@openagentpack/playground 0.0.2 → 0.2.0-beta-ddef91c-20260720

package/dist/bin/playground.js

@@ -3,7 +3,7 @@
 // src/server.ts
 import "@hono/zod-openapi";
 import { readFileSync } from "fs";
-import { dirname as dirname2, join } from "path";
+import { dirname as dirname3, join as join2 } from "path";
 import { fileURLToPath } from "url";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
@@ -1052,109 +1052,6 @@ function localizedDescription(template) {
   return names.zh ?? names.en ?? Object.values(names)[0] ?? template.id;
 }
 
-// ../playbooks/src/session-runtime.ts
-function playbookIdentityMismatchMessage(playbookId) {
-  return `\u73A9\u6CD5\u300C${playbookId}\u300D\u5B58\u5728\u540C\u5E94\u7528\u540C\u540D Agent\uFF0C\u4F46 metadata.${PLAYBOOK_APP_METADATA_KEY}/${PLAYBOOK_METADATA_KEY} \u672A\u5BF9\u4E0A\uFF0C\u7591\u4F3C\u8EAB\u4EFD\u672A\u76D6\u7AE0\uFF1B\u8BF7\u68C0\u67E5\u914D\u7F6E\u800C\u975E\u91CD\u590D\u521B\u5EFA\u3002`;
-}
-var PlaybookAgentIdentityMismatchError = class extends Error {
-  constructor(playbookId) {
-    super(playbookIdentityMismatchMessage(playbookId));
-    this.name = "PlaybookAgentIdentityMismatchError";
-  }
-};
-function pickPlaybookAgent(agents, input) {
-  const matched = agents.filter(
-    (agent2) => (input.includeArchived || !isArchived(agent2)) && agent2.metadata?.[PLAYBOOK_APP_METADATA_KEY] === input.appId && agent2.metadata?.[PLAYBOOK_METADATA_KEY] === input.playbookId
-  );
-  if (matched.length <= 1) {
-    return {
-      agent: matched[0],
-      duplicates: [],
-      identityMismatch: matched.length === 0 && hasSameNameCurrentAppAgent(agents, input)
-    };
-  }
-  const sorted = [...matched].sort((a, b) => epochOf(updatedAtOf(b)) - epochOf(updatedAtOf(a)));
-  const [agent, ...duplicates] = sorted;
-  return { agent, duplicates, identityMismatch: false };
-}
-function createPlaybookSessionRuntime(adapters) {
-  async function findAgent(playbookId) {
-    const [agents, expectedAgentName] = await Promise.all([
-      adapters.agents.listPlaybookAgents({ playbookId, includeArchived: false }),
-      adapters.identity.expectedAgentName?.(playbookId)
-    ]);
-    return pickPlaybookAgent(agents, {
-      playbookId,
-      appId: adapters.identity.appId,
-      expectedAgentName
-    });
-  }
-  return {
-    async list(input) {
-      return adapters.sessions.list(input);
-    },
-    async getDetail(input) {
-      return adapters.sessions.getDetail(input);
-    },
-    async start(input) {
-      const pick = await findAgent(input.playbookId);
-      if (pick.identityMismatch) throw new PlaybookAgentIdentityMismatchError(input.playbookId);
-      if (pick.agent && pick.duplicates.length) {
-        adapters.onDuplicateAgent?.({ playbookId: input.playbookId, winner: pick.agent, duplicates: pick.duplicates });
-      }
-      const agent = await adapters.agents.ensurePlaybookAgent({
-        playbookId: input.playbookId,
-        model: input.model,
-        matched: pick.agent
-      });
-      const started = await adapters.sessions.start({ ...input, remoteAgentId: agent.id });
-      if (started.events) {
-        adapters.events?.attachLiveStream(started.sessionId, started.events, started.completedEvents);
-      } else if (started.completedEvents?.length) {
-        adapters.events?.seedCompleted(started.sessionId, started.completedEvents);
-      }
-      return adapters.sessions.getDetail({
-        sessionId: started.sessionId,
-        playbookId: input.playbookId,
-        remoteAgentId: agent.id
-      });
-    },
-    async send(input) {
-      const sent = await adapters.sessions.send(input);
-      if (sent.events) {
-        adapters.events?.attachLiveStream(sent.sessionId, sent.events, sent.completedEvents);
-      } else if (sent.completedEvents?.length) {
-        adapters.events?.seedCompleted(sent.sessionId, sent.completedEvents);
-      }
-      return adapters.sessions.getDetail({
-        sessionId: sent.sessionId,
-        playbookId: input.playbookId
-      });
-    },
-    async delete(input) {
-      await adapters.sessions.delete(input);
-    }
-  };
-}
-function hasSameNameCurrentAppAgent(agents, input) {
-  if (!input.expectedAgentName) return false;
-  return agents.some(
-    (agent) => !isArchived(agent) && agent.metadata?.[PLAYBOOK_APP_METADATA_KEY] === input.appId && agent.name === input.expectedAgentName
-  );
-}
-function isArchived(agent) {
-  return agent.archivedAt != null || agent.archived_at != null;
-}
-function updatedAtOf(agent) {
-  return agent.updatedAt ?? agent.updated_at;
-}
-function epochOf(value) {
-  if (value == null) return 0;
-  if (typeof value === "number") return value;
-  const parsed = Date.parse(value);
-  return Number.isNaN(parsed) ? 0 : parsed;
-}
-
 // ../playbooks/src/index.ts
 var PLAYBOOK_SOURCES = {
   bailian: bailian_default,
@@ -1314,7 +1211,7 @@ function compileAgentRuntime(playbookId, baseConfig, modelOverride) {
   const config = cloneConfig(baseConfig);
   const resolved = resolveSeedPlaybook(effectiveId, provider);
   const runtimeAgentId = resolved.agent.name;
-  const built = buildAgentDecl(void 0, toAgentBuildInput(resolved, provider, modelOverride));
+  const built = buildAgentDecl(void 0, toAgentBuildInput(resolved, provider, baseConfig, modelOverride));
   config.agents = {
     ...config.agents ?? {},
     [runtimeAgentId]: built.agent
@@ -1373,12 +1270,32 @@ function validateAgent(playbookId, _config) {
 function computeAgentConfigHash(config, agentId) {
   return createHash("sha256").update(stableStringify({ agentId, config })).digest("hex").slice(0, 16);
 }
-function toAgentBuildInput(resolved, provider, modelOverride) {
+function toAgentBuildInput(resolved, provider, baseConfig, modelOverride) {
   const model = resolvePlaybookModel(resolved, provider, modelOverride);
+  const envKeys = Object.keys(baseConfig.environments ?? {});
+  if (envKeys.length !== 1) {
+    throw new Error(
+      `Expected exactly 1 environment in runtime config, got ${envKeys.length}. The agent compile path assumes a single base environment per provider.`
+    );
+  }
+  const environmentName = envKeys[0];
+  const vaultProfile = getVaultProfile(provider);
+  let vaultName;
+  if (vaultProfile) {
+    const vaultKeys = Object.keys(baseConfig.vaults ?? {});
+    if (vaultKeys.length !== 1) {
+      throw new Error(
+        `Expected exactly 1 vault in runtime config for provider '${provider}', got ${vaultKeys.length}. The agent compile path assumes a single base vault per provider.`
+      );
+    }
+    vaultName = vaultKeys[0];
+  }
   return {
     description: resolved.agent.description,
     model,
     instructions: resolved.agent.system,
+    environment: environmentName,
+    vault: vaultName,
     provider,
     builtinTools: resolved.agent.builtinTools,
     skills: resolved.agent.skills.map(
@@ -1458,13 +1375,15 @@ async function buildRuntimeConfig() {
         // Secret value is injected from env here — never stored in playbooks.
         secret_value: requireEnv(cred.secret_name),
         ...cred.networking ? { networking: cred.networking } : {}
-      }))
+      })),
+      metadata: { "agents.vault": "true" }
     }
   } : {};
   const environments = {
     [environment.name]: {
       ...environment.description ? { description: environment.description } : {},
-      config: environment.config
+      config: environment.config,
+      metadata: { "agents.base": "true" }
     }
   };
   const rawConfig = {
@@ -1489,12 +1408,47 @@ function requireEnv(name) {
 }
 
