@12ui/design 0.2.81 → 0.2.82

package/README.md

@@ -208,18 +208,19 @@ providers. Preparation, imports and registration do not need a 12ui account.
 interruption behavior.
 
 Provider routing considers a host session that declared text or code first, then
-eligible Codex and Claude subscription CLI capabilities, then explicitly authorized
-OpenAI API and 12ui providers. Image, image-edit and convert work never routes to
+eligible Codex and Claude subscription CLI capabilities, then the OpenAI API when
+the user opts in, then the 12ui API on the 12ui sign-in. Image, image-edit and convert work never routes to
 a session. Codex text/code subprocess execution requires
 `--trust-codex-config`: explicit trust in the existing user's CLI configuration,
-including tools and hooks beyond the command sandbox. This does not authorize
-paid fallback and does not apply to the current session's tools. Claude requires
+including tools and hooks beyond the command sandbox. This does not opt in to
+the OpenAI API and does not apply to the current session's tools. Claude requires
 supported safe mode, edits code with a fixed file-tool set without shell tests,
 and currently cannot attach images to text requests. Run checks in the parent
 session. Image capability is never inferred from a text CLI's presence.
 Session capabilities (text or code) must be
-explicitly declared from available tools. Key presence alone does not authorize paid work;
-`--allow-paid` is required for a funded route. An ambiguous dispatched operation
+explicitly declared from available tools. 12ui credit use needs no permission. The
+OpenAI API spends on the user's own key and runs only with `--allow-paid openai`; key
+presence alone never enables it. An ambiguous dispatched operation
 requires reconciliation and cannot silently replay on another provider.
 An accepted job with a failed download, or a completed response with malformed
 output, stays in reconciliation under the same operation and attempt. Recover

package/SKILL.md

@@ -23,7 +23,7 @@ candidates.
 Use `12ui` when it is available on `PATH`. Otherwise invoke the pinned CLI that
 the plugin's `open-design.json` MCP entry uses:
 
-    npx -y @12ui/design@0.2.81 <command> ...
+    npx -y @12ui/design@0.2.82 <command> ...
 
 Run `12ui auth status --json` (or its pinned `npx` equivalent) first. A desktop user can authenticate with `12ui auth login`; a headless
 run supplies `TWELVE_UI_API_KEY`. Never put a credential into project files,

package/dist/cli-capabilities.d.ts

@@ -9,8 +9,8 @@ export declare const CLI_CAPABILITIES: {
         readonly preparation: "Prepare and recipe commands record work without model dispatch; execute chooses a provider.";
         readonly session: "Declare session capabilities explicitly (text or code only); execute returns a handoff and register records its result with the exact --attempt number.";
         readonly generation: "image, image-edit and convert always run through the 12ui CLI's own providers, never a host session.";
-        readonly codexConfiguration: "Codex child execution requires --trust-codex-config, including trust in configured tools and hooks. This does not authorize paid fallbacks.";
-        readonly paidProviders: "openai and 12ui require explicit --allow-paid permission; available credentials do not authorize spending.";
+        readonly codexConfiguration: "Codex child execution requires --trust-codex-config, including trust in configured tools and hooks. This does not opt in to the OpenAI API.";
+        readonly paidProviders: "12ui runs on the 12ui sign-in. openai spends on the user's own key and runs only with --allow-paid openai; an available key does not enable it.";
         readonly recovery: "Ambiguous dispatched work requires reconciliation and never silently falls through to another provider.";
         readonly authentication: "Local operations and MCP startup do not require 12ui credentials.";
         readonly layerdoc: "Read completed native LayerDoc and verified local raster mappings without HTTP or inference; sidecar bundles are not hosted conversion uploads.";

package/dist/cli-capabilities.js

@@ -17,8 +17,8 @@ export const CLI_CAPABILITIES = {
         preparation: 'Prepare and recipe commands record work without model dispatch; execute chooses a provider.',
         session: 'Declare session capabilities explicitly (text or code only); execute returns a handoff and register records its result with the exact --attempt number.',
         generation: 'image, image-edit and convert always run through the 12ui CLI\'s own providers, never a host session.',
-        codexConfiguration: 'Codex child execution requires --trust-codex-config, including trust in configured tools and hooks. This does not authorize paid fallbacks.',
-        paidProviders: 'openai and 12ui require explicit --allow-paid permission; available credentials do not authorize spending.',
+        codexConfiguration: 'Codex child execution requires --trust-codex-config, including trust in configured tools and hooks. This does not opt in to the OpenAI API.',
+        paidProviders: '12ui runs on the 12ui sign-in. openai spends on the user\'s own key and runs only with --allow-paid openai; an available key does not enable it.',
         recovery: 'Ambiguous dispatched work requires reconciliation and never silently falls through to another provider.',
         authentication: 'Local operations and MCP startup do not require 12ui credentials.',
         layerdoc: 'Read completed native LayerDoc and verified local raster mappings without HTTP or inference; sidecar bundles are not hosted conversion uploads.',

