@caplets/core 0.26.0 → 0.27.0

package/dist/{service-rvZ7z6FI.js → service-BGGiZLHa.js}

@@ -1,5 +1,5 @@
 import { A as safeParseAsync$1, C as toJSONSchema, D as parse$3, E as $ZodType, F as NEVER, M as defineLazy, N as normalizeParams, O as parseAsync, P as $constructor, S as datetime, T as $ZodObject, _ as record, a as any, b as unknown, c as custom, d as literal, f as looseObject, g as preprocess, h as optional, i as _null, j as clone, k as safeParse$1, l as discriminatedUnion, m as object$1, o as array, p as number$1, r as _enum, s as boolean, t as ZodNumber$1, u as intersection, v as string, w as _coercedNumber, x as url, y as union } from "./schemas-BoqMu4MG.js";
-import { a as isAllowedHttpBaseUrl, c as validateHttpActionHeaders, d as errorResult, f as redactSecrets, i as SERVER_ID_PATTERN, n as HEADER_NAME_PATTERN, o as isAllowedRemoteUrl, p as toSafeError, r as HTTP_BASE_URL_PATTERN, s as isUrl, t as FORBIDDEN_HEADERS, u as CapletsError } from "./validation-C4tYXw6G.js";
+import { a as SERVER_ID_PATTERN, c as isUrl, d as CapletsError, f as errorResult, i as NAMESPACE_ALIAS_LABEL_PATTERN, l as validateHttpActionHeaders, m as toSafeError, n as HEADER_NAME_PATTERN, o as isAllowedHttpBaseUrl, p as redactSecrets, r as HTTP_BASE_URL_PATTERN, s as isAllowedRemoteUrl, t as FORBIDDEN_HEADERS } from "./validation-CWzd2gtn.js";
 import { generatedToolInputJsonSchema, generatedToolInputJsonSchemaForCaplet, generatedToolInputSchemaForCaplet, mcpOperations, operations } from "./generated-tool-input-schema.js";
 import { f as observedOutputShapeKey, i as observeOutputShape, r as normalizedObservableValue, t as usefulOutputSchema, u as FileObservedOutputShapeStore } from "./observed-output-shapes-DuP7mJQf.js";
 import { createRequire } from "node:module";
@@ -26005,7 +26005,11 @@ const capletExposureSchema = _enum([
 	"direct_and_code_mode",
 	"progressive_and_code_mode"
 ]).describe("How this Caplet is exposed to agents.");
-const capletShadowingSchema = _enum(["forbid", "allow"]).describe("Whether attached local Caplets may shadow this remote Caplet ID.");
+const capletShadowingSchema = _enum([
+	"forbid",
+	"allow",
+	"namespace"
+]).describe("Whether attached local Caplets may shadow this remote Caplet ID.");
 const capletEndpointAuthSchema = discriminatedUnion("type", [
 	object$1({ type: literal("none") }).strict(),
 	object$1({
@@ -27288,7 +27292,33 @@ const exposureSchema = _enum([
 	"direct_and_code_mode",
 	"progressive_and_code_mode"
 ]).describe("How this Caplet is exposed to agents.");
-const shadowingSchema = _enum(["forbid", "allow"]).default("forbid").describe("Whether attached local Caplets may shadow this remote Caplet ID.");
+const shadowingSchema = _enum([
+	"forbid",
+	"allow",
+	"namespace"
+]).default("forbid").describe("Whether attached local Caplets may shadow this remote Caplet ID.");
+const namespaceAliasLabelSchema = string().regex(NAMESPACE_ALIAS_LABEL_PATTERN, "namespace alias labels must be lowercase DNS-style labels using letters, numbers, or hyphens").describe("Namespace label used when qualifying colliding Caplet IDs.");
+const namespaceAliasesSchema = object$1({
+	local: namespaceAliasLabelSchema.optional(),
+	upstreams: record(string().trim().min(1), namespaceAliasLabelSchema).default({}).describe("Namespace aliases keyed by durable upstream source identity.")
+}).strict().default({ upstreams: {} }).superRefine((aliases, ctx) => {
+	const seen = /* @__PURE__ */ new Map();
+	const addAlias = (value, path) => {
+		if (!value) return;
+		const existing = seen.get(value);
+		if (existing) {
+			ctx.addIssue({
+				code: "custom",
+				path,
+				message: `namespace alias '${value}' is already used at ${existing.join(".")}`
+			});
+			return;
+		}
+		seen.set(value, path);
+	};
+	addAlias(aliases.local, ["local"]);
+	for (const [selector, alias] of Object.entries(aliases.upstreams)) addAlias(alias, ["upstreams", selector]);
+}).describe("Source-level namespace aliases for hash-qualified Caplet IDs.");
 const publicServerSchema = object$1({
 	name: string().trim().min(1).max(80).describe("Human-readable server display name."),
 	description: string().describe("Capability description shown to agents before downstream tools are disclosed.").refine((value) => value.trim().length >= 10, "description must contain at least 10 non-whitespace characters").refine((value) => value.length <= 1500, "description must be at most 1500 characters"),
@@ -27545,6 +27575,7 @@ function configSchemaFor(serverValueSchema, openApiEndpointValueSchema, googleDi
 			exposureDiscoveryTimeoutMs: 15e3,
 			exposureDiscoveryConcurrency: 4
 		}).describe("Global Caplets runtime options."),
+		namespaceAliases: namespaceAliasesSchema,
 		mcpServers: record(string().regex(SERVER_ID_PATTERN), serverValueSchema).default({}).describe("Downstream MCP servers keyed by stable server ID."),
 		openapiEndpoints: record(string().regex(SERVER_ID_PATTERN), openApiEndpointValueSchema).default({}).describe("OpenAPI endpoints keyed by stable Caplet ID."),
 		googleDiscoveryApis: record(string().regex(SERVER_ID_PATTERN), googleDiscoveryApiValueSchema).default({}).describe("Google Discovery APIs keyed by stable Caplet ID."),
@@ -28321,6 +28352,7 @@ function mergeConfigInputs(...inputs) {
 		merged = {
 			...merged,
 			...input,
+			namespaceAliases: mergeNamespaceAliases(merged?.namespaceAliases, input.namespaceAliases),
 			mcpServers: {
 				...merged?.mcpServers,
 				...input.mcpServers
@@ -28353,6 +28385,23 @@ function mergeConfigInputs(...inputs) {
 	}
 	return merged;
 }
+function mergeNamespaceAliases(left, right) {
+	if (right !== void 0 && !isPlainObject$5(right)) return right;
+	if (left !== void 0 && !isPlainObject$5(left)) return left;
+	if (!isPlainObject$5(left) && !isPlainObject$5(right)) return;
+	const leftRecord = isPlainObject$5(left) ? left : void 0;