 // ../../apps/server/src/lib/state-scope.ts
-import { resolve } from "path";
+import { copyFileSync, existsSync, mkdirSync, renameSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, resolve } from "path";
 import { LocalFileStateBackend } from "@openagentpack/sdk";
-var DEFAULT_STATE_PATH = "examples/bailian/bailian-cli/agents.state.json";
+var DEFAULT_STATE_PATH = join(homedir(), ".agents", "playground.state.json");
+var LEGACY_STATE_PATH = "examples/bailian/bailian-cli/agents.state.json";
+var migrationChecked = false;
+function ensureMigrated(newPath, cwd) {
+  if (migrationChecked) return;
+  if (existsSync(newPath)) {
+    migrationChecked = true;
+    return;
+  }
+  const legacyPath = resolve(cwd, LEGACY_STATE_PATH);
+  if (!existsSync(legacyPath)) {
+    migrationChecked = true;
+    return;
+  }
+  try {
+    mkdirSync(dirname(newPath), { recursive: true });
+    copyFileSync(legacyPath, newPath);
+    try {
+      renameSync(legacyPath, `${legacyPath}.migrated`);
+    } catch {
+    }
+    migrationChecked = true;
+    console.warn(
+      `[state] Migrated playground state from legacy path:
+         ${legacyPath}
+       \u2192 ${newPath}
+       The legacy file has been renamed to ${legacyPath}.migrated.`
+    );
+  } catch (error) {
+    console.warn(`[state] Failed to migrate legacy state file: ${error instanceof Error ? error.message : error}`);
+  }
+}
 function resolveStatePath(env = process.env, cwd = process.cwd()) {
   const configured = env.AGENTS_STATE_PATH?.trim();
-  return configured ? resolve(cwd, configured) : resolve(cwd, DEFAULT_STATE_PATH);
+  if (configured) return resolve(cwd, configured);
+  ensureMigrated(DEFAULT_STATE_PATH, cwd);
+  return DEFAULT_STATE_PATH;
 }
 function deriveWebUiStateScope() {
   return { projectId: RUNTIME_PROJECT_NAME };
@@ -1633,6 +1587,109 @@ async function importMatchedCloudAgent(input, provider, matched) {
   });
 }
 
+// ../../apps/server/src/services/sessions/playbook-session-adapter/runtime.ts
+function playbookIdentityMismatchMessage(playbookId) {
+  return `\u73A9\u6CD5\u300C${playbookId}\u300D\u5B58\u5728\u540C\u5E94\u7528\u540C\u540D Agent\uFF0C\u4F46 metadata.${PLAYBOOK_APP_METADATA_KEY}/${PLAYBOOK_METADATA_KEY} \u672A\u5BF9\u4E0A\uFF0C\u7591\u4F3C\u8EAB\u4EFD\u672A\u76D6\u7AE0\uFF1B\u8BF7\u68C0\u67E5\u914D\u7F6E\u800C\u975E\u91CD\u590D\u521B\u5EFA\u3002`;
+}
+var PlaybookAgentIdentityMismatchError = class extends Error {
+  constructor(playbookId) {
+    super(playbookIdentityMismatchMessage(playbookId));
+    this.name = "PlaybookAgentIdentityMismatchError";
+  }
+};
+function pickPlaybookAgent(agents, input) {
+  const matched = agents.filter(
+    (agent2) => (input.includeArchived || !isArchived(agent2)) && agent2.metadata?.[PLAYBOOK_APP_METADATA_KEY] === input.appId && agent2.metadata?.[PLAYBOOK_METADATA_KEY] === input.playbookId
+  );
+  if (matched.length <= 1) {
+    return {
+      agent: matched[0],
+      duplicates: [],
+      identityMismatch: matched.length === 0 && hasSameNameCurrentAppAgent(agents, input)
+    };
+  }
+  const sorted = [...matched].sort((a, b) => epochOf(updatedAtOf(b)) - epochOf(updatedAtOf(a)));
+  const [agent, ...duplicates] = sorted;
+  return { agent, duplicates, identityMismatch: false };
+}
+function createPlaybookSessionRuntime(deps) {
+  async function findAgent(playbookId) {
+    const [agents, expectedAgentName] = await Promise.all([
+      deps.agents.listPlaybookAgents({ playbookId, includeArchived: false }),
+      deps.identity.expectedAgentName?.(playbookId)
+    ]);
+    return pickPlaybookAgent(agents, {
+      playbookId,
+      appId: deps.identity.appId,
+      expectedAgentName
+    });
+  }
+  return {
+    async list(input) {
+      return deps.sessions.list(input);
+    },
+    async getDetail(input) {
+      return deps.sessions.getDetail(input);
+    },
+    async start(input) {
+      const pick = await findAgent(input.playbookId);
+      if (pick.identityMismatch) throw new PlaybookAgentIdentityMismatchError(input.playbookId);
+      if (pick.agent && pick.duplicates.length) {
+        deps.onDuplicateAgent?.({ playbookId: input.playbookId, winner: pick.agent, duplicates: pick.duplicates });
+      }
+      const agent = await deps.agents.ensurePlaybookAgent({
+        playbookId: input.playbookId,
+        model: input.model,
+        matched: pick.agent
+      });
+      const started = await deps.sessions.start({ ...input, remoteAgentId: agent.id });
+      if (started.events) {
+        deps.events?.attachLiveStream(started.sessionId, started.events, started.completedEvents);
+      } else if (started.completedEvents?.length) {
+        deps.events?.seedCompleted(started.sessionId, started.completedEvents);
+      }
+      return deps.sessions.getDetail({
+        sessionId: started.sessionId,
+        playbookId: input.playbookId,
+        remoteAgentId: agent.id
+      });
+    },
+    async send(input) {
+      const sent = await deps.sessions.send(input);
+      if (sent.events) {
+        deps.events?.attachLiveStream(sent.sessionId, sent.events, sent.completedEvents);
+      } else if (sent.completedEvents?.length) {
+        deps.events?.seedCompleted(sent.sessionId, sent.completedEvents);
+      }
+      return deps.sessions.getDetail({
+        sessionId: sent.sessionId,
+        playbookId: input.playbookId
+      });
+    },
+    async delete(input) {
+      await deps.sessions.delete(input);
+    }
+  };
+}
+function hasSameNameCurrentAppAgent(agents, input) {
+  if (!input.expectedAgentName) return false;
+  return agents.some(
+    (agent) => !isArchived(agent) && agent.metadata?.[PLAYBOOK_APP_METADATA_KEY] === input.appId && agent.name === input.expectedAgentName
+  );
+}
+function isArchived(agent) {
+  return agent.archivedAt != null || agent.archived_at != null;
+}
+function updatedAtOf(agent) {
+  return agent.updatedAt ?? agent.updated_at;
+}
+function epochOf(value) {
+  if (value == null) return 0;
+  if (typeof value === "number") return value;
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? 0 : parsed;
+}
+
 // ../../apps/server/src/services/sessions/playbook-session-adapter/sessions.ts
 import {
   deleteSession,
@@ -1838,7 +1895,7 @@ function seedCompletedEvents(sessionId, events) {
 }
 
