is a valid value: `maxEntries: 0` or `maxAgeDays: 0` deletes every row,\n * as it does on the platform.\n */\nexport function resolveLogsRetention(\n  configured: LogStoreRetention | undefined,\n): Required<LogStoreRetention> {\n  return {\n    maxEntries: isRetentionValue(configured?.maxEntries)\n      ? configured.maxEntries\n      : DEFAULT_LOGS_RETENTION.maxEntries,\n    maxAgeDays: isRetentionValue(configured?.maxAgeDays)\n      ? configured.maxAgeDays\n      : DEFAULT_LOGS_RETENTION.maxAgeDays,\n  };\n}\n\nfunction yieldToEventLoop(): Promise<void> {\n  return new Promise<void>((resolve) => setImmediate(resolve));\n}\n\n/**\n * Run one bounded delete until it stops filling a batch. Each statement is its\n * own implicit transaction, so no lock is held across the yield and the\n * in-process sink can write between batches.\n */\nasync function runBoundedTrim(\n  stmt: PortableStatement,\n  params: Record<string, unknown>,\n): Promise<number> {\n  let deleted = 0;\n  for (let pass = 0; pass < MAX_TRIM_PASSES; pass++) {\n    const { changes } = stmt.run(params);\n    deleted += changes;\n    if (changes < BATCH_SIZE) break;\n    await yieldToEventLoop();\n  }\n  return deleted;\n}\n\n/**\n * Delete rows older than `maxAgeDays`, then keep at most the `maxEntries`\n * newest rows (by ULID id). Uses its own connection with a busy timeout, in\n * bounded batches that yield to the event loop between passes.\n *\n * Returns zero counts when the file does not exist or the policy is empty.\n * Other failures (lock timeout, not a log store) reject; the caller decides\n * how loud to be.\n */\nexport async function enforceLogsRetention(\n  dbPath: string,\n  retention: LogStoreRetention,\n): Promise<EnforceLogsRetentionResult> {\n  const result: EnforceLogsRetentionResult = { deletedByAge: 0, deletedByCount: 0 };\n  if (!existsSync(dbPath)) return result;\n  if (retention.maxAgeDays == null && retention.maxEntries == null) return result;\n\n  const db = openSqlite(dbPath);\n  try {\n    db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);\n    if (retention.maxAgeDays != null) {\n      const cutoff = new Date(Date.now() - retention.maxAgeDays * DAY_MS).toISOString();\n      result.deletedByAge = await runBoundedTrim(db.prepare(AGE_TRIM_SQL), {\n        $cutoff: cutoff,\n        $batch: BATCH_SIZE,\n      });\n    }\n    if (retention.maxEntries != null) {\n      result.deletedByCount = await runBoundedTrim(db.prepare(COUNT_TRIM_SQL), {\n        $keep: retention.maxEntries,\n        $batch: BATCH_SIZE,\n      });\n    }\n    return result;\n  } finally {\n    db.close();\n  }\n}\n","/**\n * Log-safe rendering of free text that may quote customer document paths.\n *\n * Rule (skaile-ai/platform#6909): logs carry ids and fingerprints, never document\n * paths, file names or folder names. Runner rows reach the zone log store on the\n * broker fleet, and SharePoint/OneDrive folder names routinely carry customer,\n * project and company names.\n *\n * The fingerprint is an unsalted sha256 prefix on purpose and matches the\n * platform's `backend/libs/log-sink/src/log-safe-path.ts`: the pinned literal\n * `\"Kunde AG/Projekt Nordwind/Vertrag final.pdf\"` -> `<path#bdead54ccb34>.pdf`\n * is shared with the platform tests, so an operator can match a tag across both.\n */\nimport { createHash } from \"node:crypto\";\n\nconst FINGERPRINT_LENGTH = 12;\n// Short and alphanumeric only, so a folder like `Kunde.Siemens` does not leak its tail.\nconst SAFE_EXTENSION = /^[a-z0-9]{1,5}$/;\n\nconst QUOTED = \"<quoted>\";\nconst PATH_TAG = /^<path#(?:[0-9a-f]{12}|none)>(?:\\.[a-z0-9]{1,5})?$/;\n\n// Each span is bounded and single-line so the scan stays linear on long input.\n// A single-quote span opens and closes on a non-word boundary, so `don't` survives.\nconst QUOTED_SPANS: RegExp[] = [\n  /(?<!\\w)'[^\\n]{1,512}?'(?!\\w)/g,\n  /\"[^\"\\n]{1,512}\"/g,\n  /“[^”\\n]{1,512}”/g,\n  /‘[^’\\n]{1,512}’/g,\n  /`[^`\\n]{1,512}`/g,\n];\n\n// The host may be empty (`file:///srv/x`).\nconst URL = /\\b([a-z][a-z0-9+.-]{0,31}:\\/\\/)([^\\s/?#]*)([^\\s]*)/gi;\nconst TRAILING_PUNCT = /[.,;:)\\]}]+$/;\nconst LEADING_PUNCT = /^[([{]+/;\nconst SLASH_BETWEEN = /[^/\\\\][/\\\\]+[^/\\\\]/;\nconst ROOTED = /^(?:\\/|\\.\\/|~\\/|[A-Za-z]:\\\\|\\\\\\\\)\\S/;\n// A slash that is not a path: a MIME type or a protocol version.\nconst NOT_A_PATH =\n  /^(?:(?:application|text|image|audio|video|multipart|font|model)\\/[\\w.+-]+|HTTPS?\\/\\d(?:\\.\\d)?)$/i;\n// `key=value`: only the value is a candidate, so the key stays readable and the tag of the\n// value matches the platform's tag for the same path.\nconst KEY_VALUE = /^([A-Za-z_][\\w.-]{0,63})=(.+)$/;\nconst DIGITS_AND_SLASHES = /^[\\d/]+$/;\nconst DOCUMENT_NAME =\n  /^.+\\.(?:doc|docx|docm|dot|dotx|xls|xlsx|xlsm|ppt|pptx|pptm|pdf|csv|tsv|txt|rtf|odt|ods|odp|odg|pages|key|numbers|vsd|vsdx|one|mpp|dwg|msg|eml|ics|vcf|md|json|xml|htm|html|zip|7z|rar|tar|gz|png|jpg|jpeg|gif|tif|tiff|heic|webp|bmp|svg|mp3|mp4|mov)$/i;\n\n/** Trims and strips leading `./` / `/` and trailing `/`, so `/a/b/` and `a/b` fingerprint alike. */\nfunction normalizePath(value: string): string {\n  let normalized = value.trim();\n  for (;;) {\n    if (normalized.startsWith(\"./\")) normalized = normalized.slice(2);\n    else if (normalized.startsWith(\"/\")) normalized = normalized.slice(1);\n    else break;\n  }\n  while (normalized.endsWith(\"/\")) normalized = normalized.slice(0, -1);\n  return normalized;\n}\n\n/** First 12 hex characters of the sha256 of the normalized path (the platform's `pathFingerprint`). */\nexport function pathFingerprint(value: string): string {\n  return createHash(\"sha256\")\n    .update(normalizePath(value), \"utf8\")\n    .digest(\"hex\")\n    .slice(0, FINGERPRINT_LENGTH);\n}\n\n/**\n * `<path#12hex>[.ext]` for a path, or `<path#none>` when it is empty after\n * normalizing (the platform's `pathTag`). The extension is kept only when short\n * and alphanumeric. Like the platform, the hash normalizes the normalized path\n * once more, so the two agree on every input.\n */\nexport function pathTag(value: string): string {\n  const normalized = normalizePath(value);\n  if (!normalized) return \"<path#none>\";\n  const hash = pathFingerprint(normalized);\n  const basename = normalized.slice(normalized.lastIndexOf(\"/\") + 1);\n  const dot = basename.lastIndexOf(\".\");\n  const ext = dot > 0 ? basename.slice(dot + 1).toLowerCase() : \"\";\n  return SAFE_EXTENSION.test(ext) ? `<path#${hash}>.${ext}` : `<path#${hash}>`;\n}\n\nfunction scrubUrl(match: string, scheme: string, host: string, rest: string): string {\n  const trailing = rest.match(TRAILING_PUNCT)?.[0] ?? \"\";\n  const body = trailing ? rest.slice(0, -trailing.length) : rest;\n  if (body === \"\" || body === \"/\" || PATH_TAG.test(body.slice(1))) return match;\n  const path = body.split(/[?#]/, 1)[0] ?? \"\";\n  return `${scheme}${host}/${pathTag(path)}${trailing}`;\n}\n\nfunction scrubToken(token: string): string {\n  if (token.includes(\"://\")) return token;\n  const leading = token.match(LEADING_PUNCT)?.[0] ?? \"\";\n  const afterLeading = token.slice(leading.length);\n  const trailing = afterLeading.match(TRAILING_PUNCT)?.[0] ?? \"\";\n  const core = trailing ? afterLeading.slice(0, -trailing.length) : afterLeading;\n  // Skip only a token that IS a tag: `<quoted>/Projekt/Vertrag.pdf` still holds names.\n  if (core === QUOTED || PATH_TAG.test(core)) return token;\n  if (!core || DIGITS_AND_SLASHES.test(core) || NOT_A_PATH.test(core)) return token;\n  const keyValue = core.match(KEY_VALUE);\n  if (keyValue) return `${leading}${keyValue[1]}=${scrubToken(keyValue[2] ?? \"\")}${trailing}`;\n  const isPath = SLASH_BETWEEN.test(core) || ROOTED.test(core);\n  if (!isPath && !DOCUMENT_NAME.test(core)) return token;\n  return `${leading}${pathTag(core)}${trailing}`;\n}\n\n/**\n * Removes document paths and names from free text whose names are not known\n * up front, such as a connector's error message: quoted spans become\n * `<quoted>`, URL paths and slash paths become `<path#…>` fingerprints (a URL\n * keeps its scheme and host), and bare document file names are fingerprinted.\n * Version numbers, host names and digit ratios/dates are left alone. Idempotent.\n * Words of a path that contains spaces and is not quoted can survive outside\n * the slash-bearing token; quote paths at the source when that matters.\n */\nexport function scrubLogText(text: string): string {\n  let out = text;\n  for (const span of QUOTED_SPANS) {\n    out = out.replace(span, QUOTED);\n  }\n  out = out.replace(URL, scrubUrl);\n  return out.replace(/\\S+/g, scrubToken);\n}\n","import type { LogEntry, LogSink } from \"@skaile/workspaces/types\";\n\n/**\n * OnLogBridgeSink — forwards every entry as a single formatted text line to\n * a legacy `onLog(line)` callback. Used as a back-compat bridge for callers\n * that historically received plain text lines from the runner.\n *\n * Format: `[level] [kind:subkind[:instance]] message [data-json] [— error.message]`\n */\nexport class OnLogBridgeSink implements LogSink {\n  constructor(private readonly onLog: (line: string) => void) {}\n\n  write(entry: LogEntry): void {\n    const tag = entry.source.instance\n      ? `${entry.source.kind}:${entry.source.subkind}:${entry.source.instance}`\n      : `${entry.source.kind}:${entry.source.subkind}`;\n    let line = `[${entry.level}] [${tag}] ${entry.message}`;\n    if (entry.data && Object.keys(entry.data).length > 0) {\n      line += ` ${JSON.stringify(entry.data)}`;\n    }\n    if (entry.error?.message) {\n      line += ` — ${entry.error.message}`;\n    }\n    this.onLog(line);\n  }\n\n  writeBatch(entries: LogEntry[]): void {\n    for (const e of entries) this.write(e);\n  }\n\n  close(): void {\n    /* no-op */\n  }\n}\n","import type { LogEntry, LogEntryEvent } from \"@skaile/workspaces/types\";\nimport type { LogSink } from \"./types.js\";\n\nexport interface WsLogSinkOptions {\n  /**\n   * Transport send callback. Typically wired to `transport.send` on the\n   * runner's `WebSocketServerTransport`. The transport already drops sends\n   * when no client is connected — this sink does not buffer.\n   */\n  send: (event: LogEntryEvent) => void;\n}\n\n/**\n * Forwards every LogEntry recorded by LogStore as a `log_entry` AgentEvent\n * over the configured transport. Used by the runner to make container-side\n * structured logs visible to the platform gateway in real time. Historical\n * reads still go through SQLite — this sink is for live tail only.\n */\nexport class WsLogSink implements LogSink {\n  private readonly send: (event: LogEntryEvent) => void;\n\n  constructor(opts: WsLogSinkOptions) {\n    this.send = opts.send;\n  }\n\n  write(entry: LogEntry): void {\n    try {\n      this.send({ type: \"log_entry\", entry });\n    } catch {\n      // Logging must never break the agent — drop on transport failure.\n    }\n  }\n\n  writeBatch(entries: LogEntry[]): void {\n    for (const e of entries) this.write(e);\n  }\n\n  close(): void {\n    /* nothing to release — transport lifecycle is owned by the caller */\n  }\n}\n"]}

package/dist/{chunk-LMADWO4Q.js → chunk-SBAUZ7XH.js}

@@ -1,5 +1,5 @@
-import { resolveSkWorkspaceConfig, localConnectorMountDir } from './chunk-FZO64PLQ.js';
-import { parseFrontmatter } from './chunk-GNUA7XT2.js';
+import { resolveSkWorkspaceConfig, localConnectorMountDir } from './chunk-BNLXZXZN.js';
+import { parseFrontmatter } from './chunk-VS6XC5JE.js';
 import { createLogger } from './chunk-BOFL7GIF.js';
 import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
@@ -502,5 +502,5 @@ function resolveAuthRef(auth, mountId) {
 }
 
 export { ConnectorFieldMissingError, ConnectorStartupError, EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, deriveSingleMaterializedConnectorDeclaration, fromMaterializedConnectorMd, isKnownSecretRef, loadConnectorDeclarations, loadMaterializedConnectorDeclarations, loadYamlConnectorDeclarations, readUnavailableMarker, resolveAuthRef, resolveBackendAuthFor, resolvedConfigToDeclarations, withMaterializedConnectorDeclarations };
-//# sourceMappingURL=chunk-LMADWO4Q.js.map
-//# sourceMappingURL=chunk-LMADWO4Q.js.map
+//# sourceMappingURL=chunk-SBAUZ7XH.js.map
+//# sourceMappingURL=chunk-SBAUZ7XH.js.map

package/dist/{chunk-LMADWO4Q.js.map → chunk-SBAUZ7XH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../connectors/src/connector-types.ts","../connectors/src/materialized-connectors.ts","../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;;;;AAqHO,SAAS,sBAAsB,KAAA,EAA+C;AACnF,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,OAAO,OAAO,MAAA;AACrE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAM;AAC7E,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,EAAE,QAAQ,aAAA,EAAc;AAC9D,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAC3B,EAAA,MAAM,MAAA,GAA4B;AAAA,IAChC,MAAA,EAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,IAAA,EAAK,KAAM,KAAK,MAAA,GAAS;AAAA,GACxE;AACA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,CAAO,MAAK,KAAM,EAAA,SAAW,MAAA,GAAS,MAAA;AACxE,EAAA,OAAO,MAAA;AACT;AAmIO,IAAM,0BAAA,GAAN,cAAyC,KAAA,CAAM;AAAA,EAC3C,WAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,kBAAA;AAAA,EAET,YAAY,IAAA,EAKT;AACD,IAAA,KAAA;AAAA,MACE,cAAc,IAAA,CAAK,WAAW,CAAA,6BAAA,EAAgC,IAAA,CAAK,MAAM,GAAG,CAAA,UAAA,EAC/D,IAAA,CAAK,QAAA,IAAY,QAAQ,CAAA,wBAAA,EACZ,IAAA,CAAK,mBAAmB,IAAA,CAAK,IAAI,KAAK,QAAQ,CAAA;AAAA,KAC1E;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,4BAAA;AACZ,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AAClB,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,QAAA;AACrB,IAAA,IAAA,CAAK,qBAAqB,IAAA,CAAK,kBAAA;AAAA,EACjC;AACF;AA0SO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EACtC,MAAA;AAAA,EACA,eAAA;AAAA,EACT,WAAA,CACE,OAAA,EACA,MAAA,EACA,eAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AACF;AC7jBO,SAAS,2BAAA,CAA4B,UAAkB,IAAA,EAAoC;AAChG,EAAA,MAAM,EAAE,MAAM,IAAA,EAAM,IAAA,KAAS,gBAAA,CAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAC5E,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,IAAI,CAAA;AACnC,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,EAAA;AAAA,IACA,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,MAAA,KAAW,YAAA,GAAe,YAAA,GAAe;AAAA,GACxD;AACA,EAAA,IAAI,KAAK,MAAA,KAAW,YAAA,IAAgB,KAAK,MAAA,KAAW,WAAA,OAAkB,eAAA,GAAkB,IAAA;AACxF,EAAA,IAAI,OAAO,KAAK,KAAA,KAAU,QAAA,IAAY,KAAK,KAAA,EAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AACpE,EAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpD,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,QAAA,IAAY,KAAK,cAAA,EAAgB;AAClE,IAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,cAAA;AAAA,EAC7B;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,OAAA,IAAW,IAAA,CAAK,SAAS,MAAA,EAAQ,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpE,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACpF,IAAA,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AAAA,EACtB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,IAAA,CAAK,KAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA;AAAA,MAC7B,GAAI,CAAA,CAAE,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA,EAAE,GAAI,EAAC;AAAA,MAC7D,GAAI,OAAO,CAAA,CAAE,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,MACzD,GAAI,OAAO,CAAA,CAAE,iBAAA,KAAsB,SAAA,GAC/B,EAAE,iBAAA,EAAmB,CAAA,CAAE,iBAAA,EAAkB,GACzC,EAAC;AAAA,MACL,GAAI,OAAO,CAAA,CAAE,cAAA,KAAmB,QAAA,GAAW,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI;AAAC,KACrF;AAAA,EACF;AACA,EAAA,MAAM,WAAA,GAAc,KAAK,IAAA,EAAK;AAC9B,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,YAAA,GAAe,WAAA;AAChD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,kBAAA,CAAmB,MAA4B,YAAA,EAA4B;AAClF,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,YAAA,EAAc,MAAM,CAAC,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACpE,EAAA,IAAA,CAAK,OAAA,GAAU,EAAE,GAAI,MAAA,EAAoC,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACnF;AAGO,SAAS,4CAAA,CACd,oBACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,kBAAA,EAAoB,IAAI,CAAA;AACzC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACnC,EAAA,IAAI,CAAC,UAAA,CAAW,EAAE,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,2BAAA,CAA4B,EAAA,EAAI,IAAI,CAAA;AACjD,EAAA,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,gBAAgB,CAAC,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,sCAAsC,UAAA,EAA4C;AAChG,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,0BAA0B,CAAA;AACxD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAC/B,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAC3B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,CAAE,aAAY,EAAG;AAClC,MAAA,MAAM,IAAA,GAAO,4CAAA,CAA6C,IAAA,EAAM,IAAI,CAAA;AACpE,MAAA,IAAI,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;;;ACrFA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAIT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,GAAA,IAAO,EAAE,CAAA,EAAG;AAC9D,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,EAAO,EAAE,IAAI,IAAI,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,GAAA,CAAI,IAAA,EAAqC,EAAA,EAAY,IAAA,EAAiC;AACpF,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAAqC,EAAA,EAAqB;AAC9D,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAAqC,EAAA,EAA6C;AACxF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,CAAA;AACrF,MAAA,OAAO,MAAA;AACT,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB;AAAA,EACrB,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,SAAS,iBAAiB,KAAA,EAAwB;AACvD,EAAA,OAAO,SAAA,CAAU,KAAK,CAAA,KAAM,MAAA;AAC9B;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AC3bA,IAAM,YAAY,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,UAAU,CAAA;AAahE,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,OAAO,qCAAA;AAAA,IACL,8BAA8B,UAAU,CAAA;AAAA,IACxC;AAAA,GACF;AACF;AAUO,SAAS,8BAA8B,UAAA,EAA4C;AACxF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAO,UAAA,IAAc,MAAA,CAAO,UAAA,CAAW,MAAA,GAAS,IACnD,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,CAAC,MAAM,+BAAA,CAAgC,CAAA,EAAG,UAAU,CAAC,IAC3E,EAAC;AACP;AAQO,SAAS,qCAAA,CACd,MACA,UAAA,EACwB;AACxB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,KAAA,MAAW,KAAK,IAAA,EAAM,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AACtC,EAAA,KAAA,MAAW,CAAA,IAAK,qCAAA,CAAsC,UAAU,CAAA,EAAG;AACjE,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AAClB,MAAA,SAAA,CAAU,IAAA,CAAK,CAAA,wBAAA,EAA2B,CAAA,CAAE,EAAE,CAAA,mCAAA,CAAqC,CAAA;AACnF,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAA,EAAI,CAAC,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAMA,SAAS,SAAS,MAAA,EAAwD;AACxE,EAAA,OAAO,MAAA,KAAW,eAAe,YAAA,GAAe,WAAA;AAClD;AAEA,SAAS,+BAAA,CACP,GACA,UAAA,EACsB;AACtB,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,QAAA,CAAS,CAAA,CAAE,MAAM,CAAA;AAAA,IACzB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AACA,EAAA,IAAI,CAAA,CAAE,MAAA,IAAU,IAAA,EAAM,IAAA,CAAK,eAAA,GAAkB,IAAA;AAG7C,EAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAE9C,EAAA,MAAM,WAAA,GAAc,qBAAA,CAAsB,CAAA,CAAE,WAAW,CAAA;AACvD,EAAA,IAAI,WAAA,OAAkB,WAAA,GAAc,WAAA;AAGpC,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF,CAAA,MAAA,IAAW,CAAA,CAAE,MAAA,KAAW,OAAA,EAAS;AAG/B,IAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,CAAA,EAAG,UAAU,CAAA;AACnD,IAAA,IAAI,MAAA,EAAQ,IAAA,CAAK,KAAA,GAAQ,EAAE,MAAA,EAAO;AAAA,EACpC;AAEA,EAAA,OAAO,IAAA;AACT;AAsBO,SAAS,6BACd,QAAA,EACwB;AAGxB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,EAA6B,IAAA,KAAqC;AAC7F,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG;AACrB,MAAA,SAAA,CAAU,IAAA,CAAK,CAAA,kCAAA,EAAqC,IAAI,CAAA,sBAAA,CAAA,EAA0B;AAAA,QAChF,IAAI,IAAA,CAAK;AAAA,OACV,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAA,EAAI,IAAI,CAAA;AAAA,EACxB,CAAA;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AAErC,IAAA,IACE,OAAO,CAAA,EAAG,EAAA,KAAO,QAAA,IACjB,OAAO,CAAA,EAAG,MAAA,KAAW,QAAA,IACrB,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EACpB;AACA,MAAA,SAAA,CAAU,KAAK,oEAAA,EAAsE;AAAA,QACnF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,QAAA,CAAS,CAAA,CAAE,MAAM,CAAA;AAAA,MACzB,GAAI,EAAE,MAAA,IAAU,IAAA,GAAO,EAAE,eAAA,EAAiB,IAAA,KAAkB,EAAC;AAAA,MAC7D,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,KAAA,EAAO;AAAA,QACL,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,OAAO,CAAA,CAAE,KAAA;AAAA,QACT,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE;AAAA;AACpB,KACF;AAEA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,SAAS,IAAI,CAAA;AAAA,EACnC;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,UAAA,IAAc,EAAC,EAAG;AACzC,IAAA,IAAI,OAAO,CAAA,EAAG,EAAA,KAAO,YAAY,OAAO,CAAA,EAAG,WAAW,QAAA,EAAU;AAC9D,MAAA,SAAA,CAAU,KAAK,iEAAA,EAAmE;AAAA,QAChF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,QAAA,CAAS,CAAA,CAAE,MAAM,CAAA;AAAA,MACzB,GAAI,EAAE,MAAA,IAAU,IAAA,GAAO,EAAE,eAAA,EAAiB,IAAA,KAAkB,EAAC;AAAA,MAC7D,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE;AAAA,KACb;AACA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,aAAa,IAAI,CAAA;AAAA,EACvC;AAEA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD","file":"chunk-LMADWO4Q.js","sourcesContent":["/**\n * Connector adapter infrastructure types.\n *\n * Connectors are external backends (databases, KV stores, object stores,\n * in-process state, git repos, etc.). A connector exposes up to two faces: a\n * `ToolFace` (agents access it through injected tools) and/or a\n * `FilesystemFace` (the connector projects content into a mounted directory).\n *\n * @docLink packages/connectors/concepts#connector-types\n */\n\nimport type {\n  ConnectorContent,\n  ConnectorEntry,\n  ListOptions,\n  OperationDescriptor,\n  SearchOptions,\n  SearchResult,\n  SyncOptions,\n  SyncResult,\n  WatchHandle,\n  WatchOptions,\n} from \"./shared-types.js\";\n\nexport type { OperationDescriptor } from \"./shared-types.js\";\n\nimport type { ConnectorPushState, Logger } from \"@skaile/workspaces/types\";\nimport type { SecretProvider } from \"./secrets.js\";\n\n// ── Connector declaration (runtime config, resolved from skaile.yaml) ────────\n\n/**\n * Parsed connector configuration from `skaile.yaml`, passed to `ConnectorAdapter.connect()` and held by `ConnectorManager`.\n * @docLink packages/connectors/concepts#connector-declaration\n */\nexport interface ConnectorDeclaration {\n  /** Unique identifier for this connector instance. */\n  id: string;\n  /** Driver type: \"postgres\", \"redis\", \"memory\", \"xstate\", \"yjs\", etc. */\n  driver: string;\n  /**\n   * Human-readable connection name, projected from the materialized CONNECTOR.md\n   * frontmatter `label`. The platform resource-explorer tab renders this over the\n   * driver name when present; absent for connectors with no configured name.\n   */\n  label?: string;\n  /** Access level enforced by the manager. */\n  access: \"read-only\" | \"read-write\";\n  /**\n   * True when the source set no `access` and the parser filled in the\n   * `read-only` default. The git driver's read-only mode (discard edits, never\n   * push) runs only on an explicit `read-only`, so an undeclared mount keeps\n   * its earlier behaviour.\n   */\n  accessDefaulted?: true;\n  /** Credential reference: \"env:VAR_NAME\" or inline value. */\n  auth?: string;\n  /**\n   * Backend provider link id for `auth: \"backend\"` connectors. The runner's\n   * token-refresh mediator passes this as the `host.refresh_credential` `id` so\n   * the platform resolves the credential against the right provider link.\n   */\n  providerLinkId?: string;\n  /**\n   * Operating mode for connectors that manage a working copy. Orthogonal to\n   * faces. `agent` = the agent drives the source natively (e.g. native git) and\n   * the connector only provisions short-lived credentials. `sync` = the\n   * connector owns the working copy (clone + watch + auto-commit/pull). Absent =\n   * the driver's legacy `options.{session,sync,lifecycle}` blocks decide.\n   */\n  mode?: \"agent\" | \"sync\";\n  /** Driver-specific configuration. */\n  options?: Record<string, unknown>;\n  /**\n   * Owner-authored instruction text projected from the materialized\n   * CONNECTOR.md body (preset custom instructions). Injected eagerly into the\n   * agent system prompt. Absent when the body is empty.\n   */\n  instructions?: string;\n  /** Filesystem-face config — only meaningful for mountable connectors. */\n  mount?: {\n    /** Source URL or path (repo URL, bucket name, host path). */\n    source: string;\n    /** Override mount target directory (default: `.mounts/<id>/`). */\n    target?: string;\n    /** Watch flag: omitted → watch read-write, skip read-only. */\n    watch?: boolean;\n    /** Expert-only: expose the resolved credential to the agent CLI. */\n    exposeAccessToken?: boolean;\n    /** Optional access-token TTL override (seconds). */\n    accessTokenTTL?: number;\n  };\n  /**\n   * Set by the host when it has already decided this connector cannot be\n   * attached (e.g. a cloud mount whose host-side build failed). The manager\n   * never calls the driver for it and reports it as failed with this reason.\n   */\n  unavailable?: UnavailableMarker;\n}\n\n/**\n * Why the host declared a connector without making it available. `reason` is\n * a short machine-readable token chosen by the host; `detail` is its prose.\n * @docLink packages/connectors/concepts#connector-declaration\n */\nexport interface UnavailableMarker {\n  reason: string;\n  detail?: string;\n}\n\n/**\n * Read an `unavailable:` value from an untyped declaration. Absent, `null` and\n * `false` mean \"not marked\". Any other value marks the connector unavailable —\n * a host that wrote the key meant it. A plain string is taken as the reason;\n * anything else that is not a `{ reason, detail? }` object gets a generic one.\n * @docLink packages/connectors/concepts#connector-declaration\n */\nexport function readUnavailableMarker(value: unknown): UnavailableMarker | undefined {\n  if (value === undefined || value === null || value === false) return undefined;\n  if (typeof value === \"string\" && value.trim() !== \"\") return { reason: value };\n  if (typeof value !== \"object\") return { reason: \"unavailable\" };\n  const { reason, detail } = value as { reason?: unknown; detail?: unknown };\n  const marker: UnavailableMarker = {\n    reason: typeof reason === \"string\" && reason.trim() !== \"\" ? reason : \"unavailable\",\n  };\n  if (typeof detail === \"string\" && detail.trim() !== \"\") marker.detail = detail;\n  return marker;\n}\n\n// ── Connector handle (returned by adapter.connect) ───────────────────────────\n\n/**\n * Live state of a connected backend, returned by `Connector.connect()` (or the\n * legacy `ConnectorAdapter.connect()`) and held by `ConnectorManager`.\n * @docLink packages/connectors/concepts#connector-handle\n */\nexport interface ConnectorHandle {\n  /** Connector declaration ID. */\n  readonly id: string;\n  /** Driver name. */\n  readonly driver: string;\n  /** Effective access level. */\n  readonly access: \"read-only\" | \"read-write\";\n  /** Lifecycle status. Set by every `Connector`. */\n  status: \"connecting\" | \"connected\" | \"error\" | \"disconnected\";\n  /** Present iff the connector has a filesystem face and is mounted. */\n  mountPath?: string;\n  /** Adapter-specific state (connection pool, client, etc.). Opaque to callers. */\n  state: unknown;\n}\n\n/** Optional capability a filesystem-face connector attaches to its handle state\n * when reads need an authoritative remote byte size rather than trusting local\n * filesystem metadata.\n */\nexport interface AuthoritativeSizeProvider {\n  authoritativeSize(relPath: string): Promise<number | null>;\n}\n\n// ── Connector change event ────────────────────────────────────────────────────\n\n/**\n * Change event emitted by a connector adapter's `watch()` implementation.\n * @docLink packages/connectors/concepts#connector-change-event\n */\nexport interface ConnectorChangeEvent {\n  /** Relative path, key, table name, node ID, etc. */\n  path: string;\n  /** What happened. */\n  action: \"create\" | \"edit\" | \"delete\" | \"conflict\";\n  /** What caused the change. */\n  source: \"filesystem\" | \"operation\" | \"remote\" | \"sync\";\n}\n\n// ── ConnectorManager info ────────────────────────────────────────────────────\n\n/**\n * Summary of a connected connector returned by `ConnectorManager.listConnectors()`.\n * @docLink packages/connectors/concepts#connector-info\n */\nexport interface ConnectorInfo {\n  id: string;\n  driver: string;\n  /** Human-readable connection name; the resource-explorer tab renders this over `id`/`driver` when present. */\n  label?: string;\n  access: \"read-only\" | \"read-write\";\n  /** Operation names this connector exposes as agent tools (via describeOperations). */\n  operations: string[];\n}\n\n/**\n * Bulk connect/disconnect result returned by `ConnectorManager.connectAll()` and `disconnectAll()`.\n * @docLink packages/connectors/concepts#connector-report\n */\nexport interface ConnectorReport {\n  results: Array<{ id: string; connected: boolean; error?: string }>;\n}\n\n// ── Field spec (connector credential/config declarations) ────────────────────\n\n/**\n * Input types for `ConnectorFieldSpec`. Controls validation rules and the Forge UI affordance.\n * @docLink packages/connectors/concepts#field-type\n */\nexport type FieldType =\n  | \"text\" // plain string\n  | \"password\" // sensitive; always stored via SecretProvider\n  | \"api-key\" // alias for password with specific UI affordance\n  | \"url\" // validated URL string\n  | \"oauth\" // triggers OAuth flow; oauthService required\n  | \"select\" // enum; choices required and non-empty\n  | \"boolean\" // default must be \"true\" or \"false\" if provided\n  | \"number\"; // default must be a parseable numeric string if provided\n\n/**\n * Declares one credential or configuration field that a connector adapter requires.\n * Used by `ConnectorManager.resolveFields()` and the Forge settings UI.\n * @docLink packages/connectors/concepts#connector-field-spec\n */\nexport interface ConnectorFieldSpec {\n  /** Machine name used as the options key in skaile.yaml. */\n  key: string;\n  /** Human-readable label for the forge settings UI. */\n  label: string;\n  /** Tooltip / help text. */\n  description?: string;\n  /** Input type. Controls validation rules and UI affordance in the forge settings panel. */\n  type: FieldType;\n  /** Whether the adapter refuses to connect when this field is missing. */\n  required: boolean;\n  /** String fallback used when not provided and not required. */\n  default?: string;\n  /** Forge UI masks the value; value is never logged. */\n  sensitive: boolean;\n  /** UI grouping: \"Authentication\", \"Connection\", \"Options\". */\n  group?: string;\n  /**\n   * Required when type === \"select\"; must be non-empty.\n   */\n  choices?: string[];\n  /**\n   * Required when type === \"oauth\".\n   * Identifies the OAuth service, e.g. \"google\".\n   * Used to call OAuthSecretProvider.initiateFlow(oauthService, account).\n   * oauth fields must be declared AFTER any field they reference (e.g., \"account\").\n   */\n  oauthService?: string;\n  /** Example value shown as placeholder text in the forge settings UI. */\n  example?: string;\n}\n\n/**\n * Thrown by `ConnectorManager.connectAll()` and `resolveFields()` when a required\n * adapter field cannot be resolved through the `SecretProviderChain`. Carries the\n * connector ID, the missing field spec, the ref that was tried, and the available\n * providers for actionable error messages.\n * @docLink packages/connectors/concepts#connector-field-missing-error\n */\nexport class ConnectorFieldMissingError extends Error {\n  readonly connectorId: string;\n  readonly field: ConnectorFieldSpec;\n  readonly triedRef: string;\n  readonly availableProviders: string[];\n\n  constructor(opts: {\n    connectorId: string;\n    field: ConnectorFieldSpec;\n    triedRef: string;\n    availableProviders: string[];\n  }) {\n    super(\n      `Connector \"${opts.connectorId}\" is missing required field \"${opts.field.key}\" ` +\n        `(tried: ${opts.triedRef || \"(none)\"}). ` +\n        `Available providers: ${opts.availableProviders.join(\", \") || \"(none)\"}`,\n    );\n    this.name = \"ConnectorFieldMissingError\";\n    this.connectorId = opts.connectorId;\n    this.field = opts.field;\n    this.triedRef = opts.triedRef;\n    this.availableProviders = opts.availableProviders;\n  }\n}\n\n// ── Runtime skill descriptor ──────────────────────────────────────────────────\n\n/**\n * Instance-specific skill descriptor returned by `ConnectorAdapter.describeSkill()`.\n * Returned by `ConnectorManager.listSkills()` to surface connector capabilities to the agent.