@runcofactor/cli 0.10.0 → 0.15.0

package/dist/chunk-CMGI7UZD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/login.ts"],"sourcesContent":["import process from \"node:process\";\nimport readline from \"node:readline\";\nimport { spawn } from \"node:child_process\";\nimport { saveAuth, ENV_URLS, envToProfile, getArgValue } from \"./auth\";\nimport { readBrandEnv } from \"./brand.js\";\n\nexport type StartResponse = {\n  ok: boolean;\n  deviceCode?: string;\n  userCode?: string;\n  verificationUrl?: string;\n  expiresAt?: string;\n  intervalSeconds?: number;\n  error?: string;\n};\n\nexport type PollResponse = {\n  ok: boolean;\n  status?: \"pending\" | \"approved\" | \"rejected\" | \"expired\";\n  accessToken?: string;\n  orgId?: string;\n  error?: string;\n};\n\nexport type OrgsResponse = {\n  ok: boolean;\n  currentOrgId?: string;\n  organizations?: Array<{ id: string; name: string; role: string }>;\n  error?: string;\n};\n\nexport type SwitchOrgResponse = {\n  ok: boolean;\n  accessToken?: string;\n  orgId?: string;\n  orgName?: string;\n  role?: string;\n  error?: string;\n};\n\nfunction shouldOpenBrowser(argv: string[]): boolean {\n  return !argv.includes(\"--no-open\");\n}\n\nexport function openUrl(url: string) {\n  const platform = process.platform;\n  if (platform === \"darwin\") {\n    spawn(\"open\", [url], { stdio: \"ignore\" });\n    return;\n  }\n  if (platform === \"win32\") {\n    spawn(\"cmd\", [\"/c\", \"start\", \"\", url], { stdio: \"ignore\" });\n    return;\n  }\n  spawn(\"xdg-open\", [url], { stdio: \"ignore\" });\n}\n\nfunction promptChoice(question: string): Promise<string> {\n  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n  return new Promise((resolve) => {\n    rl.question(question, (answer) => {\n      rl.close();\n      resolve(answer.trim());\n    });\n  });\n}\n\nexport async function fetchOrgs(apiUrl: string, token: string): Promise<OrgsResponse | null> {\n  try {\n    const res = await fetch(`${apiUrl}/cli-login/orgs`, {\n      headers: { Authorization: `Bearer ${token}` },\n    });\n    if (!res.ok) return null;\n    return (await res.json()) as OrgsResponse;\n  } catch {\n    return null;\n  }\n}\n\nexport async function switchOrg(apiUrl: string, token: string, orgId: string): Promise<SwitchOrgResponse> {\n  const res = await fetch(`${apiUrl}/cli-login/switch-org`, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${token}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({ orgId }),\n  });\n  return (await res.json()) as SwitchOrgResponse;\n}\n\nexport async function runLogin(argv: string[]) {\n  const env = getArgValue(argv, \"--env\");\n  const envUrls = env ? ENV_URLS[env] : undefined;\n\n  if (env && !envUrls) {\n    console.error(`Unknown environment: ${env}`);\n    console.error(\"Valid environments: prod, dev, local\");\n    process.exit(1);\n  }\n\n  const apiUrl =\n    getArgValue(argv, \"--api-url\") ??\n    envUrls?.api ??\n    readBrandEnv(\"CANARY_API_URL\") ??\n    \"https://api.trycanary.ai\";\n  const appUrl =\n    getArgValue(argv, \"--app-url\") ??\n    envUrls?.app ??\n    process.env.CANARY_APP_URL ??\n    \"https://app.trycanary.ai\";\n\n  const orgFlag = getArgValue(argv, \"--org\");\n\n  const startRes = await fetch(`${apiUrl}/cli-login/start`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({ appUrl }),\n  });\n\n  const startJson = (await startRes.json()) as StartResponse;\n  if (!startRes.ok || !startJson.ok || !startJson.deviceCode || !startJson.userCode) {\n    console.error(\"Login start failed\", startJson.error ?? startRes.statusText);\n    process.exit(1);\n  }\n\n  console.log(\"Login required.\");\n  console.log(`User code: ${startJson.userCode}`);\n  if (startJson.verificationUrl) {\n    console.log(`Open: ${startJson.verificationUrl}`);\n    if (shouldOpenBrowser(argv)) {\n      try {\n        openUrl(startJson.verificationUrl);\n      } catch {\n        console.log(\"Unable to open browser automatically. Please open the URL manually.\");\n      }\n    }\n  }\n\n  const intervalMs = (startJson.intervalSeconds ?? 3) * 1000;\n  const expiresAt = startJson.expiresAt ? new Date(startJson.expiresAt).getTime() : null;\n\n  let token: string | undefined;\n  let initialOrgId: string | undefined;\n\n  while (true) {\n    if (expiresAt && Date.now() > expiresAt) {\n      console.error(\"Login code expired.\");\n      process.exit(1);\n    }\n\n    await new Promise((resolve) => setTimeout(resolve, intervalMs));\n\n    const pollRes = await fetch(`${apiUrl}/cli-login/poll`, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify({ deviceCode: startJson.deviceCode }),\n    });\n\n    const pollJson = (await pollRes.json()) as PollResponse;\n    if (!pollRes.ok || !pollJson.ok) {\n      console.error(\"Login poll failed\", pollJson.error ?? pollRes.statusText);\n      process.exit(1);\n    }\n\n    if (pollJson.status === \"approved\" && pollJson.accessToken) {\n      token = pollJson.accessToken;\n      initialOrgId = pollJson.orgId;\n      break;\n    }\n\n    if (pollJson.status === \"rejected\") {\n      console.error(\"Login rejected.\");\n      process.exit(1);\n    }\n\n    if (pollJson.status === \"expired\") {\n      console.error(\"Login expired.\");\n      process.exit(1);\n    }\n  }\n\n  // Fetch user's organizations (gracefully skip if endpoint not available)\n  const orgsData = await fetchOrgs(apiUrl, token);\n  const orgs = orgsData?.organizations ?? [];\n\n  let finalToken = token;\n  let finalOrgId = initialOrgId;\n  let finalOrgName: string | undefined;\n\n  if (orgs.length <= 1) {\n    // Single org (or none) — use as-is\n    finalOrgName = orgs[0]?.name;\n  } else {\n    // Multiple orgs — determine which one to use\n    let selectedOrg: (typeof orgs)[number] | undefined;\n\n    if (orgFlag) {\n      // Match --org flag by name (case-insensitive) or ID\n      selectedOrg = orgs.find(\n        (o) => o.name.toLowerCase() === orgFlag.toLowerCase() || o.id === orgFlag\n      );\n      if (!selectedOrg) {\n        console.error(`Organization \"${orgFlag}\" not found. Available orgs:`);\n        for (const o of orgs) {\n          console.error(`  - ${o.name} (${o.id})`);\n        }\n        process.exit(1);\n      }\n    } else if (process.stdin.isTTY) {\n      // Interactive prompt\n      console.log(\"\\nYou belong to multiple organizations. Select one:\");\n      for (let i = 0; i < orgs.length; i++) {\n        const marker = orgs[i].id === initialOrgId ? \" (current)\" : \"\";\n        console.log(`  ${i + 1}. ${orgs[i].name}${marker}`);\n      }\n\n      const answer = await promptChoice(`\\nChoice [1-${orgs.length}]: `);\n      const idx = parseInt(answer, 10) - 1;\n      if (isNaN(idx) || idx < 0 || idx >= orgs.length) {\n        console.error(\"Invalid selection.