@skaile/workspaces 2.8.0 → 3.0.0

package/dist/cli/index.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { makeInstallCommand, makeCheckCommand, makeCleanCommand, reportInstalledSoftDeps } from '../chunk-AZ44F3AT.js';
-import { makeSourceCommand, syncProjectSources } from '../chunk-JIA2S3T2.js';
+import { makeInstallCommand, makeCheckCommand, makeCleanCommand, reportInstalledSoftDeps } from '../chunk-TXTCW7V6.js';
+import { makeSourceCommand, syncProjectSources } from '../chunk-EH7BCJF4.js';
 import { AI_RESOURCES, aiResourceRoots } from '../chunk-57RFYEVM.js';
 import { getStoreConfig, storeFetch, deviceLogin, loadStoreAuthConfig, logout, hasStoredAuth, isStoreAuthenticated, getStoreToken, getStoreIdentity } from '../chunk-AM5LFRXJ.js';
-import { openCatalogSource, openLibraryManager, createFullRegistry, openLibrary } from '../chunk-ZJ7MRR2R.js';
-import { logErr, S, logOk, logInfo, kindColorPad, kindColor, colorRef, formatSoftDepSection, bareSoftDepName, logWarn, formatSoftDepHint, formatRelativeTime, formatSoftDepRemovePreview, formatSoftDepAddPreview, fitWidth } from '../chunk-XTFZOYNY.js';
+import { openCatalogSource, openLibraryManager, createFullRegistry, openLibrary } from '../chunk-QGDQHNYC.js';
+import { logErr, S, logOk, logInfo, kindColorPad, kindColor, colorRef, formatSoftDepSection, bareSoftDepName, logWarn, formatSoftDepHint, formatRelativeTime, formatSoftDepRemovePreview, formatSoftDepAddPreview, fitWidth } from '../chunk-P2J3MLTW.js';
 import { LocalSecretsProvider } from '../chunk-6BEGKO2Q.js';
-import { runAgentChat, loadSessionById, loadSession, listSessions, setCurrentSession, deleteSession, clearSession, loadAgentManifest, compileComposition, MarkdownStreamer, resolveMixin } from '../chunk-OAUKA7VT.js';
-import { buildClaudePluginFiles } from '../chunk-ZJOEU5GP.js';
+import { runAgentChat, loadSessionById, loadSession, listSessions, setCurrentSession, deleteSession, clearSession, loadAgentManifest, compileComposition, MarkdownStreamer, resolveMixin } from '../chunk-JQMULHO6.js';
+import { buildClaudePluginFiles } from '../chunk-NMKTM55X.js';
 import '../chunk-X5YPJV4N.js';
 import '../chunk-W3UDISS2.js';
 import '../chunk-O7SG5PC2.js';
@@ -15,27 +15,27 @@ import '../chunk-7QBNJTTQ.js';
 import '../chunk-GTS2FODO.js';
 import '../chunk-WQ7DE5UC.js';
 import '../chunk-32NA4TVC.js';
-import '../chunk-VNIKF66R.js';
-import '../chunk-ISQWMBKD.js';
-import '../chunk-RRVQAE5D.js';
-import '../chunk-BMQKMOQY.js';
-import '../chunk-GAH4YRCI.js';
-import '../chunk-HY3MBSNC.js';
-import { runFlow, resumeFlow } from '../chunk-P3DUVOAW.js';
+import { runFlow, resumeFlow } from '../chunk-XJECOBCO.js';
 import '../chunk-4R6DROGN.js';
 import { validateFlowVersions, parseSkillFrontmatter } from '../chunk-CZZRDYT4.js';
 import '../chunk-BEAIJRVF.js';
-import '../chunk-IWUIXNMF.js';
-import '../chunk-HVQWLYZB.js';
+import '../chunk-N4GFUWWC.js';
+import '../chunk-ZO7KL7GN.js';
 import '../chunk-ZNIHTT22.js';
+import '../chunk-P5W6JVD4.js';
+import '../chunk-ISQWMBKD.js';
+import '../chunk-RRVQAE5D.js';
+import '../chunk-V34ZEXSE.js';
+import '../chunk-GAH4YRCI.js';
+import '../chunk-SR6NBBWT.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-IFGTRL2I.js';
-import { loadFlow, loadAllFlows } from '../chunk-E4AVJMOJ.js';
-import '../chunk-XJ74XFIZ.js';
-import '../chunk-SCR3WGW7.js';
-import '../chunk-TUYN2HDT.js';
+import { loadFlow, loadAllFlows } from '../chunk-S5FV6ISY.js';
+import '../chunk-5QGMEPUX.js';
+import '../chunk-7KFN2EPR.js';
+import '../chunk-F5VREBV2.js';
 import '../chunk-D4VHBAJC.js';
-import { AssetManager, NON_DEPLOYABLE_KINDS, MissingManifestError, parseRefTolerant, normalizeRepoUrl, FACTORY_SOURCE_URL } from '../chunk-6AYGXPPF.js';
+import { AssetManager, NON_DEPLOYABLE_KINDS, MissingManifestError, parseRefTolerant, normalizeRepoUrl, FACTORY_SOURCE_URL } from '../chunk-Q6O53D5Q.js';
 import { resolveLibraryDir, getStoreManifestsDir, getDefaultValue, isSecretPlaceholder } from '../chunk-3HVASHBF.js';
 import '../chunk-NU4E7C5I.js';
 import '../chunk-UKJMQZV6.js';
@@ -110,7 +110,7 @@ async function runSearch(kind, query, opts) {
   }
 }
 async function searchIndex(query, kind) {
-  const { openLibrary: openLibrary2 } = await import('../open-library-Y5SKFAMK.js');
+  const { openLibrary: openLibrary2 } = await import('../open-library-3FMLAU3F.js');
   const library = await openLibrary2();
   try {
     const defs = await library.listAssetDefs(kind ? { kind } : {});
@@ -163,7 +163,7 @@ async function searchLocal(query, kind, opts, showStore, airGapped) {
   const factory = await searchFactory(projectDir, query, kind);
   let entries = unionEntries(await searchIndex(query, kind), factory);
   if (entries.length === 0 && !query && !kind && !airGapped) {
-    const { autoSyncForSearch } = await import('../source-XBJ5KTAV.js');
+    const { autoSyncForSearch } = await import('../source-45XHQSBF.js');
     if (await autoSyncForSearch(projectDir)) {
       entries = unionEntries(await searchIndex(query, kind), factory);
     }
@@ -217,7 +217,7 @@ async function searchStore(query, kind, opts, airGapped) {
     logInfo("air-gapped (cache_ttl: 0) \u2014 local sources only");
     return;
   }
-  const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError } = await import('../open-library-Y5SKFAMK.js');
+  const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError } = await import('../open-library-3FMLAU3F.js');
   try {
     const remote = await openCatalogSource2({ projectDir: path14__default.resolve(opts.projectDir) });
     const assets = await remote.listAssets(kind ? { kind } : {});
@@ -532,7 +532,7 @@ async function resolveInfoEntry(am2, ref, opts) {
     return { entry: match ?? deployed };
   }
   const lookup = opts.storeLookup ?? (async (filter) => {
-    const { resolveCatalogSource } = await import('../open-library-Y5SKFAMK.js');
+    const { resolveCatalogSource } = await import('../open-library-3FMLAU3F.js');
     const { source, close } = await resolveCatalogSource({ projectDir: opts.projectDir });
     try {
       return await source.listAssets(filter);
@@ -548,7 +548,7 @@ async function resolveInfoEntry(am2, ref, opts) {
     );
     return { entry: hit ? catalogAssetToEntry(hit) : null };
   } catch (err) {
-    const { LocalCatalogDisabledError } = await import('../open-library-Y5SKFAMK.js');
+    const { LocalCatalogDisabledError } = await import('../open-library-3FMLAU3F.js');
     const storeNote = err instanceof Error ? err.message : String(err);
     const disabled = err instanceof LocalCatalogDisabledError || /catalog\.url/i.test(storeNote);
     return { entry: null, storeNote, ...disabled ? { storeDisabled: true } : {} };
@@ -1168,7 +1168,7 @@ function makeCatalogCommand() {
