@skaile/workspaces 3.27.0 → 4.0.0

package/dist/{chunk-3NCGSSCU.js → chunk-WLFRA5RM.js}

@@ -1,4 +1,5 @@
 import { fsDeadlineMs, withFsDeadline, tryWithFsDeadline } from './chunk-MKZOK4JU.js';
+import { entryTransport, resolveEntryBaseUrl } from './chunk-ILG4BXYE.js';
 import { createReadStream, createWriteStream } from 'fs';
 import { readdir, stat, rename, unlink } from 'fs/promises';
 import { join } from 'path';
@@ -6,27 +7,25 @@ import { pipeline } from 'stream/promises';
 import { homedir } from 'os';
 
 // bridge/src/cloud.ts
-var SUPPORTED_CLOUDS = ["default", "bedrock", "vertex", "azure", "gateway"];
-var CLOUD_SECRET_ENV_KEYS = {
-  bedrock: [
-    "AWS_ACCESS_KEY_ID",
-    "AWS_SECRET_ACCESS_KEY",
-    "AWS_SESSION_TOKEN",
-    "AWS_BEARER_TOKEN_BEDROCK"
-  ],
-  vertex: ["GOOGLE_APPLICATION_CREDENTIALS_JSON"],
-  azure: ["ANTHROPIC_FOUNDRY_API_KEY"],
-  gateway: ["ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_API_KEY"]
-};
 var SCRUBBED_ENV_KEYS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL"];
-function buildClaudeCloudEnv(args) {
-  const { cloud, cloudConfig, cloudSecrets, baseEnv, configEnv, fallbackApiKey } = args;
+var ANTHROPIC_DEFAULT_BASE_URL = "https://api.anthropic.com";
+var SDK_OWNED_HEADERS = {
+  "anthropic-version": true,
+  authorization: true,
+  "x-api-key": true
+};
+function claudeEndpointMode(entry) {
+  const surface = entry.surface;
+  const transport = entryTransport(entry);
+  if (surface === "bedrock-converse-stream" || transport === "bedrock") return "bedrock";
+  if (surface === "google-vertex" || transport === "vertex") return "vertex";
+  if (transport === "foundry") return "foundry";
+  return "anthropic";
+}
+function buildClaudeEndpointEnv(args) {
+  const { entry, credential, baseEnv, configEnv } = args;
   const env = { ...baseEnv, ...configEnv ?? {} };
-  const ambient = {
-    authToken: env.ANTHROPIC_AUTH_TOKEN,
-    apiKey: env.ANTHROPIC_API_KEY,
-    baseUrl: env.ANTHROPIC_BASE_URL
-  };
+  const ambient = { authToken: env.ANTHROPIC_AUTH_TOKEN, apiKey: env.ANTHROPIC_API_KEY };
   for (const key of Object.keys(env)) {
     if (SCRUBBED_ENV_KEYS.includes(key) || key.startsWith("CLAUDE_CODE_USE_")) {
       delete env[key];
@@ -35,40 +34,43 @@ function buildClaudeCloudEnv(args) {
   const set = (key, value) => {
     if (value) env[key] = value;
   };
-  switch (cloud) {
+  const kind = entry.credential?.kind ?? "none";
+  const params = entry.params;
+  const headers = Object.entries(entry.headers ?? {}).filter(
+    ([name]) => !SDK_OWNED_HEADERS[name.toLowerCase()]
+  );
+  if (headers.length > 0) {
+    env.ANTHROPIC_CUSTOM_HEADERS = headers.map(([name, value]) => `${name}: ${value}`).join("\n");
+  }
+  switch (claudeEndpointMode(entry)) {
     case "bedrock": {
       env.CLAUDE_CODE_USE_BEDROCK = "1";
-      for (const key of CLOUD_SECRET_ENV_KEYS.bedrock) set(key, cloudSecrets?.[key]);
-      set("AWS_REGION", cloudConfig?.region);
+      set("AWS_REGION", params?.region);
       break;
     }
     case "vertex": {
       env.CLAUDE_CODE_USE_VERTEX = "1";
-      set("GOOGLE_APPLICATION_CREDENTIALS", cloudSecrets?.GOOGLE_APPLICATION_CREDENTIALS);
-      set("ANTHROPIC_VERTEX_PROJECT_ID", cloudConfig?.projectId);
-      set("CLOUD_ML_REGION", cloudConfig?.region);
+      set("ANTHROPIC_VERTEX_PROJECT_ID", params?.project);
+      set("CLOUD_ML_REGION", params?.location);
       break;
     }
-    case "azure": {
+    case "foundry": {
       env.CLAUDE_CODE_USE_FOUNDRY = "1";
-      set("ANTHROPIC_FOUNDRY_API_KEY", cloudSecrets?.ANTHROPIC_FOUNDRY_API_KEY);
-      if (cloudConfig?.resource) {
-        env.ANTHROPIC_FOUNDRY_RESOURCE = cloudConfig.resource;
-      } else {
-        set("ANTHROPIC_FOUNDRY_BASE_URL", cloudConfig?.baseUrl);
-      }
+      if (entry.base_url) set("ANTHROPIC_FOUNDRY_BASE_URL", entry.base_url);
+      else set("ANTHROPIC_FOUNDRY_RESOURCE", params?.resource);
+      set("ANTHROPIC_FOUNDRY_API_KEY", credential);
       break;
     }
-    case "gateway": {
-      set("ANTHROPIC_BASE_URL", cloudConfig?.baseUrl ?? ambient.baseUrl);
-      const authToken = cloudSecrets?.ANTHROPIC_AUTH_TOKEN ?? ambient.authToken;
-      if (authToken) {
-        env.ANTHROPIC_AUTH_TOKEN = authToken;
-      } else {
-        set(
-          "ANTHROPIC_API_KEY",
-          cloudSecrets?.ANTHROPIC_API_KEY ?? fallbackApiKey ?? ambient.apiKey
-        );
+    case "anthropic": {
+      const baseUrl = resolveEntryBaseUrl(entry)?.trim().replace(/\/+$/, "");
+      if (baseUrl && baseUrl.toLowerCase() !== ANTHROPIC_DEFAULT_BASE_URL) {
+        env.ANTHROPIC_BASE_URL = baseUrl;
+      }
+      if (kind === "bearer") set("ANTHROPIC_AUTH_TOKEN", credential);
+      else if (kind === "api_key_header") set("ANTHROPIC_API_KEY", credential);
+      if (!credential) {
+        if (ambient.authToken) env.ANTHROPIC_AUTH_TOKEN = ambient.authToken;
+        else set("ANTHROPIC_API_KEY", ambient.apiKey);
       }
       break;
     }
@@ -291,6 +293,6 @@ async function probeResumeTranscript(sessionId, opts) {
   }
 }
 
-export { CLOUD_SECRET_ENV_KEYS, SUPPORTED_CLOUDS, buildClaudeCloudEnv, probeResumeTranscript, resolveClaudeConfigDir, scrubPoisonedTranscript };
-//# sourceMappingURL=chunk-3NCGSSCU.js.map
-//# sourceMappingURL=chunk-3NCGSSCU.js.map
+export { ANTHROPIC_DEFAULT_BASE_URL, buildClaudeEndpointEnv, claudeEndpointMode, probeResumeTranscript, resolveClaudeConfigDir, scrubPoisonedTranscript };
+//# sourceMappingURL=chunk-WLFRA5RM.js.map
+//# sourceMappingURL=chunk-WLFRA5RM.js.map

