@skaile/workspaces 1.2.0 → 1.4.0

package/dist/{chunk-TTTLCSEQ.js → chunk-AAGD2J4H.js}

@@ -1,17 +1,18 @@
-import { WorkspacePlugin } from './chunk-EPLYVB3L.js';
+import { WorkspacePlugin } from './chunk-OSCJRUKM.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
-import { PROTOCOL_VERSION } from './chunk-EVZKWY5J.js';
-import { EventNormalizer } from './chunk-UY5Q2NZH.js';
+import { EventNormalizer } from './chunk-HKX5VSWQ.js';
+import { SUPPORTED_CLOUDS, CLOUD_SECRET_ENV_KEYS } from './chunk-ISQWMBKD.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver } from './chunk-QVE3ILCY.js';
+import { createDriver } from './chunk-TNSCHS4I.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-VCBLXF7D.js';
-import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, deriveSingleMaterializedConnectorDeclaration } from './chunk-BCJL2UNH.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-GWDZW44L.js';
+import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, deriveSingleMaterializedConnectorDeclaration } from './chunk-BDUANIAR.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-DEYYRFQU.js';
-import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-MG6UIS7G.js';
-import { resolveRuntimeAssets } from './chunk-BM37QD6U.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-5AGARSQT.js';
+import { PROTOCOL_VERSION } from './chunk-PK7Q7MC7.js';
+import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-26YCXWCU.js';
+import { resolveRuntimeAssets } from './chunk-TJRWGMD2.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, cloudConfigFromProfile, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-OUWNTFDG.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
 import { getLogStore, resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, registerLogStore, resetLogStore, createLogger } from './chunk-JB35MVBN.js';
@@ -235,11 +236,11 @@ async function resolveMixin(ref, defaultKind, agentDir, repos) {
   return { content: stripFrontmatter(raw).trim(), source: entry.source };
 }
 async function resolveAgentMixins(manifest, agentDir, repos) {
-  const resolve3 = (refs, kind) => Promise.all((refs ?? []).map((r) => resolveMixin(r, kind, agentDir, repos)));
+  const resolve4 = (refs, kind) => Promise.all((refs ?? []).map((r) => resolveMixin(r, kind, agentDir, repos)));
   const [personaResults, rulesResults, knowledgeResults] = await Promise.all([
-    resolve3(manifest.persona, "persona"),
-    resolve3(manifest.rules, "ruleset"),
-    resolve3(manifest.knowledge, "knowledge")
+    resolve4(manifest.persona, "persona"),
+    resolve4(manifest.rules, "ruleset"),
+    resolve4(manifest.knowledge, "knowledge")
   ]);
   return {
     personas: personaResults.filter((r) => r !== null),
@@ -1787,7 +1788,9 @@ async function createAgentSession(config) {
   const driverType = settings.driver ?? "omp";
   const provider = settings.provider;
   const model = settings.model;
-  const apiKey = config.apiKey ?? resolveApiKey(provider ?? "anthropic", settings);
+  const cloud = config.cloud ?? settings.cloud ?? "default";
+  const cloudConfig = config.cloudConfig ?? settings.cloudConfig;
+  const apiKey = cloud === "bedrock" || cloud === "vertex" || cloud === "azure" ? config.apiKey : config.apiKey ?? resolveApiKey(provider ?? "anthropic", settings);
   const manifest = agentDir ? await loadAgentManifest(agentDir) : void 0;
   const {
     resourceManager,
@@ -1862,6 +1865,8 @@ async function createAgentSession(config) {
     agentCwd,
     provider,
     model,
+    cloud,
+    cloudConfig,
     manifest,
     maxTurns,
     apiKey,
@@ -1984,6 +1989,8 @@ function createSessionDriver(args) {
     agentCwd,
     provider,
     model,
+    cloud,
+    cloudConfig,
     manifest,
     maxTurns,
     apiKey,
@@ -2003,6 +2010,11 @@ function createSessionDriver(args) {
     apiKeys: apiKey ? { [provider ?? "anthropic"]: apiKey } : void 0,
     systemPrompt,
     tools: manifest?.tools,
+    // Cloud transport dimension — omitted entirely for `default` so the
+    // driver config stays byte-identical to pre-cloud behavior.
