@meistrari/tela-cli 1.0.0 → 1.1.0

package/dist/index.js

@@ -50516,6 +50516,18 @@ var require_reference = __commonJS({
   }
 });
 
+// ../../packages/workflow-code/dist/vault/asset.js
+var require_asset = __commonJS({
+  "../../packages/workflow-code/dist/vault/asset.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.workflowCodeVaultAssetKey = workflowCodeVaultAssetKey;
+    function workflowCodeVaultAssetKey(workflowKey, asset) {
+      return JSON.stringify([workflowKey, asset.path, asset.name ?? null, asset.mimeType ?? null]);
+    }
+  }
+});
+
 // ../../node_modules/.pnpm/source-map@0.6.1/node_modules/source-map/lib/base64.js
 var require_base64 = __commonJS({
   "../../node_modules/.pnpm/source-map@0.6.1/node_modules/source-map/lib/base64.js"(exports2) {
@@ -264499,7 +264511,7 @@ var require_output_schema = __commonJS({
   "../../packages/workflow-code/dist/compiler/output-schema.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.SPLITTER_OUTPUT_JSON_SCHEMA = exports2.FILE_INPUT_JSON_SCHEMA = exports2.FILE_OUTPUT_JSON_SCHEMA = void 0;
+    exports2.CROP_OUTPUT_JSON_SCHEMA = exports2.SPLITTER_OUTPUT_JSON_SCHEMA = exports2.FILE_INPUT_JSON_SCHEMA = exports2.FILE_OUTPUT_JSON_SCHEMA = void 0;
     exports2.createPromptOutputJsonSchema = createPromptOutputJsonSchema;
     exports2.selectOutputJsonSchema = selectOutputJsonSchema;
     exports2.isFileCompatibleOutputJsonSchema = isFileCompatibleOutputJsonSchema;
@@ -264535,6 +264547,21 @@ var require_output_schema = __commonJS({
         required: Object.freeze(["startPage", "endPage", "pages", "originalFile", "file", "description", "fileType"])
       })
     });
+    exports2.CROP_OUTPUT_JSON_SCHEMA = Object.freeze({
+      type: "array",
+      items: Object.freeze({
+        type: "object",
+        properties: Object.freeze({
+          indexes: Object.freeze({
+            type: "array",
+            items: Object.freeze({ anyOf: Object.freeze([{ type: "integer" }, { type: "string" }]) })
+          }),
+          originalFile: exports2.FILE_OUTPUT_JSON_SCHEMA,
+          file: exports2.FILE_OUTPUT_JSON_SCHEMA
+        }),
+        required: Object.freeze(["indexes", "originalFile", "file"])
+      })
+    });
     function createPromptOutputJsonSchema(schema) {
       return schema === void 0 || schema === null ? void 0 : { type: "object", properties: schema };
     }
@@ -266379,6 +266406,7 @@ var require_modules = __commonJS({
     var workflow_shared_1 = require_cjs2();
     var remote_1 = require_remote();
     var reference_1 = require_reference();
+    var asset_1 = require_asset();
     var extract_1 = require_extract3();
     var imports_1 = require_imports();
     var remote_refs_1 = require_remote_refs();
@@ -266699,7 +266727,7 @@ var require_modules = __commonJS({
       lower(node, context) {
         if (validateSplitterInput(node).length > 0)
           return void 0;
-        const loweredFile = lowerSplitterFile(node.input.file, context);
+        const loweredFile = lowerDocumentFile(node.input.file, context, "splitter.input.file");
         context.diagnostics.push(...loweredFile.diagnostics);
         if (loweredFile.value === void 0)
           return void 0;
@@ -266728,10 +266756,62 @@ var require_modules = __commonJS({
         };
       }
     };
+    var cropModule = {
+      kind: "crop",
+      actionId: workflow_shared_1.WORKFLOW_ACTION_IDS.documentCropper,
+      createFailedInput() {
+        return {
+          file: { fileUrl: "https://workflow-code.invalid/compilation-failed" },
+          indexes: [],
+          type: "pdf"
+        };
+      },
+      validate(node) {
+        return validateCropInput(node);
+      },
+      lower(node, context) {
+        if (validateCropInput(node).length > 0)
+          return void 0;
+        const loweredFile = lowerDocumentFile(node.input.file, context, "crop.input.file");
+        context.diagnostics.push(...loweredFile.diagnostics);
+        if (loweredFile.value === void 0)
+          return void 0;
+        const linearPorts = defaultLinearPorts(context.nodeId);
+        return {
+          node: {
+            id: context.nodeId,
+            name: node.name,
+            actionId: workflow_shared_1.WORKFLOW_ACTION_IDS.documentCropper,
+            ports: [
+              { id: linearPorts.input, dir: "in", type: "default" },
+              { id: linearPorts.output, dir: "out", type: "default" }
+            ],
+            input: {
+              file: loweredFile.value,
+              indexes: node.input.indexes,
+              type: node.input.type ?? "pdf"
+            }
+          },
+          linearPorts,
+          outputSchema: output_schema_1.CROP_OUTPUT_JSON_SCHEMA,
+          vaultRefs: loweredFile.vaultRefs
+        };
+      }
+    };
+    function validateCropInput(node) {
+      if (!node.input || typeof node.input !== "object")
+        return [invalidDocumentInputDiagnostic(node, "crop", "input must be an object")];
+      const diagnostics = validateDocumentFile(node, "crop");
+      if (!Array.isArray(node.input.indexes) || !node.input.indexes.every((index) => typeof index === "string" || typeof index === "number" && Number.isInteger(index)))
+        diagnostics.push(invalidDocumentInputDiagnostic(node, "crop", "indexes must be an array of integers or strings"));
+      if (node.input.type !== void 0 && node.input.type !== "pdf")
+        diagnostics.push(invalidDocumentInputDiagnostic(node, "crop", "type must be pdf"));
+      return diagnostics;
+    }
     function validateSplitterInput(node) {
       if (!node.input || typeof node.input !== "object")
         return [invalidSplitterInputDiagnostic(node, "input must be an object")];
-      const diagnostics = validateSplitterFile(node);
+      const diagnostics = validateDocumentFile(node, "splitter");
       if (node.input.chunkSize !== void 0 && (typeof node.input.chunkSize !== "number" || !Number.isFinite(node.input.chunkSize)))
         diagnostics.push(invalidSplitterInputDiagnostic(node, "chunkSize must be a finite number"));
       if (node.input.type !== void 0 && node.input.type !== "pdf" && node.input.type !== "csv")
@@ -266744,21 +266824,43 @@ var require_modules = __commonJS({
         diagnostics.push(invalidSplitterInputDiagnostic(node, "customPromptMode must be always or fallback"));
       return diagnostics;
     }
-    function validateSplitterFile(node) {
+    function validateDocumentFile(node, moduleName) {
       const file = node.input.file;
       if (isExclusiveWorkflowRef(file))
         return [];
       if (isVaultRef(file))
         return (0, reference_1.isWorkflowCodeVaultReference)(file.reference) ? [] : [invalidVaultRefDiagnostic(file.reference)];
-      if (Array.isArray(file) && file.every(isVaultRef))
-        return file.flatMap((item) => (0, reference_1.isWorkflowCodeVaultReference)(item.reference) ? [] : [invalidVaultRefDiagnostic(item.reference)]);
-      return [invalidSplitterInputDiagnostic(node, "file must be an exclusive workflow reference, vault.ref(), or an array of vault.ref() values")];
+      if (isVaultAsset(file))
+        return validateVaultAsset(file);
+      if (Array.isArray(file) && file.every((item) => isVaultRef(item) || isVaultAsset(item))) {
+        return file.flatMap((item) => {
+          if (isVaultRef(item))
+            return (0, reference_1.isWorkflowCodeVaultReference)(item.reference) ? [] : [invalidVaultRefDiagnostic(item.reference)];
+          return validateVaultAsset(item);
+        });
+      }
+      return [invalidDocumentInputDiagnostic(node, moduleName, "file must be an exclusive workflow reference, vault.ref(), vault.asset(), or an array of Vault values")];
+    }
+    function validateVaultAsset(asset) {
+      if (typeof asset.path !== "string" || asset.path.trim().length === 0)
+        return [invalidVaultAssetDiagnostic("path must be a non-empty string")];
+      if (asset.name !== void 0 && (typeof asset.name !== "string" || asset.name.trim().length === 0))
+        return [invalidVaultAssetDiagnostic("name must be a non-empty string when present")];
+      if (asset.mimeType !== void 0 && (typeof asset.mimeType !== "string" || asset.mimeType.trim().length === 0))
+        return [invalidVaultAssetDiagnostic("mimeType must be a non-empty string when present")];
+      return [];
+    }
+    function invalidVaultAssetDiagnostic(detail) {
+      return { code: "compiler.module.invalid_input", severity: "error", message: `Vault asset is invalid: ${detail}` };
     }
     function invalidSplitterInputDiagnostic(node, detail) {
+      return invalidDocumentInputDiagnostic(node, "splitter", detail);
+    }
+    function invalidDocumentInputDiagnostic(node, moduleName, detail) {
       return {
         code: "compiler.module.invalid_input",
         severity: "error",
-        message: `Node ${node.name || "<unnamed>"} has invalid splitter input: ${detail}`
+        message: `Node ${node.name || "<unnamed>"} has invalid ${moduleName} input: ${detail}`
       };
     }
     function invalidVaultRefDiagnostic(reference) {
@@ -266769,7 +266871,7 @@ var require_modules = __commonJS({
         hint: "Use a vault:// reference containing a UUID v4 or SHA-256 file ID."
       };
     }
-    function lowerSplitterFile(file, context) {
+    function lowerDocumentFile(file, context, targetField) {
       if (isVaultRef(file) && (0, reference_1.isWorkflowCodeVaultReference)(file.reference)) {
         return {
           value: vaultTransportFile(file.reference),
@@ -266777,17 +266879,21 @@ var require_modules = __commonJS({
           diagnostics: []
         };
       }
+      if (isVaultAsset(file))
+        return lowerVaultAsset(file, context);
       if (Array.isArray(file)) {
-        const refs = file.map((item) => item.reference).filter(reference_1.isWorkflowCodeVaultReference);
+        const lowered = file.map((item) => isVaultRef(item) ? (0, reference_1.isWorkflowCodeVaultReference)(item.reference) ? { ref: item.reference, value: vaultTransportFile(item.reference) } : void 0 : lowerVaultAssetValue(item, context));
+        if (lowered.includes(void 0))
+          return { vaultRefs: lowered.flatMap((item) => item?.ref ?? []), diagnostics: [missingVaultAssetDiagnostic()] };
         return {
-          value: refs.map(vaultTransportFile),
-          vaultRefs: refs,
+          value: lowered.map((item) => item?.value),
+          vaultRefs: lowered.flatMap((item) => item?.ref ?? []),
           diagnostics: []
         };
       }
       if (!isExclusiveWorkflowRef(file))
         return { vaultRefs: [], diagnostics: [] };
-      const compatibility = validateExclusiveFileTarget(file, context);
+      const compatibility = validateExclusiveFileTarget(file, context, targetField);
       if (compatibility.length > 0)
         return { vaultRefs: [], diagnostics: compatibility };
       const resolved = (0, refs_1.resolveExclusiveRef)(file, {
@@ -266798,24 +266904,40 @@ var require_modules = __commonJS({
       });
       return { value: resolved.reference, vaultRefs: [], diagnostics: [...resolved.diagnostics] };
     }
-    function validateExclusiveFileTarget(file, context) {
+    function lowerVaultAsset(asset, context) {
+      const lowered = lowerVaultAssetValue(asset, context);
+      return lowered ? { value: lowered.value, vaultRefs: [lowered.ref], diagnostics: [] } : { vaultRefs: [], diagnostics: [missingVaultAssetDiagnostic(asset.path)] };
+    }
+    function lowerVaultAssetValue(asset, context) {
+      const snapshot = context.vaultAssetsByKey.get((0, asset_1.workflowCodeVaultAssetKey)(context.workflowKey, asset));
+      return snapshot === void 0 || !(0, reference_1.isWorkflowCodeVaultReference)(snapshot.ref) ? void 0 : { ref: snapshot.ref, value: vaultTransportFile(snapshot.ref) };
+    }
+    function missingVaultAssetDiagnostic(path2) {
+      return {
+        code: "vault.asset.missing_lock",
+        severity: "error",
+        message: `Vault asset${path2 === void 0 ? "" : ` ${path2}`} has no uploaded lock for this workflow`,
+        hint: "Run tela workflow sync so the CLI can upload and lock the local asset before compilation."
+      };
+    }
+    function validateExclusiveFileTarget(file, context, targetField) {
       if (file.targetKind === "input") {
         const target = context.builtInputs.find((input) => (input.key ?? input.name) === file.targetKey);
         if (!target || target.inputType === "file")
           return [];
-        return [incompatibleSplitterRefDiagnostic(file.targetKey)];
+        return [incompatibleDocumentRefDiagnostic(file.targetKey, targetField)];
       }
       const targetIndex = context.nodeIndexesByKey.get(file.targetKey);
       if (targetIndex === void 0 || targetIndex >= context.nodeIndex)
         return [];
       const selectedSchema = (0, output_schema_1.selectOutputJsonSchema)(context.nodeOutputSchemasByKey.get(file.targetKey), file.path ?? []);
-      return (0, output_schema_1.isFileCompatibleOutputJsonSchema)(selectedSchema) ? [] : [incompatibleSplitterRefDiagnostic(file.targetKey)];
+      return (0, output_schema_1.isFileCompatibleOutputJsonSchema)(selectedSchema) ? [] : [incompatibleDocumentRefDiagnostic(file.targetKey, targetField)];
     }
-    function incompatibleSplitterRefDiagnostic(targetKey) {
+    function incompatibleDocumentRefDiagnostic(targetKey, targetField) {
       return {
         code: "compiler.ref.incompatible",
         severity: "error",
-        message: `Exclusive reference ${targetKey} does not select a file or file array value for splitter.input.file`
+        message: `Exclusive reference ${targetKey} does not select a file or file array value for ${targetField}`
       };
     }
     function vaultTransportFile(reference) {
@@ -266827,6 +266949,9 @@ var require_modules = __commonJS({
     function isVaultRef(value) {
       return isRecord2(value) && value.kind === "vault-ref";
     }
+    function isVaultAsset(value) {
+      return isRecord2(value) && value.kind === "vault-asset";
+    }
     function isRecord2(value) {
       return typeof value === "object" && value !== null && !Array.isArray(value);
     }
@@ -266937,7 +267062,8 @@ var require_modules = __commonJS({
       [remoteAgentModule.kind, remoteAgentModule],
       [codeModule.kind, codeModule],
       [mapModule.kind, mapModule],
-      [splitterModule.kind, splitterModule]
+      [splitterModule.kind, splitterModule],
+      [cropModule.kind, cropModule]
     ]);
   }
 });
@@ -267067,6 +267193,7 @@ var require_transpile = __commonJS({
     var hash_1 = require_hash();
     var modules_1 = require_modules();
     var validation_1 = require_validation();
+    var asset_1 = require_asset();
     function isInputLike(input) {
       return Boolean(input) && typeof input === "object";
     }
@@ -267128,6 +267255,8 @@ var require_transpile = __commonJS({
         return createFailedMapNode(workflowKey, declaration);
       if (declaration.node.nodeKind === "splitter")
         return createFailedSplitterNode(workflowKey, declaration);
+      if (declaration.node.nodeKind === "crop")
+        return createFailedCropNode(workflowKey, declaration);
       if (declaration.node.nodeKind === "remote-executable" || declaration.node.nodeKind === "remote-agent")
         return createFailedRemoteNode(workflowKey, declaration);
       return createFailedPromptNode(workflowKey, declaration);
@@ -267172,6 +267301,29 @@ var require_transpile = __commonJS({
         }
       };
     }
+    function createFailedCropNode(workflowKey, declaration) {
+      const nodeId = (0, ids_1.stableNodeId)(workflowKey, declaration.node, declaration.path);
+      const linearPorts = failedNodePorts(nodeId);
+      const module3 = modules_1.nodeModuleRegistry.get(declaration.node.nodeKind);
+      return {
+        declarationIndex: declaration.ordinal,
+        path: declaration.path,
+        scopePath: declaration.scopePath,
+        sequenceIndex: declaration.sequenceIndex,
+        linearPorts,
+        node: {
+          id: nodeId,
+          name: declaration.node.name,
+          actionId: module3?.actionId ?? workflow_shared_1.WORKFLOW_ACTION_IDS.documentCropper,
+          ports: workflowNodePorts(linearPorts),
+          input: module3?.createFailedInput(declaration.node) ?? {
+            file: { fileUrl: "https://workflow-code.invalid/compilation-failed" },
+            indexes: [],
+            type: "pdf"
+          }
+        }
+      };
+    }
     function createFailedCodeNode(workflowKey, declaration) {
       const nodeId = (0, ids_1.stableNodeId)(workflowKey, declaration.node, declaration.path);
       const linearPorts = failedNodePorts(nodeId);
