@alexkroman1/aai-cli 5.14.0 → 6.2.0

package/dist/worker-bundler-CIdDhZ0c.mjs

@@ -0,0 +1,398 @@
+#!/usr/bin/env node
+import { i as errorCode } from "./_utils-B8QmtFhK.mjs";
+import { n as withPreservedNodeEnv } from "./_vite-env-BNveawd1.mjs";
+import path from "node:path";
+import fs from "node:fs/promises";
+import { build } from "vite";
+import { BaseBuilder, applySwcTransform, detectWorkflowPatterns, shouldTransformFile } from "@workflow/builders";
+//#region workflow-bundler.ts
+/**
+* Workflow bundling — turning a project's `workflows/` directory into the two
+* small artifacts a guest needs to run durable workflows.
+*
+* Public (no `_` prefix) for the same reason as `worker-bundler.ts`: the studio
+* builds its workspaces through this too, so a workflow published from the
+* browser comes out of the same pass as one from `aai build`.
+*
+* @internal — build hook for aai-server/the studio; not a supported public API
+* and not covered by semver.
+*
+* ## Why this exists at all
+*
+* The Workflow Development Kit's own integrations (Next, Nitro, SvelteKit) build
+* workflow routes while building the SERVER, by scanning `workflows/` and
+* emitting handler files. That model does not fit this platform: the guest image
+* is baked once and then serves MANY tenants' agents, each arriving over
+* `bundle/load` at runtime. There is no `workflows/` directory in existence when
+* the harness is built. So the transform has to happen per tenant at deploy
+* time — here — and the guest receives the result as data.
+*
+* ## The two artifacts, and why they are small
+*
+* A default `workflow build` emits a 3.7 MB flow bundle and a 12 MB step bundle,
+* because each one inlines the whole WDK runtime. Neither could ride the guest's
+* single-ESM-string delivery. Two settings fix that, and both are load-bearing:
+*
+* - **`externalPackages: ["workflow", …]`** — the WDK is resolved from the
+*   guest's BAKED image instead of being inlined. Step bundle: 12 MB → ~7 KB.
+* - **`bundleFinalOutput: false`** — skips wrapping the workflow-mode code in a
+*   runtime host, which is exactly what `workflowEntrypoint(code)` supplies
+*   itself at the other end. Flow bundle: 3.7 MB → ~69 KB.
+*
+* So `workflowCode` is passed to `workflowEntrypoint()` in the guest and
+* `stepCode` is evaluated there to register its step functions.
+*
+* ## The THIRD transform, which is the agent bundle's
+*
+* Those two are what the queue runs. The agent bundle needs a third —
+* `applySwcTransform(…, "client")`, wired in as {@link workflowClientPlugin} —
+* and without it the whole mechanism is inert: `ctx.workflows.start` reads the
+* `workflowId` the compiler attaches to a directive body, and Vite bundling
+* `workflows/research.ts` the ordinary way attaches nothing. The symptom is
+* `MISSING_WORKFLOW_ID_MESSAGE` at the first `start()` — an agent that builds,
+* deploys, boots and answers the phone, and cannot start a run.
+*
+* The plugin transforms EXACTLY the files the builder scanned (`inputFiles`),
+* not "every file with a directive". Same list, same `moduleSpecifierRoot`,
+* therefore the same ids by construction — a body outside `workflows/` cannot
+* acquire an id that no flow bundle registered, which would trade a clear
+* failure at `start()` for a run that enqueues and then fails at replay.
+*
+* ## Config details that are not optional
+*
+* Each of these cost real time to find, and none fails in a way that names
+* itself:
+*
+* - `dirs` must carry the `./` prefix. A bare `"workflows"` crashes inside
+*   enhanced-resolve with `Cannot read properties of undefined (reading
+*   'length')` from `join(undefined, …)`, nowhere near the cause.
+* - Every bundle path must be ABSOLUTE, for the same reason.