+    ...cloud !== "default" ? { cloud } : {},
+    ...cloudConfig ? { cloudConfig } : {},
+    ...config.cloudSecrets ? { cloudSecrets: config.cloudSecrets } : {},
     ...thinking ? { thinking } : {},
     ...effort ? { effort } : {},
     ...sessionId ? { sessionId } : {},
@@ -2059,14 +2071,14 @@ async function runAgentChat(opts) {
 ${message}`;
   }
   try {
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       const onEvent = (event) => {
         if (event.type === "agent_end") {
           driver.off("agent-event", onEvent);
           mdStream.end();
           process.stdout.write("\n");
           driver.kill();
-          resolve3();
+          resolve4();
         } else if (event.type === "error") {
           driver.off("agent-event", onEvent);
           const err = new Error(String(event.error));
@@ -2187,8 +2199,12 @@ var ORIGIN_PROMPT_ORDER = [
   "skill",
   "mcp",
   "connector",
-  "mount"
+  "mount",
+  "app"
 ];
+function describeSource(source) {
+  return typeof source === "string" ? source : `app:${source.appId}`;
+}
 var CapabilityRegistry = class {
   byName = /* @__PURE__ */ new Map();
   logger;
@@ -2238,6 +2254,8 @@ var CapabilityRegistry = class {
    * Allowed combinations:
    * - source `'agent'`: origins `framework | agent | flow | skill | mcp | connector | mount`
    * - source `'client'`: origin `client` only
+   * - source `{ kind: 'app', appId }`: origin `app` only, and the origin's
+   *   `appId` must match the source `appId`
    *
    * @param cap - capability to register (typically built via {@link defineCapability})
    * @param source - which side is doing the registration
@@ -2246,7 +2264,7 @@ var CapabilityRegistry = class {
     if (!this.isOriginAllowed(source, cap.origin)) {
       this.logger.warn("capability registration rejected (origin mismatch)", {
         name: cap.name,
-        source,
+        source: describeSource(source),
         originKind: cap.origin.kind
       });
       return;
@@ -2397,7 +2415,10 @@ var CapabilityRegistry = class {
     if (source === "client") {
       return origin.kind === "client";
     }
-    return origin.kind !== "client";
+    if (source === "agent") {
+      return origin.kind !== "client" && origin.kind !== "app";
+    }
+    return origin.kind === "app" && origin.appId === source.appId;
   }
   /** Strip the runtime-only fields from a {@link DefinedCapability}. */
   toWire(cap) {
@@ -2466,7 +2487,7 @@ function buildClientCapabilityHandler(args) {
       });
       return {};
     }
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const timer = setTimeout(() => {
         args.pending.delete(callId);
         reject(
@@ -2475,7 +2496,7 @@ function buildClientCapabilityHandler(args) {
           )
         );
       }, timeoutMs);
-      args.pending.set(callId, { resolve: resolve3, reject, timer });
+      args.pending.set(callId, { resolve: resolve4, reject, timer });
       args.emit({
         type: "capability_invoked",
         callId,
@@ -2864,6 +2885,34 @@ function planRuntimeSessionEmit(input) {
   }
   return { type: "runtime_session", driverSessionId, model, capabilitySignature };
 }
+var GCP_SA_JSON_KEY = "GOOGLE_APPLICATION_CREDENTIALS_JSON";
+var GCP_SA_RELATIVE_PATH = join(".skaile", "gcp-sa.json");
+function resolveCloudSecretBundle(args) {
+  const { cloud, secrets, projectDir } = args;
+  const cloudSecrets = {};
+  const bundleKeys = CLOUD_SECRET_ENV_KEYS[cloud];
+  if (!secrets || !bundleKeys) return { cloudSecrets };
+  for (const key of bundleKeys) {
+    if (key === GCP_SA_JSON_KEY) continue;
+    const value = secrets[key];
+    if (value) cloudSecrets[key] = value;
+  }
+  const saJson = secrets[GCP_SA_JSON_KEY];
+  if (bundleKeys.includes(GCP_SA_JSON_KEY) && saJson) {
+    const saPath = resolve(projectDir, GCP_SA_RELATIVE_PATH);
+    mkdirSync(dirname(saPath), { recursive: true });
+    rmSync(saPath, { force: true });
+    writeFileSync(saPath, saJson, { mode: 384 });
+    cloudSecrets.GOOGLE_APPLICATION_CREDENTIALS = saPath;
+  }
+  return { cloudSecrets };
+}
+function cleanupCloudCredentialFiles(projectDir) {
+  try {
+    rmSync(resolve(projectDir, GCP_SA_RELATIVE_PATH), { force: true });
+  } catch {
+  }
+}
 
 // runner/src/compaction/prompt.ts
 var DEFAULT_COMPACTION_PROMPT = `You are being asked to compact this conversation into a structured summary.