@@ -267351,6 +267503,7 @@ var require_transpile = __commonJS({
         });
       }
       const workflowKey = sourceWorkflowKey;
+      const vaultAssetsByKey = new Map((input.vaultAssets ?? []).map((asset) => [asset.key, asset]));
       const declarationInputs = input.declaration.inputs.filter(isInputLike);
       const declarationNodes = input.declaration.nodes.filter(isNodeLike);
       const rootRecords = createNodeRecords(declarationNodes);
@@ -267414,6 +267567,7 @@ var require_transpile = __commonJS({
           builtInputs: declarationInputs,
           builtNodes: declarationNodes,
           source: input.source,
+          vaultAssetsByKey,
           buildSource: buildBinding?.source,
           childNodeIdsByParentId,
           remoteMode,
@@ -267432,6 +267586,7 @@ var require_transpile = __commonJS({
       });
       const loweredModuleNodes = loweredModuleNodesByDeclaration.filter(isLoweredModuleNodeWithIndex);
       const vaultRefs = [...new Set(loweredModuleNodes.flatMap((item) => item.vaultRefs ?? []))].sort((left, right) => left.localeCompare(right));
+      const vaultAssets = collectVaultAssetUses(flattenedNodes, workflowKey);
       const loweredByPath = createLoweredByPath(loweredModuleNodes);
       const nodes = loweredModuleNodes.map((item) => item.node);
       const edges = createTopologyEdges(rootRecords, loweredByPath);
@@ -267472,10 +267627,31 @@ var require_transpile = __commonJS({
           source: (0, hash_1.hashJson)(sourceHashInput),
           compiled: (0, hash_1.hashJson)({ intermediate, payload, remoteRefs, remoteMode: remoteMode.kind })
         },
-        resources: Object.freeze({ vaultRefs: Object.freeze(vaultRefs) }),
+        resources: Object.freeze({
+          vaultRefs: Object.freeze(vaultRefs),
+          ...vaultAssets.length === 0 ? {} : { vaultAssets: Object.freeze(vaultAssets) }
+        }),
         diagnostics
       });
     }
+    function collectVaultAssetUses(records, workflowKey) {
+      const byKey = /* @__PURE__ */ new Map();
+      for (const { node } of records) {
+        if (node.nodeKind !== "splitter" && node.nodeKind !== "crop")
+          continue;
+        const values = Array.isArray(node.input.file) ? node.input.file : [node.input.file];
+        for (const value of values) {
+          if (!isVaultAsset(value))
+            continue;
+          const key = (0, asset_1.workflowCodeVaultAssetKey)(workflowKey, value);
+          byKey.set(key, Object.freeze({ ...value, key }));
+        }
+      }
+      return [...byKey.values()].sort((left, right) => left.key.localeCompare(right.key));
+    }
+    function isVaultAsset(value) {
+      return value !== null && typeof value === "object" && !Array.isArray(value) && value.kind === "vault-asset";
+    }
   }
 });
 
@@ -267866,6 +268042,134 @@ var require_load_config = __commonJS({
   }
 });
 
+// ../../packages/workflow-code/dist/cli/config/resolve-target-identity.js
+var require_resolve_target_identity = __commonJS({
+  "../../packages/workflow-code/dist/cli/config/resolve-target-identity.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.resolveWorkflowTargetIdentity = resolveWorkflowTargetIdentity;
+    exports2.resolveWorkflowTargetLockIdentity = resolveWorkflowTargetLockIdentity;
+    var tela_local_config_1 = require_dist();
+    var diagnostics_1 = require_diagnostics();
+    var format_config_path_1 = require_format_config_path();
+    async function resolveWorkflowTargetIdentity(targetName, target, options = {}) {
+      const lockIdentity = await resolveWorkflowTargetLockIdentity(targetName, target, options);
+      if (!lockIdentity.ok)
+        return lockIdentity;
+      const diagnostics = validateResolvedBinding(targetName, lockIdentity.value);
+      if (diagnostics.length > 0)
+        return { ok: false, diagnostics };
+      return {
+        ok: true,
+        value: {
+          ...lockIdentity.value,
+          projectId: lockIdentity.value.projectId
+        }
+      };
+    }
+    async function resolveWorkflowTargetLockIdentity(targetName, target, options = {}) {
+      const contexts = target.contexts;
+      if (contexts && Object.keys(contexts).length > 0) {
+        const contextResult = await resolveActiveContext(options);
+        if (!contextResult.ok)
+          return contextResult;
+        const candidateKeys = contextBindingCandidateKeys(contextResult.value);
+        const contextBinding = findContextBinding(contexts, candidateKeys);
+        if (!contextBinding) {
+          return {
+            ok: false,
+            diagnostics: [(0, diagnostics_1.diagnostic)("config.context_binding.missing", "error", `Workflow target ${targetName} has no binding for active Tela context ${contextResult.value.id}`, missingContextBindingHint(targetName, Object.keys(contexts), candidateKeys))]
+          };
+        }
+        const [contextKey, binding] = contextBinding;
+        const diagnostics2 = validateResolvedBinding(targetName, binding, { requireProjectId: false });
+        if (diagnostics2.length > 0)
+          return { ok: false, diagnostics: diagnostics2 };
+        return {
+          ok: true,
+          value: {
+            contextId: contextResult.value.id,
+            contextKey,
+            ...binding.projectId === void 0 ? {} : { projectId: binding.projectId },
+            ...binding.promptId === void 0 ? {} : { promptId: binding.promptId },
+            source: "context"
+          }
+        };
+      }
+      const diagnostics = validateResolvedBinding(targetName, target, { requireProjectId: false });
+      if (diagnostics.length > 0)
+        return { ok: false, diagnostics };
+      return {
+        ok: true,
+        value: {
+          ...target.projectId === void 0 ? {} : { projectId: target.projectId },
+          ...target.promptId === void 0 ? {} : { promptId: target.promptId },
+          source: "legacy"
+        }
+      };
+    }
+    function findContextBinding(contexts, candidateKeys) {
+      for (const contextKey of candidateKeys) {
+        const binding = contexts[contextKey];
+        if (binding !== void 0)
+          return [contextKey, binding];
+      }
+      return void 0;
+    }
+    async function resolveActiveContext(options) {
+      try {
+        const config = options.localConfig ?? await (0, tela_local_config_1.loadConfig)();
+        return { ok: true, value: (0, tela_local_config_1.resolveContext)(config) };
+      } catch (error) {
+        return {
+          ok: false,
+          diagnostics: [(0, diagnostics_1.diagnostic)("config.context.resolve_failed", "error", "Unable to resolve active Tela Local context for Workflow Code command", resolveContextHint(error))]
+        };
+      }
+    }
+    function contextBindingCandidateKeys(context) {
+      return uniqueStrings([
+        context.id,
+        context.context.environmentId,
+        context.environment.label.toLowerCase(),
+        environmentAlias(context.context.environmentId),
+        context.environment.kind === "local" ? "dev" : void 0
+      ]);
+    }
+    function environmentAlias(environmentId) {
+      if (environmentId === "production")
+        return "prod";
+      if (environmentId === "development")
+        return "dev";
+      return void 0;
+    }
+    function validateResolvedBinding(targetName, binding, options = {}) {
+      const diagnostics = [];
+      if (options.requireProjectId !== false && (!binding.projectId || typeof binding.projectId !== "string")) {
+        diagnostics.push((0, diagnostics_1.diagnostic)("config.workflow.project_id.missing", "error", `Workflow target ${targetName} must resolve a non-empty projectId`, `Set \`${(0, format_config_path_1.formatConfigPath)("workflows", targetName, "projectId")}\` to a non-empty Tela project id, or add \`${(0, format_config_path_1.formatConfigPath)("workflows", targetName, "contexts", "<context>", "projectId")}\` for the active Tela context. Check contexts with \`tela context list\`.`));
+      }
+      if (binding.promptId !== void 0 && (typeof binding.promptId !== "string" || binding.promptId.length === 0)) {
+        diagnostics.push((0, diagnostics_1.diagnostic)("config.workflow.prompt_id.invalid", "error", `Workflow target ${targetName} promptId must be a non-empty string when provided`, `Set \`${(0, format_config_path_1.formatConfigPath)("workflows", targetName, "promptId")}\` to a non-empty Tela prompt id from the Tela UI, or remove it if no existing prompt should be bound.`));
+      }
+      return diagnostics;
+    }
+    function missingContextBindingHint(targetName, configuredKeys, triedKeys) {
+      const preferredKey = triedKeys[0] ?? "<context>";
+      return [
+        `Add one of the tried keys under \`${(0, format_config_path_1.formatConfigPath)("workflows", targetName, "contexts")}\`, for example \`${(0, format_config_path_1.formatObjectKey)(preferredKey)}: { projectId: 'proj_...' }\`, or switch context with \`tela context use <context-id>\`.`,
+        `Configured bindings: ${configuredKeys.join(", ") || "(none)"}. Tried: ${triedKeys.join(", ") || "(none)"}.`
+      ].join(" ");
+    }
+    function resolveContextHint(error) {
+      const detail = error instanceof Error && error.message.trim() ? ` Detail: ${error.message}` : "";
+      return `Run \`tela context list\` to see configured contexts, then choose one with \`tela context use <context-id>\`. If no contexts exist, add one in Tela Dock/local setup before running workflow commands.${detail}`;
+    }
+    function uniqueStrings(values) {
+      return Array.from(new Set(values.filter((value) => Boolean(value))));
+    }
+  }
+});
+
 // ../../packages/workflow-code/dist/cli/source/evaluate-source.js
 var require_evaluate_source = __commonJS({
   "../../packages/workflow-code/dist/cli/source/evaluate-source.js"(exports2) {
@@ -269122,14 +269426,15 @@ const __workflowCodeApi = (() => {
         paths(target) { return createPathProxy([], target.kind, target.key ?? target.name) },
     })
     const isVaultRef = (value) => value && typeof value === 'object' && !Array.isArray(value) && value.kind === 'vault-ref'
+    const isVaultAsset = (value) => value && typeof value === 'object' && !Array.isArray(value) && value.kind === 'vault-asset'
     const isWorkflowRef = (value) => value && typeof value === 'object' && !Array.isArray(value) && value.kind === 'workflow-ref'
-    const renderExclusiveFileSource = (input, source) => {
+    const renderExclusiveFileSource = (input, field, source) => {
         const value = typeof input === 'function' ? input(exclusiveRefContext(source)) : input
-        if (isVaultRef(value) || isWorkflowRef(value))
+        if (isVaultRef(value) || isVaultAsset(value) || isWorkflowRef(value))
             return value
-        if (Array.isArray(value) && value.every(isVaultRef))
+        if (Array.isArray(value) && value.every(item => isVaultRef(item) || isVaultAsset(item)))
             return freeze([...value])
-        throwAuthoringDiagnostic('splitter.input.file must be a workflow file reference, vault.ref(), or an array of vault.ref() values', source)
+        throwAuthoringDiagnostic(\`\${field} must be a workflow file reference, vault.ref(), or an array of vault.ref() values\`, source)
     }
     const renderReferenceRecord = (input, source) => {
         if (typeof input !== 'function')
@@ -269358,7 +269663,7 @@ const __workflowCodeApi = (() => {
         if (!options || typeof options !== 'object' || !options.input || typeof options.input !== 'object')
             throwAuthoringDiagnostic('splitter.input must be an object', options && typeof options === 'object' ? options.__workflowCodeSource : undefined)
         assertNonEmptyString(options.name, 'splitter.name', options.__workflowCodeSource)
-        const file = renderExclusiveFileSource(options.input.file, options.__workflowCodeSource)
+        const file = renderExclusiveFileSource(options.input.file, 'splitter.input.file', options.__workflowCodeSource)
         return freeze({
             kind: 'node',
             nodeKind: 'splitter',
@@ -269374,16 +269679,42 @@ const __workflowCodeApi = (() => {
             }),
         })
     }
+    const cropNode = (options) => {
+        if (!options || typeof options !== 'object' || !options.input || typeof options.input !== 'object')
+            throwAuthoringDiagnostic('crop.input must be an object', options && typeof options === 'object' ? options.__workflowCodeSource : undefined)
+        assertNonEmptyString(options.name, 'crop.name', options.__workflowCodeSource)
+        const file = renderExclusiveFileSource(options.input.file, 'crop.input.file', options.__workflowCodeSource)
+        if (!Array.isArray(options.input.indexes))
+            throwAuthoringDiagnostic('crop.input.indexes must be an array', options.__workflowCodeSource)
+        return freeze({
+            kind: 'node',
+            nodeKind: 'crop',
+            name: options.name,
+            ...(options.key !== undefined ? { key: options.key } : {}),
+            input: freeze({
+                file,
+                indexes: freeze([...options.input.indexes]),
+                ...(options.input.type !== undefined ? { type: options.input.type } : {}),
+            }),
+        })
+    }
     return freeze({
         agent: (ref, options) => publishedAgent(ref, options),
         build: buildWorkflow,
         canvas: canvasNode,
         code: codeNode,
+        crop: cropNode,
         input: freeze({ text: (options) => baseInput('text', options), file: (options) => baseInput('file', options) }),
         llm: (options) => promptNode('llm', options, llmInput),
         map: mapNode,
         splitter: splitterNode,
         vault: freeze({
+            asset: (path, options = {}) => freeze({
+                kind: 'vault-asset',
+                path,
+                ...(options.name === undefined ? {} : { name: options.name }),
+                ...(options.mimeType === undefined ? {} : { mimeType: options.mimeType }),
+            }),
             ref: (reference) => freeze({ kind: 'vault-ref', reference }),
         }),
         remote,
@@ -269854,6 +270185,745 @@ var require_load_source = __commonJS({
   }
 });
 
+// ../../packages/workflow-code/dist/cli/state/lockfile.js
+var require_lockfile = __commonJS({
+  "../../packages/workflow-code/dist/cli/state/lockfile.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.deriveLockfilePath = deriveLockfilePath;
+    exports2.readLockfile = readLockfile;
+    exports2.validateWorkflowLockfile = validateWorkflowLockfile;
+    exports2.serializeLockfile = serializeLockfile;
+    exports2.planLockfileWrite = planLockfileWrite;
+    var promises_1 = require("node:fs/promises");
+    var node_path_1 = require("node:path");
+    var diagnostics_1 = require_diagnostics();
+    var reference_1 = require_reference();
+    var hash_1 = require_hash();
+    var path_segments_1 = require_path_segments();
+    var LOCKFILE_VERSION = 1;
+    var VALID_VERSION_STATUSES = /* @__PURE__ */ new Set(["draft", "consolidated", "published"]);
+    function deriveLockfilePath(rootDir, facts) {
+      const workflowDiagnostic = validatePathSegment("workflowKey", facts.workflowKey);
+      const contextDiagnostic = validatePathSegment("contextKey", facts.context.key);
+      const diagnostics = [workflowDiagnostic, contextDiagnostic].filter((item) => item !== void 0);
+      if (diagnostics.length > 0)
+        return { ok: false, diagnostics };
+      return {
+        ok: true,
+        value: (0, node_path_1.join)(rootDir, ".tela", "workflows", facts.workflowKey, "contexts", facts.context.key, "lock.json")
+      };
+    }
+    async function readLockfile(path2) {
+      let content;
+      try {
+        content = await (0, promises_1.readFile)(path2, "utf8");
+      } catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT") {
+          return {
+            ok: false,
+            diagnostics: [(0, diagnostics_1.diagnostic)("state.lockfile.missing", "error", `Workflow state lockfile does not exist at ${path2}`, "Run a remote workflow command that can fetch and persist remote state for the active context.")]
+          };
+        }
+        throw error;
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(content);
+      } catch (error) {
+        const detail = error instanceof Error ? ` ${error.message}` : "";
+        return {
+          ok: false,
+          diagnostics: [(0, diagnostics_1.diagnostic)("state.lockfile.invalid", "error", `Workflow state lockfile at ${path2} is not valid JSON.${detail}`, "Regenerate the active-context workflow state lockfile from fresh remote state.")]
