@mulmoclaude/mulmoscript-plugin 0.2.3 → 1.1.0

package/dist/core/paths.d.ts

@@ -1,8 +1,5 @@
-/** Lowercase-hyphen slug, capped at MAX_SLUG_LEN, with leading/trailing
- *  hyphens stripped. Falls back to `fallback` for empty/undefined/non-ASCII
- *  input. Mirrors html-plugin's in-package slugify — deliberately simpler
- *  than the host's hash-fallback variant; the timestamp suffix appended by
- *  `storyFilePath` keeps these throwaway filenames collision-free. */
+/** Lowercase-hyphen slug, capped, leading/trailing hyphens stripped; falls back
+ *  to `fallback` for empty/undefined/non-ASCII input. */
 export declare function slugify(title: string | undefined, fallback?: string): string;
 /** Build a fresh, collision-safe story path for a new script —
  *  `stories/<slug>-<epoch-ms>.json`, valid as both the FileOps-relative

package/dist/core/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/core/paths.ts"],"names":[],"mappings":"AAcA;;;;sEAIsE;AACtE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,SAAU,GAAG,MAAM,CAW7E;AAED;;0CAE0C;AAC1C,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUlE"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/core/paths.ts"],"names":[],"mappings":"AAgBA;yDACyD;AACzD,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,SAAsB,GAAG,MAAM,CAEzF;AAED;;0CAE0C;AAC1C,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUlE"}

package/dist/core/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/core/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAKpE,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE/F;;mCAEmC;AACnC,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,aAAa,GAAG,WAAW,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAAC,GAAG,kBAAkB,CAAC;AAE5G,MAAM,MAAM,wBAAwB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,kBAAkB,CAAC;AAgEzE;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,yBAAyB,EAClC,IAAI,EAAE,mBAAmB,EACzB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAYjC;AAYD;;kEAEkE;AAClE,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoB5H;AAED;;mDAEmD;AACnD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAU9H;AAED;;;wDAGwD;AACxD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAmB5I;AAED;;0CAE0C;AAC1C,eAAO,MAAM,UAAU,EAAE,cAAc,CAAC,eAAe,EAAE,eAAe,EAAE,mBAAmB,CAK5F,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/core/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAMpE,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE/F;;mCAEmC;AACnC,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,aAAa,GAAG,WAAW,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAAC,GAAG,kBAAkB,CAAC;AAE5G,MAAM,MAAM,wBAAwB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,kBAAkB,CAAC;AA4DzE;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,yBAAyB,EAClC,IAAI,EAAE,mBAAmB,EACzB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAYjC;AAYD;;kEAEkE;AAClE,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoB5H;AAED;;mDAEmD;AACnD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAU9H;AAED;;;wDAGwD;AACxD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAmB5I;AAED;;0CAE0C;AAC1C,eAAO,MAAM,UAAU,EAAE,cAAc,CAAC,eAAe,EAAE,eAAe,EAAE,mBAAmB,CAK5F,CAAC"}

package/dist/core/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/core/validate.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBxF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC,CAqBD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;CACf,CAAC,CA4BD"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/core/validate.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAoCxF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC,CAkBD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;CACf,CAAC,CA0BD"}

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_plugin = require("./plugin-Bi986Wga.cjs");
+const require_plugin = require("./plugin-BLp8tSYt.cjs");
 exports.TOOL_DEFINITION = require_plugin.TOOL_DEFINITION;
 exports.TOOL_NAME = require_plugin.TOOL_NAME;
 exports.executeMulmoScript = require_plugin.executeMulmoScript;

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as pluginCore, c as normalizeStoryPath, d as TOOL_DEFINITION, f as TOOL_NAME, i as executeUpdateScript, l as slugify, n as executeMulmoScriptSave, o as validateUpdateBeatBody, r as executeUpdateBeat, s as validateUpdateScriptBody, t as executeMulmoScript, u as storyFilePath } from "./plugin-BQyzxkui.js";
+import { a as pluginCore, c as normalizeStoryPath, f as TOOL_DEFINITION, i as executeUpdateScript, l as slugify, n as executeMulmoScriptSave, o as validateUpdateBeatBody, p as TOOL_NAME, r as executeUpdateBeat, s as validateUpdateScriptBody, t as executeMulmoScript, u as storyFilePath } from "./plugin-CXhOP_xU.js";
 export { TOOL_DEFINITION, TOOL_NAME, executeMulmoScript, executeMulmoScriptSave, executeUpdateBeat, executeUpdateScript, normalizeStoryPath, pluginCore, slugify, storyFilePath, validateUpdateBeatBody, validateUpdateScriptBody };

package/dist/lang/index.d.ts

@@ -1,9 +1,8 @@
-import { type ComputedRef } from "vue";
 import type { Messages } from "./messages";
 /** Reactive message bundle for the active host locale. The plugin carries its
  *  own translations (no host i18n dependency); it reads the locale off the
  *  injected `BrowserPluginRuntime.locale` ref and falls back to English.
  *  Same pattern as @mulmoclaude/html-plugin. */
-export declare function useT(): ComputedRef<Messages>;
+export declare const useT: () => import("vue").ComputedRef<Messages>;
 export type { Messages };
 //# sourceMappingURL=index.d.ts.map

package/dist/lang/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lang/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,WAAW,EAAY,MAAM,KAAK,CAAC;AAExE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAoB3C;;;gDAGgD;AAChD,wBAAgB,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,CAI5C;AAED,YAAY,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lang/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAY3C;;;gDAGgD;AAChD,eAAO,MAAM,IAAI,2CAAuB,CAAC;AAEzC,YAAY,EAAE,QAAQ,EAAE,CAAC"}