   return catalog;
 }
 async function runLocalCatalogTest(projectDir) {
-  const { resolveCatalogSource } = await import('../open-library-Y5SKFAMK.js');
+  const { resolveCatalogSource } = await import('../open-library-3FMLAU3F.js');
   let resolved;
   try {
     resolved = await resolveCatalogSource({ projectDir });
@@ -3407,16 +3407,16 @@ function makeLibraryCommand() {
   });
   cmd.command("publish <lib>").description("Push + register the library's manifest atomically (needs git backend)").option("--asset <ref>", "Publish only the single asset matching this ref/name").option("--create-repo", "Provision + link a public github repo if the library has no remote").option("--ref <gitref>", "Git ref to ingest (default: the library branch or main)").option("--dry-run", "Print the plan; push nothing and call no store endpoint").action(
     async (lib, opts) => {
-      const { runLibraryPublish } = await import('../library-publish-3Z33J2ZY.js');
+      const { runLibraryPublish } = await import('../library-publish-QJACP6FW.js');
       await withStoreErrorHandling(() => runLibraryPublish(lib, opts));
     }
   );
   cmd.command("register <lib>").description("Register the library's manifest without pushing (bytes already on github)").option("--asset <ref>", "Publish only the single asset matching this ref/name").option("--ref <gitref>", "Git ref to ingest (default: the library branch or main)").option("--dry-run", "Print the plan; call no store endpoint").action(async (lib, opts) => {
-    const { runLibraryRegister } = await import('../library-publish-3Z33J2ZY.js');
+    const { runLibraryRegister } = await import('../library-publish-QJACP6FW.js');
     await withStoreErrorHandling(() => runLibraryRegister(lib, opts));
   });
   cmd.command("yank <lib>").description("Retract the library's published assets from the store").option("--asset <ref>", "Yank only the single asset matching this ref/name").action(async (lib, opts) => {
-    const { runLibraryYank } = await import('../library-publish-3Z33J2ZY.js');
+    const { runLibraryYank } = await import('../library-publish-QJACP6FW.js');
     await withStoreErrorHandling(() => runLibraryYank(lib, opts));
   });
   return cmd;
@@ -4138,7 +4138,7 @@ function scheduleSoftDepPreview() {
 }
 async function loadAssets() {
   softDepPreviewCache.clear();
-  const { gatherAssetFeeds } = await import('../asset-feeds-23CP6YUY.js');
+  const { gatherAssetFeeds } = await import('../asset-feeds-XKPJZ6QT.js');
   const { entries, domains, notes } = await gatherAssetFeeds(am, am.projectDir);
   if (notes.length > 0) {
     state.message = notes.map((n) => `[${n.feed}] ${n.message}`).join(" \u2022 ");
@@ -4344,7 +4344,7 @@ function reconcileCollapsedSets(rows) {
 async function loadSourcesAndLibraries() {
   try {
     const [{ openLibraryManager: openLibraryManager2 }, { skaileHomeDir }, { getGlobalCacheDir: getGlobalCacheDir2 }] = await Promise.all([
-      import('../open-library-Y5SKFAMK.js'),
+      import('../open-library-3FMLAU3F.js'),
       import('../library/index.js'),
       import('../core/index.js')
     ]);
@@ -6788,7 +6788,7 @@ function makeServeCommand() {
   );
 }
 async function ensurePluginsLoadedForServe(projectDir) {
-  const { logInfo: logInfo2, logWarn: logWarn2 } = await import('../helpers-PXEHIKF7.js');
+  const { logInfo: logInfo2, logWarn: logWarn2 } = await import('../helpers-IS4MSEOQ.js');
   try {
     const { resolveSkWorkspaceConfig: resolveSkWorkspaceConfig2 } = await import('../core/index.js');
     const config = resolveSkWorkspaceConfig2(projectDir);
@@ -6807,7 +6807,7 @@ async function ensurePluginsLoadedForServe(projectDir) {
   }
 }
 async function runCompileTest(opts) {
-  const { logOk: logOk2, logErr: logErr2, logInfo: logInfo2, S: S2 } = await import('../helpers-PXEHIKF7.js');
+  const { logOk: logOk2, logErr: logErr2, logInfo: logInfo2, S: S2 } = await import('../helpers-IS4MSEOQ.js');
   const { tmpdir } = await import('os');
   const { dirname: dirname4, join: join7, resolve: resolve5 } = await import('path');
   const { fileURLToPath: fileURLToPath2 } = await import('url');
@@ -7689,7 +7689,7 @@ function makeStoreCommand() {
     process.exit(2);
   });
   store.command("search <query>").description("Search the AI Asset Store catalog by name, description, or publisher").option("--kind <kind>", "Filter by asset kind (skill, agent, prompt, flow, \u2026)").option("-C, --project-dir <dir>", "Project directory (catalog config overlay)", process.cwd()).action(async (query, opts) => {
-    const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError } = await import('../open-library-Y5SKFAMK.js');
+    const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError } = await import('../open-library-3FMLAU3F.js');
     try {
       const remote = await openCatalogSource2({ projectDir: path14__default.resolve(opts.projectDir) });
       const assets = await remote.listAssets(opts.kind ? { kind: opts.kind } : {});
@@ -7722,8 +7722,8 @@ function makeStoreCommand() {
     }
   });
   store.command("show <ref>").description("Show a store asset's details + provenance (source, files, integrity)").option("-C, --project-dir <dir>", "Project directory (catalog config overlay)", process.cwd()).action(async (ref, opts) => {
-    const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError } = await import('../open-library-Y5SKFAMK.js');
-    const { supportsInstallManifest } = await import('../project-DQRC6J6M.js');
+    const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError } = await import('../open-library-3FMLAU3F.js');
+    const { supportsInstallManifest } = await import('../project-KEAAGHSX.js');
     try {
       const remote = await openCatalogSource2({ projectDir: path14__default.resolve(opts.projectDir) });
       const asset = await remote.resolve(ref);
@@ -8803,7 +8803,7 @@ async function bootstrapUserConfig() {
 }
 async function hydrateInitSources(resolved, created) {
   try {
-    const { ensureSourcesCloned } = await import('../ensure-sources-N7B7657V.js');
+    const { ensureSourcesCloned } = await import('../ensure-sources-D6R57GAP.js');
     const hydrate = ensureSourcesCloned(resolved, { quiet: true });
     for (const n of hydrate.cloned) created.push(`~/.skaile/cache/sources/${n}/`);
     if (hydrate.failed.length > 0) {
@@ -8843,7 +8843,7 @@ function printInitSummary(resolved, projectDir, created) {
   console.log();
 }
 program.command("setup").description("Interactive provider setup wizard").action(async () => {
-  const { cmdSetup } = await import('../setup-RHWARBBB.js');
+  const { cmdSetup } = await import('../setup-VX6EPF5P.js');
   await cmdSetup([], { projectDir: process.cwd() });
 });
 program.addCommand(makeInstallCommand());