package/dist/cli-capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-capabilities.js","sourceRoot":"","sources":["../src/cli-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE;QACR,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC;QACrI,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC;QAC5F,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC3D,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC;QAChE,SAAS,EAAE,oEAAoE;QAC/E,WAAW,EAAE,6FAA6F;QAC1G,OAAO,EAAE,yJAAyJ;QAClK,UAAU,EAAE,uGAAuG;QACnH,kBAAkB,EAAE,6IAA6I;QACjK,aAAa,EAAE,4GAA4G;QAC3H,QAAQ,EAAE,yGAAyG;QACnH,cAAc,EAAE,mEAAmE;QACnF,QAAQ,EAAE,iJAAiJ;KAC5J;IACD,MAAM,EAAE;QACN,cAAc,EAAE,kGAAkG;QAClH,KAAK,EAAE,mEAAmE;QAC1E,WAAW,EAAE,UAAU;QACvB,uBAAuB,EAAE,EAAE;QAC3B,WAAW,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC;QACjD,KAAK,EAAE,sFAAsF;QAC7F,UAAU,EAAE,2EAA2E;QACvF,MAAM,EAAE,oBAAoB;KAC7B;IACD,MAAM,EAAE;QACN,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,6BAA6B,CAAC,QAAQ;KACvC;IACD,OAAO,EAAE,sBAAsB;IAC/B,iBAAiB,EACf,sGAAsG;UACpG,sGAAsG;IAC1G,iBAAiB,EAAE;QACjB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAChC,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,kBAAkB;QAC/B,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,aAAa,EAAE,oFAAoF;KACpG;IACD,eAAe,EAAE;QACf,OAAO,EAAE,mDAAmD;QAC5D,aAAa,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;QACrC,mBAAmB,EAAE,EAAE,wBAAwB,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;QAClF,kBAAkB,EAAE,8IAA8I;QAClK,cAAc,EAAE,KAAK;KACtB;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,gEAAgE;QACzE,aAAa,EAAE,mFAAmF;QAClG,YAAY,EAAE,0DAA0D;KACzE;IACD,+GAA+G;IAC/G,UAAU,EAAE;QACV,OAAO,EAAE,mBAAmB;QAC5B,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,8BAA8B;QACvC,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,UAAU;KAClB;IACD,WAAW,EAAE;QACX,OAAO,EAAE,0EAA0E;QACnF,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QACzD,KAAK,EAAE,gEAAgE;KACxE;IACD,WAAW,EAAE,iBAAiB;IAC9B,gBAAgB,EAAE;QAChB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EAAE,uFAAuF;KACrG;IACD,qDAAqD;IACrD,OAAO,EAAE;QACP,KAAK,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACtC,QAAQ,EAAE,CAAC,YAAY,EAAE,qBAAqB,CAAC;QAC/C,iBAAiB,EAAE,CAAC;QACpB,OAAO,EAAE,mEAAmE;QAC5E,WAAW,EACT,qGAAqG;KACxG;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,OAAO;QACnB,sBAAsB,EAAE,wBAAwB;QAChD,OAAO,EAAE,yEAAyE;QAClF,WAAW,EAAE,kPAAkP;KAChQ;IACD,mBAAmB,EAAE,+BAA+B;IACpD,eAAe,EAAE;QACf,OAAO,EAAE,yBAAyB,CAAC,OAAO;QAC1C,cAAc,EAAE,yBAAyB,CAAC,MAAM;QAChD,SAAS,EAAE,yBAAyB,CAAC,KAAK;QAC1C,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,WAAW,EAAE,wBAAwB,CAAC,WAAW;QACjD,YAAY,EAAE,wBAAwB,CAAC,YAAY;QACnD,aAAa,EAAE,wBAAwB,CAAC,UAAU;QAClD,aAAa,EAAE,wBAAwB,CAAC,UAAU;QAClD,iBAAiB,EAAE,wBAAwB,CAAC,OAAO;KACpD;IACD;;;;;OAKG;IACH,cAAc,EAAE;QACd,GAAG,EAAE,4BAA4B;QACjC,QAAQ,EAAE,mCAAmC;KAC9C;IACD,MAAM,EAAE;QACN,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,uBAAuB;QACrC,OAAO,EAAE;YACP,yCAAyC;YACzC,2CAA2C;YAC3C,0EAA0E;SAC3E;KACF;IACD;;;;;;OAMG;IACH,UAAU,EAAE;QACV,IAAI,EAAE,eAAe,oBAAoB,EAAE;QAC3C,aAAa,EAAE,mBAAmB;QAClC,MAAM,EAAE,4DAA4D;QACpE,SAAS,EAAE,+CAA+C;QAC1D,OAAO,EAAE;YACP,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,OAAO;YAClE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK;SAClF;QACD,iFAAiF;QACjF,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB;IACD;;;;;;OAMG;IACH,iBAAiB,EAAE;QACjB,KAAK,EAAE,2CAA2C;QAClD,yEAAyE;QACzE,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC5B,SAAS,EAAE;YACT,+CAA+C;YAC/C,sBAAsB;YACtB,+BAA+B;SAChC;QACD,MAAM,EAAE,+BAA+B;QACvC,6EAA6E;QAC7E,MAAM,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC;QACxD,6EAA6E;QAC7E,aAAa,EAAE;YACb,IAAI,EAAE,mCAAmC;YACzC,MAAM,EAAE,iFAAiF;SAC1F;QACD,UAAU,EAAE,IAAI;KACjB;IACD,uEAAuE;IACvE,iBAAiB,EAAE;QACjB,OAAO,EAAE,sEAAsE;QAC/E,QAAQ,EAAE,yBAAyB;QACnC,qBAAqB,EAAE,oBAAoB;QAC3C,eAAe,EAAE,wBAAwB,CAAC,OAAO;KAClD;IACD,MAAM,EAAE;QACN,OAAO,EAAE,qBAAqB;QAC9B,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,sBAAsB;QAC1C,QAAQ,EAAE,gBAAgB;QAC1B;;;WAGG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,+BAA+B;YACxC,OAAO,EAAE,EAAE;SACZ;QACD,sBAAsB,EAAE,wBAAwB,CAAC,aAAa;KAC/D;IACD,SAAS,EAAE;QACT,OAAO,EAAE,0BAA0B;QACnC,UAAU,EAAE,uCAAuC;QACnD,UAAU,EAAE,2DAA2D;QACvE,MAAM,EAAE,4CAA4C;QACpD,WAAW,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC;QACtD,UAAU,EAAE,yOAAyO;QACrP,UAAU,EAAE,mGAAmG;QAC/G,SAAS,EAAE,CAAC,kBAAkB,EAAE,+DAA+D,CAAC;KACjG;CACO,CAAC"}
+{"version":3,"file":"cli-capabilities.js","sourceRoot":"","sources":["../src/cli-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE;QACR,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC;QACrI,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC;QAC5F,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC3D,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC;QAChE,SAAS,EAAE,oEAAoE;QAC/E,WAAW,EAAE,6FAA6F;QAC1G,OAAO,EAAE,yJAAyJ;QAClK,UAAU,EAAE,uGAAuG;QACnH,kBAAkB,EAAE,6IAA6I;QACjK,aAAa,EAAE,kJAAkJ;QACjK,QAAQ,EAAE,yGAAyG;QACnH,cAAc,EAAE,mEAAmE;QACnF,QAAQ,EAAE,iJAAiJ;KAC5J;IACD,MAAM,EAAE;QACN,cAAc,EAAE,kGAAkG;QAClH,KAAK,EAAE,mEAAmE;QAC1E,WAAW,EAAE,UAAU;QACvB,uBAAuB,EAAE,EAAE;QAC3B,WAAW,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC;QACjD,KAAK,EAAE,sFAAsF;QAC7F,UAAU,EAAE,2EAA2E;QACvF,MAAM,EAAE,oBAAoB;KAC7B;IACD,MAAM,EAAE;QACN,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,6BAA6B,CAAC,QAAQ;KACvC;IACD,OAAO,EAAE,sBAAsB;IAC/B,iBAAiB,EACf,sGAAsG;UACpG,sGAAsG;IAC1G,iBAAiB,EAAE;QACjB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAChC,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,kBAAkB;QAC/B,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,aAAa,EAAE,oFAAoF;KACpG;IACD,eAAe,EAAE;QACf,OAAO,EAAE,mDAAmD;QAC5D,aAAa,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;QACrC,mBAAmB,EAAE,EAAE,wBAAwB,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;QAClF,kBAAkB,EAAE,8IAA8I;QAClK,cAAc,EAAE,KAAK;KACtB;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,gEAAgE;QACzE,aAAa,EAAE,mFAAmF;QAClG,YAAY,EAAE,0DAA0D;KACzE;IACD,+GAA+G;IAC/G,UAAU,EAAE;QACV,OAAO,EAAE,mBAAmB;QAC5B,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,8BAA8B;QACvC,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,UAAU;KAClB;IACD,WAAW,EAAE;QACX,OAAO,EAAE,0EAA0E;QACnF,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QACzD,KAAK,EAAE,gEAAgE;KACxE;IACD,WAAW,EAAE,iBAAiB;IAC9B,gBAAgB,EAAE;QAChB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EAAE,uFAAuF;KACrG;IACD,qDAAqD;IACrD,OAAO,EAAE;QACP,KAAK,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACtC,QAAQ,EAAE,CAAC,YAAY,EAAE,qBAAqB,CAAC;QAC/C,iBAAiB,EAAE,CAAC;QACpB,OAAO,EAAE,mEAAmE;QAC5E,WAAW,EACT,qGAAqG;KACxG;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,OAAO;QACnB,sBAAsB,EAAE,wBAAwB;QAChD,OAAO,EAAE,yEAAyE;QAClF,WAAW,EAAE,kPAAkP;KAChQ;IACD,mBAAmB,EAAE,+BAA+B;IACpD,eAAe,EAAE;QACf,OAAO,EAAE,yBAAyB,CAAC,OAAO;QAC1C,cAAc,EAAE,yBAAyB,CAAC,MAAM;QAChD,SAAS,EAAE,yBAAyB,CAAC,KAAK;QAC1C,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;QACnE,WAAW,EAAE,wBAAwB,CAAC,WAAW;QACjD,YAAY,EAAE,wBAAwB,CAAC,YAAY;QACnD,aAAa,EAAE,wBAAwB,CAAC,UAAU;QAClD,aAAa,EAAE,wBAAwB,CAAC,UAAU;QAClD,iBAAiB,EAAE,wBAAwB,CAAC,OAAO;KACpD;IACD;;;;;OAKG;IACH,cAAc,EAAE;QACd,GAAG,EAAE,4BAA4B;QACjC,QAAQ,EAAE,mCAAmC;KAC9C;IACD,MAAM,EAAE;QACN,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,uBAAuB;QACrC,OAAO,EAAE;YACP,yCAAyC;YACzC,2CAA2C;YAC3C,0EAA0E;SAC3E;KACF;IACD;;;;;;OAMG;IACH,UAAU,EAAE;QACV,IAAI,EAAE,eAAe,oBAAoB,EAAE;QAC3C,aAAa,EAAE,mBAAmB;QAClC,MAAM,EAAE,4DAA4D;QACpE,SAAS,EAAE,+CAA+C;QAC1D,OAAO,EAAE;YACP,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,OAAO;YAClE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK;SAClF;QACD,iFAAiF;QACjF,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB;IACD;;;;;;OAMG;IACH,iBAAiB,EAAE;QACjB,KAAK,EAAE,2CAA2C;QAClD,yEAAyE;QACzE,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC5B,SAAS,EAAE;YACT,+CAA+C;YAC/C,sBAAsB;YACtB,+BAA+B;SAChC;QACD,MAAM,EAAE,+BAA+B;QACvC,6EAA6E;QAC7E,MAAM,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC;QACxD,6EAA6E;QAC7E,aAAa,EAAE;YACb,IAAI,EAAE,mCAAmC;YACzC,MAAM,EAAE,iFAAiF;SAC1F;QACD,UAAU,EAAE,IAAI;KACjB;IACD,uEAAuE;IACvE,iBAAiB,EAAE;QACjB,OAAO,EAAE,sEAAsE;QAC/E,QAAQ,EAAE,yBAAyB;QACnC,qBAAqB,EAAE,oBAAoB;QAC3C,eAAe,EAAE,wBAAwB,CAAC,OAAO;KAClD;IACD,MAAM,EAAE;QACN,OAAO,EAAE,qBAAqB;QAC9B,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,sBAAsB;QAC1C,QAAQ,EAAE,gBAAgB;QAC1B;;;WAGG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,+BAA+B;YACxC,OAAO,EAAE,EAAE;SACZ;QACD,sBAAsB,EAAE,wBAAwB,CAAC,aAAa;KAC/D;IACD,SAAS,EAAE;QACT,OAAO,EAAE,0BAA0B;QACnC,UAAU,EAAE,uCAAuC;QACnD,UAAU,EAAE,2DAA2D;QACvE,MAAM,EAAE,4CAA4C;QACpD,WAAW,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC;QACtD,UAAU,EAAE,yOAAyO;QACrP,UAAU,EAAE,mGAAmG;QAC/G,SAAS,EAAE,CAAC,kBAAkB,EAAE,+DAA+D,CAAC;KACjG;CACO,CAAC"}

