@skaile/workspaces 4.21.1 → 4.23.0

package/dist/{chunk-FELWDKLQ.js.map → chunk-WBRD2T5J.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-publisher.ts","../cli/src/commands/publish-core.ts"],"names":[],"mappings":";;;;AA+FO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAC3F,qBAAA,EAAuB,CAAC,EAAA,KACtB,IAAA,CAAK,sBAAsB,kBAAA,CAAmB,EAAE,CAAC,CAAA,aAAA,CAAe;AAAA,GACpE;AACF;;;ACvGO,SAAS,4BAA4B,CAAA,EAGjC;AACT,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,EAAA,CAAG,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IAClC,KAAK,kBAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IACpC;AACE,MAAA,OAAO,GAAG,CAAA,CAAE,GAAA,CAAI,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA;AAEvC;AAYA,eAAsB,kBAAA,CACpB,QACA,SAAA,EAC4C;AAC5C,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,MAAM,MAAA,CAAO,qBAAA,CAAsB,SAAS,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB;AACA,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,IACpB,KAAK,kBAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EACE,CAAA,CAAA,EAAI,SAAS,CAAA,mDAAA,EACV,CAAA,CAAE,WAAA,GAAc,CAAA,EAAA,EAAK,CAAA,CAAE,WAAW,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,eAAA,EAAkB,EAAE,OAAO,CAAA;AAAA,OAC5E;AAAA,IACF;AACE,MAAA,OAAO,EAAE,IAAI,KAAA,EAAO,OAAA,EAAS,yBAAyB,SAAS,CAAA,QAAA,EAAM,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA;AAEvF;AAaO,SAAS,yBAAA,CACd,YACA,QAAA,EACK;AACL,EAAA,MAAM,SAAS,IAAI,GAAA,CAAA,CAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,IAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AAChF,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AACnE;AAGO,SAAS,MAAA,CAAO,IAAA,EAAc,SAAA,EAAmB,IAAA,EAAc,OAAA,EAA0B;AAC9F,EAAA,MAAM,OAAO,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,SAAS,IAAI,IAAI,CAAA,CAAA;AAC1C,EAAA,OAAO,OAAA,GAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,IAAA;AAC1C;AAGO,SAAS,SAAS,GAAA,EAAqB;AAC5C,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAAI,GAAA;AACxE,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GACrC,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAC1C,SAAA;AACJ,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA;AAChC;AAOA,eAAsB,QACpB,MAAA,EACA,KAAA,EACA,UAAA,GAAa,IAAA,EACb,YAAY,GAAA,EACmF;AAC/F,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAC9B,EAAA,IAAI,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,OAAO,IAAI,MAAA,KAAW,SAAA,IAAa,IAAA,CAAK,GAAA,KAAQ,QAAA,EAAU;AACxD,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,UAAU,CAAC,CAAA;AAClD,IAAA,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,iBAAiB,GAAA,EAAuB;AACtD,EAAA,MAAM,GAAA,GAAA,CAAO,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,GAAG,WAAA,EAAY;AAC3E,EAAA,OAAO,qEAAA,CAAsE,KAAK,GAAG,CAAA;AACvF;AAcA,eAAsB,eAAe,IAAA,EAOA;AACnC,EAAA,MAAM,EAAE,WAAW,GAAA,EAAK,OAAA,EAAS,UAAU,SAAA,EAAW,MAAA,EAAQ,KAAI,GAAI,IAAA;AAEtE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW;AAAA,MACjC,GAAA,EAAK,SAAA;AAAA,MACL,GAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,UAAA,EAAY,OAAA,CAAQ,KAAK,UAAA,EAAY,OAAA,CAAQ,GAAA,EAAI,GAAI,EAAC;AAAA;AAAA;AAAA;AAAA,MAItE,GAAI,SAAS,SAAA,GAAY,EAAE,WAAW,QAAA,CAAS,SAAA,KAAc;AAAC,KAC/D,CAAA;AACD,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI,CAAC,gBAAA,CAAiB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,SAAS,CAAA;AAClD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,OAAA,EAAU,SAAS,CAAA,qDAAA,EACd,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OACvD;AAAA,IACF;AACA,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,GAAA,CAAI,WAAW,QAAQ,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AACpC,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,WAAA,EAAa;AACzD,IAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,KAAA,IAAS,EAAC,EAAG,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,QAAQ,CAAA;AACpE,IAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,MAAA,CAAO,CAAA,MAAA,EAAS,CAAA,CAAE,KAAK,CAAA,EAAA,EAAK,CAAA,CAAE,KAAA,IAAS,QAAQ,CAAA,CAAE,CAAA;AACzE,IAAA,MAAA,CAAO,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACnC,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,IAAA,MAAA,CAAO,sFAAiF,CAAA;AACxF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,aAAa,yBAAA,CAA0B,MAAM,IAAI,gBAAA,CAAiB,QAAQ,GAAG,QAAQ,CAAA;AACzF,EAAA,IAAI,SAAA,eAAwB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,SAAS,CAAA;AACzE,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,wEAAmE,CAAA;AAC3E,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,YAAA,CAAa,EAAE,EAAE,CAAA;AAC3C,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,YAAA,CAAa,CAAA,CAAE,EAAA,EAAI,EAAE,GAAA,EAAK,KAAA,EAAO,OAAA,CAAQ,eAAA,EAAiB,CAAA;AAGhF,MAAA,IAAI,IAAI,KAAA,EAAO;AACb,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,EAAK,IAAI,KAAK,CAAA;AAC3C,QAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,UAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAC,EAC5B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA,CACnC,IAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA,CAClB,OAAO,OAAO,CAAA;AACjB,UAAA,OAAA;AAAA,YACE,cAAc,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,kBAAA,EAAqB,MAAA,CAAO,MAAM,CAAA,CAAA,CAAA,IAC7D,KAAK,MAAA,GAAS,CAAA,EAAA,EAAK,KAAK,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AAAA,WAC5C;AACA,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,SAAA,CAAU,IAAA,CAAK,MAAA,CAAO,CAAA,CAAE,IAAA,EAAM,OAAA,CAAQ,SAAA,CAAU,kBAAA,EAAoB,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAC,CAAA;AAAA,IACxF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA;AAAA,QACE,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OAC5F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,CAAA,UAAA,EAAa,SAAA,CAAU,MAAM,CAAA,UAAA,CAAY,CAAA;AAC/C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAA,EAAW,OAAA,CAAQ,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAC3C,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB","file":"chunk-FELWDKLQ.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n  /**\n   * Identity of the caller. `username` is the Keycloak login (personal-tier\n   * namespace); `githubLogin` is the verified GitHub handle when connected —\n   * the namespace to publish under when it differs from the login.\n   */\n  me(): Promise<{ username: string; githubLogin?: string | null }>;\n  /** Register (or re-register) a source; returns the created/existing row id. */\n  sourcesAdd(body: {\n    url: string;\n    ref: string;\n    sidecarUrl?: string;\n    sidecarRef?: string;\n    /**\n     * Target publisher namespace (the manifest's `publisher`). When it differs\n     * from the caller's login username, the store resolves the CLAIMED Publisher\n     * for it (the store must already have the claim). Omitted → the store\n     * defaults to `@<username>` (personal).\n     */\n    namespace?: string;\n  }): Promise<{ id: string }>;\n  /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n  sourcesList(): Promise<Array<{ id: string; url: string }>>;\n  /** Kick off a source sync; returns the async job id to poll. */\n  sourceSync(id: string): Promise<{ jobId: string }>;\n  /** Poll a job's terminal status + per-item results. */\n  jobGet(\n    jobId: string,\n  ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n  /** Discovered publishable candidates for a synced source. */\n  sourceCandidates(id: string): Promise<\n    Array<{\n      id: string;\n      name: string;\n      version: string;\n      kind: string;\n      published: boolean;\n      assetRoot: string;\n    }>\n  >;\n  /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n  assetPreview(id: string): Promise<{\n    discoveredFiles: string[];\n    candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n  }>;\n  /**\n   * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n   * launching a job; the normal path returns `{ jobId }`.