+	const rightRecord = isPlainObject$5(right) ? right : void 0;
+	const leftUpstreams = isPlainObject$5(leftRecord?.upstreams) ? leftRecord.upstreams : void 0;
+	const rightUpstreams = isPlainObject$5(rightRecord?.upstreams) ? rightRecord.upstreams : void 0;
+	return stripUndefined({
+		...leftRecord,
+		...rightRecord,
+		upstreams: {
+			...leftUpstreams,
+			...rightUpstreams
+		}
+	});
+}
 function mergeConfigInputsWithSources(...inputs) {
 	let merged = {};
 	const sources = {};
@@ -28477,6 +28526,10 @@ function parseConfig(input, options = {}) {
 			exposureDiscoveryConcurrency: parsed.data.options.exposureDiscoveryConcurrency,
 			completion: parsed.data.completion
 		},
+		namespaceAliases: stripUndefined({
+			local: parsed.data.namespaceAliases.local,
+			upstreams: parsed.data.namespaceAliases.upstreams
+		}),
 		mcpServers: servers,
 		openapiEndpoints,
 		googleDiscoveryApis,
@@ -64028,7 +64081,7 @@ var CapletsEngine = class {
 		}
 	}
 	async completeCliWords(words) {
-		const { completeCliWords } = await import("./completion-DaYL-XQN.js").then((n) => n.r);
+		const { completeCliWords } = await import("./completion-1wDjwHkC.js").then((n) => n.r);
 		return await completeCliWords(words, {
 			config: this.registry.config,
 			managers: {
@@ -81409,7 +81462,7 @@ function primitiveInvokeInput(capletId, operation, input) {
 function toolsFromManifest(manifest) {
 	const codeModeCaplets = manifest.codeModeCaplets ?? [];
 	const codeModeMarker = attachCodeModeMarker(codeModeCaplets);
-	const codeModeShadowing = codeModeCaplets.some((entry) => entry.shadowing === "forbid") ? "forbid" : "allow";
+	const codeModeShadowing = codeModeCaplets.some((entry) => entry.shadowing === "forbid") ? "forbid" : codeModeCaplets.some((entry) => entry.shadowing === "namespace") ? "namespace" : "allow";
 	return [
 		...manifest.caplets.map((entry) => ({
 			name: entry.capletId,
@@ -81700,13 +81753,129 @@ function isAuthFailure(error) {
 }
 function isPermanentRemoteCredentialsError(error) {
 	const candidate = error;
-	if (candidate?.projectBindingCode === "remote_credentials_required" || candidate?.projectBindingCode === "remote_auth_failed") return true;
+	if (isPermanentRemoteCredentialsCode(candidate?.projectBindingCode)) return true;
 	if (isPlainObject(candidate?.details)) {
 		const code = candidate.details.code;
-		if (code === "remote_credentials_required" || code === "remote_auth_failed") return true;
+		if (isPermanentRemoteCredentialsCode(code)) return true;
 	}
 	return isAuthFailure(error);
 }
+function isPermanentRemoteCredentialsCode(code) {
+	return code === "remote_credentials_required" || code === "remote_credentials_revoked" || code === "remote_auth_failed";
+}
+//#endregion
+//#region src/exposure/namespace.ts
+function resolveNamespaceExposure(entries, options = {}) {
+	const hashLength = options.hashLength ?? 4;
+	const maxHashLength = options.maxHashLength ?? 8;
+	const groups = groupByBaseId(entries);
+	const visibleRecords = [];
+	const suppressedBareIds = /* @__PURE__ */ new Map();
+	const unavailableDiagnostics = [];
+	const reservedBareIds = new Set(groups.keys());
+	for (const [baseId, group] of groups) {
+		if (group.length === 1) {
+			visibleRecords.push(visibleRecord(group[0], baseId, false));
+			continue;
+		}
+		if (!isNamespaceCollisionGroup(group)) {
+			visibleRecords.push(visibleRecord(nonNamespaceWinner(group), baseId, false));
+			continue;
+		}
+		const diagnostics = validateNamespaceGroup(baseId, group);
+		if (diagnostics.length > 0) {
+			unavailableDiagnostics.push(...diagnostics);
+			continue;
+		}
+		const resolved = qualifyNamespaceGroup(group, {
+			baseId,
+			hashLength,
+			maxHashLength,
+			reservedBareIds
+		});
+		if ("diagnostic" in resolved) {
+			unavailableDiagnostics.push(resolved.diagnostic);
+			continue;
+		}
+		visibleRecords.push(...resolved.records);
+		suppressedBareIds.set(baseId, diagnostic(baseId, "namespace_collision", group, resolved.records.map((record) => record.id)));
+	}
+	return {
+		visibleRecords,
+		routes: new Map(visibleRecords.map((record) => [record.id, record.route])),
+		suppressedBareIds,
+		unavailableDiagnostics
+	};
+}
+function groupByBaseId(entries) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) groups.set(entry.baseId, [...groups.get(entry.baseId) ?? [], entry]);
+	return groups;
+}
+function isNamespaceCollisionGroup(group) {
+	const upstreams = group.filter((entry) => entry.sourceKind === "upstream");
+	return upstreams.length > 0 && upstreams.every((entry) => entry.shadowing === "namespace");
+}
+function nonNamespaceWinner(group) {
+	const forbiddingUpstream = group.find((entry) => entry.sourceKind === "upstream" && entry.shadowing === "forbid");
+	if (forbiddingUpstream) return forbiddingUpstream;
+	const local = group.find((entry) => entry.sourceKind === "local");
+	if (local) return local;
+	return group.find((entry) => entry.sourceKind === "upstream") ?? group[0];
+}
+function validateNamespaceGroup(baseId, group) {
+	const diagnostics = [];
+	for (const entry of group) {
+		if (!entry.durableSourceIdentity) {
+			diagnostics.push(diagnostic(baseId, "missing_durable_source_identity", group, []));
+			break;
+		}
+		if (entry.namespaceAlias && !NAMESPACE_ALIAS_LABEL_PATTERN.test(entry.namespaceAlias)) {
+			diagnostics.push(diagnostic(baseId, "namespace_alias_invalid", group, []));
+			break;
+		}
+	}
+	return diagnostics;
+}
+function qualifyNamespaceGroup(group, options) {
+	const ids = group.map((entry) => qualifiedId(entry, options.baseId, options.hashLength));
+	if (!(new Set(ids).size !== ids.length || ids.some((id) => options.reservedBareIds.has(id) || !SERVER_ID_PATTERN.test(id)))) return { records: group.map((entry, index) => visibleRecord(entry, ids[index], true)) };
+	return { diagnostic: diagnostic(options.baseId, "generated_id_collision", group, []) };