\n * @docLink packages/connectors/concepts#runtime-skill-descriptor\n */\nexport interface RuntimeSkillDescriptor {\n  /** Connector instance id, e.g. \"gmail-work\". */\n  id: string;\n  /** Short label: \"Gmail — work@company.com\". */\n  name: string;\n  /** Instance-specific description: \"Read and write email for work@company.com\". */\n  description: string;\n  /** Category for grouping in the forge UI. */\n  category: string;\n  access: \"read-only\" | \"read-write\";\n  /** Operation names (without loading full defs) for agent planning. */\n  toolNames: string[];\n}\n\n// ── Token mediator (Tier-2 credential mediation) ─────────────────────────────\n\n/**\n * Result of a single `TokenMediator` call. Mirrors\n * `AccessTokenResponseEvent.result` from `@skaile/workspaces/types` so the runner\n * can pass it straight through.\n *\n * @docLink packages/connectors/api-reference#token-mediator\n */\nexport type TokenMediatorResult =\n  | {\n      ok: true;\n      /** Access token to use for the next git operation. */\n      token: string;\n      /**\n       * ISO-8601 expiry, or `null` for indefinite tokens (static PATs). Drives\n       * whether the driver schedules a refresh tick.\n       */\n      expiresAt: string | null;\n      /** Optional scope/permissions list, surfaced in audit logs. */\n      scope?: string[];\n    }\n  | {\n      ok: false;\n      code: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\" | \"timeout\";\n      /** Human-readable detail, never carries secrets. */\n      message: string;\n    };\n\n/**\n * Function signature mountable connectors use to acquire a fresh access token\n * from the runner-owned backend mediator. Implemented by the runner: emits a\n * `request_access_token` command over the transport and resolves with the\n * matching `access_token_response` payload.\n *\n * Connectors MUST treat this as the only token source when the parsed\n * `MountAuthRef.kind === 'backend'`. Local minting (PAT, OAuth, GitHub App)\n * has been removed from the runner — provider dispatch lives on the platform.\n *\n * @docLink packages/connectors/api-reference#token-mediator\n */\nexport type TokenMediator = (input: {\n  connectorId: string;\n  reason: \"initial\" | \"refresh\" | \"retry-401\";\n  /**\n   * Connector driver, used by the runner mediator to pick the platform refresh\n   * `kind`; absent on `initial` and for legacy callers.\n   */\n  driver?: string;\n  /**\n   * Backend provider link id — the `id` the platform `host.refresh_credential`\n   * capability resolves the credential against. Absent on `initial` and for\n   * legacy callers.\n   */\n  providerLinkId?: string;\n  /**\n   * The connector's declaration id, bound from the declaration like `driver`\n   * and `providerLinkId`. The runner sends it next to the link id on a git\n   * refresh, so a read-only reference sharing its link with a read-write\n   * mount is refreshed read-only. Absent on `initial` and for legacy callers.\n   */\n  declarationId?: string;\n}) => Promise<TokenMediatorResult>;\n\n// ── S3 presigner (backend-signed S3 reads) ───────────────────────────────────\n\n/**\n * Request to the platform's runtime capability `host.s3_presign`. `mountId` is\n * the connector id of an `auth: backend` S3 mount in this session; bucket,\n * prefix and endpoint come from the platform's copy of that declaration.\n */\nexport type S3PresignRequest =\n  | { mountId: string; op: \"list\"; continuationToken?: string }\n  | { mountId: string; op: \"get\"; keys: string[] };\n\n/**\n * Answer from `host.s3_presign`. `list` carries one ListObjectsV2 URL, `get`\n * one GetObject URL per key; folder markers (keys ending in `/`) are listed in\n * `skipped` instead. Every URL expires at `expiresAt` (ten minutes today).\n */\nexport type S3PresignResult =\n  | { ok: true; op: \"list\"; url: string; expiresAt: string }\n  | {\n      ok: true;\n      op: \"get\";\n      urls: { key: string; url: string }[];\n      skipped: { key: string; reason: string }[];\n      expiresAt: string;\n    }\n  | { ok: false; code: string; message: string };\n\n/**\n * Presign client for `auth: backend` S3 mounts, implemented by the runner over\n * the same remote-capability channel as {@link TokenMediator}. The S3 keys stay\n * in the backend; the container only ever sees short-lived read URLs.\n * Never throws: transport failures resolve as `{ ok: false, code: \"backend-error\" }`.\n */\nexport type S3Presigner = (request: S3PresignRequest) => Promise<S3PresignResult>;\n\n// ── Unified connector types ───────────────────────────────────────────────────\n\n/**\n * Context passed to `Connector.connect()` by `ConnectorManager`.\n * @docLink packages/connectors/concepts#connect-context\n */\nexport interface ConnectContext {\n  /**\n   * Absolute project directory the owning `ConnectorManager` runs for (always set by the manager). A connector that needs\n   * an optional npm peer looks in this project's `node_modules` first.\n   */\n  projectDir?: string;\n  /** Secret provider for resolving credential references. */\n  secrets?: SecretProvider;\n  /**\n   * Backend token mediator — present for `auth: backend` connectors of either\n   * face (filesystem or tool), so mount refresh and tool-face OAuth flows share\n   * one path.\n   */\n  tokenMediator?: TokenMediator;\n  /**\n   * Backend S3 presigner — the read path for `auth: backend` S3 mounts. Absent\n   * outside a platform-connected runner.\n   */\n  s3Presigner?: S3Presigner;\n  /**\n   * Absolute directory the manager allocated for the filesystem face.\n   * Present iff `connector.filesystem != null`. The connector projects its\n   * content here during `connect()` and sets `handle.mountPath`.\n   */\n  mountTarget?: string;\n  /** Resolved credential/config fields (from `describeFields()`). */\n  resolvedFields?: Record<string, string>;\n  /**\n   * Aborted when the owning `ConnectorManager` is disposed. Long-running\n   * `connect()` implementations — notably background (deferred) filesystem\n   * mounts — should observe this and bail out promptly so session cleanup\n   * does not wait on a wedged remote.\n   */\n  abortSignal?: AbortSignal;\n}\n\n/**\n * Filesystem face — present ⇒ the connector is \"mountable\".\n * @docLink packages/connectors/concepts#filesystem-face\n */\nexport interface FilesystemFace {\n  /** Pull latest remote state into the mounted directory. */\n  sync(handle: ConnectorHandle, options?: SyncOptions): Promise<SyncResult>;\n}\n\n/**\n * Tool face — present ⇒ the connector exposes agent tools.\n * @docLink packages/connectors/concepts#tool-face\n */\nexport interface ToolFace {\n  read?(handle: ConnectorHandle, path: string): Promise<ConnectorContent | null>;\n  write?(handle: ConnectorHandle, path: string, content: ConnectorContent): Promise<void>;\n  delete?(handle: ConnectorHandle, path: string): Promise<boolean>;\n  list?(handle: ConnectorHandle, path?: string, options?: ListOptions): Promise<ConnectorEntry[]>;\n  search?(handle: ConnectorHandle, query: string, options?: SearchOptions): Promise<SearchResult[]>;\n  describeOperations(handle: ConnectorHandle): OperationDescriptor[];\n  executeOp(\n    handle: ConnectorHandle,\n    operation: string,\n    args: Record<string, unknown>,\n  ): Promise<string>;\n  describeSkill?(\n    handle: ConnectorHandle,\n    declaration: ConnectorDeclaration,\n  ): RuntimeSkillDescriptor;\n}\n\n/**\n * The unified connector contract. A connector should expose at least one face\n * (`filesystem` and/or `tools`); `ConnectorManager` rejects a faceless\n * connector at connect time.\n * @docLink packages/connectors/concepts#connector\n */\nexport interface Connector {\n  readonly name: string;\n  /**\n   * True when `connect()` for this declaration can only get its credential from\n   * `ctx.tokenMediator`. A manager with neither a mediator nor a pre-mint then\n   * fails the connect without calling the driver, whose failure path may write\n   * shared state (the git driver's credential helper) the live session uses.\n   */\n  requiresTokenMediator?(declaration: ConnectorDeclaration): boolean;\n  connect(declaration: ConnectorDeclaration, ctx: ConnectContext): Promise<ConnectorHandle>;\n  disconnect(handle: ConnectorHandle): Promise<void>;\n  readonly filesystem?: FilesystemFace;\n  readonly tools?: ToolFace;\n  describeFields?(): ConnectorFieldSpec[];\n  setLogger?(logger: Logger): void;\n  watch?(\n    handle: ConnectorHandle,\n    callback: (e: ConnectorChangeEvent) => void,\n    options?: WatchOptions,\n  ): WatchHandle;\n  onHibernate?(handle: ConnectorHandle): Promise<ConnectorHookOutcome>;\n  onSessionClose?(handle: ConnectorHandle): Promise<ConnectorHookOutcome>;\n}\n\n/**\n * Structured return of a lifecycle hook (`onHibernate` / `onSessionClose`).\n * `detail` is the same human-readable line a hook can return as a plain string;\n * `pushState` is what the connector can prove about its working copy, copied\n * onto the hook's `LifecycleResult`.\n */\nexport interface ConnectorHookReport {\n  detail?: string;\n  pushState?: ConnectorPushState;\n}\n\n/** What a lifecycle hook may return: a detail line, a structured report, or nothing. */\nexport type ConnectorHookOutcome = string | ConnectorHookReport | undefined;\n\n/**\n * Factory used by the connector registry.\n * @docLink packages/connectors/api-reference#connector-factory\n */\nexport type ConnectorFactory = () => Connector;\n\n/**\n * Per-connector bulk-connect result returned by `ConnectorManager.connectAll()`.\n * @docLink packages/connectors/concepts#connector-startup-report\n */\nexport interface ConnectorStartupReport {\n  results: Array<{\n    id: string;\n    connected: boolean;\n    /**\n     * A fleet mount whose readiness check missed its deadline: registered with\n     * `connected: false`, retried in the background, and not a failure.\n     * `error` says why it is not live yet.\n     */\n    connecting?: boolean;\n    mountPath?: string;\n    error?: string;\n    access?: \"read-only\" | \"read-write\";\n  }>;\n}\n\n/**\n * A connector that failed to connect, as returned by\n * `ConnectorManager.listFailedConnectors()`.\n *\n * A failed connector never enters the manager's active map, so it is absent\n * from `listConnectors()` and `get()` by design — those describe what the agent\n * can actually use. This record is the second list that keeps the failure\n * itself visible.\n *\n * @docLink packages/connectors/concepts#connector-manager\n */\nexport interface FailedConnectorInfo {\n  id: string;\n  driver: string;\n  access: \"read-only\" | \"read-write\";\n  label?: string;\n  /** `mount.source` when declared. */\n  source?: string;\n  /** Resolved absolute mount target, when the declaration has a mount. */\n  mountPath?: string;\n  /** True when the failure is fail-fast material: read-write AND mount-bearing. */\n  required: boolean;\n  /** The connect error message. */\n  error: string;\n  /** Present when the host declared the connector unavailable; no connect was attempted. */\n  unavailable?: UnavailableMarker;\n}\n\n/**\n * Thrown by `connectAll` when a read-write mountable connector fails and\n * `failOnReadWriteError` was set.\n * @docLink packages/connectors/concepts#connector-startup-error\n */\nexport class ConnectorStartupError extends Error {\n  readonly report: ConnectorStartupReport;\n  readonly failedReadWrite: ReadonlyArray<{ id: string; error: string }>;\n  constructor(\n    message: string,\n    report: ConnectorStartupReport,\n    failedReadWrite: ReadonlyArray<{ id: string; error: string }>,\n  ) {\n    super(message);\n    this.name = \"ConnectorStartupError\";\n    this.report = report;\n    this.failedReadWrite = failedReadWrite;\n  }\n}\n","/**\n * Derive runtime connector declarations from the platform-materialized\n * `.skaile/assets/connector/<name>/CONNECTOR.md` projection.\n *\n * Connector mirror of MCP's `loadMaterializedMcpDeclarations` /\n * `deriveSingleMaterializedMcpDeclaration`. The generated `CONNECTOR.md` carries\n * a RUNTIME declaration (driver/access/auth/mode/options/mount) — distinct from\n * the catalog `CONNECTOR.md` parsed by `core/manifest.ts:fromConnectorMd`\n * (entry/fields). Driver is referenced by name (first-party; resolved via the\n * connector registry — no code-loading).\n */\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseFrontmatter } from \"../../core/src/manifest.js\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/** Parse a generated CONNECTOR.md (runtime projection) into a ConnectorDeclaration. */\nexport function fromMaterializedConnectorMd(filePath: string, name: string): ConnectorDeclaration {\n  const { data: meta, body } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n  const id = String(meta.name ?? name);\n  const decl: ConnectorDeclaration = {\n    id,\n    driver: String(meta.driver ?? \"\"),\n    access: meta.access === \"read-write\" ? \"read-write\" : \"read-only\",\n  };\n  if (meta.access !== \"read-write\" && meta.access !== \"read-only\") decl.accessDefaulted = true;\n  if (typeof meta.label === \"string\" && meta.label) decl.label = meta.label;\n  if (typeof meta.auth === \"string\") decl.auth = meta.auth;\n  if (typeof meta.providerLinkId === \"string\" && meta.providerLinkId) {\n    decl.providerLinkId = meta.providerLinkId;\n  }\n  if (meta.mode === \"agent\" || meta.mode === \"sync\") decl.mode = meta.mode;\n  if (meta.options && typeof meta.options === \"object\" && !Array.isArray(meta.options)) {\n    decl.options = meta.options as Record<string, unknown>;\n  }\n  if (meta.mount && typeof meta.mount === \"object\" && !Array.isArray(meta.mount)) {\n    const m = meta.mount as Record<string, unknown>;\n    decl.mount = {\n      source: String(m.source ?? \"\"),\n      ...(m.target !== undefined ? { target: String(m.target) } : {}),\n      ...(typeof m.watch === \"boolean\" ? { watch: m.watch } : {}),\n      ...(typeof m.exposeAccessToken === \"boolean\"\n        ? { exposeAccessToken: m.exposeAccessToken }\n        : {}),\n      ...(typeof m.accessTokenTTL === \"number\" ? { accessTokenTTL: m.accessTokenTTL } : {}),\n    };\n  }\n  const trimmedBody = body.trim();\n  if (trimmedBody.length > 0) decl.instructions = trimmedBody;\n  return decl;\n}\n\n/** Provide `.instance.json` config entries as defaults under the declaration's options (the CONNECTOR.md declaration wins on key collision). */\nfunction foldInstanceConfig(decl: ConnectorDeclaration, instancePath: string): void {\n  if (!existsSync(instancePath)) return;\n  let parsed: { config?: Record<string, unknown> };\n  try {\n    parsed = JSON.parse(readFileSync(instancePath, \"utf8\"));\n  } catch {\n    return;\n  }\n  const config = parsed.config;\n  if (!config || typeof config !== \"object\" || Array.isArray(config)) return;\n  decl.options = { ...(config as Record<string, unknown>), ...(decl.options ?? {}) };\n}\n\n/** Derive a single materialized connector declaration; null when no CONNECTOR.md. */\nexport function deriveSingleMaterializedConnectorDeclaration(\n  connectorAssetsDir: string,\n  name: string,\n): ConnectorDeclaration | null {\n  const sub = join(connectorAssetsDir, name);\n  const md = join(sub, \"CONNECTOR.md\");\n  if (!existsSync(md)) return null;\n  const decl = fromMaterializedConnectorMd(md, name);\n  foldInstanceConfig(decl, join(sub, \".instance.json\"));\n  return decl;\n}\n\n/** Scan `<projectDir>/.skaile/assets/connector/*` for materialized connectors. */\nexport function loadMaterializedConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const root = join(projectDir, \".skaile/assets/connector\");\n  if (!existsSync(root)) return [];\n  const out: ConnectorDeclaration[] = [];\n  for (const name of readdirSync(root)) {\n    try {\n      const sub = join(root, name);\n      if (!statSync(sub).isDirectory()) continue;\n      const decl = deriveSingleMaterializedConnectorDeclaration(root, name);\n      if (decl) out.push(decl);\n    } catch {\n      // Per-directory failure is isolated — one bad asset never aborts the scan.\n    }\n  }\n  return out;\n}\n","/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\n// Narrow module, not the `core/logging` barrel: it re-exports the SQLite sink,\n// whose `import.meta` breaks consumers that transpile this entry to CommonJS.\nimport { createLogger } from \"../../core/src/logging/create-logger.js\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>`, `connector:<id>`, and `mcp:<id>`.