@autohq/cli 0.1.302 → 0.1.304

package/dist/agent-bridge.js

@@ -23399,7 +23399,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.302",
+  version: "0.1.304",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -26769,407 +26769,6 @@ function isSetupCacheTtl(value2) {
   return /^[1-9][0-9]*(s|m|h|d)$/.test(value2);
 }
 
-// ../../packages/schemas/src/live-events.ts
-var LiveEntityEventEnvelopeSchema = external_exports.object({
-  // Replay cursor for this frame; the SSE `id:` mirrors it so reconnects resume
-  // from `sequence > cursor`.
-  sequence: external_exports.number().int().nonnegative(),
-  eventKey: external_exports.string().min(1),
-  // The event's `subjectKind`, surfaced as `entity` for client-side dispatch.
-  entity: external_exports.string().min(1),
-  subjectId: external_exports.string().min(1),
-  payload: JsonValueSchema2,
-  occurredAt: external_exports.string().min(1)
-});
-
-// ../../packages/schemas/src/mcp.ts
-var McpToolCallMessageSchema = external_exports.object({
-  method: external_exports.literal("tools/call"),
-  params: external_exports.object({
-    name: external_exports.string().trim().min(1)
-  })
-});
-var McpJsonRpcMessageSchema = external_exports.object({
-  method: external_exports.string().optional()
-}).passthrough();
-var McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
-
-// ../../packages/schemas/src/pricing.ts
-var RATE_CARD_2026_06_23 = {
-  version: "2026-06-23",
-  effectiveAt: "2026-06-23T00:00:00.000Z",
-  models: {
-    "claude-opus-4-8": opusTier(),
-    "claude-opus-4-7": opusTier(),
-    "claude-opus-4-6": opusTier(),
-    "claude-sonnet-4-6": tier(3, 15),
-    "claude-haiku-4-5": tier(1, 5),
-    "claude-haiku-4-5-20251001": tier(1, 5),
-    "claude-fable-5": tier(10, 50),
-    // OpenAI gpt-5.3-codex, standard tier: input $1.75/Mtok, cached input
-    // $0.175/Mtok, output $14.00/Mtok. Source (verified 2026-06-23):
-    // https://developers.openai.com/api/docs/models/gpt-5.3-codex and
-    // https://developers.openai.com/api/docs/pricing (priority tier is 2x; we
-    // bill standard).
-    "gpt-5.3-codex": openAiTier({
-      input: 1.75,
-      cachedInput: 0.175,
-      output: 14
-    })
-  }
-};
-var PRICING_RATE_CARDS = {
-  [RATE_CARD_2026_06_23.version]: RATE_CARD_2026_06_23
-};
-var CURRENT_PRICING_VERSION = RATE_CARD_2026_06_23.version;
-function tier(inputUsdPerMtok, outputUsdPerMtok) {
-  return {
-    inputUsdPerMtok,
-    outputUsdPerMtok,
-    cacheWrite5mUsdPerMtok: inputUsdPerMtok * 1.25,
-    cacheReadUsdPerMtok: inputUsdPerMtok * 0.1
-  };
-}
-function opusTier() {
-  return tier(5, 25);
-}
-function openAiTier(rates) {
-  return {
-    inputUsdPerMtok: rates.input,
-    outputUsdPerMtok: rates.output,
-    cacheWrite5mUsdPerMtok: rates.input,
-    cacheReadUsdPerMtok: rates.cachedInput
-  };
-}
-
-// ../../packages/schemas/src/project-service-accounts.ts
-var ProjectServiceAccountSchema = external_exports.object({
-  id: ServiceAccountIdSchema,
-  organizationId: OrganizationIdSchema,
-  projectId: ProjectIdSchema,
-  name: ResourceNameSchema,
-  scopes: external_exports.array(AuthScopeSchema),
-  createdAt: external_exports.string().datetime()
-});
-var ProjectServiceAccountCreateRequestSchema = external_exports.object({
-  name: ResourceNameSchema,
-  scopes: external_exports.array(AuthScopeSchema).min(1)
-});
-var ProjectServiceAccountUpdateRequestSchema = external_exports.object({
-  scopes: external_exports.array(AuthScopeSchema).min(1)
-});
-var ProjectServiceAccountTokenResponseSchema = external_exports.object({
-  serviceAccount: ProjectServiceAccountSchema,
-  token: external_exports.string().min(1)
-});
-var ProjectServiceAccountUpdateResponseSchema = external_exports.object({
-  serviceAccount: ProjectServiceAccountSchema
-});
-var ProjectServiceAccountRemoveResponseSchema = external_exports.object({
-  serviceAccount: ProjectServiceAccountSchema,
-  removed: external_exports.literal(true)
-});
-var ProjectServiceAccountListResponseSchema = external_exports.object({
-  serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
-});
-
-// ../../packages/schemas/src/project-resources.ts
-var EnvironmentApplyDocumentSchema = resourceApplyDocumentSchema(
-  RESOURCE_KIND_ENVIRONMENT,
-  EnvironmentApplyRequestSchema.shape.spec
-);
-var IdentityApplyDocumentSchema = resourceApplyDocumentSchema(
-  RESOURCE_KIND_IDENTITY,
-  IdentityApplyRequestSchema.shape.spec
-);
-var AgentApplyDocumentSchema = resourceApplyDocumentSchema(
-  RESOURCE_KIND_AGENT,
-  AgentApplyRequestSchema.shape.spec
-);
-var ProjectApplyResourceSchema = external_exports.discriminatedUnion("kind", [
-  EnvironmentApplyDocumentSchema,
-  IdentityApplyDocumentSchema,
-  AgentApplyDocumentSchema
-]);
-var PROJECT_RESOURCE_APPLY_ORDER = [
-  RESOURCE_KIND_CONNECTION,
-  RESOURCE_KIND_IDENTITY,
-  RESOURCE_KIND_ENVIRONMENT,
-  RESOURCE_KIND_AGENT
-];
-var PROJECT_RESOURCE_KINDS = PROJECT_RESOURCE_APPLY_ORDER;
-var PROJECT_APPLY_RESOURCE_KINDS = [
-  RESOURCE_KIND_IDENTITY,
-  RESOURCE_KIND_ENVIRONMENT,
-  RESOURCE_KIND_AGENT
-];
-var PROJECT_APPLY_BUNDLE_VERSION = 1;
-var MAX_PROJECT_APPLY_BUNDLE_BYTES = 64 * 1024 * 1024;
-var PROJECT_APPLY_BUNDLE_CONTENT_TYPE = "application/vnd.auto.project-apply-bundle+json";