package/dist/chunk-WLFRA5RM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/cloud.ts","../bridge/src/drivers/scrub-transcript.ts","../bridge/src/drivers/resume-probe.ts"],"names":["join"],"mappings":";;;;;;;;;AAsCA,IAAM,iBAAA,GAAoB,CAAC,mBAAA,EAAqB,sBAAA,EAAwB,oBAAoB,CAAA;AAQrF,IAAM,0BAAA,GAA6B;AAQ1C,IAAM,iBAAA,GAA0C;AAAA,EAC9C,mBAAA,EAAqB,IAAA;AAAA,EACrB,aAAA,EAAe,IAAA;AAAA,EACf,WAAA,EAAa;AACf,CAAA;AAcO,SAAS,mBAAmB,KAAA,EAA4C;AAC7E,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,eAAe,KAAK,CAAA;AACtC,EAAA,IAAI,OAAA,KAAY,yBAAA,IAA6B,SAAA,KAAc,SAAA,EAAW,OAAO,SAAA;AAC7E,EAAA,IAAI,OAAA,KAAY,eAAA,IAAmB,SAAA,KAAc,QAAA,EAAU,OAAO,QAAA;AAClE,EAAA,IAAI,SAAA,KAAc,WAAW,OAAO,SAAA;AACpC,EAAA,OAAO,WAAA;AACT;AA2CO,SAAS,uBAAuB,IAAA,EAAsD;AAC3F,EAAA,MAAM,EAAE,KAAA,EAAO,UAAA,EAAY,OAAA,EAAS,WAAU,GAAI,IAAA;AAClD,EAAA,MAAM,MAA8B,EAAE,GAAG,SAAS,GAAI,SAAA,IAAa,EAAC,EAAG;AAIvE,EAAA,MAAM,UAAU,EAAE,SAAA,EAAW,IAAI,oBAAA,EAAsB,MAAA,EAAQ,IAAI,iBAAA,EAAkB;AAErF,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,IAAA,IAAI,kBAAkB,QAAA,CAAS,GAAG,KAAK,GAAA,CAAI,UAAA,CAAW,kBAAkB,CAAA,EAAG;AACzE,MAAA,OAAO,IAAI,GAAG,CAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,CAAC,GAAA,EAAa,KAAA,KAA8B;AAGtD,IAAA,IAAI,KAAA,EAAO,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,EACxB,CAAA;AAEA,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,UAAA,EAAY,IAAA,IAAQ,MAAA;AACvC,EAAA,MAAM,SAAU,KAAA,CAA6B,MAAA;AAK7C,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,OAAA,IAAW,EAAE,CAAA,CAAE,MAAA;AAAA,IAClD,CAAC,CAAC,IAAI,CAAA,KAAM,CAAC,iBAAA,CAAkB,IAAA,CAAK,aAAa;AAAA,GACnD;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,GAAA,CAAI,wBAAA,GAA2B,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAK,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EAC9F;AAEA,EAAA,QAAQ,kBAAA,CAAmB,KAAK,CAAA;AAAG,IACjC,KAAK,SAAA,EAAW;AACd,MAAA,GAAA,CAAI,uBAAA,GAA0B,GAAA;AAG9B,MAAA,GAAA,CAAI,YAAA,EAAc,QAAQ,MAAM,CAAA;AAChC,MAAA;AAAA,IACF;AAAA,IACA,KAAK,QAAA,EAAU;AACb,MAAA,GAAA,CAAI,sBAAA,GAAyB,GAAA;AAG7B,MAAA,GAAA,CAAI,6BAAA,EAA+B,QAAQ,OAAO,CAAA;AAClD,MAAA,GAAA,CAAI,iBAAA,EAAmB,QAAQ,QAAQ,CAAA;AACvC,MAAA;AAAA,IACF;AAAA,IACA,KAAK,SAAA,EAAW;AACd,MAAA,GAAA,CAAI,uBAAA,GAA0B,GAAA;AAG9B,MAAA,IAAI,KAAA,CAAM,QAAA,EAAU,GAAA,CAAI,4BAAA,EAA8B,MAAM,QAAQ,CAAA;AAAA,WAC/D,GAAA,CAAI,4BAAA,EAA8B,MAAA,EAAQ,QAAQ,CAAA;AACvD,MAAA,GAAA,CAAI,6BAA6B,UAAU,CAAA;AAC3C,MAAA;AAAA,IACF;AAAA,IACA,KAAK,WAAA,EAAa;AAChB,MAAA,MAAM,OAAA,GAAU,oBAAoB,KAAK,CAAA,EAAG,MAAK,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACrE,MAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,WAAA,EAAY,KAAM,0BAAA,EAA4B;AACnE,QAAA,GAAA,CAAI,kBAAA,GAAqB,OAAA;AAAA,MAC3B;AACA,MAAA,IAAI,IAAA,KAAS,QAAA,EAAU,GAAA,CAAI,sBAAA,EAAwB,UAAU,CAAA;AAAA,WAAA,IACpD,IAAA,KAAS,gBAAA,EAAkB,GAAA,CAAI,mBAAA,EAAqB,UAAU,CAAA;AACvE,MAAA,IAAI,CAAC,UAAA,EAAY;AAGf,QAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,GAAA,CAAI,oBAAA,GAAuB,OAAA,CAAQ,SAAA;AAAA,aACrD,GAAA,CAAI,mBAAA,EAAqB,OAAA,CAAQ,MAAM,CAAA;AAAA,MAC9C;AACA,MAAA;AAAA,IACF;AAAA;AAGF,EAAA,OAAO,GAAA;AACT;ACvFA,IAAM,SAAA,GAAY,2CAAA;AAGlB,IAAM,mBAAA,GAAsB,kCAAA;AAO5B,IAAM,eAAA,GAAkB,IAAI,IAAA,GAAO,IAAA;AAa5B,SAAS,oBAAoB,MAAA,EAA+B;AACjE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AAEF,IAAA,GAAA,GAAM,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,EAAG,EAAE,GAAG,QAAQ,CAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AAClB,IAAA,OAAO,IAAA;AAAA,EACT;AAIA,EAAA,IAAI,IAAI,CAAC,CAAA,KAAM,OAAQ,GAAA,CAAI,CAAC,MAAM,GAAA,EAAM;AACtC,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,GAAA,IAAQ,IAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,MAAM,EAAA,EAAM;AAC5E,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,IAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IAAQ,GAAA,CAAI,CAAC,MAAM,EAAA,EAAM;AAC5E,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,IACE,GAAA,CAAI,MAAA,IAAU,EAAA,IACd,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IACX,GAAA,CAAI,CAAC,MAAM,EAAA,IACX,GAAA,CAAI,CAAC,CAAA,KAAM,MACX,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IACX,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,IACX,IAAI,CAAC,CAAA,KAAM,EAAA,IACX,GAAA,CAAI,EAAE,CAAA,KAAM,EAAA,IACZ,GAAA,CAAI,EAAE,MAAM,EAAA,EACZ;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAyBA,SAAS,aAAa,CAAA,EAA0B;AAC9C,EAAA,OAAO,CAAA,CAAE,SAAA,GAAY,CAAA,CAAE,OAAA,GAAU,CAAA,CAAE,aAAA;AACrC;AAkBA,SAAS,UAAA,CAAW,OAAyB,QAAA,EAA2C;AACtF,EAAA,IAAI,MAAM,IAAA,KAAS,aAAA,IAAiB,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA,EAAG;AAChE,IAAA,OAAO;AAAA,MACL,GAAG,KAAA;AAAA,MACH,OAAA,EAAU,MAAM,OAAA,CAA+B,GAAA,CAAI,CAAC,KAAA,KAAU,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAC;AAAA,KAC3F;AAAA,EACF;AAKA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,IAAU,KAAA,CAAM,iBAAiB,IAAA,EAAM;AACxD,IAAA,MAAM,OAAO,OAAO,KAAA,CAAM,IAAA,KAAS,QAAA,GAAW,MAAM,IAAA,GAAO,EAAA;AAC3D,IAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,EAAA,EAAI;AACtB,MAAA,QAAA,CAAS,aAAA,EAAA;AACT,MAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,KAAA,EAAM;AACzB,MAAA,OAAO,KAAA,CAAM,aAAA;AACb,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IACE,KAAA,CAAM,IAAA,KAAS,OAAA,IACf,KAAA,CAAM,MAAA,EAAQ,IAAA,KAAS,QAAA,IACvB,OAAO,KAAA,CAAM,MAAA,CAAO,IAAA,KAAS,QAAA,EAC7B;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA;AAI1B,IAAA,IAAI,KAAK,KAAA,CAAO,IAAA,CAAK,SAAS,CAAA,GAAK,CAAC,IAAI,eAAA,EAAiB;AACvD,MAAA,QAAA,CAAS,OAAA,EAAA;AACT,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,mBAAA,EAAoB;AAAA,IACnD;AACA,IAAA,MAAM,OAAA,GAAU,oBAAoB,IAAI,CAAA;AACxC,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,QAAA,CAAS,OAAA,EAAA;AACT,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IACzC;AACA,IAAA,IAAI,OAAA,KAAY,KAAA,CAAM,MAAA,CAAO,UAAA,EAAY;AACvC,MAAA,QAAA,CAAS,SAAA,EAAA;AACT,MAAA,OAAO,EAAE,GAAG,KAAA,EAAO,MAAA,EAAQ,EAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,EAAE;AAAA,IACtE;AAAA,EACF;AAEA,EAAA,OAAO,KAAA;AACT;AAkBA,eAAsB,oBAAA,CACpB,SAAA,EACA,SAAA,EACA,SAAA,GAAoB,cAAa,EACT;AACxB,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,UAAU,CAAA;AAC9C,EAAA,MAAM,UAAU,MAAM,iBAAA;AAAA,IACpB,WAAW,WAAW,CAAA,CAAA;AAAA,IACtB,MAAM,QAAQ,WAAW,CAAA;AAAA,IACzB,IAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAM,YAAY,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAA,EAAG,SAAS,CAAA,MAAA,CAAQ,CAAA;AAC/D,IAAA,MAAM,QAAQ,MAAM,iBAAA;AAAA,MAClB,QAAQ,SAAS,CAAA,CAAA;AAAA,MACjB,YAAA,CAAa,MAAM,IAAA,CAAK,SAAS,GAAG,MAAA,EAAO;AAAA,MAC3C,KAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,OAAO,OAAO,SAAA;AAAA,EACpB;AACA,EAAA,OAAO,IAAA;AACT;AAiBA,gBAAgB,YAAY,QAAA,EAA0C;AACpE,EAAA,MAAM,SAAS,gBAAA,CAAiB,QAAA,EAAU,EAAE,QAAA,EAAU,QAAQ,CAAA;AAC9D,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,IAAI;AACF,IAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,MAAA,OAAA,IAAW,KAAA;AACX,MAAA,IAAI,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AAC9B,MAAA,OAAO,QAAQ,CAAA,CAAA,EAAI;AACjB,QAAA,MAAM,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC1B,QAAA,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC/B,QAAA,GAAA,GAAM,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,MAC5B;AAAA,IACF;AACA,IAAA,MAAM,OAAA;AAAA,EACR,CAAA,SAAE;AACA,IAAA,MAAA,CAAO,OAAA,EAAQ;AAAA,EACjB;AACF;AAYA,SAAS,UAAA,CAAW,MAAc,QAAA,EAAiC;AACjE,EAAA,IAAI,IAAA,CAAK,IAAA,EAAK,KAAM,EAAA,EAAI,OAAO,IAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAI,IAAI,IAAA,GAAO,EAAA;AACzC,EAAA,MAAM,OAAO,GAAA,KAAQ,EAAA,GAAK,OAAO,IAAA,CAAK,KAAA,CAAM,GAAG,EAAE,CAAA;AACjD,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,MAAM,OAAA,EAAS,OAAA;AAC/B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,GAAG,OAAO,IAAA;AACpC,EAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AACpC,EAAA,MAAM,QAAA,GAAY,QAA+B,GAAA,CAAI,CAAC,UAAU,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAC,CAAA;AAC3F,EAAA,IAAI,YAAA,CAAa,QAAQ,CAAA,KAAM,MAAA,EAAQ,OAAO,IAAA;AAC9C,EAAA,OAAO,GAAG,IAAA,CAAK,SAAA,CAAU,EAAE,GAAG,OAAO,OAAA,EAAS,EAAE,GAAG,KAAA,CAAM,SAAS,OAAA,EAAS,QAAA,IAAY,CAAC,GAAG,GAAG,CAAA,CAAA;AAChG;AAqBA,eAAsB,wBACpB,IAAA,EACgC;AAChC,EAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAW,GAAA,EAAI,GAAI,IAAA;AACtC,EAAA,MAAM,YAAY,YAAA,EAAa;AAC/B,EAAA,MAAM,MAAA,GAAgC;AAAA,IACpC,QAAA,EAAU,IAAA;AAAA,IACV,SAAA,EAAW,CAAA;AAAA,IACX,OAAA,EAAS,CAAA;AAAA,IACT,aAAA,EAAe,CAAA;AAAA,IACf,OAAA,EAAS;AAAA,GACX;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,oBAAA,CAAqB,SAAA,EAAW,WAAW,SAAS,CAAA;AAC3E,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,GAAA,EAAK,IAAA,CAAK,uCAAA,EAAyC,EAAE,SAAA,EAAW,WAAW,CAAA;AAC3E,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAA,CAAO,QAAA,GAAW,QAAA;AAGlB,EAAA,MAAM,WAA0B,EAAE,SAAA,EAAW,GAAG,OAAA,EAAS,CAAA,EAAG,eAAe,CAAA,EAAE;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,cAAA;AAAA,MACJ,mBAAmB,QAAQ,CAAA,CAAA;AAAA,MAC3B,YAAY;AACV,QAAA,WAAA,MAAiB,QAAQ,WAAA,CAAY,QAAQ,CAAA,EAAG,UAAA,CAAW,MAAM,QAAQ,CAAA;AAAA,MAC3E,CAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,EAAK,KAAK,6CAAA,EAA+C;AAAA,MACvD,QAAA;AAAA,MACA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAA,CAAO,YAAY,QAAA,CAAS,SAAA;AAC5B,EAAA,MAAA,CAAO,UAAU,QAAA,CAAS,OAAA;AAC1B,EAAA,MAAA,CAAO,gBAAgB,QAAA,CAAS,aAAA;AAEhC,EAAA,IAAI,YAAA,CAAa,QAAQ,CAAA,KAAM,CAAA,EAAG;AAChC,IAAA,OAAO,MAAA;AAAA,EACT;AAKA,EAAA,MAAM,OAAA,GAAU,GAAG,QAAQ,CAAA,UAAA,CAAA;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,cAAA;AAAA,MACJ,sBAAsB,QAAQ,CAAA,CAAA;AAAA,MAC9B,YAAY;AACV,QAAA,MAAM,UAAyB,EAAE,SAAA,EAAW,GAAG,OAAA,EAAS,CAAA,EAAG,eAAe,CAAA,EAAE;AAC5E,QAAA,MAAM,QAAA;AAAA,UAAA,CACH,mBAAmB;AAClB,YAAA,IAAI,KAAA,GAAQ,IAAA;AACZ,YAAA,WAAA,MAAiB,IAAA,IAAQ,WAAA,CAAY,QAAQ,CAAA,EAAG;AAC9C,cAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,EAAM,OAAO,CAAA,GAAI;AAAA,EAAK,UAAA,CAAW,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA;AACxE,cAAA,KAAA,GAAQ,KAAA;AAAA,YACV;AAAA,UACF,CAAA,GAAG;AAAA,UACH,iBAAA,CAAkB,OAAA,EAAS,EAAE,QAAA,EAAU,QAAQ;AAAA,SACjD;AACA,QAAA,MAAM,MAAA,CAAO,SAAS,QAAQ,CAAA;AAAA,MAChC,CAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,EAAK,KAAK,gDAAA,EAAkD;AAAA,MAC1D,QAAA;AAAA,MACA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACvD,CAAA;AAGD,IAAA,MAAM,iBAAA,CAAkB,UAAU,OAAO,CAAA,CAAA,EAAI,MAAM,MAAA,CAAO,OAAO,CAAA,EAAG,MAAA,EAAW,SAAS,CAAA;AACxF,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAA,CAAO,OAAA,GAAU,IAAA;AACjB,EAAA,GAAA,EAAK,KAAK,gDAAA,EAAkD;AAAA,IAC1D,QAAA;AAAA,IACA,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,eAAe,MAAA,CAAO;AAAA,GACvB,CAAA;AACD,EAAA,OAAO,MAAA;AACT;ACtcA,IAAM,uBAAA,GAA0B,GAAA;AAwBzB,SAAS,uBAAuB,GAAA,EAAkD;AACvF,EAAA,OAAO,GAAA,EAAK,qBAAqB,OAAA,CAAQ,GAAA,CAAI,qBAAqBA,IAAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AAC7F;AAgBA,eAAsB,qBAAA,CACpB,WACA,IAAA,EAKyC;AACzC,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,IAAA,EAAM,GAAG,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,uBAAA;AACrC,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,oBAAA;AAC/B,EAAA,IAAI;AAIF,IAAA,MAAM,WAAW,MAAM,cAAA;AAAA,MACrB,gBAAgB,SAAS,CAAA,CAAA;AAAA,MACzB,MAAM,MAAA,CAAO,SAAA,EAAW,SAAS,CAAA;AAAA,MACjC;AAAA,KACF;AACA,IAAA,OAAO,WAAW,kBAAA,GAAqB,YAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF","file":"chunk-WLFRA5RM.js","sourcesContent":["/**\n * AI endpoint transport for the `claude-sdk` driver — the Claude Agent SDK's\n * child-process environment.\n *\n * {@link buildClaudeEndpointEnv} takes an **AI provider registry entry** and\n * is what the driver calls, on every transport. It is plan §2.3's\n * `buildEndpointEnv` for the claude-sdk row (named for the driver because the\n * vars it emits — `CLAUDE_CODE_USE_*`, `ANTHROPIC_*` — are the Claude Agent\n * SDK's own contract, not a portable one).\n *\n * A registry entry says what the deleted `cloud` axis said — Amazon Bedrock,\n * Google Vertex AI, Azure AI Foundry, a generic gateway — with `surface` +\n * `transport` + `base_url` + `credential`, and says it for the direct\n * endpoint too, which the `cloud` axis could not address at all.\n *\n * Cross-repo contract: env key names and semantics here are load-bearing —\n * the platform resolves credential bundles against the same key set.\n */\n\nimport {\n  type AIProviderEntry,\n  type AIProviderLlmEntry,\n  entryTransport,\n  resolveEntryBaseUrl,\n} from \"@skaile/workspaces/core/provider-registry\";\n\n/**\n * Env vars scrubbed from the inherited environment before an endpoint env is\n * assembled. Ambient first-party credentials or a stale `CLAUDE_CODE_USE_*`\n * flag must never leak into a session whose entry points elsewhere (the\n * ambient carriers are restored explicitly when the entry has none of its\n * own).\n *\n * Deliberately NOT exhaustive: ambient transport-specific vars (AWS_*,\n * GOOGLE_*, ANTHROPIC_VERTEX_PROJECT_ID, ANTHROPIC_FOUNDRY_*) survive so a\n * standalone CLI inherits its own signing chain; the SDK ignores vars whose\n * transport flag is unset.\n */\nconst SCRUBBED_ENV_KEYS = [\"ANTHROPIC_API_KEY\", \"ANTHROPIC_AUTH_TOKEN\", \"ANTHROPIC_BASE_URL\"];\n\n/**\n * The Anthropic first-party endpoint. An entry that resolves to exactly this\n * host needs no `ANTHROPIC_BASE_URL`: the SDK already points there, and an\n * explicit value would make every default session look like a third-party\n * redirect to Claude Code's own telemetry and auth heuristics.\n */\nexport const ANTHROPIC_DEFAULT_BASE_URL = \"https://api.anthropic.com\";\n\n/**\n * Headers the SDK owns and an entry must not restate through\n * `ANTHROPIC_CUSTOM_HEADERS`: the protocol version it was built against, and\n * the two credential carriers (which are `credential.ref`'s job — a literal\n * secret in `headers` is a validation error anyway).\n */\nconst SDK_OWNED_HEADERS: Record<string, true> = {\n  \"anthropic-version\": true,\n  authorization: true,\n  \"x-api-key\": true,\n};\n\n/**\n * Which of the Claude Agent SDK's four native transports an entry addresses.\n *\n * The SDK has no `transport` field: it switches on a `CLAUDE_CODE_USE_*` flag.\n * Bedrock and Vertex are their own wire surfaces, so they are recognized by\n * `surface` as well as by `transport` — a legacy-derived entry that had no\n * region (and therefore no `params`, and therefore no `transport`) is still a\n * Bedrock session, exactly as it was before the registry existed.\n */\nexport type ClaudeEndpointMode = \"anthropic\" | \"bedrock\" | \"vertex\" | \"foundry\";\n\n/** Classify a registry entry into its {@link ClaudeEndpointMode}. */\nexport function claudeEndpointMode(entry: AIProviderEntry): ClaudeEndpointMode {\n  const surface = (entry as AIProviderLlmEntry).surface;\n  const transport = entryTransport(entry);\n  if (surface === \"bedrock-converse-stream\" || transport === \"bedrock\") return \"bedrock\";\n  if (surface === \"google-vertex\" || transport === \"vertex\") return \"vertex\";\n  if (transport === \"foundry\") return \"foundry\";\n  return \"anthropic\";\n}\n\n/** Arguments for {@link buildClaudeEndpointEnv}. */\nexport interface ClaudeEndpointEnvInput {\n  /** The selected registry entry — the whole endpoint definition. */\n  entry: AIProviderEntry;\n  /**\n   * The entry's credential, already resolved from its `credential.ref`\n   * (`resolveEntryCredential`). Absent for `kind: none`, for an ambient\n   * `sigv4` / `google_adc` / `azure_entra` chain, for `oauth` (whose blob the\n   * runner writes to the Claude credentials file, never to the env), and for a\n   * reference that did not resolve.\n   */\n  credential?: string;\n  /**\n   * The driver's base environment — `process.env` with `undefined` dropped.\n   * The endpoint vars are layered **on top** of it, never instead of it, so\n   * `PATH`, `HOME` and `SKAILE_SESSION_ID` reach the child.\n   */\n  baseEnv: Record<string, string>;\n  /** `AgentConfig.env` plus any credential material the session carried. */\n  configEnv?: Record<string, string>;\n}\n\n/**\n * Assemble the Claude Agent SDK child env for one registry entry (plan §2.3).\n *\n * Pure (no external state read, no input mutated). Starts from `baseEnv`\n * merged with `configEnv`, scrubs the inherited Anthropic credential/routing\n * vars and every `CLAUDE_CODE_USE_*` flag, then writes exactly what the entry\n * describes: at most one transport flag, the endpoint, and the credential in\n * the carrier its `kind` names.\n *\n * Credential kinds (§1.4): `api_key_header` → `ANTHROPIC_API_KEY` (the SDK\n * sends it as `x-api-key`); `bearer` → `ANTHROPIC_AUTH_TOKEN` (sent as\n * `Authorization: Bearer`); `sigv4` / `google_adc` / `azure_entra` emit\n * nothing and let the AWS/Google/Azure chain sign — which is why the scrub\n * deliberately spares ambient `AWS_*` / `GOOGLE_*` values; `oauth` and `none`\n * emit nothing, and the pre-scrub ambient carriers are restored so an OAuth or\n * shell-configured session keeps the auth it had.\n *\n * Never returns `undefined` or empty values; absent settings are omitted.\n */\nexport function buildClaudeEndpointEnv(args: ClaudeEndpointEnvInput): Record<string, string> {\n  const { entry, credential, baseEnv, configEnv } = args;\n  const env: Record<string, string> = { ...baseEnv, ...(configEnv ?? {}) };\n\n  // Captured before the scrub — an entry with no credential material of its\n  // own falls back to these, the way the gateway branch always has.\n  const ambient = { authToken: env.ANTHROPIC_AUTH_TOKEN, apiKey: env.ANTHROPIC_API_KEY };\n\n  for (const key of Object.keys(env)) {\n    if (SCRUBBED_ENV_KEYS.includes(key) || key.startsWith(\"CLAUDE_CODE_USE_\")) {\n      delete env[key];\n    }\n  }\n\n  const set = (key: string, value: string | undefined) => {\n    // Falsy check is deliberate: an empty-string credential/setting is never\n    // valid env — dropping it beats shipping a key the SDK treats as set.\n    if (value) env[key] = value;\n  };\n\n  const kind = entry.credential?.kind ?? \"none\";\n  const params = (entry as AIProviderLlmEntry).params as Record<string, string> | undefined;\n\n  // Static headers ride as ANTHROPIC_CUSTOM_HEADERS (`Name: Value` per line),\n  // the only channel the SDK offers. An entry with none leaves an ambient\n  // value alone.\n  const headers = Object.entries(entry.headers ?? {}).filter(\n    ([name]) => !SDK_OWNED_HEADERS[name.toLowerCase()],\n  );\n  if (headers.length > 0) {\n    env.ANTHROPIC_CUSTOM_HEADERS = headers.map(([name, value]) => `${name}: ${value}`).join(\"\\n\");\n  }\n\n  switch (claudeEndpointMode(entry)) {\n    case \"bedrock\": {\n      env.CLAUDE_CODE_USE_BEDROCK = \"1\";\n      // The AWS credential bundle itself is `configEnv` material (AWS_*), and\n      // ambient AWS_* survived the scrub, so a standalone CLI keeps its own.\n      set(\"AWS_REGION\", params?.region);\n      break;\n    }\n    case \"vertex\": {\n      env.CLAUDE_CODE_USE_VERTEX = \"1\";\n      // GOOGLE_APPLICATION_CREDENTIALS is a path the runner materialized; it\n      // arrives through `configEnv` or ambient, never from `credential`.\n      set(\"ANTHROPIC_VERTEX_PROJECT_ID\", params?.project);\n      set(\"CLOUD_ML_REGION\", params?.location);\n      break;\n    }\n    case \"foundry\": {\n      env.CLAUDE_CODE_USE_FOUNDRY = \"1\";\n      // §1.3: an explicit `base_url` wins over the resource-derived endpoint,\n      // and the SDK has a separate var for each form.\n      if (entry.base_url) set(\"ANTHROPIC_FOUNDRY_BASE_URL\", entry.base_url);\n      else set(\"ANTHROPIC_FOUNDRY_RESOURCE\", params?.resource);\n      set(\"ANTHROPIC_FOUNDRY_API_KEY\", credential);\n      break;\n    }\n    case \"anthropic\": {\n      const baseUrl = resolveEntryBaseUrl(entry)?.trim().replace(/\\/+$/, \"\");\n      if (baseUrl && baseUrl.toLowerCase() !== ANTHROPIC_DEFAULT_BASE_URL) {\n        env.ANTHROPIC_BASE_URL = baseUrl;\n      }\n      if (kind === \"bearer\") set(\"ANTHROPIC_AUTH_TOKEN\", credential);\n      else if (kind === \"api_key_header\") set(\"ANTHROPIC_API_KEY\", credential);\n      if (!credential) {\n        // `oauth` / `none` / an unresolved ref: the ambient carriers are the\n        // only auth this session has, and the scrub just removed them.\n        if (ambient.authToken) env.ANTHROPIC_AUTH_TOKEN = ambient.authToken;\n        else set(\"ANTHROPIC_API_KEY\", ambient.apiKey);\n      }\n      break;\n    }\n  }\n\n  return env;\n}\n","/**\n * Poisoned-transcript repair for the Claude Agent SDK driver.\n *\n * The Anthropic Messages API can permanently reject a conversation once its\n * persisted history contains a malformed content block. Because the bad block\n * lives in the SDK's on-disk JSONL transcript, every replayed turn fails with\n * the same `400 invalid_request_error` and the session is bricked with no\n * in-band recovery.\n *\n * This module repairs the transcript in place, covering three known poison\n * classes:\n *\n * 1. **Image `media_type` mismatch / omission.** An image block whose declared\n *    `media_type` does not match — or is missing for — the actual bytes:\n *    `... The image was specified using the image/png media type, but the\n *    image appears to be a image/jpeg image`. Produced by the Claude Code\n *    `Read` tool's format fallback (anthropics/claude-code#55338, #30124,\n *    #33179). Repaired by sniffing the base64 magic bytes and correcting\n *    `media_type`.\n * 2. **Oversized image.** An image whose decoded payload exceeds the API's\n *    5 MB per-image limit (anthropics/claude-code#34566). Replaced with a\n *    text stub — the byte budget cannot be recovered any other way.\n * 3. **`cache_control` on an empty text block.** A text block carrying a\n *    `cache_control` marker with empty/whitespace `text`\n *    (anthropics/claude-code#59626). The `cache_control` field is stripped.\n *\n * Genuinely unidentifiable image blocks are also replaced with a text stub.\n *\n * Recovering by content scan (rather than parsing the API's `messages.N`\n * index) is deliberate: the index addresses the assembled API request, not a\n * JSONL line, and reproducing the SDK's message-assembly is fragile. A full\n * scan is index-free and repairs every poisoned block in one pass.\n *\n * **Async and line-streaming since #454.** A Claude Code transcript is routinely\n * multi-megabyte (base64 images inline in `tool_result` blocks), and this runs on\n * a failed turn *and before every resume* — inside the single-threaded `skaile\n * serve` loop. The previous `readFileSync` + `writeFileSync` + `renameSync` held\n * the loop for the whole file and materialised it twice over as one string. Both\n * passes now stream line by line off a `createReadStream`, so the loop is yielded\n * between lines and peak memory is one JSONL line rather than the whole file, and\n * every I/O phase is deadline-bounded.\n *\n * Streaming was chosen over a worker thread: the work is I/O-bound rather than\n * CPU-bound (per-line `JSON.parse` on a yielded loop is not what stalls a turn),\n * and a worker would add a structured-clone of the same multi-MB payload plus a\n * thread lifecycle to a path that must never block a turn.\n *\n * @module\n */\n\nimport { createReadStream, createWriteStream } from \"node:fs\";\nimport { readdir, rename, stat, unlink } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { pipeline } from \"node:stream/promises\";\nimport { fsDeadlineMs, tryWithFsDeadline, withFsDeadline } from \"@skaile/workspaces/core\";\n\n/**\n * Minimal logger shape accepted by {@link scrubPoisonedTranscript}. Compatible\n * with the bridge `Logger`, but narrowed so the helper stays unit-testable\n * without a real logger instance.\n *\n * @category Transcript repair\n */\nexport interface ScrubLogger {\n  info(message: string, data?: Record<string, unknown>): void;\n  warn(message: string, data?: Record<string, unknown>): void;\n}\n\n/**\n * Options for {@link scrubPoisonedTranscript}.\n *\n * @category Transcript repair\n */\nexport interface ScrubTranscriptOptions {\n  /**\n   * Claude Code config directory — the parent of `projects/`. Resolve from\n   * `CLAUDE_CONFIG_DIR`, falling back to `~/.claude`.\n   */\n  configDir: string;\n  /** SDK session id whose transcript JSONL should be repaired. */\n  sessionId: string;\n  /** Optional logger for diagnostics. */\n  log?: ScrubLogger;\n}\n\n/**\n * Outcome of a {@link scrubPoisonedTranscript} pass.\n *\n * @category Transcript repair\n */\nexport interface ScrubTranscriptResult {\n  /** The located JSONL transcript path, or `null` when not found. */\n  filePath: string | null;\n  /** Image blocks whose `media_type` was corrected (or filled in) to match the bytes. */\n  corrected: number;\n  /**\n   * Image blocks replaced with a text stub — either unidentifiable bytes or a\n   * payload over the API's 5 MB per-image limit.\n   */\n  stubbed: number;\n  /** Empty text blocks from which a rejected `cache_control` marker was stripped. */\n  cacheStripped: number;\n  /**\n   * `true` when the transcript was located, contained at least one poisoned\n   * block, and was rewritten. `false` means nothing needed repair (or the\n   * file was not found) — the caller should not retry the resume.\n   */\n  changed: boolean;\n}\n\n/** Text inserted in place of an image block whose format cannot be identified. */\nconst STUB_TEXT = \"[image removed: unprocessable image data]\";\n\n/** Text inserted in place of an image block that exceeds the API size limit. */\nconst STUB_TEXT_OVERSIZED = \"[image removed: image too large]\";\n\n/**\n * The Anthropic Messages API rejects any single image whose decoded payload\n * exceeds 5 MB. An image at or under this is left alone; a larger one is\n * stubbed (its byte budget cannot be recovered).\n */\nconst MAX_IMAGE_BYTES = 5 * 1024 * 1024;\n\n/**\n * Identify an image's media type from the leading bytes of its base64 payload.\n *\n * Recognises the four formats the Anthropic API accepts. Returns `null` when\n * the magic bytes match no known format — the caller treats that as a\n * genuinely corrupt block and stubs it.\n *\n * @param base64 - Base64-encoded image data (only the prefix is inspected).\n * @returns An `image/*` media type, or `null` when unrecognised.\n * @category Transcript repair\n */\nexport function sniffImageMediaType(base64: string): string | null {\n  let buf: Buffer;\n  try {\n    // 32 base64 chars decode to 24 bytes — enough for the WebP check at 12.\n    buf = Buffer.from(base64.slice(0, 32), \"base64\");\n  } catch {\n    return null;\n  }\n  if (buf.length < 4) {\n    return null;\n  }\n  // JPEG — SOI marker `FF D8`. Third byte varies (and may be corrupt), so a\n  // two-byte check is intentional: it still matches malformed JPEGs, which is\n  // exactly the poison case the API flags as \"appears to be image/jpeg\".\n  if (buf[0] === 0xff && buf[1] === 0xd8) {\n    return \"image/jpeg\";\n  }\n  // PNG — `89 50 4E 47`.\n  if (buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) {\n    return \"image/png\";\n  }\n  // GIF — `47 49 46 38` (\"GIF8\").\n  if (buf[0] === 0x47 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x38) {\n    return \"image/gif\";\n  }\n  // WebP — `RIFF` at 0..3 and `WEBP` at 8..11.\n  if (\n    buf.length >= 12 &&\n    buf[0] === 0x52 &&\n    buf[1] === 0x49 &&\n    buf[2] === 0x46 &&\n    buf[3] === 0x46 &&\n    buf[8] === 0x57 &&\n    buf[9] === 0x45 &&\n    buf[10] === 0x42 &&\n    buf[11] === 0x50\n  ) {\n    return \"image/webp\";\n  }\n  return null;\n}\n\n/** A base64 image source on a content block (shape is SDK-defined). */\ninterface Base64ImageSource {\n  type?: string;\n  media_type?: string;\n  data?: string;\n}\n\n/** Loosely-typed content block from a transcript message. */\ninterface ContentBlockLike {\n  type?: string;\n  source?: Base64ImageSource;\n  content?: unknown;\n  [k: string]: unknown;\n}\n\n/** Mutable counters threaded through one scrub pass. */\ninterface ScrubCounters {\n  corrected: number;\n  stubbed: number;\n  cacheStripped: number;\n}\n\n/** Total repairs recorded in a counter set — used to detect per-line changes. */\nfunction totalChanges(c: ScrubCounters): number {\n  return c.corrected + c.stubbed + c.cacheStripped;\n}\n\n/**\n * Repair a single content block. Returns the (possibly replaced) block.\n *\n * - A `tool_result` block recurses into its `content` array.\n * - A text block carrying a `cache_control` marker whose `text` is empty or\n *   whitespace has the marker stripped (the API rejects `cache_control` on\n *   empty text blocks).\n * - An image block whose decoded payload exceeds the API's 5 MB limit is\n *   replaced with a text stub.\n * - An image block whose bytes match no known format is replaced with a text\n *   stub (an image cannot simply be dropped — a `tool_result` must keep at\n *   least one content entry, and a bare `image` block is replaced 1:1).\n * - An image block whose declared `media_type` mismatches (or is missing for)\n *   the sniffed type is corrected in place.\n * - Every other block is returned untouched.\n */\nfunction scrubBlock(block: ContentBlockLike, counters: ScrubCounters): ContentBlockLike {\n  if (block.type === \"tool_result\" && Array.isArray(block.content)) {\n    return {\n      ...block,\n      content: (block.content as ContentBlockLike[]).map((inner) => scrubBlock(inner, counters)),\n    };\n  }\n\n  // A `cache_control` marker on a text block whose text is empty or whitespace\n  // is rejected by the API (\"cache_control cannot be set for empty text\n  // blocks\"). Strip the marker — the empty block itself is harmless.\n  if (block.type === \"text\" && block.cache_control != null) {\n    const text = typeof block.text === \"string\" ? block.text : \"\";\n    if (text.trim() === \"\") {\n      counters.cacheStripped++;\n      const clone = { ...block };\n      delete clone.cache_control;\n      return clone;\n    }\n  }\n\n  if (\n    block.type === \"image\" &&\n    block.source?.type === \"base64\" &&\n    typeof block.source.data === \"string\"\n  ) {\n    const data = block.source.data;\n    // The API rejects any image whose decoded payload exceeds 5 MB. The byte\n    // budget cannot be salvaged, so the whole block becomes a text stub.\n    // base64 encodes 3 bytes per 4 chars, so decoded length ≈ len * 3 / 4.\n    if (Math.floor((data.length * 3) / 4) > MAX_IMAGE_BYTES) {\n      counters.stubbed++;\n      return { type: \"text\", text: STUB_TEXT_OVERSIZED };\n    }\n    const sniffed = sniffImageMediaType(data);\n    if (sniffed === null) {\n      counters.stubbed++;\n      return { type: \"text\", text: STUB_TEXT };\n    }\n    if (sniffed !== block.source.media_type) {\n      counters.corrected++;\n      return { ...block, source: { ...block.source, media_type: sniffed } };\n    }\n  }\n\n  return block;\n}\n\n/**\n * Locate the JSONL transcript for `sessionId` under `<configDir>/projects/`.\n *\n * Claude Code encodes the project directory into the `projects/` subfolder\n * name; rather than reproduce that encoding, this scans every subfolder for\n * `<sessionId>.jsonl` (the session id is a UUID — globally unique).\n *\n * Async and deadline-bounded since #454. The `existsSync(projectsDir)` probe is\n * gone: `readdir` already fails on a missing directory, so the probe was a\n * second stat on the same path for no information.\n *\n * `timeoutMs` defaults to {@link fsDeadlineMs} so callers that only need the\n * path (the resume probe) can omit it.\n *\n * @category Transcript repair\n */\nexport async function locateTranscriptPath(\n  configDir: string,\n  sessionId: string,\n  timeoutMs: number = fsDeadlineMs(),\n): Promise<string | null> {\n  const projectsDir = join(configDir, \"projects\");\n  const entries = await tryWithFsDeadline(\n    `readdir ${projectsDir}`,\n    () => readdir(projectsDir),\n    null,\n    timeoutMs,\n  );\n  if (!entries) return null;\n  for (const entry of entries) {\n    const candidate = join(projectsDir, entry, `${sessionId}.jsonl`);\n    const found = await tryWithFsDeadline(\n      `stat ${candidate}`,\n      async () => (await stat(candidate)).isFile(),\n      false,\n      timeoutMs,\n    );\n    if (found) return candidate;\n  }\n  return null;\n}\n\n/**\n * Yield a file's contents line by line, reproducing `readFileSync(...).split(\"\\n\")`\n * exactly — including the final (possibly empty) segment, so a trailing newline\n * survives a rewrite byte for byte.\n *\n * Splits on `\\n` alone, so a line out of a CRLF transcript arrives with its\n * `\\r` still attached. That carrier byte is part of the line here, and\n * {@link repairLine} re-attaches it to a line it rewrites — the file keeps the\n * terminator style it arrived with. Deliberately not `node:readline`:\n * `crlfDelay` strips the `\\r` outright (rewriting a CRLF transcript to LF) and\n * the interface swallows the trailing-newline distinction, either of which\n * would make the \"clean transcript is left byte-for-byte untouched\" guarantee\n * false. Only one line is held in memory at a time, so a multi-MB transcript\n * never materialises as a single string.\n */\nasync function* streamLines(filePath: string): AsyncGenerator<string> {\n  const stream = createReadStream(filePath, { encoding: \"utf8\" });\n  let pending = \"\";\n  try {\n    for await (const chunk of stream) {\n      pending += chunk as string;\n      let idx = pending.indexOf(\"\\n\");\n      while (idx !== -1) {\n        yield pending.slice(0, idx);\n        pending = pending.slice(idx + 1);\n        idx = pending.indexOf(\"\\n\");\n      }\n    }\n    yield pending;\n  } finally {\n    stream.destroy();\n  }\n}\n\n/**\n * Repair one JSONL line, returning the (possibly rewritten) line and mutating\n * `counters`. A non-JSON, blank, or content-less line is returned untouched.\n *\n * The reader splits on `\\n` only, so a line from a CRLF transcript still carries\n * its trailing `\\r`. An untouched line is returned verbatim and keeps it; a\n * rewritten one is rebuilt by `JSON.stringify`, which would drop it — leaving a\n * repaired CRLF transcript with mixed line endings. So the terminator is split\n * off before the parse and re-appended to the rewritten line.\n */\nfunction repairLine(line: string, counters: ScrubCounters): string {\n  if (line.trim() === \"\") return line;\n  const eol = line.endsWith(\"\\r\") ? \"\\r\" : \"\";\n  const body = eol === \"\" ? line : line.slice(0, -1);\n  let entry: { message?: { content?: unknown } };\n  try {\n    entry = JSON.parse(body);\n  } catch {\n    return line; // Not JSON — leave untouched.\n  }\n  const content = entry.message?.content;\n  if (!Array.isArray(content)) return line;\n  const before = totalChanges(counters);\n  const scrubbed = (content as ContentBlockLike[]).map((block) => scrubBlock(block, counters));\n  if (totalChanges(counters) === before) return line; // Nothing changed on this line.\n  return `${JSON.stringify({ ...entry, message: { ...entry.message, content: scrubbed } })}${eol}`;\n}\n\n/**\n * Scan a Claude Code SDK transcript for image content blocks whose declared\n * `media_type` does not match the actual bytes, repair them, and atomically\n * rewrite the file.\n *\n * Safe to call after a turn has failed: the SDK query is dead at that point,\n * and the next resume re-reads the transcript from disk.\n *\n * **Async since #454.** Two streaming passes rather than one whole-file read:\n * pass 1 counts repairs without writing anything, and pass 2 runs only when\n * pass 1 found something. The common case — the preventive scrub of a clean\n * transcript before every resume — is therefore one streaming read and zero\n * writes, and a clean transcript is still left byte-for-byte untouched.\n *\n * @param opts - Config directory, session id, and an optional logger.\n * @returns A {@link ScrubTranscriptResult}. When `changed` is `true` the\n *   caller may retry the resume with the same session id.\n * @category Transcript repair\n */\nexport async function scrubPoisonedTranscript(\n  opts: ScrubTranscriptOptions,\n): Promise<ScrubTranscriptResult> {\n  const { configDir, sessionId, log } = opts;\n  const timeoutMs = fsDeadlineMs();\n  const result: ScrubTranscriptResult = {\n    filePath: null,\n    corrected: 0,\n    stubbed: 0,\n    cacheStripped: 0,\n    changed: false,\n  };\n\n  const filePath = await locateTranscriptPath(configDir, sessionId, timeoutMs);\n  if (!filePath) {\n    log?.warn(\"scrub-transcript: no transcript found\", { configDir, sessionId });\n    return result;\n  }\n  result.filePath = filePath;\n\n  // ── Pass 1: detect. Streams the transcript, counting repairs, writing nothing.\n  const counters: ScrubCounters = { corrected: 0, stubbed: 0, cacheStripped: 0 };\n  try {\n    await withFsDeadline(\n      `scan transcript ${filePath}`,\n      async () => {\n        for await (const line of streamLines(filePath)) repairLine(line, counters);\n      },\n      timeoutMs,\n    );\n  } catch (err) {\n    log?.warn(\"scrub-transcript: failed to read transcript\", {\n      filePath,\n      error: err instanceof Error ? err.message : String(err),\n    });\n    return result;\n  }\n\n  result.corrected = counters.corrected;\n  result.stubbed = counters.stubbed;\n  result.cacheStripped = counters.cacheStripped;\n\n  if (totalChanges(counters) === 0) {\n    return result;\n  }\n\n  // ── Pass 2: rewrite. Atomic: stream a sibling temp file, then rename over the\n  // original. Line separators are re-emitted exactly as pass 1 split them, so a\n  // trailing newline and any blank lines survive verbatim.\n  const tmpPath = `${filePath}.scrub-tmp`;\n  try {\n    await withFsDeadline(\n      `rewrite transcript ${filePath}`,\n      async () => {\n        const discard: ScrubCounters = { corrected: 0, stubbed: 0, cacheStripped: 0 };\n        await pipeline(\n          (async function* () {\n            let first = true;\n            for await (const line of streamLines(filePath)) {\n              yield first ? repairLine(line, discard) : `\\n${repairLine(line, discard)}`;\n              first = false;\n            }\n          })(),\n          createWriteStream(tmpPath, { encoding: \"utf8\" }),\n        );\n        await rename(tmpPath, filePath);\n      },\n      timeoutMs,\n    );\n  } catch (err) {\n    log?.warn(\"scrub-transcript: failed to rewrite transcript\", {\n      filePath,\n      error: err instanceof Error ? err.message : String(err),\n    });\n    // Never leave a half-written sibling behind — the next scrub would rewrite\n    // it anyway, but a stray `.scrub-tmp` in the SDK's projects dir is noise.\n    await tryWithFsDeadline(`unlink ${tmpPath}`, () => unlink(tmpPath), undefined, timeoutMs);\n    return result;\n  }\n\n  result.changed = true;\n  log?.info(\"scrub-transcript: repaired poisoned transcript\", {\n    filePath,\n    corrected: result.corrected,\n    stubbed: result.stubbed,\n    cacheStripped: result.cacheStripped,\n  });\n  return result;\n}\n","/**\n * Pre-first-turn resume probe for the Claude Agent SDK driver.\n *\n * A tier-1 native resume only hands its session id to the SDK inside the first\n * real turn, so the `jsonl_lost` outcome (\"No conversation found\") is invisible\n * until a turn is consumed. The runner shares the container filesystem with the\n * SDK, so a cheap `stat` of the on-disk JSONL transcript is an authoritative,\n * side-effect-free signal of whether the resume will find its history — no\n * probe query, no spurious model turn.\n *\n * @module\n */\n\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { withFsDeadline } from \"@skaile/workspaces/core\";\nimport { locateTranscriptPath } from \"./scrub-transcript.js\";\n\n/**\n * Overall wall-clock budget for the probe. Deliberately a small fraction of the\n * platform's `session_init_ack` timeout (`DEFAULT_INIT_ACK_TIMEOUT_MS`, 15s):\n * the probe runs synchronously on the pre-ack path, so a wedged\n * `CLAUDE_CONFIG_DIR` mount must never push the ack past its deadline.\n */\nconst RESUME_PROBE_TIMEOUT_MS = 2_000;\n\n/**\n * Outcome of {@link probeResumeTranscript}: whether the SDK transcript for a\n * requested tier-1 resume exists on disk.\n *\n * @category Resume probe\n */\nexport type ResumeProbeOutcome = \"transcript_found\" | \"jsonl_lost\";\n\n/**\n * Resolve the Claude Code config directory — the parent of `projects/` — from\n * an explicit env map, the process environment, or the `~/.claude` default.\n *\n * The runner's probe and the claude-sdk driver share this one resolver, so they\n * agree as long as they see the same `CLAUDE_CONFIG_DIR`. Today they do:\n * `CLAUDE_CONFIG_DIR` is container-scoped and neither side threads a per-session\n * override through `config.env`, so both fall through to `process.env`. If a\n * future change ever set the driver's `config.env.CLAUDE_CONFIG_DIR` to a\n * divergent path, the reactive `resume_failed { jsonl_lost }` turn remains the\n * safety net.\n *\n * @category Resume probe\n */\nexport function resolveClaudeConfigDir(env?: Record<string, string | undefined>): string {\n  return env?.CLAUDE_CONFIG_DIR || process.env.CLAUDE_CONFIG_DIR || join(homedir(), \".claude\");\n}\n\n/**\n * Probe whether the SDK JSONL transcript for `sessionId` exists on disk.\n *\n * Non-null locator result → `transcript_found`; null → `jsonl_lost`;\n * `undefined` → outcome unknown (the probe exceeded its budget or errored). The\n * caller leaves the ack field ABSENT on `undefined` so the reactive\n * `resume_failed { jsonl_lost }` turn stays the safety net — a timed-out probe\n * must never masquerade as a genuine `jsonl_lost` and force a needless downgrade.\n *\n * `opts.timeoutMs` overrides {@link RESUME_PROBE_TIMEOUT_MS}; `opts.locate`\n * overrides the transcript locator (used by tests / alternate stores).\n *\n * @category Resume probe\n */\nexport async function probeResumeTranscript(\n  sessionId: string,\n  opts?: {\n    env?: Record<string, string | undefined>;\n    timeoutMs?: number;\n    locate?: (configDir: string, sessionId: string) => Promise<string | null>;\n  },\n): Promise<ResumeProbeOutcome | undefined> {\n  const configDir = resolveClaudeConfigDir(opts?.env);\n  const timeoutMs = opts?.timeoutMs ?? RESUME_PROBE_TIMEOUT_MS;\n  const locate = opts?.locate ?? locateTranscriptPath;\n  try {\n    // Bound the whole probe on wall-clock and THROW on expiry: the inner per-op\n    // deadline swallows a timeout into a null path (a false `jsonl_lost`), so a\n    // wedged mount must yield \"unknown\" here rather than a spurious downgrade.\n    const filePath = await withFsDeadline(\n      `resume-probe ${sessionId}`,\n      () => locate(configDir, sessionId),\n      timeoutMs,\n    );\n    return filePath ? \"transcript_found\" : \"jsonl_lost\";\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/{chunk-FFE7YLYO.js → chunk-XEVWRSLS.js}