+        };
+      }
+      const validation = validateWorkflowLockfile(parsed, path2);
+      if (!validation.ok)
+        return validation;
+      return {
+        ok: true,
+        value: {
+          path: path2,
+          hash: (0, hash_1.hashString)(content),
+          content,
+          lockfile: validation.value
+        }
+      };
+    }
+    function validateWorkflowLockfile(value, path2 = "<lockfile>") {
+      const diagnostics = validateLockfileShape(value, path2);
+      if (diagnostics.length > 0)
+        return { ok: false, diagnostics };
+      return { ok: true, value };
+    }
+    function serializeLockfile(lockfile) {
+      return `${JSON.stringify(orderLockfile(lockfile), null, 2)}
+`;
+    }
+    function planLockfileWrite(path2, lockfile, existing) {
+      return {
+        path: path2,
+        ...existing === void 0 ? {} : { expectedPreviousHash: existing.hash },
+        lockfile,
+        content: serializeLockfile(lockfile)
+      };
+    }
+    function validatePathSegment(name, value) {
+      if ((0, path_segments_1.isSafeStatePathSegment)(value))
+        return void 0;
+      return (0, diagnostics_1.diagnostic)("state.lockfile.invalid", "error", `Workflow state lockfile ${name} is not a safe filesystem path segment`, "Workflow and context keys must be one filesystem segment using only letters, numbers, `_`, or `-`.");
+    }
+    function validateLockfileShape(value, path2) {
+      const diagnostics = [];
+      validateLockfile(value, path2, diagnostics);
+      return diagnostics;
+    }
+    function validateLockfile(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["version", "targetName", "workflowKey", "context", "remote", "generatedMetadata", "vaultAssets", "pendingSync", "lastSynced"], diagnostics))
+        return;
+      if (value.version !== LOCKFILE_VERSION)
+        pushInvalid(diagnostics, path2, "version must be 1");
+      validateRequiredString(value, "targetName", `${path2}.targetName`, diagnostics);
+      validateRequiredString(value, "workflowKey", `${path2}.workflowKey`, diagnostics);
+      validateContext(value.context, `${path2}.context`, diagnostics);
+      validateRemote(value.remote, `${path2}.remote`, diagnostics);
+      if (value.generatedMetadata !== void 0)
+        validateGeneratedMetadata(value.generatedMetadata, `${path2}.generatedMetadata`, diagnostics);
+      if (value.vaultAssets !== void 0)
+        validateVaultAssets(value.vaultAssets, `${path2}.vaultAssets`, diagnostics);
+      if (value.pendingSync !== void 0)
+        validatePendingSync(value.pendingSync, `${path2}.pendingSync`, diagnostics);
+      if (value.lastSynced !== void 0)
+        validateLastSynced(value.lastSynced, `${path2}.lastSynced`, diagnostics);
+    }
+    function validateVaultAssets(value, path2, diagnostics) {
+      if (!Array.isArray(value)) {
+        pushInvalid(diagnostics, path2, "must be an array");
+        return;
+      }
+      value.forEach((asset, index) => {
+        const assetPath = `${path2}[${index}]`;
+        if (!validateObject(asset, assetPath, ["kind", "key", "path", "resolvedPath", "contentHash", "size", "name", "mimeType", "ref", "uploadedAt"], diagnostics))
+          return;
+        if (asset.kind !== "vault-asset")
+          pushInvalid(diagnostics, `${assetPath}.kind`, "must be vault-asset");
+        validateRequiredString(asset, "key", `${assetPath}.key`, diagnostics);
+        validateRequiredString(asset, "path", `${assetPath}.path`, diagnostics);
+        validateOptionalString(asset, "resolvedPath", `${assetPath}.resolvedPath`, diagnostics);
+        validateOptionalString(asset, "contentHash", `${assetPath}.contentHash`, diagnostics);
+        validateOptionalNumber(asset, "size", `${assetPath}.size`, diagnostics);
+        validateOptionalString(asset, "name", `${assetPath}.name`, diagnostics);
+        validateOptionalString(asset, "mimeType", `${assetPath}.mimeType`, diagnostics);
+        if (!(0, reference_1.isWorkflowCodeVaultReference)(asset.ref))
+          pushInvalid(diagnostics, `${assetPath}.ref`, "must be a vault:// UUID v4 or SHA-256 reference");
+        validateRequiredString(asset, "uploadedAt", `${assetPath}.uploadedAt`, diagnostics);
+      });
+    }
+    function validateGeneratedMetadata(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["version", "contextId", "workspaceId", "catalogHash", "refs"], diagnostics))
+        return;
+      if (value.version !== LOCKFILE_VERSION)
+        pushInvalid(diagnostics, `${path2}.version`, "version must be 1");
+      validateRequiredString(value, "contextId", `${path2}.contextId`, diagnostics);
+      validateRequiredString(value, "workspaceId", `${path2}.workspaceId`, diagnostics);
+      validateRequiredString(value, "catalogHash", `${path2}.catalogHash`, diagnostics);
+      if (!Array.isArray(value.refs)) {
+        pushInvalid(diagnostics, `${path2}.refs`, "must be an array");
+        return;
+      }
+      value.refs.forEach((ref, index) => validateLockedRemoteRef(ref, `${path2}.refs[${index}]`, diagnostics));
+    }
+    function validateLockedRemoteRef(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["declarationKey", "kind", "path", "id", "environmentName", "versionId", "revision", "inputHash", "outputContractHash", "contractHash"], diagnostics))
+        return;
+      validateRequiredString(value, "declarationKey", `${path2}.declarationKey`, diagnostics);
+      if (value.kind !== "canvas" && value.kind !== "workflow" && value.kind !== "agent" && value.kind !== "model")
+        pushInvalid(diagnostics, `${path2}.kind`, "kind must be canvas, workflow, agent, or model");
+      if (value.path !== void 0)
+        validateStringArray(value.path, `${path2}.path`, diagnostics);
+      validateRequiredString(value, "id", `${path2}.id`, diagnostics);
+      validateOptionalString(value, "environmentName", `${path2}.environmentName`, diagnostics);
+      validateOptionalString(value, "versionId", `${path2}.versionId`, diagnostics);
+      validateOptionalString(value, "revision", `${path2}.revision`, diagnostics);
+      validateOptionalString(value, "inputHash", `${path2}.inputHash`, diagnostics);
+      validateOptionalString(value, "outputContractHash", `${path2}.outputContractHash`, diagnostics);
+      validateRequiredString(value, "contractHash", `${path2}.contractHash`, diagnostics);
+    }
+    function validateContext(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["key", "id", "projectId", "promptId"], diagnostics))
+        return;
+      validateRequiredString(value, "key", `${path2}.key`, diagnostics);
+      validateOptionalString(value, "id", `${path2}.id`, diagnostics);
+      validateRequiredString(value, "projectId", `${path2}.projectId`, diagnostics);
+      validateRequiredString(value, "promptId", `${path2}.promptId`, diagnostics);
+    }
+    function validateRemote(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["fetchedAt", "contentHash", "prompt", "version", "codegen"], diagnostics))
+        return;
+      validateRequiredString(value, "fetchedAt", `${path2}.fetchedAt`, diagnostics);
+      validateRequiredString(value, "contentHash", `${path2}.contentHash`, diagnostics);
+      validatePrompt(value.prompt, `${path2}.prompt`, diagnostics);
+      validateRemoteVersion(value.version, `${path2}.version`, diagnostics);
+      if (value.codegen !== void 0)
+        validateCodegen(value.codegen, `${path2}.codegen`, diagnostics);
+    }
+    function validatePrompt(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["id", "title", "currentVersionId", "currentVersionIndex", "publishedVersionId", "publishedVersionIndex"], diagnostics))
+        return;
+      validateRequiredString(value, "id", `${path2}.id`, diagnostics);
+      validateOptionalString(value, "title", `${path2}.title`, diagnostics);
+      validateRequiredString(value, "currentVersionId", `${path2}.currentVersionId`, diagnostics);
+      validateRequiredNumber(value, "currentVersionIndex", `${path2}.currentVersionIndex`, diagnostics);
+      validateOptionalString(value, "publishedVersionId", `${path2}.publishedVersionId`, diagnostics);
+      validateOptionalNumber(value, "publishedVersionIndex", `${path2}.publishedVersionIndex`, diagnostics);
+    }
+    function validateRemoteVersion(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["id", "versionIndex", "status", "contentHash", "compiledHash", "publishedEnvironmentNames"], diagnostics))
+        return;
+      validateRequiredString(value, "id", `${path2}.id`, diagnostics);
+      validateRequiredNumber(value, "versionIndex", `${path2}.versionIndex`, diagnostics);
+      if (typeof value.status !== "string" || !VALID_VERSION_STATUSES.has(value.status))
+        pushInvalid(diagnostics, `${path2}.status`, "status must be draft, consolidated, or published");
+      validateRequiredString(value, "contentHash", `${path2}.contentHash`, diagnostics);
+      validateOptionalString(value, "compiledHash", `${path2}.compiledHash`, diagnostics);
+      validateOptionalStringArray(value, "publishedEnvironmentNames", `${path2}.publishedEnvironmentNames`, diagnostics);
+    }
+    function validateCodegen(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["templateVariables", "canvasVariables", "modelIds", "toolIds", "outputSchemasHash"], diagnostics))
+        return;
+      validateOptionalStringArray(value, "templateVariables", `${path2}.templateVariables`, diagnostics);
+      validateOptionalStringArray(value, "canvasVariables", `${path2}.canvasVariables`, diagnostics);
+      validateOptionalStringArray(value, "modelIds", `${path2}.modelIds`, diagnostics);
+      validateOptionalStringArray(value, "toolIds", `${path2}.toolIds`, diagnostics);
+      validateOptionalString(value, "outputSchemasHash", `${path2}.outputSchemasHash`, diagnostics);
+    }
+    function validateLifecycleMetadata(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["operation", "targetVersionId", "idempotencyKey", "requestHash"], diagnostics))
+        return;
+      if (value.operation !== "edit")
+        pushInvalid(diagnostics, `${path2}.operation`, "operation must be edit");
+      validateRequiredString(value, "targetVersionId", `${path2}.targetVersionId`, diagnostics);
+      validateRequiredString(value, "idempotencyKey", `${path2}.idempotencyKey`, diagnostics);
+      validateRequiredString(value, "requestHash", `${path2}.requestHash`, diagnostics);
+    }
+    function validatePendingSync(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["operation", "targetVersionId", "idempotencyKey", "requestHash", "sourceHash", "compiledHash", "createdAt", "mutationAttemptedAt"], diagnostics))
+        return;
+      validateLifecycleMetadata({
+        operation: value.operation,
+        targetVersionId: value.targetVersionId,
+        idempotencyKey: value.idempotencyKey,
+        requestHash: value.requestHash
+      }, path2, diagnostics);
+      validateRequiredString(value, "sourceHash", `${path2}.sourceHash`, diagnostics);
+      validateRequiredString(value, "compiledHash", `${path2}.compiledHash`, diagnostics);
+      validateRequiredString(value, "createdAt", `${path2}.createdAt`, diagnostics);
+      validateOptionalString(value, "mutationAttemptedAt", `${path2}.mutationAttemptedAt`, diagnostics);
+    }
+    function validateLastSynced(value, path2, diagnostics) {
+      if (!validateObject(value, path2, ["versionId", "versionIndex", "sourceHash", "compiledHash", "syncedAt", "lifecycle"], diagnostics))
+        return;
+      validateRequiredString(value, "versionId", `${path2}.versionId`, diagnostics);
+      validateRequiredNumber(value, "versionIndex", `${path2}.versionIndex`, diagnostics);
+      validateRequiredString(value, "sourceHash", `${path2}.sourceHash`, diagnostics);
+      validateRequiredString(value, "compiledHash", `${path2}.compiledHash`, diagnostics);
+      validateRequiredString(value, "syncedAt", `${path2}.syncedAt`, diagnostics);
+      validateLifecycleMetadata(value.lifecycle, `${path2}.lifecycle`, diagnostics);
+    }
+    function validateObject(value, path2, expectedKeys, diagnostics) {
+      if (!isRecord2(value)) {
+        pushInvalid(diagnostics, path2, "expected object");
+        return false;
+      }
+      const expected = new Set(expectedKeys);
+      for (const key of Object.keys(value)) {
+        if (!expected.has(key))
+          pushInvalid(diagnostics, `${path2}.${key}`, "unknown field");
+      }
+      return true;
+    }
+    function validateRequiredString(record, key, path2, diagnostics) {
+      const value = record[key];
+      if (typeof value !== "string" || value.length === 0)
+        pushInvalid(diagnostics, path2, "must be a non-empty string");
+    }
+    function validateOptionalString(record, key, path2, diagnostics) {
+      const value = record[key];
+      if (value !== void 0 && (typeof value !== "string" || value.length === 0))
+        pushInvalid(diagnostics, path2, "must be a non-empty string when present");
+    }
+    function validateRequiredNumber(record, key, path2, diagnostics) {
+      const value = record[key];
+      if (typeof value !== "number" || !Number.isFinite(value))
+        pushInvalid(diagnostics, path2, "must be a finite number");
+    }
+    function validateOptionalNumber(record, key, path2, diagnostics) {
+      const value = record[key];
+      if (value !== void 0 && (typeof value !== "number" || !Number.isFinite(value)))
+        pushInvalid(diagnostics, path2, "must be a finite number when present");
+    }
+    function validateOptionalStringArray(record, key, path2, diagnostics) {
+      const value = record[key];
+      if (value === void 0)
+        return;
+      validateStringArray(value, path2, diagnostics);
+    }
+    function validateStringArray(value, path2, diagnostics) {
+      if (!Array.isArray(value)) {
+        pushInvalid(diagnostics, path2, "must be an array of strings when present");
+        return;
+      }
+      if (!value.every((item) => typeof item === "string" && item.length > 0))
+        pushInvalid(diagnostics, path2, "must contain only non-empty strings");
+    }
+    function pushInvalid(diagnostics, path2, detail) {
+      diagnostics.push((0, diagnostics_1.diagnostic)("state.lockfile.invalid", "error", `Workflow state lockfile ${path2} is invalid: ${detail}`, "Regenerate the active-context workflow state lockfile from fresh remote state."));
+    }
+    function orderLockfile(lockfile) {
+      return {
+        version: lockfile.version,
+        targetName: lockfile.targetName,
+        workflowKey: lockfile.workflowKey,
+        context: {
+          key: lockfile.context.key,
+          ...lockfile.context.id === void 0 ? {} : { id: lockfile.context.id },
+          projectId: lockfile.context.projectId,
+          promptId: lockfile.context.promptId
+        },
+        remote: orderRemote(lockfile.remote),
+        ...lockfile.generatedMetadata === void 0 ? {} : { generatedMetadata: orderGeneratedMetadata(lockfile.generatedMetadata) },
+        ...lockfile.vaultAssets === void 0 ? {} : { vaultAssets: [...lockfile.vaultAssets].sort((left, right) => left.key.localeCompare(right.key)) },
+        ...lockfile.pendingSync === void 0 ? {} : { pendingSync: {
+          operation: lockfile.pendingSync.operation,
+          targetVersionId: lockfile.pendingSync.targetVersionId,
+          idempotencyKey: lockfile.pendingSync.idempotencyKey,
+          requestHash: lockfile.pendingSync.requestHash,
+          sourceHash: lockfile.pendingSync.sourceHash,
+          compiledHash: lockfile.pendingSync.compiledHash,
+          createdAt: lockfile.pendingSync.createdAt,
+          ...lockfile.pendingSync.mutationAttemptedAt === void 0 ? {} : { mutationAttemptedAt: lockfile.pendingSync.mutationAttemptedAt }
+        } },
+        ...lockfile.lastSynced === void 0 ? {} : { lastSynced: {
+          versionId: lockfile.lastSynced.versionId,
+          versionIndex: lockfile.lastSynced.versionIndex,
+          sourceHash: lockfile.lastSynced.sourceHash,
+          compiledHash: lockfile.lastSynced.compiledHash,
+          syncedAt: lockfile.lastSynced.syncedAt,
+          lifecycle: {
+            operation: lockfile.lastSynced.lifecycle.operation,
+            targetVersionId: lockfile.lastSynced.lifecycle.targetVersionId,
+            idempotencyKey: lockfile.lastSynced.lifecycle.idempotencyKey,
+            requestHash: lockfile.lastSynced.lifecycle.requestHash
+          }
+        } }
+      };
+    }
+    function orderGeneratedMetadata(metadata) {
+      return {
+        version: metadata.version,
+        contextId: metadata.contextId,
+        workspaceId: metadata.workspaceId,
+        catalogHash: metadata.catalogHash,
+        refs: [...metadata.refs].sort((left, right) => left.declarationKey.localeCompare(right.declarationKey) || left.kind.localeCompare(right.kind) || left.id.localeCompare(right.id)).map((ref) => ({
+          declarationKey: ref.declarationKey,
+          kind: ref.kind,
+          ...ref.path === void 0 ? {} : { path: [...ref.path] },
+          id: ref.id,
+          ...ref.environmentName === void 0 ? {} : { environmentName: ref.environmentName },
+          ...ref.versionId === void 0 ? {} : { versionId: ref.versionId },
+          ...ref.revision === void 0 ? {} : { revision: ref.revision },
+          ...ref.inputHash === void 0 ? {} : { inputHash: ref.inputHash },
+          ...ref.outputContractHash === void 0 ? {} : { outputContractHash: ref.outputContractHash },
+          contractHash: ref.contractHash
+        }))
+      };
+    }
+    function orderRemote(remote) {
+      return {
+        fetchedAt: remote.fetchedAt,
+        contentHash: remote.contentHash,
+        prompt: {
+          id: remote.prompt.id,
+          ...remote.prompt.title === void 0 ? {} : { title: remote.prompt.title },
+          currentVersionId: remote.prompt.currentVersionId,
+          currentVersionIndex: remote.prompt.currentVersionIndex,
+          ...remote.prompt.publishedVersionId === void 0 ? {} : { publishedVersionId: remote.prompt.publishedVersionId },
+          ...remote.prompt.publishedVersionIndex === void 0 ? {} : { publishedVersionIndex: remote.prompt.publishedVersionIndex }
+        },
+        version: {
+          id: remote.version.id,
+          versionIndex: remote.version.versionIndex,
+          status: remote.version.status,
+          contentHash: remote.version.contentHash,
+          ...remote.version.compiledHash === void 0 ? {} : { compiledHash: remote.version.compiledHash },
+          ...remote.version.publishedEnvironmentNames === void 0 ? {} : { publishedEnvironmentNames: [...remote.version.publishedEnvironmentNames].sort((left, right) => left.localeCompare(right)) }
+        },
+        ...remote.codegen === void 0 ? {} : { codegen: {
+          ...remote.codegen.templateVariables === void 0 ? {} : { templateVariables: remote.codegen.templateVariables },
+          ...remote.codegen.canvasVariables === void 0 ? {} : { canvasVariables: remote.codegen.canvasVariables },
+          ...remote.codegen.modelIds === void 0 ? {} : { modelIds: remote.codegen.modelIds },
+          ...remote.codegen.toolIds === void 0 ? {} : { toolIds: remote.codegen.toolIds },
+          ...remote.codegen.outputSchemasHash === void 0 ? {} : { outputSchemasHash: remote.codegen.outputSchemasHash }
+        } }
+      };
+    }
+    function isRecord2(value) {
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+    function isNodeError(error) {
+      return error instanceof Error && "code" in error;
+    }
+  }
+});
+
+// ../../packages/workflow-code/dist/cli/state/planning.js
+var require_planning = __commonJS({
+  "../../packages/workflow-code/dist/cli/state/planning.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.validateLockfileIdentity = validateLockfileIdentity;
+    exports2.resolvePromptId = resolvePromptId;
+    exports2.isLocalSynced = isLocalSynced;
+    exports2.isFreshRemoteConfirmed = isFreshRemoteConfirmed;
+    exports2.detectRemoteDivergence = detectRemoteDivergence;
+    exports2.planRemoteSnapshotWrite = planRemoteSnapshotWrite;
+    exports2.planSyncResultWrite = planSyncResultWrite;
+    var diagnostics_1 = require_diagnostics();
+    var lockfile_1 = require_lockfile();
+    function validateLockfileIdentity(lockfile, facts, path2 = "<lockfile>") {
+      const mismatches = [];
+      pushMismatch(mismatches, "targetName", lockfile.targetName, facts.targetName);
+      pushMismatch(mismatches, "workflowKey", lockfile.workflowKey, facts.workflowKey);
+      pushMismatch(mismatches, "context.key", lockfile.context.key, facts.context.key);
+      pushMismatch(mismatches, "context.projectId", lockfile.context.projectId, facts.context.projectId);
+      if (facts.context.id !== void 0 && lockfile.context.id !== void 0)
+        pushMismatch(mismatches, "context.id", lockfile.context.id, facts.context.id);
+      if (facts.context.promptId !== void 0)
+        pushMismatch(mismatches, "context.promptId", lockfile.context.promptId, facts.context.promptId);
+      if (mismatches.length > 0) {
+        return {
+          ok: false,
+          diagnostics: [(0, diagnostics_1.diagnostic)("state.lockfile.identity_mismatch", "error", `Workflow state lockfile at ${path2} does not match the selected workflow target/context`, `Mismatched fields: ${mismatches.join(", ")}. Use the lockfile for the active workflow/context only.`)]
+        };
+      }
+      return { ok: true, value: lockfile };
+    }
+    function resolvePromptId(facts, lockfile) {
+      if (facts.context.promptId !== void 0)
+        return { ok: true, value: facts.context.promptId };
+      if (lockfile !== void 0) {
+        const identity = validateLockfileIdentity(lockfile, facts);
+        if (!identity.ok)
+          return { ok: false, diagnostics: identity.diagnostics };
+        return { ok: true, value: lockfile.context.promptId };
+      }
+      return {
+        ok: false,
+        diagnostics: [(0, diagnostics_1.diagnostic)("state.prompt_id.missing", "error", `Workflow target ${facts.targetName} has no prompt id for context ${facts.context.key}`, "Add promptId to the active workflow context binding or run a command that creates/binds the prompt before requiring existing remote prompt state.")]