\n * Returns `undefined` for any other ref so the chain falls through to the\n * next provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capabilities\n * stay strictly in-process — no round trip to the platform to mint while\n * the resource is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors, mcp }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n    mcp?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.mcp ?? {})) {\n      this.mints.set(`mcp:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capability\n   * handlers when the platform delivers new credentials mid-session.\n   */\n  set(kind: \"mount\" | \"connector\" | \"mcp\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\" | \"mcp\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` / `mcp:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\" | \"mcp\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\") || ref.startsWith(\"mcp:\")))\n      return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\n  \"env:\",\n  \"vault:\",\n  \"forge:\",\n  \"op:\",\n  \"kp:\",\n  \"oauth:\",\n  \"mount:\",\n  \"connector:\",\n  \"mcp:\",\n] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * True when `value` starts with a known secret-ref prefix (`env:`, `oauth:`,\n * `mcp:`, ...). Lets callers distinguish an intended-but-unresolved ref from a\n * plain literal — e.g. the runner refuses to forward an unresolved ref into\n * MCP transport headers/env, where the literal would otherwise leak onto the\n * wire and produce a misleading upstream error.\n */\nexport function isKnownSecretRef(value: string): boolean {\n  return getPrefix(value) !== undefined;\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ResolvedSkaileConfig } from \"@skaile/workspaces/types\";\n// Narrow modules, not the `core` barrels: their chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { createLogger } from \"../../core/src/logging/create-logger.js\";\nimport {\n  localConnectorMountDir,\n  resolveSkWorkspaceConfig,\n  type ConnectorDeclaration as WorkspaceConnector,\n} from \"../../core/src/workspace-config.js\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\nimport { readUnavailableMarker } from \"./connector-types.js\";\nimport { loadMaterializedConnectorDeclarations } from \"./materialized-connectors.js\";\n\nconst configLog = createLogger({ kind: \"connector\", subkind: \"config\" });\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Merged array of connector declarations from `skaile.yaml` and the materialized\n *   `.skaile/assets/connector/*` disk projection (Phase 2.5); empty array if neither source\n *   contributes any entries. `skaile.yaml` wins on id collision.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  return withMaterializedConnectorDeclarations(\n    loadYamlConnectorDeclarations(projectDir),\n    projectDir,\n  );\n}\n\n/**\n * The `skaile.yaml` half of {@link loadConnectorDeclarations}: only the `connectors:` entries,\n * without the materialized projection. The runner needs it on its own because in broker mode the\n * session root keeps materialized connectors across wakes while its yaml declares nothing, and the\n * `session_init` wire set must then stand in for the yaml half, not for both.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n */\nexport function loadYamlConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  return config.connectors && config.connectors.length > 0\n    ? config.connectors.map((c) => workspaceConnectorToDeclaration(c, projectDir))\n    : [];\n}\n\n/**\n * Add the materialized `.skaile/assets/connector/*` projection to `base`. Library-assigned\n * connectors reach the runner only through that projection. `base` is explicit config (the\n * skaile.yaml entries, or the `session_init` wire set standing in for them) and wins on id\n * collision; the shadowed materialized connector is logged, not silently dropped.\n */\nexport function withMaterializedConnectorDeclarations(\n  base: ConnectorDeclaration[],\n  projectDir: string,\n): ConnectorDeclaration[] {\n  const byId = new Map<string, ConnectorDeclaration>();\n  for (const d of base) byId.set(d.id, d);\n  for (const d of loadMaterializedConnectorDeclarations(projectDir)) {\n    if (byId.has(d.id)) {\n      configLog.warn(`materialized connector '${d.id}' shadowed by an explicit connector`);\n      continue;\n    }\n    byId.set(d.id, d);\n  }\n  return [...byId.values()];\n}\n\n/**\n * A declared `access` as the manager enforces it: only `read-write` writes. A missing value and an\n * unknown one (`rw`, a typo) read-only, so a wrong spelling never opens a mount for writing.\n */\nfunction accessOf(access: string | undefined): \"read-only\" | \"read-write\" {\n  return access === \"read-write\" ? \"read-write\" : \"read-only\";\n}\n\nfunction workspaceConnectorToDeclaration(\n  c: WorkspaceConnector,\n  projectDir: string,\n): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: accessOf(c.access),\n    auth: c.auth,\n    options: c.options,\n  };\n  if (c.access == null) decl.accessDefaulted = true;\n\n  // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n  if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n\n  const unavailable = readUnavailableMarker(c.unavailable);\n  if (unavailable) decl.unavailable = unavailable;\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  } else if (c.driver === \"local\") {\n    // `mountPath:` names the host directory. An absolute source with no target makes the manager\n    // bind the connector straight to it, so reads and writes land in that directory.\n    const source = localConnectorMountDir(c, projectDir);\n    if (source) decl.mount = { source };\n  }\n\n  return decl;\n}\n\n/**\n * Map a Protocol v3 `session_init` `resolvedConfig` to `ConnectorDeclaration[]`.\n *\n * Wire mounts are flat (`source` / `target` / `watch` top-level per\n * `ResolvedSkaileConfig`); declarations carry them in the `mount:` sub-block.\n * Wire `connectors` (tool-face) map without a mount block. Malformed entries\n * (missing `id`, `driver`, or — for mounts — `source`) are logged and dropped,\n * never thrown: one bad wire entry must not kill session boot. Duplicate ids\n * (within or across the two arrays) keep the FIRST occurrence — mounts precede\n * connectors — and the shadowed entry is logged and dropped the same way.\n *\n * Pure function, no I/O. Used by the runner in place of the `skaile.yaml`\n * entries when `skaile.yaml` declares no connectors (broker mode, where the\n * delivered yaml carries no declarations). Materialized connectors are added\n * on top either way.\n *\n * @param resolved - `mounts` / `connectors` arrays from the platform-resolved config.\n * @returns Declarations in wire order — mounts first, then connectors.\n * @docLink packages/connectors/api-reference#resolved-config-to-declarations\n */\nexport function resolvedConfigToDeclarations(\n  resolved: Pick<ResolvedSkaileConfig, \"mounts\" | \"connectors\">,\n): ConnectorDeclaration[] {\n  // Keyed by id: the wire carries no well-formedness guarantee, and a duplicate\n  // id downstream would collide on mount paths / tool namespaces. First wins.\n  const byId = new Map<string, ConnectorDeclaration>();\n  const pushUnlessDuplicate = (kind: \"mount\" | \"connector\", decl: ConnectorDeclaration): void => {\n    if (byId.has(decl.id)) {\n      configLog.warn(`dropping duplicate resolvedConfig ${kind} (id already declared)`, {\n        id: decl.id,\n      });\n      return;\n    }\n    byId.set(decl.id, decl);\n  };\n\n  for (const m of resolved.mounts ?? []) {\n    // A mount without a source cannot connect — drop it with the malformed ones.\n    if (\n      typeof m?.id !== \"string\" ||\n      typeof m?.driver !== \"string\" ||\n      typeof m.source !== \"string\"\n    ) {\n      configLog.warn(\"dropping malformed resolvedConfig mount (missing id/driver/source)\", {\n        id: (m as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: m.id,\n      driver: m.driver,\n      access: accessOf(m.access),\n      ...(m.access == null ? { accessDefaulted: true as const } : {}),\n      auth: m.auth,\n      options: m.options,\n      mount: {\n        source: m.source,\n        target: m.target,\n        watch: m.watch,\n        exposeAccessToken: m.exposeAccessToken,\n        accessTokenTTL: m.accessTokenTTL,\n      },\n    };\n    // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n    if (m.providerLinkId) decl.providerLinkId = m.providerLinkId;\n    pushUnlessDuplicate(\"mount\", decl);\n  }\n\n  for (const c of resolved.connectors ?? []) {\n    if (typeof c?.id !== \"string\" || typeof c?.driver !== \"string\") {\n      configLog.warn(\"dropping malformed resolvedConfig connector (missing id/driver)\", {\n        id: (c as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: c.id,\n      driver: c.driver,\n      access: accessOf(c.access),\n      ...(c.access == null ? { accessDefaulted: true as const } : {}),\n      auth: c.auth,\n      options: c.options,\n    };\n    if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n    pushUnlessDuplicate(\"connector\", decl);\n  }\n\n  return [...byId.values()];\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n"]}
+{"version":3,"sources":["../connectors/src/connector-types.ts","../connectors/src/materialized-connectors.ts","../connectors/src/secrets.ts","../connectors/src/config.ts"],"names":[],"mappings":";;;;;;;AAqHO,SAAS,sBAAsB,KAAA,EAA+C;AACnF,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,OAAO,OAAO,MAAA;AACrE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAM;AAC7E,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,EAAE,QAAQ,aAAA,EAAc;AAC9D,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAC3B,EAAA,MAAM,MAAA,GAA4B;AAAA,IAChC,MAAA,EAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,OAAO,IAAA,EAAK,KAAM,KAAK,MAAA,GAAS;AAAA,GACxE;AACA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,CAAO,MAAK,KAAM,EAAA,SAAW,MAAA,GAAS,MAAA;AACxE,EAAA,OAAO,MAAA;AACT;AAmIO,IAAM,0BAAA,GAAN,cAAyC,KAAA,CAAM;AAAA,EAC3C,WAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,kBAAA;AAAA,EAET,YAAY,IAAA,EAKT;AACD,IAAA,KAAA;AAAA,MACE,cAAc,IAAA,CAAK,WAAW,CAAA,6BAAA,EAAgC,IAAA,CAAK,MAAM,GAAG,CAAA,UAAA,EAC/D,IAAA,CAAK,QAAA,IAAY,QAAQ,CAAA,wBAAA,EACZ,IAAA,CAAK,mBAAmB,IAAA,CAAK,IAAI,KAAK,QAAQ,CAAA;AAAA,KAC1E;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,4BAAA;AACZ,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AAClB,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,QAAA;AACrB,IAAA,IAAA,CAAK,qBAAqB,IAAA,CAAK,kBAAA;AAAA,EACjC;AACF;AA0SO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EACtC,MAAA;AAAA,EACA,eAAA;AAAA,EACT,WAAA,CACE,OAAA,EACA,MAAA,EACA,eAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AACF;AC7jBO,SAAS,2BAAA,CAA4B,UAAkB,IAAA,EAAoC;AAChG,EAAA,MAAM,EAAE,MAAM,IAAA,EAAM,IAAA,KAAS,gBAAA,CAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAC5E,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,IAAI,CAAA;AACnC,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,EAAA;AAAA,IACA,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,MAAA,KAAW,YAAA,GAAe,YAAA,GAAe;AAAA,GACxD;AACA,EAAA,IAAI,KAAK,MAAA,KAAW,YAAA,IAAgB,KAAK,MAAA,KAAW,WAAA,OAAkB,eAAA,GAAkB,IAAA;AACxF,EAAA,IAAI,OAAO,KAAK,KAAA,KAAU,QAAA,IAAY,KAAK,KAAA,EAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AACpE,EAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpD,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,QAAA,IAAY,KAAK,cAAA,EAAgB;AAClE,IAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,cAAA;AAAA,EAC7B;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,OAAA,IAAW,IAAA,CAAK,SAAS,MAAA,EAAQ,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACpE,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACpF,IAAA,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AAAA,EACtB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,IAAA,CAAK,KAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,EAAE,CAAA;AAAA,MAC7B,GAAI,CAAA,CAAE,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA,EAAE,GAAI,EAAC;AAAA,MAC7D,GAAI,OAAO,CAAA,CAAE,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,MACzD,GAAI,OAAO,CAAA,CAAE,iBAAA,KAAsB,SAAA,GAC/B,EAAE,iBAAA,EAAmB,CAAA,CAAE,iBAAA,EAAkB,GACzC,EAAC;AAAA,MACL,GAAI,OAAO,CAAA,CAAE,cAAA,KAAmB,QAAA,GAAW,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI;AAAC,KACrF;AAAA,EACF;AACA,EAAA,MAAM,WAAA,GAAc,KAAK,IAAA,EAAK;AAC9B,EAAA,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,IAAA,CAAK,YAAA,GAAe,WAAA;AAChD,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,kBAAA,CAAmB,MAA4B,YAAA,EAA4B;AAClF,EAAA,IAAI,CAAC,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,YAAA,EAAc,MAAM,CAAC,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACpE,EAAA,IAAA,CAAK,OAAA,GAAU,EAAE,GAAI,MAAA,EAAoC,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACnF;AAGO,SAAS,4CAAA,CACd,oBACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,kBAAA,EAAoB,IAAI,CAAA;AACzC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACnC,EAAA,IAAI,CAAC,UAAA,CAAW,EAAE,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,2BAAA,CAA4B,EAAA,EAAI,IAAI,CAAA;AACjD,EAAA,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,gBAAgB,CAAC,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,sCAAsC,UAAA,EAA4C;AAChG,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,0BAA0B,CAAA;AACxD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,SAAU,EAAC;AAC/B,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA,EAAG;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAC3B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,CAAE,aAAY,EAAG;AAClC,MAAA,MAAM,IAAA,GAAO,4CAAA,CAA6C,IAAA,EAAM,IAAI,CAAA;AACpE,MAAA,IAAI,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;;;ACrFA,IAAM,MAAM,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,WAAW,CAAA;AAqD3D,IAAM,yBAAN,MAAoE;AAAA,EACxD,KAAA,uBAAY,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACrD;AACF;AASO,IAAM,oBAAN,MAAkD;AAAA,EACvD,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AA0CO,IAAM,0BAAN,MAAwD;AAAA,EAC5C,KAAA,uBAAY,GAAA,EAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9D,YAAY,WAAA,EAIT;AACD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,MAAA,IAAU,EAAE,CAAA,EAAG;AACjE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,MAAA,EAAS,EAAE,IAAI,IAAI,CAAA;AAAA,IACpC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AACrE,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,UAAA,EAAa,EAAE,IAAI,IAAI,CAAA;AAAA,IACxC;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA,CAAY,GAAA,IAAO,EAAE,CAAA,EAAG;AAC9D,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,EAAO,EAAE,IAAI,IAAI,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,GAAA,CAAI,IAAA,EAAqC,EAAA,EAAY,IAAA,EAAiC;AACpF,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,MAAqC,EAAA,EAAqB;AAC9D,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,CAAQ,MAAqC,EAAA,EAA6C;AACxF,IAAA,OAAO,KAAK,KAAA,CAAM,GAAA,CAAI,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,EACvC;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,EAAE,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,CAAA;AACrF,MAAA,OAAO,MAAA;AACT,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,OAAO,IAAA,EAAM,EAAA,GAAK,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjC;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAAE,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA;AAAA,EACzE;AACF;AAQO,IAAM,sBAAN,MAAiE;AAAA,EACrD,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAEjD,UAAU,OAAA,EAAuC;AAC/C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,MAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAChE,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACvD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,QAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,WAAA,CAAY,QAAA,EAAkB,OAAA,EAAiB,KAAA,EAAe;AAC5D,IAAA,KAAA,CAAM,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAE,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AA+CO,IAAe,uBAAf,MAA8D;AAAA,EACnE,MAAA,GAAS,IAAA;AAAA,EACU,KAAA,uBAAY,GAAA,EAAoB;AAAA,EAGnD,MAAM,OAAO,UAAA,EAAmC;AAC9C,IAAA,MAAM,IAAA,CAAK,SAAS,UAAU,CAAA;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA,EAIA,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,MAAA;AACxB,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