@dam-agents/cli 0.2.13 → 0.2.14-rc1

package/dist/bin.js

@@ -26722,12 +26722,38 @@ function date4(params) {
 config(en_default());
 
 // ../api-server-api/src/modules/shared.ts
+var RESOURCE_NAME_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+function resourceNameSchema(example) {
+  return external_exports.string().min(1, "name is required").max(63, "name must be 63 characters or fewer").regex(
+    RESOURCE_NAME_PATTERN,
+    `name must be lowercase letters, digits, and single hyphens (e.g. ${example})`
+  );
+}
 var ENV_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
 var envVarSchema = external_exports.object({
   name: external_exports.string().min(1).max(255).regex(ENV_NAME_RE, "name must match [A-Z_][A-Z0-9_]*"),
   value: external_exports.string().max(1e4)
 });
 
+// ../api-server-api/src/modules/events/schemas.ts
+var liveEventSchema = external_exports.discriminatedUnion("topic", [
+  external_exports.object({ topic: external_exports.literal("sync") }),
+  external_exports.object({ topic: external_exports.literal("approvals"), agentId: external_exports.string().min(1) }),
+  external_exports.object({ topic: external_exports.literal("agents"), agentId: external_exports.string().min(1) }),
+  external_exports.object({ topic: external_exports.literal("schedules"), agentId: external_exports.string().min(1) }),
+  external_exports.object({ topic: external_exports.literal("harnessConfig"), agentId: external_exports.string().min(1) }),
+  external_exports.object({
+    topic: external_exports.literal("experiments"),
+    experimentId: external_exports.string().min(1),
+    agentId: external_exports.string().min(1)
+  }),
+  external_exports.object({
+    topic: external_exports.literal("artifacts"),
+    artifactId: external_exports.string().min(1).optional(),
+    agentId: external_exports.string().min(1).optional()
+  })
+]);
+
 // ../api-server-api/src/modules/skills/schemas.ts
 var skillSourcePathSchema = external_exports.string().transform((p2) => p2.trim().replace(/^\/+|\/+$/g, "")).refine((p2) => !p2.split("/").includes(".."), "path must not contain '..'");
 var skillSourceSchema = external_exports.object({
@@ -26735,12 +26761,7 @@ var skillSourceSchema = external_exports.object({
   name: external_exports.string(),
   gitUrl: external_exports.string(),
   path: external_exports.string().optional(),
-  /** True when the source is managed by the cluster admin
-   *  (Helm-seeded). Users can't delete it. */
   system: external_exports.boolean().optional(),
-  /** Present when the source was declared by an agent template
-   *  (spec.skillSources). UI-only hint for the "Agent" badge —
-   *  backend treats template sources as read-only. */
   fromTemplate: external_exports.object({ templateId: external_exports.string(), templateName: external_exports.string() }).optional(),
   canPublish: external_exports.boolean().optional()
 });
@@ -26754,18 +26775,12 @@ var skillSchema = external_exports.object({
   description: external_exports.string(),
   version: external_exports.string(),
   contentHash: external_exports.string(),
-  /** Repo-relative directory the skill was found in, whichever Source Root it
-   *  came from — what a raw-file URL needs. Distinct from `skillSourceSchema.path`,
-   *  which is the source's optional subdir; `dir` is this one skill's actual
-   *  location under it. Optional: the agent-runtime clone scan (private /
-   *  non-GitHub sources) doesn't report it. */
   dir: external_exports.string().optional()
 });
 var skillListResultSchema = external_exports.object({
   skills: external_exports.array(skillSchema),
-  /** ISO 8601 time the source's skill list was last read from upstream. A
-   *  cache hit reports the original read, not the moment of the hit. */
-  scannedAt: external_exports.string().datetime()
+  scannedAt: external_exports.string().datetime(),
+  visibility: external_exports.enum(["public", "private"]).optional()
 });
 var scanFailureCodes = [
   "needs_github_connection",
@@ -26776,35 +26791,21 @@ var scanFailureCodes = [
 ];
 var scanFailureSchema = external_exports.object({
   code: external_exports.enum(scanFailureCodes),
-  /** Single line naming the cause. */
   title: external_exports.string(),
-  /** Single line naming the fix. */
   detail: external_exports.string()
 });
 var skillRefSchema = external_exports.object({
   source: external_exports.string(),
   name: external_exports.string(),
   version: external_exports.string(),
-  /** Deterministic SHA-256 of the skill directory's file contents at
-   *  install time. Compared to the scanner's contentHash to flag drift.