\");\n        process.exit(1);\n      }\n      selectedOrg = orgs[idx];\n    } else {\n      // Non-interactive — use default from JWT\n      const defaultOrg = orgs.find((o) => o.id === initialOrgId);\n      console.log(\n        `Warning: Multiple organizations available but running non-interactively. Using \"${defaultOrg?.name ?? initialOrgId}\".`\n      );\n      console.log('Tip: Use --org <name> to select a specific organization.');\n      selectedOrg = defaultOrg;\n    }\n\n    if (selectedOrg && selectedOrg.id !== initialOrgId) {\n      // Switch to selected org\n      const switchRes = await switchOrg(apiUrl, token, selectedOrg.id);\n      if (!switchRes.ok || !switchRes.accessToken) {\n        console.error(\"Failed to switch organization:\", switchRes.error ?? \"Unknown error\");\n        process.exit(1);\n      }\n      finalToken = switchRes.accessToken;\n      finalOrgId = switchRes.orgId;\n      finalOrgName = switchRes.orgName;\n    } else if (selectedOrg) {\n      finalOrgName = selectedOrg.name;\n    }\n  }\n\n  const profileName = env ? envToProfile(env) : undefined;\n  const filePath = await saveAuth({ token: finalToken, apiUrl, orgId: finalOrgId, orgName: finalOrgName }, profileName);\n  const displayName = finalOrgName ? ` to ${finalOrgName}` : \"\";\n  const profileLabel = profileName ? ` (profile: ${profileName})` : \"\";\n  console.log(`Login successful${displayName}${profileLabel}. Token saved to ${filePath}`);\n  console.log(\"Set CANARY_API_TOKEN to use the CLI without re-login.\");\n}\n"],"mappings":";;;;;;;;;;;;AAAA,OAAO,aAAa;AACpB,OAAO,cAAc;AACrB,SAAS,aAAa;AAsCtB,SAAS,kBAAkB,MAAyB;AAClD,SAAO,CAAC,KAAK,SAAS,WAAW;AACnC;AAEO,SAAS,QAAQ,KAAa;AACnC,QAAM,WAAW,QAAQ;AACzB,MAAI,aAAa,UAAU;AACzB,UAAM,QAAQ,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;AACxC;AAAA,EACF;AACA,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,CAAC,MAAM,SAAS,IAAI,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;AAC1D;AAAA,EACF;AACA,QAAM,YAAY,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;AAC9C;AAEA,SAAS,aAAa,UAAmC;AACvD,QAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AACpF,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,OAAG,SAAS,UAAU,CAAC,WAAW;AAChC,SAAG,MAAM;AACT,cAAQ,OAAO,KAAK,CAAC;AAAA,IACvB,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,UAAU,QAAgB,OAA6C;AAC3F,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,MAAM,mBAAmB;AAAA,MAClD,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,IAC9C,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,UAAU,QAAgB,OAAe,OAA2C;AACxG,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,yBAAyB;AAAA,IACxD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,EAChC,CAAC;AACD,SAAQ,MAAM,IAAI,KAAK;AACzB;AAEA,eAAsB,SAAS,MAAgB;AAC7C,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,UAAU,MAAM,SAAS,GAAG,IAAI;AAEtC,MAAI,OAAO,CAAC,SAAS;AACnB,YAAQ,MAAM,wBAAwB,GAAG,EAAE;AAC3C,YAAQ,MAAM,sCAAsC;AACpD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,SACJ,YAAY,MAAM,WAAW,KAC7B,SAAS,OACT,aAAa,gBAAgB,KAC7B;AACF,QAAM,SACJ,YAAY,MAAM,WAAW,KAC7B,SAAS,OACT,QAAQ,IAAI,kBACZ;AAEF,QAAM,UAAU,YAAY,MAAM,OAAO;AAEzC,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,oBAAoB;AAAA,IACxD,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,EACjC,CAAC;AAED,QAAM,YAAa,MAAM,SAAS,KAAK;AACvC,MAAI,CAAC,SAAS,MAAM,CAAC,UAAU,MAAM,CAAC,UAAU,cAAc,CAAC,UAAU,UAAU;AACjF,YAAQ,MAAM,sBAAsB,UAAU,SAAS,SAAS,UAAU;AAC1E,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,IAAI,iBAAiB;AAC7B,UAAQ,IAAI,cAAc,UAAU,QAAQ,EAAE;AAC9C,MAAI,UAAU,iBAAiB;AAC7B,YAAQ,IAAI,SAAS,UAAU,eAAe,EAAE;AAChD,QAAI,kBAAkB,IAAI,GAAG;AAC3B,UAAI;AACF,gBAAQ,UAAU,eAAe;AAAA,MACnC,QAAQ;AACN,gBAAQ,IAAI,qEAAqE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,UAAU,mBAAmB,KAAK;AACtD,QAAM,YAAY,UAAU,YAAY,IAAI,KAAK,UAAU,SAAS,EAAE,QAAQ,IAAI;AAElF,MAAI;AACJ,MAAI;AAEJ,SAAO,MAAM;AACX,QAAI,aAAa,KAAK,IAAI,IAAI,WAAW;AACvC,cAAQ,MAAM,qBAAqB;AACnC,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,UAAU,CAAC;AAE9D,UAAM,UAAU,MAAM,MAAM,GAAG,MAAM,mBAAmB;AAAA,MACtD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,YAAY,UAAU,WAAW,CAAC;AAAA,IAC3D,CAAC;AAED,UAAM,WAAY,MAAM,QAAQ,KAAK;AACrC,QAAI,CAAC,QAAQ,MAAM,CAAC,SAAS,IAAI;AAC/B,cAAQ,MAAM,qBAAqB,SAAS,SAAS,QAAQ,UAAU;AACvE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,SAAS,WAAW,cAAc,SAAS,aAAa;AAC1D,cAAQ,SAAS;AACjB,qBAAe,SAAS;AACxB;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,YAAY;AAClC,cAAQ,MAAM,iBAAiB;AAC/B,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,SAAS,WAAW,WAAW;AACjC,cAAQ,MAAM,gBAAgB;AAC9B,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,WAAW,MAAM,UAAU,QAAQ,KAAK;AAC9C,QAAM,OAAO,UAAU,iBAAiB,CAAC;AAEzC,MAAI,aAAa;AACjB,MAAI,aAAa;AACjB,MAAI;AAEJ,MAAI,KAAK,UAAU,GAAG;AAEpB,mBAAe,KAAK,CAAC,GAAG;AAAA,EAC1B,OAAO;AAEL,QAAI;AAEJ,QAAI,SAAS;AAEX,oBAAc,KAAK;AAAA,QACjB,CAAC,MAAM,EAAE,KAAK,YAAY,MAAM,QAAQ,YAAY,KAAK,EAAE,OAAO;AAAA,MACpE;AACA,UAAI,CAAC,aAAa;AAChB,gBAAQ,MAAM,iBAAiB,OAAO,8BAA8B;AACpE,mBAAW,KAAK,MAAM;AACpB,kBAAQ,MAAM,OAAO,EAAE,IAAI,KAAK,EAAE,EAAE,GAAG;AAAA,QACzC;AACA,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF,WAAW,QAAQ,MAAM,OAAO;AAE9B,cAAQ,IAAI,qDAAqD;AACjE,eAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,cAAM,SAAS,KAAK,CAAC,EAAE,OAAO,eAAe,eAAe;AAC5D,gBAAQ,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,IAAI,GAAG,MAAM,EAAE;AAAA,MACpD;AAEA,YAAM,SAAS,MAAM,aAAa;AAAA,YAAe,KAAK,MAAM,KAAK;AACjE,YAAM,MAAM,SAAS,QAAQ,EAAE,IAAI;AACnC,UAAI,MAAM,GAAG,KAAK,MAAM,KAAK,OAAO,KAAK,QAAQ;AAC/C,gBAAQ,MAAM,oBAAoB;AAClC,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,oBAAc,KAAK,GAAG;AAAA,IACxB,OAAO;AAEL,YAAM,aAAa,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,YAAY;AACzD,cAAQ;AAAA,QACN,mFAAmF,YAAY,QAAQ,YAAY;AAAA,MACrH;AACA,cAAQ,IAAI,0DAA0D;AACtE,oBAAc;AAAA,IAChB;AAEA,QAAI,eAAe,YAAY,OAAO,cAAc;AAElD,YAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,YAAY,EAAE;AAC/D,UAAI,CAAC,UAAU,MAAM,CAAC,UAAU,aAAa;AAC3C,gBAAQ,MAAM,kCAAkC,UAAU,SAAS,eAAe;AAClF,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,mBAAa,UAAU;AACvB,mBAAa,UAAU;AACvB,qBAAe,UAAU;AAAA,IAC3B,WAAW,aAAa;AACtB,qBAAe,YAAY;AAAA,IAC7B;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,aAAa,GAAG,IAAI;AAC9C,QAAM,WAAW,MAAM,SAAS,EAAE,OAAO,YAAY,QAAQ,OAAO,YAAY,SAAS,aAAa,GAAG,WAAW;AACpH,QAAM,cAAc,eAAe,OAAO,YAAY,KAAK;AAC3D,QAAM,eAAe,cAAc,cAAc,WAAW,MAAM;AAClE,UAAQ,IAAI,mBAAmB,WAAW,GAAG,YAAY,oBAAoB,QAAQ,EAAE;AACvF,UAAQ,IAAI,uDAAuD;AACrE;","names":[]}