+      };
+    }
+    function isLocalSynced(lockfile, local) {
+      const lastSynced = lockfile.lastSynced;
+      return lastSynced !== void 0 && lastSynced.sourceHash === local.sourceHash && lastSynced.compiledHash === local.compiledHash;
+    }
+    function isFreshRemoteConfirmed(lockfile, remote) {
+      return lockfile.lastSynced !== void 0 && remote.version.id === lockfile.lastSynced.versionId && remote.version.versionIndex === lockfile.lastSynced.versionIndex && remote.contentHash === lockfile.remote.contentHash;
+    }
+    function detectRemoteDivergence(lockfile, remote) {
+      if (lockfile.lastSynced === void 0)
+        return [];
+      if (remote.version.id === lockfile.lastSynced.versionId && remote.version.versionIndex === lockfile.lastSynced.versionIndex && remote.contentHash === lockfile.remote.contentHash) {
+        return [];
+      }
+      return [(0, diagnostics_1.diagnostic)("state.remote.diverged", "warning", `Remote workflow content for ${lockfile.workflowKey}/${lockfile.context.key} differs from the last synced lockfile state`, "Confirm before overwriting remote changes, or pass --yes to continue non-interactively.")];
+    }
+    function planRemoteSnapshotWrite(path2, facts, remote, existing, generatedMetadata, vaultAssets) {
+      const lockfile = buildLockfile(facts, remote, existing?.lockfile, generatedMetadata, vaultAssets);
+      if (!lockfile.ok)
+        return { ok: false, diagnostics: lockfile.diagnostics };
+      return { ok: true, value: (0, lockfile_1.planLockfileWrite)(path2, lockfile.value, existing) };
+    }
+    function planSyncResultWrite(path2, facts, remote, syncResult, existing, generatedMetadata, vaultAssets) {
+      const consistency = validateRemoteVersionMatchesSyncResult(remote, syncResult.versionId, syncResult.versionIndex, syncResult.compiledHash);
+      if (!consistency.ok)
+        return { ok: false, diagnostics: consistency.diagnostics };
+      const lockfile = buildLockfile(facts, remote, existing?.lockfile, generatedMetadata, vaultAssets);
+      if (!lockfile.ok)
+        return { ok: false, diagnostics: lockfile.diagnostics };
+      const { pendingSync: _pendingSync, ...syncedLockfile } = lockfile.value;
+      return {
+        ok: true,
+        value: (0, lockfile_1.planLockfileWrite)(path2, {
+          ...syncedLockfile,
+          lastSynced: {
+            versionId: syncResult.versionId,
+            versionIndex: syncResult.versionIndex,
+            sourceHash: syncResult.sourceHash,
+            compiledHash: syncResult.compiledHash,
+            syncedAt: syncResult.syncedAt,
+            lifecycle: syncResult.lifecycle
+          }
+        }, existing)
+      };
+    }
+    function buildLockfile(facts, remote, existing, generatedMetadata, vaultAssets) {
+      if (existing !== void 0) {
+        const identity = validateLockfileIdentity(existing, facts);
+        if (!identity.ok)
+          return { ok: false, diagnostics: identity.diagnostics };
+      }
+      const promptId = resolvePromptId(facts, existing);
+      if (!promptId.ok)
+        return { ok: false, diagnostics: promptId.diagnostics };
+      return {
+        ok: true,
+        value: {
+          version: 1,
+          targetName: facts.targetName,
+          workflowKey: facts.workflowKey,
+          context: {
+            key: facts.context.key,
+            ...facts.context.id === void 0 ? {} : { id: facts.context.id },
+            projectId: facts.context.projectId,
+            promptId: promptId.value
+          },
+          remote,
+          ...generatedMetadata === void 0 ? existing?.generatedMetadata === void 0 ? {} : { generatedMetadata: existing.generatedMetadata } : { generatedMetadata },
+          ...vaultAssets === void 0 ? existing?.vaultAssets === void 0 ? {} : { vaultAssets: existing.vaultAssets } : { vaultAssets },
+          ...existing?.pendingSync === void 0 ? {} : { pendingSync: existing.pendingSync },
+          ...existing?.lastSynced === void 0 ? {} : { lastSynced: existing.lastSynced }
+        }
+      };
+    }
+    function validateRemoteVersionMatchesSyncResult(remote, versionId, versionIndex, compiledHash) {
+      const remoteVersion = remote.version;
+      if (remoteVersion !== void 0 && remoteVersion.id === versionId && remoteVersion.versionIndex === versionIndex && remoteVersion.compiledHash === compiledHash) {
+        return { ok: true, value: void 0 };
+      }
+      return {
+        ok: false,
+        diagnostics: [(0, diagnostics_1.diagnostic)("state.remote.inconsistent", "error", "Workflow sync result does not match the supplied fresh remote snapshot", `Expected remote.version.id ${versionId}, remote.version.versionIndex ${versionIndex}, and remote.version.compiledHash ${compiledHash}. Pass the post-sync remote snapshot before writing state.`)]
+      };
+    }
+    function pushMismatch(mismatches, field, actual, expected) {
+      if (actual !== expected)
+        mismatches.push(`${field} expected ${expected} but found ${actual}`);
+    }
+  }
+});
+
+// ../../packages/workflow-code/dist/cli/state/types.js
+var require_types4 = __commonJS({
+  "../../packages/workflow-code/dist/cli/state/types.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+  }
+});
+
+// ../../packages/workflow-code/dist/cli/state/write.js
+var require_write = __commonJS({
+  "../../packages/workflow-code/dist/cli/state/write.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.writePlannedLockfile = writePlannedLockfile;
+    var node_crypto_1 = require("node:crypto");
+    var promises_1 = require("node:fs/promises");
+    var node_path_1 = require("node:path");
+    var diagnostics_1 = require_diagnostics();
+    var path_segments_1 = require_path_segments();
+    async function writePlannedLockfile(plan) {
+      const safeParent = await prepareSafeLockfileParent(plan.path);
+      if (!safeParent.ok)
+        return safeParent;
+      const lockPath = `${safeParent.value.lockfilePath}.lock`;
+      const lock = await acquireWriteLock(lockPath, plan.path);
+      if (!lock.ok)
+        return lock;
+      const tempPath = `${safeParent.value.lockfilePath}.${process.pid}.${Date.now()}.tmp`;
+      try {
+        const current = await readCurrentHash(safeParent.value.lockfilePath);
+        if (current !== plan.expectedPreviousHash) {
+          return {
+            ok: false,
+            diagnostics: [(0, diagnostics_1.diagnostic)("state.write.conflict", "error", `Workflow state lockfile changed before write at ${plan.path}`, "Re-read the active-context lockfile, recompute the planned write, and retry.")]
+          };
+        }
+        await (0, promises_1.writeFile)(tempPath, plan.content, { encoding: "utf8", flag: "wx" });
+        await (0, promises_1.rename)(tempPath, safeParent.value.lockfilePath);
+        return {
+          ok: true,
+          value: {
+            path: plan.path,
+            hash: hashContent(plan.content)
+          }
+        };
+      } catch (error) {
+        await (0, promises_1.unlink)(tempPath).catch(() => void 0);
+        throw error;
+      } finally {
+        await lock.value.close();
+        await (0, promises_1.unlink)(lockPath).catch(() => void 0);
+      }
+    }
+    async function prepareSafeLockfileParent(path2) {
+      const parts = parseLockfilePath(path2);
+      if (!parts.ok)
+        return parts;
+      let current = parts.value.rootDir;
+      for (const segment of [".tela", "workflows", parts.value.workflowKey, "contexts", parts.value.contextKey]) {
+        current = (0, node_path_1.join)(current, segment);
+        const directory = await ensureDirectoryWithoutSymlink(current, path2);
+        if (!directory.ok)
+          return directory;
+      }
+      const containment = await verifyRealStateContainment(parts.value, path2);
+      if (!containment.ok)
+        return containment;
+      const target = await rejectExistingTargetSymlink(parts.value.lockfilePath, path2);
+      if (!target.ok)
+        return target;
+      return parts;
+    }
+    function parseLockfilePath(path2) {
+      const lockfilePath = (0, node_path_1.resolve)(path2);
+      const parsed = (0, node_path_1.parse)(lockfilePath);
+      const segments = lockfilePath.slice(parsed.root.length).split(node_path_1.sep).filter((segment) => segment.length > 0);
+      const lockfileIndex = segments.length - 1;
+      const contextIndex = segments.length - 2;
+      const contextsIndex = segments.length - 3;
+      const workflowIndex = segments.length - 4;
+      const workflowsIndex = segments.length - 5;
+      const stateIndex = segments.length - 6;
+      if (stateIndex < 0 || segments[stateIndex] !== ".tela" || segments[workflowsIndex] !== "workflows" || segments[contextsIndex] !== "contexts" || segments[lockfileIndex] !== "lock.json" || !(0, path_segments_1.isSafeStatePathSegment)(segments[workflowIndex]) || !(0, path_segments_1.isSafeStatePathSegment)(segments[contextIndex])) {
+        return unsafePath(path2, "Expected lockfile path shape .tela/workflows/{workflowKey}/contexts/{contextKey}/lock.json");
+      }
+      const rootDir = (0, node_path_1.join)(parsed.root, ...segments.slice(0, stateIndex));
+      const workflowKey = segments[workflowIndex];
+      const contextKey = segments[contextIndex];
+      const stateDir = (0, node_path_1.join)(rootDir, ".tela");
+      const parentDir = (0, node_path_1.join)(stateDir, "workflows", workflowKey, "contexts", contextKey);
+      return {
+        ok: true,
+        value: {
+          rootDir,
+          stateDir,
+          parentDir,
+          lockfilePath: (0, node_path_1.join)(parentDir, "lock.json"),
+          workflowKey,
+          contextKey
+        }
+      };
+    }
+    async function ensureDirectoryWithoutSymlink(path2, targetPath) {
+      try {
+        const stats2 = await (0, promises_1.lstat)(path2);
+        if (stats2.isSymbolicLink())
+          return unsafePath(targetPath, `Path component ${path2} is a symbolic link`);
+        if (!stats2.isDirectory())
+          return unsafePath(targetPath, `Path component ${path2} is not a directory`);
+        return { ok: true, value: void 0 };
+      } catch (error) {
+        if (!isNodeError(error) || error.code !== "ENOENT")
+          throw error;
+      }
+      try {
+        await (0, promises_1.mkdir)(path2);
+      } catch (error) {
+        if (!isNodeError(error) || error.code !== "EEXIST")
+          throw error;
+      }
+      const stats = await (0, promises_1.lstat)(path2);
+      if (stats.isSymbolicLink())
+        return unsafePath(targetPath, `Path component ${path2} is a symbolic link`);
+      if (!stats.isDirectory())
+        return unsafePath(targetPath, `Path component ${path2} is not a directory`);
+      return { ok: true, value: void 0 };
+    }
+    async function verifyRealStateContainment(parts, targetPath) {
+      const stateDir = await (0, promises_1.realpath)(parts.stateDir);
+      const parentDir = await (0, promises_1.realpath)(parts.parentDir);
+      const parentRelativePath = (0, node_path_1.relative)(stateDir, parentDir);
+      if (parentRelativePath === "" || !parentRelativePath.startsWith("..") && !(0, node_path_1.isAbsolute)(parentRelativePath))
+        return { ok: true, value: void 0 };
+      return unsafePath(targetPath, `Resolved parent directory ${parentDir} escapes state directory ${stateDir}`);
+    }
+    async function rejectExistingTargetSymlink(path2, targetPath) {
+      try {
+        const stats = await (0, promises_1.lstat)(path2);
+        if (stats.isSymbolicLink())
+          return unsafePath(targetPath, `Existing lockfile ${path2} is a symbolic link`);
+        return { ok: true, value: void 0 };
+      } catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT")
+          return { ok: true, value: void 0 };
+        throw error;
+      }
+    }
+    function unsafePath(path2, detail) {
+      return {
+        ok: false,
+        diagnostics: [(0, diagnostics_1.diagnostic)("state.write.unsafe_path", "error", `Workflow state lockfile path is unsafe at ${path2}`, `${detail}. Use the derived workflow state path under .tela/workflows. This writer rejects pre-existing symlinked state components for CLI path hygiene, but does not sandbox concurrent local filesystem mutation of parent directories.`)]
+      };
+    }
+    async function acquireWriteLock(lockPath, targetPath) {
+      try {
+        return { ok: true, value: await (0, promises_1.open)(lockPath, "wx") };
+      } catch (error) {
+        if (isNodeError(error) && error.code === "EEXIST") {
+          return {
+            ok: false,
+            diagnostics: [(0, diagnostics_1.diagnostic)("state.write.conflict", "error", `Workflow state lockfile is already being written at ${targetPath}`, `Wait for the in-progress write to finish, then re-read and retry. If the previous process crashed, remove stale lock file ${lockPath} and retry.`)]
+          };
+        }
+        throw error;
+      }
+    }
+    async function readCurrentHash(path2) {
+      try {
+        return hashContent(await (0, promises_1.readFile)(path2));
+      } catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT")
+          return void 0;
+        throw error;
+      }
+    }
+    function hashContent(content) {
+      return (0, node_crypto_1.createHash)("sha256").update(content).digest("hex");
+    }
+    function isNodeError(error) {
+      return error instanceof Error && "code" in error;
+    }
+  }
+});
+
+// ../../packages/workflow-code/dist/cli/state/index.js
+var require_state = __commonJS({
+  "../../packages/workflow-code/dist/cli/state/index.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o2, m3, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m3, k);
+      if (!desc || ("get" in desc ? !m3.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m3[k];
+        } };
+      }
+      Object.defineProperty(o2, k2, desc);
+    }) : (function(o2, m3, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o2[k2] = m3[k];
+    }));
+    var __exportStar = exports2 && exports2.__exportStar || function(m3, exports3) {
+      for (var p3 in m3) if (p3 !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p3)) __createBinding(exports3, m3, p3);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    __exportStar(require_lockfile(), exports2);
+    __exportStar(require_planning(), exports2);
+    __exportStar(require_types4(), exports2);
+    __exportStar(require_write(), exports2);
+  }
+});
+
 // ../../packages/workflow-code/dist/cli/commands/select-target.js
 var require_select_target = __commonJS({
   "../../packages/workflow-code/dist/cli/commands/select-target.js"(exports2) {
@@ -269907,7 +270977,9 @@ var require_compile = __commonJS({
     var node_path_1 = require("node:path");
     var compiler_1 = require_compiler();
     var load_config_1 = require_load_config();
+    var resolve_target_identity_1 = require_resolve_target_identity();
     var load_source_1 = require_load_source();
+    var state_1 = require_state();
     var ui_1 = require_ui2();
     var select_target_1 = require_select_target();
     async function compileCommand(context) {
@@ -269922,13 +270994,58 @@ var require_compile = __commonJS({
       const sourceResult = await (0, load_source_1.loadWorkflowSource)((0, node_path_1.dirname)(configResult.value.path), selected.target, configResult.value.env, configResult.value.config.tsconfig);
       if (!sourceResult.ok)
         return { exitCode: 1, diagnostics: sourceResult.diagnostics };
-      const compiled = (0, compiler_1.transpileWorkflow)({
+      const initial = (0, compiler_1.transpileWorkflow)({
         targetName: selected.name,
         workflowKey: selected.target.workflowKey,
         title: selected.target.title,
         declaration: sourceResult.value.declaration,
         source: sourceResult.value.source
       });
+      const hasNonVaultAssetErrors = initial.diagnostics.some((item) => item.severity === "error" && item.code !== "vault.asset.missing_lock");
+      if (initial.resources.vaultAssets === void 0 || hasNonVaultAssetErrors)
+        return compileResult(configResult.value.path, selected.name, initial);
+      const identity = await (0, resolve_target_identity_1.resolveWorkflowTargetLockIdentity)(selected.name, selected.target);
+      if (!identity.ok)
+        return { exitCode: 1, diagnostics: identity.diagnostics, compiled: initial };
+      const lockPathFacts = {
+        targetName: selected.name,
+        workflowKey: initial.workflowKey,
+        context: {
+          key: identity.value.contextKey ?? "default",
+          ...identity.value.contextId === void 0 ? {} : { id: identity.value.contextId },
+          projectId: identity.value.projectId ?? "",
+          ...identity.value.promptId === void 0 ? {} : { promptId: identity.value.promptId }
+        }
+      };
+      const lockPath = (0, state_1.deriveLockfilePath)(context.cwd, lockPathFacts);
+      if (!lockPath.ok)
+        return { exitCode: 1, diagnostics: lockPath.diagnostics, compiled: initial };
+      const existing = await (0, state_1.readLockfile)(lockPath.value);
+      if (!existing.ok && existing.diagnostics[0]?.code !== "state.lockfile.missing")
+        return { exitCode: 1, diagnostics: existing.diagnostics, compiled: initial };
+      if (existing.ok) {
+        const facts = {
+          ...lockPathFacts,
+          context: {
+            ...lockPathFacts.context,
+            projectId: identity.value.projectId ?? existing.value.lockfile.context.projectId
+          }
+        };
+        const lockfileIdentity = (0, state_1.validateLockfileIdentity)(existing.value.lockfile, facts, lockPath.value);
+        if (!lockfileIdentity.ok)
+          return { exitCode: 1, diagnostics: lockfileIdentity.diagnostics, compiled: initial };
+      }
+      const compiled = (0, compiler_1.transpileWorkflow)({
+        targetName: selected.name,
+        workflowKey: selected.target.workflowKey,
+        title: selected.target.title,
+        declaration: sourceResult.value.declaration,
+        source: sourceResult.value.source,
+        vaultAssets: existing.ok ? existing.value.lockfile.vaultAssets : void 0
+      });
