@dam-agents/cli 0.2.5-rc1 → 0.2.7-rc1

package/dist/bin.js

@@ -7204,6 +7204,1261 @@ var require_websocket_server = __commonJS({
   }
 });
 
+// ../../node_modules/.pnpm/ms@2.1.3/node_modules/ms/index.js
+var require_ms = __commonJS({
+  "../../node_modules/.pnpm/ms@2.1.3/node_modules/ms/index.js"(exports, module) {
+    "use strict";
+    var s = 1e3;
+    var m = s * 60;
+    var h2 = m * 60;
+    var d2 = h2 * 24;
+    var w3 = d2 * 7;
+    var y = d2 * 365.25;
+    module.exports = function(val, options) {
+      options = options || {};
+      var type = typeof val;
+      if (type === "string" && val.length > 0) {
+        return parse4(val);
+      } else if (type === "number" && isFinite(val)) {
+        return options.long ? fmtLong(val) : fmtShort(val);
+      }
+      throw new Error(
+        "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
+      );
+    };
+    function parse4(str) {
+      str = String(str);
+      if (str.length > 100) {
+        return;
+      }
+      var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
+        str
+      );
+      if (!match) {
+        return;
+      }
+      var n = parseFloat(match[1]);
+      var type = (match[2] || "ms").toLowerCase();
+      switch (type) {
+        case "years":
+        case "year":
+        case "yrs":
+        case "yr":
+        case "y":
+          return n * y;
+        case "weeks":
+        case "week":
+        case "w":
+          return n * w3;
+        case "days":
+        case "day":
+        case "d":
+          return n * d2;
+        case "hours":
+        case "hour":
+        case "hrs":
+        case "hr":
+        case "h":
+          return n * h2;
+        case "minutes":
+        case "minute":
+        case "mins":
+        case "min":
+        case "m":
+          return n * m;
+        case "seconds":
+        case "second":
+        case "secs":
+        case "sec":
+        case "s":
+          return n * s;
+        case "milliseconds":
+        case "millisecond":
+        case "msecs":
+        case "msec":
+        case "ms":
+          return n;
+        default:
+          return void 0;
+      }
+    }
+    function fmtShort(ms) {
+      var msAbs = Math.abs(ms);
+      if (msAbs >= d2) {
+        return Math.round(ms / d2) + "d";
+      }
+      if (msAbs >= h2) {
+        return Math.round(ms / h2) + "h";
+      }
+      if (msAbs >= m) {
+        return Math.round(ms / m) + "m";
+      }
+      if (msAbs >= s) {
+        return Math.round(ms / s) + "s";
+      }
+      return ms + "ms";
+    }
+    function fmtLong(ms) {
+      var msAbs = Math.abs(ms);
+      if (msAbs >= d2) {
+        return plural(ms, msAbs, d2, "day");
+      }
+      if (msAbs >= h2) {
+        return plural(ms, msAbs, h2, "hour");
+      }
+      if (msAbs >= m) {
+        return plural(ms, msAbs, m, "minute");
+      }
+      if (msAbs >= s) {
+        return plural(ms, msAbs, s, "second");
+      }
+      return ms + " ms";
+    }
+    function plural(ms, msAbs, n, name) {
+      var isPlural = msAbs >= n * 1.5;
+      return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
+    }
+  }
+});
+
+// ../../node_modules/.pnpm/debug@4.4.3/node_modules/debug/src/common.js
+var require_common = __commonJS({
+  "../../node_modules/.pnpm/debug@4.4.3/node_modules/debug/src/common.js"(exports, module) {
+    "use strict";
+    function setup(env) {
+      createDebug.debug = createDebug;
+      createDebug.default = createDebug;
+      createDebug.coerce = coerce;
+      createDebug.disable = disable;
+      createDebug.enable = enable;
+      createDebug.enabled = enabled;
+      createDebug.humanize = require_ms();
+      createDebug.destroy = destroy;
+      Object.keys(env).forEach((key) => {
+        createDebug[key] = env[key];
+      });
+      createDebug.names = [];
+      createDebug.skips = [];
+      createDebug.formatters = {};
+      function selectColor(namespace) {
+        let hash2 = 0;
+        for (let i = 0; i < namespace.length; i++) {
+          hash2 = (hash2 << 5) - hash2 + namespace.charCodeAt(i);
+          hash2 |= 0;
+        }
+        return createDebug.colors[Math.abs(hash2) % createDebug.colors.length];
+      }
+      createDebug.selectColor = selectColor;
+      function createDebug(namespace) {
+        let prevTime;
+        let enableOverride = null;
+        let namespacesCache;
+        let enabledCache;
+        function debug(...args) {
+          if (!debug.enabled) {
+            return;
+          }
+          const self = debug;
+          const curr = Number(/* @__PURE__ */ new Date());
+          const ms = curr - (prevTime || curr);
+          self.diff = ms;
+          self.prev = prevTime;
+          self.curr = curr;
+          prevTime = curr;
+          args[0] = createDebug.coerce(args[0]);
+          if (typeof args[0] !== "string") {
+            args.unshift("%O");
+          }
+          let index = 0;
+          args[0] = args[0].replace(/%([a-zA-Z%])/g, (match, format) => {
+            if (match === "%%") {
+              return "%";
+            }
+            index++;
+            const formatter = createDebug.formatters[format];
+            if (typeof formatter === "function") {
+              const val = args[index];
+              match = formatter.call(self, val);
+              args.splice(index, 1);
+              index--;
+            }
+            return match;
+          });
+          createDebug.formatArgs.call(self, args);
+          const logFn = self.log || createDebug.log;
+          logFn.apply(self, args);
+        }
+        debug.namespace = namespace;
+        debug.useColors = createDebug.useColors();
+        debug.color = createDebug.selectColor(namespace);
+        debug.extend = extend2;
+        debug.destroy = createDebug.destroy;
+        Object.defineProperty(debug, "enabled", {
+          enumerable: true,
+          configurable: false,
+          get: () => {
+            if (enableOverride !== null) {
+              return enableOverride;
+            }
+            if (namespacesCache !== createDebug.namespaces) {
+              namespacesCache = createDebug.namespaces;
+              enabledCache = createDebug.enabled(namespace);
+            }
+            return enabledCache;
+          },
+          set: (v2) => {
+            enableOverride = v2;
+          }
+        });
+        if (typeof createDebug.init === "function") {
+          createDebug.init(debug);
+        }
+        return debug;
+      }
+      function extend2(namespace, delimiter) {
+        const newDebug = createDebug(this.namespace + (typeof delimiter === "undefined" ? ":" : delimiter) + namespace);
+        newDebug.log = this.log;
+        return newDebug;
+      }
+      function enable(namespaces) {
+        createDebug.save(namespaces);
+        createDebug.namespaces = namespaces;
+        createDebug.names = [];
+        createDebug.skips = [];
+        const split2 = (typeof namespaces === "string" ? namespaces : "").trim().replace(/\s+/g, ",").split(",").filter(Boolean);
+        for (const ns of split2) {
+          if (ns[0] === "-") {
+            createDebug.skips.push(ns.slice(1));
+          } else {
+            createDebug.names.push(ns);
+          }
+        }
+      }
+      function matchesTemplate(search, template) {
+        let searchIndex = 0;
+        let templateIndex = 0;
+        let starIndex = -1;
+        let matchIndex = 0;
+        while (searchIndex < search.length) {
+          if (templateIndex < template.length && (template[templateIndex] === search[searchIndex] || template[templateIndex] === "*")) {
+            if (template[templateIndex] === "*") {
+              starIndex = templateIndex;
+              matchIndex = searchIndex;
+              templateIndex++;
+            } else {
+              searchIndex++;
+              templateIndex++;
+            }
+          } else if (starIndex !== -1) {
+            templateIndex = starIndex + 1;
+            matchIndex++;
+            searchIndex = matchIndex;
+          } else {
+            return false;
+          }
+        }
+        while (templateIndex < template.length && template[templateIndex] === "*") {
+          templateIndex++;
+        }
+        return templateIndex === template.length;
+      }
+      function disable() {
+        const namespaces = [
+          ...createDebug.names,
+          ...createDebug.skips.map((namespace) => "-" + namespace)
+        ].join(",");
+        createDebug.enable("");
+        return namespaces;
+      }
+      function enabled(name) {
+        for (const skip of createDebug.skips) {
+          if (matchesTemplate(name, skip)) {
+            return false;
+          }
+        }
+        for (const ns of createDebug.names) {
+          if (matchesTemplate(name, ns)) {
+            return true;
+          }
+        }
+        return false;
+      }
+      function coerce(val) {
+        if (val instanceof Error) {
+          return val.stack || val.message;
+        }
+        return val;
+      }
+      function destroy() {
+        console.warn("Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`.");
+      }
+      createDebug.enable(createDebug.load());
+      return createDebug;
+    }
+    module.exports = setup;
+  }
+});
+
+// ../../node_modules/.pnpm/debug@4.4.3/node_modules/debug/src/browser.js
+var require_browser = __commonJS({
+  "../../node_modules/.pnpm/debug@4.4.3/node_modules/debug/src/browser.js"(exports, module) {
+    "use strict";
+    exports.formatArgs = formatArgs;
+    exports.save = save;
+    exports.load = load;
+    exports.useColors = useColors;
+    exports.storage = localstorage();
+    exports.destroy = /* @__PURE__ */ (() => {
+      let warned = false;
+      return () => {
+        if (!warned) {
+          warned = true;
+          console.warn("Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`.");
+        }
+      };
+    })();
+    exports.colors = [
+      "#0000CC",
+      "#0000FF",
+      "#0033CC",
+      "#0033FF",
+      "#0066CC",
+      "#0066FF",
+      "#0099CC",
+      "#0099FF",
+      "#00CC00",
+      "#00CC33",
+      "#00CC66",
+      "#00CC99",
+      "#00CCCC",
+      "#00CCFF",
+      "#3300CC",
+      "#3300FF",
+      "#3333CC",
+      "#3333FF",
+      "#3366CC",
+      "#3366FF",
+      "#3399CC",
+      "#3399FF",
+      "#33CC00",
+      "#33CC33",
+      "#33CC66",
+      "#33CC99",
+      "#33CCCC",
+      "#33CCFF",
+      "#6600CC",
+      "#6600FF",
+      "#6633CC",
+      "#6633FF",
+      "#66CC00",
+      "#66CC33",
+      "#9900CC",
+      "#9900FF",
+      "#9933CC",
+      "#9933FF",
+      "#99CC00",
+      "#99CC33",
+      "#CC0000",
+      "#CC0033",
+      "#CC0066",
+      "#CC0099",
+      "#CC00CC",
+      "#CC00FF",
+      "#CC3300",
+      "#CC3333",
+      "#CC3366",
+      "#CC3399",
+      "#CC33CC",
+      "#CC33FF",
+      "#CC6600",
+      "#CC6633",
+      "#CC9900",
+      "#CC9933",
+      "#CCCC00",
+      "#CCCC33",
+      "#FF0000",
+      "#FF0033",
+      "#FF0066",
+      "#FF0099",
+      "#FF00CC",
+      "#FF00FF",
+      "#FF3300",
+      "#FF3333",
+      "#FF3366",
+      "#FF3399",
+      "#FF33CC",
+      "#FF33FF",
+      "#FF6600",
+      "#FF6633",
+      "#FF9900",
+      "#FF9933",
+      "#FFCC00",
+      "#FFCC33"
+    ];
+    function useColors() {
+      if (typeof window !== "undefined" && window.process && (window.process.type === "renderer" || window.process.__nwjs)) {
+        return true;
+      }
+      if (typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/(edge|trident)\/(\d+)/)) {
+        return false;
+      }
+      let m;
+      return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://stackoverflow.com/a/398120/376773
+      typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
+      // https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
+      typeof navigator !== "undefined" && navigator.userAgent && (m = navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/)) && parseInt(m[1], 10) >= 31 || // Double check webkit in userAgent just in case we are in a worker
+      typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/);
+    }
+    function formatArgs(args) {
+      args[0] = (this.useColors ? "%c" : "") + this.namespace + (this.useColors ? " %c" : " ") + args[0] + (this.useColors ? "%c " : " ") + "+" + module.exports.humanize(this.diff);
+      if (!this.useColors) {
+        return;
+      }
+      const c2 = "color: " + this.color;
+      args.splice(1, 0, c2, "color: inherit");
+      let index = 0;
+      let lastC = 0;
+      args[0].replace(/%[a-zA-Z%]/g, (match) => {
+        if (match === "%%") {
+          return;
+        }
+        index++;
+        if (match === "%c") {
+          lastC = index;
+        }
+      });
+      args.splice(lastC, 0, c2);
+    }
+    exports.log = console.debug || console.log || (() => {
+    });
+    function save(namespaces) {
+      try {
+        if (namespaces) {
+          exports.storage.setItem("debug", namespaces);
+        } else {
+          exports.storage.removeItem("debug");
+        }
+      } catch (error51) {
+      }
+    }
+    function load() {
+      let r;
+      try {
+        r = exports.storage.getItem("debug") || exports.storage.getItem("DEBUG");
+      } catch (error51) {
+      }
+      if (!r && typeof process !== "undefined" && "env" in process) {
+        r = process.env.DEBUG;
+      }
+      return r;
+    }
+    function localstorage() {
+      try {
+        return localStorage;
+      } catch (error51) {
+      }
+    }
+    module.exports = require_common()(exports);
+    var { formatters } = module.exports;
+    formatters.j = function(v2) {
+      try {
+        return JSON.stringify(v2);
+      } catch (error51) {
+        return "[UnexpectedJSONParseError]: " + error51.message;
+      }
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/debug@4.4.3/node_modules/debug/src/node.js
+var require_node = __commonJS({
+  "../../node_modules/.pnpm/debug@4.4.3/node_modules/debug/src/node.js"(exports, module) {
+    "use strict";
+    var tty = __require("tty");
+    var util = __require("util");
+    exports.init = init;
+    exports.log = log;
+    exports.formatArgs = formatArgs;
+    exports.save = save;
+    exports.load = load;
+    exports.useColors = useColors;
+    exports.destroy = util.deprecate(
+      () => {
+      },
+      "Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`."
+    );
+    exports.colors = [6, 2, 3, 4, 5, 1];
+    try {
+      const supportsColor = __require("supports-color");
+      if (supportsColor && (supportsColor.stderr || supportsColor).level >= 2) {
+        exports.colors = [
+          20,
+          21,
+          26,
+          27,
+          32,
+          33,
+          38,
+          39,
+          40,
+          41,
+          42,
+          43,
+          44,
+          45,
+          56,
+          57,
+          62,
+          63,
+          68,
+          69,
+          74,
+          75,
+          76,
+          77,
+          78,
+          79,
+          80,
+          81,
+          92,
+          93,
+          98,
+          99,
+          112,
+          113,
+          128,
+          129,
+          134,
+          135,
+          148,
+          149,
+          160,
+          161,
+          162,
+          163,
+          164,
+          165,
+          166,
+          167,
+          168,
+          169,
+          170,
+          171,
+          172,
+          173,
+          178,
+          179,
+          184,
+          185,
+          196,
+          197,
+          198,
+          199,
+          200,
+          201,
+          202,
+          203,
+          204,
+          205,
+          206,
+          207,
+          208,
+          209,
+          214,
+          215,
+          220,
+          221
+        ];
+      }
+    } catch (error51) {
+    }
+    exports.inspectOpts = Object.keys(process.env).filter((key) => {
+      return /^debug_/i.test(key);
+    }).reduce((obj, key) => {
+      const prop = key.substring(6).toLowerCase().replace(/_([a-z])/g, (_, k2) => {
+        return k2.toUpperCase();
+      });
+      let val = process.env[key];
+      if (/^(yes|on|true|enabled)$/i.test(val)) {
+        val = true;
+      } else if (/^(no|off|false|disabled)$/i.test(val)) {
+        val = false;
+      } else if (val === "null") {
+        val = null;
+      } else {
+        val = Number(val);
+      }
+      obj[prop] = val;
+      return obj;
+    }, {});
+    function useColors() {
+      return "colors" in exports.inspectOpts ? Boolean(exports.inspectOpts.colors) : tty.isatty(process.stderr.fd);
+    }
+    function formatArgs(args) {
+      const { namespace: name, useColors: useColors2 } = this;
+      if (useColors2) {
+        const c2 = this.color;
+        const colorCode = "\x1B[3" + (c2 < 8 ? c2 : "8;5;" + c2);
+        const prefix = `  ${colorCode};1m${name} \x1B[0m`;
+        args[0] = prefix + args[0].split("\n").join("\n" + prefix);
+        args.push(colorCode + "m+" + module.exports.humanize(this.diff) + "\x1B[0m");
+      } else {
+        args[0] = getDate() + name + " " + args[0];
+      }
+    }
+    function getDate() {
+      if (exports.inspectOpts.hideDate) {
+        return "";
+      }
+      return (/* @__PURE__ */ new Date()).toISOString() + " ";
+    }
+    function log(...args) {
+      return process.stderr.write(util.formatWithOptions(exports.inspectOpts, ...args) + "\n");
+    }
+    function save(namespaces) {
+      if (namespaces) {
+        process.env.DEBUG = namespaces;
+      } else {
+        delete process.env.DEBUG;
+      }
+    }
+    function load() {
+      return process.env.DEBUG;
+    }
+    function init(debug) {
+      debug.inspectOpts = {};
+      const keys = Object.keys(exports.inspectOpts);
+      for (let i = 0; i < keys.length; i++) {
+        debug.inspectOpts[keys[i]] = exports.inspectOpts[keys[i]];
+      }
+    }
+    module.exports = require_common()(exports);
+    var { formatters } = module.exports;
+    formatters.o = function(v2) {
+      this.inspectOpts.colors = this.useColors;
+      return util.inspect(v2, this.inspectOpts).split("\n").map((str) => str.trim()).join(" ");
+    };
+    formatters.O = function(v2) {
+      this.inspectOpts.colors = this.useColors;
+      return util.inspect(v2, this.inspectOpts);
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/debug@4.4.3/node_modules/debug/src/index.js
+var require_src2 = __commonJS({
+  "../../node_modules/.pnpm/debug@4.4.3/node_modules/debug/src/index.js"(exports, module) {
+    "use strict";
+    if (typeof process === "undefined" || process.type === "renderer" || process.browser === true || process.__nwjs) {
+      module.exports = require_browser();
+    } else {
+      module.exports = require_node();
+    }
+  }
+});
+
+// ../../node_modules/.pnpm/agent-base@7.1.4/node_modules/agent-base/dist/helpers.js
+var require_helpers = __commonJS({
+  "../../node_modules/.pnpm/agent-base@7.1.4/node_modules/agent-base/dist/helpers.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      var desc = Object.getOwnPropertyDescriptor(m, k2);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k2];
+        } };
+      }
+      Object.defineProperty(o, k22, desc);
+    }) : (function(o, m, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      o[k22] = m[k2];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v2) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v2 });
+    }) : function(o, v2) {
+      o["default"] = v2;
+    });
+    var __importStar = exports && exports.__importStar || function(mod) {
+      if (mod && mod.__esModule) return mod;
+      var result = {};
+      if (mod != null) {
+        for (var k2 in mod) if (k2 !== "default" && Object.prototype.hasOwnProperty.call(mod, k2)) __createBinding(result, mod, k2);
+      }
+      __setModuleDefault(result, mod);
+      return result;
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.req = exports.json = exports.toBuffer = void 0;
+    var http = __importStar(__require("http"));
+    var https = __importStar(__require("https"));
+    async function toBuffer(stream) {
+      let length = 0;
+      const chunks = [];
+      for await (const chunk of stream) {
+        length += chunk.length;
+        chunks.push(chunk);
+      }
+      return Buffer.concat(chunks, length);
+    }
+    exports.toBuffer = toBuffer;
+    async function json2(stream) {
+      const buf = await toBuffer(stream);
+      const str = buf.toString("utf8");