+* - `projectRoot` and `moduleSpecifierRoot` must be set explicitly; they do not
+*   default to `workingDir` on the path this takes.
+* - `keepInterimBundleContext` must stay off — it leaves an esbuild watch context
+*   alive, so a one-shot build never exits.
+*/
+/**
+* The directory a project's `"use workflow"` bodies live in.
+*
+* The WDK builder's convention, not ours, and it is why a workflow body cannot
+* live in `agent.ts`: only files under here are transformed. A body outside it
+* runs inline, once, with no durability and nothing reporting that.
+*/
+const WORKFLOWS_DIR = "workflows";
+/**
+* Packages left OUT of both bundles, resolved from the guest's baked image.
+*
+* `workflow` alone would nearly do it — its subpaths are what user code imports —
+* but the `@workflow/*` internals are what the transform's own emitted imports
+* reach for, and inlining those is most of the 12 MB.
+*/
+const WDK_EXTERNAL = [
+	"workflow",
+	"@workflow/core",
+	"@workflow/errors",
+	"@workflow/utils",
+	"@workflow/world"
+];
+/** Scratch directory for the builder's file output, under the CLI's own dot-dir. */
+const SCRATCH_REL = path.join(".aai", "workflow-build");
+/**
+* What makes a CJS dependency survive into the ESM step bundle.
+*
+* esbuild cannot statically rewrite `require("node:assert")` inside a bundled
+* CommonJS module, so it emits a `__require` shim — and that shim's fallback
+* THROWS: `Dynamic require of "node:assert" is not supported`. A step bundles
+* everything it imports and npm is full of CJS, so any step reaching a package
+* with a CJS dependency anywhere in its graph failed AT MODULE LOAD, before a
+* single line of the step ran.
+*
+* That is not a hypothetical, and the way it presents is the argument for
+* fixing it here. `research-workflow` imports `webSearch` from
+* `@alexkroman1/aai/tools`, which reaches `host/ssrf.ts`, which imports
+* **undici** — 118 dynamic requires, all of them `node:` builtins. `aai dev`
+* then never listened at all: the message named a Node builtin the author
+* never mentions, nothing named the package or the import that pulled it, and
+* because the step bundle is loaded before the server binds there was no
+* server to ask. It also does not reproduce in-tree, where `@dev/source`
+* resolves the SDK to TypeScript — only against the published `dist` — so
+* every gate short of the e2e suite was green.
+*
+* The shim itself is the fix's whole mechanism: esbuild writes
+* `typeof require !== "undefined" ? require : <thrower>`, so a real `require`
+* in scope is USED. This defines one from `import.meta.url` and is prepended,
+* which puts it ahead of the `var __require = …` initializer that reads it.
+* The flow bundle deliberately gets none — it is compiled in a `node:vm`
+* Script, where `import.meta` does not exist.
+*/
+const STEP_REQUIRE_SHIM = [
+	"import { createRequire as __aaiCreateRequire } from \"node:module\";",
+	"const require = __aaiCreateRequire(import.meta.url);",
+	""
+].join("\n");
+/**
+* The builder, with the config gotchas above applied once.
+*
+* `BaseBuilder` is abstract over `build()`, so a subclass is the supported way to
+* choose which bundles to emit and how — the WDK's own framework integrations do
+* the same.
+*/
+var AaiWorkflowBuilder = class extends BaseBuilder {
+	/**
+	* Where `build()` leaves its result.
+	*
+	* `BaseBuilder.build()` is typed `Promise<void>`, so a subclass cannot return
+	* the artifacts from it — and parameter properties are unavailable under this
+	* repo's `erasableSyntaxOnly`, so the fields are declared the long way too.