package/dist/cli-help/index.d.ts

@@ -108,7 +108,7 @@ export declare const CLI_HELP_CONTEXTS: {
         readonly summary: "Run design work through one persistent local workflow shared by the CLI, SDK, and MCP.";
         readonly sections: readonly [{
             readonly heading: "Flow";
-            readonly items: readonly ["Import local files, prepare a request or recipe, execute the returned operation, then inspect its status. Recipe commands prepare only.", "Image, image-edit and convert work always runs through the 12ui CLI's own providers (the 12ui API, or the OpenAI API for images), never a host session.", "A declared host session receives a handoff for text or code with its own tools; register the resulting JSON or files against that same operation and attempt number.", "Local Codex/Claude execution uses the user’s plan. OpenAI API and 12ui fallbacks require explicit --allow-paid authorization; credentials alone do not enable spending.", "An ambiguous dispatch stops for reconciliation. Repeating execute never silently buys the same work through another provider."];
+            readonly items: readonly ["Import local files, prepare a request or recipe, execute the returned operation, then inspect its status. Recipe commands prepare only.", "Image, image-edit and convert work always runs through the 12ui CLI's own providers (the 12ui API, or the OpenAI API for images), never a host session.", "A declared host session receives a handoff for text or code with its own tools; register the resulting JSON or files against that same operation and attempt number.", "Local Codex/Claude execution uses the user’s plan. The 12ui API runs on the 12ui sign-in. The OpenAI API spends on the user’s own key and runs only with --allow-paid openai; a key alone does not enable it.", "An ambiguous dispatch stops for reconciliation. Repeating execute never silently buys the same work through another provider."];
         }];
     };
     readonly 'workflow prepare': {
@@ -122,7 +122,7 @@ export declare const CLI_HELP_CONTEXTS: {
         readonly summary: "Execute an existing operation through eligible providers in the requested preference order.";
         readonly sections: readonly [{
             readonly heading: "Routing";
-            readonly items: readonly ["--providers is an ordered comma-separated subset of session,codex,claude,openai,12ui. Declare only text or code with --session-capabilities: a session never generates images or converts.", "--allow-paid openai,12ui authorizes those paid fallbacks. Omit a provider to withhold that permission. User-plan execution still consumes the user’s allowance.", "--trust-codex-config permits launching the existing Codex CLI configuration, including configured tools and hooks. Codex child execution is unavailable without it. This does not authorize paid API or 12ui fallbacks.", "Session execution (text or code only) returns a handoff, not completed output. Fulfill it using the calling client, then run workflow register with the result and the exact handoff attemptNumber as --attempt."];
+            readonly items: readonly ["--providers is an ordered comma-separated subset of session,codex,claude,openai,12ui. Declare only text or code with --session-capabilities: a session never generates images or converts.", "--allow-paid openai opts in to the OpenAI API on the user’s own key. 12ui credit use needs no flag. User-plan execution still consumes the user’s allowance.", "--trust-codex-config permits launching the existing Codex CLI configuration, including configured tools and hooks. Codex child execution is unavailable without it. This does not opt in to the OpenAI API.", "Session execution (text or code only) returns a handoff, not completed output. Fulfill it using the calling client, then run workflow register with the result and the exact handoff attemptNumber as --attempt."];
         }];
     };
     readonly 'workflow register': {

package/dist/cli-help/workflow.d.ts

@@ -4,7 +4,7 @@ export declare const WORKFLOW_HELP: {
         readonly summary: "Run design work through one persistent local workflow shared by the CLI, SDK, and MCP.";
         readonly sections: readonly [{
             readonly heading: "Flow";
-            readonly items: readonly ["Import local files, prepare a request or recipe, execute the returned operation, then inspect its status. Recipe commands prepare only.", "Image, image-edit and convert work always runs through the 12ui CLI's own providers (the 12ui API, or the OpenAI API for images), never a host session.", "A declared host session receives a handoff for text or code with its own tools; register the resulting JSON or files against that same operation and attempt number.", "Local Codex/Claude execution uses the user’s plan. OpenAI API and 12ui fallbacks require explicit --allow-paid authorization; credentials alone do not enable spending.", "An ambiguous dispatch stops for reconciliation. Repeating execute never silently buys the same work through another provider."];
+            readonly items: readonly ["Import local files, prepare a request or recipe, execute the returned operation, then inspect its status. Recipe commands prepare only.", "Image, image-edit and convert work always runs through the 12ui CLI's own providers (the 12ui API, or the OpenAI API for images), never a host session.", "A declared host session receives a handoff for text or code with its own tools; register the resulting JSON or files against that same operation and attempt number.", "Local Codex/Claude execution uses the user’s plan. The 12ui API runs on the 12ui sign-in. The OpenAI API spends on the user’s own key and runs only with --allow-paid openai; a key alone does not enable it.", "An ambiguous dispatch stops for reconciliation. Repeating execute never silently buys the same work through another provider."];
         }];
     };
     readonly 'workflow prepare': {
@@ -18,7 +18,7 @@ export declare const WORKFLOW_HELP: {
         readonly summary: "Execute an existing operation through eligible providers in the requested preference order.";
         readonly sections: readonly [{
             readonly heading: "Routing";
-            readonly items: readonly ["--providers is an ordered comma-separated subset of session,codex,claude,openai,12ui. Declare only text or code with --session-capabilities: a session never generates images or converts.", "--allow-paid openai,12ui authorizes those paid fallbacks. Omit a provider to withhold that permission. User-plan execution still consumes the user’s allowance.", "--trust-codex-config permits launching the existing Codex CLI configuration, including configured tools and hooks. Codex child execution is unavailable without it. This does not authorize paid API or 12ui fallbacks.", "Session execution (text or code only) returns a handoff, not completed output. Fulfill it using the calling client, then run workflow register with the result and the exact handoff attemptNumber as --attempt."];
+            readonly items: readonly ["--providers is an ordered comma-separated subset of session,codex,claude,openai,12ui. Declare only text or code with --session-capabilities: a session never generates images or converts.", "--allow-paid openai opts in to the OpenAI API on the user’s own key. 12ui credit use needs no flag. User-plan execution still consumes the user’s allowance.", "--trust-codex-config permits launching the existing Codex CLI configuration, including configured tools and hooks. Codex child execution is unavailable without it. This does not opt in to the OpenAI API.", "Session execution (text or code only) returns a handoff, not completed output. Fulfill it using the calling client, then run workflow register with the result and the exact handoff attemptNumber as --attempt."];
         }];
     };
     readonly 'workflow register': {

package/dist/cli-help/workflow.js

@@ -3,7 +3,7 @@ const recipe = {
     sections: [{ heading: 'Continue', items: [
                 'Use a persistent --workspace and stable --key. Keep the returned operation id; execute it through the same workflow service from CLI or MCP.',
                 'Supply local source/reference paths in the input JSON. The recipe imports and hashes the files before execution.',
-                'Provider discovery and --allow-paid belong to workflow execute. Preparing a recipe does not authorize model calls.',
+                'Provider discovery and --allow-paid openai belong to workflow execute. Preparing a recipe does not dispatch model calls.',
             ] }],
 };
 export const WORKFLOW_HELP = {
@@ -13,7 +13,7 @@ export const WORKFLOW_HELP = {
                     'Import local files, prepare a request or recipe, execute the returned operation, then inspect its status. Recipe commands prepare only.',
                     'Image, image-edit and convert work always runs through the 12ui CLI\'s own providers (the 12ui API, or the OpenAI API for images), never a host session.',
                     'A declared host session receives a handoff for text or code with its own tools; register the resulting JSON or files against that same operation and attempt number.',
-                    'Local Codex/Claude execution uses the user’s plan. OpenAI API and 12ui fallbacks require explicit --allow-paid authorization; credentials alone do not enable spending.',
+                    'Local Codex/Claude execution uses the user’s plan. The 12ui API runs on the 12ui sign-in. The OpenAI API spends on the user’s own key and runs only with --allow-paid openai; a key alone does not enable it.',
                     'An ambiguous dispatch stops for reconciliation. Repeating execute never silently buys the same work through another provider.',
                 ] }],
     },
@@ -28,8 +28,8 @@ export const WORKFLOW_HELP = {
         summary: 'Execute an existing operation through eligible providers in the requested preference order.',
         sections: [{ heading: 'Routing', items: [
                     '--providers is an ordered comma-separated subset of session,codex,claude,openai,12ui. Declare only text or code with --session-capabilities: a session never generates images or converts.',
-                    '--allow-paid openai,12ui authorizes those paid fallbacks. Omit a provider to withhold that permission. User-plan execution still consumes the user’s allowance.',
-                    '--trust-codex-config permits launching the existing Codex CLI configuration, including configured tools and hooks. Codex child execution is unavailable without it. This does not authorize paid API or 12ui fallbacks.',
+                    '--allow-paid openai opts in to the OpenAI API on the user’s own key. 12ui credit use needs no flag. User-plan execution still consumes the user’s allowance.',
+                    '--trust-codex-config permits launching the existing Codex CLI configuration, including configured tools and hooks. Codex child execution is unavailable without it. This does not opt in to the OpenAI API.',
                     'Session execution (text or code only) returns a handoff, not completed output. Fulfill it using the calling client, then run workflow register with the result and the exact handoff attemptNumber as --attempt.',
                 ] }],
     },