package/dist/{plugin-Bi986Wga.cjs → plugin-BLp8tSYt.cjs}

@@ -1,4 +1,5 @@
 let _mulmocast_types = require("@mulmocast/types");
+let _mulmoclaude_core_artifacts = require("@mulmoclaude/core/artifacts");
 //#region src/core/definition.ts
 var TOOL_NAME = "presentMulmoScript";
 var TOOL_DEFINITION = {
@@ -111,29 +112,54 @@ IMPORTANT: "imagePrompt" and "moviePrompt" are plain string fields on the beat,
 	}
 };
 //#endregion
+//#region ../../common/dist/index.js
+/** Narrow `unknown` to a plain object (not null, not array). */
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Check that a record has a specific key with a string value. */
+function hasStringProp(value, key) {
+	return isRecord$1(value) && typeof value[key] === "string";
+}
+/** Normalise an unknown thrown value into a human-readable string. Isomorphic
+*  (host, bridges, plugins, Vue) — this is the single home for the helper that
+*  #2217 could only consolidate for server code, since `@mulmoclaude/core/utils`
+*  is server-only.
+*
+*  A non-Error object with a non-empty string `details` (gRPC convention) or
+*  `message` field surfaces that field — `details` wins — instead of the
+*  `[object Object]` a bare `String(err)` would print; an empty-string field
+*  falls through. `fallback` covers the error-boundary idiom where a thrown
+*  non-Error should read as a descriptive message rather than `String(err)`
+*  noise; omit it in logging contexts where `String(err)` is fine. */
+function errorMessage(err, fallback) {
+	if (err instanceof Error) return err.message;
+	if (hasStringProp(err, "details") && err.details) return err.details;
+	if (hasStringProp(err, "message") && err.message) return err.message;
+	if (fallback !== void 0) return fallback;
+	return String(err);
+}
+//#endregion
 //#region src/core/paths.ts
 var STORIES_DIR = "stories";
-var ARTIFACTS_DIR = "artifacts";
-var MAX_SLUG_LEN = 120;
-/** Lowercase-hyphen slug, capped at MAX_SLUG_LEN, with leading/trailing
-*  hyphens stripped. Falls back to `fallback` for empty/undefined/non-ASCII
-*  input. Mirrors html-plugin's in-package slugify — deliberately simpler
-*  than the host's hash-fallback variant; the timestamp suffix appended by
-*  `storyFilePath` keeps these throwaway filenames collision-free. */
-function slugify(title, fallback = "story") {
-	if (!title) return fallback;
-	const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, MAX_SLUG_LEN);
-	let start = 0;
-	let end = collapsed.length;
-	while (start < end && collapsed[start] === "-") start += 1;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	return collapsed.slice(start, end) || fallback;
+var STORY_FALLBACK_SLUG = "story";
+/** Lowercase-hyphen slug, capped, leading/trailing hyphens stripped; falls back
+*  to `fallback` for empty/undefined/non-ASCII input. */
+function slugify(title, fallback = STORY_FALLBACK_SLUG) {
+	return (0, _mulmoclaude_core_artifacts.slugifyArtifact)(title, fallback);
 }
 /** Build a fresh, collision-safe story path for a new script —
 *  `stories/<slug>-<epoch-ms>.json`, valid as both the FileOps-relative
 *  write path and the wire `filePath`. */
 function storyFilePath(slugSource, now = /* @__PURE__ */ new Date()) {
-	return `${STORIES_DIR}/${slugify(slugSource)}-${now.getTime()}.json`;
+	return (0, _mulmoclaude_core_artifacts.buildArtifactRelPath)({
+		dir: STORIES_DIR,
+		title: slugSource,
+		ext: ".json",
+		fallback: STORY_FALLBACK_SLUG,
+		now,
+		partitioned: false
+	});
 }
 /**
 * Normalize a caller-supplied wire path to the canonical
@@ -152,9 +178,9 @@ function storyFilePath(slugSource, now = /* @__PURE__ */ new Date()) {
 function normalizeStoryPath(filePath) {
 	if (filePath.length === 0 || filePath.includes("\\")) return null;
 	if (filePath.startsWith("/") || /^[A-Za-z]:/.test(filePath)) return null;
+	if ((0, _mulmoclaude_core_artifacts.hasUnsafePathSegment)(filePath)) return null;
 	const segments = filePath.split("/");
-	if (segments.some((seg) => seg === "" || seg === "." || seg === "..")) return null;
-	const trimmed = segments[0] === ARTIFACTS_DIR && segments[1] === STORIES_DIR ? segments.slice(1) : segments;
+	const trimmed = segments[0] === _mulmoclaude_core_artifacts.ARTIFACTS_ROOT && segments[1] === STORIES_DIR ? segments.slice(1) : segments;
 	const rest = trimmed[0] === STORIES_DIR ? trimmed.slice(1) : trimmed;
 	if (rest.length === 0) return null;
 	return [STORIES_DIR, ...rest].join("/");
@@ -171,12 +197,10 @@ function formatZodIssues(issues) {
 	}).join("; ");
 	return issues.length > 3 ? `${head} (+${issues.length - 3} more)` : head;
 }
-/**
-* Validate the `update-script` request body. Returns the parsed,
-* schema-conformant script on success, or a human-readable error
-* suitable for sending back as a 400 response.
-*/
-function validateUpdateScriptBody(body) {
+/** Shared prelude: require an object body carrying a non-empty
+*  `filePath`. On success returns the narrowed record + filePath so the
+*  caller reads the remaining fields without re-narrowing. */
+function validateFilePathBody(body) {
 	if (!isRecord(body)) return {
 		ok: false,
 		error: "body must be an object"
@@ -185,11 +209,28 @@ function validateUpdateScriptBody(body) {
 		ok: false,
 		error: "filePath must be a non-empty string"
 	};
-	if (body.script === void 0) return {
+	return {
+		ok: true,
+		value: {
+			record: body,
+			filePath: body.filePath
+		}
+	};
+}
+/**
+* Validate the `update-script` request body. Returns the parsed,
+* schema-conformant script on success, or a human-readable error
+* suitable for sending back as a 400 response.
+*/
+function validateUpdateScriptBody(body) {
+	const base = validateFilePathBody(body);
+	if (!base.ok) return base;
+	const { record, filePath } = base.value;
+	if (record.script === void 0) return {
 		ok: false,
 		error: "script is required"
 	};
-	const parsed = _mulmocast_types.mulmoScriptSchema.safeParse(body.script);
+	const parsed = _mulmocast_types.mulmoScriptSchema.safeParse(record.script);
 	if (!parsed.success) return {
 		ok: false,
 		error: `invalid script: ${formatZodIssues(parsed.error.issues)}`
@@ -197,7 +238,7 @@ function validateUpdateScriptBody(body) {
 	return {
 		ok: true,
 		value: {
-			filePath: body.filePath,
+			filePath,
 			script: parsed.data
 		}
 	};
@@ -208,23 +249,19 @@ function validateUpdateScriptBody(body) {
 * against the actual script length after reading the file.
 */
 function validateUpdateBeatBody(body) {
-	if (!isRecord(body)) return {
-		ok: false,
-		error: "body must be an object"
-	};
-	if (typeof body.filePath !== "string" || body.filePath === "") return {
-		ok: false,
-		error: "filePath must be a non-empty string"
-	};
-	if (typeof body.beatIndex !== "number" || !Number.isInteger(body.beatIndex) || body.beatIndex < 0) return {
+	const base = validateFilePathBody(body);
+	if (!base.ok) return base;
+	const { record, filePath } = base.value;
+	const beatIndex = record.beatIndex;
+	if (typeof beatIndex !== "number" || !Number.isInteger(beatIndex) || beatIndex < 0) return {
 		ok: false,
 		error: "beatIndex must be a non-negative integer"
 	};
-	if (body.beat === void 0) return {
+	if (record.beat === void 0) return {
 		ok: false,
 		error: "beat is required"
 	};
-	const parsed = _mulmocast_types.mulmoBeatSchema.safeParse(body.beat);
+	const parsed = _mulmocast_types.mulmoBeatSchema.safeParse(record.beat);
 	if (!parsed.success) return {
 		ok: false,
 		error: `invalid beat: ${formatZodIssues(parsed.error.issues)}`
@@ -232,8 +269,8 @@ function validateUpdateBeatBody(body) {
 	return {
 		ok: true,
 		value: {
-			filePath: body.filePath,
-			beatIndex: body.beatIndex,
+			filePath,
+			beatIndex,
 			beat: parsed.data
 		}
 	};
@@ -254,9 +291,6 @@ function notFound(error) {
 		error
 	};
 }
-function errorText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
 function stringifyScript(script) {
 	return JSON.stringify(script, null, 2);
 }
@@ -287,7 +321,7 @@ async function loadExistingScript(context, filePath) {
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		return badRequest(`Invalid JSON: ${errorText(err)}`);
+		return badRequest(`Invalid JSON: ${errorMessage(err)}`);
 	}
 	const validation = _mulmocast_types.mulmoScriptSchema.safeParse(parsed);
 	if (!validation.success) return badRequest("File is not a valid MulmoScript");
@@ -333,7 +367,7 @@ async function executeUpdateBeat(context, body) {
 	try {
 		script = JSON.parse(await context.files.artifacts.read(resolved.storyPath));
 	} catch (err) {
-		return badRequest(`Invalid JSON: ${errorText(err)}`);
+		return badRequest(`Invalid JSON: ${errorMessage(err)}`);
 	}
 	if (!Array.isArray(script.beats) || beatIndex >= script.beats.length) return badRequest("Invalid beatIndex");
 	script.beats[beatIndex] = beat;
@@ -394,6 +428,12 @@ Object.defineProperty(exports, "TOOL_NAME", {
 		return TOOL_NAME;
 	}
 });
+Object.defineProperty(exports, "errorMessage", {
+	enumerable: true,
+	get: function() {
+		return errorMessage;
+	}
+});
 Object.defineProperty(exports, "executeMulmoScript", {
 	enumerable: true,
 	get: function() {
@@ -455,4 +495,4 @@ Object.defineProperty(exports, "validateUpdateScriptBody", {
 	}
 });
 
-//# sourceMappingURL=plugin-Bi986Wga.cjs.map
+//# sourceMappingURL=plugin-BLp8tSYt.cjs.map