@@ -1,9 +1,9 @@
-import { workspaceValidate, workspaceInfo, workspaceTestSecret, workspaceReload } from './chunk-E7HKNQTH.js';
+import { flowList, flowShow, flowListSessions, flowGetSession, flowFindFlowForSession } from './chunk-UKWEJPZZ.js';
+import { skillList, skillListDomains, skillShow, skillSearch, skillCheckRequirements, skillGetPreamble } from './chunk-FAI2SMFE.js';
+import { workspaceValidate, workspaceInfo, workspaceTestSecret, workspaceReload } from './chunk-JXCUUZA3.js';
 import { mountList, mountSync, mountStatus, mountRead, connectorList, connectorRead, connectorWrite, connectorSearch, connectorExec, connectorLoadSkill, connectorDescribe } from './chunk-FUCYTGAE.js';
-import { flowList, flowShow, flowListSessions, flowGetSession, flowFindFlowForSession } from './chunk-773WLEXL.js';
 import { sessionList, sessionGet } from './chunk-R6O6YWU7.js';
-import { skillList, skillListDomains, skillShow, skillSearch, skillCheckRequirements, skillGetPreamble } from './chunk-FAI2SMFE.js';
-import { withActivityLabelDefs } from './chunk-72DG6GSB.js';
+import { withActivityLabelDefs } from './chunk-YS4XBN7O.js';
 import * as zNS from 'zod';
 