package/dist/cli-help/workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../src/cli-help/workflow.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,GAAmB;IAC7B,OAAO,EAAE,oFAAoF;IAC7F,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE;gBACvC,8IAA8I;gBAC9I,kHAAkH;gBAClH,oHAAoH;aACrH,EAAE,CAAC;CACL,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE;QACR,OAAO,EAAE,wFAAwF;QACjG,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;oBACnC,yIAAyI;oBACzI,0JAA0J;oBAC1J,sKAAsK;oBACtK,yKAAyK;oBACzK,+HAA+H;iBAChI,EAAE,CAAC;KACL;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,yFAAyF;QAClG,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;oBACtC,mQAAmQ;oBACnQ,6IAA6I;iBAC9I,EAAE,CAAC;KACL;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,6FAA6F;QACtG,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;oBACtC,4LAA4L;oBAC5L,iKAAiK;oBACjK,yNAAyN;oBACzN,kNAAkN;iBACnN,EAAE,CAAC;KACL;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,2DAA2D;QACpE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE;oBAC1C,sQAAsQ;oBACtQ,8MAA8M;iBAC/M,EAAE,CAAC;KACL;IACD,iBAAiB,EAAE,EAAE,OAAO,EAAE,oEAAoE,EAAE;IACpG,mBAAmB,EAAE;QACnB,OAAO,EAAE,qFAAqF;QAC9F,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,oGAAoG,CAAC,EAAE,CAAC;KACrJ;IACD,eAAe,EAAE;QACf,OAAO,EAAE,sEAAsE;QAC/E,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;oBAC3C,2GAA2G;oBAC3G,oJAAoJ;oBACpJ,yHAAyH;iBAC1H,EAAE,CAAC;KACL;IACD,iBAAiB,EAAE,EAAE,OAAO,EAAE,iFAAiF,EAAE;IACjH,iBAAiB,EAAE,EAAE,OAAO,EAAE,kFAAkF,EAAE;IAClH,mBAAmB,EAAE;QACnB,OAAO,EAAE,wEAAwE;QACjF,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE;oBAC7C,+LAA+L;oBAC/L,gIAAgI;oBAChI,4IAA4I;iBAC7I,EAAE,CAAC;KACL;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,+EAA+E;QACxF,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;oBACtC,yHAAyH;oBACzH,sFAAsF;iBACvF,EAAE,CAAC;KACL;IACD,uBAAuB,EAAE;QACvB,OAAO,EAAE,0EAA0E;QACnF,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;oBAC3C,iGAAiG;oBACjG,wMAAwM;iBACzM,EAAE,CAAC;KACL;IACD,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM;IAC5E,mBAAmB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM;IAChH,iBAAiB,EAAE;QACjB,OAAO,EAAE,qEAAqE;QAC9E,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;oBACpC,wJAAwJ;oBACxJ,2HAA2H;iBAC5H,EAAE,CAAC;KACL;CACgC,CAAC"}
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../src/cli-help/workflow.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,GAAmB;IAC7B,OAAO,EAAE,oFAAoF;IAC7F,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE;gBACvC,8IAA8I;gBAC9I,kHAAkH;gBAClH,0HAA0H;aAC3H,EAAE,CAAC;CACL,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE;QACR,OAAO,EAAE,wFAAwF;QACjG,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;oBACnC,yIAAyI;oBACzI,0JAA0J;oBAC1J,sKAAsK;oBACtK,+MAA+M;oBAC/M,+HAA+H;iBAChI,EAAE,CAAC;KACL;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,yFAAyF;QAClG,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;oBACtC,mQAAmQ;oBACnQ,6IAA6I;iBAC9I,EAAE,CAAC;KACL;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,6FAA6F;QACtG,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;oBACtC,4LAA4L;oBAC5L,8JAA8J;oBAC9J,6MAA6M;oBAC7M,kNAAkN;iBACnN,EAAE,CAAC;KACL;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,2DAA2D;QACpE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE;oBAC1C,sQAAsQ;oBACtQ,8MAA8M;iBAC/M,EAAE,CAAC;KACL;IACD,iBAAiB,EAAE,EAAE,OAAO,EAAE,oEAAoE,EAAE;IACpG,mBAAmB,EAAE;QACnB,OAAO,EAAE,qFAAqF;QAC9F,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,oGAAoG,CAAC,EAAE,CAAC;KACrJ;IACD,eAAe,EAAE;QACf,OAAO,EAAE,sEAAsE;QAC/E,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;oBAC3C,2GAA2G;oBAC3G,oJAAoJ;oBACpJ,yHAAyH;iBAC1H,EAAE,CAAC;KACL;IACD,iBAAiB,EAAE,EAAE,OAAO,EAAE,iFAAiF,EAAE;IACjH,iBAAiB,EAAE,EAAE,OAAO,EAAE,kFAAkF,EAAE;IAClH,mBAAmB,EAAE;QACnB,OAAO,EAAE,wEAAwE;QACjF,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE;oBAC7C,+LAA+L;oBAC/L,gIAAgI;oBAChI,4IAA4I;iBAC7I,EAAE,CAAC;KACL;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,+EAA+E;QACxF,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;oBACtC,yHAAyH;oBACzH,sFAAsF;iBACvF,EAAE,CAAC;KACL;IACD,uBAAuB,EAAE;QACvB,OAAO,EAAE,0EAA0E;QACnF,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;oBAC3C,iGAAiG;oBACjG,wMAAwM;iBACzM,EAAE,CAAC;KACL;IACD,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM;IAC5E,mBAAmB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM;IAChH,iBAAiB,EAAE;QACjB,OAAO,EAAE,qEAAqE;QAC9E,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;oBACpC,wJAAwJ;oBACxJ,2HAA2H;iBAC5H,EAAE,CAAC;KACL;CACgC,CAAC"}

package/dist/cli-usage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-usage.d.ts","sourceRoot":"","sources":["../src/cli-usage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAkD9C,eAAO,MAAM,SAAS,QAqGsC,CAAC;AAE7D,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAER,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIhD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAgB9C,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAI5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAA2C,CAAC;AAEzF,gFAAgF;AAChF,eAAO,MAAM,eAAe,GAAI,QAAO,SAAS,MAAM,EAAoB,KAAG,GAAG,CAAC,MAAM,CAMtF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,GAAG,MAAM,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAczE,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,GAAG,MAAM,SAAS,MAAM,EAAE,KAAG,MAEzD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,SAAS,MAAM,EAAE,KAAG,MAaxD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB,KAAG,UAGH,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,WAAW,GAAI,MAAM;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB,KAAG,KAEH,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,UAAU,GAAI,UAAS,SAAS,MAAM,EAAO,KAAG,IAE5D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,KAAK,QAAO,KAExB,CAAC"}
+{"version":3,"file":"cli-usage.d.ts","sourceRoot":"","sources":["../src/cli-usage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAkD9C,eAAO,MAAM,SAAS,QAsGsC,CAAC;AAE7D,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAER,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIhD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAgB9C,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAI5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAA2C,CAAC;AAEzF,gFAAgF;AAChF,eAAO,MAAM,eAAe,GAAI,QAAO,SAAS,MAAM,EAAoB,KAAG,GAAG,CAAC,MAAM,CAMtF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,GAAG,MAAM,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAczE,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,GAAG,MAAM,SAAS,MAAM,EAAE,KAAG,MAEzD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,SAAS,MAAM,EAAE,KAAG,MAaxD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB,KAAG,UAGH,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,WAAW,GAAI,MAAM;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB,KAAG,KAEH,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,UAAU,GAAI,UAAS,SAAS,MAAM,EAAO,KAAG,IAE5D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,KAAK,QAAO,KAExB,CAAC"}

package/dist/cli-usage.js

@@ -48,7 +48,7 @@ import { CLI_CONVERSION_OUTPUTS } from './conversion-outputs.js';
 const CONCEPT_PLACEHOLDER = `<text>`;
 export const CLI_USAGE = `Usage:
   12ui workflow prepare <request.json> --workspace <directory> --key <stable-key>
-  12ui workflow execute <operation-id> --workspace <directory> [--providers session,codex,claude,openai,12ui] [--allow-paid openai,12ui] [--session-capabilities text,code] [--trust-codex-config]
+  12ui workflow execute <operation-id> --workspace <directory> [--providers session,codex,claude,openai,12ui] [--allow-paid openai] [--session-capabilities text,code] [--trust-codex-config]
   12ui workflow register <operation-id> --workspace <directory> --attempt <number> --result <result.json>
   12ui workflow continue <operation-id> --workspace <directory>
   12ui workflow fail <operation-id> --workspace <directory> --attempt <number> --failure <failure.json>
@@ -134,12 +134,13 @@ retained deterministic polish rules before runtime verification; it is opt-in.
 Workflow prepare and recipe commands do not dispatch models. Execute selects a
 capable provider. Images, image edits and conversion always run through the 12ui
 CLI's own providers, never a host session. A host session may declare text or
-code to receive a handoff, then register its outputs with the handoff's --attempt number. --allow-paid explicitly permits OpenAI API or 12ui credit
-spend. Credentials alone never enable a paid workflow fallback. Local execution
+code to receive a handoff, then register its outputs with the handoff's --attempt number. The 12ui API runs on
+the 12ui sign-in. --allow-paid openai opts in to the OpenAI API on the user's own key;
+a key alone never enables it. Local execution
 can consume the user's model plan and hardware. Keep the same workspace and key
 for recovery; uncertain dispatched work never silently moves to another provider.
 Codex child execution requires --trust-codex-config because existing configured
-tools and hooks may run. This trust does not authorize paid API or 12ui fallback.
+tools and hooks may run. This trust does not opt in to the OpenAI API.
 