+	*/
+	output;
+	outDir;
+	constructor(cwd, outDir) {
+		super({
+			buildTarget: "standalone",
+			dirs: [`./${WORKFLOWS_DIR}`],
+			workingDir: cwd,
+			projectRoot: cwd,
+			moduleSpecifierRoot: cwd,
+			externalPackages: [...WDK_EXTERNAL],
+			stepsBundlePath: path.join(outDir, "step.mjs"),
+			workflowsBundlePath: path.join(outDir, "flow.mjs"),
+			webhookBundlePath: path.join(outDir, "webhook.mjs"),
+			suppressCreateWorkflowsBundleLogs: true,
+			suppressCreateWebhookBundleLogs: true,
+			suppressCreateManifestLogs: true
+		});
+		this.outDir = outDir;
+	}
+	async build() {
+		const inputFiles = await this.getInputFiles();
+		const flowFile = path.join(this.outDir, "flow.mjs");
+		const stepFile = path.join(this.outDir, "step.mjs");
+		const { manifest } = await this.createWorkflowsBundle({
+			inputFiles,
+			format: "esm",
+			outfile: flowFile,
+			bundleFinalOutput: false
+		});
+		await this.createStepsBundle({
+			inputFiles,
+			format: "esm",
+			outfile: stepFile
+		});
+		const [workflowCode, stepCode] = await Promise.all([fs.readFile(flowFile, "utf-8"), fs.readFile(stepFile, "utf-8")]);
+		this.output = {
+			workflowCode,
+			stepCode: STEP_REQUIRE_SHIM + stepCode,
+			manifest,
+			inputFiles
+		};
+	}
+};
+/**
+* Attach the compiler's `workflowId`/`stepId` to the agent bundle's copy of
+* each directive body — the third transform, see the module doc.
+*
+* `enforce: "pre"` so it sees the file before Vite's own TypeScript pass: the
+* swc transform reads types itself (it is given the filename to infer syntax),
+* and its output is plain JS that the later pass leaves alone.
+*
+* @internal
+*/
+function workflowClientPlugin(cwd, inputFiles) {
+	const scanned = new Set(inputFiles.map((file) => path.resolve(cwd, file)));
+	return {
+		name: "aai:workflow-client",
+		enforce: "pre",
+		async transform(code, id) {
+			const file = path.resolve(id.split("?")[0] ?? id);
+			if (!scanned.has(file)) return;
+			if (!shouldTransformFile(file, detectWorkflowPatterns(code))) return;
+			const { code: transformed } = await applySwcTransform(path.relative(cwd, file), code, "client", file, cwd, cwd);
+			return {
+				code: transformed,
+				map: null
+			};
+		}
+	};
+}
+/**
+* Build a project's workflows, or resolve `undefined` when it declares none.
+*
+* `undefined` rather than empty strings, because "this project has no workflows"
+* is the common case — every voice agent that never reaches for one — and the
+* guest must be able to tell it apart from "the build produced nothing", which
+* would be a bug.
+*
+* @internal
+*/
+async function buildWorkflows(cwd) {
+	if (!await hasWorkflowsDir(cwd)) return;
+	const outDir = path.join(cwd, SCRATCH_REL);
+	await fs.mkdir(outDir, { recursive: true });
+	try {
+		const builder = new AaiWorkflowBuilder(cwd, outDir);
+		await builder.build();
+		const built = builder.output;
+		if (!built) return;
+		return built.workflowCode.trim() === "" ? void 0 : built;
+	} finally {
+		await fs.rm(outDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+}
+/** Does this project have a `workflows/` directory with anything in it? */
+async function hasWorkflowsDir(cwd) {
+	try {
+		return (await fs.readdir(path.join(cwd, WORKFLOWS_DIR))).some((name) => /\.(ts|tsx|js|jsx|mjs)$/.test(name));
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region worker-bundler.ts
+/**
+* Generated wrapper entry, written under `.aai/` for the duration of the
+* build (the CLI's own scratch dir — dot-paths are ignored by the dev
+* watcher, and the studio's workspace materialization never writes there).