-function projectApplyBundleStorageKey(sha256) {
-  return `project-apply-bundles/${sha256}.json`;
-}
-var ProjectDeleteResourceBaseSchema = external_exports.object({
-  name: external_exports.string().trim().min(1)
-});
-var ProjectDeleteResourceSchema = ProjectDeleteResourceBaseSchema.extend({
-  kind: external_exports.enum(PROJECT_APPLY_RESOURCE_KINDS)
-});
-var AVATAR_ASSET_CONTENT_TYPES = ["image/png", "image/jpeg"];
-var MAX_AVATAR_ASSET_BASE64_LENGTH = Math.ceil(MAX_AVATAR_ASSET_BYTES / 3) * 4 + 4;
-var ProjectApplyAssetSchema = external_exports.object({
-  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
-  contentType: external_exports.enum(AVATAR_ASSET_CONTENT_TYPES),
-  dataBase64: external_exports.string().min(1).max(MAX_AVATAR_ASSET_BASE64_LENGTH).regex(/^[A-Za-z0-9+/]+={0,2}$/)
-});
-var ProjectApplyAssetsSchema = external_exports.record(
-  external_exports.string().refine(isAvatarAssetPathShapeValid, {
-    message: "asset keys must be relative paths under .auto/assets"
-  }),
-  ProjectApplyAssetSchema
-);
-var AvatarAssetUploadResponseSchema = external_exports.object({
-  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
-  contentType: external_exports.enum(AVATAR_ASSET_CONTENT_TYPES),
-  sizeBytes: external_exports.number().int().positive()
-});
-var ApplyBundlePathSchema = external_exports.string().trim().min(1).max(4096).refine((path2) => !path2.startsWith("/") && !path2.includes("\0"), {
-  message: "apply bundle paths must be relative paths"
-});
-var ProjectApplyBundleFileSchema = external_exports.object({
-  path: ApplyBundlePathSchema,
-  contentBase64: external_exports.string().regex(/^[A-Za-z0-9+/]*={0,2}$/)
-});
-var ProjectApplyBundleSchema = external_exports.object({
-  version: external_exports.literal(PROJECT_APPLY_BUNDLE_VERSION),
-  files: external_exports.array(ProjectApplyBundleFileSchema).max(2e4)
-});
-var ProjectApplyBundleRefSchema = external_exports.object({
-  kind: external_exports.literal("vercel_blob"),
-  storageKey: external_exports.string().trim().min(1).max(1024),
-  sha256: external_exports.string().regex(SHA256_HEX_PATTERN),
-  sizeBytes: external_exports.number().int().positive().max(MAX_PROJECT_APPLY_BUNDLE_BYTES)
-}).superRefine((ref, context) => {
-  const expectedStorageKey = projectApplyBundleStorageKey(ref.sha256);
-  if (ref.storageKey === expectedStorageKey) {
-    return;
-  }
-  context.addIssue({
-    code: "custom",
-    path: ["storageKey"],
-    message: "apply bundle storage key must match its sha256"
-  });
-});
-var ProjectApplyBundleUploadRequestSchema = external_exports.object({
-  sha256: external_exports.string().regex(SHA256_HEX_PATTERN),
-  sizeBytes: external_exports.number().int().positive().max(MAX_PROJECT_APPLY_BUNDLE_BYTES)
-});
-var ProjectApplyBundleUploadResponseSchema = external_exports.object({
-  method: external_exports.literal("PUT"),
-  uploadUrl: external_exports.string().url(),
-  contentType: external_exports.literal(PROJECT_APPLY_BUNDLE_CONTENT_TYPE),
-  source: ProjectApplyBundleRefSchema
-});
-var ProjectApplyBundleDirectoryEntrypointSchema = external_exports.object({
-  kind: external_exports.literal("directory"),
-  resourceRoot: ApplyBundlePathSchema.default(".auto"),
-  displayResourceRoot: external_exports.string().trim().min(1).max(4096).optional()
-});
-var ProjectApplyBundleFileEntrypointSchema = external_exports.object({
-  kind: external_exports.literal("file"),
-  filePath: ApplyBundlePathSchema
-});
-var ProjectApplyBundleEntrypointSchema = external_exports.discriminatedUnion("kind", [
-  ProjectApplyBundleDirectoryEntrypointSchema,
-  ProjectApplyBundleFileEntrypointSchema
-]);
-var ProjectApplySourceSchema = external_exports.object({
-  kind: external_exports.literal("bundle"),
-  bundle: ProjectApplyBundleRefSchema,
-  entrypoint: ProjectApplyBundleEntrypointSchema
-});
-var ProjectApplySourceRequestSchema = external_exports.object({
-  source: ProjectApplySourceSchema,
-  delete: external_exports.array(ProjectDeleteResourceSchema).default([]),
-  dryRun: external_exports.boolean().default(false),
-  prune: external_exports.boolean().default(true)
-});
-var ProjectApplyRequestSchema = external_exports.object({
-  delete: external_exports.array(ProjectDeleteResourceSchema).default([]),
-  dryRun: external_exports.boolean().default(false),
-  prune: external_exports.boolean().default(false),
-  resources: external_exports.array(ProjectApplyResourceSchema).default([]),
-  assets: ProjectApplyAssetsSchema.default({})
-});
-var ProjectApplySystemConfigSchema = external_exports.object({
-  kind: external_exports.literal("system"),
-  metadata: external_exports.object({
-    name: external_exports.string().trim().min(1).optional()
-  }).optional(),
-  spec: ProjectApplyRequestSchema
-});
-var ProjectAppliedResourceSchema = external_exports.union([
-  ProjectConnectionAllocationResourceSchema,
-  EnvironmentResourceSchema,
-  IdentityResourceSchema,
-  AgentResourceSchema
-]);
-var ProjectApplyDiagnosticSchema = external_exports.object({
-  // "info" is a non-blocking advisory (e.g. template-push capability/override
-  // notices); "error" remains the validation-failure severity. Coordinated
-  // shape with the optional-connection-gating work; whoever lands second rebases.