 Hosted work accepts --origin <url> and --api-key <key> (defaulting to
 TWELVE_UI_ORIGIN / TWELVE_UI_API_KEY, then \`12ui auth login\`). Local next, resume,

package/dist/cli-usage.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-usage.js","sourceRoot":"","sources":["../src/cli-usage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA+BA,mBAAmB;0DACc,mBAAmB;;;oCAGzC,mBAAmB;;;;;;;;;;6DAUM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;2DAClC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;;;sFAGL,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4DAoD1D,CAAC;AAE7D,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAsB,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;KAC5E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;KAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,sCAAsC;IACtC,6HAA6H;IAC7H,gDAAgD;CACjD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,6BAA6B;IAC7B,iDAAiD;IACjD,0DAA0D;IAC1D,oDAAoD;IACpD,+FAA+F;IAC/F,yDAAyD;IACzD,2GAA2G;UACvG,qEAAqE;IACzE,+FAA+F;IAC/F,8DAA8D;IAC9D,oDAAoD;IACpD,kGAAkG;UAC9F,mCAAmC;IACvC,4FAA4F;IAC5F,iEAAiE;CAClE,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,GAAG,uBAAuB;IAC1B,GAAG,mBAAmB;IACtB,GAAG,iBAAiB;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEzF,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAA2B,eAAe,EAAe,EAAE;IACzF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAuB,EAAqB,EAAE;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,KAAK,IAAI,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;IACzC,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAuB,EAAU,EAAE,CAAC,CAClE,WAAW,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAuB,EAAU,EAAE;IAChE,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,MAAM,IAAI,UAAU,CAClB,wBAAwB,KAAK,qBAAqB,KAAK,GAAG;cACtD,6CAA6C,EACjD,oBAAoB,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,OAAO,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAI5B,EAAc,EAAE,CAAC,IAAI,UAAU,CAC9B,GAAG,IAAI,CAAC,MAAM,OAAO,WAAW,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAChD,IAAI,CAAC,IAAI,CACV,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAI3B,EAAS,EAAE;IACV,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAA6B,EAAE,EAAQ,EAAE;IAClE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,GAAU,EAAE;IAC/B,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC,CAAC"}
+{"version":3,"file":"cli-usage.js","sourceRoot":"","sources":["../src/cli-usage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA+BA,mBAAmB;0DACc,mBAAmB;;;oCAGzC,mBAAmB;;;;;;;;;;6DAUM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;2DAClC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;;;sFAGL,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4DAqD1D,CAAC;AAE7D,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAsB,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;KAC5E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;KAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,sCAAsC;IACtC,6HAA6H;IAC7H,gDAAgD;CACjD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,6BAA6B;IAC7B,iDAAiD;IACjD,0DAA0D;IAC1D,oDAAoD;IACpD,+FAA+F;IAC/F,yDAAyD;IACzD,2GAA2G;UACvG,qEAAqE;IACzE,+FAA+F;IAC/F,8DAA8D;IAC9D,oDAAoD;IACpD,kGAAkG;UAC9F,mCAAmC;IACvC,4FAA4F;IAC5F,iEAAiE;CAClE,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,GAAG,uBAAuB;IAC1B,GAAG,mBAAmB;IACtB,GAAG,iBAAiB;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEzF,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAA2B,eAAe,EAAe,EAAE;IACzF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAuB,EAAqB,EAAE;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,KAAK,IAAI,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;IACzC,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAuB,EAAU,EAAE,CAAC,CAClE,WAAW,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAuB,EAAU,EAAE;IAChE,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,MAAM,IAAI,UAAU,CAClB,wBAAwB,KAAK,qBAAqB,KAAK,GAAG;cACtD,6CAA6C,EACjD,oBAAoB,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,OAAO,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAI5B,EAAc,EAAE,CAAC,IAAI,UAAU,CAC9B,GAAG,IAAI,CAAC,MAAM,OAAO,WAAW,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAChD,IAAI,CAAC,IAAI,CACV,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAI3B,EAAS,EAAE;IACV,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAA6B,EAAE,EAAQ,EAAE;IAClE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,GAAU,EAAE;IAC/B,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC,CAAC"}

package/dist/mcp-workflow-tools.js

@@ -34,11 +34,11 @@ export const MCP_WORKFLOW_TOOL_DEFINITIONS = [
     },
     {
         name: 'design.workflow.execute',
-        description: 'Route a prepared operation. Image, image-edit and convert work runs only through the 12ui CLI\'s own providers (the 12ui API, or the OpenAI API for images, each with explicit allowPaid), never a host session. Text and code may go to a declared session (a handoff to complete with host tools, then register), a local CLI, or an explicitly authorized paid provider. Ambiguous dispatched work is not retried on another provider.',
+        description: 'Route a prepared operation. Image, image-edit and convert work runs only through the 12ui CLI\'s own providers (the 12ui API on the 12ui sign-in, or the OpenAI API for images when the user opts in with allowPaid), never a host session. Text and code may go to a declared session (a handoff to complete with host tools, then register), a local CLI, the 12ui API, or the OpenAI API under allowPaid. Ambiguous dispatched work is not retried on another provider.',
         inputSchema: object({
             workspace, operationId: string,
             providers: { type: 'array', minItems: 1, uniqueItems: true, items: { enum: [...PROVIDERS] }, description: 'Provider preference order. A session is eligible only for explicitly declared capabilities.' },
-            allowPaid: { type: 'array', uniqueItems: true, items: { enum: ['openai', '12ui'] }, description: 'Explicit permission for providers funded by API keys or 12ui credits. Key presence is not permission.' },
+            allowPaid: { type: 'array', uniqueItems: true, items: { enum: ['openai', '12ui'] }, description: 'The user\'s opt-in to spend on their own OpenAI API key ("openai"). Key presence is not that opt-in. 12ui credit use needs no permission; a "12ui" entry changes nothing.' },
             sessionCapabilities: capabilityList,
             trustCodexConfig,
         }, ['workspace', 'operationId']),

package/dist/mcp-workflow-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-workflow-tools.js","sourceRoot":"","sources":["../src/mcp-workflow-tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,qBAAqB,EAAsD,MAAM,yBAAyB,CAAC;AAE9J,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACzD,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;AAC/F,MAAM,cAAc,GAAG,EAAE,IAAI,EAAE,OAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,4IAA4I,EAAE,CAAC;AAC5Q,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,SAAkB,EAAE,WAAW,EAAE,wKAAwK,EAAE,CAAC;AAC7O,MAAM,MAAM,GAAG,CAAC,UAAkC,EAAE,WAAqB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;AACjK,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,mDAAmD,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAC7L,MAAM,QAAQ,GAAG,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,MAAM;IAClG,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;CAC5J,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,6BAA6B,GAAW;IACnD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,+LAA+L;QAC5M,WAAW,EAAE;YACX,GAAG,MAAM,CAAC;gBACR,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,gFAAgF,EAAE;gBAC5H,OAAO,EAAE,MAAM,CAAC;oBACd,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM;oBACvD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;oBAC9G,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC/B,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAChD,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,qBAAqB,CAAC,EAAE;gBAC5C,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+DAA+D,EAAE;aACxG,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACxB,KAAK,EAAE;gBACL,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC9F,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE;aAClE;SACF;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,2aAA2a;QACxb,WAAW,EAAE,MAAM,CAAC;YAClB,SAAS,EAAE,WAAW,EAAE,MAAM;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,6FAA6F,EAAE;YACzM,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,uGAAuG,EAAE;YAC1M,mBAAmB,EAAE,cAAc;YACnC,gBAAgB;SACjB,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;KACjC;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,wJAAwJ;QACrK,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC;gBAClL,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACvG,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,uKAAuK;QACpL,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;KACtF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,0OAA0O;QACvP,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC;gBACnM,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE;aAC7H,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;KACpG;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,sHAAsH;QACnI,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACtE,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,yHAAyH;QACtI,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;KACzG;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,oLAAoL;QACjM,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;QACzF,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,qNAAqN;QAClO,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;KAC1H;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,iMAAiM;QAC9M,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACzF,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;SAC3H,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;KACzB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,0RAA0R;QACvS,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACrF,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;OACvF,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAmB,CAAC,CAAC;AAExF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAa,EAAE,OAAkC;IACpG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAmB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACxG,CAAC"}
+{"version":3,"file":"mcp-workflow-tools.js","sourceRoot":"","sources":["../src/mcp-workflow-tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,qBAAqB,EAAsD,MAAM,yBAAyB,CAAC;AAE9J,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACzD,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;AAC/F,MAAM,cAAc,GAAG,EAAE,IAAI,EAAE,OAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,4IAA4I,EAAE,CAAC;AAC5Q,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,SAAkB,EAAE,WAAW,EAAE,wKAAwK,EAAE,CAAC;AAC7O,MAAM,MAAM,GAAG,CAAC,UAAkC,EAAE,WAAqB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;AACjK,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,mDAAmD,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAC7L,MAAM,QAAQ,GAAG,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,MAAM;IAClG,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;CAC5J,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,6BAA6B,GAAW;IACnD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,+LAA+L;QAC5M,WAAW,EAAE;YACX,GAAG,MAAM,CAAC;gBACR,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,gFAAgF,EAAE;gBAC5H,OAAO,EAAE,MAAM,CAAC;oBACd,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM;oBACvD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;oBAC9G,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC/B,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAChD,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,qBAAqB,CAAC,EAAE;gBAC5C,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+DAA+D,EAAE;aACxG,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACxB,KAAK,EAAE;gBACL,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC9F,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE;aAClE;SACF;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,4cAA4c;QACzd,WAAW,EAAE,MAAM,CAAC;YAClB,SAAS,EAAE,WAAW,EAAE,MAAM;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,6FAA6F,EAAE;YACzM,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,2KAA2K,EAAE;YAC9Q,mBAAmB,EAAE,cAAc;YACnC,gBAAgB;SACjB,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;KACjC;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,wJAAwJ;QACrK,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC;gBAClL,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACvG,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,uKAAuK;QACpL,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;KACtF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,0OAA0O;QACvP,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC;gBACnM,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE;aAC7H,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;KACpG;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,sHAAsH;QACnI,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACtE,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,yHAAyH;QACtI,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;KACzG;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,oLAAoL;QACjM,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;QACzF,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,qNAAqN;QAClO,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;KAC1H;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,iMAAiM;QAC9M,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACzF,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;SAC3H,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;KACzB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,0RAA0R;QACvS,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACrF,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;OACvF,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAmB,CAAC,CAAC;AAExF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAa,EAAE,OAAkC;IACpG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAmB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACxG,CAAC"}