+}
+function qualifiedId(entry, baseId, hashLength) {
+	return `${namespaceLabel(entry)}-${createHash("sha256").update(entry.durableSourceIdentity ?? "").digest("hex").slice(0, hashLength)}__${baseId}`;
+}
+function visibleRecord(entry, id, namespaced) {
+	return {
+		...entry,
+		id,
+		label: namespaceLabel(entry),
+		namespaced
+	};
+}
+function namespaceLabel(entry) {
+	return entry.namespaceAlias ?? entry.sourceLabel ?? entry.sourceKind;
+}
+function diagnostic(requestedId, reason, group, alternatives) {
+	return {
+		requestedId,
+		reason,
+		alternatives,
+		sources: group.map((entry) => ({
+			sourceKind: entry.sourceKind,
+			label: namespaceLabel(entry),
+			...entry.durableSourceIdentity ? { durableSourceIdentity: entry.durableSourceIdentity } : {}
+		})),
+		hint: diagnosticHint(requestedId, reason, alternatives)
+	};
+}
+function diagnosticHint(requestedId, reason, alternatives) {
+	if (reason === "namespace_collision") return `Caplet '${requestedId}' is unavailable because namespace shadowing exposes qualified alternatives: ${alternatives.join(", ")}.`;
+	if (reason === "missing_durable_source_identity") return `Caplet '${requestedId}' could not be namespaced because at least one source has no durable identity.`;
+	if (reason === "namespace_alias_invalid") return `Caplet '${requestedId}' could not be namespaced because an alias label is invalid.`;
+	if (reason === "unsupported_protocol") return `Caplet '${requestedId}' could not be namespaced because a source protocol cannot represent namespace metadata.`;
+	return `Caplet '${requestedId}' could not be namespaced because generated qualified IDs were not unique.`;
+}
 //#endregion
 //#region src/cloud-auth/errors.ts
 const SECRET_PATTERN = /(cap_access_[a-z0-9._~+/=-]+|cap_refresh_[a-z0-9._~+/=-]+|one_time_code_[a-z0-9._~+/=-]+|Bearer\s+)[^\s"]*/giu;
@@ -81869,6 +82038,7 @@ const PROJECT_BINDING_ERROR_CODES = [
 	"subscription_past_due",
 	"email_verification_required",
 	"remote_credentials_required",
+	"remote_credentials_revoked",
 	"remote_auth_failed"
 ];
 var ProjectBindingError = class extends CapletsError {
@@ -81902,6 +82072,7 @@ function recoveryCommandFor(code) {
 		case "workspace_switch_required": return "caplets remote login <cloud-url> --workspace <workspace>";
 		case "sync_size_limit_exceeded": return "Add exclusions to .capletsignore or upgrade the workspace plan.";
 		case "remote_credentials_required":
+		case "remote_credentials_revoked":
 		case "remote_auth_failed": return "caplets remote login <url>";
 		case "endpoint_unavailable":
 		case "websocket_upgrade_required": return "caplets doctor";
@@ -82079,6 +82250,7 @@ function remoteProfileStatus(input) {
 		kind: input.kind,
 		key,
 		hostUrl,
+		...input.hostIdentity ? { hostIdentity: input.hostIdentity } : {},
 		...input.workspaceId ? { workspaceId: input.workspaceId } : {},
 		...input.workspaceSlug ? { workspaceSlug: input.workspaceSlug } : {},
 		...input.clientId ? { clientId: input.clientId } : {},
@@ -82136,7 +82308,9 @@ var FileRemoteProfileStore = class {
 			kind: "self-hosted",
 			hostUrl: normalizeRemoteProfileHostUrl(input.hostUrl)
 		});
-		return this.statusByKey(key, false);
+		const status = await this.statusByKey(key, false);
+		assertHostIdentityMatches(status, input.hostIdentity);
+		return status;
 	}
 	async logoutSelfHostedProfile(input) {
 		return await this.withMutationLock(async () => {
@@ -82205,7 +82379,7 @@ var FileRemoteProfileStore = class {
 		}
 		const selected = this.readSelectedWorkspace(hostUrl);
 		if (selected) return this.statusByKey(selected.profileKey, true);
-		if (this.listProfilesForHost(hostUrl).length > 0) throw new CapletsError("REQUEST_INVALID", "Cloud Remote Profile requires a selected or explicit workspace.");
+		if (this.listProfilesForHost(hostUrl).length > 0) throw cloudWorkspaceAmbiguityError();
 		return this.migrateLegacyCloudProfile(hostUrl);
 	}
 	async listCloudProfileStatuses(hostUrlInput) {
@@ -82233,7 +82407,7 @@ var FileRemoteProfileStore = class {
 			let key;
 			if (workspace) key = this.listProfilesForHost(hostUrl).find((profile) => profileMatchesWorkspace(profile, workspace))?.key;
 			else if (selected) key = selected.profileKey;
-			else if (this.listProfilesForHost(hostUrl).length > 0) throw new CapletsError("REQUEST_INVALID", "Cloud Remote Profile requires a selected or explicit workspace.");
+			else if (this.listProfilesForHost(hostUrl).length > 0) throw cloudWorkspaceAmbiguityError();
 			if (!key) return false;
 			const profile = this.readProfile(key);
 			await this.credentials.delete(key);
@@ -82273,7 +82447,7 @@ var FileRemoteProfileStore = class {
 		else {
 			const selected = this.readSelectedWorkspace(hostUrl);
 			if (selected) status = await this.statusByKey(selected.profileKey, true);
-			else if (this.listProfilesForHost(hostUrl).length > 0) throw new CapletsError("REQUEST_INVALID", "Cloud Remote Profile requires a selected or explicit workspace.");
+			else if (this.listProfilesForHost(hostUrl).length > 0) throw cloudWorkspaceAmbiguityError();
 		}
 		if (!status) return void 0;
 		const credential = await this.credentials.load(status.key);
@@ -82326,6 +82500,7 @@ var FileRemoteProfileStore = class {
 			kind: profile.kind,
 			key: profile.key,
 			hostUrl: profile.hostUrl,
+			hostIdentity: profile.hostIdentity,
 			workspaceId: profile.workspaceId,
 			workspaceSlug: profile.workspaceSlug,
 			clientId: profile.clientId,
@@ -82346,11 +82521,13 @@ var FileRemoteProfileStore = class {
 		});
 		const now = (input.now ?? /* @__PURE__ */ new Date()).toISOString();
 		const existing = this.readProfile(key);
+		const hostIdentity = input.hostIdentity ?? existing?.hostIdentity;
 		const profile = {
 			version: 1,
 			kind: "self-hosted",
 			key,
 			hostUrl,