package/dist/plugin-BLp8tSYt.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-BLp8tSYt.cjs","names":["isRecord"],"sources":["../src/core/definition.ts","../../../common/dist/index.js","../src/core/paths.ts","../src/core/validate.ts","../src/core/plugin.ts"],"sourcesContent":["import type { ToolDefinition } from \"gui-chat-protocol\";\n\nexport const TOOL_NAME = \"presentMulmoScript\";\n\n// Single source of truth for the presentMulmoScript tool schema, shared by\n// MulmoClaude (host built-in shim re-exports this) and MulmoTerminal.\n// (Extracted byte-identical from the host definition; evolves here with the\n// package version.)\nexport const TOOL_DEFINITION: ToolDefinition = {\n  type: \"function\",\n  name: TOOL_NAME,\n  description: `Save and present a MulmoScript story or presentation as a visual storyboard in the canvas.\n\nTwo modes — provide EXACTLY ONE of \\`script\\` or \\`filePath\\`:\n\n1. **Create new** — pass \\`script\\` (full MulmoScript JSON). Server saves it to disk and presents it.\n2. **Re-display existing** — pass \\`filePath\\` (the \\`filePath\\` returned by a previous call, e.g. \"stories/my-story-1700000000000.json\"; it is resolved against the workspace's \\`artifacts/\\` directory, NOT the workspace root). Much cheaper than re-sending the full script. Use whenever the user wants to revisit a presentation that was already created in this workspace.\n\nOptional \\`autoGenerateMovie: true\\` kicks off movie generation in the background, so the final video is ready by the time the user opens the canvas. Movie generation is expensive (multiple image + audio API calls + video encoding) — only set this when the user has explicitly asked for the movie. Default \\`false\\`.\n\nProvider rules for new scripts:\n- \\`speechParams.speakers.<name>.provider\\`: \\`\"gemini\"\\` — pairs with Gemini voices like \\`\"Kore\"\\`, \\`\"Aoede\"\\`, \\`\"Puck\"\\`. Do NOT use \\`\"google\"\\` here — that routes to Google Cloud TTS, where Gemini-class voices fail with \"This voice requires a model name to be specified.\" unless an explicit \\`model\\` is set.\n- \\`imageParams.provider\\`: \\`\"google\"\\`\n- \\`movieParams.provider\\`: \\`\"google\"\\`\n- Do NOT add a top-level \\`provider\\` field to \\`speechParams\\` — provider belongs per-speaker only.\n\nRequired structure:\n\n{\n  \"$mulmocast\": { \"version\": \"1.1\" },\n  \"title\": \"The Life of a Star\",\n  \"description\": \"A short educational explainer about stellar evolution\",\n  \"lang\": \"en\",\n  \"speechParams\": {\n    \"speakers\": {\n      \"Presenter\": {\n        \"provider\": \"gemini\",\n        \"voiceId\": \"Kore\",\n        \"displayName\": { \"en\": \"Presenter\" }\n      }\n    }\n  },\n  \"imageParams\": { \"provider\": \"google\", \"model\": \"gemini-3.1-flash-image-preview\" },\n  \"movieParams\": { \"provider\": \"google\", \"model\": \"veo-3.1-generate\" },\n  \"beats\": [\n    {\n      \"speaker\": \"Presenter\",\n      \"text\": \"Narration spoken aloud for this beat.\",\n      \"imagePrompt\": \"Detailed description — AI generates the image\"\n    },\n    {\n      \"speaker\": \"Presenter\",\n      \"text\": \"Bullet point beat.\",\n      \"image\": { \"type\": \"textSlide\", \"slide\": { \"title\": \"Slide Title\", \"bullets\": [\"Point one\", \"Point two\"] } }\n    },\n    {\n      \"speaker\": \"Presenter\",\n      \"text\": \"Markdown beat.\",\n      \"image\": { \"type\": \"markdown\", \"markdown\": \"## Heading\\\\n\\\\nBody text here.\" }\n    },\n    {\n      \"speaker\": \"Presenter\",\n      \"text\": \"Chart beat — use for data, comparisons, trends.\",\n      \"image\": { \"type\": \"chart\", \"title\": \"Chart Title\", \"chartData\": { \"type\": \"bar\", \"data\": { \"labels\": [\"A\", \"B\", \"C\"], \"datasets\": [{ \"label\": \"Series\", \"data\": [10, 20, 30] }] } } }\n    },\n    {\n      \"speaker\": \"Presenter\",\n      \"text\": \"Diagram beat — use for flows, architectures, relationships.\",\n      \"image\": { \"type\": \"mermaid\", \"title\": \"Diagram Title\", \"code\": { \"kind\": \"text\", \"text\": \"graph TD\\\\n  A[Start] --> B[Process] --> C[End]\" } }\n    },\n    {\n      \"speaker\": \"Presenter\",\n      \"text\": \"Rich interactive beat — use for custom layouts, animations, or anything that benefits from HTML/CSS.\",\n      \"image\": { \"type\": \"html_tailwind\", \"html\": \"<div class=\\\\\"flex items-center justify-center h-full text-4xl font-bold text-blue-600\\\\\">Hello World</div>\" }\n    },\n    {\n      \"speaker\": \"Presenter\",\n      \"text\": \"AI video beat.\",\n      \"moviePrompt\": \"Detailed description — AI generates the video clip\"\n    }\n  ]\n}\n\nBeat visual options (choose one per beat):\n- \"imagePrompt\": \"...\"  → top-level string field — AI generates an image from the prompt\n- \"moviePrompt\": \"...\"  → top-level string field — AI generates a video clip from the prompt\n- \"image\": { \"type\": \"textSlide\", \"slide\": { \"title\", \"subtitle\"?, \"bullets\"? } }\n- \"image\": { \"type\": \"markdown\", \"markdown\": \"...\" }\n- \"image\": { \"type\": \"chart\", \"title\": \"...\", \"chartData\": { \"type\": \"bar\"|\"line\"|\"pie\"|..., \"data\": { \"labels\": [...], \"datasets\": [...] } } }  ← PREFER for data/numbers/comparisons. chartData is a full Chart.js config: labels/datasets go under \"data\", not at the top level.\n- \"image\": { \"type\": \"mermaid\", \"title\": \"...\", \"code\": { \"kind\": \"text\", \"text\": \"...\" } }  ← PREFER for flows/diagrams/relationships\n- \"image\": { \"type\": \"html_tailwind\", \"html\": \"...\", \"script\"?: \"...\" }  ← PREFER for rich layouts, animations, custom visuals\n\nIMPORTANT: \"imagePrompt\" and \"moviePrompt\" are plain string fields on the beat, NOT nested under \"image\".`,\n  parameters: {\n    type: \"object\",\n    properties: {\n      script: {\n        type: \"object\",\n        description:\n          \"Complete MulmoScript JSON for a NEW presentation. Must include $mulmocast, speechParams, imageParams, movieParams, and beats array. Always populate the top-level 'description' field with a concise 1–2 sentence summary of the presentation. Do NOT pass alongside `filePath`.\",\n        additionalProperties: true,\n      },\n      filename: {\n        type: \"string\",\n        description:\n          \"Optional filename without extension. Defaults to a slug of the script title. Only meaningful with `script`; ignored when `filePath` is given.\",\n      },\n      filePath: {\n        type: \"string\",\n        description:\n          \"Path of an EXISTING MulmoScript JSON file, as returned by a previous call (e.g. 'stories/my-story-1700000000000.json'). Resolved against the workspace's `artifacts/` directory, not the workspace root ('artifacts/stories/…' is also accepted). Use this to re-display a script previously saved in this workspace, instead of resending the full JSON. Do NOT pass alongside `script`.