package/dist/review-files-server.d.ts

@@ -0,0 +1,8 @@
+import type { ReviewModel } from './review-types.js';
+export type ReviewFilesServer = {
+    port: number;
+    close: () => Promise<void>;
+};
+/** Serves `/files/<run>/<path>` for the runs `model()` currently lists, read-only, on its own loopback port. */
+export declare const startReviewFilesServer: (model: () => ReviewModel) => Promise<ReviewFilesServer>;
+//# sourceMappingURL=review-files-server.d.ts.map

package/dist/review-files-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-files-server.d.ts","sourceRoot":"","sources":["../src/review-files-server.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAkFrD,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AAE7E,gHAAgH;AAChH,eAAO,MAAM,sBAAsB,GAAU,OAAO,MAAM,WAAW,KAAG,OAAO,CAAC,iBAAiB,CA6ChG,CAAC"}

package/dist/review-files-server.js

@@ -0,0 +1,133 @@
+import { createReadStream } from 'node:fs';
+import { realpath, stat } from 'node:fs/promises';
+import http from 'node:http';
+import path from 'node:path';
+import { assertReviewFileAccess } from './review-server-guard.js';
+/**
+ * THE RUN FILES' OWN ORIGIN. `12ui review` serves a run's files (its HTML, scripts, fonts, images) from a second
+ * loopback port, not the review page's: a run's HTML opened from the page, or framed in it, is then a normal page at
+ * an origin that holds no session token and takes no request that changes anything (`assertReviewFileAccess`). It
+ * runs as it would anywhere (module scripts, fetches of its own files, local `@font-face`, storage), and the browser's
+ * same-origin policy keeps it from reading the review page, whose server refuses its requests by Origin
+ * (`assertReviewAccess`).
+ */
+const CONTENT_TYPES = {
+    '.avif': 'image/avif',
+    '.css': 'text/css; charset=utf-8',
+    '.gif': 'image/gif',
+    '.htm': 'text/html; charset=utf-8',
+    '.html': 'text/html; charset=utf-8',
+    '.ico': 'image/x-icon',
+    '.jpeg': 'image/jpeg',
+    '.jpg': 'image/jpeg',
+    '.js': 'text/javascript; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.map': 'application/json; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.otf': 'font/otf',
+    '.png': 'image/png',
+    '.svg': 'image/svg+xml',
+    '.ttf': 'font/ttf',
+    '.txt': 'text/plain; charset=utf-8',
+    '.wasm': 'application/wasm',
+    '.webmanifest': 'application/manifest+json',
+    '.webp': 'image/webp',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+};
+const serveRunFile = async (args) => {
+    const segments = args.pathname.split('/').slice(2).map((segment) => decodeURIComponent(segment));
+    const runId = segments.shift();
+    const run = args.model.runs.find((candidate) => candidate.id === runId);
+    if (!run || segments.length === 0 || segments.some((segment) => (!segment
+        || segment === '.'
+        || segment === '..'
+        || segment.startsWith('.')
+        || segment.includes('/')
+        || segment.includes('\\')))) {
+        args.response.writeHead(404).end('not found');
+        return;
+    }
+    const root = await realpath(run.root).catch(() => null);
+    const candidate = path.resolve(run.root, ...segments);
+    const file = await realpath(candidate).catch(() => null);
+    if (!root || !file || (file !== root && !file.startsWith(`${root}${path.sep}`))) {
+        args.response.writeHead(403).end('forbidden');
+        return;
+    }
+    if (path.relative(root, file).split(path.sep).some((segment) => segment.startsWith('.'))) {
+        args.response.writeHead(404).end('not found');
+        return;
+    }
+    const details = await stat(file).catch(() => null);
+    if (!details?.isFile()) {
+        args.response.writeHead(404).end('not found');
+        return;
+    }
+    args.response.writeHead(200, {
+        'content-type': CONTENT_TYPES[path.extname(file).toLowerCase()] ?? 'application/octet-stream',
+        'content-length': details.size,
+        'cache-control': 'no-store',
+        'x-content-type-options': 'nosniff',
+    });
+    if (args.method === 'HEAD')
+        args.response.end();
+    else
+        createReadStream(file).pipe(args.response);
+};
+/** Serves `/files/<run>/<path>` for the runs `model()` currently lists, read-only, on its own loopback port. */
+export const startReviewFilesServer = async (model) => {
+    let port = 0;
+    const server = http.createServer(async (request, response) => {
+        const method = request.method ?? 'GET';
+        try {
+            assertReviewFileAccess(request, { port });
+        }
+        catch (error) {
+            const refused = error;
+            response.writeHead(refused.status, { 'content-type': 'text/plain; charset=utf-8', allow: 'GET, HEAD' }).end(refused.message);
+            return;
+        }
+        let pathname;
+        try {
+            pathname = new URL(request.url ?? '/', 'http://127.0.0.1').pathname;
+        }
+        catch {
+            response.writeHead(400).end('bad request');
+            return;
+        }
+        if (!pathname.startsWith('/files/')) {
+            response.writeHead(404).end('not found');
+            return;
+        }
+        try {
+            await serveRunFile({ model: model(), pathname, method, response });
+        }
+        catch {
+            if (!response.headersSent)
+                response.writeHead(400).end('bad request');
+            else
+                response.destroy();
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        await new Promise((resolve) => server.close(() => resolve()));
+        throw new Error('Review file server did not bind a local TCP port');
+    }
+    port = address.port;
+    return {
+        port,
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => { if (error)
+                reject(error);
+            else
+                resolve(); });
+        }),
+    };
+};
+//# sourceMappingURL=review-files-server.js.map

package/dist/review-files-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-files-server.js","sourceRoot":"","sources":["../src/review-files-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,sBAAsB,EAA0B,MAAM,0BAA0B,CAAC;AAG1F;;;;;;;GAOG;AAEH,MAAM,aAAa,GAA2B;IAC5C,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,0BAA0B;IAClC,OAAO,EAAE,0BAA0B;IACnC,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,2BAA2B;IACnC,OAAO,EAAE,kBAAkB;IAC3B,cAAc,EAAE,2BAA2B;IAC3C,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;CACvB,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,IAK3B,EAAiB,EAAE;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAC9D,CAAC,OAAO;WACL,OAAO,KAAK,GAAG;WACf,OAAO,KAAK,IAAI;WAChB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;WACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;WACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC1B,CAAC,EAAE,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;QAC3B,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B;QAC7F,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,eAAe,EAAE,UAAU;QAC3B,wBAAwB,EAAE,SAAS;KACpC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;;QAC3C,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC,CAAC;AAIF,gHAAgH;AAChH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,KAAwB,EAA8B,EAAE;IACnG,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC;YACH,sBAAsB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAA0B,CAAC;YAC3C,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,WAAW;gBAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;;gBACjE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACpB,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBAAM,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/review-page-assets.d.ts