+      return compileResult(configResult.value.path, selected.name, compiled);
+    }
+    function compileResult(configPath, targetName, compiled) {
       const hasErrors = compiled.diagnostics.some((item) => item.severity === "error");
       return {
         exitCode: hasErrors ? 1 : 0,
@@ -269939,8 +271056,8 @@ var require_compile = __commonJS({
         },
         render: () => (0, ui_1.resultCard)("Workflow compile", [
           (0, ui_1.section)("Summary", (0, ui_1.kvList)([
-            { label: "Config", value: configResult.value.path },
-            { label: "Target", value: selected.name },
+            { label: "Config", value: configPath },
+            { label: "Target", value: targetName },
             { label: "Workflow key", value: compiled.workflowKey },
             { label: "Nodes", value: String(compiled.intermediate.graph.nodes.length) },
             { label: "Edges", value: String(compiled.intermediate.graph.edges.length) },
@@ -270657,830 +271774,6 @@ var require_not_implemented = __commonJS({
   }
 });
 
-// ../../packages/workflow-code/dist/cli/config/resolve-target-identity.js
-var require_resolve_target_identity = __commonJS({
-  "../../packages/workflow-code/dist/cli/config/resolve-target-identity.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.resolveWorkflowTargetIdentity = resolveWorkflowTargetIdentity;
-    var tela_local_config_1 = require_dist();
-    var diagnostics_1 = require_diagnostics();
-    var format_config_path_1 = require_format_config_path();
-    async function resolveWorkflowTargetIdentity(targetName, target, options = {}) {
-      const contexts = target.contexts;
-      if (contexts && Object.keys(contexts).length > 0) {
-        const contextResult = await resolveActiveContext(options);
-        if (!contextResult.ok)
-          return contextResult;
-        const candidateKeys = contextBindingCandidateKeys(contextResult.value);
-        const contextBinding = findContextBinding(contexts, candidateKeys);
-        if (!contextBinding) {
-          return {
-            ok: false,
-            diagnostics: [(0, diagnostics_1.diagnostic)("config.context_binding.missing", "error", `Workflow target ${targetName} has no binding for active Tela context ${contextResult.value.id}`, missingContextBindingHint(targetName, Object.keys(contexts), candidateKeys))]
-          };
-        }
-        const [contextKey, binding] = contextBinding;
-        const diagnostics2 = validateResolvedBinding(targetName, binding);
-        if (diagnostics2.length > 0)
-          return { ok: false, diagnostics: diagnostics2 };
-        return {
-          ok: true,
-          value: {
-            contextId: contextResult.value.id,
-            contextKey,
-            projectId: binding.projectId,
-            ...binding.promptId === void 0 ? {} : { promptId: binding.promptId },
-            source: "context"
-          }
-        };
-      }
-      const diagnostics = validateResolvedBinding(targetName, target);
-      if (diagnostics.length > 0)
-        return { ok: false, diagnostics };
-      const projectId = target.projectId;
-      return {
-        ok: true,
-        value: {
-          projectId,
-          ...target.promptId === void 0 ? {} : { promptId: target.promptId },
-          source: "legacy"
-        }
-      };
-    }
-    function findContextBinding(contexts, candidateKeys) {
-      for (const contextKey of candidateKeys) {
-        const binding = contexts[contextKey];
-        if (binding !== void 0)
-          return [contextKey, binding];
-      }
-      return void 0;
-    }
-    async function resolveActiveContext(options) {
-      try {
-        const config = options.localConfig ?? await (0, tela_local_config_1.loadConfig)();
-        return { ok: true, value: (0, tela_local_config_1.resolveContext)(config, { env: options.env }) };
-      } catch (error) {
-        return {
-          ok: false,
-          diagnostics: [(0, diagnostics_1.diagnostic)("config.context.resolve_failed", "error", "Unable to resolve active Tela Local context for Workflow Code command", resolveContextHint(error))]
-        };
-      }
-    }
-    function contextBindingCandidateKeys(context) {
-      return uniqueStrings([
-        context.id,
-        context.context.environmentId,
-        context.environment.label.toLowerCase(),
-        environmentAlias(context.context.environmentId),
-        context.environment.kind === "local" ? "dev" : void 0
-      ]);
-    }
-    function environmentAlias(environmentId) {
-      if (environmentId === "production")
-        return "prod";
-      if (environmentId === "development")
-        return "dev";
-      return void 0;
-    }
-    function validateResolvedBinding(targetName, binding) {
-      const diagnostics = [];
-      if (!binding.projectId || typeof binding.projectId !== "string") {
-        diagnostics.push((0, diagnostics_1.diagnostic)("config.workflow.project_id.missing", "error", `Workflow target ${targetName} must resolve a non-empty projectId`, `Set \`${(0, format_config_path_1.formatConfigPath)("workflows", targetName, "projectId")}\` to a non-empty Tela project id, or add \`${(0, format_config_path_1.formatConfigPath)("workflows", targetName, "contexts", "<context>", "projectId")}\` for the active Tela context. Check contexts with \`tela context list\`.`));
-      }
-      if (binding.promptId !== void 0 && (typeof binding.promptId !== "string" || binding.promptId.length === 0)) {
-        diagnostics.push((0, diagnostics_1.diagnostic)("config.workflow.prompt_id.invalid", "error", `Workflow target ${targetName} promptId must be a non-empty string when provided`, `Set \`${(0, format_config_path_1.formatConfigPath)("workflows", targetName, "promptId")}\` to a non-empty Tela prompt id from the Tela UI, or remove it if no existing prompt should be bound.`));
-      }
-      return diagnostics;
-    }
-    function missingContextBindingHint(targetName, configuredKeys, triedKeys) {
-      const preferredKey = triedKeys[0] ?? "<context>";
-      return [
-        `Add one of the tried keys under \`${(0, format_config_path_1.formatConfigPath)("workflows", targetName, "contexts")}\`, for example \`${(0, format_config_path_1.formatObjectKey)(preferredKey)}: { projectId: 'proj_...' }\`, or switch context with \`tela context use <context-id>\`.`,
-        `Configured bindings: ${configuredKeys.join(", ") || "(none)"}. Tried: ${triedKeys.join(", ") || "(none)"}.`
-      ].join(" ");
-    }
-    function resolveContextHint(error) {
-      const detail = error instanceof Error && error.message.trim() ? ` Detail: ${error.message}` : "";
-      return `Run \`tela context list\` to see configured contexts, then choose one with \`tela context use <context-id>\`. If no contexts exist, add one in Tela Dock/local setup before running workflow commands.${detail}`;
-    }
-    function uniqueStrings(values) {
-      return Array.from(new Set(values.filter((value) => Boolean(value))));
-    }
-  }
-});
-
-// ../../packages/workflow-code/dist/cli/state/lockfile.js
-var require_lockfile = __commonJS({
-  "../../packages/workflow-code/dist/cli/state/lockfile.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.deriveLockfilePath = deriveLockfilePath;
-    exports2.readLockfile = readLockfile;
-    exports2.validateWorkflowLockfile = validateWorkflowLockfile;
-    exports2.serializeLockfile = serializeLockfile;
-    exports2.planLockfileWrite = planLockfileWrite;
-    var promises_1 = require("node:fs/promises");
-    var node_path_1 = require("node:path");
-    var diagnostics_1 = require_diagnostics();
-    var hash_1 = require_hash();
-    var path_segments_1 = require_path_segments();
-    var LOCKFILE_VERSION = 1;
-    var VALID_VERSION_STATUSES = /* @__PURE__ */ new Set(["draft", "consolidated", "published"]);
-    function deriveLockfilePath(rootDir, facts) {
-      const workflowDiagnostic = validatePathSegment("workflowKey", facts.workflowKey);
-      const contextDiagnostic = validatePathSegment("contextKey", facts.context.key);
-      const diagnostics = [workflowDiagnostic, contextDiagnostic].filter((item) => item !== void 0);
-      if (diagnostics.length > 0)
-        return { ok: false, diagnostics };
-      return {
-        ok: true,
-        value: (0, node_path_1.join)(rootDir, ".tela", "workflows", facts.workflowKey, "contexts", facts.context.key, "lock.json")
-      };
-    }
-    async function readLockfile(path2) {
-      let content;
-      try {
-        content = await (0, promises_1.readFile)(path2, "utf8");
-      } catch (error) {
-        if (isNodeError(error) && error.code === "ENOENT") {
-          return {
-            ok: false,
-            diagnostics: [(0, diagnostics_1.diagnostic)("state.lockfile.missing", "error", `Workflow state lockfile does not exist at ${path2}`, "Run a remote workflow command that can fetch and persist remote state for the active context.")]
-          };
-        }
-        throw error;
-      }
-      let parsed;
-      try {
-        parsed = JSON.parse(content);
-      } catch (error) {
-        const detail = error instanceof Error ? ` ${error.message}` : "";
-        return {
-          ok: false,
-          diagnostics: [(0, diagnostics_1.diagnostic)("state.lockfile.invalid", "error", `Workflow state lockfile at ${path2} is not valid JSON.${detail}`, "Regenerate the active-context workflow state lockfile from fresh remote state.")]
-        };
-      }
-      const validation = validateWorkflowLockfile(parsed, path2);
-      if (!validation.ok)
-        return validation;
-      return {
-        ok: true,
-        value: {
-          path: path2,
-          hash: (0, hash_1.hashString)(content),
-          content,
-          lockfile: validation.value
-        }
-      };
-    }
-    function validateWorkflowLockfile(value, path2 = "<lockfile>") {
-      const diagnostics = validateLockfileShape(value, path2);
-      if (diagnostics.length > 0)
-        return { ok: false, diagnostics };
-      return { ok: true, value };
-    }
-    function serializeLockfile(lockfile) {
-      return `${JSON.stringify(orderLockfile(lockfile), null, 2)}
-`;
-    }
-    function planLockfileWrite(path2, lockfile, existing) {
-      return {
-        path: path2,
-        ...existing === void 0 ? {} : { expectedPreviousHash: existing.hash },
-        lockfile,
-        content: serializeLockfile(lockfile)
-      };
-    }
-    function validatePathSegment(name, value) {
-      if ((0, path_segments_1.isSafeStatePathSegment)(value))
-        return void 0;
-      return (0, diagnostics_1.diagnostic)("state.lockfile.invalid", "error", `Workflow state lockfile ${name} is not a safe filesystem path segment`, "Workflow and context keys must be one filesystem segment using only letters, numbers, `_`, or `-`.");
-    }
-    function validateLockfileShape(value, path2) {
-      const diagnostics = [];
-      validateLockfile(value, path2, diagnostics);
-      return diagnostics;
-    }
-    function validateLockfile(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["version", "targetName", "workflowKey", "context", "remote", "generatedMetadata", "pendingSync", "lastSynced"], diagnostics))
-        return;
-      if (value.version !== LOCKFILE_VERSION)
-        pushInvalid(diagnostics, path2, "version must be 1");
-      validateRequiredString(value, "targetName", `${path2}.targetName`, diagnostics);
-      validateRequiredString(value, "workflowKey", `${path2}.workflowKey`, diagnostics);
-      validateContext(value.context, `${path2}.context`, diagnostics);
-      validateRemote(value.remote, `${path2}.remote`, diagnostics);
-      if (value.generatedMetadata !== void 0)
-        validateGeneratedMetadata(value.generatedMetadata, `${path2}.generatedMetadata`, diagnostics);
-      if (value.pendingSync !== void 0)
-        validatePendingSync(value.pendingSync, `${path2}.pendingSync`, diagnostics);
-      if (value.lastSynced !== void 0)
-        validateLastSynced(value.lastSynced, `${path2}.lastSynced`, diagnostics);
-    }
-    function validateGeneratedMetadata(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["version", "contextId", "workspaceId", "catalogHash", "refs"], diagnostics))
-        return;
-      if (value.version !== LOCKFILE_VERSION)
-        pushInvalid(diagnostics, `${path2}.version`, "version must be 1");
-      validateRequiredString(value, "contextId", `${path2}.contextId`, diagnostics);
-      validateRequiredString(value, "workspaceId", `${path2}.workspaceId`, diagnostics);
-      validateRequiredString(value, "catalogHash", `${path2}.catalogHash`, diagnostics);
-      if (!Array.isArray(value.refs)) {
-        pushInvalid(diagnostics, `${path2}.refs`, "must be an array");
-        return;
-      }
-      value.refs.forEach((ref, index) => validateLockedRemoteRef(ref, `${path2}.refs[${index}]`, diagnostics));
-    }
-    function validateLockedRemoteRef(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["declarationKey", "kind", "path", "id", "environmentName", "versionId", "revision", "inputHash", "outputContractHash", "contractHash"], diagnostics))
-        return;
-      validateRequiredString(value, "declarationKey", `${path2}.declarationKey`, diagnostics);
-      if (value.kind !== "canvas" && value.kind !== "workflow" && value.kind !== "agent" && value.kind !== "model")
-        pushInvalid(diagnostics, `${path2}.kind`, "kind must be canvas, workflow, agent, or model");
-      if (value.path !== void 0)
-        validateStringArray(value.path, `${path2}.path`, diagnostics);
-      validateRequiredString(value, "id", `${path2}.id`, diagnostics);
-      validateOptionalString(value, "environmentName", `${path2}.environmentName`, diagnostics);
-      validateOptionalString(value, "versionId", `${path2}.versionId`, diagnostics);
-      validateOptionalString(value, "revision", `${path2}.revision`, diagnostics);
-      validateOptionalString(value, "inputHash", `${path2}.inputHash`, diagnostics);
-      validateOptionalString(value, "outputContractHash", `${path2}.outputContractHash`, diagnostics);
-      validateRequiredString(value, "contractHash", `${path2}.contractHash`, diagnostics);
-    }
-    function validateContext(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["key", "id", "projectId", "promptId"], diagnostics))
-        return;
-      validateRequiredString(value, "key", `${path2}.key`, diagnostics);
-      validateOptionalString(value, "id", `${path2}.id`, diagnostics);
-      validateRequiredString(value, "projectId", `${path2}.projectId`, diagnostics);
-      validateRequiredString(value, "promptId", `${path2}.promptId`, diagnostics);
-    }
-    function validateRemote(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["fetchedAt", "contentHash", "prompt", "version", "codegen"], diagnostics))
-        return;
-      validateRequiredString(value, "fetchedAt", `${path2}.fetchedAt`, diagnostics);
-      validateRequiredString(value, "contentHash", `${path2}.contentHash`, diagnostics);
-      validatePrompt(value.prompt, `${path2}.prompt`, diagnostics);
-      validateRemoteVersion(value.version, `${path2}.version`, diagnostics);
-      if (value.codegen !== void 0)
-        validateCodegen(value.codegen, `${path2}.codegen`, diagnostics);
-    }
-    function validatePrompt(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["id", "title", "currentVersionId", "currentVersionIndex", "publishedVersionId", "publishedVersionIndex"], diagnostics))
-        return;
-      validateRequiredString(value, "id", `${path2}.id`, diagnostics);
-      validateOptionalString(value, "title", `${path2}.title`, diagnostics);
-      validateRequiredString(value, "currentVersionId", `${path2}.currentVersionId`, diagnostics);
-      validateRequiredNumber(value, "currentVersionIndex", `${path2}.currentVersionIndex`, diagnostics);
-      validateOptionalString(value, "publishedVersionId", `${path2}.publishedVersionId`, diagnostics);
-      validateOptionalNumber(value, "publishedVersionIndex", `${path2}.publishedVersionIndex`, diagnostics);
-    }
-    function validateRemoteVersion(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["id", "versionIndex", "status", "contentHash", "compiledHash", "publishedEnvironmentNames"], diagnostics))
-        return;
-      validateRequiredString(value, "id", `${path2}.id`, diagnostics);
-      validateRequiredNumber(value, "versionIndex", `${path2}.versionIndex`, diagnostics);
-      if (typeof value.status !== "string" || !VALID_VERSION_STATUSES.has(value.status))
-        pushInvalid(diagnostics, `${path2}.status`, "status must be draft, consolidated, or published");
-      validateRequiredString(value, "contentHash", `${path2}.contentHash`, diagnostics);
-      validateOptionalString(value, "compiledHash", `${path2}.compiledHash`, diagnostics);
-      validateOptionalStringArray(value, "publishedEnvironmentNames", `${path2}.publishedEnvironmentNames`, diagnostics);
-    }
-    function validateCodegen(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["templateVariables", "canvasVariables", "modelIds", "toolIds", "outputSchemasHash"], diagnostics))
-        return;
-      validateOptionalStringArray(value, "templateVariables", `${path2}.templateVariables`, diagnostics);
-      validateOptionalStringArray(value, "canvasVariables", `${path2}.canvasVariables`, diagnostics);
-      validateOptionalStringArray(value, "modelIds", `${path2}.modelIds`, diagnostics);
-      validateOptionalStringArray(value, "toolIds", `${path2}.toolIds`, diagnostics);
-      validateOptionalString(value, "outputSchemasHash", `${path2}.outputSchemasHash`, diagnostics);
-    }
-    function validateLifecycleMetadata(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["operation", "targetVersionId", "idempotencyKey", "requestHash"], diagnostics))
-        return;
-      if (value.operation !== "edit")
-        pushInvalid(diagnostics, `${path2}.operation`, "operation must be edit");
-      validateRequiredString(value, "targetVersionId", `${path2}.targetVersionId`, diagnostics);
-      validateRequiredString(value, "idempotencyKey", `${path2}.idempotencyKey`, diagnostics);
-      validateRequiredString(value, "requestHash", `${path2}.requestHash`, diagnostics);