+*/
+const WRAPPER_ENTRY_REL = path.join(".aai", "worker-entry.ts");
+/** Extensions a tool module may be authored in (mirrors the SDK's registry). */
+const TOOL_MODULE_EXT_RE = /\.(?:m?ts|tsx)$/;
+/** A co-located spec is not a tool. */
+const TOOL_SPEC_RE = /\.(?:test|spec)\.[^.]+$/;
+/**
+* The project's `tools/` directory, as file names relative to it.
+*
+* **This is the whole of "discovery", and it happens HERE because the guest has
+* no filesystem.** A sandbox is handed one ESM string, so the only place a
+* directory can be turned into modules is where the bundle is assembled — the
+* same lowering eve does (`readdir` → static import list, which the bundler then
+* follows). The names are validated by `toolRegistry` at bundle-evaluation time
+* rather than here, so one implementation owns the rules.
+*
+* Sorted, so the emitted entry is byte-stable for a given directory: an entry
+* that reordered per readdir would change the bundle hash for no reason.
+*/
+async function discoverToolFiles(cwd) {
+	const root = path.join(cwd, "tools");
+	let entries;
+	try {
+		entries = await fs.readdir(root, {
+			withFileTypes: true,
+			recursive: true
+		});
+	} catch (err) {
+		if (errorCode(err) === "ENOENT") return [];
+		throw err;
+	}
+	return entries.filter((e) => e.isFile() && TOOL_MODULE_EXT_RE.test(e.name) && !TOOL_SPEC_RE.test(e.name)).map((e) => path.relative(root, path.join(e.parentPath, e.name)).split(path.sep).join("/")).sort();
+}
+/** The prose slot: one file, beside `agent.ts`, named by convention. */
+const SYSTEM_PROMPT_FILE = "system-prompt.md";
+/**
+* Whether the project keeps its system prompt in a file.
+*
+* The other half of "a file beside `agent.ts` can BE the thing", and it happens
+* here for the same reason `discoverToolFiles` does — the guest has no
+* filesystem, so the read belongs where the bundle is assembled. What the file
+* MEANS is `withSystemPrompt`'s to decide (the author may have imported and
+* composed it, in which case discovery must not apply it twice); this only
+* answers whether there is one.
+*/
+async function hasSystemPromptFile(cwd) {
+	const nested = path.join(cwd, "system-prompt");
+	if ((await fs.stat(nested).catch(() => void 0))?.isDirectory() === true) throw new Error(`${nested} is a directory. A system prompt is ONE file — rename it to ${SYSTEM_PROMPT_FILE}, or import the pieces yourself and compose them into \`systemPrompt\`. There is deliberately no concatenation order for a directory.`);
+	try {
+		return (await fs.stat(path.join(cwd, SYSTEM_PROMPT_FILE))).isFile();
+	} catch (err) {
+		if (errorCode(err) === "ENOENT") return false;
+		throw err;
+	}
+}
+function wrapperEntrySource(runtime, workflows, toolFiles, systemPromptFile) {
+	const toolImports = toolFiles.map((file, i) => `import * as __aaiTool${i} from "../tools/${file}";`).join("\n");
+	const toolEntries = toolFiles.map((file, i) => `  ${JSON.stringify(`tools/${file}`)}: __aaiTool${i},`).join("\n");
+	return `import def from "../agent.ts";
+import { agentToolsToSchemas, toAgentConfig, toolRegistry, withSystemPrompt, withTools } from "@alexkroman1/aai/manifest";
+${runtime ? `import { createRuntime } from "@alexkroman1/aai/runtime";` : ""}
+${systemPromptFile ? `import __aaiSystemPrompt from "../${SYSTEM_PROMPT_FILE}?raw";` : ""}
+${toolImports}
+// A tool's name is its file name. The map is built here rather than written in
+// agent.ts, so a file that exists is a tool the model can call — there is no
+// registration step to forget.