,GAAG,OAAO,MAAA;AACzC,IAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,GAAA,CAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EACrD;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AACzB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/D;AACF;AAIA,IAAM,cAAA,GAAiB;AAAA,EACrB,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,UAAU,GAAA,EAAiC;AAClD,EAAA,OAAO,eAAe,IAAA,CAAK,CAAC,MAAM,GAAA,CAAI,UAAA,CAAW,CAAC,CAAC,CAAA;AACrD;AASO,SAAS,iBAAiB,KAAA,EAAwB;AACvD,EAAA,OAAO,SAAA,CAAU,KAAK,CAAA,KAAM,MAAA;AAC9B;AASO,IAAM,sBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzD,YAA6B,SAAA,EAA6B;AAA7B,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAA8B;AAAA,EAA9B,SAAA;AAAA,EAE7B,QAAQ,GAAA,EAAiC;AACvC,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,MAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,IAAA,GAAA,CAAI,MAAM,gBAAA,EAAkB,EAAE,KAAK,MAAA,EAAQ,MAAA,IAAU,UAAU,CAAA;AAC/D,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,QAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,MAChC;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACzB,MAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,GAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAA,CAAK,uBAAA,EAAyB,EAAE,GAAA,EAAK,CAAA;AACzC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,IAAI,GAAA,EAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,KAAM,MAAA;AAAA,EAC/B;AAAA,EAEA,YAAA,GAAyB;AACvB,IAAA,MAAM,GAAA,GAAM,KAAK,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAA;AAC1D,IAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA,EAGA,YAAY,GAAA,EAAyC;AACnD,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,SAAA,EAAW;AAC9B,MAAA,IAAI,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAW,OAAO,CAAA;AAAA,IAC3C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AAClC,IAAA,IACE,SACA,aAAA,IAAiB,KAAA,IACjB,OAAQ,KAAA,CAA8B,gBAAgB,UAAA,EACtD;AACA,MAAA,IAAI;AACF,QAAA,MAAO,KAAA,CAA8B,YAAY,GAAG,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,GAAA,CAAI,KAAA,CAAM,oCAAA,EAAsC,GAAA,EAAK,EAAE,KAAK,CAAA;AAC5D,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AC3bA,IAAM,YAAY,YAAA,CAAa,EAAE,MAAM,WAAA,EAAa,OAAA,EAAS,UAAU,CAAA;AAahE,SAAS,0BAA0B,UAAA,EAA4C;AACpF,EAAA,OAAO,qCAAA;AAAA,IACL,8BAA8B,UAAU,CAAA;AAAA,IACxC;AAAA,GACF;AACF;AAUO,SAAS,8BAA8B,UAAA,EAA4C;AACxF,EAAA,MAAM,MAAA,GAAS,yBAAyB,UAAU,CAAA;AAGlD,EAAA,IAAI,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAO,UAAA,IAAc,MAAA,CAAO,UAAA,CAAW,MAAA,GAAS,IACnD,MAAA,CAAO,UAAA,CAAW,GAAA,CAAI,CAAC,MAAM,+BAAA,CAAgC,CAAA,EAAG,UAAU,CAAC,IAC3E,EAAC;AACP;AAQO,SAAS,qCAAA,CACd,MACA,UAAA,EACwB;AACxB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,KAAA,MAAW,KAAK,IAAA,EAAM,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AACtC,EAAA,KAAA,MAAW,CAAA,IAAK,qCAAA,CAAsC,UAAU,CAAA,EAAG;AACjE,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AAClB,MAAA,SAAA,CAAU,IAAA,CAAK,CAAA,wBAAA,EAA2B,CAAA,CAAE,EAAE,CAAA,mCAAA,CAAqC,CAAA;AACnF,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,EAAA,EAAI,CAAC,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAMA,SAAS,SAAS,MAAA,EAAwD;AACxE,EAAA,OAAO,MAAA,KAAW,eAAe,YAAA,GAAe,WAAA;AAClD;AAEA,SAAS,+BAAA,CACP,GACA,UAAA,EACsB;AACtB,EAAA,MAAM,IAAA,GAA6B;AAAA,IACjC,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,MAAA,EAAQ,QAAA,CAAS,CAAA,CAAE,MAAM,CAAA;AAAA,IACzB,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE;AAAA,GACb;AACA,EAAA,IAAI,CAAA,CAAE,MAAA,IAAU,IAAA,EAAM,IAAA,CAAK,eAAA,GAAkB,IAAA;AAG7C,EAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAE9C,EAAA,MAAM,WAAA,GAAc,qBAAA,CAAsB,CAAA,CAAE,WAAW,CAAA;AACvD,EAAA,IAAI,WAAA,OAAkB,WAAA,GAAc,WAAA;AAGpC,EAAA,IAAI,EAAE,KAAA,EAAO;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,MAAA,EAAQ,EAAE,KAAA,CAAM,MAAA;AAAA,MAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,MACf,iBAAA,EAAmB,EAAE,KAAA,CAAM,iBAAA;AAAA,MAC3B,cAAA,EAAgB,EAAE,KAAA,CAAM;AAAA,KAC1B;AAAA,EACF,CAAA,MAAA,IAAW,CAAA,CAAE,MAAA,KAAW,OAAA,EAAS;AAG/B,IAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,CAAA,EAAG,UAAU,CAAA;AACnD,IAAA,IAAI,MAAA,EAAQ,IAAA,CAAK,KAAA,GAAQ,EAAE,MAAA,EAAO;AAAA,EACpC;AAEA,EAAA,OAAO,IAAA;AACT;AAsBO,SAAS,6BACd,QAAA,EACwB;AAGxB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAkC;AACnD,EAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,EAA6B,IAAA,KAAqC;AAC7F,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG;AACrB,MAAA,SAAA,CAAU,IAAA,CAAK,CAAA,kCAAA,EAAqC,IAAI,CAAA,sBAAA,CAAA,EAA0B;AAAA,QAChF,IAAI,IAAA,CAAK;AAAA,OACV,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,EAAA,EAAI,IAAI,CAAA;AAAA,EACxB,CAAA;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG;AAErC,IAAA,IACE,OAAO,CAAA,EAAG,EAAA,KAAO,QAAA,IACjB,OAAO,CAAA,EAAG,MAAA,KAAW,QAAA,IACrB,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EACpB;AACA,MAAA,SAAA,CAAU,KAAK,oEAAA,EAAsE;AAAA,QACnF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,QAAA,CAAS,CAAA,CAAE,MAAM,CAAA;AAAA,MACzB,GAAI,EAAE,MAAA,IAAU,IAAA,GAAO,EAAE,eAAA,EAAiB,IAAA,KAAkB,EAAC;AAAA,MAC7D,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,KAAA,EAAO;AAAA,QACL,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,OAAO,CAAA,CAAE,KAAA;AAAA,QACT,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE;AAAA;AACpB,KACF;AAEA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,SAAS,IAAI,CAAA;AAAA,EACnC;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,QAAA,CAAS,UAAA,IAAc,EAAC,EAAG;AACzC,IAAA,IAAI,OAAO,CAAA,EAAG,EAAA,KAAO,YAAY,OAAO,CAAA,EAAG,WAAW,QAAA,EAAU;AAC9D,MAAA,SAAA,CAAU,KAAK,iEAAA,EAAmE;AAAA,QAChF,IAAK,CAAA,EAAoC;AAAA,OAC1C,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,MAAA,EAAQ,QAAA,CAAS,CAAA,CAAE,MAAM,CAAA;AAAA,MACzB,GAAI,EAAE,MAAA,IAAU,IAAA,GAAO,EAAE,eAAA,EAAiB,IAAA,KAAkB,EAAC;AAAA,MAC7D,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE;AAAA,KACb;AACA,IAAA,IAAI,CAAA,CAAE,cAAA,EAAgB,IAAA,CAAK,cAAA,GAAiB,CAAA,CAAE,cAAA;AAC9C,IAAA,mBAAA,CAAoB,aAAa,IAAI,CAAA;AAAA,EACvC;AAEA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA;AAC1B;AAcO,SAAS,8BAAA,CACd,aAAA,EACA,cAAA,GAAmC,EAAC,EACf;AACrB,EAAA,OAAO,IAAI,oBAAoB,CAAC,GAAG,gBAAgB,aAAA,EAAe,IAAI,iBAAA,EAAmB,CAAC,CAAA;AAC5F;AASO,SAAS,4BAAA,CACd,YAAA,GAAuC,EAAC,EACnB;AACrB,EAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAuB;AACvC,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAC,IAAI,iBAAA,EAAkB,EAAG,GAAG,CAAC,CAAA;AAC/D;AA0CO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACT,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,MAAM,KAAA,GAAQ,OAAA,GAAU,CAAA,WAAA,EAAc,OAAO,CAAA,CAAA,CAAA,GAAM,EAAA;AACnD,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,KAAK,CAAA,GAAA,EAAM,IAAI,CAAA;AAAA;AAAA;AAAA,4DAAA;AAAA,KAKvD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAmBO,SAAS,qBAAA,CACd,IAAA,EACA,EAAA,EACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AACtC;AAmBO,SAAS,cAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,KAAK,IAAA,EAAK;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,MAAA,CAAO,MAAM,CAAA,EAAG,GAAA,EAAK,IAAA,EAAK;AAAA,EACpE;AAIA,EAAA,MAAM,IAAI,sBAAA,CAAuB,IAAA,EAAM,OAAO,CAAA;AAChD","file":"chunk-SBAUZ7XH.js","sourcesContent":["/**\n * Connector adapter infrastructure types.\n *\n * Connectors are external backends (databases, KV stores, object stores,\n * in-process state, git repos, etc.). A connector exposes up to two faces: a\n * `ToolFace` (agents access it through injected tools) and/or a\n * `FilesystemFace` (the connector projects content into a mounted directory).\n *\n * @docLink packages/connectors/concepts#connector-types\n */\n\nimport type {\n  ConnectorContent,\n  ConnectorEntry,\n  ListOptions,\n  OperationDescriptor,\n  SearchOptions,\n  SearchResult,\n  SyncOptions,\n  SyncResult,\n  WatchHandle,\n  WatchOptions,\n} from \"./shared-types.js\";\n\nexport type { OperationDescriptor } from \"./shared-types.js\";\n\nimport type { ConnectorPushState, Logger } from \"@skaile/workspaces/types\";\nimport type { SecretProvider } from \"./secrets.js\";\n\n// ── Connector declaration (runtime config, resolved from skaile.yaml) ────────\n\n/**\n * Parsed connector configuration from `skaile.yaml`, passed to `ConnectorAdapter.connect()` and held by `ConnectorManager`.\n * @docLink packages/connectors/concepts#connector-declaration\n */\nexport interface ConnectorDeclaration {\n  /** Unique identifier for this connector instance. */\n  id: string;\n  /** Driver type: \"postgres\", \"redis\", \"memory\", \"xstate\", \"yjs\", etc. */\n  driver: string;\n  /**\n   * Human-readable connection name, projected from the materialized CONNECTOR.md\n   * frontmatter `label`. The platform resource-explorer tab renders this over the\n   * driver name when present; absent for connectors with no configured name.\n   */\n  label?: string;\n  /** Access level enforced by the manager. */\n  access: \"read-only\" | \"read-write\";\n  /**\n   * True when the source set no `access` and the parser filled in the\n   * `read-only` default. The git driver's read-only mode (discard edits, never\n   * push) runs only on an explicit `read-only`, so an undeclared mount keeps\n   * its earlier behaviour.\n   */\n  accessDefaulted?: true;\n  /** Credential reference: \"env:VAR_NAME\" or inline value. */\n  auth?: string;\n  /**\n   * Backend provider link id for `auth: \"backend\"` connectors. The runner's\n   * token-refresh mediator passes this as the `host.refresh_credential` `id` so\n   * the platform resolves the credential against the right provider link.\n   */\n  providerLinkId?: string;\n  /**\n   * Operating mode for connectors that manage a working copy. Orthogonal to\n   * faces. `agent` = the agent drives the source natively (e.g. native git) and\n   * the connector only provisions short-lived credentials. `sync` = the\n   * connector owns the working copy (clone + watch + auto-commit/pull). Absent =\n   * the driver's legacy `options.{session,sync,lifecycle}` blocks decide.\n   */\n  mode?: \"agent\" | \"sync\";\n  /** Driver-specific configuration. */\n  options?: Record<string, unknown>;\n  /**\n   * Owner-authored instruction text projected from the materialized\n   * CONNECTOR.md body (preset custom instructions). Injected eagerly into the\n   * agent system prompt. Absent when the body is empty.\n   */\n  instructions?: string;\n  /** Filesystem-face config — only meaningful for mountable connectors. */\n  mount?: {\n    /** Source URL or path (repo URL, bucket name, host path). */\n    source: string;\n    /** Override mount target directory (default: `.mounts/<id>/`). */\n    target?: string;\n    /** Watch flag: omitted → watch read-write, skip read-only. */\n    watch?: boolean;\n    /** Expert-only: expose the resolved credential to the agent CLI. */\n    exposeAccessToken?: boolean;\n    /** Optional access-token TTL override (seconds). */\n    accessTokenTTL?: number;\n  };\n  /**\n   * Set by the host when it has already decided this connector cannot be\n   * attached (e.g. a cloud mount whose host-side build failed). The manager\n   * never calls the driver for it and reports it as failed with this reason.\n   */\n  unavailable?: UnavailableMarker;\n}\n\n/**\n * Why the host declared a connector without making it available. `reason` is\n * a short machine-readable token chosen by the host; `detail` is its prose.\n * @docLink packages/connectors/concepts#connector-declaration\n */\nexport interface UnavailableMarker {\n  reason: string;\n  detail?: string;\n}\n\n/**\n * Read an `unavailable:` value from an untyped declaration. Absent, `null` and\n * `false` mean \"not marked\". Any other value marks the connector unavailable —\n * a host that wrote the key meant it. A plain string is taken as the reason;\n * anything else that is not a `{ reason, detail? }` object gets a generic one.\n * @docLink packages/connectors/concepts#connector-declaration\n */\nexport function readUnavailableMarker(value: unknown): UnavailableMarker | undefined {\n  if (value === undefined || value === null || value === false) return undefined;\n  if (typeof value === \"string\" && value.trim() !== \"\") return { reason: value };\n  if (typeof value !== \"object\") return { reason: \"unavailable\" };\n  const { reason, detail } = value as { reason?: unknown; detail?: unknown };\n  const marker: UnavailableMarker = {\n    reason: typeof reason === \"string\" && reason.trim() !== \"\" ? reason : \"unavailable\",\n  };\n  if (typeof detail === \"string\" && detail.trim() !== \"\") marker.detail = detail;\n  return marker;\n}\n\n// ── Connector handle (returned by adapter.connect) ───────────────────────────\n\n/**\n * Live state of a connected backend, returned by `Connector.connect()` (or the\n * legacy `ConnectorAdapter.connect()`) and held by `ConnectorManager`.\n * @docLink packages/connectors/concepts#connector-handle\n */\nexport interface ConnectorHandle {\n  /** Connector declaration ID. */\n  readonly id: string;\n  /** Driver name. */\n  readonly driver: string;\n  /** Effective access level. */\n  readonly access: \"read-only\" | \"read-write\";\n  /** Lifecycle status. Set by every `Connector`. */\n  status: \"connecting\" | \"connected\" | \"error\" | \"disconnected\";\n  /** Present iff the connector has a filesystem face and is mounted. */\n  mountPath?: string;\n  /** Adapter-specific state (connection pool, client, etc.). Opaque to callers. */\n  state: unknown;\n}\n\n/** Optional capability a filesystem-face connector attaches to its handle state\n * when reads need an authoritative remote byte size rather than trusting local\n * filesystem metadata.\n */\nexport interface AuthoritativeSizeProvider {\n  authoritativeSize(relPath: string): Promise<number | null>;\n}\n\n// ── Connector change event ────────────────────────────────────────────────────\n\n/**\n * Change event emitted by a connector adapter's `watch()` implementation.\n * @docLink packages/connectors/concepts#connector-change-event\n */\nexport interface ConnectorChangeEvent {\n  /** Relative path, key, table name, node ID, etc. */\n  path: string;\n  /** What happened. */\n  action: \"create\" | \"edit\" | \"delete\" | \"conflict\";\n  /** What caused the change. */\n  source: \"filesystem\" | \"operation\" | \"remote\" | \"sync\";\n}\n\n// ── ConnectorManager info ────────────────────────────────────────────────────\n\n/**\n * Summary of a connected connector returned by `ConnectorManager.listConnectors()`.\n * @docLink packages/connectors/concepts#connector-info\n */\nexport interface ConnectorInfo {\n  id: string;\n  driver: string;\n  /** Human-readable connection name; the resource-explorer tab renders this over `id`/`driver` when present. */\n  label?: string;\n  access: \"read-only\" | \"read-write\";\n  /** Operation names this connector exposes as agent tools (via describeOperations). */\n  operations: string[];\n}\n\n/**\n * Bulk connect/disconnect result returned by `ConnectorManager.connectAll()` and `disconnectAll()`.\n * @docLink packages/connectors/concepts#connector-report\n */\nexport interface ConnectorReport {\n  results: Array<{ id: string; connected: boolean; error?: string }>;\n}\n\n// ── Field spec (connector credential/config declarations) ────────────────────\n\n/**\n * Input types for `ConnectorFieldSpec`. Controls validation rules and the Forge UI affordance.\n * @docLink packages/connectors/concepts#field-type\n */\nexport type FieldType =\n  | \"text\" // plain string\n  | \"password\" // sensitive; always stored via SecretProvider\n  | \"api-key\" // alias for password with specific UI affordance\n  | \"url\" // validated URL string\n  | \"oauth\" // triggers OAuth flow; oauthService required\n  | \"select\" // enum; choices required and non-empty\n  | \"boolean\" // default must be \"true\" or \"false\" if provided\n  | \"number\"; // default must be a parseable numeric string if provided\n\n/**\n * Declares one credential or configuration field that a connector adapter requires.\n * Used by `ConnectorManager.resolveFields()` and the Forge settings UI.