-  severity: external_exports.enum(["error", "info"]),
-  blocking: external_exports.boolean(),
-  code: external_exports.string().min(1),
-  message: external_exports.string().min(1),
-  action: external_exports.enum(["create", "update", "unchanged"]),
-  kind: external_exports.enum([
-    RESOURCE_KIND_CONNECTION,
-    RESOURCE_KIND_ENVIRONMENT,
-    RESOURCE_KIND_IDENTITY,
-    RESOURCE_KIND_AGENT
-  ]),
-  name: external_exports.string().min(1)
-});
-var ProjectApplyResponsePrunedSchema = external_exports.object({
-  kind: external_exports.enum(PROJECT_RESOURCE_KINDS),
-  name: external_exports.string().min(1),
-  uid: external_exports.string().min(1),
-  heartbeatScheduleIds: external_exports.array(external_exports.string().min(1)).optional()
-});
-var ProjectApplyPlanDiffSchema = external_exports.object({
-  action: external_exports.enum(["add", "remove", "change"]),
-  path: external_exports.string().min(1)
-});
-var ProjectApplyResponseSchema = external_exports.object({
-  dryRun: external_exports.boolean().default(false),
-  resources: external_exports.array(ProjectAppliedResourceSchema),
-  triggers: external_exports.array(ApplyTriggerReceiptSchema).default([]),
-  diagnostics: external_exports.array(ProjectApplyDiagnosticSchema).default([]),
-  plan: external_exports.array(
-    external_exports.object({
-      action: external_exports.enum(["create", "update", "unchanged", "archive"]),
-      kind: external_exports.enum(PROJECT_RESOURCE_KINDS),
-      name: external_exports.string().min(1),
-      uid: external_exports.string().min(1).optional(),
-      diff: external_exports.array(ProjectApplyPlanDiffSchema).optional(),
-      diffOmitted: external_exports.number().int().positive().optional()
-    })
-  ).default([]),
-  pruned: external_exports.array(ProjectApplyResponsePrunedSchema).default([])
-});
-var ProjectResourceApplyResultSchema = ProjectApplyResponseSchema.extend({
-  heartbeatSchedules: external_exports.array(
-    external_exports.object({
-      scheduleId: external_exports.string().trim().min(1),
-      cron: external_exports.string().trim().min(1),
-      timezone: external_exports.string().trim().min(1),
-      input: HeartbeatTickWorkflowInputSchema
-    })
-  ).default([]),
-  deletedHeartbeatScheduleIds: external_exports.array(external_exports.string().trim().min(1)).default([])
-});
-var ProjectResourceApplyAuditActionSchema = external_exports.enum([
-  "project_resources.apply",
-  "github_sync.apply"
-]);
-var ProjectResourceApplyOperationIdSchema = external_exports.string().trim().min(1).max(512);
-var ProjectResourceApplyTriggerArtifactSchema = external_exports.object({
-  type: external_exports.string().trim().min(1),
-  externalId: external_exports.string().trim().min(1),
-  payload: JsonValueSchema2.optional()
-}).strict();
-var ProjectResourceApplyWorkflowErrorSchema = external_exports.object({
-  name: external_exports.string().trim().min(1),
-  message: external_exports.string().trim().min(1)
-});
-var ProjectResourceApplyWorkflowInputSchema = external_exports.object({
-  operationId: ProjectResourceApplyOperationIdSchema,
-  request: ProjectApplyRequestSchema.optional(),
-  sourceRequest: ProjectApplySourceRequestSchema.optional(),
-  organizationId: OrganizationIdSchema,
-  projectId: ProjectIdSchema.nullable().optional(),
-  actor: AuthActorSchema,
-  auditAction: ProjectResourceApplyAuditActionSchema,
-  triggerArtifact: ProjectResourceApplyTriggerArtifactSchema.optional()
-}).superRefine((input, context) => {
-  if ((input.request ? 1 : 0) + (input.sourceRequest ? 1 : 0) !== 1) {
-    context.addIssue({
-      code: "custom",
-      path: ["request"],
-      message: "exactly one of request or sourceRequest is required"
-    });
-  }
-});
-var ProjectResourceApplyWorkflowResultSchema = external_exports.discriminatedUnion(
-  "status",
-  [
-    external_exports.object({
-      status: external_exports.literal("applied"),
-      result: ProjectResourceApplyResultSchema
-    }),
-    external_exports.object({