\",\n      },\n      autoGenerateMovie: {\n        type: \"boolean\",\n        description:\n          \"When true, the server starts movie generation in the background after save/load. The user does NOT need to open the canvas — progress streams via the existing session channel. Default false. Only set true when the user has explicitly asked for the movie; generation is expensive.\",\n      },\n    },\n    required: [],\n  },\n};\n","// General-purpose runtime type guards, shared across the MulmoClaude host,\n// bridges, and plugins. This is a leaf package — pure and dependency-free — so\n// any tier can import it without creating an uphill edge.\n//\n// These originated as `server/utils/types.ts` (#504), which centralised 40+\n// hand-written inline `typeof x === \"object\"` checks. They are promoted here so\n// the same guards stop being re-hand-written in every bridge and plugin too.\n/** Narrow `unknown` to a plain object (not null, not array). */\nexport function isRecord(value) {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n/** Narrow `unknown` to any object (not null, arrays allowed).\n *  Use `isRecord` when you need to access string keys. */\nexport function isObj(value) {\n    return typeof value === \"object\" && value !== null;\n}\n/** Non-empty string after trimming whitespace. */\nexport function isNonEmptyString(value) {\n    return typeof value === \"string\" && value.trim().length > 0;\n}\n/** Record whose values are all strings. */\nexport function isStringRecord(value) {\n    if (!isRecord(value))\n        return false;\n    return Object.values(value).every((val) => typeof val === \"string\");\n}\n/** String array (every element is a string). */\nexport function isStringArray(value) {\n    return Array.isArray(value) && value.every((val) => typeof val === \"string\");\n}\n/** An array of unknowns. Prefer this over a bare `Array.isArray` in typed code:\n *  `Array.isArray(x: unknown)` narrows to `any[]`, silently reintroducing\n *  `any`, whereas this keeps the element type `unknown`. */\nexport function isUnknownArray(value) {\n    return Array.isArray(value);\n}\n/** Error-like object with a `code` property (e.g. Node.js fs errors). */\nexport function isErrorWithCode(value) {\n    return isRecord(value) && typeof value.code === \"string\";\n}\n/** Check that a record has a specific key with a string value. */\nexport function hasStringProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"string\";\n}\n/** Check that a record has a specific key with a number value. */\nexport function hasNumberProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"number\";\n}\n/** Split a comma-separated env value into trimmed, non-empty entries.\n *  `lowercase` folds case for identifiers compared case-insensitively\n *  (JIDs, email addresses, hex pubkeys). Absent/empty input → empty list. */\nexport function parseCsvList(raw, opts) {\n    return (raw ?? \"\")\n        .split(\",\")\n        .map((entry) => (opts?.lowercase ? entry.trim().toLowerCase() : entry.trim()))\n        .filter(Boolean);\n}\n/** A comma-separated env value as a Set — the canonical allowlist shape,\n *  where an empty set is the \"allow all\" sentinel (`set.size === 0`). */\nexport function parseCsvSet(raw, opts) {\n    return new Set(parseCsvList(raw, opts));\n}\n/** Normalise an unknown thrown value into a human-readable string. Isomorphic\n *  (host, bridges, plugins, Vue) — this is the single home for the helper that\n *  #2217 could only consolidate for server code, since `@mulmoclaude/core/utils`\n *  is server-only.\n *\n *  A non-Error object with a non-empty string `details` (gRPC convention) or\n *  `message` field surfaces that field — `details` wins — instead of the\n *  `[object Object]` a bare `String(err)` would print; an empty-string field\n *  falls through. `fallback` covers the error-boundary idiom where a thrown\n *  non-Error should read as a descriptive message rather than `String(err)`\n *  noise; omit it in logging contexts where `String(err)` is fine. */\nexport function errorMessage(err, fallback) {\n    if (err instanceof Error)\n        return err.message;\n    if (hasStringProp(err, \"details\") && err.details)\n        return err.details;\n    if (hasStringProp(err, \"message\") && err.message)\n        return err.message;\n    if (fallback !== undefined)\n        return fallback;\n    return String(err);\n}\n/** `Date` → `YYYY-MM-DD` in UTC — for dates that must not shift with the\n *  host's local timezone (tool-trace search dirs, API date keys). Isomorphic\n *  single source (#2480): the host re-exports it from `server/utils/date.ts`,\n *  x-plugin imports it directly. The `@receptron/task-scheduler` copy stays\n *  local on purpose — that leaf package is published independently and kept\n *  dependency-free. Wall-clock questions use the host's `toLocalIsoDate`. */\nexport function toUtcIsoDate(timestamp) {\n    const year = timestamp.getUTCFullYear();\n    const month = String(timestamp.getUTCMonth() + 1).padStart(2, \"0\");\n    const day = String(timestamp.getUTCDate()).padStart(2, \"0\");\n    return `${year}-${month}-${day}`;\n}\n// A Map, not an object literal: `{}[char]` reads through the prototype chain,\n// so a future caller widening the regex would silently get `[object Object]`\n// for keys like `constructor`.\nconst HTML_ESCAPES = new Map([\n    [\"&\", \"&amp;\"],\n    [\"<\", \"&lt;\"],\n    [\">\", \"&gt;\"],\n    ['\"', \"&quot;\"],\n    [\"'\", \"&#39;\"],\n]);\n/** HTML-escape text destined for markup or an attribute value — the fixed\n *  five-character map, nothing more. Lives here rather than in\n *  `@mulmoclaude/core/wiki` (#2483) because `@mulmoclaude/markdown-utils` is a\n *  leaf that core depends on and so cannot import back up; core/wiki\n *  re-exports this, keeping its consumers' import path unchanged.\n *\n *  Escaping `&` first is what makes a single pass safe — the entities this\n *  introduces contain none of the other four characters, so nothing is\n *  double-escaped. Not a sanitiser: it neither strips tags nor validates URLs. */\nexport function escapeHtml(value) {\n    return value.replace(/[&<>\"']/g, (char) => HTML_ESCAPES.get(char) ?? char);\n}\nexport { scanEnvOptions, snakeToLowerCamel } from \"./envScan.js\";\n","// Path helpers for MulmoScript story artifacts. The generic build primitives\n// (slug + the `\"\"`/`.`/`..` traversal guard) live in the shared, browser-safe\n// `@mulmoclaude/core/artifacts` (#2405); only the story-specific wire-path\n// rules stay here.\n//\n// Path model: the stories directory lives at `<workspace>/artifacts/stories`\n// and the FileOps scope root is `<workspace>/artifacts`, so the\n// FileOps-relative path and the historical `stories/<name>.json` wire form\n// (which every mulmoScript endpoint keys on) are the SAME string. Stories are\n// NOT `YYYY/MM`-partitioned, so `storyFilePath` opts out of partitioning.