+      try {
+        return JSON.parse(str);
+      } catch (_err) {
+        const err3 = _err;
+        err3.message += ` (input: ${str})`;
+        throw err3;
+      }
+    }
+    exports.json = json2;
+    function req(url2, opts = {}) {
+      const href = typeof url2 === "string" ? url2 : url2.href;
+      const req2 = (href.startsWith("https:") ? https : http).request(url2, opts);
+      const promise2 = new Promise((resolve4, reject) => {
+        req2.once("response", resolve4).once("error", reject).end();
+      });
+      req2.then = promise2.then.bind(promise2);
+      return req2;
+    }
+    exports.req = req;
+  }
+});
+
+// ../../node_modules/.pnpm/agent-base@7.1.4/node_modules/agent-base/dist/index.js
+var require_dist = __commonJS({
+  "../../node_modules/.pnpm/agent-base@7.1.4/node_modules/agent-base/dist/index.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      var desc = Object.getOwnPropertyDescriptor(m, k2);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k2];
+        } };
+      }
+      Object.defineProperty(o, k22, desc);
+    }) : (function(o, m, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      o[k22] = m[k2];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v2) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v2 });
+    }) : function(o, v2) {
+      o["default"] = v2;
+    });
+    var __importStar = exports && exports.__importStar || function(mod) {
+      if (mod && mod.__esModule) return mod;
+      var result = {};
+      if (mod != null) {
+        for (var k2 in mod) if (k2 !== "default" && Object.prototype.hasOwnProperty.call(mod, k2)) __createBinding(result, mod, k2);
+      }
+      __setModuleDefault(result, mod);
+      return result;
+    };
+    var __exportStar = exports && exports.__exportStar || function(m, exports2) {
+      for (var p2 in m) if (p2 !== "default" && !Object.prototype.hasOwnProperty.call(exports2, p2)) __createBinding(exports2, m, p2);
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.Agent = void 0;
+    var net = __importStar(__require("net"));
+    var http = __importStar(__require("http"));
+    var https_1 = __require("https");
+    __exportStar(require_helpers(), exports);
+    var INTERNAL = /* @__PURE__ */ Symbol("AgentBaseInternalState");
+    var Agent = class extends http.Agent {
+      constructor(opts) {
+        super(opts);
+        this[INTERNAL] = {};
+      }
+      /**
+       * Determine whether this is an `http` or `https` request.
+       */
+      isSecureEndpoint(options) {
+        if (options) {
+          if (typeof options.secureEndpoint === "boolean") {
+            return options.secureEndpoint;
+          }
+          if (typeof options.protocol === "string") {
+            return options.protocol === "https:";
+          }
+        }
+        const { stack } = new Error();
+        if (typeof stack !== "string")
+          return false;
+        return stack.split("\n").some((l) => l.indexOf("(https.js:") !== -1 || l.indexOf("node:https:") !== -1);
+      }
+      // In order to support async signatures in `connect()` and Node's native
+      // connection pooling in `http.Agent`, the array of sockets for each origin
+      // has to be updated synchronously. This is so the length of the array is
+      // accurate when `addRequest()` is next called. We achieve this by creating a
+      // fake socket and adding it to `sockets[origin]` and incrementing
+      // `totalSocketCount`.
+      incrementSockets(name) {
+        if (this.maxSockets === Infinity && this.maxTotalSockets === Infinity) {
+          return null;
+        }
+        if (!this.sockets[name]) {
+          this.sockets[name] = [];
+        }
+        const fakeSocket = new net.Socket({ writable: false });
+        this.sockets[name].push(fakeSocket);
+        this.totalSocketCount++;
+        return fakeSocket;
+      }
+      decrementSockets(name, socket) {
+        if (!this.sockets[name] || socket === null) {
+          return;
+        }
+        const sockets = this.sockets[name];
+        const index = sockets.indexOf(socket);
+        if (index !== -1) {
+          sockets.splice(index, 1);
+          this.totalSocketCount--;
+          if (sockets.length === 0) {
+            delete this.sockets[name];
+          }
+        }
+      }
+      // In order to properly update the socket pool, we need to call `getName()` on
+      // the core `https.Agent` if it is a secureEndpoint.
+      getName(options) {
+        const secureEndpoint = this.isSecureEndpoint(options);
+        if (secureEndpoint) {
+          return https_1.Agent.prototype.getName.call(this, options);
+        }
+        return super.getName(options);
+      }
+      createSocket(req, options, cb) {
+        const connectOpts = {
+          ...options,
+          secureEndpoint: this.isSecureEndpoint(options)
+        };
+        const name = this.getName(connectOpts);
+        const fakeSocket = this.incrementSockets(name);
+        Promise.resolve().then(() => this.connect(req, connectOpts)).then((socket) => {
+          this.decrementSockets(name, fakeSocket);
+          if (socket instanceof http.Agent) {
+            try {
+              return socket.addRequest(req, connectOpts);
+            } catch (err3) {
+              return cb(err3);
+            }
+          }
+          this[INTERNAL].currentSocket = socket;
+          super.createSocket(req, options, cb);
+        }, (err3) => {
+          this.decrementSockets(name, fakeSocket);
+          cb(err3);
+        });
+      }
+      createConnection() {
+        const socket = this[INTERNAL].currentSocket;
+        this[INTERNAL].currentSocket = void 0;
+        if (!socket) {
+          throw new Error("No socket was returned in the `connect()` function");
+        }
+        return socket;
+      }
+      get defaultPort() {
+        return this[INTERNAL].defaultPort ?? (this.protocol === "https:" ? 443 : 80);
+      }
+      set defaultPort(v2) {
+        if (this[INTERNAL]) {
+          this[INTERNAL].defaultPort = v2;
+        }
+      }
+      get protocol() {
+        return this[INTERNAL].protocol ?? (this.isSecureEndpoint() ? "https:" : "http:");
+      }
+      set protocol(v2) {
+        if (this[INTERNAL]) {
+          this[INTERNAL].protocol = v2;
+        }
+      }
+    };
+    exports.Agent = Agent;
+  }
+});
+
+// ../../node_modules/.pnpm/http-proxy-agent@7.0.2/node_modules/http-proxy-agent/dist/index.js
+var require_dist2 = __commonJS({
+  "../../node_modules/.pnpm/http-proxy-agent@7.0.2/node_modules/http-proxy-agent/dist/index.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      var desc = Object.getOwnPropertyDescriptor(m, k2);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k2];
+        } };
+      }
+      Object.defineProperty(o, k22, desc);
+    }) : (function(o, m, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      o[k22] = m[k2];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v2) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v2 });
+    }) : function(o, v2) {
+      o["default"] = v2;
+    });
+    var __importStar = exports && exports.__importStar || function(mod) {
+      if (mod && mod.__esModule) return mod;
+      var result = {};
+      if (mod != null) {
+        for (var k2 in mod) if (k2 !== "default" && Object.prototype.hasOwnProperty.call(mod, k2)) __createBinding(result, mod, k2);
+      }
+      __setModuleDefault(result, mod);
+      return result;
+    };
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.HttpProxyAgent = void 0;
+    var net = __importStar(__require("net"));
+    var tls = __importStar(__require("tls"));
+    var debug_1 = __importDefault(require_src2());
+    var events_1 = __require("events");
+    var agent_base_1 = require_dist();
+    var url_1 = __require("url");
+    var debug = (0, debug_1.default)("http-proxy-agent");
+    var HttpProxyAgent2 = class extends agent_base_1.Agent {
+      constructor(proxy, opts) {
+        super(opts);
+        this.proxy = typeof proxy === "string" ? new url_1.URL(proxy) : proxy;
+        this.proxyHeaders = opts?.headers ?? {};
+        debug("Creating new HttpProxyAgent instance: %o", this.proxy.href);
+        const host = (this.proxy.hostname || this.proxy.host).replace(/^\[|\]$/g, "");
+        const port = this.proxy.port ? parseInt(this.proxy.port, 10) : this.proxy.protocol === "https:" ? 443 : 80;
+        this.connectOpts = {
+          ...opts ? omit2(opts, "headers") : null,
+          host,
+          port
+        };
+      }
+      addRequest(req, opts) {
+        req._header = null;
+        this.setRequestProps(req, opts);
+        super.addRequest(req, opts);
+      }
+      setRequestProps(req, opts) {
+        const { proxy } = this;
+        const protocol = opts.secureEndpoint ? "https:" : "http:";
+        const hostname3 = req.getHeader("host") || "localhost";
+        const base = `${protocol}//${hostname3}`;
+        const url2 = new url_1.URL(req.path, base);
+        if (opts.port !== 80) {
+          url2.port = String(opts.port);
+        }
+        req.path = String(url2);
+        const headers = typeof this.proxyHeaders === "function" ? this.proxyHeaders() : { ...this.proxyHeaders };
+        if (proxy.username || proxy.password) {
+          const auth = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
+          headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`;
+        }
+        if (!headers["Proxy-Connection"]) {
+          headers["Proxy-Connection"] = this.keepAlive ? "Keep-Alive" : "close";
+        }
+        for (const name of Object.keys(headers)) {
+          const value = headers[name];
+          if (value) {
+            req.setHeader(name, value);
+          }
+        }
+      }
+      async connect(req, opts) {
+        req._header = null;
+        if (!req.path.includes("://")) {
+          this.setRequestProps(req, opts);
+        }
+        let first;
+        let endOfHeaders;
+        debug("Regenerating stored HTTP header string for request");
+        req._implicitHeader();
+        if (req.outputData && req.outputData.length > 0) {
+          debug("Patching connection write() output buffer with updated header");
+          first = req.outputData[0].data;
+          endOfHeaders = first.indexOf("\r\n\r\n") + 4;
+          req.outputData[0].data = req._header + first.substring(endOfHeaders);
+          debug("Output buffer: %o", req.outputData[0].data);
+        }
+        let socket;
+        if (this.proxy.protocol === "https:") {
+          debug("Creating `tls.Socket`: %o", this.connectOpts);
+          socket = tls.connect(this.connectOpts);
+        } else {
+          debug("Creating `net.Socket`: %o", this.connectOpts);
+          socket = net.connect(this.connectOpts);
+        }
+        await (0, events_1.once)(socket, "connect");
+        return socket;
+      }
+    };
+    HttpProxyAgent2.protocols = ["http", "https"];
+    exports.HttpProxyAgent = HttpProxyAgent2;
+    function omit2(obj, ...keys) {
+      const ret = {};
+      let key;
+      for (key in obj) {
+        if (!keys.includes(key)) {
+          ret[key] = obj[key];
+        }
+      }
+      return ret;
+    }
+  }
+});
+
+// ../../node_modules/.pnpm/https-proxy-agent@7.0.6/node_modules/https-proxy-agent/dist/parse-proxy-response.js
+var require_parse_proxy_response = __commonJS({
+  "../../node_modules/.pnpm/https-proxy-agent@7.0.6/node_modules/https-proxy-agent/dist/parse-proxy-response.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.parseProxyResponse = void 0;
+    var debug_1 = __importDefault(require_src2());
+    var debug = (0, debug_1.default)("https-proxy-agent:parse-proxy-response");
+    function parseProxyResponse(socket) {
+      return new Promise((resolve4, reject) => {
+        let buffersLength = 0;
+        const buffers = [];
+        function read() {
+          const b2 = socket.read();
+          if (b2)
+            ondata(b2);
+          else
+            socket.once("readable", read);
+        }
+        function cleanup() {
+          socket.removeListener("end", onend);
+          socket.removeListener("error", onerror);
+          socket.removeListener("readable", read);
+        }
+        function onend() {
+          cleanup();
+          debug("onend");
+          reject(new Error("Proxy connection ended before receiving CONNECT response"));
+        }
+        function onerror(err3) {
+          cleanup();
+          debug("onerror %o", err3);
+          reject(err3);
+        }
+        function ondata(b2) {
+          buffers.push(b2);
+          buffersLength += b2.length;
+          const buffered = Buffer.concat(buffers, buffersLength);
+          const endOfHeaders = buffered.indexOf("\r\n\r\n");
+          if (endOfHeaders === -1) {
+            debug("have not received end of HTTP headers yet...");
+            read();
+            return;
+          }
+          const headerParts = buffered.slice(0, endOfHeaders).toString("ascii").split("\r\n");
+          const firstLine = headerParts.shift();
+          if (!firstLine) {
+            socket.destroy();
+            return reject(new Error("No header received from proxy CONNECT response"));
+          }
+          const firstLineParts = firstLine.split(" ");
+          const statusCode = +firstLineParts[1];
+          const statusText = firstLineParts.slice(2).join(" ");
+          const headers = {};
+          for (const header of headerParts) {
+            if (!header)
+              continue;
+            const firstColon = header.indexOf(":");
+            if (firstColon === -1) {
+              socket.destroy();
+              return reject(new Error(`Invalid header from proxy CONNECT response: "${header}"`));
+            }
+            const key = header.slice(0, firstColon).toLowerCase();
+            const value = header.slice(firstColon + 1).trimStart();
+            const current = headers[key];
+            if (typeof current === "string") {
+              headers[key] = [current, value];
+            } else if (Array.isArray(current)) {
+              current.push(value);
+            } else {
+              headers[key] = value;
+            }
+          }
+          debug("got proxy server response: %o %o", firstLine, headers);
+          cleanup();
+          resolve4({
+            connect: {
+              statusCode,
+              statusText,
+              headers
+            },
+            buffered
+          });
+        }
+        socket.on("error", onerror);
+        socket.on("end", onend);
+        read();
+      });
+    }
+    exports.parseProxyResponse = parseProxyResponse;
+  }
+});
+
+// ../../node_modules/.pnpm/https-proxy-agent@7.0.6/node_modules/https-proxy-agent/dist/index.js
+var require_dist3 = __commonJS({
+  "../../node_modules/.pnpm/https-proxy-agent@7.0.6/node_modules/https-proxy-agent/dist/index.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      var desc = Object.getOwnPropertyDescriptor(m, k2);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k2];
+        } };
+      }
+      Object.defineProperty(o, k22, desc);
+    }) : (function(o, m, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      o[k22] = m[k2];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v2) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v2 });
+    }) : function(o, v2) {
+      o["default"] = v2;
+    });
+    var __importStar = exports && exports.__importStar || function(mod) {
+      if (mod && mod.__esModule) return mod;
+      var result = {};
+      if (mod != null) {
+        for (var k2 in mod) if (k2 !== "default" && Object.prototype.hasOwnProperty.call(mod, k2)) __createBinding(result, mod, k2);
+      }
+      __setModuleDefault(result, mod);
+      return result;
+    };
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.HttpsProxyAgent = void 0;
+    var net = __importStar(__require("net"));
+    var tls = __importStar(__require("tls"));
+    var assert_1 = __importDefault(__require("assert"));
+    var debug_1 = __importDefault(require_src2());
+    var agent_base_1 = require_dist();
+    var url_1 = __require("url");
+    var parse_proxy_response_1 = require_parse_proxy_response();
+    var debug = (0, debug_1.default)("https-proxy-agent");
+    var setServernameFromNonIpHost = (options) => {
+      if (options.servername === void 0 && options.host && !net.isIP(options.host)) {
+        return {
+          ...options,
+          servername: options.host
+        };
+      }
+      return options;
+    };
+    var HttpsProxyAgent2 = class extends agent_base_1.Agent {
+      constructor(proxy, opts) {
+        super(opts);
+        this.options = { path: void 0 };
+        this.proxy = typeof proxy === "string" ? new url_1.URL(proxy) : proxy;
+        this.proxyHeaders = opts?.headers ?? {};
+        debug("Creating new HttpsProxyAgent instance: %o", this.proxy.href);
+        const host = (this.proxy.hostname || this.proxy.host).replace(/^\[|\]$/g, "");
+        const port = this.proxy.port ? parseInt(this.proxy.port, 10) : this.proxy.protocol === "https:" ? 443 : 80;
+        this.connectOpts = {
+          // Attempt to negotiate http/1.1 for proxy servers that support http/2
+          ALPNProtocols: ["http/1.1"],
+          ...opts ? omit2(opts, "headers") : null,
+          host,
+          port
+        };
+      }
+      /**
+       * Called when the node-core HTTP client library is creating a
+       * new HTTP request.
+       */
+      async connect(req, opts) {
+        const { proxy } = this;
+        if (!opts.host) {
+          throw new TypeError('No "host" provided');
+        }
+        let socket;
+        if (proxy.protocol === "https:") {
+          debug("Creating `tls.Socket`: %o", this.connectOpts);
+          socket = tls.connect(setServernameFromNonIpHost(this.connectOpts));
+        } else {
+          debug("Creating `net.Socket`: %o", this.connectOpts);
+          socket = net.connect(this.connectOpts);
+        }
+        const headers = typeof this.proxyHeaders === "function" ? this.proxyHeaders() : { ...this.proxyHeaders };
+        const host = net.isIPv6(opts.host) ? `[${opts.host}]` : opts.host;
+        let payload = `CONNECT ${host}:${opts.port} HTTP/1.1\r
+`;
+        if (proxy.username || proxy.password) {
+          const auth = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
+          headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`;
+        }
+        headers.Host = `${host}:${opts.port}`;
+        if (!headers["Proxy-Connection"]) {
+          headers["Proxy-Connection"] = this.keepAlive ? "Keep-Alive" : "close";
+        }
+        for (const name of Object.keys(headers)) {
+          payload += `${name}: ${headers[name]}\r
+`;
+        }
+        const proxyResponsePromise = (0, parse_proxy_response_1.parseProxyResponse)(socket);
+        socket.write(`${payload}\r
+`);
+        const { connect, buffered } = await proxyResponsePromise;
+        req.emit("proxyConnect", connect);
+        this.emit("proxyConnect", connect, req);
+        if (connect.statusCode === 200) {
+          req.once("socket", resume);
+          if (opts.secureEndpoint) {
+            debug("Upgrading socket connection to TLS");
+            return tls.connect({
+              ...omit2(setServernameFromNonIpHost(opts), "host", "path", "port"),
+              socket
+            });
+          }
+          return socket;
+        }
+        socket.destroy();
+        const fakeSocket = new net.Socket({ writable: false });
+        fakeSocket.readable = true;
+        req.once("socket", (s) => {
+          debug("Replaying proxy buffer for failed request");
+          (0, assert_1.default)(s.listenerCount("data") > 0);
+          s.push(buffered);
+          s.push(null);
+        });
+        return fakeSocket;
+      }
+    };
+    HttpsProxyAgent2.protocols = ["http", "https"];
+    exports.HttpsProxyAgent = HttpsProxyAgent2;
+    function resume(socket) {
+      socket.resume();
+    }
+    function omit2(obj, ...keys) {
+      const ret = {};
+      let key;
+      for (key in obj) {
+        if (!keys.includes(key)) {
+          ret[key] = obj[key];
+        }
+      }
+      return ret;
+    }
+  }
+});
+
 // ../../node_modules/.pnpm/events-universal@1.0.1/node_modules/events-universal/default.js
 var require_default = __commonJS({
   "../../node_modules/.pnpm/events-universal@1.0.1/node_modules/events-universal/default.js"(exports, module) {
@@ -25469,6 +26724,107 @@ var envVarSchema = external_exports.object({
   value: external_exports.string().max(1e4)
 });
 