-      status: external_exports.literal("failed"),
-      error: ProjectResourceApplyWorkflowErrorSchema
-    })
-  ]
-);
-
-// ../../packages/schemas/src/session-diagnostics.ts
-var SESSION_DIAGNOSTIC_REALTIME_EVENT = "session.diagnostic";
-var SESSION_DIAGNOSTIC_LEVELS = [
-  "debug",
-  "info",
-  "warn",
-  "error"
-];
-var SESSION_DIAGNOSTIC_SOURCES = [
-  "web",
-  "worker",
-  "activity",
-  "bridge",
-  "runtime"
-];
-var SESSION_DIAGNOSTIC_PHASES = [
-  "dispatch",
-  "environment",
-  "bridge",
-  "delivery",
-  "command",
-  "runtime"
-];
-var SESSION_DIAGNOSTIC_STATUSES = [
-  "started",
-  "succeeded",
-  "retrying",
-  "failed",
-  "skipped"
-];
-var SessionDiagnosticLevelSchema = external_exports.enum(SESSION_DIAGNOSTIC_LEVELS);
-var SessionDiagnosticSourceSchema = external_exports.enum(SESSION_DIAGNOSTIC_SOURCES);
-var SessionDiagnosticPhaseSchema = external_exports.enum(SESSION_DIAGNOSTIC_PHASES);
-var SessionDiagnosticStatusSchema = external_exports.enum(
-  SESSION_DIAGNOSTIC_STATUSES
-);
-var SessionDiagnosticEventSchema = external_exports.object({
-  type: external_exports.literal(SESSION_DIAGNOSTIC_REALTIME_EVENT),
-  id: external_exports.string().min(1),
-  sessionId: SessionIdSchema2,
-  level: SessionDiagnosticLevelSchema,
-  source: SessionDiagnosticSourceSchema,
-  phase: SessionDiagnosticPhaseSchema,
-  step: external_exports.string().trim().min(1),
-  status: SessionDiagnosticStatusSchema,
-  message: external_exports.string().trim().min(1),
-  commandId: SessionCommandIdSchema2.optional(),
-  runtimeId: RuntimeIdSchema2.optional(),
-  bridgeLeaseId: RuntimeBridgeLeaseIdSchema2.optional(),
-  attempt: external_exports.number().int().nonnegative().optional(),
-  durationMs: external_exports.number().nonnegative().optional(),
-  details: external_exports.record(external_exports.string(), JsonValueSchema2).optional(),
-  createdAt: external_exports.string().datetime()
-});
-
 // ../../packages/schemas/src/singleton-refresh.ts
 var SINGLETON_RESPAWN_REASONS = ["refresh", "failure"];
 var SingletonRespawnReasonSchema = external_exports.enum(SINGLETON_RESPAWN_REASONS);
@@ -27642,6 +27241,407 @@ var SessionsArchiveResponseSchema = external_exports.object({
   sessions: external_exports.array(SessionRecordSchema)
 });
 
+// ../../packages/schemas/src/live-events.ts
+var LiveEntityEventEnvelopeSchema = external_exports.object({
+  // Replay cursor for this frame; the SSE `id:` mirrors it so reconnects resume
+  // from `sequence > cursor`.
+  sequence: external_exports.number().int().nonnegative(),
+  eventKey: external_exports.string().min(1),
+  // The event's `subjectKind`, surfaced as `entity` for client-side dispatch.
+  entity: external_exports.string().min(1),
+  subjectId: external_exports.string().min(1),
+  payload: JsonValueSchema2,
+  occurredAt: external_exports.string().min(1)
+});
+
+// ../../packages/schemas/src/mcp.ts
+var McpToolCallMessageSchema = external_exports.object({
+  method: external_exports.literal("tools/call"),
+  params: external_exports.object({
+    name: external_exports.string().trim().min(1)
+  })
+});
+var McpJsonRpcMessageSchema = external_exports.object({
+  method: external_exports.string().optional()
+}).passthrough();
+var McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
+
+// ../../packages/schemas/src/pricing.ts
+var RATE_CARD_2026_06_23 = {
+  version: "2026-06-23",
+  effectiveAt: "2026-06-23T00:00:00.000Z",
+  models: {
+    "claude-opus-4-8": opusTier(),
+    "claude-opus-4-7": opusTier(),
+    "claude-opus-4-6": opusTier(),
+    "claude-sonnet-4-6": tier(3, 15),
+    "claude-haiku-4-5": tier(1, 5),
+    "claude-haiku-4-5-20251001": tier(1, 5),
+    "claude-fable-5": tier(10, 50),
+    // OpenAI gpt-5.3-codex, standard tier: input $1.75/Mtok, cached input
+    // $0.175/Mtok, output $14.00/Mtok. Source (verified 2026-06-23):
+    // https://developers.openai.com/api/docs/models/gpt-5.3-codex and
+    // https://developers.openai.com/api/docs/pricing (priority tier is 2x; we
+    // bill standard).