 // ../../apps/server/src/services/sessions/playbook-session-adapter/index.ts
-function createModeAPlaybookSessionRuntime() {
+function createServerPlaybookSessionRuntime() {
   return createPlaybookSessionRuntime({
     identity: {
       appId: getPlaybookAppId(),
@@ -1898,7 +1955,7 @@ function createModeAPlaybookSessionRuntime() {
     onDuplicateAgent({ playbookId, winner, duplicates }) {
       const all = [winner, ...duplicates];
       console.warn(
-        `\u73A9\u6CD5\u300C${playbookId}\u300D\u5339\u914D\u5230 ${all.length} \u4E2A active playbook Agent(${all.map((agent) => agent.id).join(", ")});\u53D6\u6700\u8FD1\u66F4\u65B0\u7684 ${winner.id}\u3002`
+        `\u73A9\u6CD5\u300C${playbookId}\u300D\u5339\u914D\u5230 ${all.length} \u4E2A active playbook Agent(${all.map((agent) => agent.id).join(", ")})\uFF1B\u53D6\u6700\u8FD1\u66F4\u65B0\u7684 ${winner.id}\u3002`
       );
     }
   });
@@ -1918,7 +1975,7 @@ async function updatePlaybookAgentModel(slug, model) {
     throw new UserError2(run.error ?? `Failed to update agent '${input.agentId}' model (status: ${run.status}).`);
   }
 }
-var playbookSessionRuntime = createModeAPlaybookSessionRuntime();
+var playbookSessionRuntime = createServerPlaybookSessionRuntime();
 async function listSessionsForAgent(input) {
   const requestedAgentId = input.agentId?.trim() || void 0;
   const limit = input.limit ?? 50;
@@ -2089,7 +2146,7 @@ import { areRuntimeCredentialsReady, resolveActiveProvider as resolveActiveProvi
 
 // ../../apps/server/src/lib/agents-config.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname } from "path";
+import { dirname as dirname2 } from "path";
 import {
   AGENTS_CONFIG_PROVIDERS,
   AGENTS_PROVIDER_FIELDS,
@@ -2168,17 +2225,20 @@ async function readProviderConfig() {
   }
   const provider = diskConfig.AGENTS_PROVIDER ?? resolveActiveProvider();
   const merged = { AGENTS_PROVIDER: provider };
-  for (const field of AGENTS_PROVIDER_FIELDS[provider]) {
-    const diskValue = diskConfig[field.key]?.trim();
-    const envValue = process.env[field.key]?.trim();
-    merged[field.key] = diskValue || envValue;
+  for (const candidateProvider of AGENTS_CONFIG_PROVIDERS) {
+    for (const field of AGENTS_PROVIDER_FIELDS[candidateProvider]) {
+      const diskValue = diskConfig[field.key]?.trim();
+      const envValue = process.env[field.key]?.trim();
+      const value = diskValue || envValue;
+      if (value) merged[field.key] = value;
+    }
   }
   return merged;
 }
 async function writeProviderConfig(input) {
   const config = validateProviderConfig(input);
   const path = providerConfigPath();
-  await mkdir(dirname(path), { recursive: true });
+  await mkdir(dirname2(path), { recursive: true });
   const payload = { AGENTS_PROVIDER: config.AGENTS_PROVIDER };
   for (const field of AGENTS_PROVIDER_FIELDS[config.AGENTS_PROVIDER]) {
     payload[field.key] = config[field.key];
@@ -2192,7 +2252,7 @@ async function writeProviderConfig(input) {
 // ../../apps/server/src/schemas/config.ts
 import { z as z3 } from "@hono/zod-openapi";
 var AgentsConfigSchema = z3.object({
-  AGENTS_PROVIDER: z3.enum(AGENTS_CONFIG_PROVIDERS2).optional()
+  AGENTS_PROVIDER: z3.enum(AGENTS_CONFIG_PROVIDERS2)
 }).catchall(z3.string()).openapi("AgentsConfig");
 var AgentsConfigSnapshotSchema = z3.object({
   AGENTS_PROVIDER: z3.enum(AGENTS_CONFIG_PROVIDERS2).optional()
@@ -2357,7 +2417,45 @@ environmentsRoute.openapi(deleteEnvironmentRoute, async (c) => {
 });
 