 var zStatic = zNS.z ?? zNS.default ?? zNS;
@@ -204,7 +204,7 @@ function buildWorkspaceToolDefs(plugin) {
       name: "workspace_info",
       description: "Show workspace configuration: driver, model, provider, resource counts.",
       inputSchema: {},
-      handler: async () => workspaceInfo(plugin, driver, plugin.provider, plugin.model)
+      handler: async () => workspaceInfo(plugin, driver, plugin.model)
     },
     {
       name: "workspace_test_secret",
@@ -251,5 +251,5 @@ async function runMcpServerStdio(plugin) {
 }
 
 export { buildWorkspaceMcpServer, buildWorkspaceMcpStdioServer, buildWorkspaceToolDefs, runMcpServerStdio };
-//# sourceMappingURL=chunk-FFE7YLYO.js.map
-//# sourceMappingURL=chunk-FFE7YLYO.js.map
+//# sourceMappingURL=chunk-XEVWRSLS.js.map
+//# sourceMappingURL=chunk-XEVWRSLS.js.map

package/dist/chunk-XEVWRSLS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../workspace-plugin/src/adapters/mcp.ts"],"names":["z"],"mappings":";;;;;;;;AA4CA,IAAM,OAAA,GAA4B,SAAkB,GAAA,CAAA,OAAA,IAAW,GAAA;AAiCxD,SAAS,uBAAuB,MAAA,EAA6C;AAClF,EAAA,MAAMA,EAAAA,GAAS,OAAA;AAEf,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,KAAA;AAChC,EAAA,MAAM,IAAI,MAAA,CAAO,UAAA;AAEjB,EAAA,OAAO;AAAA;AAAA,IAEL;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,kEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,SAAA,CAAU,MAAA,CAAO,gBAAgB;AAAA,KACxD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,SAAA,CAAU,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KAC/C;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,OAAA,EAAS,OAAO,EAAE,QAAA,OAChB,WAAA,CAAY,MAAA,CAAO,kBAAkB,QAAQ;AAAA,KACjD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,2CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gCAAgC;AAAA,OAC5D;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,IAAA,OAC1B,SAAA,CAAU,MAAA,CAAO,gBAAA,EAAkB,QAAA,EAAU,IAAI;AAAA,KACrD;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,QAAA,CAAS,CAAC;AAAA,KACjC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,WAAA;AAAA,MACN,WAAA,EAAa,0DAAA;AAAA,MACb,WAAA,EAAa,EAAE,OAAA,EAASA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,wBAAwB,CAAA,EAAE;AAAA,MACtE,SAAS,OAAO,EAAE,SAAQ,KAA2B,QAAA,CAAS,GAAG,OAAO;AAAA,KAC1E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,4DAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,gBAAA,CAAiB,CAAC;AAAA,KACzC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,gCAAgC,CAAA,EAAE;AAAA,MAC7E,SAAS,OAAO,EAAE,QAAO,KAA0B,cAAA,CAAe,GAAG,MAAM;AAAA,KAC7E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,4BAAA;AAAA,MACN,WAAA,EAAa,gEAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,sBAAA,CAAuB,GAAG,MAAM;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,0EAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,QAAA,CAAS,oBAAoB,CAAA,EAAE;AAAA,MAC5E,SAAS,OAAO,EAAE,QAAO,KAA2B,SAAA,CAAU,GAAG,MAAM;AAAA,KACzE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,uEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,gBAAA,CAAiB,CAAC;AAAA,KACzC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa,gDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,0BAA0B,CAAA,EAAE;AAAA,MACzE,SAAS,OAAO,EAAE,UAAS,KAA4B,SAAA,CAAU,GAAG,QAAQ;AAAA,KAC9E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,kDAAA;AAAA,MACb,WAAA,EAAa,EAAE,KAAA,EAAOA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACjC,SAAS,OAAO,EAAE,OAAM,KAAyB,WAAA,CAAY,GAAG,KAAK;AAAA,KACvE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,0BAAA;AAAA,MACN,WAAA,EAAa,wEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,GAAE,MAAA,EAAO;AAAA,QACnB,YAAYA,EAAAA,CACT,MAAA,GACA,QAAA,EAAS,CACT,SAAS,kDAAkD;AAAA,OAChE;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,QAAA,EAAU,UAAA,OAC1B,sBAAA,CAAuB,CAAA,EAAG,QAAA,EAAU,UAAA,IAAc,CAAC;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,EAAAA,CAAE,QAAO,EAAE;AAAA,MACpC,SAAS,OAAO,EAAE,UAAS,KAA4B,gBAAA,CAAiB,GAAG,QAAQ;AAAA,KACrF;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,cAAA;AAAA,MACN,WAAA,EAAa,2EAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,WAAA,CAAY,CAAC;AAAA,KACpC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,aAAA;AAAA,MACN,WAAA,EAAa,qDAAA;AAAA,MACb,WAAA,EAAa,EAAE,MAAA,EAAQA,EAAAA,CAAE,QAAO,EAAE;AAAA,MAClC,SAAS,OAAO,EAAE,QAAO,KAA0B,UAAA,CAAW,GAAG,MAAM;AAAA,KACzE;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EACE,4NAAA;AAAA,MACF,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,aAAA,CAAc,MAAA,CAAO,gBAAgB;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,wCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kCAAkC,CAAA;AAAA,QACpE,IAAA,EAAMA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B;AAAA,OACvD;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,IAAA,OAC9B,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,IAAI;AAAA,KAC7D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,iBAAA;AAAA,MACN,WAAA,EAAa,uCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,IAAA,EAAMA,GAAE,MAAA,EAAO;AAAA,QACf,OAAA,EAASA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kBAAkB;AAAA,OACjD;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,YAKI,cAAA,CAAe,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,MAAM,OAAO;AAAA,KAC3E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,KAAA,EAAOA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAAA,OAC3C;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,EAAc,KAAA,OAC9B,eAAA,CAAgB,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,KAAK;AAAA,KAChE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,4CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA,EAAO;AAAA,QACvB,SAAA,EAAWA,EAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wCAAwC,CAAA;AAAA,QACvE,IAAA,EAAMA,EAAAA,CAAE,MAAA,CAAOA,EAAAA,CAAE,MAAA,EAAO,EAAGA,EAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,CAAS,qBAAqB;AAAA,OACxE;AAAA,MACA,SAAS,OAAO;AAAA,QACd,YAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,YAKI,aAAA,CAAc,MAAA,CAAO,gBAAA,EAAkB,YAAA,EAAc,WAAW,IAAI;AAAA,KAC5E;AAAA,IACA;AAAA,MACE,IAAA,EAAM,sBAAA;AAAA,MACN,WAAA,EAAa,oEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,kBAAA,CAAmB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC5D;AAAA,IACA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,qEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,YAAA,EAAcA,GAAE,MAAA;AAAO,OACzB;AAAA,MACA,OAAA,EAAS,OAAO,EAAE,YAAA,OAChB,iBAAA,CAAkB,MAAA,CAAO,kBAAkB,YAAY;AAAA,KAC3D;AAAA;AAAA,IAEA;AAAA,MACE,IAAA,EAAM,oBAAA;AAAA,MACN,WAAA,EAAa,sEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,iBAAA,CAAkB,MAAA,EAAQ,MAAM;AAAA,KACvD;AAAA,IACA;AAAA,MACE,IAAA,EAAM,gBAAA;AAAA,MACN,WAAA,EAAa,yEAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,SAAS,YAAY,aAAA,CAAc,MAAA,EAAQ,MAAA,EAAQ,OAAO,KAAK;AAAA,KACjE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,uBAAA;AAAA,MACN,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa,EAAE,GAAA,EAAKA,EAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,uCAAuC,CAAA,EAAE;AAAA,MACjF,SAAS,OAAO,EAAE,GAAA,EAAI,KAAuB,oBAAoB,GAAG;AAAA,KACtE;AAAA,IACA;AAAA,MACE,IAAA,EAAM,kBAAA;AAAA,MACN,WAAA,EAAa,mDAAA;AAAA,MACb,aAAa,EAAC;AAAA,MACd,OAAA,EAAS,YAAY,eAAA,CAAgB,MAAM;AAAA;AAC7C,GACF;AACF;AAmBA,eAAsB,wBAAwB,MAAA,EAAkD;AAC9F,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,OAAO,gCAAgC,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAI,kBAAA,CAAmB;AAAA,IAC5B,IAAA,EAAM,kBAAA;AAAA,IACN,KAAA,EAAO,qBAAA,CAAsB,sBAAA,CAAuB,MAAM,GAAG,OAAO;AAAA,GACrE,CAAA;AACH;AAgBA,eAAsB,6BAA6B,MAAA,EAAuC;AACxF,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,yCAAmD,CAAA;AACtF,EAAA,MAAM,MAAA,GAAS,IAAI,SAAA,CAAU,EAAE,MAAM,kBAAA,EAAoB,OAAA,EAAS,SAAS,CAAA;AAC3E,EAAA,KAAA,MAAW,GAAA,IAAO,sBAAA,CAAuB,MAAM,CAAA,EAAG;AAChD,IAAA,MAAA,CAAO,YAAA;AAAA,MACL,GAAA,CAAI,IAAA;AAAA,MACJ,EAAE,WAAA,EAAa,GAAA,CAAI,WAAA,EAAa,WAAA,EAAa,IAAI,WAAA,EAAY;AAAA,MAC7D,GAAA,CAAI;AAAA,KACN;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAaA,eAAsB,kBAAkB,MAAA,EAAwC;AAC9E,EAAA,MAAM,MAAA,GAAS,MAAM,4BAAA,CAA6B,MAAM,CAAA;AACxD,EAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OACrC,2CACF,CAAA;AACA,EAAA,MAAM,MAAA,CAAO,OAAA,CAAQ,IAAI,oBAAA,EAAsB,CAAA;AACjD","file":"chunk-XEVWRSLS.js","sourcesContent":["// Static namespace import so bun --compile bundles zod into the binary.\n// Dynamic import(\"zod\") via a string variable evades bun's static analysis\n// and fails at runtime inside /$bunfs/. The unwrap (zNS.z ?? zNS.default\n// ?? zNS) handles both bun's native ESM and vitest's CJS-interop resolver,\n// which return the zod namespace at different keys.\nimport * as zNS from \"zod\";\nimport { withActivityLabelDefs } from \"@skaile/workspaces/types\";\nimport type { WorkspacePlugin } from \"../plugin.js\";\nimport {\n  connectorDescribe,\n  connectorExec,\n  connectorList,\n  connectorLoadSkill,\n  connectorRead,\n  connectorSearch,\n  connectorWrite,\n  mountList,\n  mountRead,\n  mountStatus,\n  mountSync,\n} from \"../tools/connectors.js\";\nimport {\n  flowFindFlowForSession,\n  flowGetSession,\n  flowList,\n  flowListSessions,\n  flowShow,\n} from \"../tools/flows.js\";\nimport { sessionGet, sessionList } from \"../tools/sessions.js\";\nimport {\n  skillCheckRequirements,\n  skillGetPreamble,\n  skillList,\n  skillListDomains,\n  skillSearch,\n  skillShow,\n} from \"../tools/skills.js\";\nimport {\n  workspaceInfo,\n  workspaceReload,\n  workspaceTestSecret,\n  workspaceValidate,\n} from \"../tools/validator.js\";\n\nconst zStatic: any = (zNS as any).z ?? (zNS as any).default ?? zNS;\n\n/**\n * One workspace plugin tool — name, description, a zod raw-shape input schema,\n * and an async handler returning a `ToolResult`.\n *\n * Carries **zero MCP/SDK dependency**: the same definitions feed both the\n * in-process Claude Agent SDK server ({@link buildWorkspaceMcpServer}) and the\n * raw stdio MCP server ({@link buildWorkspaceMcpStdioServer}).\n */\nexport interface WorkspaceToolDef {\n  name: string;\n  description: string;\n  inputSchema: Record<string, unknown>;\n  handler: (args: any) => Promise<unknown>;\n}\n\n/**\n * Build the 28 workspace plugin tool definitions.\n *\n * Tool groups:\n * - 4 mount tools (`mount_list`, `mount_sync`, `mount_status`, `mount_read`)\n * - 5 flow tools (`flow_list`, `flow_show`, `flow_list_sessions`, `flow_get_session`, `flow_find_flow_for_session`)\n * - 6 skill tools (`skill_list`, `skill_list_domains`, `skill_show`, `skill_search`, `skill_check_requirements`, `skill_get_preamble`)\n * - 2 session tools (`session_list`, `session_get`)\n * - 7 connector tools (`connector_list`, `connector_read`, `connector_write`, `connector_search`, `connector_exec`, `connector_load_skill`, `connector_describe`)\n * - 4 workspace tools (`workspace_validate`, `workspace_info`, `workspace_test_secret`, `workspace_reload`)\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The 28 tool definitions, free of any MCP/SDK coupling.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport function buildWorkspaceToolDefs(plugin: WorkspacePlugin): WorkspaceToolDef[] {\n  const z: any = zStatic;\n\n  const driver = plugin.driver ?? \"omp\";\n  const p = plugin.projectDir;\n\n  return [\n    // Mount tools\n    {\n      name: \"mount_list\",\n      description: \"List all mounts declared in skaile.yaml with their mount status.\",\n      inputSchema: {},\n      handler: async () => mountList(plugin.connectorManager),\n    },\n    {\n      name: \"mount_sync\",\n      description: \"Sync a mount — pull latest from remote (git, S3, WebDAV).\",\n      inputSchema: { mount_id: z.string().describe(\"Mount ID from mount_list\") },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountSync(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_status\",\n      description: \"Get the mount status and last sync time for a mount.\",\n      inputSchema: { mount_id: z.string() },\n      handler: async ({ mount_id }: { mount_id: string }) =>\n        mountStatus(plugin.connectorManager, mount_id),\n    },\n    {\n      name: \"mount_read\",\n      description: \"Read a file from a mounted mount by path.\",\n      inputSchema: {\n        mount_id: z.string(),\n        path: z.string().describe(\"Relative path within the mount\"),\n      },\n      handler: async ({ mount_id, path }: { mount_id: string; path: string }) =>\n        mountRead(plugin.connectorManager, mount_id, path),\n    },\n    // Flow tools\n    {\n      name: \"flow_list\",\n      description: \"List all available flow definitions from ai-assets.\",\n      inputSchema: {},\n      handler: async () => flowList(p),\n    },\n    {\n      name: \"flow_show\",\n      description: \"Show full flow definition (nodes + edges) for a flow ID.\",\n      inputSchema: { flow_id: z.string().describe(\"Flow ID from flow_list\") },\n      handler: async ({ flow_id }: { flow_id: string }) => flowShow(p, flow_id),\n    },\n    {\n      name: \"flow_list_sessions\",\n      description: \"List past and active flow run sessions for this workspace.\",\n      inputSchema: {},\n      handler: async () => flowListSessions(p),\n    },\n    {\n      name: \"flow_get_session\",\n      description: \"Get driver metadata for a specific flow run session.\",\n      inputSchema: { run_id: z.string().describe(\"Run ID from flow_list_sessions\") },\n      handler: async ({ run_id }: { run_id: string }) => flowGetSession(p, run_id),\n    },\n    {\n      name: \"flow_find_flow_for_session\",\n      description: \"Resolve and return the flow definition used in a past session.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => flowFindFlowForSession(p, run_id),\n    },\n    // Skill tools\n    {\n      name: \"skill_list\",\n      description: \"List all skills in the ai-assets catalog, optionally filtered by domain.\",\n      inputSchema: { domain: z.string().optional().describe(\"Domain name filter\") },\n      handler: async ({ domain }: { domain?: string }) => skillList(p, domain),\n    },\n    {\n      name: \"skill_list_domains\",\n      description: \"List all skill domains (top-level ai-assets directories with skills).\",\n      inputSchema: {},\n      handler: async () => skillListDomains(p),\n    },\n    {\n      name: \"skill_show\",\n      description: \"Show the full SKILL.md content for a skill ID.\",\n      inputSchema: { skill_id: z.string().describe(\"Skill ID from skill_list\") },\n      handler: async ({ skill_id }: { skill_id: string }) => skillShow(p, skill_id),\n    },\n    {\n      name: \"skill_search\",\n      description: \"Search skills by name, description, or keywords.\",\n      inputSchema: { query: z.string() },\n      handler: async ({ query }: { query: string }) => skillSearch(p, query),\n    },\n    {\n      name: \"skill_check_requirements\",\n      description: \"Validate that all skill prerequisites are met in the target directory.\",\n      inputSchema: {\n        skill_id: z.string(),\n        target_dir: z\n          .string()\n          .optional()\n          .describe(\"Directory to check against (default: projectDir)\"),\n      },\n      handler: async ({ skill_id, target_dir }: { skill_id: string; target_dir?: string }) =>\n        skillCheckRequirements(p, skill_id, target_dir ?? p),\n    },\n    {\n      name: \"skill_get_preamble\",\n      description: \"Get the REQUIRES/INPUT/READS/WRITES DSL preamble for a skill.\",\n      inputSchema: { skill_id: z.string() },\n      handler: async ({ skill_id }: { skill_id: string }) => skillGetPreamble(p, skill_id),\n    },\n    // Session tools\n    {\n      name: \"session_list\",\n      description: \"List all past agent run sessions for this workspace, sorted newest first.\",\n      inputSchema: {},\n      handler: async () => sessionList(p),\n    },\n    {\n      name: \"session_get\",\n      description: \"Get full metadata for a specific session by run ID.\",\n      inputSchema: { run_id: z.string() },\n      handler: async ({ run_id }: { run_id: string }) => sessionGet(p, run_id),\n    },\n    // Connector tools\n    {\n      name: \"connector_list\",\n      description:\n        \"List connectors declared in skaile.yaml as {connected, failed}. `failed` holds connectors that did not connect this session, with the failure reason — their mount paths are dead directories, not synced workspaces.\",\n      inputSchema: {},\n      handler: async () => connectorList(plugin.connectorManager),\n    },\n    {\n      name: \"connector_read\",\n      description: \"Read content from a connector by path.\",\n      inputSchema: {\n        connector_id: z.string().describe(\"Connector ID from connector_list\"),\n        path: z.string().describe(\"Path within the connector\"),\n      },\n      handler: async ({ connector_id, path }: { connector_id: string; path: string }) =>\n        connectorRead(plugin.connectorManager, connector_id, path),\n    },\n    {\n      name: \"connector_write\",\n      description: \"Write content to a connector by path.\",\n      inputSchema: {\n        connector_id: z.string(),\n        path: z.string(),\n        content: z.string().describe(\"Content to write\"),\n      },\n      handler: async ({\n        connector_id,\n        path,\n        content,\n      }: {\n        connector_id: string;\n        path: string;\n        content: string;\n      }) => connectorWrite(plugin.connectorManager, connector_id, path, content),\n    },\n    {\n      name: \"connector_search\",\n      description: \"Search within a connector by query string.\",\n      inputSchema: {\n        connector_id: z.string(),\n        query: z.string().describe(\"Search query\"),\n      },\n      handler: async ({ connector_id, query }: { connector_id: string; query: string }) =>\n        connectorSearch(plugin.connectorManager, connector_id, query),\n    },\n    {\n      name: \"connector_exec\",\n      description: \"Execute a custom operation on a connector.\",\n      inputSchema: {\n        connector_id: z.string(),\n        operation: z.string().describe(\"Operation name from connector_describe\"),\n        args: z.record(z.string(), z.unknown()).describe(\"Operation arguments\"),\n      },\n      handler: async ({\n        connector_id,\n        operation,\n        args,\n      }: {\n        connector_id: string;\n        operation: string;\n        args: Record<string, unknown>;\n      }) => connectorExec(plugin.connectorManager, connector_id, operation, args),\n    },\n    {\n      name: \"connector_load_skill\",\n      description: \"Load the rendered skill body for a connector (operations + usage).\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorLoadSkill(plugin.connectorManager, connector_id),\n    },\n    {\n      name: \"connector_describe\",\n      description: \"Describe a connector's capabilities via its RuntimeSkillDescriptor.\",\n      inputSchema: {\n        connector_id: z.string(),\n      },\n      handler: async ({ connector_id }: { connector_id: string }) =>\n        connectorDescribe(plugin.connectorManager, connector_id),\n    },\n    // Validator tools\n    {\n      name: \"workspace_validate\",\n      description: \"Run a full health check: connectors, mounts, secrets, driver binary.\",\n      inputSchema: {},\n      handler: async () => workspaceValidate(plugin, driver),\n    },\n    {\n      name: \"workspace_info\",\n      description: \"Show workspace configuration: driver, model, provider, resource counts.\",\n      inputSchema: {},\n      handler: async () => workspaceInfo(plugin, driver, plugin.model),\n    },\n    {\n      name: \"workspace_test_secret\",\n      description: \"Test resolution of one secret reference (env:VAR, forge:key).\",\n      inputSchema: { ref: z.string().describe(\"Secret ref e.g. env:ANTHROPIC_API_KEY\") },\n      handler: async ({ ref }: { ref: string }) => workspaceTestSecret(ref),\n    },\n    {\n      name: \"workspace_reload\",\n      description: \"Re-read skaile.yaml and re-sync the plugin state.\",\n      inputSchema: {},\n      handler: async () => workspaceReload(plugin),\n    },\n  ];\n}\n\n/**\n * Build the **in-process** workspace MCP server via the Claude Agent SDK's\n * `createSdkMcpServer`. This shape is what the runner embeds into a Claude\n * Agent SDK `query()` call — the runner *is* the Claude Agent SDK host.\n *\n * Returns `null` when `@anthropic-ai/claude-agent-sdk` is not installed\n * (graceful degradation for non-Claude-Code environments).\n *\n * For the standalone `skaile mcp-server` stdio subprocess use\n * {@link buildWorkspaceMcpStdioServer} / {@link runMcpServerStdio} instead —\n * those carry no Claude Agent SDK dependency.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns The SDK MCP server object or `null` if the SDK is unavailable.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpServer(plugin: WorkspacePlugin): Promise<unknown | null> {\n  let sdk: any;\n  try {\n    sdk = await import(\"@anthropic-ai/claude-agent-sdk\");\n  } catch {\n    return null;\n  }\n  return sdk.createSdkMcpServer({\n    name: \"skaile-workspace\",\n    tools: withActivityLabelDefs(buildWorkspaceToolDefs(plugin), zStatic),\n  });\n}\n\n/**\n * Build a **raw stdio** workspace MCP server on `@modelcontextprotocol/sdk` —\n * no Claude Agent SDK. This is the correct shape for the `skaile mcp-server`\n * stdio subprocess that MCP-client agents (Claude Code, Codex, …) spawn.\n * Runs on plain Node.\n *\n * The returned server is not yet connected — call `.connect(transport)` (or\n * use {@link runMcpServerStdio}).\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n * @returns A `McpServer` with all 28 workspace tools registered.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function buildWorkspaceMcpStdioServer(plugin: WorkspacePlugin): Promise<any> {\n  const { McpServer } = await import(\"@modelcontextprotocol/sdk/server/mcp.js\" as string);\n  const server = new McpServer({ name: \"skaile-workspace\", version: \"1.0.0\" });\n  for (const def of buildWorkspaceToolDefs(plugin)) {\n    server.registerTool(\n      def.name,\n      { description: def.description, inputSchema: def.inputSchema },\n      def.handler,\n    );\n  }\n  return server;\n}\n\n/**\n * Start the workspace MCP server over stdio transport.\n *\n * Builds the raw `@modelcontextprotocol/sdk` server via\n * {@link buildWorkspaceMcpStdioServer} and connects a `StdioServerTransport`.\n * No `@anthropic-ai/claude-agent-sdk` dependency anywhere on this path.\n *\n * @param plugin - A booted `WorkspacePlugin` instance.\n *\n * @docLink packages/workspace-plugin/concepts#adapters\n */\nexport async function runMcpServerStdio(plugin: WorkspacePlugin): Promise<void> {\n  const server = await buildWorkspaceMcpStdioServer(plugin);\n  const { StdioServerTransport } = await import(\n    \"@modelcontextprotocol/sdk/server/stdio.js\" as string\n  );\n  await server.connect(new StdioServerTransport());\n}\n"]}