\n\nimport { ARTIFACTS_ROOT, buildArtifactRelPath, hasUnsafePathSegment, slugifyArtifact } from \"@mulmoclaude/core/artifacts\";\n\nconst STORIES_DIR = \"stories\";\nconst STORY_FALLBACK_SLUG = \"story\";\n\n/** Lowercase-hyphen slug, capped, leading/trailing hyphens stripped; falls back\n *  to `fallback` for empty/undefined/non-ASCII input. */\nexport function slugify(title: string | undefined, fallback = STORY_FALLBACK_SLUG): string {\n  return slugifyArtifact(title, fallback);\n}\n\n/** Build a fresh, collision-safe story path for a new script —\n *  `stories/<slug>-<epoch-ms>.json`, valid as both the FileOps-relative\n *  write path and the wire `filePath`. */\nexport function storyFilePath(slugSource: string, now: Date = new Date()): string {\n  return buildArtifactRelPath({ dir: STORIES_DIR, title: slugSource, ext: \".json\", fallback: STORY_FALLBACK_SLUG, now, partitioned: false });\n}\n\n/**\n * Normalize a caller-supplied wire path to the canonical\n * `stories/<rel>` form, or null when it can't be trusted. Accepts the\n * canonical `stories/foo.json` convention, bare `foo.json` (the host route\n * historically allowed either), and the workspace-relative spelling\n * `artifacts/stories/foo.json` — the tool description called `filePath`\n * \"workspace-relative\" for a long time, so agents legitimately send it.\n * A leading `artifacts` segment is dropped only when `stories` follows;\n * a bare `artifacts/foo.json` keeps its historical meaning (a file named\n * `artifacts/foo.json` under the stories dir). Rejects absolute paths,\n * backslashes, and any empty / `.` / `..` segment — the lexical guard\n * before every `files.artifacts` read/write (FileOps re-checks\n * containment as defence-in-depth).\n */\nexport function normalizeStoryPath(filePath: string): string | null {\n  if (filePath.length === 0 || filePath.includes(\"\\\\\")) return null;\n  // Absolute POSIX path or Windows drive prefix.\n  if (filePath.startsWith(\"/\") || /^[A-Za-z]:/.test(filePath)) return null;\n  if (hasUnsafePathSegment(filePath)) return null;\n  const segments = filePath.split(\"/\");\n  const trimmed = segments[0] === ARTIFACTS_ROOT && segments[1] === STORIES_DIR ? segments.slice(1) : segments;\n  const rest = trimmed[0] === STORIES_DIR ? trimmed.slice(1) : trimmed;\n  if (rest.length === 0) return null;\n  return [STORIES_DIR, ...rest].join(\"/\");\n}\n","// Body validators for the mulmoScript update endpoints, moved verbatim from\n// the host's `server/api/routes/mulmoScriptValidate.ts` so MulmoClaude and\n// MulmoTerminal share one definition of a \"valid script\" / \"valid beat\".\n//\n// The `@mulmocast/types` package exports zod schemas that mirror the\n// canonical MulmoScript / MulmoBeat shapes. The same schemas back client-side\n// edit-time validation in the presentMulmoScript View.\n\nimport { mulmoBeatSchema, mulmoScriptSchema } from \"@mulmocast/types\";\n\nexport type ValidationResult<T> = { ok: true; value: T } | { ok: false; error: string };\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction formatZodIssues(\n  // Zod's `$ZodIssue.path` is `PropertyKey[]` (includes `symbol`).\n  // Accept the wider type so callers can pass `safeParse().error.issues`\n  // directly; stringify any non-string/number segments at format time.\n  issues: readonly { message: string; path: readonly PropertyKey[] }[],\n): string {\n  if (issues.length === 0) return \"invalid shape\";\n  const head = issues\n    .slice(0, 3)\n    .map((i) => {\n      const pathStr = i.path.length > 0 ? i.path.map((seg) => String(seg)).join(\".\") : \"<root>\";\n      return `${pathStr}: ${i.message}`;\n    })\n    .join(\"; \");\n  return issues.length > 3 ? `${head} (+${issues.length - 3} more)` : head;\n}\n\n/** Shared prelude: require an object body carrying a non-empty\n *  `filePath`. On success returns the narrowed record + filePath so the\n *  caller reads the remaining fields without re-narrowing. */\nfunction validateFilePathBody(body: unknown): ValidationResult<{ record: Record<string, unknown>; filePath: string }> {\n  if (!isRecord(body)) {\n    return { ok: false, error: \"body must be an object\" };\n  }\n  if (typeof body.filePath !== \"string\" || body.filePath === \"\") {\n    return { ok: false, error: \"filePath must be a non-empty string\" };\n  }\n  return { ok: true, value: { record: body, filePath: body.filePath } };\n}\n\n/**\n * Validate the `update-script` request body. Returns the parsed,\n * schema-conformant script on success, or a human-readable error\n * suitable for sending back as a 400 response.\n */\nexport function validateUpdateScriptBody(body: unknown): ValidationResult<{\n  filePath: string;\n  script: unknown;\n}> {\n  const base = validateFilePathBody(body);\n  if (!base.ok) return base;\n  const { record, filePath } = base.value;\n  if (record.script === undefined) {\n    return { ok: false, error: \"script is required\" };\n  }\n  const parsed = mulmoScriptSchema.safeParse(record.script);\n  if (!parsed.success) {\n    return {\n      ok: false,\n      error: `invalid script: ${formatZodIssues(parsed.error.issues)}`,\n    };\n  }\n  return {\n    ok: true,\n    value: { filePath, script: parsed.data },\n  };\n}\n\n/**\n * Validate the `update-beat` request body. `beatIndex` is allowed\n * to be any non-negative integer; the handler still bounds-checks\n * against the actual script length after reading the file.\n */\nexport function validateUpdateBeatBody(body: unknown): ValidationResult<{\n  filePath: string;\n  beatIndex: number;\n  beat: unknown;\n}> {\n  const base = validateFilePathBody(body);\n  if (!base.ok) return base;\n  const { record, filePath } = base.value;\n  const beatIndex = record.beatIndex;\n  if (typeof beatIndex !== \"number\" || !Number.isInteger(beatIndex) || beatIndex < 0) {\n    return { ok: false, error: \"beatIndex must be a non-negative integer\" };\n  }\n  if (record.beat === undefined) {\n    return { ok: false, error: \"beat is required\" };\n  }\n  const parsed = mulmoBeatSchema.safeParse(record.beat);\n  if (!parsed.success) {\n    return {\n      ok: false,\n      error: `invalid beat: ${formatZodIssues(parsed.error.issues)}`,\n    };\n  }\n  return {\n    ok: true,\n    value: {\n      filePath,\n      beatIndex,\n      beat: parsed.data,\n    },\n  };\n}\n","import type { ToolPluginCore, ToolResult } from \"gui-chat-protocol\";\nimport { mulmoScriptSchema } from \"@mulmocast/types\";\nimport { errorMessage } from \"@mulmoclaude/common\";\nimport { TOOL_DEFINITION } from \"./definition\";\nimport { normalizeStoryPath, storyFilePath } from \"./paths\";\nimport { validateUpdateBeatBody, validateUpdateScriptBody } from \"./validate\";\nimport type { MulmoScriptData, MulmoScriptExecuteContext, SaveMulmoScriptArgs } from \"./types\";\n\n/** Failure half of every outcome below. `code` preserves the hosts'\n *  HTTP contract (bad_request → 400, not_found → 404) without the package\n *  knowing anything about HTTP. */\nexport interface MulmoScriptFailure {\n  ok: false;\n  code: \"bad_request\" | \"not_found\";\n  error: string;\n}\n\nexport type SaveMulmoScriptOutcome = ({ ok: true; message: string } & MulmoScriptData) | MulmoScriptFailure;\n\nexport type UpdateMulmoScriptOutcome = { ok: true } | MulmoScriptFailure;\n\nfunction badRequest(error: string): MulmoScriptFailure {\n  return { ok: false, code: \"bad_request\", error };\n}\n\nfunction notFound(error: string): MulmoScriptFailure {\n  return { ok: false, code: \"not_found\", error };\n}\n\nfunction stringifyScript(script: unknown): string {\n  // 2-space indent matches the hosts' writeJsonAtomic convention so a\n  // package-written script diffs cleanly against host-written ones.