+//
+// \`system-prompt.md\` arrives the same way, and the \`?raw\` lives HERE rather
+// than in the author's own \`agent.ts\`: it is a Vite convention, and the whole
+// point of generating this entry is that a bundler feature never has to appear
+// in user-authored space.
+const __aaiAgent = ${systemPromptFile ? "withSystemPrompt(" : ""}withTools(
+  def,
+  toolRegistry({
+${toolEntries}
+  }),
+)${systemPromptFile ? ", __aaiSystemPrompt)" : ""};
+export default __aaiAgent;
+export const __aaiConfig = {
+  ...toAgentConfig(__aaiAgent),
+  toolSchemas: agentToolsToSchemas(__aaiAgent.tools ?? {}),
+};
+${runtime ? `export const __aaiCreateRuntime = (opts: Record<string, unknown>) =>
+  createRuntime({ ...opts, agent: __aaiAgent });
+` : ""}${workflows ? `// The compiled workflow surface, carried as DATA. \`__aaiWorkflowCode\` goes to
+// \`workflowEntrypoint(code)\` and \`__aaiStepCode\` is evaluated by the guest so its
+// \`registerStepFunction\` calls run. Strings rather than modules because the guest
+// receives exactly one ESM string and never sees this project's filesystem.
+export const __aaiWorkflowCode = ${JSON.stringify(workflows.workflowCode)};
+export const __aaiStepCode = ${JSON.stringify(workflows.stepCode)};
+` : ""}`;
+}
+/**
+* Bundle agent.ts into a single ESM string for the sandbox worker.
+*
+* Zod is bundled in — zod 4's `Function()` usage is wrapped in try/catch
+* and gracefully degrades in restricted environments like Deno.
+*
+* @internal — build hook for aai-server/the studio; not a supported public
+* API and not covered by semver.
+*/
+async function buildWorker(cwd, opts = {}) {
+	const wrapperPath = path.join(cwd, WRAPPER_ENTRY_REL);
+	await fs.mkdir(path.dirname(wrapperPath), { recursive: true });
+	await fs.writeFile(wrapperPath, wrapperEntrySource(opts.runtime !== false, opts.workflows, await discoverToolFiles(cwd), await hasSystemPromptFile(cwd)), "utf-8");
+	const plugins = [...opts.plugins ?? [], ...opts.workflows ? [workflowClientPlugin(cwd, opts.workflows.inputFiles)] : []];
+	let result;
+	try {
+		result = await withPreservedNodeEnv(() => build({
+			root: cwd,
+			logLevel: "silent",
+			...opts.configFile === false && { configFile: false },
+			...plugins.length > 0 && { plugins },
+			ssr: { noExternal: true },
+			build: {
+				ssr: true,
+				lib: {
+					entry: wrapperPath,
+					formats: ["es"],
+					fileName: "worker"
+				},
+				target: "node20",
+				minify: opts.minify ? "oxc" : false,
+				write: false,
+				rollupOptions: { output: {
+					entryFileNames: "[name].js",
+					codeSplitting: false
+				} }
+			}
+		}));
+	} finally {
+		await fs.rm(wrapperPath, { force: true }).catch(() => void 0);
+	}
+	const output = Array.isArray(result) ? result[0] : result;
+	if (!output) throw new Error("Vite produced no output for agent.ts");
+	const chunk = output.output.find((o) => o.type === "chunk" && o.isEntry);
+	if (!chunk) throw new Error("Vite produced no entry chunk for agent.ts");
+	return chunk.code;
+}
+//#endregion
+export { buildWorkflows as n, buildWorker as t };

package/dist/worker-bundler.d.ts

@@ -1,4 +1,5 @@
 import { type PluginOption } from "vite";
+import { type WorkflowBundleOutput } from "./workflow-bundler.ts";
 /**
  * Options for worker bundling.