+			...hostIdentity ? { hostIdentity } : {},
 			clientId: input.clientId,
 			...input.clientLabel ? { clientLabel: input.clientLabel } : {},
 			createdAt: existing?.createdAt ?? now,
@@ -82523,6 +82700,14 @@ function legacyCredential(credentials) {
 		...credentials.tokenType ? { tokenType: credentials.tokenType } : {}
 	};
 }
+function assertHostIdentityMatches(status, expectedHostIdentity) {
+	if (!status || !expectedHostIdentity || !status.hostIdentity) return;
+	if (status.hostIdentity === expectedHostIdentity) return;
+	throw new CapletsError("AUTH_FAILED", "Remote Profile belongs to a different host identity.");
+}
+function cloudWorkspaceAmbiguityError() {
+	return new CapletsError("REQUEST_INVALID", "Cloud Remote Profile requires a selected or explicit workspace.", { reason: "cloud_workspace_ambiguous" });
+}
 function parseStoredRemoteProfile(value) {
 	if (!isRecord$1(value)) return void 0;
 	if (value.version !== 1) return void 0;
@@ -82535,6 +82720,7 @@ function parseStoredRemoteProfile(value) {
 		kind: value.kind,
 		key: value.key,
 		hostUrl: value.hostUrl,
+		...typeof value.hostIdentity === "string" ? { hostIdentity: value.hostIdentity } : {},
 		...typeof value.workspaceId === "string" ? { workspaceId: value.workspaceId } : {},
 		...typeof value.workspaceSlug === "string" ? { workspaceSlug: value.workspaceSlug } : {},
 		...typeof value.clientId === "string" ? { clientId: value.clientId } : {},
@@ -82621,11 +82807,11 @@ async function resolveRemoteSelection(input = {}, env = process.env) {
 	const explicitWorkspace = input.workspace ?? (workspaceFromRemoteUrl ? void 0 : env.CAPLETS_REMOTE_WORKSPACE);
 	const profileWorkspace = workspaceFromRemoteUrl ?? explicitWorkspace;
 	const normalizedRemoteUrl = normalizeRemoteProfileHostUrl(remoteUrl);
-	let status = await store.getCloudProfileStatus({
+	let status = await getCloudProfileStatusForSelection(store, {
 		hostUrl: normalizedRemoteUrl,
 		workspace: profileWorkspace
 	});
-	if (!status && profileWorkspace) status = await store.getCloudProfileStatus({ hostUrl: normalizedRemoteUrl });
+	if (!status && profileWorkspace) status = await getCloudProfileStatusForSelection(store, { hostUrl: normalizedRemoteUrl });
 	let credential = status ? await store.credentials.load(status.key) : void 0;
 	if (!status || !credential?.accessToken) throw projectBindingError("cloud_auth_required");
 	let credentials = cloudCredentialsFromRemoteProfile(status, credential);
@@ -82703,7 +82889,7 @@ async function refreshSelfHostedCredentials(remoteUrl, refreshToken, options) {
 }
 async function selfHostedRefreshError(remoteUrl, response) {
 	const summary = await parseSelfHostedRefreshError(response);
-	if (response.status === 401 || summary?.code === "AUTH_FAILED") return remoteLoginRequired(remoteUrl);
+	if (response.status === 401 || summary?.code === "AUTH_FAILED" || summary?.code === "REMOTE_CREDENTIALS_REVOKED") return selfHostedRefreshLooksRevoked(summary) ? remoteLoginRevoked(remoteUrl) : remoteLoginRequired(remoteUrl);
 	if (response.status === 503 || summary?.code === "SERVER_UNAVAILABLE") return new CapletsError("SERVER_UNAVAILABLE", summary?.message ?? "Remote credential refresh is temporarily unavailable.");
 	return new CapletsError("AUTH_REFRESH_FAILED", summary?.message ?? `Remote credential refresh failed with HTTP ${response.status}.`);
 }
@@ -82749,6 +82935,30 @@ function remoteLoginRequired(remoteUrl) {
 		recoveryCommand: `caplets remote login ${normalizeRemoteProfileHostUrl(remoteUrl)}`
 	});
 }
+function remoteLoginRevoked(remoteUrl) {
+	const normalizedUrl = normalizeRemoteProfileHostUrl(remoteUrl);
+	return new ProjectBindingError({
+		code: "remote_credentials_revoked",
+		message: `Remote credentials for ${normalizedUrl} were revoked or rejected. Run Remote Login again and ask the server operator to approve the pending login.`,
+		recoveryCommand: `caplets remote login ${normalizedUrl}`
+	});
+}
+function selfHostedRefreshLooksRevoked(summary) {
+	if (summary?.code === "REMOTE_CREDENTIALS_REVOKED") return true;
+	return /revoked|rejected|stale/iu.test(summary?.message ?? "");
+}
+async function getCloudProfileStatusForSelection(store, input) {
+	try {
+		return await store.getCloudProfileStatus(input);
+	} catch (error) {
+		if (isCloudWorkspaceAmbiguity(error)) throw projectBindingError("workspace_switch_required", "Cloud Remote Profile requires a selected or explicit workspace.");
+		throw error;
+	}
+}
+function isCloudWorkspaceAmbiguity(error) {
+	const details = error instanceof CapletsError ? error.details : void 0;
+	return error instanceof CapletsError && error.code === "REQUEST_INVALID" && typeof details === "object" && details !== null && !Array.isArray(details) && details.reason === "cloud_workspace_ambiguous";
+}
 async function parseSelfHostedRefreshCredentials(response) {
 	const parsed = await response.json();
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CapletsError("DOWNSTREAM_PROTOCOL_ERROR", "Remote refresh response must be an object.");
@@ -83153,7 +83363,7 @@ function createLocalOverlayService(options) {
 }
 function createCompositeRemoteService(remoteOptions, local, options, authKind) {
 	const { remote, presence } = createCompositeRemoteParts(remoteOptions, local, options, authKind);
-	return new CompositeNativeCapletsService(remote, local, options, presence);
+	return new CompositeNativeCapletsService(remote, local, options, remoteOptions.url.toString(), presence);
 }
 function createCompositeRemoteParts(remoteOptions, local, options, authKind, resolveRuntimeRemoteOptions) {
 	const remote = new RemoteNativeCapletsService({
@@ -83245,7 +83455,7 @@ var ProfileBackedNativeCapletsService = class {
 			const signature = remoteOptionsSignature(remoteOptions);
 			if (!this.delegate) {