+// ../api-server-api/src/modules/skills/schemas.ts
+var skillSourcePathSchema = external_exports.string().transform((p2) => p2.trim().replace(/^\/+|\/+$/g, "")).refine((p2) => !p2.split("/").includes(".."), "path must not contain '..'");
+var skillSourceSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  gitUrl: external_exports.string(),
+  path: external_exports.string().optional(),
+  /** True when the source is managed by the cluster admin
+   *  (Helm-seeded). Users can't delete it. */
+  system: external_exports.boolean().optional(),
+  /** Present when the source was declared by an agent template
+   *  (spec.skillSources). UI-only hint for the "Agent" badge —
+   *  backend treats template sources as read-only. */
+  fromTemplate: external_exports.object({ templateId: external_exports.string(), templateName: external_exports.string() }).optional(),
+  canPublish: external_exports.boolean().optional()
+});
+var skillPublishResultSchema = external_exports.object({
+  prUrl: external_exports.string().url(),
+  branch: external_exports.string()
+});
+var skillSchema = external_exports.object({
+  source: external_exports.string(),
+  name: external_exports.string(),
+  description: external_exports.string(),
+  version: external_exports.string(),
+  contentHash: external_exports.string()
+});
+var skillRefSchema = external_exports.object({
+  source: external_exports.string(),
+  name: external_exports.string(),
+  version: external_exports.string(),
+  /** Deterministic SHA-256 of the skill directory's file contents at
+   *  install time. Compared to the scanner's contentHash to flag drift.
+   *  Optional for backward compatibility with installs that pre-date
+   *  this field. */
+  contentHash: external_exports.string().optional(),
+  /** Source subdir the skill was installed from, denormalized so the apply
+   *  path resolves the skill dir without re-reading the source. */
+  path: external_exports.string().optional()
+});
+var localSkillSchema = external_exports.object({
+  name: external_exports.string(),
+  description: external_exports.string(),
+  skillPath: external_exports.string()
+});
+var skillPublishRecordSchema = external_exports.object({
+  skillName: external_exports.string(),
+  sourceId: external_exports.string(),
+  sourceName: external_exports.string(),
+  sourceGitUrl: external_exports.string(),
+  prUrl: external_exports.string(),
+  /** ISO 8601 timestamp. */
+  publishedAt: external_exports.string()
+});
+var skillStateOutputSchema = external_exports.object({
+  installed: external_exports.array(skillRefSchema),
+  standalone: external_exports.array(localSkillSchema),
+  instancePublishes: external_exports.array(skillPublishRecordSchema)
+});
+var skillListSourcesInputSchema = external_exports.object({ agentId: external_exports.string().min(1).optional() }).optional();
+var skillCreateSourceInputSchema = external_exports.object({
+  name: external_exports.string().min(1).max(128),
+  gitUrl: external_exports.string().url(),
+  path: skillSourcePathSchema.optional()
+});
+var skillDeleteSourceInputSchema = external_exports.object({
+  id: external_exports.string().min(1)
+});
+var skillRefreshSourceInputSchema = external_exports.object({
+  id: external_exports.string().min(1)
+});
+var skillListInputSchema = external_exports.object({
+  sourceId: external_exports.string().min(1),
+  agentId: external_exports.string().min(1).optional()
+});
+var skillInstallInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  source: external_exports.string().url(),
+  name: external_exports.string().min(1),
+  version: external_exports.string().min(1),
+  contentHash: external_exports.string().optional()
+});
+var skillUninstallInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  source: external_exports.string().url(),
+  name: external_exports.string().min(1)
+});
+var skillListLocalInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1)
+});
+var skillStateInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1)
+});
+var skillPublishInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  sourceId: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  title: external_exports.string().optional(),
+  body: external_exports.string().optional()
+});
+
 // ../api-server-api/src/modules/templates/schemas.ts
 var templateGetInputSchema = external_exports.object({
   id: external_exports.string().min(1)
@@ -25488,14 +26844,19 @@ var envVarConfigMapSchema = external_exports.object({
 });
 var skillSourceSeedSchema = external_exports.object({
   name: external_exports.string(),
-  gitUrl: external_exports.string()
+  gitUrl: external_exports.string(),
+  path: skillSourcePathSchema.optional()
 });
 var templateCategorySchema = external_exports.enum(["harness", "preconfigured"]).default("harness");
 var templateSpecSchema = external_exports.object({
   version: external_exports.string(),
   image: external_exports.string(),
+  name: external_exports.string().optional(),
   description: external_exports.string().optional(),
   category: templateCategorySchema,
+  tags: external_exports.array(external_exports.string()).optional(),
+  docsUrl: external_exports.string().optional(),
+  setupNote: external_exports.object({ title: external_exports.string(), body: external_exports.string() }).optional(),
   experimental: external_exports.boolean().optional(),
   mounts: external_exports.array(mountSchema).optional(),
   init: external_exports.string().optional(),
@@ -25507,7 +26868,13 @@ var templateSpecSchema = external_exports.object({
   // (e.g. experimental external agents). Carried onto the agent spec so the
   // pod can pull the image without the user entering registry credentials.
   imagePullSecretRef: external_exports.string().optional(),
+  // Seeds the created agent's per-agent hibernation override (Go duration):
+  // "0s" never hibernates, omitted inherits the chart-wide default. A user's
+  // explicit choice at create time still wins over this.
+  hibernationTimeout: external_exports.string().optional(),
   storageSize: external_exports.string().optional(),
+  runtimeClassName: external_exports.string().optional(),
+  nodeSelector: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   skillSources: external_exports.array(skillSourceSeedSchema).optional()
 }).passthrough();
 