\n   */\n  assetPublish(\n    id: string,\n    body: { ref: string; files: string[] },\n    dryRun?: boolean,\n  ): Promise<{ jobId?: string; manifest?: unknown }>;\n  /** Retract a published asset. Response body is ignored. */\n  assetUnpublish(id: string): Promise<unknown>;\n  /**\n   * Read-only \"can I publish under `@<ns>` right now, and if not, what's the\n   * path?\" probe. Backs the `publish --dry-run` namespace status line; its\n   * `message` is store-authored and meant to be surfaced verbatim.\n   */\n  namespaceAvailability(ns: string): Promise<{\n    namespace: string;\n    status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n    claimMethod?: string;\n    message: string;\n  }>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n  config: StoreConfig = getStoreConfig(),\n  timeoutMs = 20_000,\n): PublisherClient {\n  // Acquire a fresh Keycloak token per call (device-flow session in\n  // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n  const call = async <T>(\n    path: string,\n    opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n  ): Promise<T> => {\n    const jwt = await getStoreToken();\n    return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n  };\n  return {\n    me: () => call(\"/api/v1/me\"),\n    sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n    sourcesList: () => call(\"/api/v1/sources\"),\n    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n    assetPublish: (id, body, dryRun) =>\n      call(`/api/v1/assets/${id}/publish`, {\n        method: \"POST\",\n        body,\n        ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n      }),\n    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n    namespaceAvailability: (ns) =>\n      call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`),\n  };\n}\n","/**\n * Shared store-interaction core for the two publish front-ends — the curator\n * sidecar flow (`source manifest publish`) and the first-party library flow\n * (`library publish`). Both differ only in their git side-effects + how they\n * resolve the source repo; the store orchestration below (register → sync →\n * candidates → per-asset preview+publish) is identical.\n *\n * The store REST surface is reached through the injectable {@link PublisherClient}\n * so the orchestration stays unit/integration-testable without a live store.\n *\n * @docLink cli/commands/source#manifest-publish\n */\n\nimport type { SkPublishManifest } from \"@skaile/workspaces/core\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport type { PublisherClient } from \"../store-publisher.ts\";\n\n/**\n * One-line rendering of a namespace-availability probe for a `--dry-run` plan.\n * The `message` is store-authored (identical to what a real publish would echo)\n * — we only prepend a status glyph so the reader sees green/amber/red at a\n * glance without the CLI re-deriving any authorization logic.\n */\nexport function formatNamespaceAvailability(a: {\n  status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n  message: string;\n}): string {\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return `${S.ok(\"✓\")} ${a.message}`;\n    case \"claimable-by-you\":\n      return `${S.warn(\"!\")} ${a.message}`;\n    default:\n      return `${S.err(\"✗\")} ${a.message}`;\n  }\n}\n\n/**\n * Preflight the target namespace against the store's availability probe BEFORE a\n * publish does any irreversible work (a public git push). Returns `{ ok: false }`\n * with a guided message for `reserved` (not yours) and `claimable-by-you` (must\n * claim first) — the two states a real publish would reject — so the caller can\n * abort with actionable guidance instead of a raw 422 after pushing bytes.\n *\n * The probe is advisory: any failure (offline, older store) returns `{ ok: true }`\n * so the store stays the authority and a valid publish is never blocked.