 				const { remote, presence } = createCompositeRemoteParts(remoteOptions, this.local, this.options, this.authKind, () => this.resolveProfileRemoteOptions());
-				this.delegate = new CompositeNativeCapletsService(remote, this.local, this.options, presence);
+				this.delegate = new CompositeNativeCapletsService(remote, this.local, this.options, remoteOptions.url.toString(), presence);
 				this.unsubscribeDelegate = this.delegate.onToolsChanged((tools) => this.emit(tools));
 				this.remoteSignature = signature;
 				this.credentialExpiresAt = remoteOptions.credentialExpiresAt;
@@ -83257,7 +83467,7 @@ var ProfileBackedNativeCapletsService = class {
 				await Promise.all([remote.close(), presence?.close()]);
 				return;
 			}
-			await this.delegate.replaceRemote(remote, presence);
+			await this.delegate.replaceRemote(remote, remoteOptions.url.toString(), presence);
 			this.remoteSignature = signature;
 			this.credentialExpiresAt = remoteOptions.credentialExpiresAt;
 		} catch (error) {
@@ -83342,23 +83552,30 @@ var CompositeNativeCapletsService = class {
 	remote;
 	local;
 	options;
+	remoteIdentity;
 	presence;
 	listeners = /* @__PURE__ */ new Set();
 	unsubscribeRemote;
 	unsubscribeLocal;
 	warnedShadowedLocalCaplets = /* @__PURE__ */ new Set();
 	tools = [];
+	routes = /* @__PURE__ */ new Map();
+	namespaceDiagnostics = /* @__PURE__ */ new Map();
 	closed = false;
 	batchingReload = false;
 	codeModeSessions = new CodeModeSessionManager();
-	constructor(remote, local, options, presence) {
+	constructor(remote, local, options, remoteIdentity, presence) {
 		this.remote = remote;
 		this.local = local;
 		this.options = options;
+		this.remoteIdentity = remoteIdentity;
 		this.presence = presence;
 		this.unsubscribeRemote = this.remote.onToolsChanged(() => this.updateMergedTools());
 		this.unsubscribeLocal = this.local.onToolsChanged(() => this.updateMergedTools());
-		this.tools = this.mergeTools();
+		const merged = this.mergeTools();
+		this.tools = merged.tools;
+		this.routes = merged.routes;
+		this.namespaceDiagnostics = merged.namespaceDiagnostics;
 		this.startPresence();
 	}
 	listTools() {
@@ -83366,7 +83583,11 @@ var CompositeNativeCapletsService = class {
 	}
 	async execute(capletId, request) {
 		if (capletId === "code_mode") return await executeCodeModeRunNative(this, request, this.codeModeSessions);
-		if (this.localCanExecute(capletId)) return await this.local.execute(capletId, request);
+		const route = this.routes.get(capletId);
+		if (route?.service === "local") return await this.local.execute(route.capletId, request);
+		if (route?.service === "remote") return await this.remote.execute(route.capletId, request);
+		const diagnostic = this.namespaceDiagnostics.get(capletId);
+		if (diagnostic) throw new CapletsError("CAPLET_NAMESPACE_COLLISION", diagnostic.hint, diagnostic);
 		return await this.remote.execute(capletId, request);
 	}
 	codeModeService() {
@@ -83407,16 +83628,19 @@ var CompositeNativeCapletsService = class {
 			this.presence?.close()
 		]);
 	}
-	async replaceRemote(remote, presence) {
+	async replaceRemote(remote, remoteIdentityOrPresence, presence) {
+		const remoteIdentity = typeof remoteIdentityOrPresence === "string" ? remoteIdentityOrPresence : this.remoteIdentity;
+		const nextPresence = typeof remoteIdentityOrPresence === "string" ? presence : remoteIdentityOrPresence;
 		if (this.closed) {
-			await Promise.all([remote.close(), presence?.close()]);
+			await Promise.all([remote.close(), nextPresence?.close()]);
 			return;
 		}
 		const previousRemote = this.remote;
 		const previousPresence = this.presence;
 		this.unsubscribeRemote();
 		this.remote = remote;
-		this.presence = presence;
+		this.remoteIdentity = remoteIdentity;
+		this.presence = nextPresence;
 		this.unsubscribeRemote = this.remote.onToolsChanged(() => this.updateMergedTools());
 		await Promise.all([previousRemote.close(), previousPresence?.close()]);
 		if (this.closed) return;
@@ -83425,9 +83649,15 @@ var CompositeNativeCapletsService = class {
 	}
 	updateMergedTools() {
 		if (this.closed || this.batchingReload) return;
-		const tools = this.mergeTools();
-		if (JSON.stringify(tools) === JSON.stringify(this.tools)) return;
-		this.tools = tools;
+		const merged = this.mergeTools();
+		if (JSON.stringify(merged.tools) === JSON.stringify(this.tools)) {
+			this.routes = merged.routes;
+			this.namespaceDiagnostics = merged.namespaceDiagnostics;
+			return;
+		}
+		this.tools = merged.tools;
+		this.routes = merged.routes;
+		this.namespaceDiagnostics = merged.namespaceDiagnostics;
 		for (const listener of this.listeners) try {
 			listener(this.listTools());
 		} catch (error) {
@@ -83439,16 +83669,89 @@ var CompositeNativeCapletsService = class {
 		const allRemoteTools = this.remote.listTools();
 		const remoteCodeModeTools = remoteCodeModeCallableNativeTools(allRemoteTools);
 		const remoteIds = remoteSuppressedCapletIds(allRemoteTools, remoteCodeModeTools);
-		const localTools = allLocalTools.filter((tool) => tool.codeModeRun !== true && !remoteIds.has(tool.sourceCaplet ?? tool.caplet));
+		const unsuppressedLocalTools = allLocalTools.filter((tool) => tool.codeModeRun !== true && !remoteIds.has(tool.sourceCaplet ?? tool.caplet));
 		this.warnShadowedLocalCaplets(allLocalTools, remoteIds);
-		const localCodeModeTools = codeModeCallableNativeTools(allLocalTools, { fallbackToVisible: false }).filter((tool) => !remoteIds.has(tool.caplet));
-		const mergedTools = [...allRemoteTools.filter((tool) => tool.codeModeRun !== true), ...localTools];
-		const codeModeTools = [...remoteCodeModeTools, ...localCodeModeTools];
-		return [...mergedTools, ...codeModeTools.length > 0 ? [codeModeRunNativeTool(codeModeTools)] : []];
+		const unsuppressedLocalCodeModeTools = codeModeCallableNativeTools(allLocalTools, { fallbackToVisible: false }).filter((tool) => !remoteIds.has(tool.caplet));