+    "gpt-5.3-codex": openAiTier({
+      input: 1.75,
+      cachedInput: 0.175,
+      output: 14
+    })
+  }
+};
+var PRICING_RATE_CARDS = {
+  [RATE_CARD_2026_06_23.version]: RATE_CARD_2026_06_23
+};
+var CURRENT_PRICING_VERSION = RATE_CARD_2026_06_23.version;
+function tier(inputUsdPerMtok, outputUsdPerMtok) {
+  return {
+    inputUsdPerMtok,
+    outputUsdPerMtok,
+    cacheWrite5mUsdPerMtok: inputUsdPerMtok * 1.25,
+    cacheReadUsdPerMtok: inputUsdPerMtok * 0.1
+  };
+}
+function opusTier() {
+  return tier(5, 25);
+}
+function openAiTier(rates) {
+  return {
+    inputUsdPerMtok: rates.input,
+    outputUsdPerMtok: rates.output,
+    cacheWrite5mUsdPerMtok: rates.input,
+    cacheReadUsdPerMtok: rates.cachedInput
+  };
+}
+
+// ../../packages/schemas/src/project-service-accounts.ts
+var ProjectServiceAccountSchema = external_exports.object({
+  id: ServiceAccountIdSchema,
+  organizationId: OrganizationIdSchema,
+  projectId: ProjectIdSchema,
+  name: ResourceNameSchema,
+  scopes: external_exports.array(AuthScopeSchema),
+  createdAt: external_exports.string().datetime()
+});
+var ProjectServiceAccountCreateRequestSchema = external_exports.object({
+  name: ResourceNameSchema,
+  scopes: external_exports.array(AuthScopeSchema).min(1)
+});
+var ProjectServiceAccountUpdateRequestSchema = external_exports.object({
+  scopes: external_exports.array(AuthScopeSchema).min(1)
+});
+var ProjectServiceAccountTokenResponseSchema = external_exports.object({
+  serviceAccount: ProjectServiceAccountSchema,
+  token: external_exports.string().min(1)
+});
+var ProjectServiceAccountUpdateResponseSchema = external_exports.object({
+  serviceAccount: ProjectServiceAccountSchema
+});
+var ProjectServiceAccountRemoveResponseSchema = external_exports.object({
+  serviceAccount: ProjectServiceAccountSchema,
+  removed: external_exports.literal(true)
+});
+var ProjectServiceAccountListResponseSchema = external_exports.object({
+  serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
+});
+
+// ../../packages/schemas/src/project-resources.ts
+var EnvironmentApplyDocumentSchema = resourceApplyDocumentSchema(
+  RESOURCE_KIND_ENVIRONMENT,
+  EnvironmentApplyRequestSchema.shape.spec
+);
+var IdentityApplyDocumentSchema = resourceApplyDocumentSchema(
+  RESOURCE_KIND_IDENTITY,
+  IdentityApplyRequestSchema.shape.spec
+);
+var AgentApplyDocumentSchema = resourceApplyDocumentSchema(
+  RESOURCE_KIND_AGENT,
+  AgentApplyRequestSchema.shape.spec
+);
+var ProjectApplyResourceSchema = external_exports.discriminatedUnion("kind", [
+  EnvironmentApplyDocumentSchema,
+  IdentityApplyDocumentSchema,
+  AgentApplyDocumentSchema
+]);
+var PROJECT_RESOURCE_APPLY_ORDER = [
+  RESOURCE_KIND_CONNECTION,
+  RESOURCE_KIND_IDENTITY,
+  RESOURCE_KIND_ENVIRONMENT,
+  RESOURCE_KIND_AGENT
+];
+var PROJECT_RESOURCE_KINDS = PROJECT_RESOURCE_APPLY_ORDER;
+var PROJECT_APPLY_RESOURCE_KINDS = [
+  RESOURCE_KIND_IDENTITY,
+  RESOURCE_KIND_ENVIRONMENT,
+  RESOURCE_KIND_AGENT
+];
+var PROJECT_APPLY_BUNDLE_VERSION = 1;
+var MAX_PROJECT_APPLY_BUNDLE_BYTES = 64 * 1024 * 1024;
+var PROJECT_APPLY_BUNDLE_CONTENT_TYPE = "application/vnd.auto.project-apply-bundle+json";
+function projectApplyBundleStorageKey(sha256) {
+  return `project-apply-bundles/${sha256}.json`;
+}
+var ProjectDeleteResourceBaseSchema = external_exports.object({
+  name: external_exports.string().trim().min(1)
+});
+var ProjectDeleteResourceSchema = ProjectDeleteResourceBaseSchema.extend({
+  kind: external_exports.enum(PROJECT_APPLY_RESOURCE_KINDS)
+});
+var AVATAR_ASSET_CONTENT_TYPES = ["image/png", "image/jpeg"];
+var MAX_AVATAR_ASSET_BASE64_LENGTH = Math.ceil(MAX_AVATAR_ASSET_BYTES / 3) * 4 + 4;
+var ProjectApplyAssetSchema = external_exports.object({
+  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  contentType: external_exports.enum(AVATAR_ASSET_CONTENT_TYPES),
+  dataBase64: external_exports.string().min(1).max(MAX_AVATAR_ASSET_BASE64_LENGTH).regex(/^[A-Za-z0-9+/]+={0,2}$/)
+});
+var ProjectApplyAssetsSchema = external_exports.record(
+  external_exports.string().refine(isAvatarAssetPathShapeValid, {
+    message: "asset keys must be relative paths under .auto/assets"
+  }),
+  ProjectApplyAssetSchema
+);
+var AvatarAssetUploadResponseSchema = external_exports.object({
+  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  contentType: external_exports.enum(AVATAR_ASSET_CONTENT_TYPES),
+  sizeBytes: external_exports.number().int().positive()
+});
+var ApplyBundlePathSchema = external_exports.string().trim().min(1).max(4096).refine((path2) => !path2.startsWith("/") && !path2.includes("\0"), {
+  message: "apply bundle paths must be relative paths"
+});
+var ProjectApplyBundleFileSchema = external_exports.object({
+  path: ApplyBundlePathSchema,
+  contentBase64: external_exports.string().regex(/^[A-Za-z0-9+/]*={0,2}$/)
+});
+var ProjectApplyBundleSchema = external_exports.object({
+  version: external_exports.literal(PROJECT_APPLY_BUNDLE_VERSION),
+  files: external_exports.array(ProjectApplyBundleFileSchema).max(2e4)
+});
+var ProjectApplyBundleRefSchema = external_exports.object({
+  kind: external_exports.literal("vercel_blob"),
+  storageKey: external_exports.string().trim().min(1).max(1024),
+  sha256: external_exports.string().regex(SHA256_HEX_PATTERN),
+  sizeBytes: external_exports.number().int().positive().max(MAX_PROJECT_APPLY_BUNDLE_BYTES)
+}).superRefine((ref, context) => {