package/dist/connectors/index.js

@@ -1,11 +1,17 @@
-export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, FlowAdapter, LogBuffer, ManagedGitconfigCollisionError, PortPool, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, buildSdkFlowTools, createFsWatcher, createWorktree, defaultSpawn, ensureDirMode, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock } from '../chunk-HVQWLYZB.js';
+export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, FlowAdapter, LogBuffer, ManagedGitconfigCollisionError, PortPool, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, buildSdkFlowTools, createFsWatcher, createWorktree, defaultSpawn, ensureDirMode, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock } from '../chunk-ZO7KL7GN.js';
 export { EnvSecretProvider, ForgeSecretProvider, InMemorySecretProvider, LegacyAuthGrammarError, LockedSecretProvider, OAuthRequiredError, PreMintedSecretProvider, SecretProviderChain, createCliSecretProviderChain, createForgeSecretProviderChain, deriveSingleMaterializedConnectorDeclaration, fromMaterializedConnectorMd, isKnownSecretRef, loadConnectorDeclarations, loadMaterializedConnectorDeclarations, resolveAuthRef, resolveBackendAuthFor, resolvedConfigToDeclarations } from '../chunk-ZNIHTT22.js';
+import '../chunk-P5W6JVD4.js';
+import '../chunk-ISQWMBKD.js';
+import '../chunk-RRVQAE5D.js';
+import '../chunk-V34ZEXSE.js';
+import '../chunk-GAH4YRCI.js';
+import '../chunk-SR6NBBWT.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-IFGTRL2I.js';
-import '../chunk-E4AVJMOJ.js';
-import '../chunk-XJ74XFIZ.js';
-import '../chunk-SCR3WGW7.js';
-import '../chunk-TUYN2HDT.js';
+import '../chunk-S5FV6ISY.js';
+import '../chunk-5QGMEPUX.js';
+import '../chunk-7KFN2EPR.js';
+import '../chunk-F5VREBV2.js';
 import '../chunk-P43HBWKK.js';
 import '../chunk-F3HNW354.js';
 import '../chunk-K5GBV4SA.js';

package/dist/{ensure-sources-N7B7657V.js → ensure-sources-D6R57GAP.js}

@@ -1,5 +1,5 @@
-import { logErr, logOk, logInfo } from './chunk-XTFZOYNY.js';
-import './chunk-6AYGXPPF.js';
+import { logErr, logOk, logInfo } from './chunk-P2J3MLTW.js';
+import './chunk-Q6O53D5Q.js';
 import './chunk-3HVASHBF.js';
 import './chunk-NU4E7C5I.js';
 import './chunk-UKJMQZV6.js';
@@ -86,5 +86,5 @@ function ensureSourcesCloned(projectDir, opts = {}) {
 }
 
 export { ensureSourcesCloned };
-//# sourceMappingURL=ensure-sources-N7B7657V.js.map
-//# sourceMappingURL=ensure-sources-N7B7657V.js.map
+//# sourceMappingURL=ensure-sources-D6R57GAP.js.map
+//# sourceMappingURL=ensure-sources-D6R57GAP.js.map