\n  return JSON.stringify(script, null, 2);\n}\n\n/** Persist a new, schema-validated script under a fresh `stories/…` path. */\nasync function saveNewScript(context: MulmoScriptExecuteContext, script: unknown, filename: string | undefined, now: Date): Promise<SaveMulmoScriptOutcome> {\n  const validation = mulmoScriptSchema.safeParse(script);\n  if (!validation.success) {\n    return badRequest(\"script is not a valid MulmoScript\");\n  }\n  const validatedScript = validation.data;\n  // slugify drops `/`, `\\`, and `..`, so a hostile `filename` like\n  // \"../../etc/passwd\" can never escape the stories dir — defense in\n  // depth on top of FileOps' own containment check.\n  const slugSource = filename ? filename.replace(/\\.json$/i, \"\") : validatedScript.title || \"untitled\";\n  const filePath = storyFilePath(slugSource, now);\n  await context.files.artifacts.write(filePath, stringifyScript(validatedScript));\n  return { ok: true, script: validatedScript, filePath, message: `Saved MulmoScript to ${filePath}` };\n}\n\n/** Re-open an existing script: containment guard, existence, JSON parse,\n *  schema validation — same acceptance rules as the save path so a script\n *  this package saved can never be one it later refuses to load. */\nasync function loadExistingScript(context: MulmoScriptExecuteContext, filePath: string): Promise<SaveMulmoScriptOutcome> {\n  if (!filePath.toLowerCase().endsWith(\".json\")) {\n    return badRequest(\"filePath must point to a .json file\");\n  }\n  const storyPath = normalizeStoryPath(filePath);\n  if (!storyPath) {\n    return badRequest(\"Invalid filePath\");\n  }\n  if (!(await context.files.artifacts.exists(storyPath))) {\n    return notFound(`File not found: ${filePath}`);\n  }\n  const raw = await context.files.artifacts.read(storyPath);\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    return badRequest(`Invalid JSON: ${errorMessage(err)}`);\n  }\n  const validation = mulmoScriptSchema.safeParse(parsed);\n  if (!validation.success) {\n    return badRequest(\"File is not a valid MulmoScript\");\n  }\n  return { ok: true, script: validation.data, filePath: storyPath, message: `Loaded MulmoScript from ${storyPath}` };\n}\n\n/**\n * Unified save-or-reopen for the presentMulmoScript tool call. `script`\n * (create new) and `filePath` (existing) are mutually exclusive. Never\n * throws on bad input — validation failures come back as discriminated\n * failures so host routes stay thin adapters. `autoGenerateMovie` is NOT\n * handled here: movie generation needs host backends (mulmocast/ffmpeg),\n * so hosts that support it trigger it from the returned `filePath`.\n */\nexport async function executeMulmoScriptSave(\n  context: MulmoScriptExecuteContext,\n  args: SaveMulmoScriptArgs,\n  now: Date = new Date(),\n): Promise<SaveMulmoScriptOutcome> {\n  const { script, filename, filePath } = args ?? {};\n  const hasScript = script !== undefined && script !== null;\n  const hasFilePath = typeof filePath === \"string\" && filePath !== \"\";\n  if (hasScript === hasFilePath) {\n    return badRequest(\n      hasScript ? \"Provide either `script` or `filePath`, not both.\" : \"Provide either `script` (new presentation) or `filePath` (existing presentation).\",\n    );\n  }\n  return hasFilePath\n    ? loadExistingScript(context, filePath as string)\n    : saveNewScript(context, script, typeof filename === \"string\" ? filename : undefined, now);\n}\n\n/** Resolve + guard a wire path for the update endpoints. */\nasync function resolveExistingStory(context: MulmoScriptExecuteContext, filePath: string): Promise<{ storyPath: string } | MulmoScriptFailure> {\n  const storyPath = normalizeStoryPath(filePath);\n  if (!storyPath) return badRequest(\"Invalid filePath\");\n  if (!(await context.files.artifacts.exists(storyPath))) {\n    return notFound(`File not found: ${filePath}`);\n  }\n  return { storyPath };\n}\n\n/** Overwrite one beat of an existing script (the View's per-beat source\n *  editor). Validates the body shape + beat schema, bounds-checks the index\n *  against the script on disk, and writes the whole file back. */\nexport async function executeUpdateBeat(context: MulmoScriptExecuteContext, body: unknown): Promise<UpdateMulmoScriptOutcome> {\n  const validation = validateUpdateBeatBody(body);\n  if (!validation.ok) return badRequest(validation.error);\n  const { filePath, beatIndex, beat } = validation.value;\n\n  const resolved = await resolveExistingStory(context, filePath);\n  if (\"ok\" in resolved) return resolved;\n\n  let script: { beats?: unknown[] };\n  try {\n    script = JSON.parse(await context.files.artifacts.read(resolved.storyPath));\n  } catch (err) {\n    return badRequest(`Invalid JSON: ${errorMessage(err)}`);\n  }\n  if (!Array.isArray(script.beats) || beatIndex >= script.beats.length) {\n    return badRequest(\"Invalid beatIndex\");\n  }\n  script.beats[beatIndex] = beat;\n  await context.files.artifacts.write(resolved.storyPath, stringifyScript(script));\n  return { ok: true };\n}\n\n/** Overwrite the whole script (the View's full-source editor / deck-editor\n *  auto-save). The body's `script` is schema-validated by\n *  `validateUpdateScriptBody` before the write. */\nexport async function executeUpdateScript(context: MulmoScriptExecuteContext, body: unknown): Promise<UpdateMulmoScriptOutcome> {\n  const validation = validateUpdateScriptBody(body);\n  if (!validation.ok) return badRequest(validation.error);\n  const { filePath, script } = validation.value;\n\n  const resolved = await resolveExistingStory(context, filePath);\n  if (\"ok\" in resolved) return resolved;\n\n  await context.files.artifacts.write(resolved.storyPath, stringifyScript(script));\n  return { ok: true };\n}\n\n/** ToolResult-shaped wrapper over `executeMulmoScriptSave` for runtime hosts\n *  (e.g. MulmoTerminal's package loader), where the tool call resolves to a\n *  ToolResult rather than an HTTP response. Failures are narrate-only\n *  (message, no data) so the agent can self-correct. */\nexport async function executeMulmoScript(context: MulmoScriptExecuteContext, args: SaveMulmoScriptArgs): Promise<ToolResult<MulmoScriptData>> {\n  const outcome = await executeMulmoScriptSave(context, args);\n  if (!outcome.ok) {\n    return {\n      message: outcome.error,\n      instructions: \"Acknowledge the error and retry with a valid `script` (new) or an existing `filePath`.