package/dist/{chunk-XQXVG7RA.js → chunk-FNPMWDUQ.js}

@@ -1,12 +1,12 @@
 import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
 import {
   apiRequest
-} from "./chunk-WOHL4FTB.js";
+} from "./chunk-PRBRSIZP.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-A4OFTUVV.js";
+} from "./chunk-3X3NW7QA.js";
 
 // src/tag.ts
 import process from "process";
@@ -423,4 +423,4 @@ export {
   applyWorkflowTagFlags,
   runTag
 };
-//# sourceMappingURL=chunk-XQXVG7RA.js.map
+//# sourceMappingURL=chunk-FNPMWDUQ.js.map

package/dist/chunk-G4UYGRZR.js

@@ -0,0 +1,2 @@
+import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
+//# sourceMappingURL=chunk-G4UYGRZR.js.map

package/dist/{chunk-I4QLI3JO.js → chunk-HDFYUFBI.js}

@@ -1,7 +1,7 @@
 import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
 import {
   PlaywrightClient
-} from "./chunk-4PNOV7OV.js";
+} from "./chunk-VGYN2KU2.js";
 
 // src/local-browser/host.ts
 var HEARTBEAT_INTERVAL_MS = 3e4;
@@ -410,4 +410,4 @@ export {
   LocalBrowserHost,
   USER_PAUSED_ERROR
 };
-//# sourceMappingURL=chunk-I4QLI3JO.js.map
+//# sourceMappingURL=chunk-HDFYUFBI.js.map

package/dist/chunk-JMJVGMXI.js

@@ -0,0 +1,92 @@
+import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
+
+// src/brand.ts
+import { createRequire } from "module";
+import path from "path";
+import process from "process";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+function resolveBrandFromArgv(argv1) {
+  if (argv1) {
+    const base = path.basename(argv1).replace(/\.[^./\\]+$/, "").toLowerCase();
+    if (base.includes("cofactor")) return "cofactor";
+  }
+  return "canary";
+}
+var command = resolveBrandFromArgv(process.argv[1]);
+var packageName = pkg.name;
+var version = pkg.version;
+var INVOCATION_RE = /(^|[^\w-])canary(?= [a-z])/g;
+var PROSE_RE = /\bCanary\b/g;
+function brandTextFor(text, brand) {
+  if (brand === "canary") return text;
+  const display = brand === "cofactor" ? "Cofactor" : "Canary";
+  return text.replace(INVOCATION_RE, (_m, prefix) => `${prefix}${brand}`).replace(PROSE_RE, display);
+}
+function brandText(text) {
+  return brandTextFor(text, command);
+}
+function brandSkillContentFor(content, brand) {
+  const base = brandTextFor(content, brand);
+  if (brand !== "cofactor") return base;
+  return base.replace(/`canary`/g, "`cofactor`").replace(/@canaryai\/cli/g, "@runcofactor/cli").replace(/\bCANARY_/g, "COFACTOR_").replace(/trycanary\.ai/g, "runcofactor.com");
+}
+function readBrandEnvFor(canaryName, brand, env = process.env) {
+  const cofactorName = canaryName.replace(/^CANARY_/, "COFACTOR_");
+  const order = brand === "cofactor" ? [cofactorName, canaryName] : [canaryName, cofactorName];
+  for (const name of order) {
+    const value = env[name];
+    if (value !== null && value !== void 0 && value !== "") return value;
+  }
+  return void 0;
+}
+function readBrandEnv(canaryName, env = process.env) {
+  return readBrandEnvFor(canaryName, command, env);
+}
+var SPEC_EXTENSIONS = [".cofactor.md", ".canary.md"];
+var SPEC_DIRS = ["cofactor", "canary"];
+function specExtensionFor(brand) {
+  return brand === "cofactor" ? ".cofactor.md" : ".canary.md";
+}
+function specDirFor(brand) {
+  return path.join(brand === "cofactor" ? "cofactor" : "canary", "specs");
+}
+var specExtension = specExtensionFor(command);
+var specDir = specDirFor(command);
+function readableSpecDirs() {
+  return SPEC_DIRS.map((root) => path.join(root, "specs"));
+}
+function isSpecFile(name) {
+  return SPEC_EXTENSIONS.some((ext) => name.endsWith(ext));
+}
+function splitSpecExtension(name) {
+  for (const ext of SPEC_EXTENSIONS) {
+    if (name.endsWith(ext)) return { base: name.slice(0, -ext.length), ext };
+  }
+  return null;
+}
+function installConsoleBranding() {
+  if (command === "canary") return;
+  const methods = ["log", "error", "warn", "info"];
+  for (const method of methods) {
+    const original = console[method].bind(console);
+    console[method] = (...args) => {
+      original(...args.map((arg) => typeof arg === "string" ? brandText(arg) : arg));
+    };
+  }
+}
+
+export {
+  command,
+  packageName,
+  version,
+  brandSkillContentFor,
+  readBrandEnv,
+  specExtension,
+  specDir,
+  readableSpecDirs,
+  isSpecFile,
+  splitSpecExtension,
+  installConsoleBranding
+};
+//# sourceMappingURL=chunk-JMJVGMXI.js.map