  *
@@ -24,6 +25,19 @@ export type BuildWorkerOptions = {
      * rebuild would turn the watch loop from sub-second into multi-second.
      */
     runtime?: boolean;
+    /**
+     * The project's compiled workflows, when it declares any.
+     *
+     * Embedded in the worker as two string exports rather than shipped as extra
+     * files, because the guest's `bundle/load` contract is ONE ESM string. See
+     * `wrapperEntrySource`.
+     *
+     * It also switches on the client transform (`workflowClientPlugin`), which is
+     * what puts a `workflowId` on the agent's own copy of each body. Passing the
+     * strings without it produces a bundle that serves every workflow route and
+     * cannot start a run.
+     */
+    workflows?: WorkflowBundleOutput | undefined;
 };
 /**
  * Bundle agent.ts into a single ESM string for the sandbox worker.

package/dist/worker-bundler.mjs

@@ -1,110 +1,3 @@
 #!/usr/bin/env node
-import { t as withPreservedNodeEnv } from "./_vite-env-Dg_QlVv0.mjs";
-import path from "node:path";
-import fs from "node:fs/promises";
-import { build } from "vite";
-//#region worker-bundler.ts
-/**
-* Worker bundling — the one implementation of "turn an `agent.ts` into the
-* ESM the guest sandbox loads".
-*
-* Public (no `_` prefix) for the same reason as `client-bundler.ts`: the
-* platform's browser studio builds its workspaces through this function, so a
-* worker published from the browser comes out of the same Vite/Rollup pass as
-* one from `aai deploy`.
-*
-* @internal — build hook for aai-server/the studio; not a supported public
-* API and not covered by semver. The lack of a `_` prefix is packaging (the
-* subpath must be importable cross-package), not an invitation: user code
-* should never import from `@alexkroman1/aai-cli`.
-*
-* Every worker is built through a generated wrapper entry that re-exports the
-* agent *and* its extracted config as `__aaiConfig` (via the dependency-free
-* `@alexkroman1/aai/manifest` helpers, bundled in). The guest harness returns
-* that export from `bundle/load`, which is how the platform obtains an
-* agent's config without ever evaluating tenant code on the host — the
-* `POST /deploy` route and the studio's sandbox inspection both rely on it.
-*
-* **The worker ships its own runtime.** Deploy builds also export
-* `__aaiCreateRuntime` — a factory over the *user's installed* SDK's
-* `createRuntime`, bundled in alongside the provider SDKs. The guest harness
-* builds the session runtime through it, so a deployed agent runs exactly the
-* runtime version it was built and tested against (identical to `aai dev`),
-* instead of whatever SDK the platform's harness image was baked with. The
-* harness↔bundle contract is deliberately tiny: the factory takes
-* `{ env, db?, runCode? }` and returns `{ startSession, shutdown }`.
-*
-* What the studio supplies via options, because a workspace is not a project:
-*
-* - **`configFile: false`.** Workspace files are untrusted and a Vite config
-*   is executable host code.
-* - **`plugins`.** The studio adds its import allowlist; without it, Vite
-*   would happily resolve any package in the server's `node_modules`.
-*/
-/**
-* Generated wrapper entry, written under `.aai/` for the duration of the
-* build (the CLI's own scratch dir — dot-paths are ignored by the dev
-* watcher, and the studio's workspace materialization never writes there).
-*/
-const WRAPPER_ENTRY_REL = path.join(".aai", "worker-entry.ts");
-function wrapperEntrySource(runtime) {
-	return `import def from "../agent.ts";
-import { agentToolsToSchemas, toAgentConfig } from "@alexkroman1/aai/manifest";
-${runtime ? `import { createRuntime } from "@alexkroman1/aai/runtime";` : ""}
-export default def;
-export const __aaiConfig = {
-  ...toAgentConfig(def),
-  toolSchemas: agentToolsToSchemas(def.tools ?? {}),
-};
-${runtime ? `export const __aaiCreateRuntime = (opts: Record<string, unknown>) =>
-  createRuntime({ ...opts, agent: def });
-` : ""}`;
-}
-/**
-* Bundle agent.ts into a single ESM string for the sandbox worker.