package/dist/{chunk-5UWAOYDN.js → chunk-Y6E62LFB.js}

@@ -1,11 +1,11 @@
 import { initTelemetry } from './chunk-4R6DROGN.js';
 import { parseSkillFrontmatter, validateFlowVersions } from './chunk-3XXQPHGL.js';
-import { FlowAdapter, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn } from './chunk-N27DSFA7.js';
-import { loadFlow, flowLookupRoots, findFlowFileInRoots, FLOW_FILE_EXTENSIONS } from './chunk-JMYOJ3PA.js';
+import { FlowAdapter, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn } from './chunk-RM4C5AU3.js';
+import { loadFlow, flowLookupRoots, findFlowFileInRoots, FLOW_FILE_EXTENSIONS } from './chunk-MIP4IC3O.js';
 import { renderStimulusPrompt } from './chunk-2D5BYAL6.js';
 import { flowSkillVersionPins } from './chunk-ELPR5XBG.js';
-import { resolveSettings, resolveApiKey } from './chunk-HSRHO7SK.js';
-import { resolveAgentDir, resolveSkWorkspaceConfig } from './chunk-MBARHWMZ.js';
+import { resolveSettings } from './chunk-C3QLJTMB.js';
+import { resolveAgentDir, resolveSkWorkspaceConfig } from './chunk-K27T47OO.js';
 import { isValidAssetName } from './chunk-GEEW6SY2.js';
 import { createLogger } from './chunk-W4IPN3DD.js';
 import fs from 'fs';
@@ -51,7 +51,6 @@ async function runFlow(opts) {
   const agentDir = opts.agentDir ?? resolveAgentDir(opts.projectDir);
   const settings = await resolveSettings(opts.projectDir, {
     driver: opts.driver,
-    provider: opts.provider,
     model: opts.model
   });
   const session = newSession({
@@ -59,7 +58,6 @@ async function runFlow(opts) {
     projectDir: opts.projectDir,
     agentDir,
     driver: settings.driver ?? "omp",
-    provider: settings.provider,
     model: settings.model,
     label: opts.sessionLabel
   });
@@ -122,7 +120,6 @@ async function runFlow(opts) {
       agentDir: session.agentDir,
       driver: session.driver,
       model: session.model,
-      provider: session.provider,
       resumeSessionId: session.driverSessionId,
       projectClaudeMd: path.join(opts.projectDir, "CLAUDE.md"),
       promptsDir: path.join(opts.projectDir, driverPaths.promptsDir),
@@ -144,10 +141,11 @@ async function runFlow(opts) {
     const nodeExecutor = new SessionNodeExecutor({ workspaceDir: opts.projectDir });
     const subpromptRunner = new SessionSubpromptRunner({
       driverType: agentSession.driverType,
-      provider: agentSession.provider,
       sessionModel: agentSession.model,
       workspaceDir: opts.projectDir,
-      apiKey: resolveApiKey(agentSession.provider ?? "anthropic", settings)
+      registry: agentSession.registry,
+      credentialEnv: agentSession.credentialEnv,
+      ...agentSession.modelRef ? { modelRef: agentSession.modelRef } : {}
     });
     let driverStarted = false;
     const updatedSession = { ...session };
@@ -370,7 +368,6 @@ async function resumeFlow(opts) {
       agentDir: opts.agentDir ?? session.agentDir,
       driver: session.driver,
       model: session.model,
-      provider: session.provider,
       sessionLabel: session.label,
       dryRun: opts.dryRun,
       sessionTimeoutMs: opts.sessionTimeoutMs,
@@ -521,5 +518,5 @@ function walkForSkill(dir, skillId) {
 }
 
 export { resolveFlowPath, resumeFlow, runFlow };
-//# sourceMappingURL=chunk-5UWAOYDN.js.map
-//# sourceMappingURL=chunk-5UWAOYDN.js.map
+//# sourceMappingURL=chunk-Y6E62LFB.js.map
+//# sourceMappingURL=chunk-Y6E62LFB.js.map