@@ -25525,6 +26892,321 @@ var repoSchema = external_exports.object({
   compatibleTemplates: external_exports.array(external_exports.string()).default([])
 });
 
+// ../agent-runtime-api/src/modules/files/schemas.ts
+var pathSchema = external_exports.string().min(1);
+var fileListDirsInputSchema = external_exports.object({
+  paths: external_exports.array(external_exports.string()).max(500)
+});
+var fileReadInputSchema = external_exports.object({ path: pathSchema });
+var fileWriteInputSchema = external_exports.object({
+  path: pathSchema,
+  content: external_exports.string(),
+  expectedMtimeMs: external_exports.number().optional()
+});
+var fileCreateInputSchema = external_exports.object({
+  path: pathSchema,
+  content: external_exports.string()
+});
+var fileMkdirInputSchema = external_exports.object({ path: pathSchema });
+var fileRenameInputSchema = external_exports.object({
+  from: pathSchema,
+  to: pathSchema,
+  overwrite: external_exports.boolean().optional()
+});
+var fileRemoveInputSchema = external_exports.object({ path: pathSchema });
+var fileUploadInputSchema = external_exports.object({
+  path: pathSchema,
+  contentBase64: external_exports.string(),
+  /** Browser-reported MIME (File.type). Carried in the API for observability
+   *  and forward-compat; server-side reads still detect MIME from magic
+   *  bytes so we don't need to persist this. */
+  contentType: external_exports.string().max(255).optional(),
+  overwrite: external_exports.boolean().optional()
+});
+
+// ../agent-runtime-api/src/modules/skills/schemas.ts
+var skillInstallInputSchema2 = external_exports.object({
+  sourceUrl: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  version: external_exports.string().min(1),
+  skillPaths: external_exports.array(external_exports.string().min(1)).min(1),
+  path: external_exports.string().optional()
+});
+var skillUninstallInputSchema2 = external_exports.object({
+  name: external_exports.string().min(1),
+  skillPaths: external_exports.array(external_exports.string().min(1)).min(1)
+});
+var skillScanInputSchema = external_exports.object({
+  source: external_exports.string().min(1),
+  path: external_exports.string().optional()
+});
+var skillPublishInputSchema2 = external_exports.object({
+  name: external_exports.string().min(1),
+  owner: external_exports.string().min(1),
+  repo: external_exports.string().min(1),
+  title: external_exports.string().min(1),
+  body: external_exports.string(),
+  // Source subdir the skill is published into; mirrors the scanner so a
+  // subdir source's own scan finds what was published back to it.
+  path: external_exports.string().optional()
+});
+var skillReadLocalInputSchema = external_exports.object({
+  name: external_exports.string().min(1)
+});
+
+// ../agent-runtime-api/src/modules/ssh/schemas.ts
+var sshAuthorizeKeyInputSchema = external_exports.object({
+  publicKey: external_exports.string().min(1).max(8192).refine((s) => !/[\r\n]/.test(s), "must be a single line")
+});
+
+// ../agent-runtime-api/src/modules/import/types.ts
+var importBundleResultSchema = external_exports.object({
+  filesWritten: external_exports.number().int().nonnegative(),
+  bytes: external_exports.number().int().nonnegative(),
+  durationMs: external_exports.number().int().nonnegative()
+});
+
+// ../agent-runtime-api/src/modules/runtime/types.ts
+var contributionKind = external_exports.enum([
+  "env",
+  "egress-allow",
+  "egress-inject",
+  "file",
+  "mcp-entry",
+  "skill-ref"
+]);
+var eventKind = external_exports.enum([
+  "trigger",
+  "schedule-reset",
+  "workspace-seed",
+  "experiment-trigger",
+  "harness-config"
+]);
+var mergeMode = external_exports.enum([
+  "overwrite",
+  "section-marker",
+  "key-targeted",
+  "yaml-fill-if-missing"
+]);
+var fileFormat = external_exports.enum(["yaml", "json", "text", "ini", "toml"]);
+var envContribution = external_exports.object({
+  kind: external_exports.literal("env"),
+  name: external_exports.string().min(1),
+  placeholder: external_exports.string()
+});
+var egressPort = external_exports.number().int().min(1).max(65535).optional();
+var egressAllowContribution = external_exports.object({
+  kind: external_exports.literal("egress-allow"),
+  host: external_exports.string().min(1),
+  port: egressPort,
+  pathPattern: external_exports.string().optional()
+});
+var egressInjectContribution = external_exports.object({
+  kind: external_exports.literal("egress-inject"),
+  host: external_exports.string().min(1),
+  pathPattern: external_exports.string().optional(),
+  headerName: external_exports.string().min(1),
+  valueFormat: external_exports.string().min(1),
+  encoding: external_exports.literal("basic-x-access-token").optional(),
+  // Moves the value into this query param instead of the header; restricted to unreserved chars since the Lua treats it as a trusted literal.
+  queryParamName: external_exports.string().regex(/^[A-Za-z0-9_.~-]+$/).optional(),
+  // Terminate this host's gateway chain as HTTP/2 so injection lands on a gRPC
+  // stream (e.g. Modal's x-modal-token-* metadata). Flows to the injection-hosts
+  // annotation the controller reads. Omit for HTTP/1.1 REST hosts.
+  http2: external_exports.boolean().optional(),
+  port: egressPort,
+  // Tunnel WebSocket/SPDY upgrades (kubectl streaming); keeps the chain h1.
+  upgrades: external_exports.boolean().optional(),
+  // Validate the upstream against the CA in the connection Secret, not the
+  // system store (self-signed cluster CAs).
+  upstreamCa: external_exports.boolean().optional()
+});
+var fileContribution = external_exports.object({
+  kind: external_exports.literal("file"),
+  path: external_exports.string().min(1),
+  format: fileFormat,
+  mergeMode,
+  content: external_exports.unknown().optional()
+});
+var mcpEntryContribution = external_exports.object({
+  kind: external_exports.literal("mcp-entry"),
+  name: external_exports.string().min(1),
+  url: external_exports.string().url(),
+  headers: external_exports.record(external_exports.string(), external_exports.string()).optional()
+});
+var skillRefContribution = external_exports.object({
+  kind: external_exports.literal("skill-ref"),
+  sourceUrl: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  version: external_exports.string().min(1),
+  path: external_exports.string().optional()
+});
+var contribution = external_exports.discriminatedUnion("kind", [
+  envContribution,
+  egressAllowContribution,
+  egressInjectContribution,
+  fileContribution,
+  mcpEntryContribution,
+  skillRefContribution
+]);
+var triggerEventPayload = external_exports.object({
+  scheduleId: external_exports.string().min(1),
+  task: external_exports.string().min(1),
+  sessionMode: external_exports.enum(["continuous", "fresh"]).optional(),
+  mcpServers: external_exports.array(external_exports.unknown()).optional()
+});
+var triggerEvent = external_exports.object({
+  id: external_exports.string().min(1),
+  kind: external_exports.literal("trigger"),
+  version: external_exports.number().int().nonnegative(),
+  expiresAt: external_exports.string().datetime({ offset: true }),
+  payload: triggerEventPayload
+});
+var scheduleResetEventPayload = external_exports.object({
+  scheduleId: external_exports.string().min(1)
+});
+var scheduleResetEvent = external_exports.object({
+  id: external_exports.string().min(1),
+  kind: external_exports.literal("schedule-reset"),
+  version: external_exports.number().int().nonnegative(),
+  expiresAt: external_exports.string().datetime({ offset: true }),
+  payload: scheduleResetEventPayload
+});
+var workspaceSeedEventPayload = external_exports.object({
+  url: external_exports.string().min(1),
+  /** Branch or tag to clone; omitted = the repo's default branch. */
+  ref: external_exports.string().min(1).optional()
+});
+var workspaceSeedEvent = external_exports.object({
+  id: external_exports.string().min(1),
+  kind: external_exports.literal("workspace-seed"),
+  version: external_exports.number().int().nonnegative(),
+  expiresAt: external_exports.string().datetime({ offset: true }),
+  payload: workspaceSeedEventPayload
+});
+var experimentTriggerEventPayload = external_exports.object({
+  experimentId: external_exports.string().min(1),
+  task: external_exports.string().min(1)
+});
+var experimentTriggerEvent = external_exports.object({
+  id: external_exports.string().min(1),
+  kind: external_exports.literal("experiment-trigger"),
+  version: external_exports.number().int().nonnegative(),
+  expiresAt: external_exports.string().datetime({ offset: true }),
+  payload: experimentTriggerEventPayload
+});
+var harnessConfigEventPayload = external_exports.object({
+  model: external_exports.string().min(1).optional(),
+  mode: external_exports.string().min(1).optional(),
+  configOptions: external_exports.record(external_exports.string().min(1), external_exports.string()).optional(),
+  unset: external_exports.array(external_exports.string().min(1)).optional()
+});
+var harnessConfigEvent = external_exports.object({
+  id: external_exports.string().min(1),
+  kind: external_exports.literal("harness-config"),
+  version: external_exports.number().int().nonnegative(),
+  expiresAt: external_exports.string().datetime({ offset: true }),
+  payload: harnessConfigEventPayload
+});
+var event = external_exports.discriminatedUnion("kind", [
+  triggerEvent,
+  scheduleResetEvent,
+  workspaceSeedEvent,
+  experimentTriggerEvent,
+  harnessConfigEvent
+]);
+var harnessConfigChoice = external_exports.object({
+  value: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  description: external_exports.string().optional()
+});
+var harnessConfigOptionGroup = external_exports.object({
+  // "model", "mode", or a configOption id (e.g. "effort").
+  id: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  description: external_exports.string().optional(),
+  // ACP-style category: "model" | "mode" | "thought_level" | …
+  category: external_exports.string().min(1),
+  choices: external_exports.array(harnessConfigChoice)
+});
+var harnessConfigCatalog = external_exports.object({
+  options: external_exports.array(harnessConfigOptionGroup),
+  // Per-model validity: allowed choice values per gated group. Model absent =
+  // all allowed; empty array = group hidden for that model (e.g. Haiku effort).
+  modelConstraints: external_exports.record(external_exports.string().min(1), external_exports.record(external_exports.string().min(1), external_exports.array(external_exports.string()))).optional()
+});
+var capabilities = external_exports.object({
+  contributions: external_exports.array(contributionKind),
+  events: external_exports.array(eventKind),
+  // Whether the harness declares a config mapping (gates the UI panel). Optional
+  // for forward-compat with agents that predate it.
+  harnessConfig: external_exports.boolean().optional(),
+  // The option catalog from the harness's manifest (absent → UI hides the panel).
+  harnessConfigCatalog: harnessConfigCatalog.optional()
+});
+var stateSlice = external_exports.object({
+  contributions: external_exports.array(contribution),
+  hash: external_exports.string().min(1)
+});
+var applyStateInput = external_exports.object({
+  version: external_exports.number().int().positive(),
+  state: stateSlice,
+  events: external_exports.array(event)
+});
+var driverFailure = external_exports.object({
+  kind: contributionKind,
+  message: external_exports.string().min(1)
+});
+var applyStateResult = external_exports.discriminatedUnion("status", [
+  // Processed: resulting cursor + any per-driver failures (empty on a fully clean apply).
+  external_exports.object({
+    status: external_exports.literal("ok"),
+    appliedVersion: external_exports.number().int().nonnegative(),
+    appliedHash: external_exports.string().min(1).nullable(),
+    // null until the first clean settle
+    failures: external_exports.array(driverFailure).default([]),
+    settledEvents: external_exports.array(external_exports.string()).default([])
+  }),
+  // Contributions already at ≥ the requested version; worker reconciles. Events still apply (own version) — settledEvents reports which.
+  external_exports.object({
+    status: external_exports.literal("stale"),
+    appliedVersion: external_exports.number().int().nonnegative(),
+    settledEvents: external_exports.array(external_exports.string()).default([])
+  })
+]);
+var helloInput = external_exports.object({
+  lastAppliedVersion: external_exports.number().int().nonnegative().optional(),
+  lastAppliedHash: external_exports.string().optional(),
+  protocolVersion: external_exports.literal("v1"),
+  agentRuntimeVersion: external_exports.string(),
+  capabilities
+});
+var helloResult = external_exports.object({
+  version: external_exports.number().int().positive().optional(),
+  state: stateSlice.optional(),
+  events: external_exports.array(event)
+});
+
+// ../api-server-api/src/modules/harness-config/schemas.ts
+var agentConfigOptionsSchema = external_exports.record(external_exports.string().min(1), external_exports.string());
+var harnessConfigApplyInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1),
+  model: external_exports.string().min(1).optional(),
+  mode: external_exports.string().min(1).optional(),
+  configOptions: agentConfigOptionsSchema.optional(),
+  unset: external_exports.array(external_exports.string().min(1)).optional()
+});
+var harnessConfigStatusInputSchema = external_exports.object({
+  agentId: external_exports.string().min(1)
+});
+var harnessConfigStatusSchema = external_exports.object({
+  supported: external_exports.boolean(),
+  catalog: harnessConfigCatalog.nullable()
+});
+var harnessConfigSettledSchema = external_exports.object({
+  settled: external_exports.boolean()
+});
+
 // ../api-server-api/src/modules/egress-rules/schemas.ts
 var ruleVerdictSchema = external_exports.enum(["allow", "deny"]);
 var egressPresetSchema = external_exports.enum(["none", "trusted", "all"]);
@@ -25537,6 +27219,8 @@ var egressRuleCurrentPresetInputSchema = external_exports.object({
 var egressRuleCreateInputSchema = external_exports.object({
   agentId: external_exports.string().min(1),
   host: external_exports.string().min(1),
+  // Upstream port; omit for 443. Promotes the host onto the L7 chain.
+  port: external_exports.number().int().min(1).max(65535).optional(),
   method: external_exports.string().min(1).default("*"),
   pathPattern: external_exports.string().min(1).default("*"),
   verdict: ruleVerdictSchema
@@ -25557,6 +27241,22 @@ var egressRuleApplyPresetInputSchema = external_exports.object({
 