@@ -1,3 +1,3 @@
 export declare const REVIEW_PAGE_STYLES = "\n  :root{color-scheme:light;--paper:#f7f3ed;--panel:#fffdf8;--ink:#143b33;--text:#202523;--muted:#6a706c;--line:#d9d4ca;--signal:#ef6b22;--soft:#e8eee9;--shadow:0 18px 50px rgba(31,45,39,.08)}\n  *{box-sizing:border-box}html{background:var(--paper);scroll-behavior:smooth}body{margin:0;color:var(--text);font:15px/1.45 Inter,ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,\"Segoe UI\",sans-serif;background:radial-gradient(circle at 8% 16%,rgba(239,107,34,.08),transparent 24rem),var(--paper)}\n  button,textarea{font:inherit}button,a{touch-action:manipulation}.mast{padding:28px clamp(20px,4vw,64px);border-bottom:1px solid var(--line);background:rgba(247,243,237,.92);backdrop-filter:blur(12px);position:sticky;top:0;z-index:20;display:flex;align-items:flex-end;justify-content:space-between;gap:24px}.brand{display:flex;align-items:center;gap:14px}.brand-mark{width:42px;height:42px;border-radius:50%;background:var(--ink);color:var(--paper);display:grid;place-items:center;font:700 18px Georgia,serif}.mast h1,.run h2{font-family:Georgia,\"Times New Roman\",serif;color:var(--ink);margin:0;font-weight:500}.mast h1{font-size:clamp(28px,4vw,46px);line-height:1}.mast p{margin:6px 0 0;color:var(--muted)}.summary{display:flex;gap:8px;flex-wrap:wrap;justify-content:flex-end}.summary span,.count,.mark-chip,.edit-mode{border:1px solid var(--line);border-radius:999px;padding:7px 11px;background:var(--panel);white-space:nowrap}.mark-chip{text-transform:capitalize;color:var(--ink);border-color:#9fb5a8;background:var(--soft);font-size:12px}.shell{width:min(1760px,100%);margin:0 auto;padding:36px clamp(16px,3vw,48px) 100px}.empty{max-width:680px;margin:14vh auto;padding:48px;border:1px solid var(--line);border-radius:22px;background:var(--panel);box-shadow:var(--shadow)}.empty h2{font:500 38px/1.1 Georgia,serif;color:var(--ink);margin:0 0 12px}.run{margin-bottom:64px}.run-head{display:flex;justify-content:space-between;align-items:flex-start;gap:24px;padding:0 4px 20px;border-bottom:1px solid var(--ink)}.run h2{font-size:clamp(28px,3vw,42px);line-height:1.05;max-width:1080px}.run-head p{margin:8px 0 0;color:var(--muted);overflow-wrap:anywhere}.run-purpose{max-width:920px;color:var(--text)!important}.eyebrow{margin:0 0 7px!important;color:var(--signal)!important;letter-spacing:.08em;font-size:11px;font-weight:800}.site-nav{display:flex;gap:8px;overflow:auto;padding:14px 2px 0}.site-nav a{flex:0 0 auto;color:var(--ink);text-decoration:none;border:1px solid var(--line);border-radius:999px;padding:7px 12px;background:var(--panel);font-size:12px;font-weight:750}.group{padding-top:26px}.group>h3{font:500 22px Georgia,serif;color:var(--ink);margin:0 0 14px}.items{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,360px),1fr));gap:18px}.group--pages .items,.group--conversions .items{grid-template-columns:repeat(auto-fit,minmax(min(100%,580px),1fr))}.group--branch-pages .items{display:grid;grid-template-columns:1fr;gap:28px}.item{min-width:0;border:1px solid var(--line);border-radius:18px;background:rgba(255,253,248,.92);overflow:hidden;box-shadow:0 6px 24px rgba(31,45,39,.04);scroll-margin-top:130px}.item-head{min-height:80px;padding:18px 20px 14px;display:flex;justify-content:space-between;gap:14px;align-items:flex-start}.item-head h4{font:500 21px/1.15 Georgia,serif;color:var(--ink);margin:0}.item-head p{margin:6px 0 0;color:var(--muted);font-size:13px}.item-badges{display:flex;align-items:center;gap:7px;flex-wrap:wrap;justify-content:flex-end}.edit-mode{padding:5px 9px;font-size:11px;color:var(--muted)}.preview{position:relative;display:block;width:100%;background:#e7e4dc;border-block:1px solid var(--line)}.preview--image{aspect-ratio:16/10;overflow:hidden}.preview--image img{display:block;width:100%;height:100%;object-fit:contain}.preview--html{height:520px;min-height:280px;max-height:1100px;resize:vertical;overflow:auto}.preview--html iframe{display:block;width:100%;height:100%;border:0;background:white}.open{position:absolute;right:10px;top:10px;border:1px solid rgba(20,59,51,.28);border-radius:999px;padding:7px 12px;background:rgba(255,253,248,.93);color:var(--ink);text-decoration:none;font-size:12px;font-weight:700}.preview--layerdoc{min-height:250px;display:flex;flex-direction:column;align-items:center;justify-content:center;color:var(--muted);gap:8px}.preview--layerdoc strong{font:500 24px Georgia,serif;color:var(--ink)}.layerdoc-mark{font:500 38px Georgia,serif;color:var(--signal)}.published-page>p{padding:12px 16px;margin:0!important;background:#f3f0e9}.screen-sequence{padding:18px 0;border-block:1px solid var(--line);background:#f0eee8}.screen-sequence>p{padding:0 20px}.sequence-track{display:grid;grid-auto-flow:column;grid-auto-columns:minmax(min(82vw,420px),1fr);gap:14px;overflow-x:auto;padding:0 20px 8px;scroll-snap-type:x proximity}.screen{margin:0;border:1px solid var(--line);border-radius:13px;overflow:hidden;background:var(--panel);scroll-snap-align:start}.screen .preview{border-top:0}.screen figcaption{padding:13px 15px 15px}.screen h5{font:500 17px/1.2 Georgia,serif;margin:0;color:var(--ink)}.screen figcaption p{font-size:12px;color:var(--muted);margin:7px 0 0}.comparison{display:grid;grid-template-columns:1fr 1fr;gap:1px;background:var(--line);border-block:1px solid var(--line)}.comparison section{background:var(--panel);min-width:0}.comparison .eyebrow{padding:10px 14px;margin:0!important}.comparison .preview{border-bottom:0}.edit-receipt{padding:10px 18px;margin:0;color:var(--muted);font-size:12px;border-bottom:1px solid var(--line)}.diff-strip{display:flex;gap:10px;overflow-x:auto;padding:12px 18px;border-bottom:1px solid var(--line);background:#fff8ef}.diff-region{flex:0 0 min(340px,82vw);border-left:3px solid var(--signal);padding:8px 10px;background:var(--panel)}.diff-region strong{display:block;color:var(--ink);font-size:12px}.diff-region span{display:block;color:var(--muted);font-size:11px;margin-top:3px}.diff-region del,.diff-region ins{display:block;font-size:12px;text-decoration:none;margin-top:5px}.diff-region del{color:#8f3a2f}.diff-region ins{color:#1f6955}.controls{display:grid;grid-template-columns:minmax(0,1fr);gap:0}.feedback,.edit{padding:18px 20px}.edit{border-top:1px solid var(--line);background:#f3f4ef}.edit--disabled p,.edit-note{margin:0;color:var(--muted)}label{display:grid;gap:7px;color:var(--ink);font-weight:700;font-size:13px}textarea{width:100%;min-height:82px;resize:vertical;border:1px solid #bbb9b1;border-radius:10px;padding:11px 12px;background:#fff;color:var(--text);outline:none}textarea:focus{border-color:var(--ink);box-shadow:0 0 0 3px rgba(20,59,51,.12)}.mark-row,.save-row{display:flex;align-items:center;gap:8px}.mark-row{margin-bottom:14px;flex-wrap:wrap}.mark-row button,.save,.apply{border:1px solid var(--ink);border-radius:999px;background:transparent;color:var(--ink);padding:8px 13px;font-weight:750;cursor:pointer}.mark-row button.active,.save,.apply{background:var(--ink);color:white}.mark-row .clear{border-color:transparent;color:var(--muted)}.save-row{margin-top:11px;min-height:36px}.save,.apply{border-radius:9px;padding:9px 18px}.apply{background:var(--signal);border-color:var(--signal)}button:disabled{cursor:wait;opacity:.55}.status{font-size:12px;color:var(--muted)}.cost{margin:10px 0 0;color:var(--muted);font-size:12px}.cost strong{color:var(--signal)}.history{border-top:1px solid var(--line);padding:12px 20px}.history summary{cursor:pointer;color:var(--ink);font-weight:750}.history ol{margin:10px 0 0;padding-left:22px}.history li{padding:5px 0;color:var(--muted);font-size:12px}.history a{color:var(--ink)}code{font:12px ui-monospace,SFMono-Regular,Menlo,monospace;background:#e9e5dc;padding:2px 5px;border-radius:4px}\n  .prototype-panel{margin-top:24px;border:1px solid var(--line);border-radius:18px;background:rgba(255,253,248,.92);overflow:hidden;box-shadow:0 6px 24px rgba(31,45,39,.04)}.prototype-panel--empty,.prototype-copy{padding:20px;display:flex;align-items:flex-end;justify-content:space-between;gap:22px}.prototype-panel h3{font:500 24px Georgia,serif;color:var(--ink);margin:0}.prototype-panel p{margin:7px 0 0;color:var(--muted);max-width:880px}.prototype-action{display:flex;align-items:center;gap:10px;flex:0 0 auto}.prototype-action--disabled{font-size:12px}.prototype-panel>.preview--html{height:680px;border-bottom:0}.prototype-holdings{padding:24px;border-top:1px solid var(--line);background:#f3f0e9}.prototype-holdings>header{margin-bottom:16px}.holding-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,440px),1fr));gap:16px}.holding-card{min-width:0;background:var(--panel);border:1px solid var(--line);border-radius:15px;overflow:hidden}.holding-card .preview--html{height:360px}.holding-card .edit{border-top:0}\n  @media(max-width:760px){.mast{position:static;align-items:flex-start;flex-direction:column}.summary{justify-content:flex-start}.shell{padding-top:24px}.run-head,.prototype-panel--empty,.prototype-copy{flex-direction:column;align-items:flex-start}.comparison{grid-template-columns:1fr}.preview--html{height:400px}.item-head{min-height:0}.screen{flex-basis:86vw}}\n";
-export declare const REVIEW_PAGE_SCRIPT = "\n  const post = async (url, body) => {\n    const response = await fetch(url, {method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(body)});\n    const payload = await response.json().catch(() => ({error:'The server returned no detail.'}));\n    if (!response.ok) throw new Error(payload.error || 'The request failed.');\n    return payload;\n  };\n  for (const form of document.querySelectorAll('[data-feedback]')) {\n    const status = form.querySelector('.status');\n    const save = async () => {\n      status.textContent = 'Saving\u2026';\n      try {\n        await post('/api/feedback', {runId:form.dataset.run,itemId:form.dataset.item,note:form.elements.note.value,mark:form.dataset.mark || null});\n        status.textContent = 'Saved';\n      } catch (error) { status.textContent = error.message; }\n    };\n    form.addEventListener('submit', (event) => { event.preventDefault(); save(); });\n    for (const button of form.querySelectorAll('[data-mark]')) button.addEventListener('click', () => {\n      form.dataset.mark = button.dataset.mark;\n      for (const peer of form.querySelectorAll('[data-mark]')) {\n        const active = Boolean(peer.dataset.mark) && peer.dataset.mark === form.dataset.mark;\n        peer.classList.toggle('active', active); peer.setAttribute('aria-pressed', String(active));\n      }\n      save();\n    });\n  }\n  for (const form of document.querySelectorAll('[data-edit]')) form.addEventListener('submit', async (event) => {\n    event.preventDefault();\n    const button = form.querySelector('.apply'); const status = form.querySelector('.status');\n    button.disabled = true; status.textContent = form.dataset.mode === 'convert-then-edit' ? 'Converting, then editing\u2026' : 'Applying\u2026';\n    try {\n      await post('/api/edit', {runId:form.dataset.run,itemId:form.dataset.item,prompt:form.elements.prompt.value});\n      status.textContent = 'Applied'; window.location.reload();\n    } catch (error) { status.textContent = error.message; button.disabled = false; }\n  });\n  for (const form of document.querySelectorAll('[data-prototype]')) form.addEventListener('submit', async (event) => {\n    event.preventDefault();\n    const button = form.querySelector('.apply'); const status = form.querySelector('.status');\n    button.disabled = true; status.textContent = 'Building prototype\u2026';\n    try {\n      await post('/api/prototype', {runId:form.dataset.run});\n      status.textContent = 'Built'; window.location.reload();\n    } catch (error) { status.textContent = error.message; button.disabled = false; }\n  });\n  for (const form of document.querySelectorAll('[data-fill-gap]')) form.addEventListener('submit', async (event) => {\n    event.preventDefault();\n    const button = form.querySelector('.apply'); const status = form.querySelector('.status');\n    button.disabled = true; status.textContent = 'Generating, converting, then rebuilding\u2026';\n    try {\n      await post('/api/prototype/fill', {runId:form.dataset.run,holding:form.dataset.holding});\n      status.textContent = 'Filled'; window.location.reload();\n    } catch (error) { status.textContent = error.message; button.disabled = false; }\n  });\n";
+export declare const REVIEW_PAGE_SCRIPT = "\n  const token = document.querySelector('meta[name=\"12ui-review-token\"]').content;\n  const post = async (url, body) => {\n    const response = await fetch(url, {method:'POST',headers:{'content-type':'application/json','x-12ui-token':token},body:JSON.stringify(body)});\n    const payload = await response.json().catch(() => ({error:'The server returned no detail.'}));\n    if (!response.ok) throw new Error(payload.error || 'The request failed.');\n    return payload;\n  };\n  for (const form of document.querySelectorAll('[data-feedback]')) {\n    const status = form.querySelector('.status');\n    const save = async () => {\n      status.textContent = 'Saving\u2026';\n      try {\n        await post('/api/feedback', {runId:form.dataset.run,itemId:form.dataset.item,note:form.elements.note.value,mark:form.dataset.mark || null});\n        status.textContent = 'Saved';\n      } catch (error) { status.textContent = error.message; }\n    };\n    form.addEventListener('submit', (event) => { event.preventDefault(); save(); });\n    for (const button of form.querySelectorAll('[data-mark]')) button.addEventListener('click', () => {\n      form.dataset.mark = button.dataset.mark;\n      for (const peer of form.querySelectorAll('[data-mark]')) {\n        const active = Boolean(peer.dataset.mark) && peer.dataset.mark === form.dataset.mark;\n        peer.classList.toggle('active', active); peer.setAttribute('aria-pressed', String(active));\n      }\n      save();\n    });\n  }\n  for (const form of document.querySelectorAll('[data-edit]')) form.addEventListener('submit', async (event) => {\n    event.preventDefault();\n    const button = form.querySelector('.apply'); const status = form.querySelector('.status');\n    button.disabled = true; status.textContent = form.dataset.mode === 'convert-then-edit' ? 'Converting, then editing\u2026' : 'Applying\u2026';\n    try {\n      await post('/api/edit', {runId:form.dataset.run,itemId:form.dataset.item,prompt:form.elements.prompt.value});\n      status.textContent = 'Applied'; window.location.reload();\n    } catch (error) { status.textContent = error.message; button.disabled = false; }\n  });\n  for (const form of document.querySelectorAll('[data-prototype]')) form.addEventListener('submit', async (event) => {\n    event.preventDefault();\n    const button = form.querySelector('.apply'); const status = form.querySelector('.status');\n    button.disabled = true; status.textContent = 'Building prototype\u2026';\n    try {\n      await post('/api/prototype', {runId:form.dataset.run});\n      status.textContent = 'Built'; window.location.reload();\n    } catch (error) { status.textContent = error.message; button.disabled = false; }\n  });\n  for (const form of document.querySelectorAll('[data-fill-gap]')) form.addEventListener('submit', async (event) => {\n    event.preventDefault();\n    const button = form.querySelector('.apply'); const status = form.querySelector('.status');\n    button.disabled = true; status.textContent = 'Generating, converting, then rebuilding\u2026';\n    try {\n      await post('/api/prototype/fill', {runId:form.dataset.run,holding:form.dataset.holding});\n      status.textContent = 'Filled'; window.location.reload();\n    } catch (error) { status.textContent = error.message; button.disabled = false; }\n  });\n";
 //# sourceMappingURL=review-page-assets.d.ts.map