package/dist/{ensure-sources-N7B7657V.js.map → ensure-sources-D6R57GAP.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/ensure-sources.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,gBAAgB,GAAA,EAAqB;AAC5C,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,iBAAA,EAAkB,EAAG,GAAG,CAAA;AAC3C;AASA,SAAS,kBAAA,CAAmB,UAAkB,KAAA,EAAsC;AAClF,EAAA,IAAI;AACF,IAAA,OAAO,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA,CAAE,UAAA,EAAW;AAAA,EACvD,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAA,CAAO,CAAA,eAAA,EAAkB,QAAQ,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC1F;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMA,SAAS,kBAAA,CAAmB,KAAA,EAAoB,KAAA,EAAgB,MAAA,EAA4B;AAC1F,EAAA,MAAM,GAAA,GAAM,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA;AACpC,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,MAAM,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAChC,EAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACpB,IAAA,MAAA,CAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AACvB,IAAA;AAAA,EACF;AACA,EAAA,SAAA,CAAe,aAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACjD,EAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AACtC,EAAA,IAAI,KAAA,CAAM,KAAK,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,EAAG,UAAA,EAAY,MAAM,GAAG,CAAA;AACtD,EAAA,MAAM,KAAA,GAAQ,UAAU,KAAA,EAAO,IAAA,EAAM,EAAE,KAAA,EAAO,KAAA,GAAQ,MAAA,GAAS,SAAA,EAAW,CAAA;AAC1E,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAA,CAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AACvB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,KAAA,CAAM,GAAG,CAAA,CAAE,CAAA;AAAA,IAC5C;AACA,IAAA;AAAA,EACF;AACA,EAAA,MAAA,CAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AACzB;AAGA,SAAS,kBAAkB,MAAA,EAA4B;AACrD,EAAA,KAAA,MAAW,KAAK,MAAA,CAAO,MAAA,EAAQ,KAAA,CAAM,CAAA,eAAA,EAAkB,CAAC,CAAA,EAAA,CAAI,CAAA;AAC5D,EAAA,IAAI,MAAA,CAAO,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC5B,IAAA,OAAA,CAAQ,yBAAyB,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7D;AACF;AAUO,SAAS,mBAAA,CACd,UAAA,EACA,IAAA,GAA4B,EAAC,EACf;AACd,EAAA,MAAM,MAAA,GAAuB,EAAE,MAAA,EAAQ,EAAC,EAAG,QAAQ,EAAC,EAAG,MAAA,EAAQ,EAAC,EAAE;AAClE,EAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,UAAA,EAAY,aAAa,CAAA;AACpD,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,MAAA;AAElC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,QAAA,EAAU,KAAK,CAAA;AAClD,EAAA,IAAI,OAAA,KAAY,MAAM,OAAO,MAAA;AAC7B,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAEjC,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,kBAAA,CAAmB,KAAA,EAAO,OAAO,MAAM,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,iBAAA,CAAkB,MAAM,CAAA;AAAA,EAC1B;AAEA,EAAA,OAAO,MAAA;AACT","file":"ensure-sources-N7B7657V.js","sourcesContent":["/**\n * ensure-sources.ts — hydrate the `~/.skaile/cache/sources/` clone cache from a\n * project's `skaile.yaml` `sources:` entries.\n *\n * Called by `skaile init` (idempotent: no-op when no sources declared) and\n * `skaile install` so checking out a project pulls its source clones onto\n * the local machine.\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync, mkdirSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  getGlobalCacheDir,\n  type SourceEntry,\n  sourceCacheKey,\n  sourceShortName,\n  WorkspaceYamlEditor,\n} from \"@skaile/workspaces/core\";\nimport { logErr, logInfo, logOk } from \"./helpers.ts\";\n\nfunction sourceClonePath(key: string): string {\n  return path.join(getGlobalCacheDir(), key);\n}\n\nexport interface EnsureResult {\n  cloned: string[];\n  cached: string[];\n  failed: string[];\n}\n\n/** Load `sources:` from a project's `skaile.yaml`, or `null` when unavailable. */\nfunction loadProjectSources(yamlPath: string, quiet: boolean): SourceEntry[] | null {\n  try {\n    return WorkspaceYamlEditor.load(yamlPath).getSources();\n  } catch (err) {\n    if (!quiet) {\n      logErr(`Could not read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}`);\n    }\n    return null;\n  }\n}\n\n/**\n * Hydrate a single source entry into `result`: skip when already cached,\n * otherwise clone and record success/failure. Mutates `result` in place.\n */\nfunction hydrateSourceEntry(entry: SourceEntry, quiet: boolean, result: EnsureResult): void {\n  const key = sourceCacheKey(entry.url);\n  const slug = sourceShortName(entry.url);\n  const dest = sourceClonePath(key);\n  if (existsSync(dest)) {\n    result.cached.push(slug);\n    return;\n  }\n  mkdirSync(path.dirname(dest), { recursive: true });\n  const args = [\"clone\", entry.url, dest];\n  if (entry.pin) args.splice(1, 0, \"--branch\", entry.pin);\n  const clone = spawnSync(\"git\", args, { stdio: quiet ? \"pipe\" : \"inherit\" });\n  if (clone.status !== 0) {\n    result.failed.push(slug);\n    if (quiet) {\n      logErr(`git clone failed for ${entry.url}`);\n    }\n    return;\n  }\n  result.cloned.push(slug);\n}\n\n/** Log a full-hydrate summary of cloned + reused-cached entries. */\nfunction logHydrateSummary(result: EnsureResult): void {\n  for (const n of result.cloned) logOk(`Cloned source \"${n}\".`);\n  if (result.cached.length > 0) {\n    logInfo(`Reused cached clones: ${result.cached.join(\", \")}`);\n  }\n}\n\n/**\n * Walk `projectDir/skaile.yaml` `sources:` and clone any entries whose\n * clone directory does not yet exist under `~/.skaile/cache/sources/`. Existing\n * clones are left untouched — this is hydration, not sync.\n *\n * Quiet by default: when `quiet: true` the helper only prints failures.\n * On full hydrate (`quiet: false`) it logs each cloned/cached entry.\n */\nexport function ensureSourcesCloned(\n  projectDir: string,\n  opts: { quiet?: boolean } = {},\n): EnsureResult {\n  const result: EnsureResult = { cloned: [], cached: [], failed: [] };\n  const yamlPath = path.join(projectDir, \"skaile.yaml\");\n  if (!existsSync(yamlPath)) return result;\n\n  const quiet = opts.quiet ?? false;\n  const sources = loadProjectSources(yamlPath, quiet);\n  if (sources === null) return result;\n  if (sources.length === 0) return result;\n\n  for (const entry of sources) {\n    hydrateSourceEntry(entry, quiet, result);\n  }\n\n  if (!quiet) {\n    logHydrateSummary(result);\n  }\n\n  return result;\n}\n"]}
+{"version":3,"sources":["../cli/src/ensure-sources.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,gBAAgB,GAAA,EAAqB;AAC5C,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,iBAAA,EAAkB,EAAG,GAAG,CAAA;AAC3C;AASA,SAAS,kBAAA,CAAmB,UAAkB,KAAA,EAAsC;AAClF,EAAA,IAAI;AACF,IAAA,OAAO,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA,CAAE,UAAA,EAAW;AAAA,EACvD,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAA,CAAO,CAAA,eAAA,EAAkB,QAAQ,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC1F;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMA,SAAS,kBAAA,CAAmB,KAAA,EAAoB,KAAA,EAAgB,MAAA,EAA4B;AAC1F,EAAA,MAAM,GAAA,GAAM,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA;AACpC,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,MAAM,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAChC,EAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACpB,IAAA,MAAA,CAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AACvB,IAAA;AAAA,EACF;AACA,EAAA,SAAA,CAAe,aAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACjD,EAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AACtC,EAAA,IAAI,KAAA,CAAM,KAAK,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,EAAG,UAAA,EAAY,MAAM,GAAG,CAAA;AACtD,EAAA,MAAM,KAAA,GAAQ,UAAU,KAAA,EAAO,IAAA,EAAM,EAAE,KAAA,EAAO,KAAA,GAAQ,MAAA,GAAS,SAAA,EAAW,CAAA;AAC1E,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAA,CAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AACvB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAA,CAAO,CAAA,qBAAA,EAAwB,KAAA,CAAM,GAAG,CAAA,CAAE,CAAA;AAAA,IAC5C;AACA,IAAA;AAAA,EACF;AACA,EAAA,MAAA,CAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AACzB;AAGA,SAAS,kBAAkB,MAAA,EAA4B;AACrD,EAAA,KAAA,MAAW,KAAK,MAAA,CAAO,MAAA,EAAQ,KAAA,CAAM,CAAA,eAAA,EAAkB,CAAC,CAAA,EAAA,CAAI,CAAA;AAC5D,EAAA,IAAI,MAAA,CAAO,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC5B,IAAA,OAAA,CAAQ,yBAAyB,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7D;AACF;AAUO,SAAS,mBAAA,CACd,UAAA,EACA,IAAA,GAA4B,EAAC,EACf;AACd,EAAA,MAAM,MAAA,GAAuB,EAAE,MAAA,EAAQ,EAAC,EAAG,QAAQ,EAAC,EAAG,MAAA,EAAQ,EAAC,EAAE;AAClE,EAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,UAAA,EAAY,aAAa,CAAA;AACpD,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,MAAA;AAElC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,QAAA,EAAU,KAAK,CAAA;AAClD,EAAA,IAAI,OAAA,KAAY,MAAM,OAAO,MAAA;AAC7B,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAEjC,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,kBAAA,CAAmB,KAAA,EAAO,OAAO,MAAM,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,iBAAA,CAAkB,MAAM,CAAA;AAAA,EAC1B;AAEA,EAAA,OAAO,MAAA;AACT","file":"ensure-sources-D6R57GAP.js","sourcesContent":["/**\n * ensure-sources.ts — hydrate the `~/.skaile/cache/sources/` clone cache from a\n * project's `skaile.yaml` `sources:` entries.\n *\n * Called by `skaile init` (idempotent: no-op when no sources declared) and\n * `skaile install` so checking out a project pulls its source clones onto\n * the local machine.\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync, mkdirSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  getGlobalCacheDir,\n  type SourceEntry,\n  sourceCacheKey,\n  sourceShortName,\n  WorkspaceYamlEditor,\n} from \"@skaile/workspaces/core\";\nimport { logErr, logInfo, logOk } from \"./helpers.ts\";\n\nfunction sourceClonePath(key: string): string {\n  return path.join(getGlobalCacheDir(), key);\n}\n\nexport interface EnsureResult {\n  cloned: string[];\n  cached: string[];\n  failed: string[];\n}\n\n/** Load `sources:` from a project's `skaile.yaml`, or `null` when unavailable. */\nfunction loadProjectSources(yamlPath: string, quiet: boolean): SourceEntry[] | null {\n  try {\n    return WorkspaceYamlEditor.load(yamlPath).getSources();\n  } catch (err) {\n    if (!quiet) {\n      logErr(`Could not read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}`);\n    }\n    return null;\n  }\n}\n\n/**\n * Hydrate a single source entry into `result`: skip when already cached,\n * otherwise clone and record success/failure. Mutates `result` in place.\n */\nfunction hydrateSourceEntry(entry: SourceEntry, quiet: boolean, result: EnsureResult): void {\n  const key = sourceCacheKey(entry.url);\n  const slug = sourceShortName(entry.url);\n  const dest = sourceClonePath(key);\n  if (existsSync(dest)) {\n    result.cached.push(slug);\n    return;\n  }\n  mkdirSync(path.dirname(dest), { recursive: true });\n  const args = [\"clone\", entry.url, dest];\n  if (entry.pin) args.splice(1, 0, \"--branch\", entry.pin);\n  const clone = spawnSync(\"git\", args, { stdio: quiet ? \"pipe\" : \"inherit\" });\n  if (clone.status !== 0) {\n    result.failed.push(slug);\n    if (quiet) {\n      logErr(`git clone failed for ${entry.url}`);\n    }\n    return;\n  }\n  result.cloned.push(slug);\n}\n\n/** Log a full-hydrate summary of cloned + reused-cached entries. */\nfunction logHydrateSummary(result: EnsureResult): void {\n  for (const n of result.cloned) logOk(`Cloned source \"${n}\".`);\n  if (result.cached.length > 0) {\n    logInfo(`Reused cached clones: ${result.cached.join(\", \")}`);\n  }\n}\n\n/**\n * Walk `projectDir/skaile.yaml` `sources:` and clone any entries whose\n * clone directory does not yet exist under `~/.skaile/cache/sources/`. Existing\n * clones are left untouched — this is hydration, not sync.\n *\n * Quiet by default: when `quiet: true` the helper only prints failures.\n * On full hydrate (`quiet: false`) it logs each cloned/cached entry.\n */\nexport function ensureSourcesCloned(\n  projectDir: string,\n  opts: { quiet?: boolean } = {},\n): EnsureResult {\n  const result: EnsureResult = { cloned: [], cached: [], failed: [] };\n  const yamlPath = path.join(projectDir, \"skaile.yaml\");\n  if (!existsSync(yamlPath)) return result;\n\n  const quiet = opts.quiet ?? false;\n  const sources = loadProjectSources(yamlPath, quiet);\n  if (sources === null) return result;\n  if (sources.length === 0) return result;\n\n  for (const entry of sources) {\n    hydrateSourceEntry(entry, quiet, result);\n  }\n\n  if (!quiet) {\n    logHydrateSummary(result);\n  }\n\n  return result;\n}\n"]}