@@ -3877,9 +3926,9 @@ function createSessionStimulusBus(opts) {
         connectorId,
         fragmentLength: sig.promptFragment.length
       });
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve4, reject) => {
         const q = getQueue(connectorId);
-        q.pending.push({ signal: sig, resolve: resolve3, reject });
+        q.pending.push({ signal: sig, resolve: resolve4, reject });
         startTimerIfNeeded(connectorId, q, coalesceMs);
       });
     }
@@ -4129,7 +4178,7 @@ async function startAgentServer(opts) {
   const pendingCapabilityCalls = /* @__PURE__ */ new Map();
   const remoteCapabilityInvoker = (name, input, timeoutMs) => {
     const callId = typeof crypto?.randomUUID === "function" ? crypto.randomUUID() : `rcap-${Date.now()}-${Math.floor(Math.random() * 1e9)}`;
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       if (!transport.connected) {
         reject(new Error(`Transport disconnected; cannot invoke remote capability ${name}`));
         return;
@@ -4138,7 +4187,7 @@ async function startAgentServer(opts) {
         pendingCapabilityCalls.delete(callId);
         reject(new Error(`Remote capability ${name} (callId=${callId}) timed out`));
       }, timeoutMs ?? DEFAULT_CAPABILITY_CALL_TIMEOUT_MS);
-      pendingCapabilityCalls.set(callId, { resolve: resolve3, reject, timer });
+      pendingCapabilityCalls.set(callId, { resolve: resolve4, reject, timer });
       transport.send({
         type: "capability_invoked",
         callId,
@@ -4149,8 +4198,8 @@ async function startAgentServer(opts) {
     });
   };
   let aiProviderConfigId;
-  const sleep = (ms) => new Promise((resolve3) => {
-    const t = setTimeout(resolve3, ms);
+  const sleep = (ms) => new Promise((resolve4) => {
+    const t = setTimeout(resolve4, ms);
     t.unref?.();
   });
   async function mintAndPersistAiCredential(args) {
@@ -4257,7 +4306,15 @@ async function startAgentServer(opts) {
   }
   const secretsMode = wsConfig.secrets?.provider ?? "env";
   wsConfig.secrets?.timeoutMs ?? 3e4;
-  function buildSessionConfig(secretProvider2, apiKey) {
+  const rawCloud = profile?.cloud ?? "default";
+  const effectiveCloud = SUPPORTED_CLOUDS.includes(rawCloud) ? rawCloud : "default";
+  if (effectiveCloud !== rawCloud) {
+    log(
+      `[serve] WARNING: unknown cloud "${rawCloud}" in agent-config \u2014 falling back to the default transport`
+    );
+  }
+  const effectiveCloudConfig = cloudConfigFromProfile(profile);
+  function buildSessionConfig(secretProvider2, apiKey, cloudSecrets) {
     return {
       projectDir: opts.projectDir,
       agentDir,
@@ -4273,6 +4330,13 @@ async function startAgentServer(opts) {
       secretProvider: secretProvider2,
       onAuthError,
       ...apiKey ? { apiKey } : {},
+      // Non-default cloud transport from skaile.yaml agent-config.default,
+      // plus the platform-resolved credential bundle (Vertex SA JSON already
+      // materialized to a file path by resolveCloudSecretBundle). Omitted
+      // entirely for `default` so the session config stays byte-identical.