-    }
-    function validatePendingSync(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["operation", "targetVersionId", "idempotencyKey", "requestHash", "sourceHash", "compiledHash", "createdAt", "mutationAttemptedAt"], diagnostics))
-        return;
-      validateLifecycleMetadata({
-        operation: value.operation,
-        targetVersionId: value.targetVersionId,
-        idempotencyKey: value.idempotencyKey,
-        requestHash: value.requestHash
-      }, path2, diagnostics);
-      validateRequiredString(value, "sourceHash", `${path2}.sourceHash`, diagnostics);
-      validateRequiredString(value, "compiledHash", `${path2}.compiledHash`, diagnostics);
-      validateRequiredString(value, "createdAt", `${path2}.createdAt`, diagnostics);
-      validateOptionalString(value, "mutationAttemptedAt", `${path2}.mutationAttemptedAt`, diagnostics);
-    }
-    function validateLastSynced(value, path2, diagnostics) {
-      if (!validateObject(value, path2, ["versionId", "versionIndex", "sourceHash", "compiledHash", "syncedAt", "lifecycle"], diagnostics))
-        return;
-      validateRequiredString(value, "versionId", `${path2}.versionId`, diagnostics);
-      validateRequiredNumber(value, "versionIndex", `${path2}.versionIndex`, diagnostics);
-      validateRequiredString(value, "sourceHash", `${path2}.sourceHash`, diagnostics);
-      validateRequiredString(value, "compiledHash", `${path2}.compiledHash`, diagnostics);
-      validateRequiredString(value, "syncedAt", `${path2}.syncedAt`, diagnostics);
-      validateLifecycleMetadata(value.lifecycle, `${path2}.lifecycle`, diagnostics);
-    }
-    function validateObject(value, path2, expectedKeys, diagnostics) {
-      if (!isRecord2(value)) {
-        pushInvalid(diagnostics, path2, "expected object");
-        return false;
-      }
-      const expected = new Set(expectedKeys);
-      for (const key of Object.keys(value)) {
-        if (!expected.has(key))
-          pushInvalid(diagnostics, `${path2}.${key}`, "unknown field");
-      }
-      return true;
-    }
-    function validateRequiredString(record, key, path2, diagnostics) {
-      const value = record[key];
-      if (typeof value !== "string" || value.length === 0)
-        pushInvalid(diagnostics, path2, "must be a non-empty string");
-    }
-    function validateOptionalString(record, key, path2, diagnostics) {
-      const value = record[key];
-      if (value !== void 0 && (typeof value !== "string" || value.length === 0))
-        pushInvalid(diagnostics, path2, "must be a non-empty string when present");
-    }
-    function validateRequiredNumber(record, key, path2, diagnostics) {
-      const value = record[key];
-      if (typeof value !== "number" || !Number.isFinite(value))
-        pushInvalid(diagnostics, path2, "must be a finite number");
-    }
-    function validateOptionalNumber(record, key, path2, diagnostics) {
-      const value = record[key];
-      if (value !== void 0 && (typeof value !== "number" || !Number.isFinite(value)))
-        pushInvalid(diagnostics, path2, "must be a finite number when present");
-    }
-    function validateOptionalStringArray(record, key, path2, diagnostics) {
-      const value = record[key];
-      if (value === void 0)
-        return;
-      validateStringArray(value, path2, diagnostics);
-    }
-    function validateStringArray(value, path2, diagnostics) {
-      if (!Array.isArray(value)) {
-        pushInvalid(diagnostics, path2, "must be an array of strings when present");
-        return;
-      }
-      if (!value.every((item) => typeof item === "string" && item.length > 0))
-        pushInvalid(diagnostics, path2, "must contain only non-empty strings");
-    }
-    function pushInvalid(diagnostics, path2, detail) {
-      diagnostics.push((0, diagnostics_1.diagnostic)("state.lockfile.invalid", "error", `Workflow state lockfile ${path2} is invalid: ${detail}`, "Regenerate the active-context workflow state lockfile from fresh remote state."));
-    }
-    function orderLockfile(lockfile) {
-      return {
-        version: lockfile.version,
-        targetName: lockfile.targetName,
-        workflowKey: lockfile.workflowKey,
-        context: {
-          key: lockfile.context.key,
-          ...lockfile.context.id === void 0 ? {} : { id: lockfile.context.id },
-          projectId: lockfile.context.projectId,
-          promptId: lockfile.context.promptId
-        },
-        remote: orderRemote(lockfile.remote),
-        ...lockfile.generatedMetadata === void 0 ? {} : { generatedMetadata: orderGeneratedMetadata(lockfile.generatedMetadata) },
-        ...lockfile.pendingSync === void 0 ? {} : { pendingSync: {
-          operation: lockfile.pendingSync.operation,
-          targetVersionId: lockfile.pendingSync.targetVersionId,
-          idempotencyKey: lockfile.pendingSync.idempotencyKey,
-          requestHash: lockfile.pendingSync.requestHash,
-          sourceHash: lockfile.pendingSync.sourceHash,
-          compiledHash: lockfile.pendingSync.compiledHash,
-          createdAt: lockfile.pendingSync.createdAt,
-          ...lockfile.pendingSync.mutationAttemptedAt === void 0 ? {} : { mutationAttemptedAt: lockfile.pendingSync.mutationAttemptedAt }
-        } },
-        ...lockfile.lastSynced === void 0 ? {} : { lastSynced: {
-          versionId: lockfile.lastSynced.versionId,
-          versionIndex: lockfile.lastSynced.versionIndex,
-          sourceHash: lockfile.lastSynced.sourceHash,
-          compiledHash: lockfile.lastSynced.compiledHash,
-          syncedAt: lockfile.lastSynced.syncedAt,
-          lifecycle: {
-            operation: lockfile.lastSynced.lifecycle.operation,
-            targetVersionId: lockfile.lastSynced.lifecycle.targetVersionId,
-            idempotencyKey: lockfile.lastSynced.lifecycle.idempotencyKey,
-            requestHash: lockfile.lastSynced.lifecycle.requestHash
-          }
-        } }
-      };
-    }
-    function orderGeneratedMetadata(metadata) {
-      return {
-        version: metadata.version,
-        contextId: metadata.contextId,
-        workspaceId: metadata.workspaceId,
-        catalogHash: metadata.catalogHash,
-        refs: [...metadata.refs].sort((left, right) => left.declarationKey.localeCompare(right.declarationKey) || left.kind.localeCompare(right.kind) || left.id.localeCompare(right.id)).map((ref) => ({
-          declarationKey: ref.declarationKey,
-          kind: ref.kind,
-          ...ref.path === void 0 ? {} : { path: [...ref.path] },
-          id: ref.id,
-          ...ref.environmentName === void 0 ? {} : { environmentName: ref.environmentName },
-          ...ref.versionId === void 0 ? {} : { versionId: ref.versionId },
-          ...ref.revision === void 0 ? {} : { revision: ref.revision },
-          ...ref.inputHash === void 0 ? {} : { inputHash: ref.inputHash },
-          ...ref.outputContractHash === void 0 ? {} : { outputContractHash: ref.outputContractHash },
-          contractHash: ref.contractHash
-        }))
-      };
-    }
-    function orderRemote(remote) {
-      return {
-        fetchedAt: remote.fetchedAt,
-        contentHash: remote.contentHash,
-        prompt: {
-          id: remote.prompt.id,
-          ...remote.prompt.title === void 0 ? {} : { title: remote.prompt.title },
-          currentVersionId: remote.prompt.currentVersionId,
-          currentVersionIndex: remote.prompt.currentVersionIndex,
-          ...remote.prompt.publishedVersionId === void 0 ? {} : { publishedVersionId: remote.prompt.publishedVersionId },
-          ...remote.prompt.publishedVersionIndex === void 0 ? {} : { publishedVersionIndex: remote.prompt.publishedVersionIndex }
-        },
-        version: {
-          id: remote.version.id,
-          versionIndex: remote.version.versionIndex,
-          status: remote.version.status,
-          contentHash: remote.version.contentHash,
-          ...remote.version.compiledHash === void 0 ? {} : { compiledHash: remote.version.compiledHash },
-          ...remote.version.publishedEnvironmentNames === void 0 ? {} : { publishedEnvironmentNames: [...remote.version.publishedEnvironmentNames].sort((left, right) => left.localeCompare(right)) }
-        },
-        ...remote.codegen === void 0 ? {} : { codegen: {
-          ...remote.codegen.templateVariables === void 0 ? {} : { templateVariables: remote.codegen.templateVariables },
-          ...remote.codegen.canvasVariables === void 0 ? {} : { canvasVariables: remote.codegen.canvasVariables },
-          ...remote.codegen.modelIds === void 0 ? {} : { modelIds: remote.codegen.modelIds },
-          ...remote.codegen.toolIds === void 0 ? {} : { toolIds: remote.codegen.toolIds },
-          ...remote.codegen.outputSchemasHash === void 0 ? {} : { outputSchemasHash: remote.codegen.outputSchemasHash }
-        } }
-      };
-    }
-    function isRecord2(value) {
-      return typeof value === "object" && value !== null && !Array.isArray(value);
-    }
-    function isNodeError(error) {
-      return error instanceof Error && "code" in error;
-    }
-  }
-});
-
-// ../../packages/workflow-code/dist/cli/state/planning.js
-var require_planning = __commonJS({
-  "../../packages/workflow-code/dist/cli/state/planning.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.validateLockfileIdentity = validateLockfileIdentity;
-    exports2.resolvePromptId = resolvePromptId;
-    exports2.isLocalSynced = isLocalSynced;
-    exports2.isFreshRemoteConfirmed = isFreshRemoteConfirmed;
-    exports2.detectRemoteDivergence = detectRemoteDivergence;
-    exports2.planRemoteSnapshotWrite = planRemoteSnapshotWrite;
-    exports2.planSyncResultWrite = planSyncResultWrite;
-    var diagnostics_1 = require_diagnostics();
-    var lockfile_1 = require_lockfile();
-    function validateLockfileIdentity(lockfile, facts, path2 = "<lockfile>") {
-      const mismatches = [];
-      pushMismatch(mismatches, "targetName", lockfile.targetName, facts.targetName);
-      pushMismatch(mismatches, "workflowKey", lockfile.workflowKey, facts.workflowKey);
-      pushMismatch(mismatches, "context.key", lockfile.context.key, facts.context.key);
-      pushMismatch(mismatches, "context.projectId", lockfile.context.projectId, facts.context.projectId);
-      if (facts.context.id !== void 0 && lockfile.context.id !== void 0)
-        pushMismatch(mismatches, "context.id", lockfile.context.id, facts.context.id);
-      if (facts.context.promptId !== void 0)
-        pushMismatch(mismatches, "context.promptId", lockfile.context.promptId, facts.context.promptId);
-      if (mismatches.length > 0) {
-        return {
-          ok: false,
-          diagnostics: [(0, diagnostics_1.diagnostic)("state.lockfile.identity_mismatch", "error", `Workflow state lockfile at ${path2} does not match the selected workflow target/context`, `Mismatched fields: ${mismatches.join(", ")}. Use the lockfile for the active workflow/context only.`)]
-        };
-      }
-      return { ok: true, value: lockfile };
-    }
-    function resolvePromptId(facts, lockfile) {
-      if (facts.context.promptId !== void 0)
-        return { ok: true, value: facts.context.promptId };
-      if (lockfile !== void 0) {
-        const identity = validateLockfileIdentity(lockfile, facts);
-        if (!identity.ok)
-          return { ok: false, diagnostics: identity.diagnostics };
-        return { ok: true, value: lockfile.context.promptId };
-      }
-      return {
-        ok: false,
-        diagnostics: [(0, diagnostics_1.diagnostic)("state.prompt_id.missing", "error", `Workflow target ${facts.targetName} has no prompt id for context ${facts.context.key}`, "Add promptId to the active workflow context binding or run a command that creates/binds the prompt before requiring existing remote prompt state.")]
-      };
-    }
-    function isLocalSynced(lockfile, local) {
-      const lastSynced = lockfile.lastSynced;
-      return lastSynced !== void 0 && lastSynced.sourceHash === local.sourceHash && lastSynced.compiledHash === local.compiledHash;
-    }
-    function isFreshRemoteConfirmed(lockfile, remote) {
-      return lockfile.lastSynced !== void 0 && remote.version.id === lockfile.lastSynced.versionId && remote.version.versionIndex === lockfile.lastSynced.versionIndex && remote.contentHash === lockfile.remote.contentHash;
-    }
-    function detectRemoteDivergence(lockfile, remote) {
-      if (lockfile.lastSynced === void 0)
-        return [];
-      if (remote.version.id === lockfile.lastSynced.versionId && remote.version.versionIndex === lockfile.lastSynced.versionIndex && remote.contentHash === lockfile.remote.contentHash) {
-        return [];
-      }
-      return [(0, diagnostics_1.diagnostic)("state.remote.diverged", "warning", `Remote workflow content for ${lockfile.workflowKey}/${lockfile.context.key} differs from the last synced lockfile state`, "Confirm before overwriting remote changes, or pass --yes to continue non-interactively.")];
-    }
-    function planRemoteSnapshotWrite(path2, facts, remote, existing, generatedMetadata) {
-      const lockfile = buildLockfile(facts, remote, existing?.lockfile, generatedMetadata);
-      if (!lockfile.ok)
-        return { ok: false, diagnostics: lockfile.diagnostics };
-      return { ok: true, value: (0, lockfile_1.planLockfileWrite)(path2, lockfile.value, existing) };
-    }
-    function planSyncResultWrite(path2, facts, remote, syncResult, existing, generatedMetadata) {
-      const consistency = validateRemoteVersionMatchesSyncResult(remote, syncResult.versionId, syncResult.versionIndex, syncResult.compiledHash);
-      if (!consistency.ok)
-        return { ok: false, diagnostics: consistency.diagnostics };
-      const lockfile = buildLockfile(facts, remote, existing?.lockfile, generatedMetadata);
-      if (!lockfile.ok)
-        return { ok: false, diagnostics: lockfile.diagnostics };
-      const { pendingSync: _pendingSync, ...syncedLockfile } = lockfile.value;
-      return {
-        ok: true,
-        value: (0, lockfile_1.planLockfileWrite)(path2, {
-          ...syncedLockfile,
-          lastSynced: {
-            versionId: syncResult.versionId,
-            versionIndex: syncResult.versionIndex,
-            sourceHash: syncResult.sourceHash,
-            compiledHash: syncResult.compiledHash,
-            syncedAt: syncResult.syncedAt,
-            lifecycle: syncResult.lifecycle
-          }
-        }, existing)
-      };
-    }
-    function buildLockfile(facts, remote, existing, generatedMetadata) {
-      if (existing !== void 0) {
-        const identity = validateLockfileIdentity(existing, facts);
-        if (!identity.ok)
-          return { ok: false, diagnostics: identity.diagnostics };
-      }
-      const promptId = resolvePromptId(facts, existing);
-      if (!promptId.ok)
-        return { ok: false, diagnostics: promptId.diagnostics };
-      return {
-        ok: true,
-        value: {
-          version: 1,
-          targetName: facts.targetName,
-          workflowKey: facts.workflowKey,
-          context: {
-            key: facts.context.key,
-            ...facts.context.id === void 0 ? {} : { id: facts.context.id },
-            projectId: facts.context.projectId,
-            promptId: promptId.value
-          },
-          remote,
-          ...generatedMetadata === void 0 ? existing?.generatedMetadata === void 0 ? {} : { generatedMetadata: existing.generatedMetadata } : { generatedMetadata },
-          ...existing?.pendingSync === void 0 ? {} : { pendingSync: existing.pendingSync },
-          ...existing?.lastSynced === void 0 ? {} : { lastSynced: existing.lastSynced }
-        }
-      };
-    }
-    function validateRemoteVersionMatchesSyncResult(remote, versionId, versionIndex, compiledHash) {
-      const remoteVersion = remote.version;
-      if (remoteVersion !== void 0 && remoteVersion.id === versionId && remoteVersion.versionIndex === versionIndex && remoteVersion.compiledHash === compiledHash) {
-        return { ok: true, value: void 0 };
-      }
-      return {
-        ok: false,
-        diagnostics: [(0, diagnostics_1.diagnostic)("state.remote.inconsistent", "error", "Workflow sync result does not match the supplied fresh remote snapshot", `Expected remote.version.id ${versionId}, remote.version.versionIndex ${versionIndex}, and remote.version.compiledHash ${compiledHash}. Pass the post-sync remote snapshot before writing state.`)]
-      };
-    }
-    function pushMismatch(mismatches, field, actual, expected) {
-      if (actual !== expected)
-        mismatches.push(`${field} expected ${expected} but found ${actual}`);
-    }
-  }
-});
-
-// ../../packages/workflow-code/dist/cli/state/types.js
-var require_types4 = __commonJS({
-  "../../packages/workflow-code/dist/cli/state/types.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-  }
-});
-
-// ../../packages/workflow-code/dist/cli/state/write.js
-var require_write = __commonJS({
-  "../../packages/workflow-code/dist/cli/state/write.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.writePlannedLockfile = writePlannedLockfile;
-    var node_crypto_1 = require("node:crypto");
-    var promises_1 = require("node:fs/promises");
-    var node_path_1 = require("node:path");
-    var diagnostics_1 = require_diagnostics();
-    var path_segments_1 = require_path_segments();
-    async function writePlannedLockfile(plan) {
-      const safeParent = await prepareSafeLockfileParent(plan.path);
-      if (!safeParent.ok)
-        return safeParent;
-      const lockPath = `${safeParent.value.lockfilePath}.lock`;
-      const lock = await acquireWriteLock(lockPath, plan.path);
-      if (!lock.ok)
-        return lock;
-      const tempPath = `${safeParent.value.lockfilePath}.${process.pid}.${Date.now()}.tmp`;
-      try {
-        const current = await readCurrentHash(safeParent.value.lockfilePath);
-        if (current !== plan.expectedPreviousHash) {
-          return {
-            ok: false,
-            diagnostics: [(0, diagnostics_1.diagnostic)("state.write.conflict", "error", `Workflow state lockfile changed before write at ${plan.path}`, "Re-read the active-context lockfile, recompute the planned write, and retry.")]