package/dist/chunk-JMJVGMXI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/brand.ts"],"sourcesContent":["/**\n * Brand resolution for the dual-published CLI.\n *\n * We ship a single build to two npm packages:\n *   - `@canaryai/cli`  → binary `canary`   (legacy brand)\n *   - `@runcofactor/cli` → binary `cofactor` (new brand)\n *\n * Both packages contain the identical artifact; they differ only in their\n * `name` and `bin` map (rewritten at publish time — see\n * `.github/workflows/publish-canary-cli.yml`). Everything brand-specific is\n * therefore derived at runtime:\n *\n *   - `command` comes from the invoked binary name (`basename(process.argv[1])`),\n *     so output reflects how the user called it (`brandText` rewrites legacy\n *     `canary` display strings to the active brand).\n *   - `packageName` comes from the installed package's own `package.json`, so\n *     self-upgrade and the update check target whatever package was installed.\n *\n * The legacy `canary` brand is the default for every non-`cofactor` invocation\n * (`node dist/index.js`, dev scripts, tests), which keeps existing behaviour\n * byte-for-byte unchanged.\n *\n * @module\n */\n\nimport { createRequire } from 'node:module';\nimport path from 'node:path';\nimport process from 'node:process';\n\nconst require = createRequire(import.meta.url);\nconst pkg = require('../package.json') as { name: string; version: string };\n\nexport type Brand = 'canary' | 'cofactor';\n\n/**\n * Resolve the brand from the invoked binary path (`process.argv[1]`). The\n * global-install shim is named `canary` or `cofactor` (npm/bun/pnpm bin link),\n * so the basename is the brand. Everything else (`node dist/index.js`, dev\n * scripts, tests) defaults to the legacy `canary` brand. Pure for testing.\n */\nexport function resolveBrandFromArgv(argv1: string | undefined): Brand {\n  if (argv1) {\n    const base = path.basename(argv1).replace(/\\.[^./\\\\]+$/, '').toLowerCase();\n    if (base.includes('cofactor')) return 'cofactor';\n  }\n  return 'canary';\n}\n\n/** The invoked command / binary name, e.g. `canary` or `cofactor`. */\nexport const command: Brand = resolveBrandFromArgv(process.argv[1]);\n\n/** npm package name of the installed CLI, read from its own package.json. */\nexport const packageName: string = pkg.name;\n\n/** CLI version, read from package.json. */\nexport const version: string = pkg.version;\n\n/**\n * Rewrite display strings authored against the legacy `canary` brand to the\n * active brand. Identity for the `canary` brand (so legacy output never\n * changes). Two precise, word-anchored rules:\n *\n *   1. The invocation token `canary ` followed by a lowercase letter (i.e. a\n *      sub-command or `canary v1.2.3`). Anchored on a non-word, non-hyphen\n *      boundary so it never touches `trycanary.ai`, `x-canary-request-id`,\n *      `canary-cli`, or `CANARY_API_TOKEN`.\n *   2. The prose noun `Canary` (capitalized, standalone word) → display name.\n */\nconst INVOCATION_RE = /(^|[^\\w-])canary(?= [a-z])/g;\nconst PROSE_RE = /\\bCanary\\b/g;\n\n/** Pure brand rewrite for a given target brand. Identity for `canary`. */\nexport function brandTextFor(text: string, brand: Brand): string {\n  if (brand === 'canary') return text;\n  const display = brand === 'cofactor' ? 'Cofactor' : 'Canary';\n  return text\n    .replace(INVOCATION_RE, (_m, prefix: string) => `${prefix}${brand}`)\n    .replace(PROSE_RE, display);\n}\n\nfunction brandText(text: string): string {\n  return brandTextFor(text, command);\n}\n\n/**\n * Rewrite a bundled skill template's content to the target brand for the\n * `canary skill install` / `canary skill <name>` output. Builds on\n * {@link brandTextFor} (invocation tokens + the prose noun) and additionally\n * maps the brand-specific identifiers that {@link brandTextFor} deliberately\n * leaves intact for console output — but which a distributed skill file must\n * carry per brand:\n *\n *   - inline binary: `` `canary` `` → `` `cofactor` `` (a backtick-wrapped bare\n *     binary reference, e.g. \"the `canary` CLI\" — `brandTextFor` only rewrites\n *     `canary <subcommand>` invocations, not the standalone binary name)\n *   - npm package:  `@canaryai/cli`  → `@runcofactor/cli`\n *   - env prefix:   `CANARY_*`       → `COFACTOR_*`\n *   - domains:      `*.trycanary.ai` → `*.runcofactor.com`\n *\n * Identity for the `canary` brand, so legacy skill text installs byte-for-byte\n * unchanged. The skill's frontmatter `name:` is never an invocation/prose/token\n * match (it's `canary-basic`, hyphenated), so the install directory key is\n * preserved. Trigger keywords in prose (e.g. \"mentions canary, canary CLI\")\n * intentionally keep the legacy term so the skill still activates for users who\n * say \"canary\". Pure (brand injectable).\n */\nexport function brandSkillContentFor(content: string, brand: Brand): string {\n  const base = brandTextFor(content, brand);\n  if (brand !== 'cofactor') return base;\n  return base\n    .replace(/`canary`/g, '`cofactor`')\n    .replace(/@canaryai\\/cli/g, '@runcofactor/cli')\n    .replace(/\\bCANARY_/g, 'COFACTOR_')\n    .replace(/trycanary\\.ai/g, 'runcofactor.com');\n}\n\n/**\n * Read a brand-prefixed environment variable, accepting EITHER brand's prefix.\n *\n * The two published brands historically diverged: the binary only ever read the\n * legacy `CANARY_*` names, but the cofactor docs tell users to set `COFACTOR_*`\n * (e.g. `COFACTOR_API_TOKEN`). This bridges that gap — a value set under either\n * prefix is honoured regardless of which binary (`canary` / `cofactor`) was\n * invoked. When both are set, the active brand's prefix wins.\n *\n * `canaryName` is the legacy `CANARY_`-prefixed name; the `COFACTOR_` variant is\n * derived from it. Empty strings are treated as unset so a blank value can't\n * shadow a real one set under the other prefix. Pure (brand + env injectable).\n */\nexport function readBrandEnvFor(\n  canaryName: string,\n  brand: Brand,\n  env: NodeJS.ProcessEnv = process.env,\n): string | undefined {\n  const cofactorName = canaryName.replace(/^CANARY_/, 'COFACTOR_');\n  const order = brand === 'cofactor' ? [cofactorName, canaryName] : [canaryName, cofactorName];\n  for (const name of order) {\n    const value = env[name];\n    if (value !