+      ...effectiveCloud !== "default" ? { cloud: effectiveCloud } : {},
+      ...effectiveCloudConfig ? { cloudConfig: effectiveCloudConfig } : {},
+      ...cloudSecrets ? { cloudSecrets } : {},
       // Protocol v2 `<CAPABILITIES>` block — joins each registered capability's
       // `promptFragment` (framework first, then client, then agent-side
       // surfaces). Built lazily inside `buildSessionConfig` so newly registered
@@ -4338,8 +4402,8 @@ async function startAgentServer(opts) {
   }
   let resolveSessionReady;
   let rejectSessionReady;
-  const sessionReady = new Promise((resolve3, reject) => {
-    resolveSessionReady = resolve3;
+  const sessionReady = new Promise((resolve4, reject) => {
+    resolveSessionReady = resolve4;
     rejectSessionReady = reject;
   });
   let sessionConfig;
@@ -4506,7 +4570,9 @@ async function startAgentServer(opts) {
         driver.removeAllListeners("error");
         driver.kill();
       } catch (err) {
-        log(`[serve] failed to retire previous driver: ${err instanceof Error ? err.message : String(err)}`);
+        log(
+          `[serve] failed to retire previous driver: ${err instanceof Error ? err.message : String(err)}`
+        );
       }
     }
     driver = incoming;
@@ -4604,7 +4670,7 @@ async function startAgentServer(opts) {
     return stimulusBus;
   }
   function awaitFlowAgentEnd(prompt, timeoutMs) {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       let settled = false;
       const onEvent = (event) => {
         if (event.type === "agent_end") done();
@@ -4622,7 +4688,7 @@ async function startAgentServer(opts) {
           onEvent
         ) ?? driver.removeListener("agent-event", onEvent);
         if (err) reject(err);
-        else resolve3();
+        else resolve4();
       };
       const timer = setTimeout(
         () => done(new Error(`Flow turn timed out after ${timeoutMs / 1e3}s`)),
@@ -4751,8 +4817,8 @@ async function startAgentServer(opts) {
     try {
       await Promise.race([
         sessionReady,
-        new Promise((resolve3) => {
-          const t = setTimeout(resolve3, 2e3);
+        new Promise((resolve4) => {
+          const t = setTimeout(resolve4, 2e3);
           t.unref?.();
         })
       ]);
@@ -4784,6 +4850,10 @@ async function startAgentServer(opts) {
       } catch {
       }
     }
+    try {
+      cleanupCloudCredentialFiles(opts.projectDir);
+    } catch {
+    }
   }
   async function awaitSessionReadyOrFail() {
     try {
@@ -4842,10 +4912,20 @@ async function startAgentServer(opts) {
     return initialAiCredentialExpiresAt;
   }
   async function buildSessionFromInit(secrets) {
-    const effectiveProvider = opts.provider ?? "anthropic";
-    const envKey = providerEnvKey(effectiveProvider);
-    const apiKeyFromSecrets = secrets?.[envKey];
-    sessionConfig = buildSessionConfig(secretProvider, apiKeyFromSecrets);
+    let apiKeyFromSecrets;
+    let cloudSecrets;
+    if (effectiveCloud === "default") {
+      const effectiveProvider = opts.provider ?? "anthropic";
+      const envKey = providerEnvKey(effectiveProvider);
+      apiKeyFromSecrets = secrets?.[envKey];
+    } else {
+      ({ cloudSecrets } = resolveCloudSecretBundle({
+        cloud: effectiveCloud,
+        secrets,
+        projectDir: opts.projectDir
+      }));
+    }
+    sessionConfig = buildSessionConfig(secretProvider, apiKeyFromSecrets, cloudSecrets);
     if (!agentSession) {
       agentSession = await createAgentSession(sessionConfig);
       emitSystemPromptComposed(agentSession, sendEvent);
@@ -5827,5 +5907,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-TTTLCSEQ.js.map
-//# sourceMappingURL=chunk-TTTLCSEQ.js.map
+//# sourceMappingURL=chunk-AAGD2J4H.js.map
+//# sourceMappingURL=chunk-AAGD2J4H.js.map