\n * @docLink packages/connectors/concepts#connector-field-spec\n */\nexport interface ConnectorFieldSpec {\n  /** Machine name used as the options key in skaile.yaml. */\n  key: string;\n  /** Human-readable label for the forge settings UI. */\n  label: string;\n  /** Tooltip / help text. */\n  description?: string;\n  /** Input type. Controls validation rules and UI affordance in the forge settings panel. */\n  type: FieldType;\n  /** Whether the adapter refuses to connect when this field is missing. */\n  required: boolean;\n  /** String fallback used when not provided and not required. */\n  default?: string;\n  /** Forge UI masks the value; value is never logged. */\n  sensitive: boolean;\n  /** UI grouping: \"Authentication\", \"Connection\", \"Options\". */\n  group?: string;\n  /**\n   * Required when type === \"select\"; must be non-empty.\n   */\n  choices?: string[];\n  /**\n   * Required when type === \"oauth\".\n   * Identifies the OAuth service, e.g. \"google\".\n   * Used to call OAuthSecretProvider.initiateFlow(oauthService, account).\n   * oauth fields must be declared AFTER any field they reference (e.g., \"account\").\n   */\n  oauthService?: string;\n  /** Example value shown as placeholder text in the forge settings UI. */\n  example?: string;\n}\n\n/**\n * Thrown by `ConnectorManager.connectAll()` and `resolveFields()` when a required\n * adapter field cannot be resolved through the `SecretProviderChain`. Carries the\n * connector ID, the missing field spec, the ref that was tried, and the available\n * providers for actionable error messages.\n * @docLink packages/connectors/concepts#connector-field-missing-error\n */\nexport class ConnectorFieldMissingError extends Error {\n  readonly connectorId: string;\n  readonly field: ConnectorFieldSpec;\n  readonly triedRef: string;\n  readonly availableProviders: string[];\n\n  constructor(opts: {\n    connectorId: string;\n    field: ConnectorFieldSpec;\n    triedRef: string;\n    availableProviders: string[];\n  }) {\n    super(\n      `Connector \"${opts.connectorId}\" is missing required field \"${opts.field.key}\" ` +\n        `(tried: ${opts.triedRef || \"(none)\"}). ` +\n        `Available providers: ${opts.availableProviders.join(\", \") || \"(none)\"}`,\n    );\n    this.name = \"ConnectorFieldMissingError\";\n    this.connectorId = opts.connectorId;\n    this.field = opts.field;\n    this.triedRef = opts.triedRef;\n    this.availableProviders = opts.availableProviders;\n  }\n}\n\n// ── Runtime skill descriptor ──────────────────────────────────────────────────\n\n/**\n * Instance-specific skill descriptor returned by `ConnectorAdapter.describeSkill()`.\n * Returned by `ConnectorManager.listSkills()` to surface connector capabilities to the agent.\n * @docLink packages/connectors/concepts#runtime-skill-descriptor\n */\nexport interface RuntimeSkillDescriptor {\n  /** Connector instance id, e.g. \"gmail-work\". */\n  id: string;\n  /** Short label: \"Gmail — work@company.com\". */\n  name: string;\n  /** Instance-specific description: \"Read and write email for work@company.com\". */\n  description: string;\n  /** Category for grouping in the forge UI. */\n  category: string;\n  access: \"read-only\" | \"read-write\";\n  /** Operation names (without loading full defs) for agent planning. */\n  toolNames: string[];\n}\n\n// ── Token mediator (Tier-2 credential mediation) ─────────────────────────────\n\n/**\n * Result of a single `TokenMediator` call. Mirrors\n * `AccessTokenResponseEvent.result` from `@skaile/workspaces/types` so the runner\n * can pass it straight through.\n *\n * @docLink packages/connectors/api-reference#token-mediator\n */\nexport type TokenMediatorResult =\n  | {\n      ok: true;\n      /** Access token to use for the next git operation. */\n      token: string;\n      /**\n       * ISO-8601 expiry, or `null` for indefinite tokens (static PATs). Drives\n       * whether the driver schedules a refresh tick.\n       */\n      expiresAt: string | null;\n      /** Optional scope/permissions list, surfaced in audit logs. */\n      scope?: string[];\n    }\n  | {\n      ok: false;\n      code: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\" | \"timeout\";\n      /** Human-readable detail, never carries secrets. */\n      message: string;\n    };\n\n/**\n * Function signature mountable connectors use to acquire a fresh access token\n * from the runner-owned backend mediator. Implemented by the runner: emits a\n * `request_access_token` command over the transport and resolves with the\n * matching `access_token_response` payload.\n *\n * Connectors MUST treat this as the only token source when the parsed\n * `MountAuthRef.kind === 'backend'`. Local minting (PAT, OAuth, GitHub App)\n * has been removed from the runner — provider dispatch lives on the platform.\n *\n * @docLink packages/connectors/api-reference#token-mediator\n */\nexport type TokenMediator = (input: {\n  connectorId: string;\n  reason: \"initial\" | \"refresh\" | \"retry-401\";\n  /**\n   * Connector driver, used by the runner mediator to pick the platform refresh\n   * `kind`; absent on `initial` and for legacy callers.\n   */\n  driver?: string;\n  /**\n   * Backend provider link id — the `id` the platform `host.refresh_credential`\n   * capability resolves the credential against. Absent on `initial` and for\n   * legacy callers.\n   */\n  providerLinkId?: string;\n  /**\n   * The connector's declaration id, bound from the declaration like `driver`\n   * and `providerLinkId`. The runner sends it next to the link id on a git\n   * refresh, so a read-only reference sharing its link with a read-write\n   * mount is refreshed read-only. Absent on `initial` and for legacy callers.\n   */\n  declarationId?: string;\n}) => Promise<TokenMediatorResult>;\n\n// ── S3 presigner (backend-signed S3 reads) ───────────────────────────────────\n\n/**\n * Request to the platform's runtime capability `host.s3_presign`. `mountId` is\n * the connector id of an `auth: backend` S3 mount in this session; bucket,\n * prefix and endpoint come from the platform's copy of that declaration.\n */\nexport type S3PresignRequest =\n  | { mountId: string; op: \"list\"; continuationToken?: string }\n  | { mountId: string; op: \"get\"; keys: string[] };\n\n/**\n * Answer from `host.s3_presign`. `list` carries one ListObjectsV2 URL, `get`\n * one GetObject URL per key; folder markers (keys ending in `/`) are listed in\n * `skipped` instead. Every URL expires at `expiresAt` (ten minutes today).\n */\nexport type S3PresignResult =\n  | { ok: true; op: \"list\"; url: string; expiresAt: string }\n  | {\n      ok: true;\n      op: \"get\";\n      urls: { key: string; url: string }[];\n      skipped: { key: string; reason: string }[];\n      expiresAt: string;\n    }\n  | { ok: false; code: string; message: string };\n\n/**\n * Presign client for `auth: backend` S3 mounts, implemented by the runner over\n * the same remote-capability channel as {@link TokenMediator}. The S3 keys stay\n * in the backend; the container only ever sees short-lived read URLs.\n * Never throws: transport failures resolve as `{ ok: false, code: \"backend-error\" }`.\n */\nexport type S3Presigner = (request: S3PresignRequest) => Promise<S3PresignResult>;\n\n// ── Unified connector types ───────────────────────────────────────────────────\n\n/**\n * Context passed to `Connector.connect()` by `ConnectorManager`.\n * @docLink packages/connectors/concepts#connect-context\n */\nexport interface ConnectContext {\n  /**\n   * Absolute project directory the owning `ConnectorManager` runs for (always set by the manager). A connector that needs\n   * an optional npm peer looks in this project's `node_modules` first.\n   */\n  projectDir?: string;\n  /** Secret provider for resolving credential references. */\n  secrets?: SecretProvider;\n  /**\n   * Backend token mediator — present for `auth: backend` connectors of either\n   * face (filesystem or tool), so mount refresh and tool-face OAuth flows share\n   * one path.\n   */\n  tokenMediator?: TokenMediator;\n  /**\n   * Backend S3 presigner — the read path for `auth: backend` S3 mounts. Absent\n   * outside a platform-connected runner.\n   */\n  s3Presigner?: S3Presigner;\n  /**\n   * Absolute directory the manager allocated for the filesystem face.\n   * Present iff `connector.filesystem != null`. The connector projects its\n   * content here during `connect()` and sets `handle.mountPath`.\n   */\n  mountTarget?: string;\n  /** Resolved credential/config fields (from `describeFields()`). */\n  resolvedFields?: Record<string, string>;\n  /**\n   * Aborted when the owning `ConnectorManager` is disposed. Long-running\n   * `connect()` implementations — notably background (deferred) filesystem\n   * mounts — should observe this and bail out promptly so session cleanup\n   * does not wait on a wedged remote.\n   */\n  abortSignal?: AbortSignal;\n}\n\n/**\n * Filesystem face — present ⇒ the connector is \"mountable\".\n * @docLink packages/connectors/concepts#filesystem-face\n */\nexport interface FilesystemFace {\n  /** Pull latest remote state into the mounted directory. */\n  sync(handle: ConnectorHandle, options?: SyncOptions): Promise<SyncResult>;\n}\n\n/**\n * Tool face — present ⇒ the connector exposes agent tools.\n * @docLink packages/connectors/concepts#tool-face\n */\nexport interface ToolFace {\n  read?(handle: ConnectorHandle, path: string): Promise<ConnectorContent | null>;\n  write?(handle: ConnectorHandle, path: string, content: ConnectorContent): Promise<void>;\n  delete?(handle: ConnectorHandle, path: string): Promise<boolean>;\n  list?(handle: ConnectorHandle, path?: string, options?: ListOptions): Promise<ConnectorEntry[]>;\n  search?(handle: ConnectorHandle, query: string, options?: SearchOptions): Promise<SearchResult[]>;\n  describeOperations(handle: ConnectorHandle): OperationDescriptor[];\n  executeOp(\n    handle: ConnectorHandle,\n    operation: string,\n    args: Record<string, unknown>,\n  ): Promise<string>;\n  describeSkill?(\n    handle: ConnectorHandle,\n    declaration: ConnectorDeclaration,\n  ): RuntimeSkillDescriptor;\n}\n\n/**\n * The unified connector contract. A connector should expose at least one face\n * (`filesystem` and/or `tools`); `ConnectorManager` rejects a faceless\n * connector at connect time.\n * @docLink packages/connectors/concepts#connector\n */\nexport interface Connector {\n  readonly name: string;\n  /**\n   * True when `connect()` for this declaration can only get its credential from\n   * `ctx.tokenMediator`. A manager with neither a mediator nor a pre-mint then\n   * fails the connect without calling the driver, whose failure path may write\n   * shared state (the git driver's credential helper) the live session uses.\n   */\n  requiresTokenMediator?(declaration: ConnectorDeclaration): boolean;\n  connect(declaration: ConnectorDeclaration, ctx: ConnectContext): Promise<ConnectorHandle>;\n  disconnect(handle: ConnectorHandle): Promise<void>;\n  readonly filesystem?: FilesystemFace;\n  readonly tools?: ToolFace;\n  describeFields?(): ConnectorFieldSpec[];\n  setLogger?(logger: Logger): void;\n  watch?(\n    handle: ConnectorHandle,\n    callback: (e: ConnectorChangeEvent) => void,\n    options?: WatchOptions,\n  ): WatchHandle;\n  onHibernate?(handle: ConnectorHandle): Promise<ConnectorHookOutcome>;\n  onSessionClose?(handle: ConnectorHandle): Promise<ConnectorHookOutcome>;\n}\n\n/**\n * Structured return of a lifecycle hook (`onHibernate` / `onSessionClose`).\n * `detail` is the same human-readable line a hook can return as a plain string;\n * `pushState` is what the connector can prove about its working copy, copied\n * onto the hook's `LifecycleResult`.\n */\nexport interface ConnectorHookReport {\n  detail?: string;\n  pushState?: ConnectorPushState;\n}\n\n/** What a lifecycle hook may return: a detail line, a structured report, or nothing. */\nexport type ConnectorHookOutcome = string | ConnectorHookReport | undefined;\n\n/**\n * Factory used by the connector registry.\n * @docLink packages/connectors/api-reference#connector-factory\n */\nexport type ConnectorFactory = () => Connector;\n\n/**\n * Per-connector bulk-connect result returned by `ConnectorManager.connectAll()`.\n * @docLink packages/connectors/concepts#connector-startup-report\n */\nexport interface ConnectorStartupReport {\n  results: Array<{\n    id: string;\n    connected: boolean;\n    /**\n     * A fleet mount whose readiness check missed its deadline: registered with\n     * `connected: false`, retried in the background, and not a failure.\n     * `error` says why it is not live yet.\n     */\n    connecting?: boolean;\n    mountPath?: string;\n    error?: string;\n    access?: \"read-only\" | \"read-write\";\n  }>;\n}\n\n/**\n * A connector that failed to connect, as returned by\n * `ConnectorManager.listFailedConnectors()`.\n *\n * A failed connector never enters the manager's active map, so it is absent\n * from `listConnectors()` and `get()` by design — those describe what the agent\n * can actually use. This record is the second list that keeps the failure\n * itself visible.\n *\n * @docLink packages/connectors/concepts#connector-manager\n */\nexport interface FailedConnectorInfo {\n  id: string;\n  driver: string;\n  access: \"read-only\" | \"read-write\";\n  label?: string;\n  /** `mount.source` when declared. */\n  source?: string;\n  /** Resolved absolute mount target, when the declaration has a mount. */\n  mountPath?: string;\n  /** True when the failure is fail-fast material: read-write AND mount-bearing. */\n  required: boolean;\n  /** The connect error message. */\n  error: string;\n  /** Present when the host declared the connector unavailable; no connect was attempted. */\n  unavailable?: UnavailableMarker;\n}\n\n/**\n * Thrown by `connectAll` when a read-write mountable connector fails and\n * `failOnReadWriteError` was set.\n * @docLink packages/connectors/concepts#connector-startup-error\n */\nexport class ConnectorStartupError extends Error {\n  readonly report: ConnectorStartupReport;\n  readonly failedReadWrite: ReadonlyArray<{ id: string; error: string }>;\n  constructor(\n    message: string,\n    report: ConnectorStartupReport,\n    failedReadWrite: ReadonlyArray<{ id: string; error: string }>,\n  ) {\n    super(message);\n    this.name = \"ConnectorStartupError\";\n    this.report = report;\n    this.failedReadWrite = failedReadWrite;\n  }\n}\n","/**\n * Derive runtime connector declarations from the platform-materialized\n * `.skaile/assets/connector/<name>/CONNECTOR.md` projection.\n *\n * Connector mirror of MCP's `loadMaterializedMcpDeclarations` /\n * `deriveSingleMaterializedMcpDeclaration`. The generated `CONNECTOR.md` carries\n * a RUNTIME declaration (driver/access/auth/mode/options/mount) — distinct from\n * the catalog `CONNECTOR.md` parsed by `core/manifest.ts:fromConnectorMd`\n * (entry/fields). Driver is referenced by name (first-party; resolved via the\n * connector registry — no code-loading).\n */\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\n// Narrow module, not the `core` barrel: the barrel's chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { parseFrontmatter } from \"../../core/src/manifest.js\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\n\n/** Parse a generated CONNECTOR.md (runtime projection) into a ConnectorDeclaration. */\nexport function fromMaterializedConnectorMd(filePath: string, name: string): ConnectorDeclaration {\n  const { data: meta, body } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n  const id = String(meta.name ?? name);\n  const decl: ConnectorDeclaration = {\n    id,\n    driver: String(meta.driver ?? \"\"),\n    access: meta.access === \"read-write\" ? \"read-write\" : \"read-only\",\n  };\n  if (meta.access !== \"read-write\" && meta.access !== \"read-only\") decl.accessDefaulted = true;\n  if (typeof meta.label === \"string\" && meta.label) decl.label = meta.label;\n  if (typeof meta.auth === \"string\") decl.auth = meta.auth;\n  if (typeof meta.providerLinkId === \"string\" && meta.providerLinkId) {\n    decl.providerLinkId = meta.providerLinkId;\n  }\n  if (meta.mode === \"agent\" || meta.mode === \"sync\") decl.mode = meta.mode;\n  if (meta.options && typeof meta.options === \"object\" && !Array.isArray(meta.options)) {\n    decl.options = meta.options as Record<string, unknown>;\n  }\n  if (meta.mount && typeof meta.mount === \"object\" && !Array.isArray(meta.mount)) {\n    const m = meta.mount as Record<string, unknown>;\n    decl.mount = {\n      source: String(m.source ?? \"\"),\n      ...(m.target !== undefined ? { target: String(m.target) } : {}),\n      ...