package/dist/factory-assets/connectors/box.js

@@ -1,11 +1,17 @@
-export { BoxConnector, createConnector4 as createConnector } from '../../chunk-HVQWLYZB.js';
+export { BoxConnector, createConnector4 as createConnector } from '../../chunk-ZO7KL7GN.js';
 import '../../chunk-ZNIHTT22.js';
+import '../../chunk-P5W6JVD4.js';
+import '../../chunk-ISQWMBKD.js';
+import '../../chunk-RRVQAE5D.js';
+import '../../chunk-V34ZEXSE.js';
+import '../../chunk-GAH4YRCI.js';
+import '../../chunk-SR6NBBWT.js';
 import '../../chunk-6E6PKKAD.js';
 import '../../chunk-IFGTRL2I.js';
-import '../../chunk-E4AVJMOJ.js';
-import '../../chunk-XJ74XFIZ.js';
-import '../../chunk-SCR3WGW7.js';
-import '../../chunk-TUYN2HDT.js';
+import '../../chunk-S5FV6ISY.js';
+import '../../chunk-5QGMEPUX.js';
+import '../../chunk-7KFN2EPR.js';
+import '../../chunk-F5VREBV2.js';
 import '../../chunk-P43HBWKK.js';
 import '../../chunk-F3HNW354.js';
 import '../../chunk-K5GBV4SA.js';