package/dist/review-page-assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-page-assets.d.ts","sourceRoot":"","sources":["../src/review-page-assets.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,m7RAM9B,CAAC;AAEF,eAAO,MAAM,kBAAkB,upGAqD9B,CAAC"}
+{"version":3,"file":"review-page-assets.d.ts","sourceRoot":"","sources":["../src/review-page-assets.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,kBAAkB,m7RAM9B,CAAC;AAEF,eAAO,MAAM,kBAAkB,iwGAsD9B,CAAC"}

package/dist/review-page-assets.js

@@ -1,3 +1,4 @@
+import { REVIEW_TOKEN_HEADER } from './review-server-guard.js';
 export const REVIEW_PAGE_STYLES = `
   :root{color-scheme:light;--paper:#f7f3ed;--panel:#fffdf8;--ink:#143b33;--text:#202523;--muted:#6a706c;--line:#d9d4ca;--signal:#ef6b22;--soft:#e8eee9;--shadow:0 18px 50px rgba(31,45,39,.08)}
   *{box-sizing:border-box}html{background:var(--paper);scroll-behavior:smooth}body{margin:0;color:var(--text);font:15px/1.45 Inter,ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:radial-gradient(circle at 8% 16%,rgba(239,107,34,.08),transparent 24rem),var(--paper)}
@@ -6,8 +7,9 @@ export const REVIEW_PAGE_STYLES = `
   @media(max-width:760px){.mast{position:static;align-items:flex-start;flex-direction:column}.summary{justify-content:flex-start}.shell{padding-top:24px}.run-head,.prototype-panel--empty,.prototype-copy{flex-direction:column;align-items:flex-start}.comparison{grid-template-columns:1fr}.preview--html{height:400px}.item-head{min-height:0}.screen{flex-basis:86vw}}
 `;
 export const REVIEW_PAGE_SCRIPT = `
+  const token = document.querySelector('meta[name="12ui-review-token"]').content;
   const post = async (url, body) => {
-    const response = await fetch(url, {method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(body)});
+    const response = await fetch(url, {method:'POST',headers:{'content-type':'application/json','${REVIEW_TOKEN_HEADER}':token},body:JSON.stringify(body)});
     const payload = await response.json().catch(() => ({error:'The server returned no detail.'}));
     if (!response.ok) throw new Error(payload.error || 'The request failed.');
     return payload;

package/dist/review-page-assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"review-page-assets.js","sourceRoot":"","sources":["../src/review-page-assets.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;CAMjC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDjC,CAAC"}
+{"version":3,"file":"review-page-assets.js","sourceRoot":"","sources":["../src/review-page-assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;CAMjC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;mGAGiE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDrH,CAAC"}

package/dist/review-page.d.ts

@@ -1,3 +1,10 @@
 import type { ReviewModel } from './review-types.js';
-export declare const renderReviewPage: (model: ReviewModel) => string;
+/**
+ * `token` is the serving session's secret (`review-server-guard.ts`): the page's actions send it with every POST.
+ * `files` is the origin the run files are served from (`review-files-server.ts`), never this page's own.
+ */
+export declare const renderReviewPage: (model: ReviewModel, session: {
+    token: string;
+    files: string;
+}) => string;
 //# sourceMappingURL=review-page.d.ts.map

package/dist/review-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-page.d.ts","sourceRoot":"","sources":["../src/review-page.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAIV,WAAW,EAEZ,MAAM,mBAAmB,CAAC;AAyQ3B,eAAO,MAAM,gBAAgB,GAAI,OAAO,WAAW,KAAG,MAoBrD,CAAC"}
+{"version":3,"file":"review-page.d.ts","sourceRoot":"","sources":["../src/review-page.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAIV,WAAW,EAEZ,MAAM,mBAAmB,CAAC;AAiR3B;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,WAAW,EAAE,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KAAG,MAoBhG,CAAC"}