+		const remoteTools = allRemoteTools.filter((tool) => tool.codeModeRun !== true);
+		const resolved = this.resolveVisibleToolIds(remoteTools, unsuppressedLocalTools, remoteCodeModeTools, unsuppressedLocalCodeModeTools);
+		const codeModeTools = [...resolved.remoteCodeModeTools, ...resolved.localCodeModeTools];
+		return {
+			tools: [
+				...resolved.remoteTools,
+				...resolved.localTools,
+				...codeModeTools.length > 0 ? [codeModeRunNativeTool(codeModeTools)] : []
+			],
+			routes: resolved.routes,
+			namespaceDiagnostics: resolved.namespaceDiagnostics
+		};
 	}
-	localCanExecute(capletId) {
-		const remoteIds = remoteSuppressedCapletIds(this.remote.listTools());
-		return localExecutionKeys(this.local.listTools(), capletId).some((key) => !remoteIds.has(key));
+	resolveVisibleToolIds(remoteTools, localTools, remoteCodeModeTools, localCodeModeTools) {
+		const resolution = resolveNamespaceExposure(nativeNamespaceEntries([{
+			service: "remote",
+			tools: [...remoteTools, ...remoteCodeModeTools]
+		}, {
+			service: "local",
+			tools: [...localTools, ...localCodeModeTools]
+		}], {
+			...nativeNamespaceContext(this.options),
+			remoteIdentity: this.remoteIdentity
+		}));
+		const namespacedRecords = resolution.visibleRecords.filter((record) => record.namespaced);
+		const namespacedBaseIds = new Set(namespacedRecords.map((record) => record.baseId));
+		const diagnosticBaseIds = new Set(resolution.unavailableDiagnostics.map((diagnostic) => diagnostic.requestedId));
+		const routes = /* @__PURE__ */ new Map();
+		const namespaceDiagnostics = new Map(resolution.suppressedBareIds);
+		for (const diagnostic of resolution.unavailableDiagnostics) namespaceDiagnostics.set(diagnostic.requestedId, diagnostic);
+		const alternativesByBaseId = /* @__PURE__ */ new Map();
+		const staleIdsByBaseId = /* @__PURE__ */ new Map();
+		const setRoute = (visibleCapletId, route, overwrite) => {
+			if (overwrite || !routes.has(visibleCapletId)) routes.set(visibleCapletId, route);
+		};
+		const rewrite = (service, tools, overwrite) => {
+			const rewritten = [];
+			for (const tool of tools) {
+				const baseId = sourceBaseId(tool);
+				if (diagnosticBaseIds.has(baseId)) continue;
+				if (!namespacedBaseIds.has(baseId)) {
+					rewritten.push(tool);
+					setRoute(tool.caplet, {
+						service,
+						capletId: tool.caplet
+					}, overwrite);
+					continue;
+				}
+				const record = namespacedRecords.find((candidate) => candidate.baseId === baseId && candidate.route.service === service);
+				if (!record) continue;
+				const visibleTool = renameNativeTool(tool, record.id);
+				rewritten.push(visibleTool);
+				addMapSetValue(alternativesByBaseId, baseId, visibleTool.caplet);
+				if (tool.caplet !== visibleTool.caplet) addMapSetValue(staleIdsByBaseId, baseId, tool.caplet);
+				setRoute(visibleTool.caplet, {
+					service,
+					capletId: tool.caplet
+				}, overwrite);
+			}
+			return rewritten;
+		};
+		const remoteVisibleTools = rewrite("remote", remoteTools, false);
+		const localVisibleTools = rewrite("local", localTools, true);
+		const remoteVisibleCodeModeTools = rewrite("remote", remoteCodeModeTools, false);
+		const localVisibleCodeModeTools = rewrite("local", localCodeModeTools, true);
+		for (const [baseId, alternatives] of alternativesByBaseId) {
+			const baseDiagnostic = resolution.suppressedBareIds.get(baseId);
+			if (!baseDiagnostic) continue;
+			const alternativeList = [...alternatives];
+			namespaceDiagnostics.set(baseId, namespaceDiagnosticWithAlternatives(baseId, baseDiagnostic, alternativeList));
+			for (const staleId of staleIdsByBaseId.get(baseId) ?? []) namespaceDiagnostics.set(staleId, namespaceDiagnosticWithAlternatives(staleId, baseDiagnostic, alternativeList));
+		}
+		return {
+			remoteTools: remoteVisibleTools,
+			localTools: localVisibleTools,
+			remoteCodeModeTools: remoteVisibleCodeModeTools,
+			localCodeModeTools: localVisibleCodeModeTools,
+			routes,
+			namespaceDiagnostics
+		};
 	}
 	warnShadowedLocalCaplets(localTools, remoteIds) {
 		const localIds = /* @__PURE__ */ new Set([...localTools.filter((tool) => tool.codeModeRun !== true).map((tool) => tool.sourceCaplet ?? tool.caplet), ...codeModeCallableNativeTools(localTools, { fallbackToVisible: false }).map((tool) => tool.caplet)]);
@@ -83473,22 +83776,85 @@ var CompositeNativeCapletsService = class {
 		});
 	}
 };
-function remoteCodeModeCallableNativeTools(tools) {
-	return codeModeCallableNativeTools(tools, { fallbackToVisible: true });
+function addMapSetValue(map, key, value) {
+	let values = map.get(key);
+	if (!values) {
+		values = /* @__PURE__ */ new Set();
+		map.set(key, values);
+	}
+	values.add(value);
 }
-function remoteSuppressedCapletIds(allRemoteTools, remoteCodeModeTools = remoteCodeModeCallableNativeTools(allRemoteTools)) {
-	return new Set([...allRemoteTools.filter((tool) => tool.codeModeRun !== true && tool.shadowing !== "allow").map((tool) => tool.sourceCaplet ?? tool.caplet), ...remoteCodeModeTools.filter((tool) => tool.shadowing !== "allow").map((tool) => tool.caplet)].filter((caplet) => caplet !== nativeCodeModeToolId));
+function namespaceDiagnosticWithAlternatives(requestedId, diagnostic, alternatives) {
+	return {
+		...diagnostic,
+		requestedId,
+		alternatives,
+		hint: `Caplet '${requestedId}' is unavailable because namespace shadowing exposes qualified alternatives: ${alternatives.join(", ")}.`
+	};
 }
-function localExecutionKeys(tools, capletId) {
-	const keys = [];
-	for (const tool of tools) {
-		if (tool.codeModeRun) {
-			for (const caplet of tool.codeModeCaplets ?? []) if (caplet.id === capletId) keys.push(caplet.id);
-			continue;
+function nativeNamespaceContext(options) {
+	const configPath = options.configPath ?? resolveConfigPath();
+	const projectConfigPath = options.projectConfigPath ?? resolveProjectConfigPath();