 // ../../apps/server/src/routes/files.ts
-import { OpenAPIHono as OpenAPIHono4 } from "@hono/zod-openapi";
+import { createRoute as createRoute4, OpenAPIHono as OpenAPIHono4 } from "@hono/zod-openapi";
+
+// ../../apps/server/src/schemas/files.ts
+import { z as z5 } from "@hono/zod-openapi";
+var ProviderFileInfoSchema = z5.object({
+  id: z5.string(),
+  filename: z5.string(),
+  mime_type: z5.string(),
+  size_bytes: z5.number(),
+  created_at: z5.string(),
+  downloadable: z5.boolean().optional(),
+  status: z5.string().optional(),
+  purpose: z5.string().optional(),
+  available: z5.boolean().optional()
+}).openapi("ProviderFileInfo");
+var UploadFileFormSchema = z5.object({
+  file: z5.instanceof(File).openapi({ type: "string", format: "binary" })
+});
+var FilesResponseSchema = z5.object({
+  files: z5.array(ProviderFileInfoSchema)
+});
+var FileStatusesBodySchema = z5.object({
+  fileIds: z5.array(z5.string())
+});
+var FileStatusInfoSchema = z5.object({
+  id: z5.string(),
+  status: z5.string().optional(),
+  available: z5.boolean().optional()
+});
+var FileStatusesResponseSchema = z5.object({
+  files: z5.array(FileStatusInfoSchema)
+});
+var FileParamsSchema = z5.object({
+  id: z5.string().min(1)
+});
+var FileDownloadResponseSchema = z5.object({
+  url: z5.string(),
+  expires_at: z5.string().optional()
+});
 
 // ../../apps/server/src/services/files/upload.ts
 import {
@@ -2411,21 +2509,38 @@ async function getUserFileStatuses(fileIds) {
 // ../../apps/server/src/routes/files.ts
 var filesRoute = new OpenAPIHono4();
 var MAX_UPLOAD_BYTES = 100 * 1024 * 1024;
-filesRoute.post("/files", async (c) => {
-  let body;
-  try {
-    body = await c.req.parseBody();
-  } catch (error) {
-    return jsonError(error, 400);
-  }
-  const file = body.file;
-  if (!(file instanceof File) || file.size === 0) {
-    return c.json({ error: { message: "file is required" } }, 400);
-  }
-  if (file.size > MAX_UPLOAD_BYTES) {
-    return c.json({ error: { message: "file too large" } }, 413);
+var uploadFileRoute = createRoute4({
+  method: "post",
+  path: "/files",
+  operationId: "uploadFile",
+  request: {
+    body: {
+      required: true,
+      content: { "multipart/form-data": { schema: UploadFileFormSchema } }
+    }
+  },
+  responses: {
+    201: {
+      description: "Upload a workspace file",
+      content: { "application/json": { schema: ProviderFileInfoSchema } }
+    },
+    413: {
+      description: "File exceeds the upload size limit",
+      content: { "application/json": { schema: ErrorResponseSchema } }
+    },
+    ...errorResponses
   }
-  try {
+});
+filesRoute.openapi(
+  uploadFileRoute,
+  async (c) => {
+    const { file } = c.req.valid("form");
+    if (file.size === 0) {
+      return c.json({ error: { message: "file is required" } }, 400);
+    }
+    if (file.size > MAX_UPLOAD_BYTES) {
+      return c.json({ error: { message: "file too large" } }, 413);
+    }
     const content = new Uint8Array(await file.arrayBuffer());
     const info = await uploadUserFile({
       content,
@@ -2433,80 +2548,109 @@ filesRoute.post("/files", async (c) => {
       mimeType: file.type || void 0
     });
     return c.json(info, 201);
-  } catch (error) {
-    return jsonError(error);
+  },
+  (result, c) => {
+    if (!result.success) return c.json({ error: { message: "file is required" } }, 400);
   }
-});
-filesRoute.get("/files", async (c) => {
-  try {
-    const files = await listUserFiles();
-    return c.json({ files });
-  } catch (error) {
-    return jsonError(error);
+);
+var listFilesRoute = createRoute4({
+  method: "get",
+  path: "/files",
+  operationId: "listFiles",
+  responses: {
+    200: {
+      description: "List workspace files",
+      content: { "application/json": { schema: FilesResponseSchema } }
+    },
+    ...errorResponses
   }
 });
-filesRoute.post("/files/status", async (c) => {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch (error) {
-    return jsonError(error, 400);
-  }
-  const fileIds = body.fileIds;
-  if (!Array.isArray(fileIds) || fileIds.some((id) => typeof id !== "string")) {
-    return c.json({ error: { message: "fileIds (string[]) is required" } }, 400);
-  }
-  try {
-    const files = await getUserFileStatuses(fileIds);
-    return c.json({ files });
-  } catch (error) {
-    return jsonError(error);
+filesRoute.openapi(listFilesRoute, async (c) => {
+  const files = await listUserFiles();
+  return c.json({ files }, 200);
+});
+var getFileStatusesRoute = createRoute4({
+  method: "post",
+  path: "/files/status",
+  operationId: "getFileStatuses",
+  request: {
+    body: {
+      required: true,
+      content: { "application/json": { schema: FileStatusesBodySchema } }
+    }
+  },
+  responses: {
+    200: {
+      description: "Get file scan statuses",
+      content: { "application/json": { schema: FileStatusesResponseSchema } }
+    },
+    ...errorResponses
   }
 });
-filesRoute.get("/files/:id/download", async (c) => {
-  const id = c.req.param("id");
-  if (!id) {
-    return c.json({ error: { message: "file id is required" } }, 400);
+filesRoute.openapi(
+  getFileStatusesRoute,
+  async (c) => {
+    const { fileIds } = c.req.valid("json");
+    const files = await getUserFileStatuses(fileIds);
+    return c.json({ files }, 200);
+  },
+  (result, c) => {
+    if (!result.success) return c.json({ error: { message: "fileIds (string[]) is required" } }, 400);
   }
-  try {
-    const result = await getUserFileDownloadUrl(id);
-    return c.json(result);
-  } catch (error) {
-    return jsonError(error);
+);
+var downloadFileRoute = createRoute4({
+  method: "get",
+  path: "/files/{id}/download",
+  operationId: "downloadFile",
+  request: { params: FileParamsSchema },
+  responses: {
+    200: {
+      description: "Resolve a short-lived file download URL",
+      content: { "application/json": { schema: FileDownloadResponseSchema } }
+    },
+    ...errorResponses
   }
 });
-filesRoute.delete("/files/:id", async (c) => {
-  const id = c.req.param("id");
-  if (!id) {
-    return c.json({ error: { message: "file id is required" } }, 400);
-  }
-  try {
-    await deleteUserFile(id);
-    return c.body(null, 204);
-  } catch (error) {
-    return jsonError(error);
+filesRoute.openapi(downloadFileRoute, async (c) => {
+  const { id } = c.req.valid("param");
+  const result = await getUserFileDownloadUrl(id);
+  return c.json(result, 200);
+});
+var deleteFileRoute = createRoute4({
+  method: "delete",
+  path: "/files/{id}",
+  operationId: "deleteFile",
+  request: { params: FileParamsSchema },
+  responses: {
+    204: { description: "File deleted" },
+    ...errorResponses
   }
 });
+filesRoute.openapi(deleteFileRoute, async (c) => {
+  const { id } = c.req.valid("param");
+  await deleteUserFile(id);
+  return c.body(null, 204);
+});
 