 // ../api-server-api/src/modules/agents/schemas.ts
 var idSchema = external_exports.object({ id: external_exports.string().min(1) });
+var cpuQuantitySchema = external_exports.string().regex(/^\d+(\.\d+)?m?$/, "CPU must look like '2', '0.5' or '500m'").refine((v2) => toCpuMilli(v2) >= 100, {
+  message: "CPU must be at least 100m"
+});
+var memoryQuantitySchema = external_exports.string().regex(/^\d+(Mi|Gi)$/, "memory must look like '512Mi' or '2Gi'").refine((v2) => toMemoryMi(v2) >= 128, {
+  message: "memory must be at least 128Mi"
+});
+function toCpuMilli(v2) {
+  return v2.endsWith("m") ? Number(v2.slice(0, -1)) : Number(v2) * 1e3;
+}
+function toMemoryMi(v2) {
+  return v2.endsWith("Gi") ? Number(v2.slice(0, -2)) * 1024 : Number(v2.slice(0, -2));
+}
+var agentSizeSchema = external_exports.object({
+  cpu: cpuQuantitySchema.optional(),
+  memory: memoryQuantitySchema.optional()
+});
 var agentCreateInputSchema = external_exports.object({
   name: external_exports.string().min(1).refine((n) => !n.startsWith("agent-"), {
     message: "agent name cannot start with 'agent-' (reserved for IDs)"
@@ -25573,16 +27273,24 @@ var agentCreateInputSchema = external_exports.object({
   }).optional(),
   allowedUserEmails: external_exports.array(external_exports.email()).optional(),
   egressPreset: egressPresetSchema.optional(),
+  // Per-agent idle timeout override in minutes (0 = never hibernate); omit to inherit the global default.
+  hibernationTimeoutMin: external_exports.number().int().min(0).optional(),
   // Optional: clone this public repo (optionally a branch/tag via `ref`) into
   // the work dir once, via a one-shot `workspace-seed` event. Not enforced
   // against the `gitRepos` catalog server-side — the clone runs in the
   // egress-gated agent pod, so this reaches no URL the agent couldn't already
   // reach itself.
   gitRepo: external_exports.object({ url: external_exports.url(), ref: external_exports.string().min(1).optional() }).optional(),
-  // Initial grants, settled into the spec at create so credentials ride the
-  // first snapshot and the gateway renders its chains once (no readiness flap).
-  secretIds: external_exports.array(external_exports.string()).optional(),
-  connectionIds: external_exports.array(external_exports.string()).optional()
+  // Initial connection grants, settled into the spec at create so credentials
+  // ride the first snapshot and the gateway renders its chains once (no
+  // readiness flap).
+  connectionIds: external_exports.array(external_exports.string()).optional(),
+  // The agent's size (#1900): CPU/memory limits, the user-facing "power"
+  // knob the Budget bounds (the UI renders it as sliders). Omitted
+  // dimensions inherit the template's limits, else the chart default.
+  // Requests are derived server-side — never a user concept. Floors match
+  // the chart's derivation floors; the budget gate is the only ceiling.
+  size: agentSizeSchema.optional()
 }).refine((d2) => d2.templateId !== void 0 || d2.image !== void 0, {
   message: "Either templateId or image is required"
 });
@@ -25592,7 +27300,13 @@ var agentUpdateInputSchema = external_exports.object({
   description: external_exports.string().optional(),
   env: external_exports.array(envVarSchema).max(64).optional(),
   secretRef: external_exports.string().optional(),
-  allowedUserEmails: external_exports.array(external_exports.email()).optional()
+  allowedUserEmails: external_exports.array(external_exports.email()).optional(),
+  // Per-agent idle timeout override in minutes (0 = never hibernate); null clears it back to the global default.
+  hibernationTimeoutMin: external_exports.number().int().min(0).nullable().optional(),
+  // Resize (#1900). On a sleeping sandbox the new Size rides the next start
+  // through the budget gate; on a running one the increase is gated
+  // server-side and the pod restarts to apply it.
+  size: agentSizeSchema.optional()
 });
 var agentConnectSlackInputSchema = external_exports.object({
   id: external_exports.string().min(1),
@@ -25688,6 +27402,21 @@ var scheduleStatusSchema = external_exports.object({
   lastResult: external_exports.string().optional()
 });
 
+// ../api-server-api/src/modules/experiments/schemas.ts
+var armVariationSchema = external_exports.string();
+var experimentIdInputSchema = external_exports.object({
+  id: external_exports.string().min(1)
+});
+var experimentCreateInputSchema = external_exports.object({
+  name: external_exports.string().trim().min(1, "name is required").max(200),
+  prompt: external_exports.string().trim().min(1, "prompt is required")
+});
+var experimentAddArmInputSchema = external_exports.object({
+  experimentId: external_exports.string().min(1),
+  agentId: external_exports.string().min(1),
+  armVariation: armVariationSchema.default("")
+});
+
 // ../../node_modules/.pnpm/rrule@2.8.1/node_modules/rrule/dist/esm/index.js
 var esm_exports = {};
 __export(esm_exports, {
@@ -28731,55 +30460,6 @@ function parseHHMM(s) {
   return h2 * 60 + mi;
 }
 
-// ../api-server-api/src/modules/secrets/schemas.ts
-var presetSecretTypeSchema = external_exports.enum([
-  "anthropic",
-  "ibm-litellm",
-  "openai",
-  "bob"
-]);
-var hostPatternSchema = external_exports.string().min(1).max(253).refine((v2) => !v2.includes("*"), {
-  message: "Wildcard host patterns are not supported. Please specify exact hostnames."
-});
-var envMappingSchema = external_exports.object({
-  envName: external_exports.string().min(1).max(255).regex(ENV_NAME_RE, "envName must match [A-Z_][A-Z0-9_]*"),
-  placeholder: external_exports.string().min(1).max(1e3)
-});
-var envMappingsSchema = external_exports.array(envMappingSchema).max(32);
-var secretCreateInputSchema = external_exports.object({
-  type: presetSecretTypeSchema,
-  name: external_exports.string().min(1).max(100),
-  value: external_exports.string().min(1),
-  envMappings: envMappingsSchema.optional()
-});
-var secretUpdateInputSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  name: external_exports.string().min(1).max(100).optional(),
-  value: external_exports.string().min(1).optional(),
-  envMappings: envMappingsSchema.optional()
-});
-var secretDeleteInputSchema = external_exports.object({ id: external_exports.string().min(1) });
-var secretCreateGithubPatInputSchema = external_exports.object({
-  name: external_exports.string().min(1).max(100),
-  token: external_exports.string().min(1)
-});
-var secretUpdateGithubPatInputSchema = external_exports.object({
-  apiSecretId: external_exports.string().min(1),
-  gitSecretId: external_exports.string().min(1),
-  token: external_exports.string().min(1)
-});
-var secretGetAgentAccessInputSchema = external_exports.object({
-  agentId: external_exports.string().min(1)
-});
-var secretSetAgentAccessInputSchema = external_exports.object({
-  agentId: external_exports.string().min(1),
-  secretIds: external_exports.array(external_exports.string().min(1))
-});
-var secretTestAnthropicInputSchema = external_exports.object({
-  value: external_exports.string().min(1),
-  envName: external_exports.enum(["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"])
-});
-
 // ../api-server-api/src/modules/connections/providers.ts
 var DEFAULT_ENV_PLACEHOLDER = "dummy-placeholder";
 var IBM_LITELLM_HOST = "ete-litellm.ai-models.vpc.res.ibm.com";
@@ -28798,6 +30478,12 @@ function ibmLitellmEnvMappings() {
     { envName: "OPENAI_MODEL", placeholder: "gpt-5.5" }
   ];
 }
+function openaiEnvMappings() {
+  return [
+    { envName: "OPENAI_API_KEY", placeholder: DEFAULT_ENV_PLACEHOLDER },
+    { envName: "OPENAI_BASE_URL", placeholder: "https://api.openai.com/v1" }
+  ];
+}
 var BOB_HOST = "api.us-east.bob.ibm.com";
 var BOB_PLACEHOLDER = "dummy-placeholder";
 function bobEnvMappings(pins = {}) {
@@ -28873,9 +30559,7 @@ var PROVIDERS = {
         key: "api-key",
         label: "API Key",
         templateId: "openai",
-        defaultEnvMappings: [
-          { envName: "OPENAI_API_KEY", placeholder: DEFAULT_ENV_PLACEHOLDER }
-        ]
+        defaultEnvMappings: openaiEnvMappings()
       }
     ]
   },
@@ -28904,9 +30588,6 @@ var PROVIDERS = {
 var PROVIDER_PRESET_TYPES = Object.keys(
   PROVIDERS
 );
-function isProviderPresetType(type) {
-  return type in PROVIDERS;
-}
 var TEMPLATE_TO_PROVIDER = new Map(
   PROVIDER_PRESET_TYPES.flatMap(
     (type) => PROVIDERS[type].modes.map(
@@ -28928,230 +30609,6 @@ function templateIdForProvider(type, value) {
   return (matched ?? modes.find((mode) => mode.isDefault) ?? modes[0]).templateId;
 }
 