+	let namespaceAliases = parseConfig({}).namespaceAliases;
+	try {
+		namespaceAliases = loadLocalOverlayConfigWithSources(configPath, projectConfigPath).config.namespaceAliases;
+	} catch {}
+	return {
+		localIdentity: `local:${configPath}\0${projectConfigPath}`,
+		namespaceAliases
+	};
+}
+function nativeNamespaceEntries(groups, identities) {
+	const entries = /* @__PURE__ */ new Map();
+	for (const group of groups) {
+		const byBaseId = /* @__PURE__ */ new Map();
+		for (const tool of group.tools) {
+			const baseId = sourceBaseId(tool);
+			byBaseId.set(baseId, [...byBaseId.get(baseId) ?? [], tool]);
+		}
+		for (const [baseId, tools] of byBaseId) {
+			const service = group.service;
+			entries.set(`${service}:${baseId}`, {
+				baseId,
+				sourceKind: service === "local" ? "local" : "upstream",
+				sourceLabel: service === "local" ? "local" : "remote",
+				namespaceAlias: service === "local" ? identities.namespaceAliases.local : identities.namespaceAliases.upstreams[identities.remoteIdentity],
+				durableSourceIdentity: service === "local" ? identities.localIdentity : identities.remoteIdentity,
+				shadowing: aggregateShadowing(tools),
+				route: {
+					service,
+					baseId
+				}
+			});
 		}
-		if (tool.caplet === capletId || tool.sourceCaplet === capletId) keys.push(tool.sourceCaplet ?? tool.caplet);
 	}
-	return keys;
+	return [...entries.values()];
+}
+function aggregateShadowing(tools) {
+	if (tools.some((tool) => (tool.shadowing ?? "forbid") === "forbid")) return "forbid";
+	if (tools.some((tool) => tool.shadowing === "namespace")) return "namespace";
+	return "allow";
+}
+function sourceBaseId(tool) {
+	return tool.sourceCaplet ?? tool.caplet;
+}
+function renameNativeTool(tool, visibleBaseId) {
+	const baseId = sourceBaseId(tool);
+	const visibleCapletId = tool.sourceCaplet && tool.caplet.startsWith(`${baseId}__`) ? `${visibleBaseId}${tool.caplet.slice(baseId.length)}` : visibleBaseId;
+	const operationName = tool.sourceCaplet && tool.caplet.startsWith(`${baseId}__`) ? tool.caplet.slice(baseId.length + 2) : void 0;
+	const toolName = operationName ? nativeDirectToolName(visibleBaseId, operationName) : nativeCapletToolName(visibleCapletId);
+	return {
+		...tool,
+		caplet: visibleCapletId,
+		...tool.sourceCaplet ? { sourceCaplet: visibleBaseId } : {},
+		toolName
+	};
+}
+function remoteCodeModeCallableNativeTools(tools) {
+	return codeModeCallableNativeTools(tools, { fallbackToVisible: true });
+}
+function remoteSuppressedCapletIds(allRemoteTools, remoteCodeModeTools = remoteCodeModeCallableNativeTools(allRemoteTools)) {
+	return new Set([...allRemoteTools.filter((tool) => tool.codeModeRun !== true && (tool.shadowing ?? "forbid") === "forbid").map((tool) => tool.sourceCaplet ?? tool.caplet), ...remoteCodeModeTools.filter((tool) => (tool.shadowing ?? "forbid") === "forbid").map((tool) => tool.caplet)].filter((caplet) => caplet !== nativeCodeModeToolId));
 }
 function createProjectBindingSessionManager(cloud, local, options) {
 	if (!cloud) return;
@@ -83547,4 +83913,4 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { resolveExposure as $, CallToolRequestSchema as $t, nativeCapletPromptGuidance as A, getLiteralValue as An, startOAuthFlow as At, CodeModeSessionManager as B, __exportAll as Bn, defaultStateBaseDir as Bt, resolveHostedCloudRemote as C, SetLevelRequestSchema as Cn, hasRenderableStructuredContent as Ct, isLoopbackHost as D, isJSONRPCErrorResponse as Dn, runGenericOAuthFlow as Dt, controlUrlForBase as E, isInitializeRequest as En, refreshOAuthTokenBundle as Et, nativeCodeModeToolName as F, isZ4Schema as Fn, DEFAULT_COMPLETION_CACHE_DIR as Ft, CodeModeJournalStore as G, ReadBuffer as Gt, diagnoseCodeModeTypeScript as H, resolveConfigPath as Ht, codeModeRunInputSchema as I, normalizeObjectSchema as In, DEFAULT_OBSERVED_OUTPUT_SHAPE_CACHE_DIR as It, codeModeDeclarationHash as J, assertToolsCallTaskCapability as Jt, CodeModeLogStore as K, serializeMessage as Kt, codeModeRunParamsSchema as L, objectFromShape as Ln, defaultCacheBaseDir as Lt, nativeCapletToolName as M, getParseErrorMessage as Mn, isTokenBundleExpired as Mt, nativeCapletsSystemGuidance as N, getSchemaDescription as Nn, readTokenBundle as Nt, parseServerBaseUrl as O, isJSONRPCRequest as On, runOAuthFlow as Ot, nativeCodeModeToolId as P, isSchemaOptional as Pn, DEFAULT_AUTH_DIR as Pt, CapletsEngine as Q, toJsonSchemaCompat as Qt, emptyCodeModeRunMeta as R, safeParse as Rn, defaultConfigBaseDir as Rt, resolveCapletsRemote as S, SUPPORTED_PROTOCOL_VERSIONS as Sn, loadCapletFilesFromMap as St, appendBasePath as T, assertCompleteRequestResourceTemplate as Tn, markdownStructuredContent as Tt, createCodeModeCapletsApi as U, resolveProjectCapletsRoot as Ut, QuickJsCodeModeSandbox as V, resolveCapletsRoot as Vt, listCodeModeCallableCaplets as W, resolveProjectConfigPath as Wt, generateCodeModeRunToolDescription as X, Protocol as Xt, generateCodeModeDeclarations as Y, AjvJsonSchemaValidator as Yt, minifyCodeModeDeclarationText as Z, mergeCapabilities as Zt, CapletsCloudClient as _, ListRootsResultSchema as _n, FileVaultStore as _t, CloudAuthStore as a, DEFAULT_NEGOTIATED_PROTOCOL_VERSION as an, ServerRegistry as at, isCapletsCloudUrl as b, McpError as bn, discoverCapletFiles as bt, redactedCloudAuthStatus as c, ErrorCode as cn, loadConfig as ct, projectBindingError as d, InitializedNotificationSchema as dn, loadLocalOverlayConfigWithSources as dt, CallToolResultSchema as en, decodeDirectResourceUri as et, projectBindingRecovery as f, JSONRPCMessageSchema as fn, loadProjectConfig as ft, buildProjectSyncManifest as g, ListResourcesRequestSchema as gn, vaultStoreForAuthDir as gt, createSdkRemoteCapletsClient as h, ListResourceTemplatesRequestSchema as hn, vaultResolverForAuthDir as ht, createRemoteProfileStore as