+  const expectedStorageKey = projectApplyBundleStorageKey(ref.sha256);
+  if (ref.storageKey === expectedStorageKey) {
+    return;
+  }
+  context.addIssue({
+    code: "custom",
+    path: ["storageKey"],
+    message: "apply bundle storage key must match its sha256"
+  });
+});
+var ProjectApplyBundleUploadRequestSchema = external_exports.object({
+  sha256: external_exports.string().regex(SHA256_HEX_PATTERN),
+  sizeBytes: external_exports.number().int().positive().max(MAX_PROJECT_APPLY_BUNDLE_BYTES)
+});
+var ProjectApplyBundleUploadResponseSchema = external_exports.object({
+  method: external_exports.literal("PUT"),
+  uploadUrl: external_exports.string().url(),
+  contentType: external_exports.literal(PROJECT_APPLY_BUNDLE_CONTENT_TYPE),
+  source: ProjectApplyBundleRefSchema
+});
+var ProjectApplyBundleDirectoryEntrypointSchema = external_exports.object({
+  kind: external_exports.literal("directory"),
+  resourceRoot: ApplyBundlePathSchema.default(".auto"),
+  displayResourceRoot: external_exports.string().trim().min(1).max(4096).optional()
+});
+var ProjectApplyBundleFileEntrypointSchema = external_exports.object({
+  kind: external_exports.literal("file"),
+  filePath: ApplyBundlePathSchema
+});
+var ProjectApplyBundleEntrypointSchema = external_exports.discriminatedUnion("kind", [
+  ProjectApplyBundleDirectoryEntrypointSchema,
+  ProjectApplyBundleFileEntrypointSchema
+]);
+var ProjectApplySourceSchema = external_exports.object({
+  kind: external_exports.literal("bundle"),
+  bundle: ProjectApplyBundleRefSchema,
+  entrypoint: ProjectApplyBundleEntrypointSchema
+});
+var ProjectApplySourceRequestSchema = external_exports.object({
+  source: ProjectApplySourceSchema,
+  delete: external_exports.array(ProjectDeleteResourceSchema).default([]),
+  dryRun: external_exports.boolean().default(false),
+  prune: external_exports.boolean().default(true)
+});
+var ProjectApplyRequestSchema = external_exports.object({
+  delete: external_exports.array(ProjectDeleteResourceSchema).default([]),
+  dryRun: external_exports.boolean().default(false),
+  prune: external_exports.boolean().default(false),
+  resources: external_exports.array(ProjectApplyResourceSchema).default([]),
+  assets: ProjectApplyAssetsSchema.default({})
+});
+var ProjectApplySystemConfigSchema = external_exports.object({
+  kind: external_exports.literal("system"),
+  metadata: external_exports.object({
+    name: external_exports.string().trim().min(1).optional()
+  }).optional(),
+  spec: ProjectApplyRequestSchema
+});
+var ProjectAppliedResourceSchema = external_exports.union([
+  ProjectConnectionAllocationResourceSchema,
+  EnvironmentResourceSchema,
+  IdentityResourceSchema,
+  AgentResourceSchema
+]);
+var ProjectApplyDiagnosticSchema = external_exports.object({
+  // "info" is a non-blocking advisory (e.g. template-push capability/override
+  // notices); "error" remains the validation-failure severity. Coordinated
+  // shape with the optional-connection-gating work; whoever lands second rebases.
+  severity: external_exports.enum(["error", "info"]),
+  blocking: external_exports.boolean(),
+  code: external_exports.string().min(1),
+  message: external_exports.string().min(1),
+  action: external_exports.enum(["create", "update", "unchanged"]),
+  kind: external_exports.enum([
+    RESOURCE_KIND_CONNECTION,
+    RESOURCE_KIND_ENVIRONMENT,
+    RESOURCE_KIND_IDENTITY,
+    RESOURCE_KIND_AGENT
+  ]),
+  name: external_exports.string().min(1)
+});
+var ProjectApplyResponsePrunedSchema = external_exports.object({
+  kind: external_exports.enum(PROJECT_RESOURCE_KINDS),
+  name: external_exports.string().min(1),
+  uid: external_exports.string().min(1),
+  heartbeatScheduleIds: external_exports.array(external_exports.string().min(1)).optional()
+});
+var ProjectApplyPlanDiffSchema = external_exports.object({
+  action: external_exports.enum(["add", "remove", "change"]),
+  path: external_exports.string().min(1)
+});
+var ProjectApplyResponseSchema = external_exports.object({
+  dryRun: external_exports.boolean().default(false),
+  resources: external_exports.array(ProjectAppliedResourceSchema),
+  triggers: external_exports.array(ApplyTriggerReceiptSchema).default([]),
+  diagnostics: external_exports.array(ProjectApplyDiagnosticSchema).default([]),
+  plan: external_exports.array(
+    external_exports.object({
+      action: external_exports.enum(["create", "update", "unchanged", "archive"]),
+      kind: external_exports.enum(PROJECT_RESOURCE_KINDS),
+      name: external_exports.string().min(1),
+      uid: external_exports.string().min(1).optional(),
+      diff: external_exports.array(ProjectApplyPlanDiffSchema).optional(),
+      diffOmitted: external_exports.number().int().positive().optional()
+    })
+  ).default([]),
+  pruned: external_exports.array(ProjectApplyResponsePrunedSchema).default([])
+});
+var ProjectResourceApplyResultSchema = ProjectApplyResponseSchema.extend({
+  heartbeatSchedules: external_exports.array(
+    external_exports.object({
+      scheduleId: external_exports.string().trim().min(1),
+      cron: external_exports.string().trim().min(1),
+      timezone: external_exports.string().trim().min(1),
+      input: HeartbeatTickWorkflowInputSchema
+    })
+  ).default([]),
+  deletedHeartbeatScheduleIds: external_exports.array(external_exports.string().trim().min(1)).default([])
+});