\",\n    };\n  }\n  // The tool schema advertises `autoGenerateMovie`, but movie generation\n  // needs host backends (mulmocast/ffmpeg) this generic execute path\n  // doesn't have — MulmoClaude honours the flag in its own save route.\n  // Say so in the result rather than silently dropping the option, so the\n  // agent doesn't tell the user a movie is on its way.\n  const ignoredMovieNote = args.autoGenerateMovie === true ? \" (autoGenerateMovie is not supported by this host and was ignored)\" : \"\";\n  return {\n    message: `${outcome.message}${ignoredMovieNote}`,\n    data: { script: outcome.script, filePath: outcome.filePath },\n    instructions: \"Display the storyboard to the user.\",\n  };\n}\n\n/** Non-Vue plugin core for runtime hosts that register the package directly.\n *  MulmoClaude consumes only TOOL_DEFINITION + the execute functions in its\n *  own routes, so it doesn't use this. */\nexport const pluginCore: ToolPluginCore<MulmoScriptData, MulmoScriptData, SaveMulmoScriptArgs> = {\n  toolDefinition: TOOL_DEFINITION,\n  execute: executeMulmoScript as unknown as ToolPluginCore<MulmoScriptData, MulmoScriptData, SaveMulmoScriptArgs>[\"execute\"],\n  generatingMessage: \"Generating MulmoScript storyboard…\",\n  isEnabled: () => true,\n};\n"],"mappings":";;;AAEA,IAAa,YAAY;AAMzB,IAAa,kBAAkC;CAC7C,MAAM;CACN,MAAM;CACN,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkFb,YAAY;EACV,MAAM;EACN,YAAY;GACV,QAAQ;IACN,MAAM;IACN,aACE;IACF,sBAAsB;GACxB;GACA,UAAU;IACR,MAAM;IACN,aACE;GACJ;GACA,UAAU;IACR,MAAM;IACN,aACE;GACJ;GACA,mBAAmB;IACjB,MAAM;IACN,aACE;GACJ;EACF;EACA,UAAU,CAAC;CACb;AACF;;;;AChHA,SAAgBA,WAAS,OAAO;CAC5B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;AA+BA,SAAgB,cAAc,OAAO,KAAK;CACtC,OAAOA,WAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;;;;;;;;;;;AA8BA,SAAgB,aAAa,KAAK,UAAU;CACxC,IAAI,eAAe,OACf,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,aAAa,KAAA,GACb,OAAO;CACX,OAAO,OAAO,GAAG;AACrB;;;ACtEA,IAAM,cAAc;AACpB,IAAM,sBAAsB;;;AAI5B,SAAgB,QAAQ,OAA2B,WAAW,qBAA6B;CACzF,QAAA,GAAA,4BAAA,gBAAA,CAAuB,OAAO,QAAQ;AACxC;;;;AAKA,SAAgB,cAAc,YAAoB,sBAAY,IAAI,KAAK,GAAW;CAChF,QAAA,GAAA,4BAAA,qBAAA,CAA4B;EAAE,KAAK;EAAa,OAAO;EAAY,KAAK;EAAS,UAAU;EAAqB;EAAK,aAAa;CAAM,CAAC;AAC3I;;;;;;;;;;;;;;;AAgBA,SAAgB,mBAAmB,UAAiC;CAClE,IAAI,SAAS,WAAW,KAAK,SAAS,SAAS,IAAI,GAAG,OAAO;CAE7D,IAAI,SAAS,WAAW,GAAG,KAAK,aAAa,KAAK,QAAQ,GAAG,OAAO;CACpE,KAAA,GAAA,4BAAA,qBAAA,CAAyB,QAAQ,GAAG,OAAO;CAC3C,MAAM,WAAW,SAAS,MAAM,GAAG;CACnC,MAAM,UAAU,SAAS,OAAO,4BAAA,kBAAkB,SAAS,OAAO,cAAc,SAAS,MAAM,CAAC,IAAI;CACpG,MAAM,OAAO,QAAQ,OAAO,cAAc,QAAQ,MAAM,CAAC,IAAI;CAC7D,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;AACxC;;;ACzCA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,gBAIP,QACQ;CACR,IAAI,OAAO,WAAW,GAAG,OAAO;CAChC,MAAM,OAAO,OACV,MAAM,GAAG,CAAC,CAAC,CACX,KAAK,MAAM;EAEV,OAAO,GADS,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,KAAK,QAAQ,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,SAC/D,IAAI,EAAE;CAC1B,CAAC,CAAC,CACD,KAAK,IAAI;CACZ,OAAO,OAAO,SAAS,IAAI,GAAG,KAAK,KAAK,OAAO,SAAS,EAAE,UAAU;AACtE;;;;AAKA,SAAS,qBAAqB,MAAwF;CACpH,IAAI,CAAC,SAAS,IAAI,GAChB,OAAO;EAAE,IAAI;EAAO,OAAO;CAAyB;CAEtD,IAAI,OAAO,KAAK,aAAa,YAAY,KAAK,aAAa,IACzD,OAAO;EAAE,IAAI;EAAO,OAAO;CAAsC;CAEnE,OAAO;EAAE,IAAI;EAAM,OAAO;GAAE,QAAQ;GAAM,UAAU,KAAK;EAAS;CAAE;AACtE;;;;;;AAOA,SAAgB,yBAAyB,MAGtC;CACD,MAAM,OAAO,qBAAqB,IAAI;CACtC,IAAI,CAAC,KAAK,IAAI,OAAO;CACrB,MAAM,EAAE,QAAQ,aAAa,KAAK;CAClC,IAAI,OAAO,WAAW,KAAA,GACpB,OAAO;EAAE,IAAI;EAAO,OAAO;CAAqB;CAElD,MAAM,SAAS,iBAAA,kBAAkB,UAAU,OAAO,MAAM;CACxD,IAAI,CAAC,OAAO,SACV,OAAO;EACL,IAAI;EACJ,OAAO,mBAAmB,gBAAgB,OAAO,MAAM,MAAM;CAC/D;CAEF,OAAO;EACL,IAAI;EACJ,OAAO;GAAE;GAAU,QAAQ,OAAO;EAAK;CACzC;AACF;;;;;;AAOA,SAAgB,uBAAuB,MAIpC;CACD,MAAM,OAAO,qBAAqB,IAAI;CACtC,IAAI,CAAC,KAAK,IAAI,OAAO;CACrB,MAAM,EAAE,QAAQ,aAAa,KAAK;CAClC,MAAM,YAAY,OAAO;CACzB,IAAI,OAAO,cAAc,YAAY,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,GAC/E,OAAO;EAAE,IAAI;EAAO,OAAO;CAA2C;CAExE,IAAI,OAAO,SAAS,KAAA,GAClB,OAAO;EAAE,IAAI;EAAO,OAAO;CAAmB;CAEhD,MAAM,SAAS,iBAAA,gBAAgB,UAAU,OAAO,IAAI;CACpD,IAAI,CAAC,OAAO,SACV,OAAO;EACL,IAAI;EACJ,OAAO,iBAAiB,gBAAgB,OAAO,MAAM,MAAM;CAC7D;CAEF,OAAO;EACL,IAAI;EACJ,OAAO;GACL;GACA;GACA,MAAM,OAAO;EACf;CACF;AACF;;;ACxFA,SAAS,WAAW,OAAmC;CACrD,OAAO;EAAE,IAAI;EAAO,MAAM;EAAe;CAAM;AACjD;AAEA,SAAS,SAAS,OAAmC;CACnD,OAAO;EAAE,IAAI;EAAO,MAAM;EAAa;CAAM;AAC/C;AAEA,SAAS,gBAAgB,QAAyB;CAGhD,OAAO,KAAK,UAAU,QAAQ,MAAM,CAAC;AACvC;;AAGA,eAAe,cAAc,SAAoC,QAAiB,UAA8B,KAA4C;CAC1J,MAAM,aAAa,iBAAA,kBAAkB,UAAU,MAAM;CACrD,IAAI,CAAC,WAAW,SACd,OAAO,WAAW,mCAAmC;CAEvD,MAAM,kBAAkB,WAAW;CAKnC,MAAM,WAAW,cADE,WAAW,SAAS,QAAQ,YAAY,EAAE,IAAI,gBAAgB,SAAS,YAC/C,GAAG;CAC9C,MAAM,QAAQ,MAAM,UAAU,MAAM,UAAU,gBAAgB,eAAe,CAAC;CAC9E,OAAO;EAAE,IAAI;EAAM,QAAQ;EAAiB;EAAU,SAAS,wBAAwB;CAAW;AACpG;;;;AAKA,eAAe,mBAAmB,SAAoC,UAAmD;CACvH,IAAI,CAAC,SAAS,YAAY,CAAC,CAAC,SAAS,OAAO,GAC1C,OAAO,WAAW,qCAAqC;CAEzD,MAAM,YAAY,mBAAmB,QAAQ;CAC7C,IAAI,CAAC,WACH,OAAO,WAAW,kBAAkB;CAEtC,IAAI,CAAE,MAAM,QAAQ,MAAM,UAAU,OAAO,SAAS,GAClD,OAAO,SAAS,mBAAmB,UAAU;CAE/C,MAAM,MAAM,MAAM,QAAQ,MAAM,UAAU,KAAK,SAAS;CACxD,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,SAAS,KAAK;EACZ,OAAO,WAAW,iBAAiB,aAAa,GAAG,GAAG;CACxD;CACA,MAAM,aAAa,iBAAA,kBAAkB,UAAU,MAAM;CACrD,IAAI,CAAC,WAAW,SACd,OAAO,WAAW,iCAAiC;CAErD,OAAO;EAAE,IAAI;EAAM,QAAQ,WAAW;EAAM,UAAU;EAAW,SAAS,2BAA2B;CAAY;AACnH;;;;;;;;;AAUA,eAAsB,uBACpB,SACA,MACA,sBAAY,IAAI,KAAK,GACY;CACjC,MAAM,EAAE,QAAQ,UAAU,aAAa,QAAQ,CAAC;CAChD,MAAM,YAAY,WAAW,KAAA,KAAa,WAAW;CACrD,MAAM,cAAc,OAAO,aAAa,YAAY,aAAa;CACjE,IAAI,cAAc,aAChB,OAAO,WACL,YAAY,qDAAqD,mFACnE;CAEF,OAAO,cACH,mBAAmB,SAAS,QAAkB,IAC9C,cAAc,SAAS,QAAQ,OAAO,aAAa,WAAW,WAAW,KAAA,GAAW,GAAG;AAC7F;;AAGA,eAAe,qBAAqB,SAAoC,UAAuE;CAC7I,MAAM,YAAY,mBAAmB,QAAQ;CAC7C,IAAI,CAAC,WAAW,OAAO,WAAW,kBAAkB;CACpD,IAAI,CAAE,MAAM,QAAQ,MAAM,UAAU,OAAO,SAAS,GAClD,OAAO,SAAS,mBAAmB,UAAU;CAE/C,OAAO,EAAE,UAAU;AACrB;;;;AAKA,eAAsB,kBAAkB,SAAoC,MAAkD;CAC5H,MAAM,aAAa,uBAAuB,IAAI;CAC9C,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,WAAW,KAAK;CACtD,MAAM,EAAE,UAAU,WAAW,SAAS,WAAW;CAEjD,MAAM,WAAW,MAAM,qBAAqB,SAAS,QAAQ;CAC7D,IAAI,QAAQ,UAAU,OAAO;CAE7B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,MAAM,QAAQ,MAAM,UAAU,KAAK,SAAS,SAAS,CAAC;CAC5E,SAAS,KAAK;EACZ,OAAO,WAAW,iBAAiB,aAAa,GAAG,GAAG;CACxD;CACA,IAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,KAAK,aAAa,OAAO,MAAM,QAC5D,OAAO,WAAW,mBAAmB;CAEvC,OAAO,MAAM,aAAa;CAC1B,MAAM,QAAQ,MAAM,UAAU,MAAM,SAAS,WAAW,gBAAgB,MAAM,CAAC;CAC/E,OAAO,EAAE,IAAI,KAAK;AACpB;;;;AAKA,eAAsB,oBAAoB,SAAoC,MAAkD;CAC9H,MAAM,aAAa,yBAAyB,IAAI;CAChD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,WAAW,KAAK;CACtD,MAAM,EAAE,UAAU,WAAW,WAAW;CAExC,MAAM,WAAW,MAAM,qBAAqB,SAAS,QAAQ;CAC7D,IAAI,QAAQ,UAAU,OAAO;CAE7B,MAAM,QAAQ,MAAM,UAAU,MAAM,SAAS,WAAW,gBAAgB,MAAM,CAAC;CAC/E,OAAO,EAAE,IAAI,KAAK;AACpB;;;;;AAMA,eAAsB,mBAAmB,SAAoC,MAAiE;CAC5I,MAAM,UAAU,MAAM,uBAAuB,SAAS,IAAI;CAC1D,IAAI,CAAC,QAAQ,IACX,OAAO;EACL,SAAS,QAAQ;EACjB,cAAc;CAChB;CAOF,MAAM,mBAAmB,KAAK,sBAAsB,OAAO,uEAAuE;CAClI,OAAO;EACL,SAAS,GAAG,QAAQ,UAAU;EAC9B,MAAM;GAAE,QAAQ,QAAQ;GAAQ,UAAU,QAAQ;EAAS;EAC3D,cAAc;CAChB;AACF;;;;AAKA,IAAa,aAAoF;CAC/F,gBAAgB;CAChB,SAAS;CACT,mBAAmB;CACnB,iBAAiB;AACnB"}