\n */\nexport async function preflightNamespace(\n  client: PublisherClient,\n  namespace: string,\n): Promise<{ ok: boolean; message?: string }> {\n  let a: Awaited<ReturnType<PublisherClient[\"namespaceAvailability\"]>>;\n  try {\n    a = await client.namespaceAvailability(namespace);\n  } catch {\n    return { ok: true };\n  }\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return { ok: true };\n    case \"claimable-by-you\":\n      return {\n        ok: false,\n        message:\n          `@${namespace} isn't yours yet — claim it in the store first` +\n          `${a.claimMethod ? ` (${a.claimMethod})` : \"\"}, then re-run. ${a.message}`,\n      };\n    default: // reserved, or any unrecognized future status (fail safe → block)\n      return { ok: false, message: `Cannot publish under @${namespace} — ${a.message}` };\n  }\n}\n\n/** One candidate row shape the matcher operates on (kind + name are the key). */\ninterface CandidateLike {\n  kind: string;\n  name: string;\n}\n\n/**\n * Keep only candidates whose `(kind, name)` pair is declared in the manifest.\n * The backend may merge extra assets from the base repo into the candidate\n * list; a publish only touches what the manifest curated/declared.\n */\nexport function matchCandidatesToManifest<T extends CandidateLike>(\n  candidates: T[],\n  manifest: SkPublishManifest,\n): T[] {\n  const wanted = new Set((manifest.assets ?? []).map((a) => `${a.kind}:${a.name}`));\n  return candidates.filter((c) => wanted.has(`${c.kind}:${c.name}`));\n}\n\n/** A canonical ref string `kind:@publisher/name[#version]` for reporting. */\nexport function refFor(kind: string, publisher: string, name: string, version?: string): string {\n  const base = `${kind}:@${publisher}/${name}`;\n  return version ? `${base}#${version}` : base;\n}\n\n/** The bare asset name from a `kind:@publisher/name#version` ref or a plain name. */\nexport function bareName(ref: string): string {\n  const afterKind = ref.includes(\":\") ? ref.slice(ref.indexOf(\":\") + 1) : ref;\n  const afterScope = afterKind.includes(\"/\")\n    ? afterKind.slice(afterKind.indexOf(\"/\") + 1)\n    : afterKind;\n  return afterScope.split(\"#\")[0];\n}\n\n/**\n * Poll a job until it leaves `running` or the deadline passes. Returns the last\n * observed state — the caller MUST treat a still-`running` result as a timeout\n * (not success), since it means the deadline was hit before the job finished.\n */\nexport async function pollJob(\n  client: PublisherClient,\n  jobId: string,\n  intervalMs = 1_500,\n  timeoutMs = 60_000,\n): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }> {\n  const deadline = Date.now() + timeoutMs;\n  let job = await client.jobGet(jobId);\n  while (job.status === \"running\" && Date.now() < deadline) {\n    await new Promise((r) => setTimeout(r, intervalMs));\n    job = await client.jobGet(jobId);\n  }\n  return job;\n}\n\n/**\n * True when a `sourcesAdd` rejection is a duplicate-URL conflict (the source is\n * already registered) — the only error the publish flow recovers from by looking\n * the existing row up. Every other failure (auth, 5xx, network) must propagate.\n */\nexport function isDupSourceError(err: unknown): boolean {\n  const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();\n  return /\\b409\\b|conflict|duplicate|already exists|already registered|unique/.test(msg);\n}\n\n/**\n * Register + sync the source, then publish its curated/declared candidates —\n * the store-side steps shared by both publish front-ends. Git side-effects (the\n * sidecar push, or the library commit+push) happen in the caller *before* this;\n * this function is purely store interaction.\n *\n * The sidecar front-end passes `sidecar` (so `sourcesAdd` carries the sidecar\n * pin); the library front-end omits it (the source repo IS the manifest host).\n * `assetName`, when set, narrows publication to the single candidate of that\n * name. Fatal store states (`sourcesAdd` non-dup failure) surface; sync failures\n * and empty candidate sets `process.exit(1)` with the same messages as before.