i, CreateTaskResultSchema as in, handleServerTool as it, nativeCapletToolDescription as j, getObjectShape as jn, deleteTokenBundle as jt, resolveCapletsServer as k, isJSONRPCResultResponse as kn, startGenericOAuthFlow as kt, PROJECT_BINDING_ERROR_CODES as l, GetPromptRequestSchema as ln, loadConfigWithSources as lt, RemoteNativeCapletsService as m, ListPromptsRequestSchema as mn, vaultBootstrapResolver as mt, resolveRemoteSelection as n, CreateMessageResultSchema as nn, findProjectRoot as nt, cloudAuthPath as o, ElicitResultSchema as on, capabilityDescription as ot, CloudAuthClient as p, LATEST_PROTOCOL_VERSION as pn, parseConfig as pt, redactCodeModeLogText as q, assertClientRequestTaskCapability as qt, cloudCredentialsFromRemoteProfile as r, CreateMessageResultWithToolsSchema as rn, fingerprintProjectRoot as rt, migrateCredentials as s, EmptyResultSchema as sn, GoogleDiscoveryManager as st, createNativeCapletsService as t, CompleteRequestSchema as tn, directResourceUriMatchesTemplate as tt, ProjectBindingError as u, InitializeRequestSchema as un, loadGlobalConfig as ut, resolveNativeCapletsServiceOptions as v, ListToolsRequestSchema as vn, VAULT_MAX_VALUE_BYTES as vt, resolveRemoteMode as w, assertCompleteRequestPrompt as wn, markdownCallToolResultContent as wt, normalizeRemoteProfileHostUrl as x, ReadResourceRequestSchema as xn, validateCapletFile as xt, hostedCloudWorkspaceFromRemoteUrl as y, LoggingLevelSchema as yn, validateVaultKeyName as yt, runCodeMode as z, safeParseAsync as zn, defaultConfigPath as zt };
+export { resolveExposure as $, mergeCapabilities as $t, nativeCapletPromptGuidance as A, isJSONRPCRequest as An, runOAuthFlow as At, CodeModeSessionManager as B, safeParse as Bn, defaultConfigBaseDir as Bt, resolveHostedCloudRemote as C, ReadResourceRequestSchema as Cn, validateCapletFile as Ct, isLoopbackHost as D, assertCompleteRequestResourceTemplate as Dn, markdownStructuredContent as Dt, controlUrlForBase as E, assertCompleteRequestPrompt as En, markdownCallToolResultContent as Et, nativeCodeModeToolName as F, getSchemaDescription as Fn, readTokenBundle as Ft, CodeModeJournalStore as G, resolveProjectCapletsRoot as Gt, diagnoseCodeModeTypeScript as H, __exportAll as Hn, defaultStateBaseDir as Ht, codeModeRunInputSchema as I, isSchemaOptional as In, DEFAULT_AUTH_DIR as It, codeModeDeclarationHash as J, serializeMessage as Jt, CodeModeLogStore as K, resolveProjectConfigPath as Kt, codeModeRunParamsSchema as L, isZ4Schema as Ln, DEFAULT_COMPLETION_CACHE_DIR as Lt, nativeCapletToolName as M, getLiteralValue as Mn, startOAuthFlow as Mt, nativeCapletsSystemGuidance as N, getObjectShape as Nn, deleteTokenBundle as Nt, parseServerBaseUrl as O, isInitializeRequest as On, refreshOAuthTokenBundle as Ot, nativeCodeModeToolId as P, getParseErrorMessage as Pn, isTokenBundleExpired as Pt, CapletsEngine as Q, Protocol as Qt, emptyCodeModeRunMeta as R, normalizeObjectSchema as Rn, DEFAULT_OBSERVED_OUTPUT_SHAPE_CACHE_DIR as Rt, resolveCapletsRemote as S, McpError as Sn, discoverCapletFiles as St, appendBasePath as T, SetLevelRequestSchema as Tn, hasRenderableStructuredContent as Tt, createCodeModeCapletsApi as U, resolveCapletsRoot as Ut, QuickJsCodeModeSandbox as V, safeParseAsync as Vn, defaultConfigPath as Vt, listCodeModeCallableCaplets as W, resolveConfigPath as Wt, generateCodeModeRunToolDescription as X, assertToolsCallTaskCapability as Xt, generateCodeModeDeclarations as Y, assertClientRequestTaskCapability as Yt, minifyCodeModeDeclarationText as Z, AjvJsonSchemaValidator as Zt, CapletsCloudClient as _, ListResourceTemplatesRequestSchema as _n, FileVaultStore as _t, CloudAuthStore as a, CreateMessageResultWithToolsSchema as an, ServerRegistry as at, isCapletsCloudUrl as b, ListToolsRequestSchema as bn, decryptVaultValue as bt, redactedCloudAuthStatus as c, ElicitResultSchema as cn, loadConfig as ct, projectBindingError as d, GetPromptRequestSchema as dn, loadLocalOverlayConfigWithSources as dt, toJsonSchemaCompat as en, decodeDirectResourceUri as et, projectBindingRecovery as f, InitializeRequestSchema as fn, loadProjectConfig as ft, buildProjectSyncManifest as g, ListPromptsRequestSchema as gn, vaultStoreForAuthDir as gt, createSdkRemoteCapletsClient as h, LATEST_PROTOCOL_VERSION as hn, vaultResolverForAuthDir as ht, createRemoteProfileStore as i, CreateMessageResultSchema as in, handleServerTool as it, nativeCapletToolDescription as j, isJSONRPCResultResponse as jn, startGenericOAuthFlow as jt, resolveCapletsServer as k, isJSONRPCErrorResponse as kn, runGenericOAuthFlow as kt, PROJECT_BINDING_ERROR_CODES as l, EmptyResultSchema as ln, loadConfigWithSources as lt, RemoteNativeCapletsService as m, JSONRPCMessageSchema as mn, vaultBootstrapResolver as mt, resolveRemoteSelection as n, CallToolResultSchema as nn, findProjectRoot as nt, cloudAuthPath as o, CreateTaskResultSchema as on, capabilityDescription as ot, CloudAuthClient as p, InitializedNotificationSchema as pn, parseConfig as pt, redactCodeModeLogText as q, ReadBuffer as qt, cloudCredentialsFromRemoteProfile as r, CompleteRequestSchema as rn, fingerprintProjectRoot as rt, migrateCredentials as s, DEFAULT_NEGOTIATED_PROTOCOL_VERSION as sn, GoogleDiscoveryManager as st, createNativeCapletsService as t, CallToolRequestSchema as tn, directResourceUriMatchesTemplate as tt, ProjectBindingError as u, ErrorCode as un, loadGlobalConfig as ut, resolveNativeCapletsServiceOptions as v, ListResourcesRequestSchema as vn, VAULT_MAX_VALUE_BYTES as vt, resolveRemoteMode as w, SUPPORTED_PROTOCOL_VERSIONS as wn, loadCapletFilesFromMap as wt, normalizeRemoteProfileHostUrl as x, LoggingLevelSchema as xn, encryptVaultValue as xt, hostedCloudWorkspaceFromRemoteUrl as y, ListRootsResultSchema as yn, validateVaultKeyName as yt, runCodeMode as z, objectFromShape as zn, defaultCacheBaseDir as zt };