 // ../../apps/server/src/routes/models.ts
-import { createRoute as createRoute4, OpenAPIHono as OpenAPIHono5 } from "@hono/zod-openapi";
+import { createRoute as createRoute5, OpenAPIHono as OpenAPIHono5 } from "@hono/zod-openapi";
 import { listProviderModelsForContext } from "@openagentpack/sdk";
 
 // ../../apps/server/src/schemas/models.ts
-import { z as z5 } from "@hono/zod-openapi";
-var ModelOptionSchema = z5.object({
-  id: z5.string(),
-  display_name: z5.string(),
-  is_enabled: z5.boolean().optional(),
-  is_new: z5.boolean().optional()
+import { z as z6 } from "@hono/zod-openapi";
+var ModelOptionSchema = z6.object({
+  id: z6.string(),
+  display_name: z6.string(),
+  is_enabled: z6.boolean().optional(),
+  is_new: z6.boolean().optional()
 });
-var ModelsResponseSchema = z5.object({
-  models: z5.array(ModelOptionSchema)
+var ModelsResponseSchema = z6.object({
+  models: z6.array(ModelOptionSchema)
 });
 
 // ../../apps/server/src/routes/models.ts
 var modelsRoute = new OpenAPIHono5();
-var listModelsRoute = createRoute4({
+var listModelsRoute = createRoute5({
   method: "get",
   path: "/models",
   responses: {
@@ -2534,73 +2678,72 @@ modelsRoute.openapi(listModelsRoute, async (c) => {
 });
 
 // ../../apps/server/src/routes/sessions/index.ts
-import { createRoute as createRoute9, OpenAPIHono as OpenAPIHono10 } from "@hono/zod-openapi";
+import { createRoute as createRoute10, OpenAPIHono as OpenAPIHono10 } from "@hono/zod-openapi";
 
 // ../../apps/server/src/schemas/sessions.ts
-import { z as z6 } from "@hono/zod-openapi";
+import { z as z7 } from "@hono/zod-openapi";
 import { SessionEventSchema, SessionSchema } from "@openagentpack/sdk";
-var SessionListResponseSchema = z6.object({
-  data: z6.array(SessionSchema),
-  next_page_token: z6.string().nullish()
+var SessionListResponseSchema = z7.object({
+  data: z7.array(SessionSchema),
+  next_page_token: z7.string().nullish()
 }).openapi("SessionListResponse");
-var SessionDetailResponseSchema = z6.object({
+var SessionDetailResponseSchema = z7.object({
   session: SessionSchema,
-  events: z6.array(SessionEventSchema),
-  events_next_page_token: z6.string().nullish()
+  events: z7.array(SessionEventSchema),
+  events_next_page_token: z7.string().nullish()
 }).openapi("SessionDetailResponse");
-var SessionEventsPageResponseSchema = z6.object({
-  events: z6.array(SessionEventSchema),
-  events_next_page_token: z6.string().nullish()
+var SessionEventsPageResponseSchema = z7.object({
+  events: z7.array(SessionEventSchema),
+  events_next_page_token: z7.string().nullish()
 }).openapi("SessionEventsPageResponse");
-var SessionDeleteResponseSchema = z6.object({
-  session_id: z6.string(),
-  deleted: z6.boolean()
+var SessionDeleteResponseSchema = z7.object({
+  session_id: z7.string(),
+  deleted: z7.boolean()
 }).openapi("SessionDeleteResponse");
-var SessionsQuerySchema = z6.object({
+var SessionsQuerySchema = z7.object({
   // Non-numeric values resolve to `undefined` so the handler clamps to a
   // default instead of the request being rejected with a 400.
-  limit: z6.preprocess((value) => {
+  limit: z7.preprocess((value) => {
     const parsed = Number(value);
     return Number.isFinite(parsed) ? parsed : void 0;
-  }, z6.number().int().optional()),
-  agentId: z6.string().optional(),
+  }, z7.number().int().optional()),
+  agentId: z7.string().optional(),
   // Opaque cursor for the next page (provider's next_page / next_page_token, passed through verbatim).
-  pageToken: z6.string().optional()
+  pageToken: z7.string().optional()
 });
-var SessionDetailQuerySchema = z6.object({
-  agentId: z6.string().optional()
+var SessionDetailQuerySchema = z7.object({
+  agentId: z7.string().optional()
 });
-var SessionEventsQuerySchema = z6.object({
-  agentId: z6.string().optional(),
-  pageToken: z6.string().optional(),
-  limit: z6.preprocess((value) => {
+var SessionEventsQuerySchema = z7.object({
+  agentId: z7.string().optional(),
+  pageToken: z7.string().optional(),
+  limit: z7.preprocess((value) => {
     const parsed = Number(value);
     return Number.isFinite(parsed) ? parsed : void 0;
-  }, z6.number().int().optional())
+  }, z7.number().int().optional())
 });
-var SessionParamsSchema = z6.object({
-  sessionId: z6.string()
+var SessionParamsSchema = z7.object({
+  sessionId: z7.string()
 });
-var CreateSessionBodySchema = z6.object({
-  agentId: z6.string(),
-  prompt: z6.string().min(1),
-  // Required: a session must be pinned to a cloud environment (sandbox). Both transports
-  // enforce this so Mode A (REST/OpenAPI) and Mode B (console) reject env-less creates.
-  environmentId: z6.string().min(1),
+var CreateSessionBodySchema = z7.object({
+  agentId: z7.string(),
+  prompt: z7.string().min(1),
+  // Required: a session must be pinned to a cloud environment (sandbox).
+  environmentId: z7.string().min(1),
   // Optional: cloud vault ids to bind a user-supplied credential so the sandbox receives it.
   // Top-level binding shape matches the console createSession.
-  vaultIds: z6.array(z6.string()).optional(),
-  title: z6.string().optional(),
+  vaultIds: z7.array(z7.string()).optional(),
+  title: z7.string().optional(),
   // Uploaded files to mount as session resources so the task can read the user's files.
   // Each file needs a mount_path (provider rejects a file resource without one).
-  files: z6.array(z6.object({ fileId: z6.string(), mountPath: z6.string() })).optional(),
+  files: z7.array(z7.object({ fileId: z7.string(), mountPath: z7.string() })).optional(),
   // Model the agent should run for this session. If present, createSession applies it
   // to the agent config immediately before starting the run.
-  model: z6.string().optional()
+  model: z7.string().optional()
 });
-var SendMessageBodySchema = z6.object({
-  agentId: z6.string().optional(),
-  message: z6.string().min(1)
+var SendMessageBodySchema = z7.object({
+  agentId: z7.string().optional(),
+  message: z7.string().min(1)
 });
 