\n */\nexport async function publishToStore(opts: {\n  sourceUrl: string;\n  ref: string;\n  sidecar?: { url: string; ref: string };\n  manifest: SkPublishManifest;\n  assetName?: string;\n  client: PublisherClient;\n}): Promise<{ published: string[] }> {\n  const { sourceUrl, ref, sidecar, manifest, assetName, client: pub } = opts;\n\n  let sourceId: string;\n  try {\n    const added = await pub.sourcesAdd({\n      url: sourceUrl,\n      ref,\n      ...(sidecar ? { sidecarUrl: sidecar.url, sidecarRef: sidecar.ref } : {}),\n      // Publish under the manifest's declared namespace; the store resolves a\n      // claimed Publisher when it differs from the caller's login, else defaults\n      // to `@<username>`. Omitted when the manifest carries no publisher.\n      ...(manifest.publisher ? { namespace: manifest.publisher } : {}),\n    });\n    sourceId = added.id;\n  } catch (err) {\n    // Only a duplicate-url conflict is recoverable (source already registered);\n    // auth/5xx/network failures must surface, not silently reuse a stale row.\n    if (!isDupSourceError(err)) throw err;\n    const rows = await pub.sourcesList();\n    const found = rows.find((r) => r.url === sourceUrl);\n    if (!found) {\n      throw new Error(\n        `Source ${sourceUrl} looked already-registered but no owned row matched: ` +\n          `${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n    sourceId = found.id;\n  }\n\n  const { jobId } = await pub.sourceSync(sourceId);\n  const job = await pollJob(pub, jobId);\n  if (job.status === \"failed\" || job.status === \"cancelled\") {\n    const failed = (job.items ?? []).filter((i) => i.status === \"failed\");\n    for (const i of failed) logErr(`sync: ${i.label}: ${i.error ?? \"failed\"}`);\n    logErr(`Source sync ${job.status}.`);\n    process.exit(1);\n  }\n  // A still-`running` job means the poll deadline was hit — do NOT proceed on an\n  // unfinished sync (it would read incomplete candidates).\n  if (job.status === \"running\") {\n    logErr(\"Source sync timed out before completing — re-run `publish`, or check the store.\");\n    process.exit(1);\n  }\n\n  let candidates = matchCandidatesToManifest(await pub.sourceCandidates(sourceId), manifest);\n  if (assetName) candidates = candidates.filter((c) => c.name === assetName);\n  if (candidates.length === 0) {\n    logWarn(\"No candidates discovered — check the manifest and the source ref.\");\n    process.exit(1);\n  }\n\n  const published: string[] = [];\n  for (const c of candidates) {\n    try {\n      const preview = await pub.assetPreview(c.id);\n      const res = await pub.assetPublish(c.id, { ref, files: preview.discoveredFiles });\n      // Publish is async — wait for the job so we only report refs that actually\n      // landed, not ones whose import is still in flight or about to fail.\n      if (res.jobId) {\n        const pubJob = await pollJob(pub, res.jobId);\n        if (pubJob.status !== \"succeeded\") {\n          const errs = (pubJob.items ?? [])\n            .filter((i) => i.status === \"failed\")\n            .map((i) => i.error)\n            .filter(Boolean);\n          logWarn(\n            `Publish of ${c.kind}:${c.name} did not succeed (${pubJob.status})` +\n              (errs.length ? `: ${errs.join(\"; \")}` : \"\"),\n          );\n          continue;\n        }\n      }\n      published.push(refFor(c.kind, preview.candidate.publisherNamespace, c.name, c.version));\n    } catch (err) {\n      logWarn(\n        `Failed to publish ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  logOk(`Published ${published.length} asset(s):`);\n  for (const r of published) logInfo(`  ${r}`);\n  return { published };\n}\n"]}