package/dist/{plugin-BQyzxkui.js → plugin-CXhOP_xU.js}

@@ -1,4 +1,5 @@
 import { mulmoBeatSchema, mulmoScriptSchema } from "@mulmocast/types";
+import { ARTIFACTS_ROOT, buildArtifactRelPath, hasUnsafePathSegment, slugifyArtifact } from "@mulmoclaude/core/artifacts";
 //#region src/core/definition.ts
 var TOOL_NAME = "presentMulmoScript";
 var TOOL_DEFINITION = {
@@ -111,29 +112,54 @@ IMPORTANT: "imagePrompt" and "moviePrompt" are plain string fields on the beat,
 	}
 };
 //#endregion
+//#region ../../common/dist/index.js
+/** Narrow `unknown` to a plain object (not null, not array). */
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Check that a record has a specific key with a string value. */
+function hasStringProp(value, key) {
+	return isRecord$1(value) && typeof value[key] === "string";
+}
+/** Normalise an unknown thrown value into a human-readable string. Isomorphic
+*  (host, bridges, plugins, Vue) — this is the single home for the helper that
+*  #2217 could only consolidate for server code, since `@mulmoclaude/core/utils`
+*  is server-only.
+*
+*  A non-Error object with a non-empty string `details` (gRPC convention) or
+*  `message` field surfaces that field — `details` wins — instead of the
+*  `[object Object]` a bare `String(err)` would print; an empty-string field
+*  falls through. `fallback` covers the error-boundary idiom where a thrown
+*  non-Error should read as a descriptive message rather than `String(err)`
+*  noise; omit it in logging contexts where `String(err)` is fine. */
+function errorMessage(err, fallback) {
+	if (err instanceof Error) return err.message;
+	if (hasStringProp(err, "details") && err.details) return err.details;
+	if (hasStringProp(err, "message") && err.message) return err.message;
+	if (fallback !== void 0) return fallback;
+	return String(err);
+}
+//#endregion
 //#region src/core/paths.ts
 var STORIES_DIR = "stories";
-var ARTIFACTS_DIR = "artifacts";
-var MAX_SLUG_LEN = 120;
-/** Lowercase-hyphen slug, capped at MAX_SLUG_LEN, with leading/trailing
-*  hyphens stripped. Falls back to `fallback` for empty/undefined/non-ASCII
-*  input. Mirrors html-plugin's in-package slugify — deliberately simpler
-*  than the host's hash-fallback variant; the timestamp suffix appended by
-*  `storyFilePath` keeps these throwaway filenames collision-free. */
-function slugify(title, fallback = "story") {
-	if (!title) return fallback;
-	const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, MAX_SLUG_LEN);
-	let start = 0;
-	let end = collapsed.length;
-	while (start < end && collapsed[start] === "-") start += 1;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	return collapsed.slice(start, end) || fallback;
+var STORY_FALLBACK_SLUG = "story";
+/** Lowercase-hyphen slug, capped, leading/trailing hyphens stripped; falls back
+*  to `fallback` for empty/undefined/non-ASCII input. */
+function slugify(title, fallback = STORY_FALLBACK_SLUG) {
+	return slugifyArtifact(title, fallback);
 }
 /** Build a fresh, collision-safe story path for a new script —
 *  `stories/<slug>-<epoch-ms>.json`, valid as both the FileOps-relative
 *  write path and the wire `filePath`. */
 function storyFilePath(slugSource, now = /* @__PURE__ */ new Date()) {
-	return `${STORIES_DIR}/${slugify(slugSource)}-${now.getTime()}.json`;
+	return buildArtifactRelPath({
+		dir: STORIES_DIR,
+		title: slugSource,
+		ext: ".json",
+		fallback: STORY_FALLBACK_SLUG,
+		now,
+		partitioned: false
+	});
 }
 /**
 * Normalize a caller-supplied wire path to the canonical
@@ -152,9 +178,9 @@ function storyFilePath(slugSource, now = /* @__PURE__ */ new Date()) {
 function normalizeStoryPath(filePath) {
 	if (filePath.length === 0 || filePath.includes("\\")) return null;
 	if (filePath.startsWith("/") || /^[A-Za-z]:/.test(filePath)) return null;
+	if (hasUnsafePathSegment(filePath)) return null;
 	const segments = filePath.split("/");
-	if (segments.some((seg) => seg === "" || seg === "." || seg === "..")) return null;
-	const trimmed = segments[0] === ARTIFACTS_DIR && segments[1] === STORIES_DIR ? segments.slice(1) : segments;
+	const trimmed = segments[0] === ARTIFACTS_ROOT && segments[1] === STORIES_DIR ? segments.slice(1) : segments;
 	const rest = trimmed[0] === STORIES_DIR ? trimmed.slice(1) : trimmed;
 	if (rest.length === 0) return null;
 	return [STORIES_DIR, ...rest].join("/");
@@ -171,12 +197,10 @@ function formatZodIssues(issues) {
 	}).join("; ");
 	return issues.length > 3 ? `${head} (+${issues.length - 3} more)` : head;
 }
-/**
-* Validate the `update-script` request body. Returns the parsed,
-* schema-conformant script on success, or a human-readable error
-* suitable for sending back as a 400 response.
-*/
-function validateUpdateScriptBody(body) {
+/** Shared prelude: require an object body carrying a non-empty
+*  `filePath`. On success returns the narrowed record + filePath so the
+*  caller reads the remaining fields without re-narrowing. */
+function validateFilePathBody(body) {
 	if (!isRecord(body)) return {
 		ok: false,
 		error: "body must be an object"
@@ -185,11 +209,28 @@ function validateUpdateScriptBody(body) {
 		ok: false,
 		error: "filePath must be a non-empty string"
 	};
-	if (body.script === void 0) return {
+	return {
+		ok: true,
+		value: {
+			record: body,
+			filePath: body.filePath
+		}
+	};
+}
+/**
+* Validate the `update-script` request body. Returns the parsed,
+* schema-conformant script on success, or a human-readable error
+* suitable for sending back as a 400 response.
+*/
+function validateUpdateScriptBody(body) {
+	const base = validateFilePathBody(body);
+	if (!base.ok) return base;
+	const { record, filePath } = base.value;
+	if (record.script === void 0) return {
 		ok: false,
 		error: "script is required"
 	};
-	const parsed = mulmoScriptSchema.safeParse(body.script);
+	const parsed = mulmoScriptSchema.safeParse(record.script);
 	if (!parsed.success) return {
 		ok: false,
 		error: `invalid script: ${formatZodIssues(parsed.error.issues)}`
@@ -197,7 +238,7 @@ function validateUpdateScriptBody(body) {
 	return {
 		ok: true,
 		value: {
-			filePath: body.filePath,
+			filePath,
 			script: parsed.data
 		}
 	};
@@ -208,23 +249,19 @@ function validateUpdateScriptBody(body) {
 * against the actual script length after reading the file.
 */
 function validateUpdateBeatBody(body) {
-	if (!isRecord(body)) return {
-		ok: false,
-		error: "body must be an object"
-	};
-	if (typeof body.filePath !== "string" || body.filePath === "") return {
-		ok: false,
-		error: "filePath must be a non-empty string"
-	};
-	if (typeof body.beatIndex !== "number" || !Number.isInteger(body.beatIndex) || body.beatIndex < 0) return {
+	const base = validateFilePathBody(body);
+	if (!base.ok) return base;
+	const { record, filePath } = base.value;
+	const beatIndex = record.beatIndex;
+	if (typeof beatIndex !== "number" || !Number.isInteger(beatIndex) || beatIndex < 0) return {
 		ok: false,
 		error: "beatIndex must be a non-negative integer"
 	};
-	if (body.beat === void 0) return {
+	if (record.beat === void 0) return {
 		ok: false,
 		error: "beat is required"
 	};
-	const parsed = mulmoBeatSchema.safeParse(body.beat);
+	const parsed = mulmoBeatSchema.safeParse(record.beat);
 	if (!parsed.success) return {
 		ok: false,
 		error: `invalid beat: ${formatZodIssues(parsed.error.issues)}`
@@ -232,8 +269,8 @@ function validateUpdateBeatBody(body) {
 	return {
 		ok: true,
 		value: {
-			filePath: body.filePath,
-			beatIndex: body.beatIndex,
+			filePath,
+			beatIndex,
 			beat: parsed.data
 		}
 	};
@@ -254,9 +291,6 @@ function notFound(error) {
 		error
 	};
 }
-function errorText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
 function stringifyScript(script) {
 	return JSON.stringify(script, null, 2);
 }
@@ -287,7 +321,7 @@ async function loadExistingScript(context, filePath) {
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		return badRequest(`Invalid JSON: ${errorText(err)}`);
+		return badRequest(`Invalid JSON: ${errorMessage(err)}`);
 	}
 	const validation = mulmoScriptSchema.safeParse(parsed);
 	if (!validation.success) return badRequest("File is not a valid MulmoScript");
@@ -333,7 +367,7 @@ async function executeUpdateBeat(context, body) {
 	try {
 		script = JSON.parse(await context.files.artifacts.read(resolved.storyPath));
 	} catch (err) {
-		return badRequest(`Invalid JSON: ${errorText(err)}`);
+		return badRequest(`Invalid JSON: ${errorMessage(err)}`);
 	}
 	if (!Array.isArray(script.beats) || beatIndex >= script.beats.length) return badRequest("Invalid beatIndex");
 	script.beats[beatIndex] = beat;
@@ -382,6 +416,6 @@ var pluginCore = {
 	isEnabled: () => true
 };
 //#endregion
-export { pluginCore as a, normalizeStoryPath as c, TOOL_DEFINITION as d, TOOL_NAME as f, executeUpdateScript as i, slugify as l, executeMulmoScriptSave as n, validateUpdateBeatBody as o, executeUpdateBeat as r, validateUpdateScriptBody as s, executeMulmoScript as t, storyFilePath as u };
+export { pluginCore as a, normalizeStoryPath as c, errorMessage as d, TOOL_DEFINITION as f, executeUpdateScript as i, slugify as l, executeMulmoScriptSave as n, validateUpdateBeatBody as o, TOOL_NAME as p, executeUpdateBeat as r, validateUpdateScriptBody as s, executeMulmoScript as t, storyFilePath as u };
 
-//# sourceMappingURL=plugin-BQyzxkui.js.map
+//# sourceMappingURL=plugin-CXhOP_xU.js.map