 // ../../apps/server/src/services/sessions/event-sanitizer.ts
@@ -2611,9 +2754,9 @@ function shouldIncludeDebugRaw(request) {
 }
 
 // ../../apps/server/src/routes/sessions/detail.ts
-import { createRoute as createRoute5, OpenAPIHono as OpenAPIHono6 } from "@hono/zod-openapi";
+import { createRoute as createRoute6, OpenAPIHono as OpenAPIHono6 } from "@hono/zod-openapi";
 var sessionsDetailRoute = new OpenAPIHono6();
-var getSessionRoute = createRoute5({
+var getSessionRoute = createRoute6({
   method: "get",
   path: "/sessions/{sessionId}",
   request: {
@@ -2642,7 +2785,7 @@ sessionsDetailRoute.openapi(getSessionRoute, async (c) => {
     200
   );
 });
-var deleteSessionRoute = createRoute5({
+var deleteSessionRoute = createRoute6({
   method: "delete",
   path: "/sessions/{sessionId}",
   request: {
@@ -2665,9 +2808,9 @@ sessionsDetailRoute.openapi(deleteSessionRoute, async (c) => {
 });
 
 // ../../apps/server/src/routes/sessions/events.ts
-import { createRoute as createRoute6, OpenAPIHono as OpenAPIHono7 } from "@hono/zod-openapi";
+import { createRoute as createRoute7, OpenAPIHono as OpenAPIHono7 } from "@hono/zod-openapi";
 var sessionsEventsRoute = new OpenAPIHono7();
-var listSessionEventsRoute = createRoute6({
+var listSessionEventsRoute = createRoute7({
   method: "get",
   path: "/sessions/{sessionId}/events",
   request: {
@@ -2704,9 +2847,9 @@ sessionsEventsRoute.openapi(listSessionEventsRoute, async (c) => {
 });
 
 // ../../apps/server/src/routes/sessions/messages.ts
-import { createRoute as createRoute7, OpenAPIHono as OpenAPIHono8 } from "@hono/zod-openapi";
+import { createRoute as createRoute8, OpenAPIHono as OpenAPIHono8 } from "@hono/zod-openapi";
 var sessionsMessagesRoute = new OpenAPIHono8();
-var sendMessageRoute = createRoute7({
+var sendMessageRoute = createRoute8({
   method: "post",
   path: "/sessions/{sessionId}/messages",
   request: {
@@ -2735,15 +2878,15 @@ sessionsMessagesRoute.openapi(sendMessageRoute, async (c) => {
 });
 
 // ../../apps/server/src/routes/sessions/stream.ts
-import { createRoute as createRoute8, OpenAPIHono as OpenAPIHono9, z as z7 } from "@hono/zod-openapi";
+import { createRoute as createRoute9, OpenAPIHono as OpenAPIHono9, z as z8 } from "@hono/zod-openapi";
 var sessionsStreamRoute = new OpenAPIHono9();
-var SessionStreamQuerySchema = z7.object({
-  after: z7.preprocess((value) => {
+var SessionStreamQuerySchema = z8.object({
+  after: z8.preprocess((value) => {
     const parsed = Number(value);
     return Number.isFinite(parsed) ? parsed : void 0;
-  }, z7.number().int().optional())
+  }, z8.number().int().optional())
 });
-var streamSessionRoute = createRoute8({
+var streamSessionRoute = createRoute9({
   method: "get",
   path: "/sessions/{sessionId}/stream",
   request: {
@@ -2755,7 +2898,7 @@ var streamSessionRoute = createRoute8({
       description: "Stream session events as Server-Sent Events",
       content: {
         "text/event-stream": {
-          schema: z7.string().openapi({
+          schema: z8.string().openapi({
             description: 'SSE frames with event types "event", "done", and "ping".'
           })
         }
@@ -2866,7 +3009,7 @@ data: ${data}
 
 // ../../apps/server/src/routes/sessions/index.ts
 var sessionsRoute = new OpenAPIHono10();
-var listSessionsRoute = createRoute9({
+var listSessionsRoute = createRoute10({
   method: "get",
   path: "/sessions",
   request: {
@@ -2892,7 +3035,7 @@ sessionsRoute.openapi(listSessionsRoute, async (c) => {
   });
   return c.json({ data: sessions, next_page_token: nextPageToken ?? null }, 200);
 });
-var createSessionRoute = createRoute9({
+var createSessionRoute = createRoute10({
   method: "post",
   path: "/sessions",
   request: {
@@ -2934,7 +3077,52 @@ sessionsRoute.route("/", sessionsMessagesRoute);
 sessionsRoute.route("/", sessionsStreamRoute);
 
 // ../../apps/server/src/routes/skills.ts
-import { OpenAPIHono as OpenAPIHono11 } from "@hono/zod-openapi";
+import { createRoute as createRoute11, OpenAPIHono as OpenAPIHono11 } from "@hono/zod-openapi";
+
+// ../../apps/server/src/schemas/skills.ts
+import { z as z9 } from "@hono/zod-openapi";
+var ProviderSkillInfoSchema = z9.object({
+  id: z9.string(),
+  name: z9.string(),
+  description: z9.string().optional(),
+  source: z9.enum(["custom", "official"]),
+  status: z9.enum(["checking", "active", "rejected", "deleted"]),
+  latest_version: z9.string().optional(),
+  created_at: z9.string().optional(),
+  updated_at: z9.string().optional()
+}).openapi("ProviderSkillInfo");
+var UploadSkillFileFormSchema = z9.object({
+  file: z9.instanceof(File).openapi({ type: "string", format: "binary" })
+});
+var CreateSkillBodySchema = z9.object({
+  fileId: z9.string().min(1)
+});
+var WarmSkillBodySchema = z9.object({
+  name: z9.string().min(1),
+  url: z9.string().min(1)
+});
+var WarmSkillResponseSchema = z9.object({
+  ok: z9.literal(true)
+});
+var SkillsQuerySchema = z9.object({
+  source: z9.enum(["custom", "official"]).optional()
+});
+var SkillsResponseSchema = z9.object({
+  skills: z9.array(ProviderSkillInfoSchema)
+});
+var SkillStatusesBodySchema = z9.object({
+  skillIds: z9.array(z9.string())
+});
+var SkillStatusInfoSchema = z9.object({
+  id: z9.string(),
+  status: z9.enum(["checking", "active", "rejected", "deleted"]).optional()
+});
+var SkillStatusesResponseSchema = z9.object({
+  skills: z9.array(SkillStatusInfoSchema)
+});
+var SkillParamsSchema = z9.object({
+  id: z9.string().min(1)
+});
 