-*
-* Zod is bundled in — zod 4's `Function()` usage is wrapped in try/catch
-* and gracefully degrades in restricted environments like Deno.
-*
-* @internal — build hook for aai-server/the studio; not a supported public
-* API and not covered by semver.
-*/
-async function buildWorker(cwd, opts = {}) {
-	const wrapperPath = path.join(cwd, WRAPPER_ENTRY_REL);
-	await fs.mkdir(path.dirname(wrapperPath), { recursive: true });
-	await fs.writeFile(wrapperPath, wrapperEntrySource(opts.runtime !== false), "utf-8");
-	let result;
-	try {
-		result = await withPreservedNodeEnv(() => build({
-			root: cwd,
-			logLevel: "silent",
-			...opts.configFile === false && { configFile: false },
-			...opts.plugins && { plugins: opts.plugins },
-			ssr: { noExternal: true },
-			build: {
-				ssr: true,
-				lib: {
-					entry: wrapperPath,
-					formats: ["es"],
-					fileName: "worker"
-				},
-				target: "node20",
-				minify: opts.minify ? "oxc" : false,
-				write: false,
-				rollupOptions: { output: {
-					entryFileNames: "[name].js",
-					codeSplitting: false
-				} }
-			}
-		}));
-	} finally {
-		await fs.rm(wrapperPath, { force: true }).catch(() => void 0);
-	}
-	const output = Array.isArray(result) ? result[0] : result;
-	if (!output) throw new Error("Vite produced no output for agent.ts");
-	const chunk = output.output.find((o) => o.type === "chunk" && o.isEntry);
-	if (!chunk) throw new Error("Vite produced no entry chunk for agent.ts");
-	return chunk.code;
-}
-//#endregion
+import { t as buildWorker } from "./worker-bundler-CIdDhZ0c.mjs";
 export { buildWorker };

package/dist/workflow-B-O97AqI.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+import { a as ok, n as fail } from "./_output-CKkmWs7i.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { n as getServerInfo } from "./_agent-vGW5SBnX.mjs";
+import { errorMessage, omitUndefined } from "@alexkroman1/aai/utils";
+import { createWorkflowApiClient } from "@alexkroman1/aai/workflow-api";
+//#region workflow.ts
+/** Runs listed when the caller names no limit — a terminal is not a dashboard. */
+const DEFAULT_RUN_LIMIT = 20;
+/**
+* A client for the agent's workflow API, plus the bearer when one was given.
+*
+* `getServerInfo` is what turns "this directory" into an origin and a published
+* slug, and it already refuses a project that has never been deployed with the
+* sentence naming `aai publish`. The client is handed the AGENT's base URL and
+* appends the route prefix itself, so the `/workflows` literal is not spelled
+* here — it is the same constant the server matches on.
+*
+* `serverUrl` is joined as-is: `resolveServerUrl` is the single producer of
+* every origin that reaches here and strips trailing slashes once, at
+* resolution time, precisely so join sites do not each carry a copy. The copy
+* this used to hold also DISAGREED with it — `/\/$/` takes one slash where the
+* upstream `/\/+$/` takes all — so the two would have differed on the only
+* input either was written for.
+*/
+async function target(cwd, opts) {
+	const { serverUrl, slug } = await getServerInfo(cwd, opts.server);
+	return {
+		api: createWorkflowApiClient({
+			baseUrl: `${serverUrl}/${slug}`,
+			...omitUndefined({ token: opts.token })
+		}),
+		slug
+	};
+}
+/**
+* Run one call, turning a rejection into a `CommandResult`.