-   *  Optional for backward compatibility with installs that pre-date
-   *  this field. */
   contentHash: external_exports.string().optional(),
-  /** Source subdir the skill was installed from, denormalized so the apply
-   *  path resolves the skill dir without re-reading the source. */
   path: external_exports.string().optional()
 });
 var localSkillSchema = external_exports.object({
   name: external_exports.string(),
   description: external_exports.string(),
   skillPath: external_exports.string(),
-  /** Provenance vs. the image's pristine copy: shipped untouched, shipped
-   *  but diverged, or created at runtime. Absent on pre-provenance pods —
-   *  treat as `user`. */
   origin: external_exports.enum(["system", "system-modified", "user"]).optional(),
-  /** Deterministic SHA-256 of the skill directory, comparable with a scanned
-   *  skill's `contentHash`. Present only for skills the server asked the pod to
-   *  hash, and absent on pods predating this field (#3019). */
   contentHash: external_exports.string().optional()
 });
 var skillPublishRecordSchema = external_exports.object({
@@ -26813,27 +26814,14 @@ var skillPublishRecordSchema = external_exports.object({
   sourceName: external_exports.string(),
   sourceGitUrl: external_exports.string(),
   prUrl: external_exports.string(),
-  /** ISO 8601 timestamp. */
   publishedAt: external_exports.string(),
-  /** Resolved outcome of `prUrl`, or null when it has never been
-   *  resolved — the source is private, the read was rate-limited, the
-   *  pull request is gone. `merged` and `closed` are terminal and are
-   *  never re-read (#3019). */
   prState: external_exports.enum(["draft", "open", "merged", "closed"]).nullable(),
-  /** ISO 8601 timestamp of the last resolution *attempt*, which is not
-   *  the same as the last success: an attempt that resolved nothing
-   *  still stamps it, because it doubles as the backoff clock. Null
-   *  until the first attempt. */
   prStateCheckedAt: external_exports.string().nullable()
 });
 var skillStateOutputSchema = external_exports.object({
   installed: external_exports.array(skillRefSchema),
   standalone: external_exports.array(localSkillSchema),
   instancePublishes: external_exports.array(skillPublishRecordSchema),
-  /** Present only when `standalone` came from a recorded snapshot rather than a
-   *  live pod read — the sandbox is stopped. Absent while running, which is what
-   *  lets a reader tell live truth from a snapshot without a second field for
-   *  the running case. */
   standaloneSnapshot: external_exports.object({ capturedAt: external_exports.string().datetime() }).optional()
 });
 var skillListSourcesInputSchema = external_exports.object({ agentId: external_exports.string().min(1).optional() }).optional();
@@ -26859,9 +26847,6 @@ var skillGetContentInputSchema = external_exports.object({
 });
 var skillContentSchema = external_exports.object({
   content: external_exports.string(),
-  /** Source-relative directory the SKILL.md was found in, when resolvable —
-   *  lets the UI build an accurate blob link instead of guessing the dir from
-   *  the (frontmatter) skill name. */
   dir: external_exports.string().optional()
 });
 var skillInstallInputSchema = external_exports.object({
@@ -26876,6 +26861,61 @@ var skillUninstallInputSchema = external_exports.object({
   source: external_exports.string().url(),
   name: external_exports.string().min(1)
 });
+var skillSetEntrySchema = external_exports.object({
+  source: external_exports.string().url(),
+  name: external_exports.string().min(1)
+});
+var skillSetNameSchema = resourceNameSchema("my-skill-set");
+var skillSetSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  skills: external_exports.array(skillSetEntrySchema),
+  createdAt: external_exports.string()
+});
+var skillSetCreateInputSchema = external_exports.object({
+  name: skillSetNameSchema,
+  skills: external_exports.array(skillSetEntrySchema).min(1).max(500)
+});
+var skillSetDeleteInputSchema = external_exports.object({ id: external_exports.string().min(1) });
+var skillSetApplyInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  setIds: external_exports.array(external_exports.string().min(1)).min(1).max(50)
+});
+var skillSetSkipReasonSchema = external_exports.enum([
+  "source-not-connected",
+  "source-unreadable",
+  "not-in-source"
+]);
+var skillSetApplyResultSchema = external_exports.object({
+  installed: external_exports.array(skillRefSchema),
+  added: external_exports.number().int().nonnegative(),
+  skipped: external_exports.array(
+    skillSetEntrySchema.extend({ reason: skillSetSkipReasonSchema })
+  )
+});
+var MAX_SKILL_BATCH_ENTRIES = 500;
+var skillApplyBatchInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  install: external_exports.array(
+    external_exports.object({
+      source: external_exports.string().url(),
+      name: external_exports.string().min(1),
+      version: external_exports.string().min(1),
+      contentHash: external_exports.string().optional()
+    })
+  ).max(MAX_SKILL_BATCH_ENTRIES).default([]),
+  uninstall: external_exports.array(
+    external_exports.object({
+      source: external_exports.string().url(),
+      name: external_exports.string().min(1)
+    })
+  ).max(MAX_SKILL_BATCH_ENTRIES).default([])
+}).refine(
+  (v2) => v2.install.length + v2.uninstall.length <= MAX_SKILL_BATCH_ENTRIES,
+  {
+    message: `one batch carries at most ${MAX_SKILL_BATCH_ENTRIES} skills, install and uninstall combined`
+  }
+);
 var skillListLocalInputSchema = external_exports.object({
   agentId: external_exports.string().min(1)
 });
@@ -26958,14 +26998,7 @@ var templateSpecSchema = external_exports.object({
   env: external_exports.array(envVarConfigMapSchema).optional(),
   resources: resourcesSchema.optional(),
   imagePullPolicy: external_exports.string().optional(),
-  // Names a kubernetes.io/dockerconfigjson Secret in the agent namespace,
-  // pre-created by the chart for templates that pull from a private registry
-  // (e.g. experimental external agents). Carried onto the agent spec so the
-  // pod can pull the image without the user entering registry credentials.
   imagePullSecretRef: external_exports.string().optional(),
-  // Seeds the created agent's per-agent hibernation override (Go duration):
-  // "0s" never hibernates, omitted inherits the chart-wide default. A user's
-  // explicit choice at create time still wins over this.
   hibernationTimeout: external_exports.string().optional(),
   storageSize: external_exports.string().optional(),
   backend: external_exports.object({
@@ -26981,13 +27014,9 @@ var templateSpecSchema = external_exports.object({
 var repoSchema = external_exports.object({
   id: external_exports.string().min(1),
   name: external_exports.string().min(1),
-  /** HTTPS clone URL (".git" form). Cloned into the work dir at first run. */
   url: external_exports.url(),
-  /** Branch or tag to clone; omitted = the repo's default branch. */
   ref: external_exports.string().min(1).optional(),
   description: external_exports.string().optional(),
-  /** Template ids this repo is compatible with; the UI filters by the chosen
-   *  harness. Empty means "offered for no harness". */
   compatibleTemplates: external_exports.array(external_exports.string()).default([])
 });
 
@@ -27000,21 +27029,10 @@ var spawnInvocationRequestSchema = external_exports.object({
   templateId: external_exports.string().min(1).optional(),
   connections: external_exports.array(external_exports.string().min(1)).optional(),
   prompt: external_exports.string().min(1),
-  // The result JSON Schema — arbitrary JSON, validated structurally by ajv
-  // when the target reports (a malformed schema is rejected at spawn).