package/dist/factory-assets/connectors/deploy.js

@@ -1,11 +1,17 @@
-export { DeployConnector, createConnector2 as createConnector } from '../../chunk-HVQWLYZB.js';
+export { DeployConnector, createConnector2 as createConnector } from '../../chunk-ZO7KL7GN.js';
 import '../../chunk-ZNIHTT22.js';
+import '../../chunk-P5W6JVD4.js';
+import '../../chunk-ISQWMBKD.js';
+import '../../chunk-RRVQAE5D.js';
+import '../../chunk-V34ZEXSE.js';
+import '../../chunk-GAH4YRCI.js';
+import '../../chunk-SR6NBBWT.js';
 import '../../chunk-6E6PKKAD.js';
 import '../../chunk-IFGTRL2I.js';
-import '../../chunk-E4AVJMOJ.js';
-import '../../chunk-XJ74XFIZ.js';
-import '../../chunk-SCR3WGW7.js';
-import '../../chunk-TUYN2HDT.js';
+import '../../chunk-S5FV6ISY.js';
+import '../../chunk-5QGMEPUX.js';
+import '../../chunk-7KFN2EPR.js';
+import '../../chunk-F5VREBV2.js';
 import '../../chunk-P43HBWKK.js';
 import '../../chunk-F3HNW354.js';
 import '../../chunk-K5GBV4SA.js';

package/dist/factory-assets/connectors/devserver.js

@@ -1,11 +1,17 @@
-export { DevServerConnector, createConnector3 as createConnector } from '../../chunk-HVQWLYZB.js';
+export { DevServerConnector, createConnector3 as createConnector } from '../../chunk-ZO7KL7GN.js';
 import '../../chunk-ZNIHTT22.js';
+import '../../chunk-P5W6JVD4.js';
+import '../../chunk-ISQWMBKD.js';
+import '../../chunk-RRVQAE5D.js';
+import '../../chunk-V34ZEXSE.js';
+import '../../chunk-GAH4YRCI.js';
+import '../../chunk-SR6NBBWT.js';
 import '../../chunk-6E6PKKAD.js';
 import '../../chunk-IFGTRL2I.js';
-import '../../chunk-E4AVJMOJ.js';
-import '../../chunk-XJ74XFIZ.js';
-import '../../chunk-SCR3WGW7.js';
-import '../../chunk-TUYN2HDT.js';
+import '../../chunk-S5FV6ISY.js';
+import '../../chunk-5QGMEPUX.js';
+import '../../chunk-7KFN2EPR.js';
+import '../../chunk-F5VREBV2.js';
 import '../../chunk-P43HBWKK.js';
 import '../../chunk-F3HNW354.js';
 import '../../chunk-K5GBV4SA.js';

package/dist/factory-assets/connectors/flow/CONNECTOR.md

@@ -17,9 +17,11 @@ bridges three ownership roles:
   read-only `get_state`, `get_globals`, `get_available`, `validate_node`,
   `build_handoff`).
 - **Runtime** — resolves available `router` nodes with bounded expressions,
-  drains available `function` nodes through `NodeExecutor`, parks available
-  `gate` nodes through durable approval state, and drives available `sub-flow`
-  nodes inline before an agent turn is considered.
+  drains available `function` and `check` nodes through `NodeExecutor`, drains
+  available `subprompt` nodes through `SubpromptRunner` on a second, isolated
+  driver instance, parks available `gate` nodes through durable approval
+  state, and drives available `sub-flow` nodes inline before an agent turn is
+  considered.
 - **Host** — the runner applies out-of-turn mutations through direct adapter
   methods (`applyApproval`, `applyInput`, `retryNode`, `setAutonomousMode`,
   `cancel`, `hydrate`) in response to platform actions, forwards persistence
@@ -37,20 +39,87 @@ declared in `skaile.yaml` — it is constructed by the runner per session
 and bound to the active `FlowDefinition`.
 