+var ProjectResourceApplyAuditActionSchema = external_exports.enum([
+  "project_resources.apply",
+  "github_sync.apply"
+]);
+var ProjectResourceApplyOperationIdSchema = external_exports.string().trim().min(1).max(512);
+var ProjectResourceApplyTriggerArtifactSchema = external_exports.object({
+  type: external_exports.string().trim().min(1),
+  externalId: external_exports.string().trim().min(1),
+  payload: JsonValueSchema2.optional()
+}).strict();
+var ProjectResourceApplyWorkflowErrorSchema = external_exports.object({
+  name: external_exports.string().trim().min(1),
+  message: external_exports.string().trim().min(1)
+});
+var ProjectResourceApplyWorkflowInputSchema = external_exports.object({
+  operationId: ProjectResourceApplyOperationIdSchema,
+  request: ProjectApplyRequestSchema.optional(),
+  sourceRequest: ProjectApplySourceRequestSchema.optional(),
+  organizationId: OrganizationIdSchema,
+  projectId: ProjectIdSchema.nullable().optional(),
+  actor: AuthActorSchema,
+  auditAction: ProjectResourceApplyAuditActionSchema,
+  triggerArtifact: ProjectResourceApplyTriggerArtifactSchema.optional()
+}).superRefine((input, context) => {
+  if ((input.request ? 1 : 0) + (input.sourceRequest ? 1 : 0) !== 1) {
+    context.addIssue({
+      code: "custom",
+      path: ["request"],
+      message: "exactly one of request or sourceRequest is required"
+    });
+  }
+});
+var ProjectResourceApplyWorkflowResultSchema = external_exports.discriminatedUnion(
+  "status",
+  [
+    external_exports.object({
+      status: external_exports.literal("applied"),
+      result: ProjectResourceApplyResultSchema
+    }),
+    external_exports.object({
+      status: external_exports.literal("failed"),
+      error: ProjectResourceApplyWorkflowErrorSchema
+    })
+  ]
+);
+
+// ../../packages/schemas/src/session-diagnostics.ts
+var SESSION_DIAGNOSTIC_REALTIME_EVENT = "session.diagnostic";
+var SESSION_DIAGNOSTIC_LEVELS = [
+  "debug",
+  "info",
+  "warn",
+  "error"
+];
+var SESSION_DIAGNOSTIC_SOURCES = [
+  "web",
+  "worker",
+  "activity",
+  "bridge",
+  "runtime"
+];
+var SESSION_DIAGNOSTIC_PHASES = [
+  "dispatch",
+  "environment",
+  "bridge",
+  "delivery",
+  "command",
+  "runtime"
+];
+var SESSION_DIAGNOSTIC_STATUSES = [
+  "started",
+  "succeeded",
+  "retrying",
+  "failed",
+  "skipped"
+];
+var SessionDiagnosticLevelSchema = external_exports.enum(SESSION_DIAGNOSTIC_LEVELS);
+var SessionDiagnosticSourceSchema = external_exports.enum(SESSION_DIAGNOSTIC_SOURCES);
+var SessionDiagnosticPhaseSchema = external_exports.enum(SESSION_DIAGNOSTIC_PHASES);
+var SessionDiagnosticStatusSchema = external_exports.enum(
+  SESSION_DIAGNOSTIC_STATUSES
+);
+var SessionDiagnosticEventSchema = external_exports.object({
+  type: external_exports.literal(SESSION_DIAGNOSTIC_REALTIME_EVENT),
+  id: external_exports.string().min(1),
+  sessionId: SessionIdSchema2,
+  level: SessionDiagnosticLevelSchema,
+  source: SessionDiagnosticSourceSchema,
+  phase: SessionDiagnosticPhaseSchema,
+  step: external_exports.string().trim().min(1),
+  status: SessionDiagnosticStatusSchema,
+  message: external_exports.string().trim().min(1),
+  commandId: SessionCommandIdSchema2.optional(),
+  runtimeId: RuntimeIdSchema2.optional(),
+  bridgeLeaseId: RuntimeBridgeLeaseIdSchema2.optional(),
+  attempt: external_exports.number().int().nonnegative().optional(),
+  durationMs: external_exports.number().nonnegative().optional(),
+  details: external_exports.record(external_exports.string(), JsonValueSchema2).optional(),
+  createdAt: external_exports.string().datetime()
+});
+
 // ../../packages/schemas/src/session-introspection.ts
 var TruncatedValueSchema = external_exports.object({
   truncated: external_exports.literal(true),
@@ -38223,6 +38223,7 @@ var UiMessagePartTracker = class {
   textPartIndexById = /* @__PURE__ */ new Map();
   reasoningPartIndexById = /* @__PURE__ */ new Map();
   toolPartIndexByCallId = /* @__PURE__ */ new Map();
+  approvalByCallId = /* @__PURE__ */ new Map();
   dataPartIndexById = /* @__PURE__ */ new Map();
   append(chunk) {
     switch (chunk.type) {
@@ -38315,14 +38316,16 @@ var UiMessagePartTracker = class {
         return [];
       }
       case "tool-input-available": {
+        const pendingApproval = this.approvalByCallId.get(chunk.toolCallId);
         const index = this.upsertToolPart(chunk.toolCallId, {
           ...toolPartShape({
             toolCallId: chunk.toolCallId,
             toolName: chunk.toolName,
             dynamic: chunk.dynamic,
-            state: "input-available"
+            state: pendingApproval ? "approval-requested" : "input-available"
           }),
           input: chunk.input,
+          ...pendingApproval ? { approval: pendingApproval } : {},
           ...chunk.providerExecuted !== void 0 ? { providerExecuted: chunk.providerExecuted } : {},
           ...chunk.providerMetadata !== void 0 ? { callProviderMetadata: chunk.providerMetadata } : {}
         });
@@ -38341,6 +38344,24 @@ var UiMessagePartTracker = class {
         });
         return this.persistable(index);
       }
+      case "tool-approval-request": {
+        const approval = {
+          id: chunk.approvalId,
+          ...chunk.signature != null ? { signature: chunk.signature } : {}
+        };
+        this.approvalByCallId.set(chunk.toolCallId, approval);
+        const part = this.partById(