== null && value !== undefined && value !== '') return value;\n  }\n  return undefined;\n}\n\n/** Read a brand-prefixed env var for the active brand. See {@link readBrandEnvFor}. */\nexport function readBrandEnv(\n  canaryName: string,\n  env: NodeJS.ProcessEnv = process.env,\n): string | undefined {\n  return readBrandEnvFor(canaryName, command, env);\n}\n\n/**\n * Workflow spec file convention — brand-aware, backwards compatible.\n *\n * The spec extension and default directory follow the active brand: the\n * `cofactor` binary writes `.cofactor.md` into `cofactor/specs`, the legacy\n * `canary` binary writes `.canary.md` into `canary/specs` (byte-for-byte\n * unchanged). Reading/discovery always accepts BOTH — {@link SPEC_EXTENSIONS}\n * and {@link SPEC_DIRS} list every recognized variant (newest brand first), so\n * an existing `.canary.md` repo keeps working under either binary.\n */\nexport const SPEC_EXTENSIONS = ['.cofactor.md', '.canary.md'] as const;\n\n/**\n * Default spec-directory roots, newest brand first. Each is used as\n * `<root>/specs`. The ordering is a precedence contract: consumers that merge\n * across roots (e.g. `pull --all`) must treat earlier entries as higher\n * priority, so the active/new brand's copy wins over a legacy one.\n */\nexport const SPEC_DIRS = ['cofactor', 'canary'] as const;\n\n/** Spec-file extension to WRITE for a given brand. See {@link SPEC_EXTENSIONS}. */\nexport function specExtensionFor(brand: Brand): string {\n  return brand === 'cofactor' ? '.cofactor.md' : '.canary.md';\n}\n\n/** Default spec directory (`<root>/specs`) to WRITE into for a given brand. */\nexport function specDirFor(brand: Brand): string {\n  return path.join(brand === 'cofactor' ? 'cofactor' : 'canary', 'specs');\n}\n\n/** Spec-file extension to WRITE for the active brand. See {@link specExtensionFor}. */\nexport const specExtension: string = specExtensionFor(command);\n\n/** Default spec directory to WRITE into for the active brand. See {@link specDirFor}. */\nexport const specDir: string = specDirFor(command);\n\n/**\n * Every spec directory to READ from, highest precedence first — `<root>/specs`\n * for each {@link SPEC_DIRS} root. This is the single source of the spec-dir\n * convention for discovery; consumers merge across these in order (first-seen\n * wins) so the active brand's copy beats a legacy one. Brand-independent: a\n * `cofactor` run still discovers an existing `canary/specs` repo, and vice\n * versa.\n */\nexport function readableSpecDirs(): string[] {\n  return SPEC_DIRS.map((root) => path.join(root, 'specs'));\n}\n\n/** True if `name` ends with any recognized spec extension (either brand). */\nexport function isSpecFile(name: string): boolean {\n  return SPEC_EXTENSIONS.some((ext) => name.endsWith(ext));\n}\n\n/**\n * Split a recognized spec extension off `name`, returning `{ base, ext }` for\n * the first matching {@link SPEC_EXTENSIONS} entry, or `null` if none match.\n * Lets callers derive sibling names (e.g. `.stamped`) without assuming a brand.\n */\nexport function splitSpecExtension(name: string): { base: string; ext: string } | null {\n  for (const ext of SPEC_EXTENSIONS) {\n    if (name.endsWith(ext)) return { base: name.slice(0, -ext.length), ext };\n  }\n  return null;\n}\n\n/**\n * Install brand rewriting over the `console` methods used for human-readable\n * output. No-op for the `canary` brand. Skipped by the caller for machine\n * output (`--json`/`--format`) and the `mcp` JSON-RPC transport, where rewriting\n * could corrupt structured payloads — display branding only.\n */\nexport function installConsoleBranding(): void {\n  if (command === 'canary') return;\n  const methods = ['log', 'error', 'warn', 'info'] as const;\n  for (const method of methods) {\n    const original = console[method].bind(console);\n    console[method] = (...args: unknown[]) => {\n      original(...args.map((arg) => (typeof arg === 'string' ? brandText(arg) : arg)));\n    };\n  }\n}\n"],"mappings":";;;AAyBA,SAAS,qBAAqB;AAC9B,OAAO,UAAU;AACjB,OAAO,aAAa;AAEpB,IAAMA,WAAU,cAAc,YAAY,GAAG;AAC7C,IAAM,MAAMA,SAAQ,iBAAiB;AAU9B,SAAS,qBAAqB,OAAkC;AACrE,MAAI,OAAO;AACT,UAAM,OAAO,KAAK,SAAS,KAAK,EAAE,QAAQ,eAAe,EAAE,EAAE,YAAY;AACzE,QAAI,KAAK,SAAS,UAAU,EAAG,QAAO;AAAA,EACxC;AACA,SAAO;AACT;AAGO,IAAM,UAAiB,qBAAqB,QAAQ,KAAK,CAAC,CAAC;AAG3D,IAAM,cAAsB,IAAI;AAGhC,IAAM,UAAkB,IAAI;AAanC,IAAM,gBAAgB;AACtB,IAAM,WAAW;AAGV,SAAS,aAAa,MAAc,OAAsB;AAC/D,MAAI,UAAU,SAAU,QAAO;AAC/B,QAAM,UAAU,UAAU,aAAa,aAAa;AACpD,SAAO,KACJ,QAAQ,eAAe,CAAC,IAAI,WAAmB,GAAG,MAAM,GAAG,KAAK,EAAE,EAClE,QAAQ,UAAU,OAAO;AAC9B;AAEA,SAAS,UAAU,MAAsB;AACvC,SAAO,aAAa,MAAM,OAAO;AACnC;AAwBO,SAAS,qBAAqB,SAAiB,OAAsB;AAC1E,QAAM,OAAO,aAAa,SAAS,KAAK;AACxC,MAAI,UAAU,WAAY,QAAO;AACjC,SAAO,KACJ,QAAQ,aAAa,YAAY,EACjC,QAAQ,mBAAmB,kBAAkB,EAC7C,QAAQ,cAAc,WAAW,EACjC,QAAQ,kBAAkB,iBAAiB;AAChD;AAeO,SAAS,gBACd,YACA,OACA,MAAyB,QAAQ,KACb;AACpB,QAAM,eAAe,WAAW,QAAQ,YAAY,WAAW;AAC/D,QAAM,QAAQ,UAAU,aAAa,CAAC,cAAc,UAAU,IAAI,CAAC,YAAY,YAAY;AAC3F,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,IAAI,IAAI;AACtB,QAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,GAAI,QAAO;AAAA,EACpE;AACA,SAAO;AACT;AAGO,SAAS,aACd,YACA,MAAyB,QAAQ,KACb;AACpB,SAAO,gBAAgB,YAAY,SAAS,GAAG;AACjD;AAYO,IAAM,kBAAkB,CAAC,gBAAgB,YAAY;AAQrD,IAAM,YAAY,CAAC,YAAY,QAAQ;AAGvC,SAAS,iBAAiB,OAAsB;AACrD,SAAO,UAAU,aAAa,iBAAiB;AACjD;AAGO,SAAS,WAAW,OAAsB;AAC/C,SAAO,KAAK,KAAK,UAAU,aAAa,aAAa,UAAU,OAAO;AACxE;AAGO,IAAM,gBAAwB,iBAAiB,OAAO;AAGtD,IAAM,UAAkB,WAAW,OAAO;AAU1C,SAAS,mBAA6B;AAC3C,SAAO,UAAU,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,OAAO,CAAC;AACzD;AAGO,SAAS,WAAW,MAAuB;AAChD,SAAO,gBAAgB,KAAK,CAAC,QAAQ,KAAK,SAAS,GAAG,CAAC;AACzD;AAOO,SAAS,mBAAmB,MAAoD;AACrF,aAAW,OAAO,iBAAiB;AACjC,QAAI,KAAK,SAAS,GAAG,EAAG,QAAO,EAAE,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI;AAAA,EACzE;AACA,SAAO;AACT;AAQO,SAAS,yBAA+B;AAC7C,MAAI,YAAY,SAAU;AAC1B,QAAM,UAAU,CAAC,OAAO,SAAS,QAAQ,MAAM;AAC/C,aAAW,UAAU,SAAS;AAC5B,UAAM,WAAW,QAAQ,MAAM,EAAE,KAAK,OAAO;AAC7C,YAAQ,MAAM,IAAI,IAAI,SAAoB;AACxC,eAAS,GAAG,KAAK,IAAI,CAAC,QAAS,OAAO,QAAQ,WAAW,UAAU,GAAG,IAAI,GAAI,CAAC;AAAA,IACjF;AAAA,EACF;AACF;","names":["require"]}