 The adapter normalizes authored definitions at its connect/start boundary.
-Strict v2 `run.kind: agent`, `run.kind: function`, `run.kind: gate`,
-`run.kind: router`, and `run.kind: sub-flow` nodes are active. Among legacy
-definitions, explicit `type: skill` nodes normalize into the agent shape and exact `type: sub-flow`
+All seven strict v2 kinds — `run.kind: agent`, `run.kind: subprompt`,
+`run.kind: function`, `run.kind: check`, `run.kind: gate`, `run.kind: router`,
+and `run.kind: sub-flow` — are active. Among legacy definitions, explicit
+`type: skill` nodes normalize into the agent shape and exact `type: sub-flow`
 nodes with `data.flow` normalize into the active inline-child shape. Other
 legacy kinds normalize to false-precondition router placeholders: they are
 tracked but never become available, so their outgoing hard flow edges remain
 blocking. A selected
 available or running agent receives its instruction, resolved
 bindings with origins, asset requirements, and completed predecessor
-context through `build_handoff`. Functions receive resolved raw values as
-environment variables while provenance remains on the executor request. They
-inherit the session environment and run from the session workspace.
-Configured stdout/stderr captures map only to `fields.<name>` output keys and
-remain attached to both completed and failed node executions.
+context through `build_handoff`. Functions and checks receive resolved raw
+values as environment variables while provenance remains on the executor
+request. They inherit the session environment and run from the session
+workspace. Configured stdout/stderr captures map only to `fields.<name>`
+output keys and remain attached to both completed and failed node executions.
+A subprompt receives its interpolated instruction as a plain-text prompt, not
+environment variables — see below.
+
+A `check` runs the same deterministic process as a function, through the same
+`NodeExecutor` seam, but its exit status is a pass/fail verdict rather than a
+plain success/failure. A clean exit inside `successExit` completes the node
+exactly like a function — no approval, no agent turn, dark. A clean exit
+outside `successExit` is a fail *verdict*: the runtime derives evidence — each
+compared binding's value, whether *every compared value's immediate origin*
+was runtime-obtained (`"verified"`) or at least one was agent-obtained
+(`"asserted"`; the taint check is one-hop, not transitive — see
+`engine/check-provenance.ts`), and whether the check's inputs could have
+observed anything beyond the flow's own authored state — plus the process
+record (`runtime`, `command`, `cwd`, `successExit`) so a persisted attempt is
+self-describing, and attaches it to the attempt. `provenance` is present only
+when there was at least one compared value; `inputs` defaults to `"live"`
+(the floor for any check that runs a process) and is `"flow-local"` only when
+every compared value's origins are all `literal`/`default`/`flow-input`. A
+check cannot declare `control.optional` — rejected at parse time, since an
+optional verification is close to a contradiction either way it could resolve.
+Once the automatic retry budget (`control.retries`) is exhausted, `onFail:
+'fail'` (the alternative) fails the node terminally, while `onFail: 'escalate'`
+(the default) parks it at `awaiting_approval` with an `Approval` naming the
+failed check, its exit status, and the provenance label when one applies.
+Escalation is a one-way door: `applyApproval` rejects an `"approved"` decision
+on a check outright rather than silently ignoring it, and a `"rejected"`
+decision ends the node terminally `failed` — there is no revision path and no
+way back to `available`. A spawn failure or a timeout produced no verdict at
+all, so it is always a plain node failure, carries no evidence, and never
+escalates regardless of `onFail`.
+
+A `subprompt` is `function`-shaped for everything except how the work is
+performed and how its output provenance is classified. Instead of
+`NodeExecutor`, an available subprompt hands its interpolated instruction —
+plus a JSON-response directive when `contract.output.fields` is declared —
+to a `SubpromptRunner`. The production implementation, `SessionSubpromptRunner`,
+constructs a **second, isolated** `AgentDriver` instance per call: same
+backend, provider, resolved model, and credentials as the session driver
+(threaded through from the same values the two production wiring sites
+already resolved for it — no new credential channel), but no Skaile system prompt, no MCP servers, no connector capabilities, and no access to the session conversation, bounded to a single turn. It does retain the backend's own native tool surface (a coding backend keeps its file and shell tools, rooted at the session workspace) — isolation here means a separate conversation, not a sandbox. The
+instance is started, sent one prompt, and killed afterward; isolation comes
+from the separate instance, never `resetSession()` (which mutates the shared
+session). `run.model` resolves through a pure `resolveModelTier` in
+`bridge/src/models.ts`: a configured override first, then the provider's
+built-in tier. `default` and an absent tier fall back to the session model;
+`small`/`deep` fail the node instead of substituting one, so an explicit
+cost or quality request is never silently served by a different model. With no declared output contract the response is
+prose, carried verbatim as the summary; with one declared, the response is
+additionally parsed as JSON into `fields` and validated through the same
+`validateConsumedNodeOutput` seam every other kind uses. The reply stays in
+`summary` either way — `fields` is reachable only through an expression
+binding, while `build_handoff` shows a downstream agent a predecessor's
+summary/artifacts/concerns and never its `fields`, so replacing the summary
+would make a declared output invisible to any consumer that reads it as
+context rather than binding it. There is no
+corrective reprompt — a subprompt has no conversation to reprompt in — so a
+parse or validation failure is an ordinary node failure that consumes
+`control.retries`, never fabricated output. `control.optional`,
+`control.retries`, and `control.timeoutSec` reuse the identical
+`raceWithTimeout` / `executionGeneration` / automatic-retry machinery as
+`function` and `check` — including `raceWithTimeout`'s known limit: it stops
+waiting on timeout but does not cancel the underlying call, so a timed-out
+subprompt keeps running (and being billed) after the node fails. A
+subprompt's output is classified `obtainedBy: "agent"` — model-generated even
+though the *runtime* made the call — so a downstream `check` consuming it
+always derives `"asserted"` provenance, never `"verified"`.
 
 A first-class gate never enters the agent mutation surface and never calls
 `NodeExecutor`. Admission parks it at `awaiting_approval` with `run.prompt` as