 // ../../apps/server/src/services/skills/manage.ts
 import {
@@ -3036,145 +3224,208 @@ async function warmSkillByUrl(name, url) {
 // ../../apps/server/src/routes/skills.ts
 var skillsRoute = new OpenAPIHono11();
 var MAX_UPLOAD_BYTES2 = 100 * 1024 * 1024;
-skillsRoute.post("/skills/upload-file", async (c) => {
-  let body;
-  try {
-    body = await c.req.parseBody();
-  } catch (error) {
-    return jsonError(error, 400);
-  }
-  const file = body.file;
-  if (!(file instanceof File) || file.size === 0) {
-    return c.json({ error: { message: "file is required" } }, 400);
-  }
-  if (!file.name.toLowerCase().endsWith(".zip")) {
-    return c.json({ error: { message: "skill file must be a .zip" } }, 400);
-  }
-  if (file.size > MAX_UPLOAD_BYTES2) {
-    return c.json({ error: { message: "file too large" } }, 413);
+var uploadSkillFileRoute = createRoute11({
+  method: "post",
+  path: "/skills/upload-file",
+  operationId: "uploadSkillFile",
+  request: {
+    body: {
+      required: true,
+      content: { "multipart/form-data": { schema: UploadSkillFileFormSchema } }
+    }
+  },
+  responses: {
+    201: {
+      description: "Upload a skill archive as a file pending audit",
+      content: { "application/json": { schema: ProviderFileInfoSchema } }
+    },
+    413: {
+      description: "Skill archive exceeds the upload size limit",
+      content: { "application/json": { schema: ErrorResponseSchema } }
+    },
+    ...errorResponses
   }
-  try {
+});
+skillsRoute.openapi(
+  uploadSkillFileRoute,
+  async (c) => {
+    const { file } = c.req.valid("form");
+    if (file.size === 0) return c.json({ error: { message: "file is required" } }, 400);
+    if (!file.name.toLowerCase().endsWith(".zip")) {
+      return c.json({ error: { message: "skill file must be a .zip" } }, 400);
+    }
+    if (file.size > MAX_UPLOAD_BYTES2) return c.json({ error: { message: "file too large" } }, 413);
     const content = new Uint8Array(await file.arrayBuffer());
     const info = await uploadUserSkillFile({ content, filename: file.name });
     return c.json(info, 201);
-  } catch (error) {
-    return jsonError(error);
-  }
-});
-skillsRoute.post("/skills", async (c) => {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch (error) {
-    return jsonError(error, 400);
+  },
+  (result, c) => {
+    if (!result.success) return c.json({ error: { message: "file is required" } }, 400);
   }
-  const fileId = body.fileId;
-  if (typeof fileId !== "string" || fileId.length === 0) {
-    return c.json({ error: { message: "fileId is required" } }, 400);
+);
+var createSkillRoute = createRoute11({
+  method: "post",
+  path: "/skills",
+  operationId: "createSkill",
+  request: {
+    body: {
+      required: true,
+      content: { "application/json": { schema: CreateSkillBodySchema } }
+    }
+  },
+  responses: {
+    201: {
+      description: "Create a skill from an audited file",
+      content: { "application/json": { schema: ProviderSkillInfoSchema } }
+    },
+    ...errorResponses
   }
-  try {
+});
+skillsRoute.openapi(
+  createSkillRoute,
+  async (c) => {
+    const { fileId } = c.req.valid("json");
     const info = await createUserSkillFromFile(fileId);
     return c.json(info, 201);
-  } catch (error) {
-    return jsonError(error);
-  }
-});
-skillsRoute.post("/skills/warm", async (c) => {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch (error) {
-    return jsonError(error, 400);
+  },
+  (result, c) => {
+    if (!result.success) return c.json({ error: { message: "fileId is required" } }, 400);
   }
-  const { name, url } = body;
-  if (typeof name !== "string" || !name || typeof url !== "string" || !url) {
-    return c.json({ error: { message: "name and url are required" } }, 400);
+);
+var warmSkillRoute = createRoute11({
+  method: "post",
+  path: "/skills/warm",
+  operationId: "warmSkill",
+  request: {
+    body: {
+      required: true,
+      content: { "application/json": { schema: WarmSkillBodySchema } }
+    }
+  },
+  responses: {
+    200: {
+      description: "Warm a custom skill until it is active",
+      content: { "application/json": { schema: WarmSkillResponseSchema } }
+    },
+    ...errorResponses
   }
-  try {
+});
+skillsRoute.openapi(
+  warmSkillRoute,
+  async (c) => {
+    const { name, url } = c.req.valid("json");
     await warmSkillByUrl(name, url);
     return c.json({ ok: true }, 200);
-  } catch (error) {
-    return jsonError(error);
-  }
-});
-skillsRoute.get("/skills", async (c) => {
-  const source = c.req.query("source");
-  if (source !== void 0 && source !== "custom" && source !== "official") {
-    return c.json({ error: { message: "source must be 'custom' or 'official'" } }, 400);
+  },
+  (result, c) => {
+    if (!result.success) return c.json({ error: { message: "name and url are required" } }, 400);
   }
-  try {
-    const skills = await listUserSkills(source);
-    return c.json({ skills });
-  } catch (error) {
-    return jsonError(error);
+);
+var listSkillsRoute = createRoute11({
+  method: "get",
+  path: "/skills",
+  operationId: "listSkills",
+  request: { query: SkillsQuerySchema },
+  responses: {
+    200: {
+      description: "List custom or official skills",
+      content: { "application/json": { schema: SkillsResponseSchema } }
+    },
+    ...errorResponses
   }
 });
-skillsRoute.post("/skills/status", async (c) => {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch (error) {
-    return jsonError(error, 400);
-  }
-  const skillIds = body.skillIds;
-  if (!Array.isArray(skillIds) || skillIds.some((id) => typeof id !== "string")) {
-    return c.json({ error: { message: "skillIds (string[]) is required" } }, 400);
+skillsRoute.openapi(
+  listSkillsRoute,
+  async (c) => {
+    const { source } = c.req.valid("query");
+    const skills = await listUserSkills(source);
+    return c.json({ skills }, 200);
+  },
+  (result, c) => {
+    if (!result.success) {
+      return c.json({ error: { message: "source must be 'custom' or 'official'" } }, 400);
+    }
   }
-  try {
-    const skills = await getUserSkillStatuses(skillIds);
-    return c.json({ skills });
-  } catch (error) {
-    return jsonError(error);
+);
+var getSkillStatusesRoute = createRoute11({
+  method: "post",
+  path: "/skills/status",
+  operationId: "getSkillStatuses",
+  request: {
+    body: {
+      required: true,
+      content: { "application/json": { schema: SkillStatusesBodySchema } }
+    }
+  },
+  responses: {
+    200: {
+      description: "Get skill scan statuses",
+      content: { "application/json": { schema: SkillStatusesResponseSchema } }
+    },
+    ...errorResponses
   }
 });
-skillsRoute.delete("/skills/:id", async (c) => {
-  const id = c.req.param("id");
-  if (!id) {
-    return c.json({ error: { message: "skill id is required" } }, 400);
+skillsRoute.openapi(
+  getSkillStatusesRoute,
+  async (c) => {
+    const { skillIds } = c.req.valid("json");
+    const skills = await getUserSkillStatuses(skillIds);
+    return c.json({ skills }, 200);
+  },
+  (result, c) => {
+    if (!result.success) return c.json({ error: { message: "skillIds (string[]) is required" } }, 400);
   }
-  try {
-    await deleteUserSkill(id);
-    return c.body(null, 204);
-  } catch (error) {
-    return jsonError(error);
+);
+var deleteSkillRoute = createRoute11({
+  method: "delete",
+  path: "/skills/{id}",
+  operationId: "deleteSkill",
+  request: { params: SkillParamsSchema },
+  responses: {
+    204: { description: "Skill deleted" },
+    ...errorResponses
   }
 });
+skillsRoute.openapi(deleteSkillRoute, async (c) => {
+  const { id } = c.req.valid("param");
+  await deleteUserSkill(id);
+  return c.body(null, 204);
+});
 