+{"version":3,"sources":["../cli/src/store-publisher.ts","../cli/src/commands/publish-core.ts"],"names":[],"mappings":";;;;AA+FO,SAAS,uBAAA,CACd,MAAA,GAAsB,cAAA,EAAe,EACrC,YAAY,GAAA,EACK;AAGjB,EAAA,MAAM,IAAA,GAAO,OACX,IAAA,EACA,IAAA,KACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,EAAc;AAChC,IAAA,OAAO,UAAA,CAAc,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAM,CAAA;AAAA,EACvE,CAAA;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,IAC3B,UAAA,EAAY,CAAC,IAAA,KAAS,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IACtE,WAAA,EAAa,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,IACzC,UAAA,EAAY,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,KAAA,CAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IACnF,QAAQ,CAAC,KAAA,KAAU,IAAA,CAAK,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAE,CAAA;AAAA,IAC/C,kBAAkB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,gBAAA,EAAmB,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,IACjE,cAAc,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,IACzD,YAAA,EAAc,CAAC,EAAA,EAAI,IAAA,EAAM,WACvB,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,QAAA,CAAA,EAAY;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,GAAI,SAAS,EAAE,MAAA,EAAQ,EAAE,MAAA,EAAQ,GAAA,EAAI,EAAE,GAAI;AAAC,KAC7C,CAAA;AAAA,IACH,cAAA,EAAgB,CAAC,EAAA,KAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,UAAA,CAAA,EAAc,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAC3F,qBAAA,EAAuB,CAAC,EAAA,KACtB,IAAA,CAAK,sBAAsB,kBAAA,CAAmB,EAAE,CAAC,CAAA,aAAA,CAAe;AAAA,GACpE;AACF;;;ACvGO,SAAS,4BAA4B,CAAA,EAGjC;AACT,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,EAAA,CAAG,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IAClC,KAAK,kBAAA;AACH,MAAA,OAAO,GAAG,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA,IACpC;AACE,MAAA,OAAO,GAAG,CAAA,CAAE,GAAA,CAAI,QAAG,CAAC,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA,CAAA;AAAA;AAEvC;AAYA,eAAsB,kBAAA,CACpB,QACA,SAAA,EAC4C;AAC5C,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,MAAM,MAAA,CAAO,qBAAA,CAAsB,SAAS,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB;AACA,EAAA,QAAQ,EAAE,MAAA;AAAQ,IAChB,KAAK,cAAA;AAAA,IACL,KAAK,WAAA;AACH,MAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,IACpB,KAAK,kBAAA;AACH,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EACE,CAAA,CAAA,EAAI,SAAS,CAAA,mDAAA,EACV,CAAA,CAAE,WAAA,GAAc,CAAA,EAAA,EAAK,CAAA,CAAE,WAAW,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,eAAA,EAAkB,EAAE,OAAO,CAAA;AAAA,OAC5E;AAAA,IACF;AACE,MAAA,OAAO,EAAE,IAAI,KAAA,EAAO,OAAA,EAAS,yBAAyB,SAAS,CAAA,QAAA,EAAM,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA;AAEvF;AAaO,SAAS,yBAAA,CACd,YACA,QAAA,EACK;AACL,EAAA,MAAM,SAAS,IAAI,GAAA,CAAA,CAAK,QAAA,CAAS,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,IAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AAChF,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,EAAE,CAAC,CAAA;AACnE;AAGO,SAAS,MAAA,CAAO,IAAA,EAAc,SAAA,EAAmB,IAAA,EAAc,OAAA,EAA0B;AAC9F,EAAA,MAAM,OAAO,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,SAAS,IAAI,IAAI,CAAA,CAAA;AAC1C,EAAA,OAAO,OAAA,GAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,IAAA;AAC1C;AAGO,SAAS,SAAS,GAAA,EAAqB;AAC5C,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAAI,GAAA;AACxE,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GACrC,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,GAC1C,SAAA;AACJ,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA;AAChC;AAOA,eAAsB,QACpB,MAAA,EACA,KAAA,EACA,UAAA,GAAa,IAAA,EACb,YAAY,GAAA,EACmF;AAC/F,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAC9B,EAAA,IAAI,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,OAAO,IAAI,MAAA,KAAW,SAAA,IAAa,IAAA,CAAK,GAAA,KAAQ,QAAA,EAAU;AACxD,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,UAAU,CAAC,CAAA;AAClD,IAAA,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,iBAAiB,GAAA,EAAuB;AACtD,EAAA,MAAM,GAAA,GAAA,CAAO,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,GAAG,WAAA,EAAY;AAC3E,EAAA,OAAO,qEAAA,CAAsE,KAAK,GAAG,CAAA;AACvF;AAcA,eAAsB,eAAe,IAAA,EAOA;AACnC,EAAA,MAAM,EAAE,WAAW,GAAA,EAAK,OAAA,EAAS,UAAU,SAAA,EAAW,MAAA,EAAQ,KAAI,GAAI,IAAA;AAEtE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,UAAA,CAAW;AAAA,MACjC,GAAA,EAAK,SAAA;AAAA,MACL,GAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,UAAA,EAAY,OAAA,CAAQ,KAAK,UAAA,EAAY,OAAA,CAAQ,GAAA,EAAI,GAAI,EAAC;AAAA;AAAA;AAAA;AAAA,MAItE,GAAI,SAAS,SAAA,GAAY,EAAE,WAAW,QAAA,CAAS,SAAA,KAAc;AAAC,KAC/D,CAAA;AACD,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB,SAAS,GAAA,EAAK;AAGZ,IAAA,IAAI,CAAC,gBAAA,CAAiB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,WAAA,EAAY;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,SAAS,CAAA;AAClD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,OAAA,EAAU,SAAS,CAAA,qDAAA,EACd,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OACvD;AAAA,IACF;AACA,IAAA,QAAA,GAAW,KAAA,CAAM,EAAA;AAAA,EACnB;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,GAAA,CAAI,WAAW,QAAQ,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AACpC,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,WAAA,EAAa;AACzD,IAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,KAAA,IAAS,EAAC,EAAG,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,QAAQ,CAAA;AACpE,IAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,MAAA,CAAO,CAAA,MAAA,EAAS,CAAA,CAAE,KAAK,CAAA,EAAA,EAAK,CAAA,CAAE,KAAA,IAAS,QAAQ,CAAA,CAAE,CAAA;AACzE,IAAA,MAAA,CAAO,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACnC,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAGA,EAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,IAAA,MAAA,CAAO,sFAAiF,CAAA;AACxF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,IAAI,aAAa,yBAAA,CAA0B,MAAM,IAAI,gBAAA,CAAiB,QAAQ,GAAG,QAAQ,CAAA;AACzF,EAAA,IAAI,SAAA,eAAwB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,SAAS,CAAA;AACzE,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,wEAAmE,CAAA;AAC3E,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,YAAA,CAAa,EAAE,EAAE,CAAA;AAC3C,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,YAAA,CAAa,CAAA,CAAE,EAAA,EAAI,EAAE,GAAA,EAAK,KAAA,EAAO,OAAA,CAAQ,eAAA,EAAiB,CAAA;AAGhF,MAAA,IAAI,IAAI,KAAA,EAAO;AACb,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,EAAK,IAAI,KAAK,CAAA;AAC3C,QAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,UAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAC,EAC5B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA,CACnC,IAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA,CAClB,OAAO,OAAO,CAAA;AACjB,UAAA,OAAA;AAAA,YACE,cAAc,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,kBAAA,EAAqB,MAAA,CAAO,MAAM,CAAA,CAAA,CAAA,IAC7D,KAAK,MAAA,GAAS,CAAA,EAAA,EAAK,KAAK,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AAAA,WAC5C;AACA,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,SAAA,CAAU,IAAA,CAAK,MAAA,CAAO,CAAA,CAAE,IAAA,EAAM,OAAA,CAAQ,SAAA,CAAU,kBAAA,EAAoB,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAC,CAAA;AAAA,IACxF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA;AAAA,QACE,CAAA,kBAAA,EAAqB,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,OAC5F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,CAAA,UAAA,EAAa,SAAA,CAAU,MAAM,CAAA,UAAA,CAAY,CAAA;AAC/C,EAAA,KAAA,MAAW,CAAA,IAAK,SAAA,EAAW,OAAA,CAAQ,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAC3C,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB","file":"chunk-WBRD2T5J.js","sourcesContent":["/**\n * Typed REST client for the AI Asset Store **publisher** surface — the\n * curator-publish flow (`skaile source manifest publish` / `yank`). Thin\n * wrappers over {@link storeFetch}; every method maps 1:1 to an `/api/v1/…`\n * endpoint. The {@link PublisherClient} interface is injectable so the\n * orchestration in `commands/source-manifest-publish.ts` can be unit-tested\n * against a fake without a live store.