   schema: external_exports.unknown(),
-  // Optional liveness deadline for this target, in ms. Bounded server-side; a
-  // shorter value fails a wedged/misconfigured target fast, a longer one lets
-  // a heavy target run past the default hour.
   ttlMs: external_exports.number().int().min(MIN_INVOCATION_TTL_MS).max(MAX_INVOCATION_TTL_MS).optional(),
-  // Optional resource limits. A heavy Make (clone + install + build)
-  // OOM-kills at the template's small default memory, so let the driver raise
-  // it. Same grammar and floors as the agent size knob.
   memory: external_exports.string().regex(/^\d+(Mi|Gi)$/, "memory must look like '512Mi' or '4Gi'").optional(),
   cpu: external_exports.string().regex(/^\d+(\.\d+)?m?$/, "cpu must look like '2', '0.5' or '500m'").optional(),
-  // Experiments v2 span attach: "<experimentId>/<spanId>" stamped by the
-  // experiment SDK when the spawn happens inside a span, so the Trace Feed
-  // shows this invocation under its stage. Opaque to invocations.
   experimentSpanId: external_exports.string().min(1).max(300).optional()
 }).refine((d2) => d2.image !== void 0 || d2.templateId !== void 0, {
   message: "either image or templateId is required"
@@ -27052,9 +27070,6 @@ var fileRemoveInputSchema = external_exports.object({ path: pathSchema });
 var fileUploadInputSchema = external_exports.object({
   path: pathSchema,
   contentBase64: external_exports.string(),
-  /** Browser-reported MIME (File.type). Carried in the API for observability
-   *  and forward-compat; server-side reads still detect MIME from magic
-   *  bytes so we don't need to persist this. */
   contentType: external_exports.string().max(255).optional(),
   overwrite: external_exports.boolean().optional()
 });
@@ -27081,14 +27096,9 @@ var skillPublishInputSchema2 = external_exports.object({
   repo: external_exports.string().min(1),
   title: external_exports.string().min(1),
   body: external_exports.string(),
-  // Source subdir the skill is published into; mirrors the scanner so a
-  // subdir source's own scan finds what was published back to it.
   path: external_exports.string().optional()
 });
 var skillListLocalInputSchema2 = external_exports.object({
-  /** Names to compute `contentHash` for. Hashing walks the whole skill dir on
-   *  an NFS-backed PVC and this runs on every state poll, so the caller asks
-   *  only for the few skills it needs it for (#3019). */
   hashNames: external_exports.array(external_exports.string()).optional()
 });
 var skillReadLocalInputSchema2 = external_exports.object({
@@ -27101,10 +27111,7 @@ var skillReadPullRequestInputSchema = external_exports.object({
 });
 var skillReadSkillFileInputSchema = external_exports.object({
   source: external_exports.string().min(1),
-  /** Commit SHA the scan pinned — the preview renders the revision the
-   *  catalog listed. */
   version: external_exports.string().min(1),
-  /** Repo-relative skill directory from the scan; `SKILL.md` is read inside it. */
   dir: external_exports.string().min(1)
 });
 var skillDeleteLocalInputSchema2 = external_exports.object({
@@ -27113,9 +27120,7 @@ var skillDeleteLocalInputSchema2 = external_exports.object({
 var skillWriteLocalInputSchema = external_exports.object({
   skills: external_exports.array(
     external_exports.object({
-      /** Confirmed display name — becomes frontmatter `name:`; the dir is its slug. */
       name: external_exports.string().min(1).max(128),
-      /** Raw Markdown file content; lands as SKILL.md. */
       content: external_exports.string()
     })
   ).min(1).max(50)
@@ -27134,10 +27139,6 @@ var backgroundWorkItemSchema = external_exports.object({
   command: advisory(500)
 });
 var backgroundWorkReportSchema = external_exports.object({
-  // Also truncated rather than capped, for the same reason: a hold is per
-  // session, so one surviving item holds it, whereas rejecting an over-long list
-  // would hold nothing at all. Excess entries cost only detail in the status
-  // payload.
   items: external_exports.array(backgroundWorkItemSchema).transform((items) => items.slice(0, 64))
 });
 
@@ -27191,17 +27192,10 @@ var egressInjectContribution = external_exports.object({
   headerName: external_exports.string().min(1),
   valueFormat: external_exports.string().min(1),
   encoding: external_exports.literal("basic-x-access-token").optional(),
-  // Moves the value into this query param instead of the header; restricted to unreserved chars since the Lua treats it as a trusted literal.
   queryParamName: external_exports.string().regex(/^[A-Za-z0-9_.~-]+$/).optional(),
-  // Terminate this host's gateway chain as HTTP/2 so injection lands on a gRPC
-  // stream (e.g. Modal's x-modal-token-* metadata). Flows to the injection-hosts
-  // annotation the controller reads. Omit for HTTP/1.1 REST hosts.
   http2: external_exports.boolean().optional(),
   port: egressPort,
-  // Tunnel WebSocket/SPDY upgrades (kubectl streaming); keeps the chain h1.
   upgrades: external_exports.boolean().optional(),
-  // Validate the upstream against the CA in the connection Secret, not the
-  // system store (self-signed cluster CAs).
   upstreamCa: external_exports.boolean().optional()
 });
 var fileContribution = external_exports.object({
@@ -27257,7 +27251,6 @@ var scheduleResetEvent = external_exports.object({
 });
 var workspaceSeedEventPayload = external_exports.object({
   url: external_exports.string().min(1),
-  /** Branch or tag to clone; omitted = the repo's default branch. */
   ref: external_exports.string().min(1).optional()
 });
 var workspaceSeedEvent = external_exports.object({
@@ -27315,18 +27308,14 @@ var harnessConfigChoice = external_exports.object({
   description: external_exports.string().optional()
 });
 var harnessConfigOptionGroup = external_exports.object({
-  // "model", "mode", or a configOption id (e.g. "effort").