package/dist/chunk-Y6E62LFB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../factory-assets/connectors/flow/run-flow.ts"],"names":["c"],"mappings":";;;;;;;;;;;;;;AAgEA,IAAI,aAAA;AAEJ,eAAe,gBAAA,GAAiC;AAC9C,EAAA,IAAI,eAAe,OAAO,aAAA;AAC1B,EAAA,aAAA,GAAgB,MAAM,OAAO,mBAA2B,CAAA;AACxD,EAAA,OAAO,aAAA;AACT;AAMA,IAAM,0BAAA,GAA6B,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,GAAA;AAEjD,IAAM,0BAAA,uBAAiC,GAAA,CAAI;AAAA,EACzC,eAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAC,CAAA;AAuHD,eAAsB,QAAQ,IAAA,EAAiC;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,EAAA,MAAM;AAAA,IACJ,uBAAA;AAAA,IACA,2BAAA;AAAA,IACA,kBAAA;AAAA,IACA,kBAAA;AAAA,IACA,wBAAA;AAAA,IACA,gBAAA;AAAA,IACA,+BAAA;AAAA,IACA,kBAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAA;AAEJ,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA;AACnC,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,eAAA,CAAgB,KAAK,UAAU,CAAA;AACjE,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,IAAA,CAAK,UAAA,EAAY;AAAA,IACtD,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AAED,EAAA,MAAM,UAAU,UAAA,CAAW;AAAA,IACzB,QAAQ,IAAA,CAAK,EAAA;AAAA,IACb,YAAY,IAAA,CAAK,UAAA;AAAA,IACjB,QAAA;AAAA,IACA,MAAA,EAAQ,SAAS,MAAA,IAAU,KAAA;AAAA,IAC3B,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AAED,EAAA,MAAM,WAAA,CAAY,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AAK1C,EAAA,MAAM,aAAA,GAAgB,wBAAA,CAAyB,IAAA,CAAK,UAAU,CAAA;AAC9D,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAgB,GAAI,uBAAA,CAAwB;AAAA,IAC3D,WAAW,OAAA,CAAQ,KAAA;AAAA,IACnB,YAAY,IAAA,CAAK,UAAA;AAAA,IACjB,WAAY,aAAA,CAAwC,OAAA;AAAA,IACpD,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AACD,EAAA,MAAM,UAAU,YAAA,CAAa;AAAA,IAC3B,IAAA,EAAM,gBAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,UAAU,OAAA,CAAQ;AAAA,GACnB,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAiB,OAAA,CAAQ,KAAK,IAAI,CAAA;AAC/C,EAAA,MAAM,kBAAA,GAAqB,IAAI,kBAAA,EAAmB;AAClD,EAAA,2BAAA,CAA4B,kBAAkB,CAAA;AAC9C,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,WAAW,OAAA,CAAQ,KAAA;AAAA,IACnB,YAAA,EAAc,MAAM,kBAAA,CAAmB,eAAA,EAAgB;AAAA,IACvD,OAAA,EAAS,CAAC,IAAA,KACR,kBAAA,CAAmB,IAAA,EAAK,CAAE,IAAA,CAAK,CAAC,GAAA,KAA0B,GAAA,CAAI,IAAA,KAAS,IAAI,CAAA,IAAK,IAAA;AAAA,IAClF,MAAA,EAAQ,CAAC,IAAA,EAAc,KAAA,KACrB,kBAAA,CAAmB,MAAA,CAAO,IAAA,EAAM,KAAA,EAAO,EAAE,SAAA,EAAW,OAAA,CAAQ,KAAA,EAAO;AAAA,GACvE;AAEA,EAAA,IAAI;AAEF,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,OAAA;AAAA,QAC3B;AAAA,UACE,EAAA,EAAI,MAAA;AAAA,UACJ,MAAA,EAAQ,MAAA;AAAA,UACR,MAAA,EAAQ,WAAA;AAAA,UACR,OAAA,EAAS,EAAE,IAAA,EAAM,IAAA,EAAM,EAAE,OAAO,OAAA,CAAQ,KAAA,EAAO,SAAA,EAAW,KAAA,EAAM;AAAE,SACpE;AAAA,QACA;AAAC;AAAA,OACH;AACA,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,YAAA,CAAa,MAAM,CAAA;AACzC,MAAA,MAAM,YAAY,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,KAAK,EACxC,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,WAAW,CAAA,CACtC,IAAI,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA;AAClB,MAAA,GAAA,CAAI,mBAAmB,IAAA,CAAK,IAAI,CAAA,EAAA,EAAK,IAAA,CAAK,EAAE,CAAA,CAAA,CAAG,CAAA;AAC/C,MAAA,GAAA,CAAI,wBAAwB,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,IAAK,QAAQ,CAAA,CAAE,CAAA;AAC9D,MAAA,MAAM,OAAA,CAAQ,WAAW,MAAM,CAAA;AAC/B,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,sBAAA,CAAuB,IAAA,EAAM,IAAA,CAAK,UAAA,EAAY,GAAG,CAAA;AAGvD,IAAA,MAAM,QAAA,GAAW,aAAA;AACjB,IAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,QAAA,CAAS,SAAS,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,UAAU,UAAA,CAAW;AAAA,MACrC,IAAA,EAAM,CAAA,KAAA,EAAQ,IAAA,CAAK,EAAE,CAAA,CAAA;AAAA,MACrB,IAAA,EAAM,UAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,kBAAkB,IAAA,CAAK,EAAA;AAAA,QACvB,sBAAsB,OAAA,CAAQ;AAAA;AAChC,KACD,CAAA;AAGD,IAAA,MAAM,WAAA,GAAc,mBAAmB,QAAQ,CAAA;AAC/C,IAAA,MAAM,YAAA,GAAe,MAAM,kBAAA,CAAmB;AAAA,MAC5C,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,iBAAiB,OAAA,CAAQ,eAAA;AAAA,MACzB,eAAA,EAAiB,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,YAAY,WAAW,CAAA;AAAA,MACvD,YAAY,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,UAAU,CAAA;AAAA,MAC7D,WAAW,OAAA,CAAQ,KAAA;AAAA,MACnB,KAAA,EAAO,GAAA;AAAA,MACP,SAAA;AAAA,MACA,KAAA,EAAO,SAAA;AAAA,MACP,QAAA;AAAA,MACA,YAAA,EAAc,eAAA;AAAA,MACd;AAAA,KACD,CAAA;AACD,IAAA,IAAI,YAAA,CAAa,WAAA,EAAa,mBAAA,CAAoB,MAAA,EAAQ;AACxD,MAAA,+BAAA;AAAA,QACE,kBAAA;AAAA,QACA,aAAa,WAAA,CAAY;AAAA,OAC3B;AAAA,IACF;AACA,IAAA,MAAM,EAAE,QAAO,GAAI,YAAA;AACnB,IAAA,MAAM,eAAe,IAAI,mBAAA,CAAoB,EAAE,YAAA,EAAc,IAAA,CAAK,YAAY,CAAA;AAI9E,IAAA,MAAM,eAAA,GAAkB,IAAI,sBAAA,CAAuB;AAAA,MACjD,YAAY,YAAA,CAAa,UAAA;AAAA,MACzB,cAAc,YAAA,CAAa,KAAA;AAAA,MAC3B,cAAc,IAAA,CAAK,UAAA;AAAA,MACnB,UAAU,YAAA,CAAa,QAAA;AAAA,MACvB,eAAe,YAAA,CAAa,aAAA;AAAA,MAC5B,GAAI,aAAa,QAAA,GAAW,EAAE,UAAU,YAAA,CAAa,QAAA,KAAa;AAAC,KACpE,CAAA;AACD,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,MAAM,cAAA,GAAiB,EAAE,GAAG,OAAA,EAAQ;AAGpC,IAAA,MAAA,CAAO,EAAA,CAAG,eAAe,MAAM;AAC7B,MAAA,MAAM,mBAAmB,MAAA,CAAO,gBAAA;AAChC,MAAA,IAAI,CAAC,gBAAA,IAAoB,gBAAA,KAAqB,cAAA,CAAe,eAAA,EAAiB;AAC9E,MAAA,cAAA,CAAe,eAAA,GAAkB,gBAAA;AACjC,MAAA,KAAK,YAAY,IAAA,CAAK,UAAA,EAAY,cAAc,CAAA,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAAA,IAClE,CAAC,CAAA;AAeD,IAAA,MAAM,eAAA,GAAkB,MAAA;AACxB,IAAA,MAAM,aAAA,GAAgB,KAAK,gBAAA,IAAoB,0BAAA;AAE/C,IAAA,MAAM,sBAAsB,YAA2B;AACrD,MAAA,IAAI,aAAA,EAAe;AACnB,MAAA,MAAM,OAAO,KAAA,EAAM;AACnB,MAAA,aAAA,GAAgB,IAAA;AAAA,IAClB,CAAA;AAKA,IAAA,MAAM,cAAA,GAAiB,CAAC,KAAA,KAAiC;AACvD,MAAA,IAAA,CAAK,UAAU,KAA8B,CAAA;AAAA,IAC/C,CAAA;AAEA,IAAA,MAAM,mBAAA,GAAsB,IAAI,0BAAA,CAA2B;AAAA,MACzD,WAAA,EAAa,CAAC,MAAA,KAAW,QAAA,CAAS,gBAAgB,MAAA,EAAQ,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,MAC1E,YAAA;AAAA,MACA,eAAA;AAAA,MACA,gBAAgB,OAAO,EAAE,MAAM,SAAA,EAAW,SAAA,EAAW,UAAS,KAAM;AAClE,QAAA,MAAM,mBAAA,EAAoB;AAC1B,QAAA,MAAM,qBAAA,CAAsB;AAAA,UAC1B,IAAA,EAAM,SAAA;AAAA,UACN,SAAA;AAAA,UACA,QAAA;AAAA,UACA,IAAA,EAAM,cAAA;AAAA,UACN,OAAA,EAAS,CAAC,MAAA,KAAW,aAAA,CAAc,QAAQ,MAAA,EAAQ,IAAA,CAAK,SAAS,aAAa;AAAA,SAC/E,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAID,IAAA,IAAI,cAAA,GAAqC,IAAA;AACzC,IAAA,IAAI,aAAA,GAAgF,IAAA;AAEpF,IAAA,MAAM,cAAc,wBAAA,CAAyB;AAAA,MAC3C,SAAA,EAAW,OACT,cAAA,EACA,KAAA,KACkB;AAKlB,QAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,EAAG,IAAA;AAC1C,QAAA,IAAI,QAAA;AACJ,QAAA,IAAI,aAAa,cAAA,EAAgB;AAC/B,UAAA,QAAA,GAAW,EAAE,MAAM,cAAA,EAAe;AAAA,QACpC,CAAA,MAAA,IACE,QAAA,KAAa,cAAA,IACb,OAAO,KAAA,CAAM,MAAM,MAAA,GAAS,CAAC,CAAA,EAAG,IAAA,KAAS,QAAA,EACzC;AACA,UAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA;AACnC,UAAA,QAAA,GAAW;AAAA,YACT,IAAA,EAAM,cAAA;AAAA,YACN,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,IAAQ,EAAE,CAAA;AAAA,YAC5B,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAA,IAAY,MAAM;AAAA,WAC1C;AAAA,QACF,CAAA,MAAO;AACL,UAAA,QAAA,GAAW,EAAE,MAAM,eAAA,EAAgB;AAAA,QACrC;AAOA,QAAA,KAAK,cAAA;AACL,QAAA,IAAI,CAAC,cAAA,IAAkB,CAAC,aAAA,EAAe;AACrC,UAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,QAChE;AACA,QAAA,MAAM,cAAA,CAAe,kBAAkB,aAAa,CAAA;AACpD,QAAA,MAAM,SAAA,GAAY,cAAA,CAAe,YAAA,CAAa,aAAa,CAAA;AAC3D,QAAA,IAAI,UAAU,IAAA,IAAQ,SAAA,CAAU,WAAW,QAAA,IAAY,SAAA,CAAU,WAAW,WAAA,EAAa;AACvF,UAAA;AAAA,QACF;AACA,QAAA,IAAI,CAAC,cAAA,CAAe,oBAAA,CAAqB,aAAA,EAAe,QAAQ,CAAA,EAAG;AACnE,QAAA,MAAM,mBAAA,EAAoB;AAC1B,QAAA,MAAM,qBAAA,CAAsB;AAAA,UAC1B,IAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA;AAAA,UACA,IAAA,EAAM,cAAA;AAAA,UACN,OAAA,EAAS,CAAC,MAAA,KAAW,aAAA,CAAc,QAAQ,MAAA,EAAQ,IAAA,CAAK,SAAS,aAAa;AAAA,SAC/E,CAAA;AAAA,MACH,CAAA;AAAA,MACA,GAAA,EAAK;AAAA,KACN,CAAA;AAED,IAAA,MAAM,WAAA,GAAc,IAAI,WAAA,EAAY;AACpC,IAAA,MAAM,UAAA,GAAa,MAAM,WAAA,CAAY,OAAA;AAAA,MACnC;AAAA,QACE,EAAA,EAAI,eAAA;AAAA,QACJ,MAAA,EAAQ,MAAA;AAAA,QACR,MAAA,EAAQ,YAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,IAAA;AAAA,UACA,IAAA,EAAM;AAAA,YACJ,OAAO,OAAA,CAAQ,KAAA;AAAA,YACf,SAAA,EAAW,KAAA;AAAA,YACX,cAAA,EAAgB,KAAK,cAAA,IAAkB;AAAA,WACzC;AAAA,UACA,WAAA;AAAA,UACA,iBAAA,EAAmB,IAAA;AAAA,UACnB,YAAA;AAAA,UACA,eAAA;AAAA,UACA;AAAA;AACF,OACF;AAAA,MACA;AAAC;AAAA,KACH;AACA,IAAA,cAAA,GAAiB,WAAA;AACjB,IAAA,aAAA,GAAgB,UAAA;AAIhB,IAAA,KAAA,MAAW,SAAA,IAAa,WAAA,CAAY,KAAA,CACjC,kBAAA,CAAmB,UAAU,CAAA,CAC7B,MAAA,CAAO,CAAC,EAAE,MAAK,KAAM,0BAAA,CAA2B,GAAA,CAAI,IAAI,CAAC,CAAA,EAAG;AAC7D,MAAA,MAAM,QAAmC,EAAC;AAC1C,MAAA,KAAA,MAAW,GAAA,IAAO,UAAU,IAAA,EAAM;AAChC,QAAA,IAAI,MAAA;AACJ,QAAA,QAAQ,IAAI,IAAA;AAAM,UAChB,KAAK,SAAA;AACH,YAAA,MAAA,GAAW,CAAA,CAAA,OAAA,EAAQ;AACnB,YAAA;AAAA,UACF,KAAK,QAAA;AACH,YAAA,MAAA,GAAW,CAAA,CAAA,MAAA,EAAO;AAClB,YAAA;AAAA,UACF,KAAK,MAAA;AACH,YAAA,MAAA,GAAW,CAAA,CAAA,IAAA,EAAK;AAChB,YAAA;AAAA,UACF;AACE,YAAA,MAAA,GAAW,CAAA,CAAA,MAAA,EAAO;AAAA;AAEtB,QAAA,KAAA,CAAM,IAAI,IAAI,CAAA,GAAI,IAAI,QAAA,GAAW,MAAA,GAAS,OAAO,QAAA,EAAS;AAAA,MAC5D;AACA,MAAA,kBAAA,CAAmB,QAAA;AAAA,QACjB,gBAAA,CAAiB;AAAA,UACf,MAAM,SAAA,CAAU,IAAA;AAAA,UAChB,aAAa,SAAA,CAAU,IAAA;AAAA,UACvB,aAAa,SAAA,CAAU,WAAA;AAAA,UACvB,KAAA,EAAS,SAAO,KAAK,CAAA;AAAA,UACrB,IAAA,EAAM,OAAA;AAAA,UACN,QAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,KAAK,EAAA,EAAG;AAAA,UACxC,KAAA,EAAO,SAAA;AAAA,UACP,QAAA,EAAU,CAAC,KAAK,CAAA;AAAA,UAChB,IAAA,EAAM,SAAA,CAAU,WAAA,KAAgB,MAAA,GAAS,OAAA,GAAU,QAAA;AAAA,UACnD,OAAA,EAAS,OAAO,IAAA,KACd,WAAA,CAAY,UAAU,UAAA,EAAY,SAAA,CAAU,MAAM,IAAI;AAAA,SACzD,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF;AAKA,IAAA,WAAA,CAAY,aAAA,CAAc,UAAA,EAAY,CAAC,KAAA,KAAyB;AAC9D,MAAA,IAAA,CAAK,OAAA,GAAU;AAAA,QACb,IAAA,EAAM,eAAA;AAAA,QACN,KAAA,EAAO,CAAA,KAAA,EAAQ,KAAA,CAAM,KAAK,CAAA,CAAA;AAAA,QAC1B;AAAA,OACwB,CAAA;AAAA,IAC5B,CAAC,CAAA;AAGD,IAAA,OAAA,CAAQ,KAAK,eAAA,EAAiB;AAAA,MAC5B,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,UAAU,IAAA,CAAK,IAAA;AAAA,MACf,OAAO,OAAA,CAAQ;AAAA,KAChB,CAAA;AAED,IAAA,IAAI;AAGF,MAAA,MAAM,eAAA,GAAgC,EAAE,IAAA,EAAM,cAAA,EAAe;AAC7D,MAAA,MAAM,WAAA,CAAY,OAAO,eAAA,EAAiB;AAAA,QACxC,cAAA,EAAgB,qBAAqB,eAAe,CAAA;AAAA,QACpD,IAAA,EAAM,EAAE,IAAA,EAAM,eAAA,CAAgB,IAAA;AAAK,OACpC,CAAA;AAED,MAAA,MAAM,UAAA,GAAa,WAAA,CAAY,YAAA,CAAa,UAAU,CAAA;AACtD,MAAA,IAAI,WAAW,IAAA,EAAM;AACnB,QAAA,OAAA,CAAQ,IAAA,CAAK,iBAAiB,EAAE,MAAA,EAAQ,KAAK,EAAA,EAAI,QAAA,EAAU,IAAA,CAAK,IAAA,EAAM,CAAA;AAAA,MACxE,CAAA,MAAA,IAAW,UAAA,CAAW,MAAA,KAAW,QAAA,EAAU;AACzC,QAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,EAAe,KAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,KAAK,EAAA,EAAI,QAAA,EAAU,IAAA,CAAK,IAAA,EAAM,CAAA;AAAA,MAClF,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,KAAK,uCAAA,EAAyC;AAAA,UACpD,QAAQ,IAAA,CAAK,EAAA;AAAA,UACb,QAAQ,UAAA,CAAW,MAAA;AAAA,UACnB,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AAAA,IACF,CAAA,SAAE;AACA,MAAA,MAAA,CAAO,IAAA,EAAK;AACZ,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,YAAA,CAAa,UAAU,CAAA;AACrD,MAAA,MAAM,WAAA;AAAA,QACJ,IAAA,CAAK,UAAA;AAAA,QACL,YAAA,CAAa;AAAA,UACX,GAAG,cAAA;AAAA,UACH,eAAA,EAAiB,MAAA,CAAO,gBAAA,IAAoB,cAAA,CAAe,eAAA;AAAA,UAC3D,MAAA,EAAQ,SAAA,CAAU,MAAA,KAAW,UAAA,GAAa,UAAA,GAAa;AAAA,SACxD;AAAA,OACH,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAChB,MAAA,MAAM,WAAA,CAAY,UAAA,CAAW,UAAU,CAAA,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACvD,MAAA,MAAM,aAAa,OAAA,EAAQ;AAC3B,MAAA,SAAA,CAAU,SAAS,SAAA,EAAW;AAAA,QAC5B,QAAQ,WAAA,CAAY,YAAA,CAAa,UAAU,CAAA,CAAE,MAAA,KAAW,aAAa,IAAA,GAAO;AAAA,OAC7E,CAAA;AACD,MAAA,MAAM,SAAA,CAAU,KAAA,EAAM,CAAE,KAAA,CAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAAA,IACxC;AAAA,EACF,CAAA,SAAE;AACA,IAAA,eAAA,EAAgB;AAAA,EAClB;AACF;AAkBA,eAAsB,WAAW,IAAA,EAAoC;AACnE,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,EAAA,MAAM,EAAE,WAAA,EAAa,eAAA,EAAiB,uBAAA,EAAwB,GAAI,MAAA;AAElE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,GACjB,MAAM,eAAA,CAAgB,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,SAAS,CAAA,GACrD,MAAM,WAAA,CAAY,KAAK,UAAU,CAAA;AAErC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,GACd,CAAA,QAAA,EAAW,KAAK,SAAS,CAAA,CAAA,GACzB,CAAA,mBAAA,EAAsB,IAAA,CAAK,UAAU,CAAA,QAAA,CAAA;AACzC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,IAAI,CAAA,0BAAA,CAAuB,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,OAAA,CAAQ,MAAA,EAAQ,KAAK,UAAU,CAAA;AAKhE,EAAA,MAAM,aAAA,GAAgB,wBAAA,CAAyB,IAAA,CAAK,UAAU,CAAA;AAC9D,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAgB,GAAI,uBAAA,CAAwB;AAAA,IAC3D,WAAW,OAAA,CAAQ,KAAA;AAAA,IACnB,YAAY,IAAA,CAAK,UAAA;AAAA,IACjB,WAAY,aAAA,CAAwC,OAAA;AAAA,IACpD,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AACD,EAAA,MAAM,UAAU,YAAA,CAAa;AAAA,IAC3B,IAAA,EAAM,gBAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,UAAU,OAAA,CAAQ;AAAA,GACnB,CAAA;AACD,EAAA,OAAA,CAAQ,KAAK,kBAAA,EAAoB;AAAA,IAC/B,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,CAAQ;AAAA,MACZ,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,QAAA;AAAA,MACA,QAAA,EAAU,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,QAAA;AAAA,MACnC,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,cAAc,OAAA,CAAQ,KAAA;AAAA,MACtB,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,kBAAkB,IAAA,CAAK,gBAAA;AAAA,MACvB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH,CAAA,SAAE;AACA,IAAA,eAAA,EAAgB;AAAA,EAClB;AACF;AAMA,eAAe,sBAAA,CACb,IAAA,EACA,UAAA,EACA,GAAA,EACe;AACf,EAAA,MAAM,WAAA,GAAc,qBAAqB,IAAI,CAAA;AAC7C,EAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAE9B,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAoB;AAC9C,EAAA,MAAM,cAAA,GAAiB,mBAAmB,UAAU,CAAA;AACpD,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,KAAA,MAAW,QAAQ,WAAA,EAAa;AAC9B,MAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,MAAA,IAAI,aAAA,CAAc,GAAA,CAAI,OAAO,CAAA,EAAG;AAChC,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,cAAA,EAAgB,OAAO,CAAA;AACrD,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,MAAM,OAAA,GAAU,EAAA,CAAG,YAAA,CAAa,SAAA,EAAW,OAAO,CAAA;AAClD,QAAA,MAAM,EAAA,GAAK,sBAAsB,OAAO,CAAA;AACxC,QAAA,aAAA,CAAc,IAAI,OAAA,EAAS,EAAA,CAAG,UAAU,OAAA,IAAW,EAAA,CAAG,WAAW,EAAE,CAAA;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,WAAA,EAAa,aAAa,CAAA;AAC9D,EAAA,MAAM,WAAW,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,EAAE,SAAS,CAAA;AAClD,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,QAAQ,QAAA,CAAS,GAAA;AAAA,MACrB,CAAC,CAAA,KAAM,CAAA,EAAA,EAAK,CAAA,CAAE,MAAM,CAAA,QAAA,EAAW,CAAA,CAAE,SAAS,CAAA,QAAA,EAAW,CAAA,CAAE,MAAA,IAAU,QAAQ,CAAA;AAAA,KAC3E;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAA4B,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EAChE;AACA,EAAA,KAAA,MAAW,KAAK,MAAA,CAAO,MAAA,CAAO,CAACA,EAAAA,KAAMA,EAAAA,CAAE,SAAS,CAAA,EAAG;AACjD,IAAA,GAAA,CAAI,CAAA,cAAA,EAAiB,EAAE,OAAO,CAAA,CAAA,EAAI,EAAE,MAAM,CAAA,WAAA,EAAc,CAAA,CAAE,SAAS,CAAA,CAAE,CAAA;AAAA,EACvE;AACF;AAYA,SAAS,wBAAA,CAAyB,KAAA,EAAe,KAAA,EAAiB,MAAA,EAAsB;AACtF,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,CAAC,IAAA,KAAS;AAClC,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA,CAAS,KAAK,OAAA,CAAQ,IAAI,GAAG,QAAQ,CAAA;AAC3D,IAAA,OAAO,CAAC,SAAS,UAAA,CAAW,IAAI,KAAK,CAAC,IAAA,CAAK,WAAW,QAAQ,CAAA;AAAA,EAChE,CAAC,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,KAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,EAChF;AACF;AAGA,SAAS,cAAA,CAAe,QAA0B,OAAA,EAAyB;AACzE,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACzB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG;AACzB,IAAA,IAAA,CAAK,GAAA,CAAI,KAAK,IAAI,CAAA;AAClB,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,IAAA,CAAK,WAAW,aAAA,GACZ,CAAA,EAAA,EAAK,KAAK,IAAI,CAAA,cAAA,EAAiB,KAAK,SAAA,CAAU,IAAA,CAAK,cAAc,EAAE,CAAC,KACpE,CAAA,EAAA,EAAK,IAAA,CAAK,IAAI,CAAA,uBAAA,EAA0B,IAAA,CAAK,SAAS,eAAe,CAAA,CAAA;AAAA,KAC3E;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,SAAS,CAAA,GAAI;AAAA,EAAK,OAAO;AAAA,EAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AAClE;AAWO,SAAS,eAAA,CAAgB,QAAgB,UAAA,EAA4B;AAG1E,EAAA,IAAI,CAAC,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,KAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,EAC9E;AAEA,EAAA,MAAM,KAAA,GAAQ,gBAAgB,UAAU,CAAA;AACxC,EAAA,MAAM,SAA2B,EAAC;AAClC,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,MAAA,EAAQ,KAAA,EAAO,EAAE,MAAA,EAAQ,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA;AAClF,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,wBAAA,CAAyB,KAAA,EAAO,OAAO,MAAM,CAAA;AAC7C,IAAA,OAAO,KAAA;AAAA,EACT;AAKA,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,IAAK,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,aAAa,CAAA,EAAG;AACxE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,KAAA,EAAQ,MAAM,CAAA,mCAAA,CAAA,GAAwC,cAAA,CAAe,QAAQ,aAAa;AAAA,KAC5F;AAAA,EACF;AAEA,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,IAAI,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,UAAA,GAAQ,EAAA;AAGxC,EAAA,MAAM,QAAA,GAAW,oBAAA,CAAqB,GAAA,CAAI,CAAC,GAAA,KAAQ,CAAA,EAAG,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,KAAK,CAAA;AAChF,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,mBAAmB,MAAM,CAAA,WAAA,EAAc,KAAA,CAAM,MAAM,aAAa,KAAA,IAAS,MAAM,CAAA,EAAG,IAAI,SAC7E,QAAQ,CAAA,0BAAA,EAAwB,MAAM,CAAA,YAAA,CAAA,GAC7C,cAAA,CAAe,QAAQ,cAAc;AAAA,GACzC;AACF;AAGA,SAAS,mBAAmB,UAAA,EAAmC;AAC7D,EAAA,IAAI,GAAA,GAAM,UAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA;AAC5C,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,SAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,WAAA,CAAY,gBAAwB,OAAA,EAAgC;AAC3E,EAAA,KAAA,MAAW,MAAA,IAAU,GAAG,WAAA,CAAY,cAAA,EAAgB,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAC5E,IAAA,IAAI,CAAC,MAAA,CAAO,WAAA,EAAY,EAAG;AAC3B,IAAA,MAAM,YAAY,IAAA,CAAK,IAAA,CAAK,cAAA,EAAgB,MAAA,CAAO,MAAM,QAAQ,CAAA;AACjE,IAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAG;AAC/B,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,SAAA,EAAW,OAAO,CAAA;AAC7C,IAAA,IAAI,OAAO,OAAO,KAAA;AAAA,EACpB;AACA,EAAA,OAAO,IAAA;AACT;AAwBA,SAAS,aAAA,CACP,MAAA,EACA,MAAA,EACA,OAAA,EACA,SAAA,EACe;AACf,EAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,IAAA,IAAI,OAAA,GAAU,KAAA;AAEd,IAAA,MAAM,IAAA,GAAO,CAAC,GAAA,KAAgB;AAC5B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,mBAAmB,aAAa,CAAA;AACvC,MAAA,IAAI,GAAA,SAAY,GAAG,CAAA;AAAA,WACd,OAAA,EAAQ;AAAA,IACf,CAAA;AAEA,IAAA,MAAM,KAAA,GAAQ,UAAA;AAAA,MACZ,MAAM,KAAK,IAAI,KAAA,CAAM,6BAA6B,SAAA,GAAY,GAAI,GAAG,CAAC,CAAA;AAAA,MACtE;AAAA,KACF;AAEA,IAAA,MAAA,CAAO,EAAA,CAAG,aAAA,EAAe,CAAC,KAAA,KAAsB;AAC9C,MAAA,OAAA,GAAU,KAAK,CAAA;AACf,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,WAAA,EAAa,IAAA,EAAK;AAAA,WAAA,IAC5B,KAAA,CAAM,SAAS,OAAA,EAAS;AAC/B,QAAA,MAAM,GAAA,GACH,KAAA,CAA+C,KAAA,IAC/C,KAAA,CAA+B,OAAA,IAChC,aAAA;AACF,QAAA,IAAA,CAAK,IAAI,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,MACrB;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA;AAAA,EAClC,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CAAa,KAAa,OAAA,EAAgC;AACjE,EAAA,KAAA,MAAW,KAAA,IAAS,GAAG,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,IAAA,IAAI,CAAC,KAAA,CAAM,WAAA,EAAY,EAAG;AAC1B,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA;AACtC,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AAC1C,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,OAAO,CAAA,EAAG;AAC1B,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,OAAA,EAAS,OAAO,OAAA;AAAA,IACrC,CAAA,MAAO;AACL,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,IAAA,EAAM,OAAO,CAAA;AACxC,MAAA,IAAI,OAAO,OAAO,KAAA;AAAA,IACpB;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-Y6E62LFB.js","sourcesContent":["/**\n * runFlow / resumeFlow — CLI entry helpers for the flow connector.\n *\n * Moved from `runner/src/runner.ts` to `factory-assets/connectors/flow/run-flow.ts`\n * in Phase 3 of the flow-connector extraction (2026-05-08). Behaviour is\n * byte-identical to the previous runner-side implementation; only the log\n * source changes from `runner:flow:<runId>` to `flow-connector:run:<runId>`.\n *\n * The runner re-exports these symbols with a deprecation warning for one\n * release. CLI consumers should switch to\n * `import { runFlow, resumeFlow } from \"@skaile/workspaces/factory-assets/connectors/flow/run-flow\"`.\n *\n * Internal runner helpers (FlowOrchestrator, bootstrapRunnerLogStore,\n * createAgentSession, resolveDriverPaths, session helpers) are loaded lazily\n * via dynamic `await import(\"@skaile/workspaces/runner\")` inside\n * `loadRunnerModule()` below. The lazy load avoids a static package-level\n * cycle (runner → connectors → factory-assets → runner) — the cycle exists at\n * the workspace level but never resolves at module-load time because\n * factory-assets only ever calls `import` from inside an async function body.\n * The string-literal specifier preserves `bun --compile` and tsup static\n * analysis.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { AgentEvent } from \"@skaile/workspaces/bridge\";\nimport {\n  isValidAssetName,\n  resolveAgentDir,\n  resolveSettings,\n  resolveSkWorkspaceConfig,\n} from \"@skaile/workspaces/core\";\nimport { createLogger } from \"@skaile/workspaces/core/logging\";\nimport { parseSkillFrontmatter, validateFlowVersions } from \"@skaile/workspaces/resolver\";\nimport { initTelemetry } from \"@skaile/workspaces/telemetry\";\nimport type { FlowExecution, FlowPromptEvent } from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nimport { FlowAdapter } from \"./adapter.js\";\nimport {\n  findFlowFileInRoots,\n  FLOW_FILE_EXTENSIONS,\n  type FlowLookupMiss,\n  flowLookupRoots,\n  loadFlow,\n} from \"./engine/index.js\";\nimport { flowSkillVersionPins } from \"./engine/node-shape.js\";\nimport { SessionInlineSubFlowRunner } from \"./inline-sub-flow-host.js\";\nimport { SessionNodeExecutor } from \"./node-executor.js\";\nimport { driveOrchestratorTurn } from \"./orchestrator-turn.js\";\nimport { renderStimulusPrompt, type TurnStimulus } from \"./prompt-fragments.js\";\nimport { SessionSubpromptRunner } from \"./subprompt-runner.js\";\n\n/**\n * Lazy `import(\"@skaile/workspaces/runner\")` accessor. Cached on first call so\n * subsequent `runFlow` invocations don't re-evaluate the runner module.\n *\n * Dynamic ESM import is used (not `require`) so vitest and other ESM\n * bundlers honour their alias resolution — `require` would side-step the\n * configured aliases and pick up two distinct module instances when run\n * under vitest. The string-literal specifier ensures bun --compile keeps\n * the dependency (per the static-import-or-die rule in\n * connectors/CLAUDE.md).\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nlet _runnerModule: any | undefined;\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nasync function loadRunnerModule(): Promise<any> {\n  if (_runnerModule) return _runnerModule;\n  _runnerModule = await import(\"@skaile/workspaces/runner\");\n  return _runnerModule;\n}\n\n/** Type-only re-export of SessionState so the runner tombstone shim still works. */\nexport type SessionState = import(\"@skaile/workspaces/runner\").SessionState;\n\n/** Maximum agent session duration (4 hours). Configurable via {@link RunOptions.sessionTimeoutMs}. */\nconst DEFAULT_SESSION_TIMEOUT_MS = 4 * 60 * 60 * 1000; // 4 hours\n\nconst FLOW_AGENT_OPERATION_NAMES = new Set([\n  \"get_available\",\n  \"get_state\",\n  \"get_globals\",\n  \"build_handoff\",\n  \"validate_node\",\n  \"start_node\",\n  \"request_approval\",\n  \"request_input\",\n  \"complete_node\",\n  \"skip_node\",\n  \"fail_node\",\n]);\n\n/**\n * Options for {@link runFlow}.\n *\n * Wraps `FlowOrchestrator` with autonomous mode turned on by default. First-class\n * gate nodes remain mandatory human decisions in every mode.\n *\n * @docLink packages/factory-assets/flow#run-flow\n */\nexport interface RunOptions {\n  /** The working directory for the project being orchestrated. */\n  projectDir: string;\n  /** Absolute path to the `.flow.yaml` or `.flow.json` definition file. */\n  flowPath: string;\n  /**\n   * Directory containing `agent.yaml`, `SOUL.md`, `RULES.md`, `knowledge/`.\n   * Resolved from `skaile.yaml` via `resolveAgentDir` when absent.\n   */\n  agentDir?: string;\n  /**\n   * Agent driver backend. Defaults to `settings.driver` (`\"omp\"` or `\"claude-sdk\"`).\n   */\n  driver?: string;\n  /**\n   */\n  /**\n   * Model name override. Falls back to `settings.model` when absent.\n   */\n  model?: string;\n  /**\n   * Path to a specific `settings.json` to load instead of the default\n   * layered resolution chain (project → parent → global → built-in defaults).\n   */\n  settingsFile?: string;\n  /**\n   * When `true`, prints the initial flow state without starting the agent\n   * and returns immediately.\n   */\n  dryRun?: boolean;\n  /**\n   * Per-session timeout in milliseconds. Defaults to\n   * {@link DEFAULT_SESSION_TIMEOUT_MS} (4 hours).\n   */\n  sessionTimeoutMs?: number;\n  /** Optional human-readable label shown in the session list. */\n  sessionLabel?: string;\n  /** Autonomous mode for CLI runs. Defaults to true; first-class gate nodes are never bypassed. */\n  autonomousMode?: boolean;\n  /**\n   * Called for each {@link AgentEvent} emitted during the run\n   * (e.g. `text`, `tool_call`, `state_changed`).\n   */\n  onEvent?: (event: AgentEvent) => void;\n  /**\n   * Called for each diagnostic log line. Defaults to `process.stdout`.\n   */\n  onLog?: (line: string) => void;\n}\n\n/**\n * Options for resuming an existing CLI session.\n *\n * Reconnects the driver's conversation thread (conversation history is\n * preserved via the stored `driverSessionId`) but restarts flow execution\n * from scratch — flow state is not persisted in CLI mode. For governed,\n * resumable flow runs use a host that persists flow state (e.g. the Skaile\n * platform).\n *\n * @docLink packages/factory-assets/flow#resume-flow\n */\nexport interface ResumeOptions {\n  /** The working directory for the project being orchestrated. */\n  projectDir: string;\n  /**\n   * Specific run ID to resume. When absent, the current session pointer\n   * at `<projectDir>/.skaile/current` is used.\n   */\n  sessionId?: string;\n  /**\n   * Agent definition directory override. Defaults to the directory stored\n   * in the session file.\n   */\n  agentDir?: string;\n  /**\n   * When `true`, prints the initial flow state without starting the agent\n   * and returns immediately.\n   */\n  dryRun?: boolean;\n  /**\n   * Per-session timeout in milliseconds. Defaults to\n   * {@link DEFAULT_SESSION_TIMEOUT_MS} (4 hours).\n   */\n  sessionTimeoutMs?: number;\n  /**\n   * Called for each {@link AgentEvent} emitted during the run.\n   */\n  onEvent?: RunOptions[\"onEvent\"];\n  /**\n   * Called for each diagnostic log line. Defaults to `process.stdout`.\n   */\n  onLog?: RunOptions[\"onLog\"];\n}\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Start a new flow session from the CLI.