-          };
-        }
-        await (0, promises_1.writeFile)(tempPath, plan.content, { encoding: "utf8", flag: "wx" });
-        await (0, promises_1.rename)(tempPath, safeParent.value.lockfilePath);
-        return {
-          ok: true,
-          value: {
-            path: plan.path,
-            hash: hashContent(plan.content)
-          }
-        };
-      } catch (error) {
-        await (0, promises_1.unlink)(tempPath).catch(() => void 0);
-        throw error;
-      } finally {
-        await lock.value.close();
-        await (0, promises_1.unlink)(lockPath).catch(() => void 0);
-      }
-    }
-    async function prepareSafeLockfileParent(path2) {
-      const parts = parseLockfilePath(path2);
-      if (!parts.ok)
-        return parts;
-      let current = parts.value.rootDir;
-      for (const segment of [".tela", "workflows", parts.value.workflowKey, "contexts", parts.value.contextKey]) {
-        current = (0, node_path_1.join)(current, segment);
-        const directory = await ensureDirectoryWithoutSymlink(current, path2);
-        if (!directory.ok)
-          return directory;
-      }
-      const containment = await verifyRealStateContainment(parts.value, path2);
-      if (!containment.ok)
-        return containment;
-      const target = await rejectExistingTargetSymlink(parts.value.lockfilePath, path2);
-      if (!target.ok)
-        return target;
-      return parts;
-    }
-    function parseLockfilePath(path2) {
-      const lockfilePath = (0, node_path_1.resolve)(path2);
-      const parsed = (0, node_path_1.parse)(lockfilePath);
-      const segments = lockfilePath.slice(parsed.root.length).split(node_path_1.sep).filter((segment) => segment.length > 0);
-      const lockfileIndex = segments.length - 1;
-      const contextIndex = segments.length - 2;
-      const contextsIndex = segments.length - 3;
-      const workflowIndex = segments.length - 4;
-      const workflowsIndex = segments.length - 5;
-      const stateIndex = segments.length - 6;
-      if (stateIndex < 0 || segments[stateIndex] !== ".tela" || segments[workflowsIndex] !== "workflows" || segments[contextsIndex] !== "contexts" || segments[lockfileIndex] !== "lock.json" || !(0, path_segments_1.isSafeStatePathSegment)(segments[workflowIndex]) || !(0, path_segments_1.isSafeStatePathSegment)(segments[contextIndex])) {
-        return unsafePath(path2, "Expected lockfile path shape .tela/workflows/{workflowKey}/contexts/{contextKey}/lock.json");
-      }
-      const rootDir = (0, node_path_1.join)(parsed.root, ...segments.slice(0, stateIndex));
-      const workflowKey = segments[workflowIndex];
-      const contextKey = segments[contextIndex];
-      const stateDir = (0, node_path_1.join)(rootDir, ".tela");
-      const parentDir = (0, node_path_1.join)(stateDir, "workflows", workflowKey, "contexts", contextKey);
-      return {
-        ok: true,
-        value: {
-          rootDir,
-          stateDir,
-          parentDir,
-          lockfilePath: (0, node_path_1.join)(parentDir, "lock.json"),
-          workflowKey,
-          contextKey
-        }
-      };
-    }
-    async function ensureDirectoryWithoutSymlink(path2, targetPath) {
-      try {
-        const stats2 = await (0, promises_1.lstat)(path2);
-        if (stats2.isSymbolicLink())
-          return unsafePath(targetPath, `Path component ${path2} is a symbolic link`);
-        if (!stats2.isDirectory())
-          return unsafePath(targetPath, `Path component ${path2} is not a directory`);
-        return { ok: true, value: void 0 };
-      } catch (error) {
-        if (!isNodeError(error) || error.code !== "ENOENT")
-          throw error;
-      }
-      try {
-        await (0, promises_1.mkdir)(path2);
-      } catch (error) {
-        if (!isNodeError(error) || error.code !== "EEXIST")
-          throw error;
-      }
-      const stats = await (0, promises_1.lstat)(path2);
-      if (stats.isSymbolicLink())
-        return unsafePath(targetPath, `Path component ${path2} is a symbolic link`);
-      if (!stats.isDirectory())
-        return unsafePath(targetPath, `Path component ${path2} is not a directory`);
-      return { ok: true, value: void 0 };
-    }
-    async function verifyRealStateContainment(parts, targetPath) {
-      const stateDir = await (0, promises_1.realpath)(parts.stateDir);
-      const parentDir = await (0, promises_1.realpath)(parts.parentDir);
-      const parentRelativePath = (0, node_path_1.relative)(stateDir, parentDir);
-      if (parentRelativePath === "" || !parentRelativePath.startsWith("..") && !(0, node_path_1.isAbsolute)(parentRelativePath))
-        return { ok: true, value: void 0 };
-      return unsafePath(targetPath, `Resolved parent directory ${parentDir} escapes state directory ${stateDir}`);
-    }
-    async function rejectExistingTargetSymlink(path2, targetPath) {
-      try {
-        const stats = await (0, promises_1.lstat)(path2);
-        if (stats.isSymbolicLink())
-          return unsafePath(targetPath, `Existing lockfile ${path2} is a symbolic link`);
-        return { ok: true, value: void 0 };
-      } catch (error) {
-        if (isNodeError(error) && error.code === "ENOENT")
-          return { ok: true, value: void 0 };
-        throw error;
-      }
-    }
-    function unsafePath(path2, detail) {
-      return {
-        ok: false,
-        diagnostics: [(0, diagnostics_1.diagnostic)("state.write.unsafe_path", "error", `Workflow state lockfile path is unsafe at ${path2}`, `${detail}. Use the derived workflow state path under .tela/workflows. This writer rejects pre-existing symlinked state components for CLI path hygiene, but does not sandbox concurrent local filesystem mutation of parent directories.`)]
-      };
-    }
-    async function acquireWriteLock(lockPath, targetPath) {
-      try {
-        return { ok: true, value: await (0, promises_1.open)(lockPath, "wx") };
-      } catch (error) {
-        if (isNodeError(error) && error.code === "EEXIST") {
-          return {
-            ok: false,
-            diagnostics: [(0, diagnostics_1.diagnostic)("state.write.conflict", "error", `Workflow state lockfile is already being written at ${targetPath}`, `Wait for the in-progress write to finish, then re-read and retry. If the previous process crashed, remove stale lock file ${lockPath} and retry.`)]
-          };
-        }
-        throw error;
-      }
-    }
-    async function readCurrentHash(path2) {
-      try {
-        return hashContent(await (0, promises_1.readFile)(path2));
-      } catch (error) {
-        if (isNodeError(error) && error.code === "ENOENT")
-          return void 0;
-        throw error;
-      }
-    }
-    function hashContent(content) {
-      return (0, node_crypto_1.createHash)("sha256").update(content).digest("hex");
-    }
-    function isNodeError(error) {
-      return error instanceof Error && "code" in error;
-    }
-  }
-});
-
-// ../../packages/workflow-code/dist/cli/state/index.js
-var require_state = __commonJS({
-  "../../packages/workflow-code/dist/cli/state/index.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o2, m3, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m3, k);
-      if (!desc || ("get" in desc ? !m3.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m3[k];
-        } };
-      }
-      Object.defineProperty(o2, k2, desc);
-    }) : (function(o2, m3, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o2[k2] = m3[k];
-    }));
-    var __exportStar = exports2 && exports2.__exportStar || function(m3, exports3) {
-      for (var p3 in m3) if (p3 !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p3)) __createBinding(exports3, m3, p3);
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    __exportStar(require_lockfile(), exports2);
-    __exportStar(require_planning(), exports2);
-    __exportStar(require_types4(), exports2);
-    __exportStar(require_write(), exports2);
-  }
-});
-
 // ../../packages/workflow-code/dist/cli/sync/hash.js
 var require_hash2 = __commonJS({
   "../../packages/workflow-code/dist/cli/sync/hash.js"(exports2) {
@@ -271640,7 +271933,7 @@ var require_engine = __commonJS({
         const lastSynced = existing.lockfile.lastSynced;
         if (lastSynced === void 0)
           return { ok: false, diagnostics: [(0, diagnostics_1.diagnostic)("sync.lockfile.inconsistent", "error", "Workflow lockfile sync predicates passed without lastSynced metadata.")] };
-        if (options.generatedMetadata !== void 0 && JSON.stringify(existing.lockfile.generatedMetadata) !== JSON.stringify(options.generatedMetadata)) {
+        if (options.generatedMetadata !== void 0 && JSON.stringify(existing.lockfile.generatedMetadata) !== JSON.stringify(options.generatedMetadata) || options.vaultAssets !== void 0 && JSON.stringify(existing.lockfile.vaultAssets) !== JSON.stringify(options.vaultAssets)) {
           const noopPlan = (0, state_1.planSyncResultWrite)(lockfilePath.value, options.facts, remoteBefore.value, {
             versionId: remoteBefore.value.version.id,
             versionIndex: remoteBefore.value.version.versionIndex,
@@ -271648,7 +271941,7 @@ var require_engine = __commonJS({
             compiledHash: options.compiled.hashes.compiled,
             syncedAt: lastSynced.syncedAt,
             lifecycle: lastSynced.lifecycle
-          }, existing, options.generatedMetadata);
+          }, existing, options.generatedMetadata, options.vaultAssets);
           if (!noopPlan.ok)
             return { ok: false, diagnostics: noopPlan.diagnostics };
           const noopWrite = await (0, state_1.writePlannedLockfile)(noopPlan.value);
@@ -271698,6 +271991,7 @@ var require_engine = __commonJS({
           },
           remote: remoteBefore.value,
           ...options.generatedMetadata === void 0 ? {} : { generatedMetadata: options.generatedMetadata },
+          ...options.vaultAssets === void 0 ? {} : { vaultAssets: options.vaultAssets },
           pendingSync: pending.value,
           ...existing?.lockfile.lastSynced === void 0 ? {} : { lastSynced: existing.lockfile.lastSynced }
         };
@@ -271745,7 +272039,7 @@ var require_engine = __commonJS({
           idempotencyKey: pending.value.idempotencyKey,
           requestHash: pending.value.requestHash
         }
-      }, currentState, options.generatedMetadata);
+      }, currentState, options.generatedMetadata, options.vaultAssets);
       if (!syncPlan.ok)
         return { ok: false, diagnostics: syncPlan.diagnostics };
       const written = await (0, state_1.writePlannedLockfile)(syncPlan.value);
@@ -271853,9 +272147,10 @@ var require_remote_api2 = __commonJS({
       const credential = await (0, tela_local_config_1.refreshUserSessionCredential)(session.resolved.environment, session.credentialRef, session.credential, credentials);
       const baseUrl = trimTrailingSlash((0, tela_local_config_1.getServiceUrl)(session, "api"));
       const headers = (0, tela_local_config_1.createTelaRequestHeaders)(credential);
-      const request = createJsonRequester(baseUrl, headers, options.fetchImpl ?? fetch);
+      const fetchImpl = options.fetchImpl ?? fetch;
+      const request = createJsonRequester(baseUrl, headers, fetchImpl);
       const vaultServiceUrl = session.resolved.environment.services.vault;
-      const vaultRequest = vaultServiceUrl === void 0 ? void 0 : createJsonRequester(trimTrailingSlash(vaultServiceUrl), headers, options.fetchImpl ?? fetch);
+      const vaultRequest = vaultServiceUrl === void 0 ? void 0 : createJsonRequester(trimTrailingSlash(vaultServiceUrl), headers, fetchImpl);
       const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
       return {
         async validateVaultRef(input) {
@@ -271875,6 +272170,39 @@ var require_remote_api2 = __commonJS({
             throw workflowApiError("vault.ref.inaccessible", `Vault reference ${input.reference} could not be validated in the active Tela context.`, "Check the selected workspace, context credentials, Vault service URL, and network access.");
           }
         },
+        async uploadVaultAsset(input) {
+          if (!vaultRequest) {
+            throw workflowApiError("vault.asset.upload_failed", "The active Tela environment does not configure a Vault service URL.", "Add services.vault to the active Tela environment and retry.");
+          }
+          const created = await vaultRequest("/files", {
+            method: "POST",
+            body: {
+              fileName: input.name,
+              size: input.content.byteLength,
+              ...input.mimeType === void 0 ? {} : { mimeType: input.mimeType }
+            },
+            failureCode: "vault.asset.upload_failed",
+            invalidResponseCode: "vault.asset.upload_failed",
+            failureMessage: (status) => `Vault could not register local asset ${input.name} (HTTP ${status}).`
+          });
+          const id = requireString(created, "id");
+          const uploadUrl = requireString(created, "uploadUrl");
+          const reference = `vault://${id}`;
+          if (!(0, reference_1.isWorkflowCodeVaultReference)(reference)) {
+            throw workflowApiError("vault.asset.upload_failed", "Vault returned an invalid file reference while registering a local asset.", "Retry sync after checking that the active Vault service is compatible with Workflow Code.");
+          }
+          const uploadBuffer = new ArrayBuffer(input.content.byteLength);
+          new Uint8Array(uploadBuffer).set(input.content);
+          const upload = await fetchImpl(uploadUrl, {
+            method: "PUT",
+            headers: input.mimeType === void 0 ? void 0 : { "Content-Type": input.mimeType },
+            body: new Blob([uploadBuffer], input.mimeType === void 0 ? void 0 : { type: input.mimeType })
+          });
+          if (!upload.ok) {
+            throw workflowApiError("vault.asset.upload_failed", `Vault upload for local asset ${input.name} failed with HTTP ${upload.status}.`, "Retry sync after checking Vault availability and file permissions.");
+          }
+          return reference;
+        },
         async fetchPromptSnapshot(input) {
           const prompt = await request(`/prompt/${encodeURIComponent(input.promptId)}`);
           validatePromptMatchesBinding(prompt, input);
@@ -272198,6 +272526,100 @@ var require_types5 = __commonJS({
   }
 });
 
+// ../../packages/workflow-code/dist/cli/sync/vault-assets.js
+var require_vault_assets = __commonJS({
+  "../../packages/workflow-code/dist/cli/sync/vault-assets.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.prepareWorkflowVaultAssets = prepareWorkflowVaultAssets;
+    var node_crypto_1 = require("node:crypto");
+    var node_fs_1 = require("node:fs");
+    var promises_1 = require("node:fs/promises");
+    var node_path_1 = require("node:path");
+    var diagnostics_1 = require_diagnostics();
+    async function prepareWorkflowVaultAssets(input) {
+      if (input.assets.length === 0)
+        return { ok: true, value: [] };
+      if (!input.vaultApi) {
+        return { ok: false, diagnostics: [(0, diagnostics_1.diagnostic)("vault.asset.upload_failed", "error", "Vault assets cannot be uploaded because the active remote client has no Vault service.", "Configure services.vault for the active Tela environment and retry before syncing.")] };
+      }
+      const existingByKey = new Map((input.existing ?? []).map((asset) => [asset.key, asset]));
+      const prepared = [];
+      let projectRoot;
+      try {
+        projectRoot = await (0, promises_1.realpath)(input.rootDir);
+      } catch {
+        return { ok: false, diagnostics: [(0, diagnostics_1.diagnostic)("vault.asset.file_missing", "error", "The Workflow Code project directory is unavailable.", "Run sync from a project containing workflow-code.config.ts.")] };
+      }
+      for (const asset of input.assets) {
+        const declaredPath = (0, node_path_1.resolve)(projectRoot, asset.path);
+        if (!isWithinRoot(declaredPath, projectRoot)) {
+          return { ok: false, diagnostics: [(0, diagnostics_1.diagnostic)("vault.asset.file_missing", "error", `Vault asset path ${asset.path} resolves outside the Workflow Code project.`, "Use a relative path inside the project containing workflow-code.config.ts.")] };
+        }
+        let resolvedPath;
+        let content;
+        try {
+          resolvedPath = await (0, promises_1.realpath)(declaredPath);
+          if (!isWithinRoot(resolvedPath, projectRoot)) {
+            return { ok: false, diagnostics: [(0, diagnostics_1.diagnostic)("vault.asset.file_missing", "error", `Vault asset path ${asset.path} resolves outside the Workflow Code project.`, "Use a regular file inside the project containing workflow-code.config.ts.")] };
+          }
+          const file = await (0, promises_1.open)(resolvedPath, node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_NOFOLLOW);
+          try {
+            const metadata = await file.stat();
+            if (!metadata.isFile())
+              throw new Error("path is not a regular file");
+            const openedPath = await (0, promises_1.realpath)(resolvedPath);
+            const pathMetadata = await (0, promises_1.lstat)(resolvedPath);
+            if (!isWithinRoot(openedPath, projectRoot) || !pathMetadata.isFile() || pathMetadata.dev !== metadata.dev || pathMetadata.ino !== metadata.ino) {
+              throw new Error("path changed while opening");
+            }
+            content = await file.readFile();
+          } finally {
+            await file.close();
+          }
+        } catch {
+          return { ok: false, diagnostics: [(0, diagnostics_1.diagnostic)("vault.asset.file_missing", "error", `Vault asset ${asset.path} is unavailable.`, "Add a regular file at the declared path or update vault.asset().")] };
+        }
+        const contentHash = (0, node_crypto_1.createHash)("sha256").update(content).digest("hex");
+        const previous = existingByKey.get(asset.key);
+        if (previous?.contentHash === contentHash) {
+          prepared.push(previous);
+          continue;
+        }
+        const name = asset.name ?? (0, node_path_1.basename)(resolvedPath);
+        try {
+          const ref = await input.vaultApi.uploadVaultAsset({
+            name,
+            ...asset.mimeType === void 0 ? {} : { mimeType: asset.mimeType },