-// ../agent-runtime-api/src/modules/files/schemas.ts
-var pathSchema = external_exports.string().min(1);
-var fileListDirsInputSchema = external_exports.object({
-  paths: external_exports.array(external_exports.string()).max(500)
-});
-var fileReadInputSchema = external_exports.object({ path: pathSchema });
-var fileWriteInputSchema = external_exports.object({
-  path: pathSchema,
-  content: external_exports.string(),
-  expectedMtimeMs: external_exports.number().optional()
-});
-var fileCreateInputSchema = external_exports.object({
-  path: pathSchema,
-  content: external_exports.string()
-});
-var fileMkdirInputSchema = external_exports.object({ path: pathSchema });
-var fileRenameInputSchema = external_exports.object({
-  from: pathSchema,
-  to: pathSchema,
-  overwrite: external_exports.boolean().optional()
-});
-var fileRemoveInputSchema = external_exports.object({ path: pathSchema });
-var fileUploadInputSchema = external_exports.object({
-  path: pathSchema,
-  contentBase64: external_exports.string(),
-  /** Browser-reported MIME (File.type). Carried in the API for observability
-   *  and forward-compat; server-side reads still detect MIME from magic
-   *  bytes so we don't need to persist this. */
-  contentType: external_exports.string().max(255).optional(),
-  overwrite: external_exports.boolean().optional()
-});
-
-// ../agent-runtime-api/src/modules/skills/schemas.ts
-var skillInstallInputSchema = external_exports.object({
-  sourceUrl: external_exports.string().min(1),
-  name: external_exports.string().min(1),
-  version: external_exports.string().min(1),
-  skillPaths: external_exports.array(external_exports.string().min(1)).min(1)
-});
-var skillUninstallInputSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  skillPaths: external_exports.array(external_exports.string().min(1)).min(1)
-});
-var skillScanInputSchema = external_exports.object({
-  source: external_exports.string().min(1)
-});
-var skillPublishInputSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  owner: external_exports.string().min(1),
-  repo: external_exports.string().min(1),
-  title: external_exports.string().min(1),
-  body: external_exports.string()
-});
-var skillReadLocalInputSchema = external_exports.object({
-  name: external_exports.string().min(1)
-});
-
-// ../agent-runtime-api/src/modules/ssh/schemas.ts
-var sshAuthorizeKeyInputSchema = external_exports.object({
-  publicKey: external_exports.string().min(1).max(8192).refine((s) => !/[\r\n]/.test(s), "must be a single line")
-});
-
-// ../agent-runtime-api/src/modules/import/types.ts
-var importBundleResultSchema = external_exports.object({
-  filesWritten: external_exports.number().int().nonnegative(),
-  bytes: external_exports.number().int().nonnegative(),
-  durationMs: external_exports.number().int().nonnegative()
-});
-
-// ../agent-runtime-api/src/modules/runtime/types.ts
-var contributionKind = external_exports.enum([
-  "env",
-  "egress-allow",
-  "egress-inject",
-  "file",
-  "mcp-entry",
-  "skill-ref"
-]);
-var eventKind = external_exports.enum([
-  "trigger",
-  "schedule-reset",
-  "workspace-seed"
-]);
-var mergeMode = external_exports.enum([
-  "overwrite",
-  "section-marker",
-  "key-targeted",
-  "yaml-fill-if-missing"
-]);
-var fileFormat = external_exports.enum(["yaml", "json", "text", "ini"]);
-var envContribution = external_exports.object({
-  kind: external_exports.literal("env"),
-  name: external_exports.string().min(1),
-  placeholder: external_exports.string()
-});
-var egressAllowContribution = external_exports.object({
-  kind: external_exports.literal("egress-allow"),
-  host: external_exports.string().min(1),
-  pathPattern: external_exports.string().optional()
-});
-var egressInjectContribution = external_exports.object({
-  kind: external_exports.literal("egress-inject"),
-  host: external_exports.string().min(1),
-  pathPattern: external_exports.string().optional(),
-  headerName: external_exports.string().min(1),
-  valueFormat: external_exports.string().min(1),
-  encoding: external_exports.literal("basic-x-access-token").optional(),
-  // Moves the value into this query param instead of the header; restricted to unreserved chars since the Lua treats it as a trusted literal.
-  queryParamName: external_exports.string().regex(/^[A-Za-z0-9_.~-]+$/).optional()
-});
-var fileContribution = external_exports.object({
-  kind: external_exports.literal("file"),
-  path: external_exports.string().min(1),
-  format: fileFormat,
-  mergeMode,
-  content: external_exports.unknown().optional()
-});
-var mcpEntryContribution = external_exports.object({
-  kind: external_exports.literal("mcp-entry"),
-  name: external_exports.string().min(1),
-  url: external_exports.string().url(),
-  headers: external_exports.record(external_exports.string(), external_exports.string()).optional()
-});
-var skillRefContribution = external_exports.object({
-  kind: external_exports.literal("skill-ref"),
-  sourceUrl: external_exports.string().min(1),
-  name: external_exports.string().min(1),
-  version: external_exports.string().min(1)
-});
-var contribution = external_exports.discriminatedUnion("kind", [
-  envContribution,
-  egressAllowContribution,
-  egressInjectContribution,
-  fileContribution,
-  mcpEntryContribution,
-  skillRefContribution
-]);
-var triggerEventPayload = external_exports.object({
-  scheduleId: external_exports.string().min(1),
-  task: external_exports.string().min(1),
-  sessionMode: external_exports.enum(["continuous", "fresh"]).optional(),
-  mcpServers: external_exports.array(external_exports.unknown()).optional()
-});
-var triggerEvent = external_exports.object({
-  id: external_exports.string().min(1),
-  kind: external_exports.literal("trigger"),
-  version: external_exports.number().int().nonnegative(),
-  expiresAt: external_exports.string().datetime({ offset: true }),
-  payload: triggerEventPayload
-});
-var scheduleResetEventPayload = external_exports.object({
-  scheduleId: external_exports.string().min(1)
-});
-var scheduleResetEvent = external_exports.object({
-  id: external_exports.string().min(1),
-  kind: external_exports.literal("schedule-reset"),
-  version: external_exports.number().int().nonnegative(),
-  expiresAt: external_exports.string().datetime({ offset: true }),
-  payload: scheduleResetEventPayload
-});
-var workspaceSeedEventPayload = external_exports.object({
-  url: external_exports.string().min(1),
-  /** Branch or tag to clone; omitted = the repo's default branch. */
-  ref: external_exports.string().min(1).optional()
-});
-var workspaceSeedEvent = external_exports.object({
-  id: external_exports.string().min(1),
-  kind: external_exports.literal("workspace-seed"),
-  version: external_exports.number().int().nonnegative(),
-  expiresAt: external_exports.string().datetime({ offset: true }),
-  payload: workspaceSeedEventPayload
-});
-var event = external_exports.discriminatedUnion("kind", [
-  triggerEvent,
-  scheduleResetEvent,
-  workspaceSeedEvent
-]);
-var capabilities = external_exports.object({
-  contributions: external_exports.array(contributionKind),
-  events: external_exports.array(eventKind)
-});
-var stateSlice = external_exports.object({
-  contributions: external_exports.array(contribution),
-  hash: external_exports.string().min(1)
-});
-var applyStateInput = external_exports.object({
-  version: external_exports.number().int().positive(),
-  state: stateSlice,
-  events: external_exports.array(event)
-});
-var driverFailure = external_exports.object({
-  kind: contributionKind,
-  message: external_exports.string().min(1)
-});
-var applyStateResult = external_exports.discriminatedUnion("status", [
-  // Processed: resulting cursor + any per-driver failures (empty on a fully clean apply).
-  external_exports.object({
-    status: external_exports.literal("ok"),
-    appliedVersion: external_exports.number().int().nonnegative(),
-    appliedHash: external_exports.string().min(1).nullable(),
-    // null until the first clean settle
-    failures: external_exports.array(driverFailure).default([]),
-    settledEvents: external_exports.array(external_exports.string()).default([])
-  }),
-  // Contributions already at ≥ the requested version; worker reconciles. Events still apply (own version) — settledEvents reports which.
-  external_exports.object({
-    status: external_exports.literal("stale"),
-    appliedVersion: external_exports.number().int().nonnegative(),
-    settledEvents: external_exports.array(external_exports.string()).default([])
-  })
-]);
-var helloInput = external_exports.object({
-  lastAppliedVersion: external_exports.number().int().nonnegative().optional(),
-  lastAppliedHash: external_exports.string().optional(),
-  protocolVersion: external_exports.literal("v1"),
-  agentRuntimeVersion: external_exports.string(),
-  capabilities
-});
-var helloResult = external_exports.object({
-  version: external_exports.number().int().positive().optional(),
-  state: stateSlice.optional(),
-  events: external_exports.array(event)
-});
-
 // ../api-server-api/src/modules/secret-store/types.ts
 var secretRef = external_exports.object({
   storeId: external_exports.string().optional(),
@@ -29177,6 +30634,20 @@ var oauthAuth = external_exports.object({
   host: external_exports.string().min(1).optional(),
   appSlug: external_exports.string().min(1).optional()
 });
+var clientCredentialsAuth = external_exports.object({
+  kind: external_exports.literal("client-credentials"),
+  clientId: external_exports.string(),
+  clientSecretRef: secretRef,
+  accessTokenRef: secretRef,
+  issuerUrl: external_exports.string().url(),
+  tokenUrl: external_exports.string().url(),
+  scopes: external_exports.array(external_exports.string()).default([]),
+  audience: external_exports.string().min(1).optional(),
+  expiresAt: external_exports.number().int().optional(),
+  connectedAt: external_exports.number().int().optional(),
+  tokenEndpointAcceptJson: external_exports.boolean().optional(),
+  host: external_exports.string().min(1).optional()
+});
 var headerAuth = external_exports.object({
   kind: external_exports.literal("header"),
   valueRef: secretRef,
@@ -29188,6 +30659,7 @@ var noneAuth = external_exports.object({
 });
 var authConfig = external_exports.discriminatedUnion("kind", [
   oauthAuth,
+  clientCredentialsAuth,
   headerAuth,
   noneAuth
 ]);
@@ -29206,6 +30678,12 @@ var connectionStatus = external_exports.enum([
   "pending",
   "disconnected"
 ]);
+var authKind = external_exports.enum([
+  "oauth",
+  "client-credentials",
+  "header",
+  "none"
+]);
 var connectionView = external_exports.object({
   id: external_exports.string(),
   ownerId: external_exports.string(),
@@ -29213,14 +30691,13 @@ var connectionView = external_exports.object({
   category: connectionCategory,
   name: external_exports.string(),
   status: connectionStatus,
-  authKind: external_exports.enum(["oauth", "header", "none"]),
+  authKind,
   contributions: external_exports.array(contribution),
   connectedAt: external_exports.string().optional(),
   hosts: external_exports.array(external_exports.string()),
   host: external_exports.string().min(1).optional(),
   appSlug: external_exports.string().min(1).optional()
 });
-var authKind = external_exports.enum(["oauth", "header", "none"]);
 var templateInputState = external_exports.enum([
   "required",
   "overridable",
@@ -29282,6 +30759,9 @@ var connectionStartOAuthInputSchema = external_exports.object({
 var connectionDiscoverMcpInputSchema = external_exports.object({
   url: external_exports.string().url()
 });
+var connectionProbeClusterCaInputSchema = external_exports.object({
+  host: external_exports.string().min(1)
+});
 var connectionGetAgentConnectionsInputSchema = external_exports.object({
   agentId: external_exports.string().min(1)
 });
@@ -29318,7 +30798,30 @@ var headerCreateInput = external_exports.object({
   ).optional(),
   // Values for the template's declared config inputs, keyed by input name.
   configInputs: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  value: external_exports.string().min(1)
+  value: external_exports.string().min(1),
+  // Upstream CA bundle for hosts whose TLS cert a public root can't verify
+  // (self-signed cluster CAs). PEM, or base64 of PEM (kubeconfig
+  // `certificate-authority-data`).
+  caData: external_exports.string().optional()
+});
+var clientCredentialsCreateInput = external_exports.object({
+  ...commonFields,
+  authKind: external_exports.literal("client-credentials"),
+  host: external_exports.string().min(1).optional(),
+  // The token endpoint is discovered from the issuer's OAuth metadata.
+  issuerUrl: external_exports.string().url().optional(),
+  clientId: external_exports.string().min(1).optional(),
+  clientSecret: external_exports.string().min(1).optional(),
+  // Space- or comma-separated; the server splits. A single string keeps the
+  // schema-driven forms all-string.
+  scopes: external_exports.string().optional(),
+  audience: external_exports.string().min(1).optional(),
+  headerName: external_exports.string().min(1).optional(),
+  valueFormat: external_exports.string().min(1).optional(),
+  envName: external_exports.string().regex(
+    /^[A-Za-z_][A-Za-z0-9_]*$/,
+    "env var name must be letters, digits, and underscores (not starting with a digit)"
+  ).optional()
 });
 var noneCreateInput = external_exports.object({
   ...commonFields,
@@ -29327,16 +30830,22 @@ var noneCreateInput = external_exports.object({
 });
 var connectionCreateInputSchema = external_exports.discriminatedUnion("authKind", [
   oauthCreateInput,
+  clientCredentialsCreateInput,
   headerCreateInput,
   noneCreateInput
 ]);
+var connectionTestAnthropicInputSchema = external_exports.object({
+  value: external_exports.string().min(1),
+  envName: external_exports.enum(["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"])
+});
 
 // ../api-server-api/src/modules/sessions/types.ts
 var SessionType = {
   Regular: "regular",
   ChannelSlack: "channel_slack",
   ChannelTelegram: "channel_telegram",
-  ScheduleCron: "schedule_cron"
+  ScheduleCron: "schedule_cron",
+  ExperimentTrial: "experiment_trial"
 };
 var SessionMode = /* @__PURE__ */ ((SessionMode2) => {
   SessionMode2["Chat"] = "chat";
@@ -29399,101 +30908,6 @@ var PodFilesEventSchema = external_exports.object({
 });
 var EventKindSchema = external_exports.enum(["snapshot", "upsert"]);
 
-// ../api-server-api/src/modules/skills/schemas.ts
-var skillSourceSchema = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  gitUrl: external_exports.string(),
-  /** True when the source is managed by the cluster admin
-   *  (Helm-seeded). Users can't delete it. */
-  system: external_exports.boolean().optional(),
-  /** Present when the source was declared by an agent template
-   *  (spec.skillSources). UI-only hint for the "Agent" badge —
-   *  backend treats template sources as read-only. */
-  fromTemplate: external_exports.object({ templateId: external_exports.string(), templateName: external_exports.string() }).optional(),
-  canPublish: external_exports.boolean().optional()
-});
-var skillPublishResultSchema = external_exports.object({
-  prUrl: external_exports.string().url(),
-  branch: external_exports.string()
-});
-var skillSchema = external_exports.object({
-  source: external_exports.string(),
-  name: external_exports.string(),
-  description: external_exports.string(),
-  version: external_exports.string(),
-  contentHash: external_exports.string()
-});
-var skillRefSchema = external_exports.object({
-  source: external_exports.string(),
-  name: external_exports.string(),
-  version: external_exports.string(),
-  /** Deterministic SHA-256 of the skill directory's file contents at
-   *  install time. Compared to the scanner's contentHash to flag drift.
-   *  Optional for backward compatibility with installs that pre-date
-   *  this field. */
-  contentHash: external_exports.string().optional()
-});
-var localSkillSchema = external_exports.object({
-  name: external_exports.string(),
-  description: external_exports.string(),
-  skillPath: external_exports.string()
-});
-var skillPublishRecordSchema = external_exports.object({
-  skillName: external_exports.string(),
-  sourceId: external_exports.string(),
-  sourceName: external_exports.string(),
-  sourceGitUrl: external_exports.string(),
-  prUrl: external_exports.string(),
-  /** ISO 8601 timestamp. */
-  publishedAt: external_exports.string()
-});
-var skillStateOutputSchema = external_exports.object({
-  installed: external_exports.array(skillRefSchema),
-  standalone: external_exports.array(localSkillSchema),
-  instancePublishes: external_exports.array(skillPublishRecordSchema)
-});
-var skillListSourcesInputSchema = external_exports.object({ agentId: external_exports.string().min(1).optional() }).optional();
-var skillCreateSourceInputSchema = external_exports.object({
-  name: external_exports.string().min(1).max(128),
-  gitUrl: external_exports.string().url()
-});
-var skillDeleteSourceInputSchema = external_exports.object({
-  id: external_exports.string().min(1)
-});
-var skillRefreshSourceInputSchema = external_exports.object({
-  id: external_exports.string().min(1)
-});
-var skillListInputSchema = external_exports.object({
-  sourceId: external_exports.string().min(1),
-  agentId: external_exports.string().min(1).optional()
-});
-var skillInstallInputSchema2 = external_exports.object({
-  agentId: external_exports.string().min(1),
-  source: external_exports.string().url(),
-  name: external_exports.string().min(1),
-  version: external_exports.string().min(1),
-  contentHash: external_exports.string().optional()
-});
-var skillUninstallInputSchema2 = external_exports.object({
-  agentId: external_exports.string().min(1),
-  source: external_exports.string().url(),
-  name: external_exports.string().min(1)
-});
-var skillListLocalInputSchema = external_exports.object({
-  agentId: external_exports.string().min(1)
-});
-var skillStateInputSchema = external_exports.object({
-  agentId: external_exports.string().min(1)
-});
-var skillPublishInputSchema2 = external_exports.object({
-  agentId: external_exports.string().min(1),
-  sourceId: external_exports.string().min(1),
-  name: external_exports.string().min(1),
-  title: external_exports.string().optional(),
-  body: external_exports.string().optional()
-});
-
 // ../api-server-api/src/modules/approvals/schemas.ts
 var approvalStatusSchema = external_exports.enum(["pending", "resolved", "expired"]);
 var approvalListOptionsSchema = external_exports.object({
@@ -29541,15 +30955,20 @@ function formatEgressRuleSource(source) {
 function formatEgressRuleInline(rule) {
   const parts = [rule.verdict];
   if (rule.method !== "*") parts.push(rule.method);
-  parts.push(joinHostPath(rule.host, rule.pathPattern));
+  parts.push(joinHostPath(rule.host, rule.pathPattern, rule.port));
   return parts.join(" ");
 }
-function joinHostPath(host, pathPattern) {
-  const normalizedHost = host.replace(/\/+$/, "");
+function joinHostPath(host, pathPattern, port) {
+  const normalizedHost = stripTrailingSlashes(host) + (port ? `:${port}` : "");
   if (pathPattern === "*") return normalizedHost;
   const normalizedPath = pathPattern.startsWith("/") ? pathPattern : `/${pathPattern}`;
   return `${normalizedHost}${normalizedPath}`;
 }
+function stripTrailingSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s[end - 1] === "/") end--;
+  return s.slice(0, end);
+}
 
 // ../api-server-api/src/modules/acp/types.ts
 var platformTurnEndedParamsSchema = external_exports.object({
@@ -31203,35 +32622,6 @@ function promptSecret(message) {
   });
 }
 