\n *\n * Wraps `FlowOrchestrator` with autonomous mode turned on by default. The\n * runner remains idle between turns; first-class gates always park for a human\n * decision, including in autonomous mode. Non-CLI hosts (Skaile platform,\n * Pichi) use the orchestrator directly via the serve command surface and drive\n * gates through user actions.\n *\n * @docLink packages/factory-assets/flow#run-flow\n */\nexport async function runFlow(opts: RunOptions): Promise<void> {\n  const runner = await loadRunnerModule();\n  const {\n    bootstrapRunnerLogStore,\n    bootstrapCapabilityRegistry,\n    CapabilityRegistry,\n    createAgentSession,\n    createSessionStimulusBus,\n    defineCapability,\n    registerCompositionCapabilities,\n    resolveDriverPaths,\n    newSession,\n    saveSession,\n    touchSession,\n  } = runner;\n\n  const flow = loadFlow(opts.flowPath);\n  const agentDir = opts.agentDir ?? resolveAgentDir(opts.projectDir);\n  const settings = await resolveSettings(opts.projectDir, {\n    driver: opts.driver,\n    model: opts.model,\n  });\n\n  const session = newSession({\n    flowId: flow.id,\n    projectDir: opts.projectDir,\n    agentDir,\n    driver: settings.driver ?? \"omp\",\n    model: settings.model,\n    label: opts.sessionLabel,\n  });\n\n  await saveSession(opts.projectDir, session);\n\n  // Bootstrap structured logging — registers a process-singleton LogStore.\n  // OnLogBridgeSink mirrors entries to opts.onLog when caller provides one,\n  // preserving back-compat with CLI hosts that consume plain text lines.\n  const wsConfigEarly = resolveSkWorkspaceConfig(opts.projectDir);\n  const { dispose: disposeLogStore } = bootstrapRunnerLogStore({\n    sessionId: session.runId,\n    projectDir: opts.projectDir,\n    yamlBlock: (wsConfigEarly as { logging?: unknown }).logging,\n    onLog: opts.onLog,\n  });\n  const flowLog = createLogger({\n    kind: \"flow-connector\",\n    subkind: \"run\",\n    instance: session.runId,\n  });\n  const log = (line: string) => flowLog.info(line);\n  const capabilityRegistry = new CapabilityRegistry();\n  bootstrapCapabilityRegistry(capabilityRegistry);\n  const capabilityHooks = {\n    sessionId: session.runId,\n    composeTools: () => capabilityRegistry.composeLLMTools(),\n    resolve: (name: string) =>\n      capabilityRegistry.list().find((cap: { name: string }) => cap.name === name) ?? null,\n    invoke: (name: string, input: unknown) =>\n      capabilityRegistry.invoke(name, input, { sessionId: session.runId }),\n  };\n\n  try {\n    // ── Dry run ────────────────────────────────────────────────────────────\n    if (opts.dryRun) {\n      const adapter = new FlowAdapter();\n      const handle = await adapter.connect(\n        {\n          id: \"flow\",\n          driver: \"flow\",\n          access: \"read-only\" as const,\n          options: { flow, seed: { runId: session.runId, startedBy: \"cli\" } },\n        },\n        {}, // flow needs no connect context\n      );\n      const state = adapter.getExecution(handle);\n      const available = Object.values(state.nodes)\n        .filter((n) => n.status === \"available\")\n        .map((n) => n.id);\n      log(`[dry-run] Flow: ${flow.name} (${flow.id})`);\n      log(`[dry-run] Available: ${available.join(\", \") || \"(none)\"}`);\n      await adapter.disconnect(handle);\n      return;\n    }\n\n    await validatePinnedVersions(flow, opts.projectDir, log);\n\n    // ── Telemetry initialization ────────────────────────────────────────────\n    const wsConfig = wsConfigEarly;\n    const telemetry = await initTelemetry(wsConfig.telemetry);\n    const flowTrace = telemetry.startTrace({\n      name: `flow:${flow.id}`,\n      kind: \"flow_run\",\n      attributes: {\n        \"skaile.flow.id\": flow.id,\n        \"skaile.flow.run_id\": session.runId,\n      },\n    });\n\n    // ── Agent session setup ─────────────────────────────────────────────────\n    const driverPaths = resolveDriverPaths(settings);\n    const agentSession = await createAgentSession({\n      projectDir: opts.projectDir,\n      agentDir: session.agentDir,\n      driver: session.driver,\n      model: session.model,\n      resumeSessionId: session.driverSessionId,\n      projectClaudeMd: path.join(opts.projectDir, \"CLAUDE.md\"),\n      promptsDir: path.join(opts.projectDir, driverPaths.promptsDir),\n      sessionId: session.runId,\n      onLog: log,\n      telemetry,\n      trace: flowTrace,\n      wsConfig,\n      capabilities: capabilityHooks,\n      capabilityRegistry,\n    });\n    if (agentSession.composition?.discoverableEntries.length) {\n      registerCompositionCapabilities(\n        capabilityRegistry,\n        agentSession.composition.discoverableEntries,\n      );\n    }\n    const { driver } = agentSession;\n    const nodeExecutor = new SessionNodeExecutor({ workspaceDir: opts.projectDir });\n    // Same endpoints and credentials the session driver used: the registry\n    // and the credential env `createAgentSession` already resolved — not a\n    // new resolution, not a new secret channel.\n    const subpromptRunner = new SessionSubpromptRunner({\n      driverType: agentSession.driverType,\n      sessionModel: agentSession.model,\n      workspaceDir: opts.projectDir,\n      registry: agentSession.registry,\n      credentialEnv: agentSession.credentialEnv,\n      ...(agentSession.modelRef ? { modelRef: agentSession.modelRef } : {}),\n    });\n    let driverStarted = false;\n    const updatedSession = { ...session };\n\n    // Track driver session ID so future resumes can reconnect the SDK thread.\n    driver.on(\"agent-event\", () => {\n      const runtimeSessionId = driver.runtimeSessionId;\n      if (!runtimeSessionId || runtimeSessionId === updatedSession.driverSessionId) return;\n      updatedSession.driverSessionId = runtimeSessionId;\n      void saveSession(opts.projectDir, updatedSession).catch(() => {});\n    });\n\n    // ── FlowAdapter + stimulus bus ─────────────────────────────────────────\n    //\n    // Phase 4 of the flow-connector extraction: SessionStimulusBus is the sole\n    // turn driver. The legacy FlowOrchestrator + onStateChange subscription\n    // are gone — every turn is initiated either by the bus (after an adapter\n    // mutation observed via `useBusForStimulus: true`) or by an explicit\n    // `bus.signal()` call from this function (the initial flow_started turn).\n    //\n    // The bus's `driveTurn` callback receives the stimulus paragraph the\n    // adapter rendered (not the full orchestrator prompt). It hands the turn to\n    // `driveOrchestratorTurn`, which rebuilds the five-section prompt so the\n    // agent sees the same flow context the legacy orchestrator produced — and\n    // announces it, so a CLI consumer's `onEvent` stream carries the prompt too.\n    const flowConnectorId = \"flow\";\n    const turnTimeoutMs = opts.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;\n\n    const ensureDriverStarted = async (): Promise<void> => {\n      if (driverStarted) return;\n      await driver.start();\n      driverStarted = true;\n    };\n\n    // Same widening the `state_changed` forwarder below performs: `onEvent` is\n    // typed against the bridge's driver-level union, which has no case for a\n    // runtime-level event.\n    const emitFlowPrompt = (event: FlowPromptEvent): void => {\n      opts.onEvent?.(event as unknown as AgentEvent);\n    };\n\n    const inlineSubFlowRunner = new SessionInlineSubFlowRunner({\n      resolveFlow: (flowId) => loadFlow(resolveFlowPath(flowId, opts.projectDir)),\n      nodeExecutor,\n      subpromptRunner,\n      driveAgentTurn: async ({ flow: childFlow, execution, stimulus }) => {\n        await ensureDriverStarted();\n        await driveOrchestratorTurn({\n          flow: childFlow,\n          execution,\n          stimulus,\n          emit: emitFlowPrompt,\n          deliver: (prompt) => awaitAgentEnd(driver, prompt, opts.onEvent, turnTimeoutMs),\n        });\n      },\n    });\n\n    // Forward declaration so `driveTurn` can read the live execution\n    // snapshot. Assigned just below, before the bus can fire.\n    let flowAdapterRef: FlowAdapter | null = null;\n    let flowHandleRef: import(\"@skaile/workspaces/connectors\").ConnectorHandle | null = null;\n\n    const stimulusBus = createSessionStimulusBus({\n      driveTurn: async (\n        promptFragment: string,\n        metas: Array<Record<string, unknown>>,\n      ): Promise<void> => {\n        // The adapter signal carries `meta.kind` per stimulus. Use that to\n        // reconstruct the typed `TurnStimulus`; for compound batches, fall\n        // back to `state_changed` (the union element that means \"look at\n        // current state and continue\").\n        const lastKind = metas[metas.length - 1]?.kind;\n        let stimulus: TurnStimulus;\n        if (lastKind === \"flow_started\") {\n          stimulus = { kind: \"flow_started\" };\n        } else if (\n          lastKind === \"user_message\" &&\n          typeof metas[metas.length - 1]?.text === \"string\"\n        ) {\n          const meta = metas[metas.length - 1] as Record<string, unknown>;\n          stimulus = {\n            kind: \"user_message\",\n            text: String(meta.text ?? \"\"),\n            senderId: String(meta.senderId ?? \"user\"),\n          };\n        } else {\n          stimulus = { kind: \"state_changed\" };\n        }\n        // The fragment passed in by the bus is the adapter's\n        // `renderStimulusPrompt(stim)` joined across coalesced signals. It is\n        // discarded in favour of the structured stimulus, which\n        // `driveOrchestratorTurn` rebuilds the full prompt from; that keeps the\n        // prompt shape stable and the structured form already contains\n        // everything the fragment encoded.\n        void promptFragment;\n        if (!flowAdapterRef || !flowHandleRef) {\n          throw new Error(\"driveTurn fired before FlowAdapter was wired\");\n        }\n        await flowAdapterRef.drainRuntimeNodes(flowHandleRef);\n        const execution = flowAdapterRef.getExecution(flowHandleRef);\n        if (execution.done || execution.status === \"failed\" || execution.status === \"cancelled\") {\n          return;\n        }\n        if (!flowAdapterRef.shouldDriveAgentTurn(flowHandleRef, stimulus)) return;\n        await ensureDriverStarted();\n        await driveOrchestratorTurn({\n          flow,\n          execution,\n          stimulus,\n          emit: emitFlowPrompt,\n          deliver: (prompt) => awaitAgentEnd(driver, prompt, opts.onEvent, turnTimeoutMs),\n        });\n      },\n      log: flowLog,\n    });\n\n    const flowAdapter = new FlowAdapter();\n    const flowHandle = await flowAdapter.connect(\n      {\n        id: flowConnectorId,\n        driver: \"flow\",\n        access: \"read-write\" as const,\n        options: {\n          flow,\n          seed: {\n            runId: session.runId,\n            startedBy: \"cli\",\n            autonomousMode: opts.autonomousMode ?? true,\n          },\n          stimulusBus,\n          useBusForStimulus: true,\n          nodeExecutor,\n          subpromptRunner,\n          inlineSubFlowRunner,\n        },\n      },\n      {}, // flow needs no connect context\n    );\n    flowAdapterRef = flowAdapter;\n    flowHandleRef = flowHandle;\n\n    // Flow operations retain the connector's published bare protocol names;\n    // this is the intentional exception to generic capability namespaces.\n    for (const operation of flowAdapter.tools\n      .describeOperations(flowHandle)\n      .filter(({ name }) => FLOW_AGENT_OPERATION_NAMES.has(name))) {\n      const shape: Record<string, z.ZodType> = {};\n      for (const arg of operation.args) {\n        let schema: z.ZodType;\n        switch (arg.type) {\n          case \"boolean\":\n            schema = z.boolean();\n            break;\n          case \"number\":\n            schema = z.number();\n            break;\n          case \"json\":\n            schema = z.json();\n            break;\n          default:\n            schema = z.string();\n        }\n        shape[arg.name] = arg.required ? schema : schema.optional();\n      }\n      capabilityRegistry.register(\n        defineCapability({\n          name: operation.name,\n          displayName: operation.name,\n          description: operation.description,\n          input: z.object(shape),\n          side: \"agent\",\n          origin: { kind: \"flow\", flowId: flow.id },\n          scope: \"session\",\n          audience: [\"llm\"],\n          kind: operation.accessLevel === \"read\" ? \"query\" : \"effect\",\n          handler: async (args: Record<string, unknown>) =>\n            flowAdapter.executeOp(flowHandle, operation.name, args),\n        }),\n        \"agent\",\n      );\n    }\n\n    // Forward state_changed events to the caller. The bus computes a\n    // turn-kicking stimulus on each adapter mutation; the host-facing\n    // event stream still observes the full snapshot via onChange.\n    flowAdapter.onStateChange(flowHandle, (state: FlowExecution) => {\n      opts.onEvent?.({\n        type: \"state_changed\",\n        store: `flow:${state.runId}`,\n        state: state as unknown as Record<string, unknown>,\n      } as unknown as AgentEvent);\n    });\n\n    // ── Execute ────────────────────────────────────────────────────────────\n    flowLog.info(\"starting flow\", {\n      flowId: flow.id,\n      flowName: flow.name,\n      runId: session.runId,\n    });\n\n    try {\n      // Kick the initial flow_started turn explicitly. Subsequent turns are\n      // driven by the bus signaling whenever the adapter mutates.\n      const initialStimulus: TurnStimulus = { kind: \"flow_started\" };\n      await stimulusBus.signal(flowConnectorId, {\n        promptFragment: renderStimulusPrompt(initialStimulus),\n        meta: { kind: initialStimulus.kind },\n      });\n\n      const finalState = flowAdapter.getExecution(flowHandle);\n      if (finalState.done) {\n        flowLog.info(\"flow complete\", { flowId: flow.id, flowName: flow.name });\n      } else if (finalState.status === \"failed\") {\n        flowLog.error(\"flow failed\", undefined, { flowId: flow.id, flowName: flow.name });\n      } else {\n        flowLog.warn(\"flow paused awaiting further stimulus\", {\n          flowId: flow.id,\n          status: finalState.status,\n          note: \"CLI mode does not supply human approval/input decisions\",\n        });\n      }\n    } finally {\n      driver.kill();\n      const lastState = flowAdapter.getExecution(flowHandle);\n      await saveSession(\n        opts.projectDir,\n        touchSession({\n          ...updatedSession,\n          driverSessionId: driver.runtimeSessionId ?? updatedSession.driverSessionId,\n          status: lastState.status === \"complete\" ? \"complete\" : \"paused\",\n        }),\n      ).catch(() => {});\n      await flowAdapter.disconnect(flowHandle).catch(() => {});\n      await agentSession.dispose();\n      telemetry.endTrace(flowTrace, {\n        status: flowAdapter.getExecution(flowHandle).status === \"complete\" ? \"ok\" : \"error\",\n      });\n      await telemetry.flush().catch(() => {});\n    }\n  } finally {\n    disposeLogStore();\n  }\n}\n\n/**\n * Resume an existing session from the CLI.\n *\n * With the Phase 2 turn-based model, flow state is NOT persisted to\n * local session files — only the driver session ID is kept. The CLI\n * can resume the agent's conversation thread, but the flow execution\n * itself starts from scratch because the runner has no durable store\n * for per-run state.\n *\n * For a governed, resumable flow run, use a host that persists flow\n * state (e.g. the Skaile platform). CLI resume is retained as a\n * driver-level convenience only: we load the session, restart the\n * flow, and the SDK will reconnect to the prior conversation thread.\n *\n * @docLink packages/factory-assets/flow#resume-flow\n */\nexport async function resumeFlow(opts: ResumeOptions): Promise<void> {\n  const runner = await loadRunnerModule();\n  const { loadSession, loadSessionById, bootstrapRunnerLogStore } = runner;\n\n  const session = opts.sessionId\n    ? await loadSessionById(opts.projectDir, opts.sessionId)\n    : await loadSession(opts.projectDir);\n\n  if (!session) {\n    const hint = opts.sessionId\n      ? `session ${opts.sessionId}`\n      : `current session in ${opts.projectDir}/.skaile`;\n    throw new Error(`No session found (${hint}) — run 'start' first`);\n  }\n\n  const flowPath = resolveFlowPath(session.flowId, opts.projectDir);\n\n  // Bootstrap a transient logger for the resume diagnostics. The inner\n  // runFlow() call will register its own LogStore for the new run. Keep\n  // OnLogBridgeSink wiring so callers passing onLog still see this line.\n  const wsConfigEarly = resolveSkWorkspaceConfig(opts.projectDir);\n  const { dispose: disposeLogStore } = bootstrapRunnerLogStore({\n    sessionId: session.runId,\n    projectDir: opts.projectDir,\n    yamlBlock: (wsConfigEarly as { logging?: unknown }).logging,\n    onLog: opts.onLog,\n  });\n  const flowLog = createLogger({\n    kind: \"flow-connector\",\n    subkind: \"run\",\n    instance: session.runId,\n  });\n  flowLog.info(\"resuming session\", {\n    runId: session.runId,\n    flowId: session.flowId,\n    note: \"CLI mode does not persist flow state — flow restarts from scratch; driver thread resumes\",\n  });\n\n  try {\n    await runFlow({\n      projectDir: opts.projectDir,\n      flowPath,\n      agentDir: opts.agentDir ?? session.agentDir,\n      driver: session.driver,\n      model: session.model,\n      sessionLabel: session.label,\n      dryRun: opts.dryRun,\n      sessionTimeoutMs: opts.sessionTimeoutMs,\n      onEvent: opts.onEvent,\n      onLog: opts.onLog,\n    });\n  } finally {\n    disposeLogStore();\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nasync function validatePinnedVersions(\n  flow: Awaited<ReturnType<typeof loadFlow>>,\n  projectDir: string,\n  log: (line: string) => void,\n): Promise<void> {\n  const pinnedNodes = flowSkillVersionPins(flow);\n  if (pinnedNodes.length === 0) return;\n\n  const skillVersions = new Map<string, string>();\n  const aiResourcesDir = findAiResourcesDir(projectDir);\n  if (aiResourcesDir) {\n    for (const node of pinnedNodes) {\n      const skillId = node.skillId;\n      if (skillVersions.has(skillId)) continue;\n      const skillPath = findSkillMd(aiResourcesDir, skillId);\n      if (skillPath) {\n        const content = fs.readFileSync(skillPath, \"utf-8\");\n        const fm = parseSkillFrontmatter(content);\n        skillVersions.set(skillId, fm.metadata?.version ?? fm.version ?? \"\");\n      }\n    }\n  }\n\n  const checks = validateFlowVersions(pinnedNodes, skillVersions);\n  const failures = checks.filter((c) => !c.satisfied);\n  if (failures.length > 0) {\n    const lines = failures.map(\n      (f) => `  ${f.nodeId}: wants ${f.requested}, found ${f.actual || \"(none)\"}`,\n    );\n    throw new Error(`Skill version mismatch:\\n${lines.join(\"\\n\")}`);\n  }\n  for (const c of checks.filter((c) => c.satisfied)) {\n    log(`  Version OK: ${c.skillId} ${c.actual} satisfies ${c.requested}`);\n  }\n}\n\n/**\n * Assert `found` sits inside one of `roots`.\n *\n * A backstop, not the primary control: `isValidAssetName` already rejects every\n * id containing a separator, and `findFlowFileInRoots` skips any candidate that\n * escapes its search dir. So on today's code this cannot fire — it is here to\n * fail loudly rather than silently if a future lookup stops enforcing\n * containment itself. Widening the accepted extensions must never widen which\n * paths are reachable, and this is the line that keeps that honest.\n */\nfunction assertContainedInAnyRoot(found: string, roots: string[], flowId: string): void {\n  const resolved = path.resolve(found);\n  const inside = roots.some((root) => {\n    const relative = path.relative(path.resolve(root), resolved);\n    return !relative.startsWith(\"..\") && !path.isAbsolute(relative);\n  });\n  if (!inside) {\n    throw new Error(`Flow path escapes its lookup root: ${JSON.stringify(flowId)}`);\n  }\n}\n\n/** One line per near-miss: a file that is right there but was still rejected. */\nfunction describeMisses(misses: FlowLookupMiss[], heading: string): string {\n  const seen = new Set<string>();\n  const lines: string[] = [];\n  for (const miss of misses) {\n    if (seen.has(miss.path)) continue;\n    seen.add(miss.path);\n    lines.push(\n      miss.reason === \"id-mismatch\"\n        ? `  ${miss.path}: declares id ${JSON.stringify(miss.declaredId ?? \"\")}`\n        : `  ${miss.path}: could not be parsed (${miss.error ?? \"unknown error\"})`,\n    );\n  }\n  return lines.length > 0 ? `\\n${heading}\\n${lines.join(\"\\n\")}` : \"\";\n}\n\n/**\n * Resolve one flow identity through the CLI/serve host's normal lookup order —\n * the same roots and filenames `skaile run` and `flow list` use, via\n * {@link flowLookupRoots} / {@link findFlowFileInRoots}. Resolution is by the\n * **declared** `id`, not by filename.\n *\n * @throws {Error} When `flowId` is not a canonical asset name, when no file\n *   declares it, or when a match somehow resolves outside every lookup root.\n */\nexport function resolveFlowPath(flowId: string, projectDir: string): string {\n  // Sub-flow targets and resumed session records are the two callers, so an\n  // identity that is not canonical is a bug in the caller, not a missing file.\n  if (!isValidAssetName(flowId)) {\n    throw new Error(`Invalid canonical flow identity: ${JSON.stringify(flowId)}`);\n  }\n\n  const roots = flowLookupRoots(projectDir);\n  const misses: FlowLookupMiss[] = [];\n  const found = findFlowFileInRoots(flowId, roots, { onMiss: (m) => misses.push(m) });\n  if (found) {\n    assertContainedInAnyRoot(found, roots, flowId);\n    return found;\n  }\n\n  // A file that is present but unparseable is a different problem from a missing\n  // one, and \"not found\" is the wrong headline for it — that exact misdirection\n  // is what this change exists to remove, so don't reintroduce it here.\n  if (misses.length > 0 && misses.every((m) => m.reason === \"unparseable\")) {\n    throw new Error(\n      `Flow ${flowId} was found but could not be loaded.` + describeMisses(misses, \"Candidates:\"),\n    );\n  }\n\n  const shown = roots.slice(0, 3).join(\", \");\n  const more = roots.length > 3 ? \", …\" : \"\";\n  // Spelled from FLOW_FILE_EXTENSIONS so the message cannot drift from the\n  // candidate list the lookup actually probes.\n  const accepted = FLOW_FILE_EXTENSIONS.map((ext) => `${flowId}${ext}`).join(\" | \");\n  throw new Error(\n    `Flow not found: ${flowId}. Searched ${roots.length} root(s) (${shown || \"none\"}${more}) ` +\n      `for ${accepted} — flat, or inside a ${flowId}/ directory.` +\n      describeMisses(misses, \"Near misses:\"),\n  );\n}\n\n/** Walk up from projectDir to find ai-assets/ */\nfunction findAiResourcesDir(projectDir: string): string | null {\n  let dir = projectDir;\n  for (let i = 0; i < 6; i++) {\n    const candidate = path.join(dir, \"ai-assets\");\n    if (fs.existsSync(candidate)) return candidate;\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/** Find SKILL.md for a given skill ID by walking ai-assets domains */\nfunction findSkillMd(aiResourcesDir: string, skillId: string): string | null {\n  for (const domain of fs.readdirSync(aiResourcesDir, { withFileTypes: true })) {\n    if (!domain.isDirectory()) continue;\n    const skillsDir = path.join(aiResourcesDir, domain.name, \"skills\");\n    if (!fs.existsSync(skillsDir)) continue;\n    const found = walkForSkill(skillsDir, skillId);\n    if (found) return found;\n  }\n  return null;\n}\n\n// ---------------------------------------------------------------------------\n// Turn-wait helper\n// ---------------------------------------------------------------------------\n\n/**\n * Minimal driver surface needed by the bus's `driveTurn` callback. Mirrors\n * the slice the legacy `FlowOrchestrator` consumed (`prompt` + `on` +\n * `removeAllListeners`) so we can keep the wait helper private to this\n * module without pulling in a runtime dep on `@skaile/workspaces/bridge`.\n */\ninterface TurnDriverSurface {\n  prompt(message: string): Promise<void>;\n  on(event: \"agent-event\", handler: (event: AgentEvent) => void): void;\n  removeAllListeners(event: \"agent-event\"): void;\n}\n\n/**\n * Send a prompt to the driver and resolve when the agent emits\n * `agent_end` (or reject on `error`). Identical contract to the legacy\n * `awaitAgentEnd` helper from `flow-orchestrator.ts`. Phase 4 lifts the\n * helper into `run-flow.ts` because the bus now owns turn driving.\n */\nfunction awaitAgentEnd(\n  driver: TurnDriverSurface,\n  prompt: string,\n  onEvent: ((event: AgentEvent) => void) | undefined,\n  timeoutMs: number,\n): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    let settled = false;\n\n    const done = (err?: Error) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      driver.removeAllListeners(\"agent-event\");\n      if (err) reject(err);\n      else resolve();\n    };\n\n    const timer = setTimeout(\n      () => done(new Error(`Flow turn timed out after ${timeoutMs / 1000}s`)),\n      timeoutMs,\n    );\n\n    driver.on(\"agent-event\", (event: AgentEvent) => {\n      onEvent?.(event);\n      if (event.type === \"agent_end\") done();\n      else if (event.type === \"error\") {\n        const msg =\n          (event as { error?: string; message?: string }).error ??\n          (event as { message?: string }).message ??\n          \"Agent error\";\n        done(new Error(msg));\n      }\n    });\n\n    driver.prompt(prompt).catch(done);\n  });\n}\n\nfunction walkForSkill(dir: string, skillId: string): string | null {\n  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n    if (!entry.isDirectory()) continue;\n    const full = path.join(dir, entry.name);\n    const skillMd = path.join(full, \"SKILL.md\");\n    if (fs.existsSync(skillMd)) {\n      if (entry.name === skillId) return skillMd;\n    } else {\n      const found = walkForSkill(full, skillId);\n      if (found) return found;\n    }\n  }\n  return null;\n}\n"]}