package/dist/factory-assets/connectors/flow/adapter.d.ts

@@ -30,6 +30,7 @@ import type { BindingOrigin } from "./contract/expression.js";
 import { type FlowDefinition, isBlocking } from "./engine/index.js";
 import type { NodeExecutor } from "./node-executor.js";
 import type { InlineSubFlowOperationTarget, InlineSubFlowRunner } from "./sub-flow-runner.js";
+import type { SubpromptRunner } from "./subprompt-runner.js";
 import { type TurnStimulus } from "./prompt-fragments.js";
 /**
  * Minimal structural shape of the runner's `SessionStimulusBus`. Declared
@@ -81,6 +82,8 @@ export interface FlowAdapterState {
     lastSignaledExecution?: FlowExecution;
     /** Deterministic runtime backed by the already-materialized session workspace. */
     nodeExecutor?: NodeExecutor;
+    /** Isolated model-call runtime for subprompt nodes — a second driver instance, never the session driver. */
+    subpromptRunner?: SubpromptRunner;
     /** Host-owned inline child lifecycle, backed by the existing materialized session. */
     inlineSubFlowRunner?: InlineSubFlowRunner;
     /** Transient child operation routes keyed by their owning parent sub-flow node. */
@@ -91,6 +94,14 @@ export interface FlowAdapterState {
     inlineSubFlowAncestry: string[];
     /** Non-durable ownership epoch for results returned by in-flight inline children. */
     executionGeneration: number;
+    /**
+     * Non-durable opportunistic wake timer for agent-node deadline re-evaluation.
+     * The derived deadline (see `engine/node-deadline.ts`) is the source of truth;
+     * this timer's only job is to trigger a re-evaluation call while nothing else
+     * would (a genuinely hung agent turn has no other event to react to). Rearmed
+     * after every mutation, `connect()`, and `hydrate()`; cleared on `disconnect()`.
+     */
+    wakeTimer: ReturnType<typeof setTimeout> | null;
 }
 /**
  * Options the runner passes via `declaration.options` when connecting the `FlowAdapter`.
@@ -127,6 +138,8 @@ export interface FlowAdapterConnectOptions {
     useBusForStimulus?: boolean;
     /** Runtime for function nodes. Required before deterministic nodes are drained. */
     nodeExecutor?: NodeExecutor;
+    /** Runtime for subprompt nodes. Required before subprompt nodes are drained. */
+    subpromptRunner?: SubpromptRunner;
     /** Host lifecycle used to resolve and drive inline child flows in the current session. */
     inlineSubFlowRunner?: InlineSubFlowRunner;
     /** @internal Provenance for child flow inputs, retained only in the live adapter. */
@@ -188,7 +201,9 @@ export declare class FlowAdapter extends AbstractConnector {
     /**
      * Record an approval decision on a node currently `awaiting_approval`.
      * A first-class gate completes directly when approved and remains parked when rejected.
-     * Agent-node approvals keep their existing resume behavior.
+     * Agent-node approvals keep their existing resume behavior. A check's escalation is a
+     * one-way door: only `rejected` is legal, and it ends the node terminally `failed` —
+     * there is no decision that resumes or passes a check.
      */
     applyApproval(handle: ConnectorHandle, nodeId: string, decision: "approved" | "rejected", feedback: string | undefined, decidedBy: string): void;
     /**
@@ -204,7 +219,13 @@ export declare class FlowAdapter extends AbstractConnector {
     retryNode(handle: ConnectorHandle, nodeId: string): void;
     /** Toggle autonomous mode at the flow-execution level. */
     setAutonomousMode(handle: ConnectorHandle, enabled: boolean): void;
-    /** Cancel the flow run. Status transitions to `cancelled`; dependents stay put. */
+    /**
+     * Cancel the flow run. Status transitions to `cancelled`; dependents stay
+     * put. Bumps `executionGeneration` — the sole late-settlement rejection
+     * mechanism every in-flight await (function executor, sub-flow child)
+     * checks after resolving, so a result that arrives after cancellation can
+     * never write state.
+     */
     cancel(handle: ConnectorHandle): void;
     /** Read-only access to the current FlowExecution snapshot. */
     getExecution(handle: ConnectorHandle): FlowExecution;
@@ -229,9 +250,11 @@ export declare class FlowAdapter extends AbstractConnector {
      */
     drainRuntimeNodes(handle: ConnectorHandle): Promise<FlowExecution>;
     /**
-     * Run every currently available function node through the configured
-     * NodeExecutor. Newly-unblocked function nodes are drained in definition
-     * order before returning control to the runner's agent-turn decision.
+     * Run every currently available function and check node through the
+     * configured NodeExecutor. Newly-unblocked function/check nodes are
+     * drained in definition order before returning control to the runner's
+     * agent-turn decision. Routers and gates are excluded — see
+     * {@link drainRuntimeNodes} for the full drain.
      */
     executeAvailableFunctionNodes(handle: ConnectorHandle): Promise<FlowExecution>;
     private drainAvailableRuntimeNodes;
@@ -252,6 +275,75 @@ export declare class FlowAdapter extends AbstractConnector {
      * state directly.
      */
     private recompute;
+    private clearWakeTimer;
+    /**
+     * Whether `execution` counts as "actively running" for `control.timeoutSec`
+     * evaluation. Ordinarily this is just `status === "running"`. The one
+     * exception: a non-gate agent node whose approval was just decided
+     * `approved` stays at `awaiting_approval` — `applyApproval` deliberately
+     * does not restore `running` there, because `doCompleteNode`'s
+     * `approvedPrior` check requires exactly that status (a mandatory-approval
+     * node has no `runningAutonomous` fallback). Without this second clause the
+     * timeout would pause for the approval wait (correctly, via
+     * `remainingActiveExecutionMs` reading the now-resolved `approvalHistory`
+     * entry) and then never resume, since nothing re-evaluates a node that
+     * never looks "running" again.
+     */
+    private isDeadlineEligible;
+    /**
+     * Recomputes the pending wake timer against the current state: cancels any
+     * previously-armed timer, then arms a fresh one for the earliest deadline
+     * among currently `running` agent nodes with a `control.timeoutSec`. A
+     * no-op when nothing is running against a timeout, or the flow is already
+     * terminal. Called after every {@link mutate}, plus `connect()` and
+     * `hydrate()` (which bypass `mutate()`).
+     *
+     * `disconnect()` clears the timer and bumps `executionGeneration`, but a
+     * `mutate()` already in flight (or one that lands after teardown for any
+     * other reason) still calls this on its way out — bail here on
+     * `handle.status` so a post-disconnect mutation can never re-arm a timer
+     * that would fire against a handle nothing is watching anymore.
+     */
+    private rearmWakeTimer;
+    /**
+     * Re-checks every `running` agent node's derived deadline and, for any that
+     * have expired, either auto-retries (bounded by `control.retries`, composing
+     * with the existing `doFailNode(recoverable: true)` and `retryNode`
+     * pathways) or terminally fails the node. Safe to call at any time — the
+     * derived deadline means this is a no-op unless something has actually
+     * expired. Goes through {@link mutate}, so a state change here republishes
+     * `onChange`/stimulus exactly like any other mutation, waking a fresh turn
+     * when the node retries or the flow rolls up to `failed`.
+     */
+    private evaluateAgentNodeDeadlines;
+    /**
+     * Records one failed attempt on `nodeId`'s execution and decides whether
+     * the automatic bounded retry (`control.retries`) still has budget. Shared
+     * by every automatic-failure seam (agent-node timeout, function/check
+     * execution/timeout failure, sub-flow execution/timeout failure, and a
+     * check's fail verdict) so the budget — derived from prior `'failed'`
+     * entries in `outputHistory`, not a separate durable counter — is computed
+     * once, the same way, everywhere.
+     *
+     * Returns the `NodeExecution` patch (error/errorHistory/outputHistory/
+     * output) plus whether budget remains; the caller decides the resulting
+     * `status` because that differs by kind (e.g. sub-flow degrades an
+     * optional node's exhausted failure to `skipped`; agent/function do not,
+     * preserving their existing behavior). A terminal failure whose node has
+     * any `control.retries` configured carries `recoverable: true` so the
+     * manual `retryNode` operator override — which sits outside this budget
+     * entirely — remains usable once the automatic budget runs out.
+     *
+     * @param sourceErrorAtIso - The failure's own timestamp, when the caller has
+     *   one more precise than `completedAtIso` (e.g. a sub-flow child reports
+     *   its own `error.at`, which can predate this node's parent-side
+     *   `completedAt` by however long the result took to propagate). Defaults
+     *   to `completedAtIso` for callers (agent-timeout, function-node) whose
+     *   failure message is synthesized at the moment of detection.
+     * @param checkEvidence - Derived evidence for a check's fail verdict, so it
+     *   rides on the same appended attempt as the failure it explains.
+     */
+    private planAutomaticRetry;
     /**
      * Build the selected agent node's complete turn briefing plus upstream context.
      */