 // ../../apps/server/src/routes/vaults.ts
-import { createRoute as createRoute10, OpenAPIHono as OpenAPIHono12 } from "@hono/zod-openapi";
+import { createRoute as createRoute12, OpenAPIHono as OpenAPIHono12 } from "@hono/zod-openapi";
 import { createCloudVault, deleteCloudVault, listCloudVaults } from "@openagentpack/sdk";
 
 // ../../apps/server/src/schemas/vaults.ts
-import { z as z8 } from "@hono/zod-openapi";
+import { z as z10 } from "@hono/zod-openapi";
 import { CloudVaultSchema } from "@openagentpack/sdk";
 import { CloudVaultSchema as CloudVaultSchema2 } from "@openagentpack/sdk";
-var CloudVaultsResponseSchema = z8.object({
-  vaults: z8.array(CloudVaultSchema)
+var CloudVaultsResponseSchema = z10.object({
+  vaults: z10.array(CloudVaultSchema)
 });
-var CreateVaultBodySchema = z8.object({
-  name: z8.string().min(1),
-  metadata: z8.record(z8.string(), z8.string()).optional(),
-  // The DASHSCOPE_API_KEY stored as the vault's credential secret value. Optional: Mode B
-  // supplies the user's key; Mode A (local) omits it and the server injects it from its own
-  // DASHSCOPE_API_KEY env. (Mode B never reaches this REST route — it goes via console RPC.)
-  key: z8.string().min(1).optional()
+var CreateVaultBodySchema = z10.object({
+  name: z10.string().min(1),
+  metadata: z10.record(z10.string(), z10.string()).optional(),
+  // The DASHSCOPE_API_KEY stored as the vault's credential secret value. Optional:
+  // when omitted the server injects it from its own DASHSCOPE_API_KEY env.
+  key: z10.string().min(1).optional()
 });
-var CreateVaultResponseSchema = z8.object({
-  id: z8.string().nullable(),
-  type: z8.string(),
-  version: z8.number().optional()
+var CreateVaultResponseSchema = z10.object({
+  id: z10.string().nullable(),
+  type: z10.string(),
+  version: z10.number().optional()
 });
-var DeleteVaultResponseSchema = z8.object({
-  id: z8.string(),
-  type: z8.string()
+var DeleteVaultResponseSchema = z10.object({
+  id: z10.string(),
+  type: z10.string()
 });
-var VaultParamsSchema = z8.object({
-  vaultId: z8.string().min(1)
+var VaultParamsSchema = z10.object({
+  vaultId: z10.string().min(1)
 });
 
 // ../../apps/server/src/routes/vaults.ts
 var vaultsRoute = new OpenAPIHono12();
-var listVaultsRoute = createRoute10({
+var listVaultsRoute = createRoute12({
   method: "get",
   path: "/vaults",
   responses: {
@@ -3189,7 +3440,7 @@ vaultsRoute.openapi(listVaultsRoute, async (c) => {
   const vaults = await withAgentRuntime(DEFAULT_AGENT_ID, (ctx) => listCloudVaults(ctx));
   return c.json({ vaults }, 200);
 });
-var createVaultRoute = createRoute10({
+var createVaultRoute = createRoute12({
   method: "post",
   path: "/vaults",
   request: {
@@ -3217,8 +3468,8 @@ vaultsRoute.openapi(createVaultRoute, async (c) => {
   const vault = await withAgentRuntime(
     DEFAULT_AGENT_ID,
     (ctx) => createCloudVault(ctx, name, {
-      // display_name carries the base-vault identity (Agents/secrets) — a vault has no
-      // separate `name` field, so findBaseVault nets it by display_name + the stamp.
+      // display_name is used as the vault's human-readable label on the provider.
+      // findBaseVault identifies the managed vault by its metadata stamp (agents.vault).
       display_name: name,
       metadata,
       credentials: structure.credentials.map((cred) => ({
@@ -3232,7 +3483,7 @@ vaultsRoute.openapi(createVaultRoute, async (c) => {
   );
   return c.json(vault, 200);
 });
-var deleteVaultRoute = createRoute10({
+var deleteVaultRoute = createRoute12({
   method: "delete",
   path: "/vaults/{vaultId}",
   request: {
@@ -3318,8 +3569,8 @@ async function resolveListenPort(preferred, maxAttempts = MAX_PORT_ATTEMPTS) {
 
 // src/server.ts
 var DEFAULT_PLAYGROUND_PORT = 4848;
-var webRoot = join(dirname2(fileURLToPath(import.meta.url)), "../../web");
-var indexHtml = injectPlaygroundRuntimeMarker(readFileSync(join(webRoot, "index.html"), "utf8"));
+var webRoot = join2(dirname3(fileURLToPath(import.meta.url)), "../../web");
+var indexHtml = injectPlaygroundRuntimeMarker(readFileSync(join2(webRoot, "index.html"), "utf8"));
 function injectPlaygroundRuntimeMarker(html) {
   if (html.includes('name="agents-runtime"')) return html;
   return html.replace("<head>", '<head>\n    <meta name="agents-runtime" content="playground" />');