+          this.toolPartIndexByCallId,
+          chunk.toolCallId
+        );
+        const index = this.toolPartIndexByCallId.get(chunk.toolCallId);
+        if (!part || index === void 0) {
+          return [];
+        }
+        part.state = "approval-requested";
+        part.approval = approval;
+        return this.persistable(index);
+      }
       case "tool-output-available": {
         const part = this.partById(
           this.toolPartIndexByCallId,
@@ -38353,6 +38374,20 @@ var UiMessagePartTracker = class {
         part.state = "output-available";
         part.output = chunk.output;
         part.preliminary = chunk.preliminary;
+        this.settleApproval(part, chunk.toolCallId, { approved: true });
+        return this.persistable(index);
+      }
+      case "tool-output-denied": {
+        const part = this.partById(
+          this.toolPartIndexByCallId,
+          chunk.toolCallId
+        );
+        const index = this.toolPartIndexByCallId.get(chunk.toolCallId);
+        if (!part || index === void 0) {
+          return [];
+        }
+        part.state = "output-denied";
+        this.settleApproval(part, chunk.toolCallId, { approved: false });
         return this.persistable(index);
       }
       case "tool-output-error": {
@@ -38366,6 +38401,7 @@ var UiMessagePartTracker = class {
         }
         part.state = "output-error";
         part.errorText = chunk.errorText;
+        this.settleApproval(part, chunk.toolCallId, { approved: true });
         return this.persistable(index);
       }
       case "start-step": {
@@ -38473,6 +38509,16 @@ var UiMessagePartTracker = class {
     }
     return this.parts[index] ?? null;
   }
+  // The UIToolInvocation contract requires `approval.approved` on settled
+  // states (`output-available`/`output-denied`), but the settling chunks don't
+  // carry it — the outcome is implied by which chunk arrives. Stamp it onto a
+  // previously requested approval; parts that never parked stay approval-free.
+  settleApproval(part, toolCallId, outcome) {
+    const approval = this.approvalByCallId.get(toolCallId);
+    if (approval) {
+      part.approval = { ...approval, approved: outcome.approved };
+    }
+  }
   reset() {
     this.messageId = null;
     this.messageMetadata = void 0;
@@ -38481,6 +38527,7 @@ var UiMessagePartTracker = class {
     this.textPartIndexById = /* @__PURE__ */ new Map();
     this.reasoningPartIndexById = /* @__PURE__ */ new Map();
     this.toolPartIndexByCallId = /* @__PURE__ */ new Map();
+    this.approvalByCallId = /* @__PURE__ */ new Map();
     this.dataPartIndexById = /* @__PURE__ */ new Map();
   }
 };
@@ -38917,6 +38964,21 @@ function legacyToolEntry(chunk) {
           ]
         }
       };
+    case "tool-output-denied":
+      return {
+        role: "tool",
+        kind: "tool_result",
+        content: {
+          parts: [
+            {
+              type: "tool_result",
+              toolUseId: legacyToolCallId(chunk.toolCallId),
+              output: { denied: true },
+              isError: true
+            }
+          ]
+        }
+      };
     default:
       return null;
   }
@@ -60626,15 +60688,19 @@ var CodexProjector = class {
         return [];
     }
   }
-  // An approval parks the turn on operator input, so the question chunk also
-  // marks the delivered turn as waiting for input.
+  // An approval parks the turn on operator input, so both chunks mark the
+  // delivered turn as waiting for input.
   projectApproval(request) {
     return [
-      uiChunk2({
-        type: "tool-approval-request",
-        approvalId: String(request.requestId),
-        toolCallId: request.itemId
-      }),
+      {
+        type: "ui_message_chunk",
+        chunk: {
+          type: "tool-approval-request",
+          approvalId: String(request.requestId),
+          toolCallId: request.itemId
+        },
+        turnStatus: "waiting_for_input"
+      },
       {
         type: "ui_message_chunk",
         chunk: {
@@ -60689,6 +60755,7 @@ var CodexProjector = class {
             ...item.cwd ? { cwd: item.cwd } : {}
           },
           output: item.aggregatedOutput ?? "",
+          isDenied: isDeclinedStatus(item.status),
           isError: isFailedStatus(item.status) || (item.exitCode ?? 0) !== 0,
           title: item.command,
           toolMetadata: statusMetadata(item.status, {
@@ -60702,6 +60769,7 @@ var CodexProjector = class {
           name: "apply_patch",
           input: { changes: toJsonValue(item.changes) },
           output: { status: item.status ?? "unknown" },
+          isDenied: isDeclinedStatus(item.status),
           isError: isFailedStatus(item.status),
           title: "apply_patch",
           toolMetadata: statusMetadata(item.status)
@@ -60799,6 +60867,12 @@ function toolInputChunk(input) {
   });
 }
 function toolOutputChunk(input) {
+  if (input.isDenied) {
+    return uiChunk2({
+      type: "tool-output-denied",
+      toolCallId: input.itemId
+    });
+  }
   return uiChunk2(
     input.isError ? {
       type: "tool-output-error",
@@ -60869,6 +60943,9 @@ function reasoningPartId(itemId) {
 function isFailedStatus(status) {
   return status === "failed" || status === "declined";
 }
+function isDeclinedStatus(status) {
+  return status === "declined";
+}
 function statusMetadata(status, fields = {}) {
   return {
     status: status ?? "unknown",