-// src/modules/agent/lib/group-github-pats.ts
-var API_HOST = "api.github.com";
-var GIT_HOST = "github.com";
-function groupGithubPats(secrets) {
-  const byName2 = /* @__PURE__ */ new Map();
-  for (const s of secrets) {
-    const slot = s.hostPattern === API_HOST ? "api" : s.hostPattern === GIT_HOST ? "git" : null;
-    if (!slot) continue;
-    let group = byName2.get(s.name);
-    if (!group) {
-      group = { api: [], git: [] };
-      byName2.set(s.name, group);
-    }
-    group[slot].push(s.id);
-  }
-  const pairs = [];
-  for (const [name, group] of byName2) {
-    if (group.api.length === 1 && group.git.length === 1) {
-      pairs.push({
-        name,
-        apiSecretId: group.api[0],
-        gitSecretId: group.git[0]
-      });
-    }
-  }
-  pairs.sort((a, b2) => a.name.localeCompare(b2.name));
-  return pairs;
-}
-
 // src/modules/connection/services/connection-service.ts
 function createConnectionService(deps) {
   const readIds = async (agentId) => {
@@ -31263,6 +32653,11 @@ function createConnectionService(deps) {
     async discoverMcp(url2) {
       return trpcCall(() => deps.trpc.connections.discoverMcp.mutate({ url: url2 }));
     },
+    async probeClusterCa(host) {
+      return trpcCall(
+        () => deps.trpc.connections.probeClusterCa.mutate({ host })
+      );
+    },
     async getConnection(id) {
       return trpcCall(() => deps.trpc.connections.get.query({ id }));
     },
@@ -31485,34 +32880,14 @@ hint: run \`dam auth login\` first`
     process.exit(EXIT_RUNTIME_FAILURE);
   }
   spin.message("Granting credentials...");
-  const connectionIds = [];
-  const secretIds = [];
-  if (provider.routing.kind === "connection") {
-    connectionIds.push(provider.routing.id);
-  } else {
-    secretIds.push(provider.routing.id);
-  }
-  if (githubPat) {
-    if (githubPat.source === "connection") {
-      connectionIds.push(githubPat.connectionId);
-    } else {
-      secretIds.push(githubPat.apiSecretId, githubPat.gitSecretId);
-    }
-  }
+  const connectionIds = [provider.routing.id];
+  if (githubPat) connectionIds.push(githubPat.connectionId);
   try {
     await withRetry(async () => {
-      if (connectionIds.length > 0) {
-        await trpc.connections.setAgentConnections.mutate({
-          agentId: cleanup.agentId,
-          connectionIds
-        });
-      }
-      if (secretIds.length > 0) {
-        await trpc.secrets.setAgentAccess.mutate({
-          agentId: cleanup.agentId,
-          secretIds
-        });
-      }
+      await trpc.connections.setAgentConnections.mutate({
+        agentId: cleanup.agentId,
+        connectionIds
+      });
     });
   } catch (e2) {
     spin.stop("Grant failed");
@@ -31619,7 +32994,6 @@ async function listCredentials(trpc, cleanup) {
   try {
     return {
       conns: await trpc.connections.list.query(),
-      secrets: await trpc.secrets.list.query(),
       templates: await trpc.connections.listTemplates.query()
     };
   } catch (e2) {
@@ -31629,12 +33003,9 @@ async function listCredentials(trpc, cleanup) {
   }
 }
 async function pickProvider(trpc, cleanup) {
-  const { conns, secrets, templates } = await listCredentials(trpc, cleanup);
+  const { conns, templates } = await listCredentials(trpc, cleanup);
   const existingConns = providerConns(conns);
-  const existingSecrets = secrets.filter(
-    (s) => isProviderPresetType(s.type)
-  ).map((s) => ({ id: s.id, name: s.name, type: s.type }));
-  if (existingConns.length === 0 && existingSecrets.length === 0) {
+  if (existingConns.length === 0) {
     R2.info("No model providers configured yet \u2014 let's add one.");
     return addOrReplaceProvider(trpc, cleanup, existingConns, templates);
   }
@@ -31646,10 +33017,6 @@ async function pickProvider(trpc, cleanup) {
         value: `conn:${c2.id}`,
         label: `${c2.name} (${c2.type})`
       })),
-      ...existingSecrets.map((s) => ({
-        value: `secret:${s.id}`,
-        label: `${s.name} (${s.type}) (legacy)`
-      })),
       { value: NEW, label: "Add new..." }
     ]
   });
@@ -31657,17 +33024,9 @@ async function pickProvider(trpc, cleanup) {
   if (picked === NEW) {
     return addOrReplaceProvider(trpc, cleanup, existingConns, templates);
   }
-  if (picked.startsWith("conn:")) {
-    const found2 = existingConns.find((c2) => `conn:${c2.id}` === picked);
-    return {
-      routing: { kind: "connection", id: found2.id },
-      name: found2.name,
-      type: found2.type
-    };
-  }
-  const found = existingSecrets.find((s) => `secret:${s.id}` === picked);
+  const found = existingConns.find((c2) => `conn:${c2.id}` === picked);
   return {
-    routing: { kind: "secret", id: found.id },
+    routing: { id: found.id },
     name: found.name,
     type: found.type
   };
@@ -31697,7 +33056,7 @@ async function addOrReplaceProvider(trpc, cleanup, existingConns, templates) {
       if (q(replace)) return cancelAndCleanup(trpc, cleanup);
       if (!replace) {
         return {
-          routing: { kind: "connection", id: existingOfType.id },
+          routing: { id: existingOfType.id },
           name: existingOfType.name,
           type
         };
@@ -31721,7 +33080,7 @@ async function addOrReplaceProvider(trpc, cleanup, existingConns, templates) {
           value: value2
         });
         return {
-          routing: { kind: "connection", id: existingOfType.id },
+          routing: { id: existingOfType.id },
           name: existingOfType.name,
           type
         };
@@ -31823,17 +33182,16 @@ async function createProviderConnection(trpc, cleanup, type, templateId, value,
   });
   if (!created) return null;
   return {
-    routing: { kind: "connection", id: created.id },
+    routing: { id: created.id },
     name: created.name,
     type
   };
 }
 var DEFAULT_GITHUB_PAT_NAME = GITHUB_PAT_TEMPLATE_ID;
 async function pickGithubPat(trpc, cleanup) {
-  const { conns, secrets } = await listCredentials(trpc, cleanup);
+  const { conns } = await listCredentials(trpc, cleanup);
   const patConns = conns.filter((c2) => c2.templateId === GITHUB_PAT_TEMPLATE_ID);
-  const pairs = groupGithubPats(secrets);
-  if (patConns.length === 0 && pairs.length === 0) {
+  if (patConns.length === 0) {
     R2.info("No GitHub PAT configured yet.");
     const add = await ue({ message: "Add one?", initialValue: true });
     if (q(add)) return cancelAndCleanup(trpc, cleanup);
@@ -31846,10 +33204,6 @@ async function pickGithubPat(trpc, cleanup) {
     message: "GitHub PAT",
     options: [
       ...patConns.map((c2) => ({ value: `conn:${c2.id}`, label: c2.name })),
-      ...pairs.map((p2) => ({
-        value: `secret:${p2.name}`,
-        label: `${p2.name} (legacy)`
-      })),
       { value: NEW, label: "Add new..." },
       { value: SKIP, label: "Skip" }
     ]
@@ -31857,17 +33211,8 @@ async function pickGithubPat(trpc, cleanup) {
   if (q(picked)) return cancelAndCleanup(trpc, cleanup);
   if (picked === SKIP) return null;
   if (picked === NEW) return addOrReplaceGithubPat(trpc, cleanup, patConns);
-  if (picked.startsWith("conn:")) {
-    const found2 = patConns.find((c2) => `conn:${c2.id}` === picked);
-    return { source: "connection", connectionId: found2.id, name: found2.name };
-  }
-  const found = pairs.find((p2) => `secret:${p2.name}` === picked);
-  return {
-    source: "secret",
-    apiSecretId: found.apiSecretId,
-    gitSecretId: found.gitSecretId,
-    name: found.name
-  };
+  const found = patConns.find((c2) => `conn:${c2.id}` === picked);
+  return { connectionId: found.id, name: found.name };
 }
 async function addOrReplaceGithubPat(trpc, cleanup, existing) {
   const collide = existing.find((c2) => c2.name === DEFAULT_GITHUB_PAT_NAME);
@@ -31879,21 +33224,13 @@ async function addOrReplaceGithubPat(trpc, cleanup, existing) {
       });
       if (q(replace)) return cancelAndCleanup(trpc, cleanup);
       if (!replace) {
-        return {
-          source: "connection",
-          connectionId: collide.id,
-          name: collide.name
-        };
+        return { connectionId: collide.id, name: collide.name };
       }
       const token2 = await promptSecret("New GitHub personal access token");
       if (q(token2)) return cancelAndCleanup(trpc, cleanup);
       try {
         await trpc.connections.update.mutate({ id: collide.id, value: token2 });
-        return {
-          source: "connection",
-          connectionId: collide.id,
-          name: collide.name
-        };
+        return { connectionId: collide.id, name: collide.name };
       } catch (e2) {
         R2.error(`Failed to replace GitHub PAT: ${errorReason2(e2)}`);
         continue;
@@ -31908,11 +33245,7 @@ async function addOrReplaceGithubPat(trpc, cleanup, existing) {
       nameExample: "my-github"
     });
     if (created) {
-      return {
-        source: "connection",
-        connectionId: created.id,
-        name: created.name
-      };
+      return { connectionId: created.id, name: created.name };
     }
   }
 }
@@ -38137,11 +39470,40 @@ var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
+// src/modules/shared/ws-proxy.ts
+var import_http_proxy_agent = __toESM(require_dist2(), 1);
+var import_https_proxy_agent = __toESM(require_dist3(), 1);
+function proxyAgentForUrl(url2, env = process.env) {
+  let target;
+  try {
+    target = new URL(url2);
+  } catch {
+    return void 0;
+  }
+  const secure = target.protocol === "wss:" || target.protocol === "https:";
+  const proxy = secure ? env.HTTPS_PROXY ?? env.https_proxy : env.HTTP_PROXY ?? env.http_proxy;
+  if (!proxy) return void 0;
+  if (isNoProxy(target.hostname, env.NO_PROXY ?? env.no_proxy))
+    return void 0;
+  return secure ? new import_https_proxy_agent.HttpsProxyAgent(proxy) : new import_http_proxy_agent.HttpProxyAgent(proxy);
+}
+function isNoProxy(host, noProxy) {
+  if (!noProxy) return false;
+  for (const raw of noProxy.split(",")) {
+    const entry = raw.trim();
+    if (entry === "") continue;
+    if (entry === "*") return true;
+    const bare = (entry.startsWith(".") ? entry.slice(1) : entry).toLowerCase();
+    if (host === bare || host.endsWith(`.${bare}`)) return true;
+  }
+  return false;
+}
+
 // src/modules/chat/infrastructure/acp-session-client.ts
 var TIMEOUT_MS = 12e4;
 function wsStream(url2) {
   return new Promise((resolve4, reject) => {
-    const ws = new import_websocket.default(url2);
+    const ws = new import_websocket.default(url2, { agent: proxyAgentForUrl(url2) });
     ws.on("open", () => {
       const readable = new ReadableStream({
         start(controller) {
@@ -38190,6 +39552,7 @@ function toSessionView(agentId, s) {
     mode: p2 ? p2.mode ?? "chat" /* Chat */ : "terminal" /* Terminal */,
     createdAt: p2?.createdAt ?? s.updatedAt ?? (/* @__PURE__ */ new Date(0)).toISOString(),
     scheduleId: p2?.scheduleId ?? null,
+    experimentId: p2?.experimentId ?? null,
     title: s.title ?? null,
     updatedAt: s.updatedAt ?? null
   };
@@ -38296,9 +39659,8 @@ function connectTerminalBridge({
     const proto = host.startsWith("https://") ? "wss:" : "ws:";
     const base = host.replace(/^https?:\/\//, "").replace(/\/+$/, "");
     const sep = terminalPath.includes("?") ? "&" : "?";
-    const ws = new wrapper_default(
-      `${proto}//${base}${terminalPath}${sep}token=${encodeURIComponent(token)}`
-    );
+    const url2 = `${proto}//${base}${terminalPath}${sep}token=${encodeURIComponent(token)}`;
+    const ws = new wrapper_default(url2, { agent: proxyAgentForUrl(url2) });
     const onData = (chunk) => {
       if (ws.readyState === wrapper_default.OPEN)
         ws.send(encodeDataFrame(OP_INPUT, new Uint8Array(chunk)));
@@ -38518,13 +39880,13 @@ function createSessionsPort(deps) {
 }
 
 // src/modules/chat/compose.ts
+var buildSessionsPort = (host, token) => createSessionsPort({ acp: createAcpSessionClient({ host, token }) });
 function composeChatModule({
   compatService,
   configService,
   tokenProvider,
   createAgentService: createAgentService2
 }) {
-  const buildSessionsPort = (host, token) => createSessionsPort({ acp: createAcpSessionClient({ host, token }) });
   const chatService = createChatService({
     compatService,
     configService,
@@ -38812,7 +40174,7 @@ function createProcessEnvReader() {
 
 // src/modules/cli/infrastructure/package-version.ts
 function readPackageVersion() {
-  return true ? "0.2.5-rc1" : DEV_VERSION;
+  return true ? "0.2.7-rc1" : DEV_VERSION;
 }
 