+*
+* The client throws with the AGENT'S own sentence — an unknown workflow names
+* the declared ones, a 503 says the sandbox is still booting — and that text is
+* the whole diagnostic, so it is surfaced rather than replaced with a status
+* code. `errorMessage` rather than `instanceof Error`, because a rejection that
+* is message-bearing without being an `Error` would otherwise print as
+* `[object Object]`.
+*/
+async function attempt(call) {
+	try {
+		return {
+			ok: true,
+			value: await call()
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: errorMessage(err)
+		};
+	}
+}
+/** `aai workflow list` — what this agent declares. */
+async function executeWorkflowList(cwd, opts) {
+	const { api, slug } = await target(cwd, opts);
+	const res = await attempt(() => api.list());
+	if (!res.ok) return fail("workflow_list_failed", res.error, HINT_BROKER);
+	const workflows = res.value;
+	if (workflows.length === 0) log.info(`${slug} declares no workflows`);
+	else for (const w of workflows) log.info(`${w.name}${w.description ? ` — ${w.description}` : ""}`);
+	return ok({ workflows });
+}
+/**
+* `aai workflow runs <name>` — recent runs, newest first.
+*
+* `recent` rather than `find`, so the query carries no `key`: a terminal has no
+* correlation key to ask about, and most runs carry none.
+*/
+async function executeWorkflowRuns(cwd, workflow, opts) {
+	const { api } = await target(cwd, opts);
+	const res = await attempt(() => api.recent(workflow, { limit: opts.limit ?? DEFAULT_RUN_LIMIT }));
+	if (!res.ok) return fail("workflow_runs_failed", res.error, HINT_BROKER);
+	const runs = res.value;
+	if (runs.length === 0) log.info(`No runs of ${workflow} yet`);
+	for (const run of runs) log.info(formatRun(run));
+	return ok({ runs });
+}
+/** One run on one line — the id first, because it is what every other verb takes. */
+function formatRun(run) {
+	const parts = [run.runId, run.status];
+	if (run.key !== void 0) parts.push(`key=${run.key}`);
+	if (run.status === "failed") parts.push(run.error);
+	return parts.join("  ");
+}
+/** `aai workflow show <runId>` — one run in full, including its output. */
+async function executeWorkflowShow(cwd, runId, opts) {
+	const { api } = await target(cwd, opts);
+	const res = await attempt(() => api.get(runId));
+	if (!res.ok) return fail("workflow_show_failed", res.error, HINT_BROKER);
+	if (res.value === void 0) return fail("workflow_show_failed", `No run ${runId}`, HINT_BROKER);
+	const run = res.value;
+	log.info(formatRun(run));
+	if (run.status === "completed") log.info(JSON.stringify(run.output, null, 2));
+	return ok({ run });
+}
+/** `aai workflow cancel <runId>` — stop a live run. */
+async function executeWorkflowCancel(cwd, runId, opts) {
+	const { api } = await target(cwd, opts);
+	const res = await attempt(() => api.cancel(runId));
+	if (!res.ok) return fail("workflow_cancel_failed", res.error, HINT_BROKER);
+	const cancelled = res.value;
+	log.info(cancelled ? `Cancelled ${runId}` : `${runId} had already finished`);
+	return ok({
+		runId,
+		cancelled
+	});
+}
+/**
+* The hint every failure here carries.
+*
+* Three causes dominate and they look similar from a terminal: the agent
+* declares no workflows (404 from its own API), its sandbox is still booting
+* (503 from the broker), or its operator closed the surface (401). Naming all
+* three is cheap and cannot be wrong — the same reasoning
+* `WORKFLOWS_UNAVAILABLE_MESSAGE` follows.
+*/
+const HINT_BROKER = "The agent may declare no workflows, or its sandbox may still be starting — try again shortly. Pass --token if the agent sets AAI_WORKFLOW_API_TOKEN.";
+//#endregion
+export { executeWorkflowCancel, executeWorkflowList, executeWorkflowRuns, executeWorkflowShow };