   id: external_exports.string().min(1),
   name: external_exports.string().min(1),
   description: external_exports.string().optional(),
-  // ACP-style category: "model" | "mode" | "thought_level" | …
   category: external_exports.string().min(1),
   choices: external_exports.array(harnessConfigChoice)
 });
 var harnessConfigCatalog = external_exports.object({
   options: external_exports.array(harnessConfigOptionGroup),
-  // Per-model validity: allowed choice values per gated group. Model absent =
-  // all allowed; empty array = group hidden for that model (e.g. Haiku effort).
   modelConstraints: external_exports.record(external_exports.string().min(1), external_exports.record(external_exports.string().min(1), external_exports.array(external_exports.string()))).optional()
 });
 var harnessConfigCurrent = external_exports.object({
@@ -27338,10 +27327,7 @@ var harnessConfigCurrent = external_exports.object({
 var capabilities = external_exports.object({
   contributions: external_exports.array(contributionKind),
   events: external_exports.array(eventKind),
-  // Whether the harness declares a config mapping (gates the UI panel). Optional
-  // for forward-compat with agents that predate it.
   harnessConfig: external_exports.boolean().optional(),
-  // The option catalog from the harness's manifest (absent → UI hides the panel).
   harnessConfigCatalog: harnessConfigCatalog.optional()
 });
 var stateSlice = external_exports.object({
@@ -27358,19 +27344,14 @@ var driverFailure = external_exports.object({
   message: external_exports.string().min(1)
 });
 var applyStateResult = external_exports.discriminatedUnion("status", [
-  // Processed: resulting cursor + any per-driver failures (empty on a fully clean apply).
   external_exports.object({
     status: external_exports.literal("ok"),
     appliedVersion: external_exports.number().int().nonnegative(),
     appliedHash: external_exports.string().min(1).nullable(),
-    // null until the first clean settle
     failures: external_exports.array(driverFailure).default([]),
     settledEvents: external_exports.array(external_exports.string()).default([]),
-    // Absent from a pod predating this, or one whose manifest declares no
-    // harness-config driver — the server then keeps whatever it holds.
     harnessConfigCurrent: harnessConfigCurrent.optional()
   }),
-  // Contributions already at ≥ the requested version; worker reconciles. Events still apply (own version) — settledEvents reports which.
   external_exports.object({
     status: external_exports.literal("stale"),
     appliedVersion: external_exports.number().int().nonnegative(),
@@ -27384,10 +27365,6 @@ var helloInput = external_exports.object({
   protocolVersion: external_exports.literal("v1"),
   agentRuntimeVersion: external_exports.string(),
   capabilities,
-  // The config file as it stands at boot, with no discovered model list: `hello`
-  // is what delivers capabilities, and the worker won't dispatch an apply until
-  // they land, so waiting on the provider here delays the first apply after
-  // every boot and wake. The apply reply carries the list instead.
   harnessConfigCurrent: harnessConfigCurrent.optional()
 });
 var helloResult = external_exports.object({
@@ -27419,22 +27396,12 @@ var harnessConfigSnapshotSchema = external_exports.object({
   model: external_exports.string().nullable(),
   mode: external_exports.string().nullable(),
   configOptions: agentConfigOptionsSchema,
-  /** Models the provider offered when it was last successfully asked; null when
-   *  the harness declares no discovery source. A failed attempt leaves this
-   *  alone, so it can be older than the rest of the snapshot. */
   availableModels: external_exports.array(harnessConfigChoice).nullable(),
   capturedAt: external_exports.string().datetime(),
-  /** The model that was in effect when `availableModels` was observed. Comparing
-   *  the two is only meaningful while this still equals `model`: a model changed
-   *  since the list was read proves nothing about whether the provider offers it.
-   *  Absent on rows written before this field existed — treat as unpaired. */
   modelAtDiscovery: external_exports.string().nullable().optional(),
-  /** False while the only source is an apply the pod has not reported back. */
   confirmed: external_exports.boolean()
 });
 var harnessConfigSnapshotResultSchema = external_exports.object({
-  /** The agent has sent `hello` at least once, so a snapshot is possible.
-   *  False means "never run" — genuinely nothing to show, not a miss. */
   hasRun: external_exports.boolean(),
   snapshot: harnessConfigSnapshotSchema.nullable()
 });
@@ -27455,7 +27422,6 @@ var egressRuleCurrentPresetInputSchema = external_exports.object({
 var egressRuleCreateInputSchema = external_exports.object({
   agentId: external_exports.string().min(1),
   host: egressHostSchema,
-  // Upstream port; omit for 443. Promotes the host onto the L7 chain.
   port: external_exports.number().int().min(1).max(65535).optional(),
   method: external_exports.string().min(1).default("*"),
   pathPattern: external_exports.string().min(1).default("*"),
@@ -27515,38 +27481,12 @@ var agentCreateInputSchema = external_exports.object({
     password: external_exports.string().min(1)
   }).optional(),
   egressPreset: egressPresetSchema.optional(),
-  // Per-agent idle timeout override in minutes (0 = never hibernate); omit to inherit the global default.
   hibernationTimeoutMin: external_exports.number().int().min(0).optional(),
-  // Optional: clone this public repo (optionally a branch/tag via `ref`) into
-  // the work dir once, via a one-shot `workspace-seed` event. Not enforced
-  // against the `gitRepos` catalog server-side — the clone runs in the
-  // egress-gated agent pod, so this reaches no URL the agent couldn't already
-  // reach itself.
   gitRepo: external_exports.object({ url: external_exports.url(), ref: external_exports.string().min(1).optional() }).optional(),
-  // Initial connection grants, settled into the spec at create so credentials
-  // ride the first snapshot and the gateway renders its chains once (no
-  // readiness flap).
   connectionIds: external_exports.array(external_exports.string()).optional(),
-  // The agent's size (#1900): CPU/memory limits, the user-facing "power"
-  // knob the Budget bounds (the UI renders it as sliders). Omitted
-  // dimensions inherit the template's limits, else the chart default.