 // src/modules/cli/infrastructure/version-probe.ts
@@ -39039,10 +40401,22 @@ function buildConnectCommand(deps) {
   ).option(
     "--auth <mode>",
     "MCP auth mode: oauth | none (default: auto-detect from the server)"
-  ).option("--url <url>", "input: url").option("--host <host>", "input: host").option("--client-id <id>", "input: OAuth client id").option("--client-secret <secret>", "input: OAuth client secret").option("--app-slug <slug>", "input: GitHub App slug").option("--header-name <name>", "input: header name").option("--value-format <format>", "input: header value format").option(
+  ).option("--url <url>", "input: url").option("--host <host>", "input: host").option("--client-id <id>", "input: OAuth client id").option("--client-secret <secret>", "input: OAuth client secret").option(
+    "--issuer-url <url>",
+    "input: OAuth issuer URL \u2014 the token endpoint is discovered from its metadata (client credentials)"
+  ).option(
+    "--scopes <scopes>",
+    "input: OAuth scopes, space- or comma-separated (client credentials)"
+  ).option(
+    "--audience <audience>",
+    "input: OAuth audience (client credentials)"
+  ).option("--app-slug <slug>", "input: GitHub App slug").option("--header-name <name>", "input: header name").option("--value-format <format>", "input: header value format").option(
     "--env-name <name>",
     "input: expose the credential to the agent as this env var (custom header credentials)"
   ).option("--value <value>", "input: header secret value").option(
+    "--ca-data <data>",
+    "input: upstream CA certificate \u2014 PEM or base64 (a kubeconfig's certificate-authority-data)"
+  ).option(
     "-c, --config <key=value>",
     "set an optional template config input (e.g. -c model=premium-shell), repeatable",
     (val, prev) => [...prev, val],
@@ -39059,7 +40433,7 @@ function buildConnectCommand(deps) {
     String(DEFAULT_TIMEOUT_SECONDS3)
   ).addHelpText(
     "after",
-    "\nExamples:\n  dam connection connect github\n  dam connection connect github --client-id Iv1.\u2026 --client-secret \u2026  # use your own OAuth app\n  dam connection connect github --no-browser\n  dam connection connect my-api --header-name X-API-Key --value sk-\u2026\n  dam connection connect bob --value sk-\u2026 --config model=premium-shell --config chatMode=code\n  dam connection connect https://mcp.example.com\n  dam connection connect https://mcp.example.com --auth none\n"
+    "\nExamples:\n  dam connection connect github\n  dam connection connect github --client-id Iv1.\u2026 --client-secret \u2026  # use your own OAuth app\n  dam connection connect github --no-browser\n  dam connection connect my-api --header-name X-API-Key --value sk-\u2026\n  dam connection connect custom-client-credentials --host api.example.com \\\n      --issuer-url https://auth.example.com/realms/main --client-id \u2026 --client-secret \u2026\n  dam connection connect bob --value sk-\u2026 --config model=premium-shell --config chatMode=code\n  dam connection connect https://mcp.example.com\n  dam connection connect https://mcp.example.com --auth none\n"
   ).action(async (providerOrUrl, opts) => {
     const json2 = opts.json ?? false;
     const timeoutSeconds = parseTimeout2(opts.timeout);
@@ -39115,6 +40489,9 @@ function buildConnectCommand(deps) {
 `);
       process.exit(EXIT_INVALID_INPUT);
     }
+    if (template.id === "kubernetes" && payload.authKind === "header" && !payload.caData && values.host && !checkClusterTrust(await svc.probeClusterCa(values.host), values.host)) {
+      process.exit(EXIT_INVALID_INPUT);
+    }
     const createRes = await svc.createConnection(payload);
     if (!createRes.ok) {
       printServiceError(createRes.error, host);
@@ -39304,6 +40681,20 @@ function buildPayload(template, name, values) {
         ...v2("clientSecret") ? { clientSecret: v2("clientSecret") } : {},
         ...v2("appSlug") ? { appSlug: v2("appSlug") } : {}
       };
+    case "client-credentials":
+      return {
+        ...common2,
+        authKind: "client-credentials",
+        ...v2("host") ? { host: v2("host") } : {},
+        ...v2("issuerUrl") ? { issuerUrl: v2("issuerUrl") } : {},
+        ...v2("clientId") ? { clientId: v2("clientId") } : {},
+        ...v2("clientSecret") ? { clientSecret: v2("clientSecret") } : {},
+        ...v2("scopes") ? { scopes: v2("scopes") } : {},
+        ...v2("audience") ? { audience: v2("audience") } : {},
+        ...v2("headerName") ? { headerName: v2("headerName") } : {},
+        ...v2("valueFormat") ? { valueFormat: v2("valueFormat") } : {},
+        ...v2("envName") ? { envName: v2("envName") } : {}
+      };
     case "header": {
       const value = v2("value");
       if (!value) return { error: "the secret value is required (--value)" };
@@ -39320,6 +40711,7 @@ function buildPayload(template, name, values) {
         ...v2("headerName") ? { headerName: v2("headerName") } : {},
         ...v2("valueFormat") ? { valueFormat: v2("valueFormat") } : {},
         ...v2("envName") ? { envName: v2("envName") } : {},
+        ...v2("caData") ? { caData: v2("caData") } : {},
         ...Object.keys(configInputs).length > 0 ? { configInputs } : {},
         value
       };
@@ -39332,6 +40724,24 @@ function buildPayload(template, name, values) {
       };
   }
 }
+function checkClusterTrust(probeRes, host) {
+  if (!probeRes.ok) return true;
+  const probe = probeRes.value;
+  if (probe.trusted) return true;
+  if (probe.reachable) {
+    process.stderr.write(
+      `error: the API server at ${host} presents a certificate that isn't publicly trusted${probe.error ? ` (${probe.error})` : ""}.
+  Pass --ca-data with the cluster CA \u2014 the certificate-authority-data value from your kubeconfig (base64 or PEM).
+`
+    );
+    return false;
+  }
+  process.stderr.write(
+    `warning: couldn't reach ${host} to check its certificate${probe.error ? ` (${probe.error})` : ""}; continuing.
+`
+  );
+  return true;
+}
 async function pollUntilActive(svc, id, timeoutSeconds) {
   const deadline = Date.now() + timeoutSeconds * 1e3;
   while (true) {
@@ -39398,13 +40808,17 @@ function flagListFor(inputs) {
 var FIELD_LABELS = {
   url: "URL",
   host: "Host",
+  issuerUrl: "Issuer URL",
   headerName: "Header name",
   valueFormat: "Value format",
   value: "Secret value",
   clientId: "Client ID",
   clientSecret: "Client secret",
+  scopes: "Scopes (space-separated)",
+  audience: "Audience",
   appSlug: "GitHub App slug",
-  envName: "Env var name"
+  envName: "Env var name",
+  caData: "Cluster CA certificate"
 };
 function labelFor(key) {
   return FIELD_LABELS[key] ?? key;
@@ -42357,11 +43771,14 @@ function deriveSourceName(gitUrl) {
 // src/modules/skill/commands/source-add.ts
 function buildSourceAddCommand(deps) {
   return new Command("add").description("Register a skill source from a git URL").argument("<git-url>", "git URL of the skill source repository").option("--name <name>", "source name (default: derived from the git URL)").option(
+    "--path <path>",
+    "optional subdirectory within the repository to scan for skills"
+  ).option(
     "--server <url>",
     "override the configured server URL for this call"
   ).option("--json", "emit the created SkillSource as JSON").addHelpText(
     "after",
-    "\nThe name defaults to the URL path (github.com/acme/skills \u2192 acme/skills);\npass --name to override. Adding a URL that a Platform or Agent source already\nuses shadows it \u2014 removing your source re-exposes the original.\n\nExamples:\n  dam skill source add https://github.com/anthropics/skills\n  dam skill source add https://github.com/acme/skills --name acme\n"
+    "\nThe name defaults to the URL path (github.com/acme/skills \u2192 acme/skills);\npass --name to override. Adding a URL that a Platform or Agent source already\nuses shadows it \u2014 removing your source re-exposes the original.\n\nExamples:\n  dam skill source add https://github.com/anthropics/skills\n  dam skill source add https://github.com/acme/skills --name acme\n  dam skill source add https://github.com/acme/monorepo --path .claude/skills\n"
   ).action(
     async (gitUrl, opts) => {
       const json2 = opts.json ?? false;
@@ -42380,6 +43797,19 @@ function buildSourceAddCommand(deps) {
 `);
         process.exit(EXIT_INVALID_INPUT);
       }
+      let path2;
+      if (opts.path !== void 0) {
+        const pathCheck = skillCreateSourceInputSchema.shape.path.safeParse(
+          opts.path
+        );
+        if (!pathCheck.success) {
+          const msg = pathCheck.error.issues[0]?.message ?? "invalid path";
+          process.stderr.write(`error: ${msg}
+`);
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        path2 = pathCheck.data || void 0;
+      }
       const host = await resolveActiveHost(deps, {
         flag: opts.server ? { server: opts.server } : void 0,
         exitCodes: {
@@ -42387,7 +43817,7 @@ function buildSourceAddCommand(deps) {
           belowFloor: EXIT_BELOW_FLOOR
         }
       });
-      const result = await deps.createSkillsService(host).addSource({ name, gitUrl });
+      const result = await deps.createSkillsService(host).addSource({ name, gitUrl, path: path2 });
       if (!result.ok) {
         if (result.error.kind === "source-exists") {
           process.stderr.write(
@@ -42434,12 +43864,12 @@ async function resolveName(gitUrl, flag, json2) {
 }
 
 // src/modules/skill/commands/source-list.ts
-var HEADER3 = ["ID", "NAME", "GIT URL", "KIND"];
+var HEADER3 = ["ID", "NAME", "GIT URL", "PATH", "KIND"];
 function tableFor3(sources) {
   const sorted = [...sources].sort((a, b2) => a.name.localeCompare(b2.name));
   return renderTable([
     HEADER3,
-    ...sorted.map((s) => [s.id, s.name, s.gitUrl, sourceKind(s)])
+    ...sorted.map((s) => [s.id, s.name, s.gitUrl, s.path ?? "", sourceKind(s)])
   ]);
 }
 function buildSourceListCommand(deps) {
@@ -42882,9 +44312,8 @@ function connectRawBridge({
     let settled = false;
     const proto = host.startsWith("https://") ? "wss:" : "ws:";
     const base = host.replace(/^https?:\/\//, "").replace(/\/+$/, "");
-    const ws = new wrapper_default(
-      `${proto}//${base}/api/agents/${encodeURIComponent(agentId)}/ssh?token=${encodeURIComponent(token)}`
-    );
+    const url2 = `${proto}//${base}/api/agents/${encodeURIComponent(agentId)}/ssh?token=${encodeURIComponent(token)}`;
+    const ws = new wrapper_default(url2, { agent: proxyAgentForUrl(url2) });
     ws.binaryType = "nodebuffer";
     const onStdin = (chunk) => {
       if (ws.readyState === wrapper_default.OPEN) ws.send(chunk, { binary: true });
@@ -43423,6 +44852,213 @@ function composeSshModule(opts) {
   return { commands: [buildSshCommand(opts)] };
 }
 
+// src/modules/metrics/commands/show.ts
+var secs = (ms) => `${(ms / 1e3).toFixed(1)}s`;
+function buildMetricsCommand(deps) {
+  return new Command("metrics").description(
+    "Show an Agent's run metrics \u2014 token spend, runtime, and context usage"
+  ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
+    "--since <hours>",
+    "lookback window in hours (max 720; default: all time)"
+  ).option("--session <id>", "narrow to one session").option(
+    "--limit <n>",
+    "max recent calls to include (default 100, max 1000)"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit raw JSON instead of the default report").addHelpText(
+    "after",
+    "\nExamples:\n  dam metrics my-agent\n  dam metrics my-agent --session sess-abc123\n  dam metrics agent-abc123 --since 168 --json\n"
+  ).action(
+    async (ref, opts) => {
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const resolved = await createAgentResolver({
+        agentService: deps.createAgentService(host)
+      }).resolve(ref);
+      if (!resolved.ok) {
+        printResolveError(resolved.error, host);
+        process.exit(exitCodeForResolveError(resolved.error));
+      }
+      const agent = resolved.value;
+      const fetchTitles = async () => {
+        const tok = await deps.tokenProvider.getValidAccessToken(host);
+        if (!tok.ok) return /* @__PURE__ */ new Map();
+        const sessions = await deps.createSessionsPort(host, tok.value).list(agent.id);
+        if (!sessions.ok) return /* @__PURE__ */ new Map();
+        return new Map(
+          sessions.value.filter((s) => s.title).map((s) => [s.sessionId, s.title])
+        );
+      };
+      const sinceHours = opts.since ? Number(opts.since) : void 0;
+      const [result, titles] = await Promise.all([
+        deps.createMetricsService(host).overview({
+          agentId: agent.id,
+          sessionId: opts.session,
+          sinceHours,
+          limit: opts.limit ? Number(opts.limit) : 100
+        }),
+        fetchTitles().catch(() => /* @__PURE__ */ new Map())
+      ]);
+      if (!result.ok) {
+        printServiceError(result.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      const { tokenSpendByModel, contextPerCall } = result.value;
+      const runtimeBySession = result.value.runtimeBySession.map((r) => ({
+        ...r,
+        title: titles.get(r.sessionId) ?? null
+      }));
+      const windowLabel = [
+        opts.session && `session ${opts.session}`,
+        sinceHours !== void 0 && `last ${sinceHours}h`
+      ].filter(Boolean).join(" \xB7 ") || "all time";
+      if (opts.json) {
+        return writeStdoutAndExit(
+          `${JSON.stringify({
+            agentId: agent.id,
+            sessionId: opts.session,
+            sinceHours,
+            tokenSpendByModel,
+            runtimeBySession,
+            contextPerCall
+          })}
+`,
+          EXIT_SUCCESS
+        );
+      }
+      if (tokenSpendByModel.length === 0) {
+        process.stderr.write(
+          `No metrics for ${agent.name} in ${windowLabel}.
+`
+        );
+        process.exit(EXIT_SUCCESS);
+      }
+      const totalCalls = tokenSpendByModel.reduce((n, r) => n + r.calls, 0);
+      const totalCost = tokenSpendByModel.reduce((n, r) => n + r.costUsd, 0);
+      const totalApiMs = runtimeBySession.reduce(
+        (n, r) => n + r.totalDurationMs,
+        0
+      );
+      const summary = renderTable([
+        ["AGENT", `${agent.name} (${agent.id})`],
+        ["WINDOW", windowLabel],
+        ["API CALLS", String(totalCalls)],
+        ["SESSIONS", String(runtimeBySession.length)],
+        ["API TIME", secs(totalApiMs)],
+        ["COST USD", totalCost.toFixed(4)]
+      ]);
+      const byModel = renderTable([
+        [
+          "MODEL",
+          "CALLS",
+          "INPUT",
+          "OUTPUT",
+          "CACHE R",
+          "CACHE W",
+          "COST USD"
+        ],
+        ...tokenSpendByModel.map((r) => [
+          r.model,
+          String(r.calls),
+          r.inputTokens.toLocaleString(),
+          r.outputTokens.toLocaleString(),
+          r.cacheReadTokens.toLocaleString(),
+          r.cacheCreationTokens.toLocaleString(),
+          r.costUsd.toFixed(4)
+        ])
+      ]);
+      const bySession = renderFittedTable(
+        [
+          "SESSION",
+          "CALLS",
+          "API TIME",
+          "INPUT",
+          "OUTPUT",
+          "CACHE R",
+          "CACHE W",
+          "COST USD",
+          "LAST"
+        ],
+        runtimeBySession.map((r) => [
+          r.title ?? r.sessionId,
+          String(r.calls),
+          secs(r.totalDurationMs),
+          r.inputTokens.toLocaleString(),
+          r.outputTokens.toLocaleString(),
+          r.cacheReadTokens.toLocaleString(),
+          r.cacheCreationTokens.toLocaleString(),
+          r.costUsd.toFixed(4),
+          r.lastAt
+        ]),
+        0
+      );
+      const recent = renderTable([
+        [
+          "TIME",
+          "MODEL",
+          "CONTEXT",
+          "INPUT",
+          "CACHE R",
+          "OUTPUT",
+          "COST USD"
+        ],
+        ...contextPerCall.map((r) => [
+          r.at,
+          r.model,
+          r.contextTokens.toLocaleString(),
+          r.inputTokens.toLocaleString(),
+          r.cacheReadTokens.toLocaleString(),
+          r.outputTokens.toLocaleString(),
+          r.costUsd.toFixed(4)
+        ])
+      ]);
+      return writeStdoutAndExit(
+        `${summary}
+TOKEN SPEND BY MODEL
+${byModel}
+SESSIONS
+${bySession}
+RECENT CALLS (context per call)
+${recent}`,
+        EXIT_SUCCESS
+      );
+    }
+  );
+}
+
+// src/modules/metrics/services/metrics-service.ts
+function createMetricsService(deps) {
+  return {
+    async overview(query) {
+      return trpcCall(() => deps.trpc.metrics.overview.query(query));
+    }
+  };
+}
+
+// src/modules/metrics/compose.ts
+function composeMetricsModule(opts) {
+  return {
+    commands: [
+      buildMetricsCommand({
+        compatService: opts.compatService,
+        configService: opts.configService,
+        tokenProvider: opts.tokenProvider,
+        createAgentService: opts.createAgentService,
+        createSessionsPort: buildSessionsPort,
+        createMetricsService: (host) => createMetricsService({
+          trpc: createTrpcClient({ host, tokenProvider: opts.tokenProvider })
+        })
+      })
+    ]
+  };
+}
+
 // src/modules/template/commands/list.ts
 var DESCRIPTION_MAX = 60;
 function buildListCommand8(deps) {
@@ -43609,6 +45245,12 @@ function compose(opts = {}) {
     compatService: cli.services.compatService,
     createAgentService: agent.exports.createService
   });
+  const metrics = composeMetricsModule({
+    tokenProvider: auth.exports.tokenProvider,
+    configService: cli.services.configService,
+    compatService: cli.services.compatService,
+    createAgentService: agent.exports.createService
+  });
   const program3 = new Command();
   program3.name("dam").description("Command-line client for a Platform deployment").version(cli.cliVersion);
   for (const command of cli.commands) program3.addCommand(command);
@@ -43625,6 +45267,7 @@ function compose(opts = {}) {
   for (const command of skill.commands) program3.addCommand(command);
   for (const command of ssh.commands) program3.addCommand(command);
   for (const command of channel.commands) program3.addCommand(command);
+  for (const command of metrics.commands) program3.addCommand(command);
   return program3;
 }