+            content
+          });
+          prepared.push(Object.freeze({
+            ...asset,
+            name,
+            resolvedPath,
+            contentHash,
+            size: content.byteLength,
+            ref,
+            uploadedAt: input.now?.() ?? (/* @__PURE__ */ new Date()).toISOString()
+          }));
+        } catch (error) {
+          if (hasDiagnostics(error))
+            return { ok: false, diagnostics: error.diagnostics };
+          return { ok: false, diagnostics: [(0, diagnostics_1.diagnostic)("vault.asset.upload_failed", "error", `Vault asset ${asset.path} could not be uploaded.`, "Check the active Vault service and retry sync.")] };
+        }
+      }
+      return { ok: true, value: prepared };
+    }
+    function isWithinRoot(path2, rootDir) {
+      const relativePath = (0, node_path_1.relative)((0, node_path_1.resolve)(rootDir), path2);
+      return relativePath === "" || !relativePath.startsWith("..") && !(0, node_path_1.isAbsolute)(relativePath);
+    }
+    function hasDiagnostics(error) {
+      return error !== null && typeof error === "object" && "diagnostics" in error && Array.isArray(error.diagnostics);
+    }
+  }
+});
+
 // ../../packages/workflow-code/dist/cli/sync/index.js
 var require_sync2 = __commonJS({
   "../../packages/workflow-code/dist/cli/sync/index.js"(exports2) {
@@ -272223,6 +272645,7 @@ var require_sync2 = __commonJS({
     __exportStar(require_hash2(), exports2);
     __exportStar(require_remote_api2(), exports2);
     __exportStar(require_types5(), exports2);
+    __exportStar(require_vault_assets(), exports2);
     __exportStar(require_vault_preflight(), exports2);
   }
 });
@@ -272295,6 +272718,7 @@ var require_engine2 = __commonJS({
           cwd: options.cwd,
           facts: options.facts,
           compiled: options.compiled,
+          vaultAssets: options.vaultAssets,
           remoteApi: options.remoteApi,
           vaultApi: options.vaultApi,
           vaultValidation: vaultValidation.value,
@@ -272609,6 +273033,7 @@ var require_publish2 = __commonJS({
     var publish_1 = require_publish();
     var load_source_1 = require_load_source();
     var sync_1 = require_sync2();
+    var state_1 = require_state();
     var ui_1 = require_ui2();
     var select_target_1 = require_select_target();
     var ALLOWED_FLAGS = /* @__PURE__ */ new Set(["config", "env", "environment", "yes", "create-environment-if-missing"]);
@@ -272634,30 +273059,19 @@ var require_publish2 = __commonJS({
       const selected = selectPublishTargets(configResult.value.config.workflows, context.passthrough);
       if (!selected.ok)
         return { exitCode: 1, diagnostics: selected.diagnostics };
-      const prepared = await preparePublishTargets({
-        configPath: configResult.value.path,
-        configEnv: configResult.value.env,
-        tsconfig: configResult.value.config.tsconfig,
-        targets: selected.targets
-      });
-      if (!prepared.ok)
-        return { exitCode: 1, diagnostics: prepared.diagnostics, compiled: prepared.compiled };
+      const resolved = await resolvePublishTargets(selected.targets);
+      if (!resolved.ok)
+        return { exitCode: 1, diagnostics: resolved.diagnostics };
       let remoteApi;
       try {
         remoteApi = context.remoteApi ?? await (0, sync_1.createWorkflowRemoteApi)({
-          contextId: prepared.targets[0]?.identity.contextId
+          contextId: resolved.targets[0]?.identity.contextId
         });
       } catch (error) {
         return { exitCode: 1, diagnostics: diagnosticsFromError(error) };
       }
-      const vaultValidation = await (0, sync_1.preflightCompiledVaultRefs)({
-        compiled: prepared.targets.map((item) => item.compiled),
-        vaultApi: remoteApi
-      });
-      if (!vaultValidation.ok)
-        return { exitCode: 1, diagnostics: vaultValidation.diagnostics };
       const preparedEnvironments = await (0, publish_1.preparePublishEnvironments)({
-        targets: prepared.targets.map((item) => ({ targetName: item.name, promptId: item.identity.promptId })),
+        targets: resolved.targets.map((item) => ({ targetName: item.name, promptId: item.identity.promptId })),
         environmentName: environment.value,
         remoteApi,
         createIfMissing: context.flags["create-environment-if-missing"] === true,
@@ -272667,6 +273081,22 @@ var require_publish2 = __commonJS({
         return { exitCode: 1, diagnostics: preparedEnvironments.diagnostics };
       const environmentsByTarget = new Map(preparedEnvironments.value.map((item) => [item.targetName, item.environment]));
       const environmentCreationDiagnostics = preparedEnvironments.value.filter((item) => item.environment.created).map((item) => (0, diagnostics_1.diagnostic)("publish.environment.created", "info", `Environment "${item.environment.name}" was created for workflow "${item.targetName}".`));
+      const prepared = await preparePublishTargets({
+        configPath: configResult.value.path,
+        configEnv: configResult.value.env,
+        tsconfig: configResult.value.config.tsconfig,
+        targets: resolved.targets,
+        rootDir: context.cwd,
+        vaultApi: remoteApi
+      });
+      if (!prepared.ok)
+        return { exitCode: 1, diagnostics: [...environmentCreationDiagnostics, ...prepared.diagnostics], compiled: prepared.compiled };
+      const vaultValidation = await (0, sync_1.preflightCompiledVaultRefs)({
+        compiled: prepared.targets.map((item) => item.compiled),
+        vaultApi: remoteApi
+      });
+      if (!vaultValidation.ok)
+        return { exitCode: 1, diagnostics: [...environmentCreationDiagnostics, ...vaultValidation.diagnostics] };
       const completed = [];
       for (const item of prepared.targets) {
         const preparedEnvironment = environmentsByTarget.get(item.name);
@@ -272686,6 +273116,7 @@ var require_publish2 = __commonJS({
             }
           },
           compiled: item.compiled,
+          vaultAssets: item.vaultAssets,
           remoteApi,
           vaultApi: remoteApi,
           vaultValidation: vaultValidation.value,
@@ -272751,27 +273182,85 @@ var require_publish2 = __commonJS({
     async function preparePublishTargets(options) {
       const prepared = [];
       for (const selected of options.targets) {
-        const identity = await (0, resolve_target_identity_1.resolveWorkflowTargetIdentity)(selected.name, selected.target);
-        if (!identity.ok)
-          return { ok: false, diagnostics: identity.diagnostics };
-        if (!identity.value.promptId) {
-          return { ok: false, diagnostics: [(0, diagnostics_1.diagnostic)("publish.prompt_id.missing", "error", `Workflow target ${selected.name} has no promptId for the active context`, "Add promptId to the active workflow context binding before publishing.")] };
-        }
         const source = await (0, load_source_1.loadWorkflowSource)((0, node_path_1.dirname)(options.configPath), selected.target, options.configEnv, options.tsconfig);
         if (!source.ok)
           return { ok: false, diagnostics: source.diagnostics };
-        const compiled = (0, compiler_1.transpileWorkflow)({
+        const initial = (0, compiler_1.transpileWorkflow)({
           targetName: selected.name,
           workflowKey: selected.target.workflowKey,
           title: selected.target.title,
           declaration: source.value.declaration,
           source: source.value.source
         });
+        const blockingDiagnostics = initial.diagnostics.filter((item) => item.severity === "error" && item.code !== "vault.asset.missing_lock");
+        if (blockingDiagnostics.length > 0)
+          return { ok: false, diagnostics: [...initial.diagnostics], compiled: initial };
+        const lockPath = (0, state_1.deriveLockfilePath)(options.rootDir, {
+          targetName: selected.name,
+          workflowKey: initial.workflowKey,
+          context: {
+            key: selected.identity.contextKey ?? "default",
+            ...selected.identity.contextId === void 0 ? {} : { id: selected.identity.contextId },
+            projectId: selected.identity.projectId,
+            promptId: selected.identity.promptId
+          }
+        });
+        if (!lockPath.ok)
+          return { ok: false, diagnostics: lockPath.diagnostics, compiled: initial };
+        const existing = await (0, state_1.readLockfile)(lockPath.value);
+        if (!existing.ok && existing.diagnostics[0]?.code !== "state.lockfile.missing")
+          return { ok: false, diagnostics: existing.diagnostics, compiled: initial };
+        if (existing.ok) {
+          const lockfileIdentity = (0, state_1.validateLockfileIdentity)(existing.value.lockfile, {
+            targetName: selected.name,
+            workflowKey: initial.workflowKey,
+            context: {
+              key: selected.identity.contextKey ?? "default",
+              ...selected.identity.contextId === void 0 ? {} : { id: selected.identity.contextId },
+              projectId: selected.identity.projectId,
+              promptId: selected.identity.promptId
+            }
+          }, lockPath.value);
+          if (!lockfileIdentity.ok)
+            return { ok: false, diagnostics: lockfileIdentity.diagnostics, compiled: initial };
+        }
+        const vaultAssets = await (0, sync_1.prepareWorkflowVaultAssets)({
+          rootDir: (0, node_path_1.dirname)(options.configPath),
+          assets: initial.resources.vaultAssets ?? [],
+          existing: existing.ok ? existing.value.lockfile.vaultAssets : void 0,
+          vaultApi: options.vaultApi
+        });
+        if (!vaultAssets.ok)
+          return { ok: false, diagnostics: vaultAssets.diagnostics, compiled: initial };
+        const compiled = (0, compiler_1.transpileWorkflow)({
+          targetName: selected.name,
+          workflowKey: selected.target.workflowKey,
+          title: selected.target.title,
+          declaration: source.value.declaration,
+          source: source.value.source,
+          vaultAssets: vaultAssets.value
+        });
         if (compiled.diagnostics.some((item) => item.severity === "error"))
           return { ok: false, diagnostics: [...compiled.diagnostics], compiled };
         prepared.push({
           ...selected,
           compiled,
+          vaultAssets: vaultAssets.value
+        });
+      }
+      return { ok: true, targets: prepared };
+    }
+    async function resolvePublishTargets(targets) {
+      const resolved = [];
+      for (const target of targets) {
+        const identity = await (0, resolve_target_identity_1.resolveWorkflowTargetIdentity)(target.name, target.target);
+        if (!identity.ok)
+          return { ok: false, diagnostics: identity.diagnostics };
+        if (!identity.value.promptId) {
+          return { ok: false, diagnostics: [(0, diagnostics_1.diagnostic)("publish.prompt_id.missing", "error", `Workflow target ${target.name} has no promptId for the active context`, "Add promptId to the active workflow context binding before publishing.")] };
+        }
+        resolved.push({
+          ...target,
           identity: {
             contextKey: identity.value.contextKey,
             contextId: identity.value.contextId,
@@ -272780,7 +273269,7 @@ var require_publish2 = __commonJS({
           }
         });
       }
-      return { ok: true, targets: prepared };
+      return { ok: true, targets: resolved };
     }
     function publishSummary(item) {
       return (0, ui_1.kvList)([
@@ -272844,22 +273333,24 @@ var require_sync3 = __commonJS({
       const selectedResult = selectSyncWorkflowTargets(configResult.value.config.workflows, context.passthrough);
       if (!selectedResult.ok)
         return { exitCode: 1, diagnostics: selectedResult.diagnostics };
+      let remoteApi;
+      try {
+        remoteApi = context.remoteApi ?? await (0, sync_1.createWorkflowRemoteApi)();
+      } catch (error) {
+        return { exitCode: 1, diagnostics: diagnosticsFromError(error, "sync.remote.configure_failed") };
+      }
       const preparedResult = await prepareSyncTargets({
         configPath: configResult.value.path,
         configEnv: configResult.value.env,
         tsconfig: configResult.value.config.tsconfig,
         targets: selectedResult.targets,
         rootDir: context.cwd,
-        catalogApi: context.catalogApi
+        projectDir: (0, node_path_1.dirname)(configResult.value.path),
+        catalogApi: context.catalogApi,
+        vaultApi: remoteApi
       });
       if (!preparedResult.ok)
         return { exitCode: 1, diagnostics: preparedResult.diagnostics, compiled: preparedResult.compiled };
-      let remoteApi;
-      try {
-        remoteApi = context.remoteApi ?? await (0, sync_1.createWorkflowRemoteApi)({ env: configResult.value.env });
-      } catch (error) {
-        return { exitCode: 1, diagnostics: diagnosticsFromError(error, "sync.remote.configure_failed") };
-      }
       const vaultValidation = await (0, sync_1.preflightCompiledVaultRefs)({
         compiled: preparedResult.targets.map((item) => item.compiled),
         vaultApi: remoteApi
@@ -272882,6 +273373,7 @@ var require_sync3 = __commonJS({
           },
           compiled: prepared.compiled,
           generatedMetadata: prepared.generatedMetadata,
+          vaultAssets: prepared.vaultAssets,
           remoteApi,
           vaultApi: remoteApi,
           vaultValidation: vaultValidation.value,
@@ -272928,7 +273420,7 @@ var require_sync3 = __commonJS({
     async function prepareSyncTargets(options) {
       const symbolicPrepared = [];
       for (const selected of options.targets) {
-        const identity = await (0, resolve_target_identity_1.resolveWorkflowTargetIdentity)(selected.name, selected.target, { env: options.configEnv });
+        const identity = await (0, resolve_target_identity_1.resolveWorkflowTargetIdentity)(selected.name, selected.target);
         if (!identity.ok)
           return { ok: false, diagnostics: identity.diagnostics };
         if (!identity.value.promptId) {
@@ -272937,13 +273429,48 @@ var require_sync3 = __commonJS({
         const sourceResult = await (0, load_source_1.loadWorkflowSource)((0, node_path_1.dirname)(options.configPath), selected.target, options.configEnv, options.tsconfig);
         if (!sourceResult.ok)
           return { ok: false, diagnostics: sourceResult.diagnostics };
-        const symbolic = (0, compiler_1.transpileWorkflow)({
+        const initialSymbolic = (0, compiler_1.transpileWorkflow)({
           targetName: selected.name,
           workflowKey: selected.target.workflowKey,
           title: selected.target.title,
           declaration: sourceResult.value.declaration,
           source: sourceResult.value.source
         });
+        const blockingDiagnostics = initialSymbolic.diagnostics.filter((item) => item.severity === "error" && item.code !== "vault.asset.missing_lock");
+        if (blockingDiagnostics.length > 0)
+          return { ok: false, diagnostics: [...initialSymbolic.diagnostics], compiled: initialSymbolic };
+        const facts = {
+          targetName: selected.name,
+          workflowKey: initialSymbolic.workflowKey,
+          context: {
+            key: identity.value.contextKey ?? "default",
+            ...identity.value.contextId === void 0 ? {} : { id: identity.value.contextId },
+            projectId: identity.value.projectId,
+            promptId: identity.value.promptId
+          }
+        };
+        const lockPath = (0, state_1.deriveLockfilePath)(options.rootDir, facts);
+        if (!lockPath.ok)
+          return { ok: false, diagnostics: lockPath.diagnostics, compiled: initialSymbolic };
+        const existing = await (0, state_1.readLockfile)(lockPath.value);
+        if (!existing.ok && existing.diagnostics[0]?.code !== "state.lockfile.missing")
+          return { ok: false, diagnostics: existing.diagnostics, compiled: initialSymbolic };
+        const vaultAssets = await (0, sync_1.prepareWorkflowVaultAssets)({
+          rootDir: options.projectDir,
+          assets: initialSymbolic.resources.vaultAssets ?? [],
+          existing: existing.ok ? existing.value.lockfile.vaultAssets : void 0,
+          vaultApi: options.vaultApi
+        });
+        if (!vaultAssets.ok)
+          return { ok: false, diagnostics: vaultAssets.diagnostics, compiled: initialSymbolic };
+        const symbolic = (0, compiler_1.transpileWorkflow)({
+          targetName: selected.name,
+          workflowKey: selected.target.workflowKey,
+          title: selected.target.title,
+          declaration: sourceResult.value.declaration,
+          source: sourceResult.value.source,
+          vaultAssets: vaultAssets.value
+        });
         if (symbolic.diagnostics.some((item) => item.severity === "error"))
           return { ok: false, diagnostics: [...symbolic.diagnostics], compiled: symbolic };
         symbolicPrepared.push({
@@ -272951,6 +273478,7 @@ var require_sync3 = __commonJS({
           source: sourceResult.value,
           symbolic,
           compiled: symbolic,
+          vaultAssets: vaultAssets.value,
           identity: {
             contextKey: identity.value.contextKey,
             contextId: identity.value.contextId,
@@ -272964,7 +273492,7 @@ var require_sync3 = __commonJS({
         return { ok: true, targets: symbolicPrepared };
       let api;
       try {
-        api = options.catalogApi ?? await (0, catalog_1.createWorkflowCatalogApi)({ env: options.configEnv });
+        api = options.catalogApi ?? await (0, catalog_1.createWorkflowCatalogApi)();
       } catch (error) {
         return { ok: false, diagnostics: diagnosticsFromError(error, "metadata.catalog.authentication_failed") };
       }
@@ -273006,7 +273534,8 @@ var require_sync3 = __commonJS({
           title: item.target.title,
           declaration: item.source.declaration,
           source: item.source.source,
-          remote: { kind: "resolved", snapshot, locks: generated.locks.refs }
+          remote: { kind: "resolved", snapshot, locks: generated.locks.refs },
+          vaultAssets: item.vaultAssets
         });
         const diagnostics = [...generated.diagnostics, ...compiled.diagnostics];
         if (diagnostics.some((diagnostic) => diagnostic.severity === "error"))