-  // Requests are derived server-side — never a user concept. Floors match
-  // the chart's derivation floors; the budget gate is the only ceiling.
   size: agentSizeSchema.optional(),
-  // Sweepable (#2816): mark this agent for automatic deletion by the Agent
-  // Sweep once it hibernates. Set on ephemeral agents (Invocation targets);
-  // durable owned agents omit it. Stamped as an annotation at create.
   sweepable: external_exports.boolean().optional(),
-  // Agent Lifetime (#2816): optional grace in ms a Sweepable agent may stay
-  // hibernated before the Sweep deletes it. Default zero — deleted as soon
-  // as it hibernates. Ignored unless `sweepable`.
   lifetimeMs: external_exports.number().int().min(0).optional()
-  // Agent Kind is deliberately NOT part of this schema: it is a
-  // service-level field (see AgentCreateInput) set only by an owning module's
-  // create path (knowledge-bases, experiments). A `kind` passed to the public
-  // agents.create is stripped, so a caller cannot mint a marked agent that
-  // skipped that module's setup — a KB or experiment sandbox whose Install
-  // Command never ran.
 }).refine((d2) => d2.templateId !== void 0 || d2.image !== void 0, {
   message: "Either templateId or image is required"
 });
@@ -27556,17 +27496,12 @@ var agentUpdateInputSchema = external_exports.object({
   description: external_exports.string().optional(),
   env: external_exports.array(envVarSchema).max(64).optional(),
   secretRef: external_exports.string().optional(),
-  // Per-agent idle timeout override in minutes (0 = never hibernate); null clears it back to the global default.
   hibernationTimeoutMin: external_exports.number().int().min(0).nullable().optional(),
-  // Resize (#1900). On a sleeping sandbox the new Size rides the next start
-  // through the budget gate; on a running one the increase is gated
-  // server-side and the pod restarts to apply it.
   size: agentSizeSchema.optional()
 });
 var agentConnectSlackInputSchema = external_exports.object({
   id: external_exports.string().min(1),
   slackChannelId: external_exports.string().min(1),
-  // Ambient mode; absent = off. Mutable: re-connecting updates it in place.
   ambient: external_exports.boolean().optional()
 });
 var agentListTelegramChatsInputSchema = external_exports.object({
@@ -27578,12 +27513,10 @@ var agentUnbindTelegramChatInputSchema = external_exports.object({
 });
 var agentBindTelegramChatInputSchema = external_exports.object({
   agentId: external_exports.string().min(1),
-  // Opaque bind-flow id minted by the Telegram OAuth callback.
   flowId: external_exports.string().min(1)
 });
 var agentBindSlackChannelInputSchema = external_exports.object({
   agentId: external_exports.string().min(1),
-  // Opaque bind-flow id minted by the Slack in-chat bind OAuth callback.
   flowId: external_exports.string().min(1)
 });
 
@@ -27683,14 +27616,12 @@ var skeletonSchema = external_exports.object({
   stages: external_exports.array(
     external_exports.object({
       id: stageIdSchema,
-      /** Stage ids this stage runs after (edges of the graph). */
       after: external_exports.array(stageIdSchema).max(20).default([])
     })
   ).max(50).default([]),
   loops: external_exports.array(
     external_exports.object({
       id: stageIdSchema,
-      /** Member stages, iterated together. */
       stages: external_exports.array(stageIdSchema).min(1).max(50)
     })
   ).max(10).default([])
@@ -27699,15 +27630,10 @@ var planRegisterRequestSchema = external_exports.object({
   name: external_exports.string().trim().min(1).max(200),
   skeleton: skeletonSchema,
   script: external_exports.object({
-    /** Pod-local path the harness will execute (`python <path>`). */
     path: external_exports.string().min(1).max(1024),
     sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
     content: external_exports.string().max(SCRIPT_CONTENT_MAX_BYTES)
   }),
-  /** Bespoke dashboard HTML captured like the script (the SDK's
-   *  dashboard_path): the platform creates or re-versions the draft's
-   *  dashboard artifact from it. Omitted = keep the existing dashboard, or
-   *  attach the stock one on first registration. */
   dashboard: external_exports.object({ content: external_exports.string().max(DASHBOARD_CONTENT_MAX_BYTES) }).optional()
 });
 var planRegisterResponseSchema = external_exports.object({
@@ -27734,9 +27660,7 @@ var spanEndEventSchema = external_exports.object({
   type: external_exports.literal("span-end"),
   spanId: spanIdSchema,
   status: external_exports.enum(["ok", "error"]),
-  /** Opaque by covenant: captured and charted, never normalized or ranked. */
   score: external_exports.number().finite().optional(),
-  /** Artifact Library ids this span produced (candidates, reports). */
   artifactIds: external_exports.array(external_exports.string().min(1)).max(20).optional(),
   attrs: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
   ts: isoTimestampSchema
@@ -27744,7 +27668,6 @@ var spanEndEventSchema = external_exports.object({
 var customDataEventSchema = external_exports.object({
   type: external_exports.literal("custom-data"),
   data: external_exports.record(external_exports.string(), external_exports.unknown()),
-  /** false replaces the blob instead of shallow-merging into it. */
   merge: external_exports.boolean().optional()
 });
 var heartbeatEventSchema = external_exports.object({
@@ -27797,8 +27720,6 @@ var knowledgeBaseCreateInputSchema = external_exports.object({
   connectionIds: external_exports.array(external_exports.string()).optional(),
   egressPreset: egressPresetSchema.optional(),
   size: agentSizeSchema.optional(),
-  // Which installation procedure to bootstrap the agent with. Defaults to
-  // the sole current template so older callers keep working.
   kbTemplateId: knowledgeBaseTemplateIdSchema.default("llm-wiki")
 }).refine((d2) => d2.templateId !== void 0 || d2.image !== void 0, {
   message: "Either templateId or image is required"
@@ -30964,7 +30885,7 @@ function bobEnvMappings(pins = {}) {
   push("BOB_SHELL_MODEL", pins.model);
   push("BOB_INSTANCE_ID", pins.agentId);
   push("BOB_TEAM_ID", pins.teamId);
-  push("BOB_MAX_COINS", pins.maxCoins);
+  push("BOB_MAX_COINS", pins.maxCost);
   push("BOB_CHAT_MODE", pins.chatMode);
   return out;
 }
@@ -31019,7 +30940,6 @@ var PROVIDERS = {
     id: "openai",
     displayName: "OpenAI",
     hostPattern: "api.openai.com",
-    // Scope injection to /v1/* so other host endpoints don't get a stray Authorization header.