(typeof m.watch === \"boolean\" ? { watch: m.watch } : {}),\n      ...(typeof m.exposeAccessToken === \"boolean\"\n        ? { exposeAccessToken: m.exposeAccessToken }\n        : {}),\n      ...(typeof m.accessTokenTTL === \"number\" ? { accessTokenTTL: m.accessTokenTTL } : {}),\n    };\n  }\n  const trimmedBody = body.trim();\n  if (trimmedBody.length > 0) decl.instructions = trimmedBody;\n  return decl;\n}\n\n/** Provide `.instance.json` config entries as defaults under the declaration's options (the CONNECTOR.md declaration wins on key collision). */\nfunction foldInstanceConfig(decl: ConnectorDeclaration, instancePath: string): void {\n  if (!existsSync(instancePath)) return;\n  let parsed: { config?: Record<string, unknown> };\n  try {\n    parsed = JSON.parse(readFileSync(instancePath, \"utf8\"));\n  } catch {\n    return;\n  }\n  const config = parsed.config;\n  if (!config || typeof config !== \"object\" || Array.isArray(config)) return;\n  decl.options = { ...(config as Record<string, unknown>), ...(decl.options ?? {}) };\n}\n\n/** Derive a single materialized connector declaration; null when no CONNECTOR.md. */\nexport function deriveSingleMaterializedConnectorDeclaration(\n  connectorAssetsDir: string,\n  name: string,\n): ConnectorDeclaration | null {\n  const sub = join(connectorAssetsDir, name);\n  const md = join(sub, \"CONNECTOR.md\");\n  if (!existsSync(md)) return null;\n  const decl = fromMaterializedConnectorMd(md, name);\n  foldInstanceConfig(decl, join(sub, \".instance.json\"));\n  return decl;\n}\n\n/** Scan `<projectDir>/.skaile/assets/connector/*` for materialized connectors. */\nexport function loadMaterializedConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const root = join(projectDir, \".skaile/assets/connector\");\n  if (!existsSync(root)) return [];\n  const out: ConnectorDeclaration[] = [];\n  for (const name of readdirSync(root)) {\n    try {\n      const sub = join(root, name);\n      if (!statSync(sub).isDirectory()) continue;\n      const decl = deriveSingleMaterializedConnectorDeclaration(root, name);\n      if (decl) out.push(decl);\n    } catch {\n      // Per-directory failure is isolated — one bad asset never aborts the scan.\n    }\n  }\n  return out;\n}\n","/**\n * Secret provider abstraction.\n *\n * Decouples credential resolution from process.env so secrets can be\n * provisioned over the transport bridge instead of living in the\n * container's environment.\n */\n\n// Narrow module, not the `core/logging` barrel: it re-exports the SQLite sink,\n// whose `import.meta` breaks consumers that transpile this entry to CommonJS.\nimport { createLogger } from \"../../core/src/logging/create-logger.js\";\n\nconst log = createLogger({ kind: \"connector\", subkind: \"secrets\" });\n\n// ── Interfaces ──────────────────────────────────────────────────────────────\n\n/**\n * Read-only secret resolution. Adapters receive this interface.\n * @docLink packages/connectors/api-reference#secret-provider\n */\nexport interface SecretProvider {\n  /**\n   * Resolve a credential reference.\n   *\n   * @param ref - Credential reference such as \"env:GIT_TOKEN\",\n   *   \"oauth:google:user@example.com\", or an inline literal.\n   * @returns The resolved secret value or undefined if not found.\n   */\n  resolve(ref: string): string | undefined;\n  /**\n   * Check whether a reference can be resolved.\n   *\n   * @param ref - Reference to check.\n   * @returns True if resolve(ref) would return a non-undefined value.\n   */\n  has(ref: string): boolean;\n  /**\n   * Return all ref strings this provider can currently resolve.\n   *\n   * @returns All resolvable refs (used by forge UI and ConnectorFieldMissingError).\n   */\n  capabilities(): string[];\n}\n\n/**\n * Extends `SecretProvider` with the ability to load secrets at runtime via `provision()`.\n * @docLink packages/connectors/api-reference#provisionable-secret-provider\n */\nexport interface ProvisionableSecretProvider extends SecretProvider {\n  /** Store a batch of key-value secrets. Keys are bare names (no prefix). */\n  provision(secrets: Record<string, string>): void;\n}\n\n// ── Implementations ─────────────────────────────────────────────────────────\n\n/**\n * In-memory secret store. Secrets are provisioned over the transport bridge\n * and stored in a private Map — never touching the filesystem or process.env.\n *\n * Supports ref prefixes:\n *   `\"env:KEY\"`   — looks up KEY in the store\n *   `\"vault:KEY\"` — looks up KEY in the store (future vault compat)\n *   (no prefix)   — returned as an inline value (backwards compat for non-chain usages)\n * @docLink packages/connectors/api-reference#in-memory-secret-provider\n */\nexport class InMemorySecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  /**\n   * Store a batch of key-value secrets.\n   *\n   * @param secrets - Key-value map of secret names to values. Keys are bare names (no prefix).\n   */\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return this.store.get(ref.slice(4));\n    if (ref.startsWith(\"vault:\")) return this.store.get(ref.slice(6));\n    // Bare key: check store first, then fall back to inline literal\n    const stored = this.store.get(ref);\n    if (stored !== undefined) return stored;\n    return ref;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Delegates to `process.env`. Used in CLI/standalone mode.\n * Does NOT pass through inline literals — returns `undefined` for any ref\n * that does not start with `\"env:\"`. Use `InMemorySecretProvider` for inline\n * literals in non-chain contexts.\n * @docLink packages/connectors/api-reference#env-secret-provider\n */\nexport class EnvSecretProvider implements SecretProvider {\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"env:\")) return process.env[ref.slice(4)];\n    return undefined; // no inline passthrough\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return Object.keys(process.env).map((k) => `env:${k}`);\n  }\n}\n\n/**\n * Pre-minted credential entry. Mirrors the discriminated `CredentialMint`\n * shape from `@skaile/workspaces/types` but redeclared here to keep this package\n * free of cross-package type dependencies.\n *\n * The failure branch carries the platform-side `code` + `message` so the\n * `ConnectorManager`'s wrapped mediator can surface the real reason instead of\n * a generic \"no pre-mint\" placeholder when a mint comes back as `ok: false`.\n */\nexport type PreMintedCredential =\n  | { ok: true; token: string; expiresAt: string | null; mintedAt?: string }\n  | {\n      ok: false;\n      code?: \"not-configured\" | \"revoked\" | \"provider-error\" | \"backend-error\";\n      message?: string;\n    };\n\n/**\n * Pre-minted credential store. Holds short-lived tokens delivered upfront in\n * the v3 `session_init` envelope so the runner never has to call back to the\n * platform during mount setup.\n *\n * Resolves refs of the form `mount:<id>`, `connector:<id>`, and `mcp:<id>`.\n * Returns `undefined` for any other ref so the chain falls through to the\n * next provider (`EnvSecretProvider` for `pat:env:NAME`, etc.).\n *\n * Tokens can be added/removed at runtime via {@link set} / {@link unset} so\n * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capabilities\n * stay strictly in-process — no round trip to the platform to mint while\n * the resource is hot-attached.\n *\n * For callers that need the full mint metadata (expiry timestamp, mintedAt\n * audit fields), use {@link mintFor} instead of the bare `resolve`. The\n * `ConnectorManager` consults this for the `auth: backend` initial-mint path so\n * the driver retains the original expiry semantics.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`.\n *\n * @docLink packages/connectors/api-reference#pre-minted-secret-provider\n */\nexport class PreMintedSecretProvider implements SecretProvider {\n  private readonly mints = new Map<string, PreMintedCredential>();\n\n  /**\n   * Seed pre-minted credentials from the v3 `session_init.credentials` map.\n   *\n   * Failed mints (`ok: false`) are stored too so callers can distinguish\n   * \"not pre-minted\" from \"pre-minted but failed\"; {@link resolve} treats\n   * both as `undefined`.\n   *\n   * @param credentials Optional initial `{ mounts, connectors, mcp }` map.\n   */\n  constructor(credentials?: {\n    mounts?: Record<string, PreMintedCredential>;\n    connectors?: Record<string, PreMintedCredential>;\n    mcp?: Record<string, PreMintedCredential>;\n  }) {\n    if (!credentials) return;\n    for (const [id, mint] of Object.entries(credentials.mounts ?? {})) {\n      this.mints.set(`mount:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.connectors ?? {})) {\n      this.mints.set(`connector:${id}`, mint);\n    }\n    for (const [id, mint] of Object.entries(credentials.mcp ?? {})) {\n      this.mints.set(`mcp:${id}`, mint);\n    }\n  }\n\n  /**\n   * Insert (or replace) a pre-minted credential. Used by\n   * `runner.add_mount` / `runner.add_connector` / `runner.add_mcp` capability\n   * handlers when the platform delivers new credentials mid-session.\n   */\n  set(kind: \"mount\" | \"connector\" | \"mcp\", id: string, mint: PreMintedCredential): void {\n    this.mints.set(`${kind}:${id}`, mint);\n  }\n\n  /**\n   * Remove a stored pre-minted credential. Used by the\n   * `runner.remove_resource` capability handler.\n   */\n  unset(kind: \"mount\" | \"connector\" | \"mcp\", id: string): boolean {\n    return this.mints.delete(`${kind}:${id}`);\n  }\n\n  /**\n   * Look up the full {@link PreMintedCredential} for a `mount:` /\n   * `connector:` / `mcp:` keyed entry. Callers that only need the token use\n   * {@link resolve} via the chain; callers that need expiry / audit\n   * metadata (e.g. ConnectorManager) use this entry point.\n   */\n  mintFor(kind: \"mount\" | \"connector\" | \"mcp\", id: string): PreMintedCredential | undefined {\n    return this.mints.get(`${kind}:${id}`);\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (!(ref.startsWith(\"mount:\") || ref.startsWith(\"connector:\") || ref.startsWith(\"mcp:\")))\n      return undefined;\n    const mint = this.mints.get(ref);\n    return mint?.ok ? mint.token : undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.mints.entries()].filter(([, m]) => m.ok).map(([k]) => k);\n  }\n}\n\n/**\n * Forge session secret provider. Secrets are provisioned from the Forge settings\n * panel over the transport bridge. Only handles `\"forge:\"` prefixed refs — returns\n * `undefined` for all others.\n * @docLink packages/connectors/api-reference#forge-secret-provider\n */\nexport class ForgeSecretProvider implements ProvisionableSecretProvider {\n  private readonly store = new Map<string, string>();\n\n  provision(secrets: Record<string, string>): void {\n    for (const [key, value] of Object.entries(secrets)) {\n      this.store.set(key, value);\n    }\n  }\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    if (ref.startsWith(\"forge:\")) return this.store.get(ref.slice(6));\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    return [...this.store.keys()].map((k) => `forge:${k}`);\n  }\n}\n\n/**\n * Thrown when an OAuth-secured connector field requires user authorization before\n * it can be resolved. Contains the redirect URL to open in the user's browser.\n * @docLink packages/connectors/api-reference#o-auth-required-error\n */\nexport class OAuthRequiredError extends Error {\n  readonly oauthRef: string;\n  readonly authUrl: string;\n  readonly state: string;\n\n  /**\n   * @param oauthRef - The 'oauth:<service>:<account>' ref that triggered the error\n   * @param authUrl - Browser URL to open for OAuth authorization\n   * @param state - OAuth state token for CSRF protection and callback correlation\n   */\n  constructor(oauthRef: string, authUrl: string, state: string) {\n    super(`OAuth authorization required for ${oauthRef}`);\n    this.name = \"OAuthRequiredError\";\n    this.oauthRef = oauthRef;\n    this.authUrl = authUrl;\n    this.state = state;\n  }\n}\n\n/**\n * Shape of an OAuth token bundle stored by `OAuthSecretProvider`.\n * @docLink packages/connectors/api-reference#o-auth-token-bundle\n */\nexport interface OAuthTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  /** Unix timestamp in ms */\n  expiry?: number;\n}\n\n/**\n * Return value of `OAuthSecretProvider.initiateFlow()`. Contains the URL and CSRF state token.\n * @docLink packages/connectors/api-reference#o-auth-flow-request\n */\nexport interface OAuthFlowRequest {\n  authUrl: string;\n  state: string;\n}\n\n/**\n * OAuth token provider. Handles `\"oauth:<service>:<account>\"` refs.\n * Callers must call `chain.prepareRef()` before `chain.resolve()` for `oauth:` refs.\n * @docLink packages/connectors/api-reference#o-auth-secret-provider\n */\nexport interface OAuthSecretProvider extends SecretProvider {\n  /**\n   * Ensure the token for this ref is fresh.\n   * Refreshes if expired.\n   * Throws OAuthRequiredError if no token exists and user authorization is needed.\n   */\n  ensureFresh(ref: string): Promise<void>;\n\n  /** Initiate the OAuth authorization flow. Returns URL to open in the user's browser. */\n  initiateFlow(oauthService: string, account: string): Promise<OAuthFlowRequest>;\n\n  /** Exchange authorization code for tokens and store the bundle. */\n  completeFlow(state: string, code: string): Promise<void>;\n}\n\n/**\n * Abstract base for vault-backed secret providers (1Password, KeePass). Subclasses\n * implement `prefix` and `loadKeys()`. Locked until `unlock(credential)` is called.\n * @docLink packages/connectors/api-reference#locked-secret-provider\n */\nexport abstract class LockedSecretProvider implements SecretProvider {\n  locked = true;\n  protected readonly store = new Map<string, string>();\n  abstract readonly prefix: string;\n\n  async unlock(credential: string): Promise<void> {\n    await this.loadKeys(credential);\n    this.locked = false;\n  }\n\n  protected abstract loadKeys(credential: string): Promise<void>;\n\n  resolve(ref: string): string | undefined {\n    if (this.locked) return undefined;\n    if (!ref.startsWith(this.prefix)) return undefined;\n    return this.store.get(ref.slice(this.prefix.length));\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    if (this.locked) return [];\n    return [...this.store.keys()].map((k) => `${this.prefix}${k}`);\n  }\n}\n\n// ── Known provider prefixes ──────────────────────────────────────────────────\n\nconst KNOWN_PREFIXES = [\n  \"env:\",\n  \"vault:\",\n  \"forge:\",\n  \"op:\",\n  \"kp:\",\n  \"oauth:\",\n  \"mount:\",\n  \"connector:\",\n  \"mcp:\",\n] as const;\n\nfunction getPrefix(ref: string): string | undefined {\n  return KNOWN_PREFIXES.find((p) => ref.startsWith(p));\n}\n\n/**\n * True when `value` starts with a known secret-ref prefix (`env:`, `oauth:`,\n * `mcp:`, ...). Lets callers distinguish an intended-but-unresolved ref from a\n * plain literal — e.g. the runner refuses to forward an unresolved ref into\n * MCP transport headers/env, where the literal would otherwise leak onto the\n * wire and produce a misleading upstream error.\n */\nexport function isKnownSecretRef(value: string): boolean {\n  return getPrefix(value) !== undefined;\n}\n\n/**\n * Chains multiple `SecretProvider` instances into a single resolver.\n * - Prefixed refs (`env:`, `forge:`, `op:`, `kp:`, `oauth:`) are routed to the first provider that can resolve them.\n * - Bare refs waterfall through all providers in order.\n * - Plain literals in `skaile.yaml` options are NOT passed to the chain; `ConnectorManager` handles them before calling `resolve()`.\n * @docLink packages/connectors/api-reference#secret-provider-chain\n */\nexport class SecretProviderChain implements SecretProvider {\n  /**\n   * @param providers - Ordered list of providers. For prefixed refs, the first\n   *   provider that can resolve wins. For bare refs, waterfall through all in order.\n   */\n  constructor(private readonly providers: SecretProvider[]) {}\n\n  resolve(ref: string): string | undefined {\n    if (!ref) return undefined;\n    const prefix = getPrefix(ref);\n    log.debug(\"resolve secret\", { ref, prefix: prefix ?? \"(bare)\" });\n    if (prefix) {\n      for (const p of this.providers) {\n        const val = p.resolve(ref);\n        if (val !