package/dist/{chunk-SJJW77WN.js → chunk-JYGNMKZ5.js}

@@ -3,7 +3,7 @@ import { createRequire as __cr } from "module"; const require = __cr(import.meta
 // ../types/src/workflows.ts
 var USER_SETTABLE_WORKFLOW_STATUSES = [
   "draft",
-  "published"
+  "approved"
 ];
 
 // ../types/src/sandbox-instance-size.ts
@@ -86,6 +86,7 @@ var NODE_TYPE_LABEL = {
   notification: "Notification",
   audio: "Audio input",
   "audio-assertion": "Audio assertion",
+  sandbox_action: "Sandbox action",
   end: "End"
 };
 function normalizeNodeType(input) {
@@ -94,7 +95,7 @@ function normalizeNodeType(input) {
 }
 
 // ../types/src/index.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 
 // ../types/src/credentials.ts
 import { z } from "zod";
@@ -171,11 +172,6 @@ var TLDR_LIMIT = 512;
 var URL_LIMIT = 2048;
 var STORAGE_KEY_LIMIT = 1024;
 var DIAGNOSTIC_LIMIT = 4e3;
-var NarrationTranscriptSegmentSchema = z2.object({
-  startMs: z2.number().int().min(0),
-  endMs: z2.number().int().min(1),
-  text: z2.string().min(1)
-});
 var RecordIssueOccurrencePayloadSchema = z2.object({
   orgId: UUID,
   propertyId: UUID,
@@ -205,8 +201,6 @@ var RecordIssueOccurrencePayloadSchema = z2.object({
   videoStorageKey: optionalLimitedString(STORAGE_KEY_LIMIT),
   /** Action timeline for video overlay synchronization */
   videoTimelineJson: z2.unknown().optional().nullable(),
-  /** Timed narration transcript for video overlay */
-  narrationTranscriptJson: z2.array(NarrationTranscriptSegmentSchema).optional().nullable(),
   consoleLogExcerpt: optionalLimitedString(DIAGNOSTIC_LIMIT),
   networkFailureUrl: optionalLimitedString(URL_LIMIT),
   networkFailureStatus: z2.number().int().optional().nullable().transform((value) => value ?? null),
@@ -231,6 +225,21 @@ var benchmarkWorkflowSuiteConfigSchema = z3.object({
   sendSlackSummary: z3.boolean().optional()
 });
 
+// ../types/src/api-sequence.ts
+import { z as z4 } from "zod";
+var ValidationOperatorSchema = z4.enum([
+  "equals",
+  "not_equals",
+  "gt",
+  "lt",
+  "gte",
+  "lte",
+  "contains",
+  "not_contains",
+  "is_set",
+  "is_not_set"
+]);
+
 // ../types/src/sandbox-tasks.ts
 var CHECKLIST_ITEMS = [
   {
@@ -439,13 +448,14 @@ var MACRO_CATALOG = [
 ];
 var VALID_MACRO_NAMES = new Set(MACRO_CATALOG.map((m) => m.name));
 var MACRO_ARG_COUNTS = new Map(MACRO_CATALOG.map((m) => [m.name, m.args.length]));
+var MACRO_PATTERN = /(?<!\\)\$([A-Z_]+)\(([^)]*)\)/g;
 
 // ../types/src/workflow-node-schemas.ts
-import { z as z4 } from "zod";
-var FormFieldSchema = z4.object({
-  name: z4.string().describe('Unique field identifier (snake_case, e.g., "search_query", "recipient_email")'),
-  label: z4.string().describe('Human-friendly label (e.g., "Search Query", "Recipient Email")'),
-  type: z4.enum([
+import { z as z5 } from "zod";
+var FormFieldSchema = z5.object({
+  name: z5.string().describe('Unique field identifier (snake_case, e.g., "search_query", "recipient_email")'),
+  label: z5.string().describe('Human-friendly label (e.g., "Search Query", "Recipient Email")'),
+  type: z5.enum([
     "text",
     "email",
     "password",
@@ -456,16 +466,38 @@ var FormFieldSchema = z4.object({
     "multiselect",
     "file"
   ]).optional().describe('Input type, defaults to "text"'),
-  required: z4.boolean().optional().describe("Whether this field is required"),
-  value: z4.string().describe("The value to use for this field"),
-  options: z4.array(z4.object({ value: z4.string(), label: z4.string() })).optional().describe("If type is select/multiselect, provide allowed options here")
+  required: z5.boolean().optional().describe("Whether this field is required"),
+  value: z5.string().describe("The value to use for this field"),
+  options: z5.array(z5.object({ value: z5.string(), label: z5.string() })).optional().describe("If type is select/multiselect, provide allowed options here")
+});
+var AssertionSeverityEnum = z5.enum(["warn", "fail", "fatal"]);
+var InlineAssertionSchema = z5.object({
+  condition: z5.string().describe("What to verify after the action"),
+  severity: AssertionSeverityEnum.describe(
+    "fatal = stop the test immediately on failure, fail = mark the run failed but keep going, warn = log a warning and continue (run still passes)"
+  ),
+  agentic: z5.boolean().optional().describe("true if requires visual/complex evaluation that cannot be cached")
 });
-var InlineAssertionSchema = z4.object({
-  condition: z4.string().describe("What to verify after the action"),
-  severity: z4.enum(["warn", "fail"]).describe("warn = log and continue on failure, fail = stop the test"),
-  agentic: z4.boolean().optional().describe("true if requires visual/complex evaluation that cannot be cached")
+var ConditionSubjectSchema = z5.discriminatedUnion("kind", [
+  z5.object({
+    kind: z5.literal("variable"),
+    name: z5.string().describe('Input/variable name, e.g. "count" for $var.count')
+  }),
+  z5.object({
+    kind: z5.literal("acting_as")
+  })
+]);
+var ConditionPredicateSchema = z5.object({
+  subject: ConditionSubjectSchema,
+  operator: ValidationOperatorSchema,
+  /**
+   * Right-hand operand. For a `variable` subject this is a literal (or `$var`
+   * reference); for `acting_as` it is a credential template id. Omitted for the
+   * unary operators `is_set` / `is_not_set`.
+   */
+  value: z5.string().optional()
 });
-var NodeTypeEnum = z4.enum([
+var NodeTypeEnum = z5.enum([
   "login",
   "navigate",
   "action",
@@ -478,7 +510,8 @@ var NodeTypeEnum = z4.enum([
   "end",
   "notification",
   "audio",
-  "audio-assertion"
+  "audio-assertion",
+  "sandbox_action"
 ]);
 