     pathPattern: "/v1/*",
     modes: [
       {
@@ -31040,7 +30960,6 @@ var PROVIDERS = {
         label: "API Key",
         templateId: "bob",
         defaultEnvMappings: bobEnvMappings(),
-        // `Apikey` prefix; `Bearer` would trigger JWT auth.
         injection: {
           headerName: "Authorization",
           valueFormat: "Apikey {value}"
@@ -31087,7 +31006,6 @@ var secretRef = external_exports.object({
 var connectionCategory = external_exports.enum(["app", "mcp", "other"]);
 var refreshBackoff = external_exports.object({
   failures: external_exports.number().int(),
-  /** Epoch seconds; ticks before this skip the connection. */
   nextAttempt: external_exports.number().int()
 });
 var oauthAuth = external_exports.object({
@@ -31101,8 +31019,6 @@ var oauthAuth = external_exports.object({
   clientSecretRef: secretRef.optional(),
   expiresAt: external_exports.number().int().optional(),
   connectedAt: external_exports.number().int().optional(),
-  // Epoch seconds, set only on a *permanent* token rejection: derives
-  // `expired` and parks the connection. Any successful token write clears it.
   refreshFailedAt: external_exports.number().int().optional(),
   refreshBackoff: refreshBackoff.optional(),
   tokenEndpointAcceptJson: external_exports.boolean().optional(),
@@ -31138,17 +31054,8 @@ var githubAppAuth = external_exports.object({
   refreshFailedAt: external_exports.number().int().optional(),
   refreshBackoff: refreshBackoff.optional(),
   host: external_exports.string().min(1).optional(),
-  // Optional narrowing of the minted token, stored because every re-mint must
-  // ask for the same subset — a scope kept only on the create input would widen
-  // back to the whole installation at the first renewal. Absent means the
-  // installation's full authority, which is what every connection made before
-  // this field existed carries.
   repositories: external_exports.array(external_exports.string().min(1)).nonempty().optional(),
   permissions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  // Repositories named by GitHub's numeric id rather than by name — what the
-  // picker records, since an id survives a rename where a name would start
-  // failing at the next renewal. Only one of the two reaches GitHub; ids win
-  // when both are set, and connections predating the picker carry names only.
   repositoryIds: external_exports.array(external_exports.number().int()).nonempty().optional()
 });
 var headerAuth = external_exports.object({
@@ -31202,13 +31109,7 @@ var connectionView = external_exports.object({
   hosts: external_exports.array(external_exports.string()),
   host: external_exports.string().min(1).optional(),
   appSlug: external_exports.string().min(1).optional(),
-  // Only for an OAuth connection storing its own client secret — an
-  // operator-supplied one is deploy config, not replaceable per connection.
   hasClientSecret: external_exports.boolean().optional(),
-  // The narrowing a github-app connection currently mints against, so it can
-  // be shown and edited rather than only set once at create. Absent means the
-  // installation's full authority. Carries no secret — names, ids, and levels
-  // are all things the user chose.
   githubAppScope: external_exports.object({
     repositories: external_exports.array(external_exports.string()).optional(),
     repositoryIds: external_exports.array(external_exports.number().int()).optional(),
@@ -31225,13 +31126,10 @@ var templateInput = external_exports.object({
   state: templateInputState,
   presetValue: external_exports.string().optional(),
   secret: external_exports.boolean().optional(),
-  // Renders as a multi-line textarea rather than a single-line input (e.g. a PEM private key).
   multiline: external_exports.boolean().optional(),
-  // Marks a config input the form packs into `configInputs` rather than the typed auth fields.
   configInput: external_exports.boolean().optional(),
   label: external_exports.string().optional(),
   hint: external_exports.string().optional(),
-  // Validation a config input declares, surfaced so clients can validate before submit (the server enforces the same).
   pattern: external_exports.string().optional(),
   patternHint: external_exports.string().optional(),
   enumValues: external_exports.array(external_exports.string()).optional()
@@ -31271,8 +31169,6 @@ var connectionStartOAuthInputSchema = external_exports.object({
     /^\/(?!\/)/,
     "returnTo must be a relative path starting with a single /"
   ).optional(),
-  // When set, the callback returns a page that postMessages the result to the
-  // opener and closes, instead of redirecting. Used by the popup OAuth flow.
   popup: external_exports.boolean().optional()
 });
 var connectionDiscoverMcpInputSchema = external_exports.object({
@@ -31288,10 +31184,7 @@ var connectionSetAgentConnectionsInputSchema = external_exports.object({
   agentId: external_exports.string().min(1),
   connectionIds: external_exports.array(external_exports.string().min(1))
 });
-var connectionNameSchema = external_exports.string().min(1, "name is required").max(63, "name must be 63 characters or fewer").regex(
-  /^[a-z0-9]+(-[a-z0-9]+)*$/,
-  "name must be lowercase letters, digits, and single hyphens (e.g. my-mcp-server)"
-);
+var connectionNameSchema = resourceNameSchema("my-mcp-server");
 var commonFields = {
   templateId: external_exports.string().min(1),
   name: connectionNameSchema
@@ -31315,24 +31208,17 @@ var headerCreateInput = external_exports.object({
     /^[A-Za-z_][A-Za-z0-9_]*$/,
     "env var name must be letters, digits, and underscores (not starting with a digit)"
   ).optional(),
-  // Values for the template's declared config inputs, keyed by input name.
   configInputs: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   value: external_exports.string().min(1),
-  // Upstream CA bundle for hosts whose TLS cert a public root can't verify
-  // (self-signed cluster CAs). PEM, or base64 of PEM (kubeconfig
-  // `certificate-authority-data`).