== undefined) return val;\n      }\n      log.warn(\"secret not resolvable\", { ref });\n      return undefined;\n    }\n    // Waterfall for bare refs\n    for (const p of this.providers) {\n      const val = p.resolve(ref);\n      if (val !== undefined) return val;\n    }\n    log.warn(\"secret not resolvable\", { ref });\n    return undefined;\n  }\n\n  has(ref: string): boolean {\n    return this.resolve(ref) !== undefined;\n  }\n\n  capabilities(): string[] {\n    const all = this.providers.flatMap((p) => p.capabilities());\n    return [...new Set(all)];\n  }\n\n  /** Returns the first provider that can resolve this ref. */\n  providerFor(ref: string): SecretProvider | undefined {\n    for (const p of this.providers) {\n      if (p.resolve(ref) !== undefined) return p;\n    }\n    return undefined;\n  }\n\n  /**\n   * Calls ensureFresh(ref) on the owning provider if it implements OAuthSecretProvider.\n   * No-op for providers that don't have ensureFresh().\n   *\n   * @param ref - Must be an \"oauth:\" prefixed ref for this to have any effect.\n   *   Calls ensureFresh() on the owning OAuthSecretProvider.\n   */\n  async prepareRef(ref: string): Promise<void> {\n    const owner = this.providerFor(ref);\n    if (\n      owner &&\n      \"ensureFresh\" in owner &&\n      typeof (owner as OAuthSecretProvider).ensureFresh === \"function\"\n    ) {\n      try {\n        await (owner as OAuthSecretProvider).ensureFresh(ref);\n      } catch (err) {\n        log.error(\"secret provider ensureFresh failed\", err, { ref });\n        throw err;\n      }\n    }\n  }\n}\n","/**\n * Load connector declarations from skaile.yaml.\n *\n * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).\n * Filesystem-projected backends must be declared under `connectors:` with a\n * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.\n */\n\nimport type { ResolvedSkaileConfig } from \"@skaile/workspaces/types\";\n// Narrow modules, not the `core` barrels: their chunks carry `import.meta`,\n// which breaks consumers that transpile this entry to CommonJS.\nimport { createLogger } from \"../../core/src/logging/create-logger.js\";\nimport {\n  localConnectorMountDir,\n  resolveSkWorkspaceConfig,\n  type ConnectorDeclaration as WorkspaceConnector,\n} from \"../../core/src/workspace-config.js\";\nimport type { ConnectorDeclaration } from \"./connector-types.js\";\nimport { readUnavailableMarker } from \"./connector-types.js\";\nimport { loadMaterializedConnectorDeclarations } from \"./materialized-connectors.js\";\n\nconst configLog = createLogger({ kind: \"connector\", subkind: \"config\" });\n\n/**\n * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n *\n * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).\n * @returns Merged array of connector declarations from `skaile.yaml` and the materialized\n *   `.skaile/assets/connector/*` disk projection (Phase 2.5); empty array if neither source\n *   contributes any entries. `skaile.yaml` wins on id collision.\n * @docLink packages/connectors/api-reference#load-connector-declarations\n */\nexport function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  return withMaterializedConnectorDeclarations(\n    loadYamlConnectorDeclarations(projectDir),\n    projectDir,\n  );\n}\n\n/**\n * The `skaile.yaml` half of {@link loadConnectorDeclarations}: only the `connectors:` entries,\n * without the materialized projection. The runner needs it on its own because in broker mode the\n * session root keeps materialized connectors across wakes while its yaml declares nothing, and the\n * `session_init` wire set must then stand in for the yaml half, not for both.\n *\n * Throws a migration error when the legacy top-level `mounts:` key is present.\n */\nexport function loadYamlConnectorDeclarations(projectDir: string): ConnectorDeclaration[] {\n  const config = resolveSkWorkspaceConfig(projectDir);\n\n  // Hard cut: reject legacy top-level `mounts:` key with an actionable message.\n  if (config.mounts && config.mounts.length > 0) {\n    throw new Error(\n      \"'mounts:' is no longer supported — move entries under 'connectors:' with a 'mount:' sub-block. See docs/migration-mounts-to-connectors.md\",\n    );\n  }\n\n  return config.connectors && config.connectors.length > 0\n    ? config.connectors.map((c) => workspaceConnectorToDeclaration(c, projectDir))\n    : [];\n}\n\n/**\n * Add the materialized `.skaile/assets/connector/*` projection to `base`. Library-assigned\n * connectors reach the runner only through that projection. `base` is explicit config (the\n * skaile.yaml entries, or the `session_init` wire set standing in for them) and wins on id\n * collision; the shadowed materialized connector is logged, not silently dropped.\n */\nexport function withMaterializedConnectorDeclarations(\n  base: ConnectorDeclaration[],\n  projectDir: string,\n): ConnectorDeclaration[] {\n  const byId = new Map<string, ConnectorDeclaration>();\n  for (const d of base) byId.set(d.id, d);\n  for (const d of loadMaterializedConnectorDeclarations(projectDir)) {\n    if (byId.has(d.id)) {\n      configLog.warn(`materialized connector '${d.id}' shadowed by an explicit connector`);\n      continue;\n    }\n    byId.set(d.id, d);\n  }\n  return [...byId.values()];\n}\n\n/**\n * A declared `access` as the manager enforces it: only `read-write` writes. A missing value and an\n * unknown one (`rw`, a typo) read-only, so a wrong spelling never opens a mount for writing.\n */\nfunction accessOf(access: string | undefined): \"read-only\" | \"read-write\" {\n  return access === \"read-write\" ? \"read-write\" : \"read-only\";\n}\n\nfunction workspaceConnectorToDeclaration(\n  c: WorkspaceConnector,\n  projectDir: string,\n): ConnectorDeclaration {\n  const decl: ConnectorDeclaration = {\n    id: c.id,\n    driver: c.driver,\n    access: accessOf(c.access),\n    auth: c.auth,\n    options: c.options,\n  };\n  if (c.access == null) decl.accessDefaulted = true;\n\n  // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n  if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n\n  const unavailable = readUnavailableMarker(c.unavailable);\n  if (unavailable) decl.unavailable = unavailable;\n\n  // Map the optional mount sub-block when present.\n  if (c.mount) {\n    decl.mount = {\n      source: c.mount.source,\n      target: c.mount.target,\n      watch: c.mount.watch,\n      exposeAccessToken: c.mount.exposeAccessToken,\n      accessTokenTTL: c.mount.accessTokenTTL,\n    };\n  } else if (c.driver === \"local\") {\n    // `mountPath:` names the host directory. An absolute source with no target makes the manager\n    // bind the connector straight to it, so reads and writes land in that directory.\n    const source = localConnectorMountDir(c, projectDir);\n    if (source) decl.mount = { source };\n  }\n\n  return decl;\n}\n\n/**\n * Map a Protocol v3 `session_init` `resolvedConfig` to `ConnectorDeclaration[]`.\n *\n * Wire mounts are flat (`source` / `target` / `watch` top-level per\n * `ResolvedSkaileConfig`); declarations carry them in the `mount:` sub-block.\n * Wire `connectors` (tool-face) map without a mount block. Malformed entries\n * (missing `id`, `driver`, or — for mounts — `source`) are logged and dropped,\n * never thrown: one bad wire entry must not kill session boot. Duplicate ids\n * (within or across the two arrays) keep the FIRST occurrence — mounts precede\n * connectors — and the shadowed entry is logged and dropped the same way.\n *\n * Pure function, no I/O. Used by the runner in place of the `skaile.yaml`\n * entries when `skaile.yaml` declares no connectors (broker mode, where the\n * delivered yaml carries no declarations). Materialized connectors are added\n * on top either way.\n *\n * @param resolved - `mounts` / `connectors` arrays from the platform-resolved config.\n * @returns Declarations in wire order — mounts first, then connectors.\n * @docLink packages/connectors/api-reference#resolved-config-to-declarations\n */\nexport function resolvedConfigToDeclarations(\n  resolved: Pick<ResolvedSkaileConfig, \"mounts\" | \"connectors\">,\n): ConnectorDeclaration[] {\n  // Keyed by id: the wire carries no well-formedness guarantee, and a duplicate\n  // id downstream would collide on mount paths / tool namespaces. First wins.\n  const byId = new Map<string, ConnectorDeclaration>();\n  const pushUnlessDuplicate = (kind: \"mount\" | \"connector\", decl: ConnectorDeclaration): void => {\n    if (byId.has(decl.id)) {\n      configLog.warn(`dropping duplicate resolvedConfig ${kind} (id already declared)`, {\n        id: decl.id,\n      });\n      return;\n    }\n    byId.set(decl.id, decl);\n  };\n\n  for (const m of resolved.mounts ?? []) {\n    // A mount without a source cannot connect — drop it with the malformed ones.\n    if (\n      typeof m?.id !== \"string\" ||\n      typeof m?.driver !== \"string\" ||\n      typeof m.source !== \"string\"\n    ) {\n      configLog.warn(\"dropping malformed resolvedConfig mount (missing id/driver/source)\", {\n        id: (m as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: m.id,\n      driver: m.driver,\n      access: accessOf(m.access),\n      ...(m.access == null ? { accessDefaulted: true as const } : {}),\n      auth: m.auth,\n      options: m.options,\n      mount: {\n        source: m.source,\n        target: m.target,\n        watch: m.watch,\n        exposeAccessToken: m.exposeAccessToken,\n        accessTokenTTL: m.accessTokenTTL,\n      },\n    };\n    // Backend-auth routing key for live token refresh; dropping it breaks git mount mint.\n    if (m.providerLinkId) decl.providerLinkId = m.providerLinkId;\n    pushUnlessDuplicate(\"mount\", decl);\n  }\n\n  for (const c of resolved.connectors ?? []) {\n    if (typeof c?.id !== \"string\" || typeof c?.driver !== \"string\") {\n      configLog.warn(\"dropping malformed resolvedConfig connector (missing id/driver)\", {\n        id: (c as { id?: unknown } | undefined)?.id,\n      });\n      continue;\n    }\n    const decl: ConnectorDeclaration = {\n      id: c.id,\n      driver: c.driver,\n      access: accessOf(c.access),\n      ...(c.access == null ? { accessDefaulted: true as const } : {}),\n      auth: c.auth,\n      options: c.options,\n    };\n    if (c.providerLinkId) decl.providerLinkId = c.providerLinkId;\n    pushUnlessDuplicate(\"connector\", decl);\n  }\n\n  return [...byId.values()];\n}\n\nimport type { ForgeSecretProvider, SecretProvider } from \"./secrets.js\";\nimport { EnvSecretProvider, InMemorySecretProvider, SecretProviderChain } from \"./secrets.js\";\n\n/**\n * Build a `SecretProviderChain` for Forge session context.\n * `OAuthSecretProvider` is not wired here — it must be provided externally\n * (the Forge session manager constructs it and passes it in).\n * @param forgeProvider - The Forge-provisioned secret store.\n * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).\n * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.\n * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain\n */\nexport function createForgeSecretProviderChain(\n  forgeProvider: ForgeSecretProvider,\n  extraProviders: SecretProvider[] = [],\n): SecretProviderChain {\n  return new SecretProviderChain([...extraProviders, forgeProvider, new EnvSecretProvider()]);\n}\n\n/**\n * Build a `SecretProviderChain` for CLI/standalone context.\n * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.\n * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).\n * @returns A chain that resolves `env:` refs from process.env plus any inline extras.\n * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain\n */\nexport function createCliSecretProviderChain(\n  extraSecrets: Record<string, string> = {},\n): SecretProviderChain {\n  const mem = new InMemorySecretProvider();\n  if (Object.keys(extraSecrets).length > 0) {\n    mem.provision(extraSecrets);\n  }\n  return new SecretProviderChain([new EnvSecretProvider(), mem]);\n}\n\n// ── Auth grammar (mount-side, Tier 2 credential tiers) ───────────────────────\n\n/**\n * Provider kind for a mount auth ref.\n *\n * Two values are accepted:\n *   - `pat`     — static personal access token resolved via the secrets chain\n *                 (standalone CLI / non-platform contexts).\n *   - `backend` — token minted by the platform's credential mediator over the\n *                 transport (`request_access_token` round-trip). Provider\n *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the\n *                 runner stays provider-agnostic.\n *\n * @docLink packages/connectors/api-reference#mount-auth-kind\n */\nexport type MountAuthKind = \"pat\" | \"backend\";\n\n/**\n * Parsed mount `auth:` field.\n *\n *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).\n *   - `backend` → `value` is empty (sentinel only); the runner asks the\n *                 backend for tokens via `request_access_token`.\n *\n * @docLink packages/connectors/api-reference#mount-auth-ref\n */\nexport interface MountAuthRef {\n  kind: MountAuthKind;\n  /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */\n  value: string;\n  /** Original auth string from the declaration, kept for diagnostics. */\n  raw: string;\n}\n\n/**\n * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar\n * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`\n * (platform-mediated).\n * @docLink packages/connectors/api-reference#legacy-auth-grammar-error\n */\nexport class LegacyAuthGrammarError extends Error {\n  readonly auth: string;\n  constructor(auth: string, mountId?: string) {\n    const where = mountId ? ` on mount '${mountId}'` : \"\";\n    super(\n      `Legacy or unrecognized auth grammar${where} ('${auth}'). ` +\n        `Replace with one of:\\n` +\n        `  - backend                  (platform-mediated, recommended)\\n` +\n        `  - pat:env:NAME             (standalone CLI / static token)\\n` +\n        `See _devlog/specs/2026-05-06-tier-2-credential-mediation.md.`,\n    );\n    this.name = \"LegacyAuthGrammarError\";\n    this.auth = auth;\n  }\n}\n\n/**\n * Resolve the `auth: backend` initial mint for a given mount or connector id\n * by querying the secrets chain with a `${kind}:${id}` ref. Returns the\n * resolved bearer token or `undefined` if no pre-minted credential is\n * available.\n *\n * Used by the runner when wiring `ConnectorManager` to\n * answer initial-mint requests from `PreMintedSecretProvider` without\n * round-tripping to the platform. Drivers continue to receive a\n * `tokenMediator` for refresh + retry-401 paths.\n *\n * @param kind Resource family (`mount` or `connector`).\n * @param id Resource declaration id.\n * @param chain Secrets chain. Pass `undefined` to return `undefined`.\n * @returns The pre-minted token, or `undefined` if not stored on the chain.\n * @docLink packages/connectors/api-reference#resolve-backend-auth-for\n */\nexport function resolveBackendAuthFor(\n  kind: \"mount\" | \"connector\",\n  id: string,\n  chain: import(\"./secrets.js\").SecretProvider | undefined,\n): string | undefined {\n  if (!chain) return undefined;\n  return chain.resolve(`${kind}:${id}`);\n}\n\n/**\n * Parse a mount-side auth ref into a typed `MountAuthRef`.\n *\n * Accepted forms:\n *   - `backend`      — platform-mediated mint via `request_access_token`.\n *   - `pat:env:NAME` — static PAT resolved from the secrets chain.\n *\n * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,\n * `github-app:`) — those moved backend-side as part of Tier-2 mediation.\n * Returns `undefined` when `auth` is absent or empty.\n *\n * @param auth - Raw `auth:` value from the mount declaration.\n * @param mountId - Optional mount id included in error messages.\n * @returns Parsed `MountAuthRef` or `undefined`.\n * @throws {LegacyAuthGrammarError} for any unrecognized grammar.\n * @docLink packages/connectors/api-reference#resolve-auth-ref\n */\nexport function resolveAuthRef(\n  auth: string | undefined,\n  mountId?: string,\n): MountAuthRef | undefined {\n  if (!auth) return undefined;\n\n  if (auth === \"backend\") {\n    return { kind: \"backend\", value: \"\", raw: auth };\n  }\n  if (auth.startsWith(\"pat:\")) {\n    return { kind: \"pat\", value: auth.slice(\"pat:\".length), raw: auth };\n  }\n\n  // Legacy bare `env:NAME` and the deprecated provider-prefixed grammars\n  // (`oauth:`, `github-app:`) all land here.\n  throw new LegacyAuthGrammarError(auth, mountId);\n}\n"]}