 // ../types/src/browser-viewport.ts
@@ -493,6 +526,60 @@ var BROWSER_VIEWPORT_PRESET_KEYS = Object.keys(
   BROWSER_VIEWPORT_PRESETS
 );
 
+// ../types/src/identifier-stability.ts
+var FRAMEWORK_PREFIX_RE = /^(?::r[0-9a-z]+:?$|radix-|headlessui-|mantine-|react-aria-|react-select-|rc-|menu-v-\d)/i;
+var BARE_HASH_RE = /^[a-f0-9]{8,}$/i;
+var PREFIX_HASH_RE = /^[a-z]+-[0-9a-f]{6,}$/i;
+var UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+var ULID_RE = /\b[0-9A-HJKMNP-TV-Z]{26}\b/i;
+var DIGIT_RUN_RE = /(?:^|[^0-9A-Za-z])(\d{6,})(?![0-9A-Za-z])/;
+var TRAILING_COUNTER_RE = /[-_](\d{3,})$/;
+var MIN_PREFIX_LEN = 3;
+function usablePrefix(prefix) {
+  return prefix.length >= MIN_PREFIX_LEN && /[a-z]/i.test(prefix);
+}
+function earliestVolatileTokenIndex(value) {
+  let best = null;
+  const consider = (idx) => {
+    if (idx !== void 0 && idx >= 0 && (best === null || idx < best)) best = idx;
+  };
+  consider(UUID_RE.exec(value)?.index);
+  consider(ULID_RE.exec(value)?.index);
+  const digit = DIGIT_RUN_RE.exec(value);
+  if (digit) consider(digit.index + (digit[0].length - digit[1].length));
+  const counter = TRAILING_COUNTER_RE.exec(value);
+  if (counter) consider(counter.index + 1);
+  return best;
+}
+function classifyIdentifier(value) {
+  if (!value) return { kind: "volatile" };
+  if (FRAMEWORK_PREFIX_RE.test(value) || BARE_HASH_RE.test(value) || PREFIX_HASH_RE.test(value)) {
+    return { kind: "volatile" };
+  }
+  const tokenIdx = earliestVolatileTokenIndex(value);
+  if (tokenIdx !== null) {
+    const prefix = value.slice(0, tokenIdx);
+    return usablePrefix(prefix) ? { kind: "stable-prefix", prefix } : { kind: "volatile" };
+  }
+  return { kind: "stable" };
+}
+function isVolatileIdentifier(value) {
+  return classifyIdentifier(value).kind !== "stable";
+}
+function stableIdentifierPrefix(value) {
+  const c = classifyIdentifier(value);
+  return c.kind === "stable-prefix" ? c.prefix : null;
+}
+function escapeCssAttrValue(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function stableAttrSelector(attr, value) {
+  const c = classifyIdentifier(value);
+  if (c.kind === "stable") return `[${attr}="${escapeCssAttrValue(value)}"]`;
+  if (c.kind === "stable-prefix") return `[${attr}^="${escapeCssAttrValue(c.prefix)}"]`;
+  return null;
+}
+
 // ../types/src/index.ts
 var PLAYBOOK_STEP_ACTIONS = [
   "click",
@@ -520,24 +607,24 @@ function isPositiveIntegerString(value) {
   if (!value || !/^\d+$/.test(value)) return false;
   return Number(value) > 0;
 }
-var playbookStepAgentSchema = z5.object({
-  order: z5.number().describe("Step number (1-based)."),
-  action: z5.enum(PLAYBOOK_STEP_ACTIONS).describe(
+var playbookStepAgentSchema = z6.object({
+  order: z6.number().describe("Step number (1-based)."),
+  action: z6.enum(PLAYBOOK_STEP_ACTIONS).describe(
     'The type of browser interaction. PREFER DETERMINISTIC VERBS even when verbose \u2014 three deterministic steps beat one agentic step, because deterministic steps replay via Playwright with no agent dispatch. Each replayable playbook step must be 1:1 with an exposed browser tool you actually used and must correspond to zero or one recorded actionRef. If you cannot accomplish the intent with the browser tools you have, do not add a playbook step for it; report the limitation outside playbookSteps. Do not summarize several recorded actions into one "other" step; report the same 1:1 browser primitives you actually used. The only multi-field exception is one fill_form step for one browser_fill_form action. Use "verify" for assertion checks \u2014 both inline assertions and completion assertions proving the action succeeded. Use "verify" for inspection language such as "inspect whether", "confirm", "observe", or "check" when the result is visible in the DOM. Use "capture" instead only when the observed value is needed by later steps. Use "fill" for single-field inputs. Use "fill_form" when browser_fill_form was called to fill multiple fields at once \u2014 one fill_form step per call. Use "click" for checkboxes, switches, toggle buttons, and click-to-focus interactions. There is no separate "toggle" or "focus" action. Use "upload" for file upload actions, including generated CSV/file, attach file, choose file, import file, and document/image attachment intents (browser_action action="upload"). Set params.path to the staged attachment handle, generated file variable, or filename reference used by the upload tool (e.g. {path: "$var.csv_file"}), and include actionRefs pointing to the recorded file_upload action. Do NOT use "other" for file attachment/upload/import intents. Use "scroll" only when scrolling is the user-visible action being tested; routine browser_scroll calls for visibility, inspection, or video framing are observation steps and should usually be omitted from playbookSteps. Use "press_key" for keyboard actions (Enter, Escape, Tab, arrows). Use "press_key" with params.key="Escape" to dismiss a popover, dropdown, panel, or modal when Escape was the recorded action; use "click" if the recorded action clicked a close button or outside target. There is no separate "dismiss" action. Use "drag" for drag-and-drop interactions. Use "resize" when browser_resize was used to resize the viewport. Set params.width and params.height to positive integer pixel values and include the actionRef pointing to the recorded resize action. Use "capture" to extract app-generated values (IDs, codes, URLs) for later steps via $var.name, but only from a visible DOM target or the current URL. Do not capture from performance/network timing, storage, hidden DOM, or app-global state. Use "screenshot" only when browser_screenshot itself is the requested evidence capture. Set params.label when a label was used, optionally params.fullPage="true". Do not use screenshot for routine visual checks after actions; use verify when a browser_assert proves visible state. Use "extract_table" when browser_extract_table was used to extract tabular data from the page. Use "python_execute" when python_execute was used with cache_label to run a data validation script. Use "verify_download" when browser_download(action="list") / browser_list_downloads proves that a file matching some pattern was downloaded. Set params.pattern to a glob (supports *, ?) or substring; optionally params.timeoutMs. This is currently agent-only at replay, so do not set actionRefs. Use "verify_download_content" when browser_download(action="read") / browser_read_download content proves CSV headers, PDF text, exported rows, or similar downloaded-file content. Set params.contains or params.pattern to the expected content predicate. This is currently agent-only at replay, so do not set actionRefs. Use "agent_loop" ONLY when the action set is genuinely unknown until runtime \u2014 variable count of items (e.g. "toggle row checkboxes until 3 selected"), conditional retry that depends on UI state, or a runtime predicate over non-DOM state. Set params.goal to a one-sentence checkable predicate (e.g. params.goal = "3 grid row checkboxes are selected"). DO NOT use agent_loop for: known-N iteration (write N deterministic steps), single click that might double-fire (use "click"), retry-on-flake (the runtime handles that). agent_loop steps replay via a Playwright override authored after first run; they are non-deterministic on first run, so the bar is high. Network/devtools/API inspections and unsupported browser environment mutations are diagnostic-only unless there is an exposed browser tool for the action. If visible page state proves the condition, record that as "verify"; otherwise omit the diagnostic observation from playbookSteps. Do not use "other". If no concrete browser-tool-backed action above fits, omit the observation from playbookSteps and report the limitation outside the playbook.'