   caData: external_exports.string().optional()
 });
 var clientCredentialsCreateInput = external_exports.object({
   ...commonFields,
   authKind: external_exports.literal("client-credentials"),
   host: external_exports.string().min(1).optional(),
-  // The token endpoint is discovered from the issuer's OAuth metadata.
   issuerUrl: external_exports.string().url().optional(),
   clientId: external_exports.string().min(1).optional(),
   clientSecret: external_exports.string().min(1).optional(),
-  // Space- or comma-separated; the server splits. A single string keeps the
-  // schema-driven forms all-string.
   scopes: external_exports.string().optional(),
   audience: external_exports.string().min(1).optional(),
   headerName: external_exports.string().min(1).optional(),
@@ -31349,14 +31235,8 @@ var githubAppCreateInput = external_exports.object({
   appId: external_exports.string().min(1),
   installationId: external_exports.string().min(1),
   privateKey: external_exports.string().min(1),
-  // Optional narrowing of the minted token. Space- or comma-separated; the
-  // server parses both. Single strings keep the schema-driven forms all-string,
-  // as client-credentials `scopes` does. Blank leaves the token with the
-  // installation's full authority.
   repositories: external_exports.string().optional(),
   permissions: external_exports.string().optional(),
-  // Repository ids, as picked from the installation. Same all-string shape as
-  // the sibling fields; ids take precedence over names when both arrive.
   repositoryIds: external_exports.string().optional()
 });
 var connectionProbeGitHubAppInputSchema = external_exports.object({
@@ -31379,8 +31259,6 @@ var noneCreateInput = external_exports.object({
   ...commonFields,
   authKind: external_exports.literal("none"),
   url: external_exports.string().url().optional(),
-  // Optional header credential (API key) for MCP servers guarded by a
-  // static header — injected at the gateway, never written to harness config.
   headerName: external_exports.string().min(1).optional(),
   value: external_exports.string().min(1).optional()
 });
@@ -31402,7 +31280,6 @@ var SessionType = {
   ChannelSlack: "channel_slack",
   ChannelTelegram: "channel_telegram",
   ScheduleCron: "schedule_cron",
-  /** The turn that launches an experiment script (Execute on a draft). */
   ExperimentExecute: "experiment_execute"
 };
 var SessionMode = /* @__PURE__ */ ((SessionMode2) => {
@@ -31540,7 +31417,6 @@ var platformTurnEndedNotificationSchema = external_exports.object({
 var platformPromptAcceptedParamsSchema = external_exports.object({
   sessionId: external_exports.string().min(1),
   promptId: external_exports.string().min(1),
-  /** True when the prompt was parked behind an in-flight turn. */
   queued: external_exports.boolean()
 });
 var platformPromptAcceptedNotificationSchema = external_exports.object({
@@ -31667,7 +31543,6 @@ var slackFireMentionInputSchema = external_exports.object({
   ts: external_exports.string().min(1),
   threadTs: external_exports.string().optional(),
   text: external_exports.string(),
-  /** Workspace id; present so the fake exercises the live-streaming path. */
   teamId: external_exports.string().optional()
 }).strict();
 var slackFireCommandInputSchema = external_exports.object({
@@ -31999,6 +31874,11 @@ hint: ${hint}
 function formatTransportError(reason, host) {
   return `cannot reach server \`${host}\`: ${reason}`;
 }
+function serverDetail(e2) {
+  if (!(e2 instanceof TRPCClientError)) return "";
+  const code = e2.data?.code;
+  return e2.message && e2.message !== code ? e2.message : "";
+}
 function printServiceError(error51, host, env = process.env) {
   if (error51.kind === "auth-required") {
     process.stderr.write(formatAuthRejection(error51.reason, env));
@@ -35133,9 +35013,6 @@ function buildTokenRevokeCommand(deps) {
 var authConfigSchema2 = external_exports.object({
   issuer: external_exports.string().min(1),
   clientId: external_exports.string().min(1),
-  // `cliClientId` is allowed to be absent so we can distinguish "server
-  // too old" from generic malformed-response. The validator below picks
-  // it up explicitly.
   cliClientId: external_exports.string().min(1).optional()
 });
 function errorMessage(e2) {
@@ -36056,8 +35933,6 @@ var hostEntrySchema = external_exports.object({
   cli_client_id: external_exports.string().min(1),
   access_token: external_exports.string().min(1),
   refresh_token: external_exports.string().min(1),
-  // smol-toml parses unquoted `YYYY-MM-DDTHH:MM:SSZ` as Date and quoted as
-  // string. Accept both so a hand-edited file with either shape round-trips.
   expires_at: external_exports.union([external_exports.string().min(1), external_exports.date()])
 });
 var fileSchema = external_exports.object({
@@ -36096,7 +35971,6 @@ function fromHostAuth(value) {
     cli_client_id: value.cliClientId,
     access_token: value.accessToken,
     refresh_token: value.refreshToken,
-    // Always emit a quoted ISO 8601 string for unambiguous round-tripping.
     expires_at: value.expiresAt.toISOString()
   };
 }
@@ -37665,11 +37539,7 @@ function renderHuman(channels) {
   return channels.length === 0 ? "No channels connected.\n" : renderTable([
     ["TYPE", "IDENTIFIER", "AMBIENT"],
     ...channels.map(
-      (c2) => (
-        // Telegram has no readable identifier — the bot token is write-only.
-        // Ambient is Slack-only.