package/dist/{chunk-72DG6GSB.js → chunk-YS4XBN7O.js}

@@ -103,8 +103,8 @@ function withActivityLabelDefs(defs, z) {
 }
 
 // types/src/version.ts
-var PROTOCOL_VERSION = { major: 3, minor: 15, patch: 0 };
-var PROTOCOL_VERSION_STRING = "3.15.0";
+var PROTOCOL_VERSION = { major: 4, minor: 0, patch: 0 };
+var PROTOCOL_VERSION_STRING = "4.0.0";
 function parseVersion(s) {
   const parts = s.split(".");
   if (parts.length !== 3) {
@@ -124,5 +124,5 @@ function formatVersion(v) {
 }
 
 export { MENTION_GROUPS, PROTOCOL_VERSION, PROTOCOL_VERSION_STRING, QUICK_REACTIONS, SESSION_ROOT_CONNECTOR_ID, TOOL_ACTIVITY_LABEL_DESCRIPTION, TOOL_ACTIVITY_LABEL_MAX_CHARS, TOOL_ACTIVITY_LABEL_PARAM, TOOL_ACTIVITY_PROMPT_SECTION, declaresActivityLabel, formatVersion, isRenderCapability, isUserInvokable, parseVersion, stripActivityLabel, withActivityLabelDefs, withActivityLabelJsonSchema, withActivityLabelShape };
-//# sourceMappingURL=chunk-72DG6GSB.js.map
-//# sourceMappingURL=chunk-72DG6GSB.js.map
+//# sourceMappingURL=chunk-YS4XBN7O.js.map
+//# sourceMappingURL=chunk-YS4XBN7O.js.map