   ),
-  target: z5.string().describe(
+  target: z6.string().describe(
     `Human-readable element description using visible labels, placeholders, or aria-labels. Examples: "'Submit' button", "'Email' input field", "'Status' dropdown". For upload actions, describe the file input and include the attachment name (e.g. "CSV file input for 'testing-checklist.csv'"). Never use coordinates, ref IDs, or internal identifiers.`
   ),
-  params: z5.record(z5.string(), z5.string()).optional().describe(
+  params: z6.record(z6.string(), z6.string()).optional().describe(
     'Data values using $var.name references and $MACRO() expressions \u2014 NEVER hard-coded literals. Common keys: value (for fill: {value: "$EMAIL()"}), option (for select: {option: "Admin"} \u2014 fixed app constants like dropdown options are allowed as literals), url (for navigate: {url: "$var.target_url"}), path (for upload: {path: "$var.file_path"}), key (for press_key: {key: "Enter"}, {key: "Escape"}), width and height (for resize: {width: "390", height: "844"}), label and fullPage (for screenshot: {label: "seats-table", fullPage: "true"}), pattern or contains (for download verification: {pattern: "report-*.csv"} or {contains: "Expected Header"}), expression + saveAs (for capture: prefer a visible DOM ref expression or "() => window.location.href"; do not use performance.getEntries() or other network/storage/global state; e.g. {saveAs: "order_confirmation_id"}). For fill_form: keys are field names from the fill_form call, values are $var.name or $MACRO() (e.g. {company: "$var.company", email: "$EMAIL()"}). Available macros: $UUID(), $EMAIL(), $FIRST_NAME(), $LAST_NAME(), $PHONE(), $RANDOM_STRING(n), $RANDOM_INT(min,max), $TODAY(), $DATE(days), $NOW(), $TIMESTAMP(), $SEQUENCE("name").'
   ),
-  note: z5.string().optional().describe(
+  note: z6.string().optional().describe(
     'Timing or quirk notes ONLY (e.g. "Wait 1s for modal animation", "Scroll into view first"). Do NOT put data values, optional markers, or verification notes here.'
   ),
-  actionRefs: z5.array(z5.number()).max(1).optional().describe(
+  actionRefs: z6.array(z6.number()).max(1).optional().describe(
     'Zero or one recorded browser action index that corresponds to this playbook step. Interaction tools, browser_resize, capture evaluates (browser_evaluate with saveAs), and browser_assert produce [Action #N] tags \u2014 collect those indices here. Read-only browser_snapshot and plain browser_evaluate without saveAs do NOT produce action indices. browser_scroll and browser_screenshot may produce action indices when they are the primary requested tool call; omit actionRefs when no action tag was emitted. If you took multiple cacheable UI actions, report multiple 1:1 playbook steps instead of putting multiple refs on one step or summarizing them as "other". A fill_form call is a single action \u2014 use one fill_form playbook step with one actionRef. For a click that triggers a native dialog, keep one click actionRef on the click step and set expectedDialogs rather than adding a separate dialog actionRef. Actions not referenced by any playbook step are considered exploratory and will be discarded by the cache compiler.'
   ),
-  expectedDialogs: z5.enum(["accept", "dismiss"]).optional().describe(
+  expectedDialogs: z6.enum(["accept", "dismiss"]).optional().describe(
     'Set when this step is known to fire a native browser dialog (alert/confirm/prompt) \u2014 e.g. clicking a "Delete" button that prompts "Are you sure?". On replay the runtime pre-arms the dialog handler with this action automatically. In free-form runs, you should call the dialog tool (browser_dialog for consolidated tools, browser_handle_dialog for legacy tools) with this action immediately before the step. Do not add a separate dialog step \u2014 keeping the pre-arm on the triggering step keeps the pre-arm and the triggering action in one place.'
   )
 }).superRefine((step, ctx) => {
@@ -545,7 +632,7 @@ var playbookStepAgentSchema = z5.object({
     const goal = step.params?.goal;
     if (!goal || goal.trim().length === 0) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["params", "goal"],
         message: 'agent_loop steps must set params.goal to a one-sentence checkable predicate (e.g. "3 grid row checkboxes are selected").'
       });
@@ -555,7 +642,7 @@ var playbookStepAgentSchema = z5.object({
     const pattern = step.params?.pattern;
     if (!pattern || pattern.trim().length === 0) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["params", "pattern"],
         message: "verify_download steps must set params.pattern to a glob (supports *, ?) or substring matching the expected filename."
       });
@@ -566,7 +653,7 @@ var playbookStepAgentSchema = z5.object({
     const contains = step.params?.contains;
     if ((!pattern || pattern.trim().length === 0) && (!contains || contains.trim().length === 0)) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["params"],
         message: "verify_download_content steps must set params.contains or params.pattern for the expected downloaded content."
       });
@@ -577,14 +664,14 @@ var playbookStepAgentSchema = z5.object({
     const height = step.params?.height;
     if (!isPositiveIntegerString(width)) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["params", "width"],
         message: "resize steps must set params.width to a positive integer pixel value."
       });
     }
     if (!isPositiveIntegerString(height)) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["params", "height"],
         message: "resize steps must set params.height to a positive integer pixel value."
       });
@@ -598,8 +685,12 @@ export {
   INSTANCE_SIZE_SPEC,
   parseInstanceSize,
   VALID_MACRO_NAMES,
+  MACRO_PATTERN,
   InlineAssertionSchema,
   NODE_TYPE_LABEL,
-  normalizeNodeType
+  normalizeNodeType,
+  isVolatileIdentifier,
+  stableIdentifierPrefix,
+  stableAttrSelector
 };
-//# sourceMappingURL=chunk-SJJW77WN.js.map
+//# sourceMappingURL=chunk-JYGNMKZ5.js.map