-        c2.type === "slack" /* Slack */ ? ["slack", c2.slackChannelId, c2.ambient ? "on" : "off"] : ["telegram", "\u2014", "\u2014"]
-      )
+      (c2) => c2.type === "slack" /* Slack */ ? ["slack", c2.slackChannelId, c2.ambient ? "on" : "off"] : ["telegram", "\u2014", "\u2014"]
     )
   ]);
 }
@@ -39871,11 +39741,6 @@ async function withConnection(url2, fn) {
   };
   const connection2 = new ClientSideConnection(
     () => ({
-      // Never answer a permission request. `list` can't trigger one; a
-      // `setMode` resume might make the runtime replay a pending request, but
-      // auto-approving (or declining) it from this throwaway connection would
-      // be wrong — leave it unanswered so a real client (the UI) handles it on
-      // its next connection. The connection closes right after the RPC anyway.
       requestPermission() {
         return new Promise(() => {
         });
@@ -40480,7 +40345,7 @@ function createProcessEnvReader() {
 
 // src/modules/cli/infrastructure/package-version.ts
 function readPackageVersion() {
-  return true ? "0.2.13" : DEV_VERSION;
+  return true ? "0.2.14-rc1" : DEV_VERSION;
 }
 
 // src/modules/cli/infrastructure/version-probe.ts
@@ -40754,7 +40619,7 @@ function buildConnectCommand(deps) {
     String(DEFAULT_TIMEOUT_SECONDS3)
   ).addHelpText(
     "after",
-    '\nExamples:\n  dam connection connect github\n  dam connection connect github --client-id Iv1.\u2026 --client-secret \u2026  # use your own OAuth app\n  dam connection connect github --no-browser\n  dam connection connect my-api --header-name X-API-Key --value sk-\u2026\n  dam connection connect custom-client-credentials --host api.example.com \\\n      --issuer-url https://auth.example.com/realms/main --client-id \u2026 --client-secret \u2026\n  dam connection connect github-app --app-id 123456 --installation-id 987654 \\\n      --private-key "$(cat app.pem)"\n  dam connection connect github-enterprise-app --host ghe.acme.com \\\n      --app-id 123456 --installation-id 987654 --private-key "$(cat app.pem)"\n  dam connection connect bob --value sk-\u2026 --config model=premium-shell --config chatMode=code\n  dam connection connect https://mcp.example.com\n  dam connection connect https://mcp.example.com --auth none\n'
+    '\nExamples:\n  dam connection connect github\n  dam connection connect github --client-id Iv1.\u2026 --client-secret \u2026  # use your own OAuth app\n  dam connection connect github --no-browser\n  dam connection connect my-api --header-name X-API-Key --value sk-\u2026\n  dam connection connect custom-client-credentials --host api.example.com \\\n      --issuer-url https://auth.example.com/realms/main --client-id \u2026 --client-secret \u2026\n  dam connection connect github-app --app-id 123456 --installation-id 987654 \\\n      --private-key "$(cat app.pem)"\n  dam connection connect github-enterprise-app --host ghe.acme.com \\\n      --app-id 123456 --installation-id 987654 --private-key "$(cat app.pem)"\n  dam connection connect bob --value sk-\u2026 --config model=premium-shell --config chatMode=agent\n  dam connection connect https://mcp.example.com\n  dam connection connect https://mcp.example.com --auth none\n'
   ).action(async (providerOrUrl, opts) => {
     const json2 = opts.json ?? false;
     const timeoutSeconds = parseTimeout2(opts.timeout);
@@ -41746,8 +41611,6 @@ var SECRET_LABELS = {
   header: "New credential value",
   "client-credentials": "New client secret",
   "github-app": "New private key (PEM)",
-  // Its own client secret, not its tokens — those come from `reauth`. Only
-  // connections carrying their own qualify; the server rejects the rest.
   oauth: "New OAuth client secret"
 };
 function buildUpdateCommand(deps) {
@@ -42459,8 +42322,9 @@ function printTrpcReadError(e2, path2, host) {
     return;
   }
   if (code === "PAYLOAD_TOO_LARGE") {
+    const detail = serverDetail(e2);
     process.stderr.write(
-      `error: ${path2} exceeds the 10 MB cap for tRPC-based reads. Streaming transfer for individual large files isn't implemented yet (use \`dam import\` for bulk transfer).
+      `error: ${path2} exceeds the server's per-file cap` + (detail ? ` (${detail})` : "") + `. Streaming transfer for individual large files isn't implemented yet.
 `
     );
     return;
@@ -42612,9 +42476,7 @@ function buildFilePutCommand(deps) {
   );
 }
 function printTrpcUploadError(e2, remotePath, host) {
-  const trpcErr = e2 instanceof TRPCClientError ? e2 : void 0;
-  const code = trpcErr?.data?.code;
-  const message = trpcErr?.data?.message ?? "";
+  const code = e2 instanceof TRPCClientError ? e2.data?.code : void 0;
   if (code === "CONFLICT") {
     process.stderr.write(
       `error: ${remotePath} already exists on the agent; pass --overwrite to clobber
@@ -42623,13 +42485,14 @@ function printTrpcUploadError(e2, remotePath, host) {
     return;
   }
   if (code === "FORBIDDEN") {
-    process.stderr.write(`error: forbidden path: ${message || remotePath}
+    process.stderr.write(`error: forbidden path: ${remotePath}
 `);
     return;
   }
   if (code === "PAYLOAD_TOO_LARGE") {
+    const detail = serverDetail(e2);
     process.stderr.write(
-      `error: ${remotePath} exceeds the server's per-file cap` + (message ? ` (${message})` : "") + `. Streaming transfer for individual large files isn't implemented yet (use \`dam import\` for bulk transfer).
+      `error: ${remotePath} exceeds the server's per-file cap` + (detail ? ` (${detail})` : "") + `. Streaming transfer for individual large files isn't implemented yet (use \`dam import\` for bulk transfer).
 `
     );
     return;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dam-agents/cli",
   "author": "IBM Corp.",
-  "version": "0.2.13",
+  "version": "0.2.14-rc1",
   "type": "module",
   "license": "Apache-2.0",
   "homepage": "https://github.com/dam-agents/dam/tree/main/packages/cli#readme",
@@ -43,8 +43,8 @@
     "vitest": "^4.1.3",
     "ws": "^8.20.0",
     "zod": "^4.4.3",
-    "agent-runtime-api": "0.0.1",
+    "api-server-api": "0.0.1",
     "dev-config": "0.0.1",
-    "api-server-api": "0.0.1"
+    "agent-runtime-api": "0.0.1"
   }
 }