\n *\n * @docLink cli/dev-guide#store-publisher\n */\n\nimport { getStoreConfig, getStoreToken, type StoreConfig, storeFetch } from \"./store-client.ts\";\n\n/**\n * The publisher REST surface used by the curator-publish flow. Kept minimal —\n * only the endpoints `runPublish` / `runYank` actually call. Response shapes\n * are narrowed to the fields the orchestration reads (the server returns more).\n */\nexport interface PublisherClient {\n  /**\n   * Identity of the caller. `username` is the Keycloak login (personal-tier\n   * namespace); `githubLogin` is the verified GitHub handle when connected —\n   * the namespace to publish under when it differs from the login.\n   */\n  me(): Promise<{ username: string; githubLogin?: string | null }>;\n  /** Register (or re-register) a source; returns the created/existing row id. */\n  sourcesAdd(body: {\n    url: string;\n    ref: string;\n    sidecarUrl?: string;\n    sidecarRef?: string;\n    /**\n     * Target publisher namespace (the manifest's `publisher`). When it differs\n     * from the caller's login username, the store resolves the CLAIMED Publisher\n     * for it (the store must already have the claim). Omitted → the store\n     * defaults to `@<username>` (personal).\n     */\n    namespace?: string;\n  }): Promise<{ id: string }>;\n  /** List sources — used to recover an id when `sourcesAdd` rejects a dup url. */\n  sourcesList(): Promise<Array<{ id: string; url: string }>>;\n  /** Kick off a source sync; returns the async job id to poll. */\n  sourceSync(id: string): Promise<{ jobId: string }>;\n  /** Poll a job's terminal status + per-item results. */\n  jobGet(\n    jobId: string,\n  ): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }>;\n  /** Discovered publishable candidates for a synced source. */\n  sourceCandidates(id: string): Promise<\n    Array<{\n      id: string;\n      name: string;\n      version: string;\n      kind: string;\n      published: boolean;\n      assetRoot: string;\n    }>\n  >;\n  /** Per-asset preview — the discovered file set + resolved candidate metadata. */\n  assetPreview(id: string): Promise<{\n    discoveredFiles: string[];\n    candidate: { name: string; version: string; kind: string; publisherNamespace: string };\n  }>;\n  /**\n   * Publish one asset. `dryRun` returns the would-be `{ manifest }` without\n   * launching a job; the normal path returns `{ jobId }`.\n   */\n  assetPublish(\n    id: string,\n    body: { ref: string; files: string[] },\n    dryRun?: boolean,\n  ): Promise<{ jobId?: string; manifest?: unknown }>;\n  /** Retract a published asset. Response body is ignored. */\n  assetUnpublish(id: string): Promise<unknown>;\n  /**\n   * Read-only \"can I publish under `@<ns>` right now, and if not, what's the\n   * path?\" probe. Backs the `publish --dry-run` namespace status line; its\n   * `message` is store-authored and meant to be surfaced verbatim.\n   */\n  namespaceAvailability(ns: string): Promise<{\n    namespace: string;\n    status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n    claimMethod?: string;\n    message: string;\n  }>;\n}\n\n/**\n * Construct the real HTTP-backed {@link PublisherClient}. Every call carries a\n * longer timeout than the default store client because publish/sync trigger\n * server-side clone work.\n *\n * @param config - Store connection config; defaults to {@link getStoreConfig}.\n * @param timeoutMs - Per-request abort timeout (default 20s).\n */\nexport function makeHttpPublisherClient(\n  config: StoreConfig = getStoreConfig(),\n  timeoutMs = 20_000,\n): PublisherClient {\n  // Acquire a fresh Keycloak token per call (device-flow session in\n  // ~/.skaile/auth.json, refreshed on demand) rather than a static config.jwt.\n  const call = async <T>(\n    path: string,\n    opts?: { method?: string; body?: unknown; params?: Record<string, string> },\n  ): Promise<T> => {\n    const jwt = await getStoreToken();\n    return storeFetch<T>({ ...config, jwt }, path, { timeoutMs, ...opts });\n  };\n  return {\n    me: () => call(\"/api/v1/me\"),\n    sourcesAdd: (body) => call(\"/api/v1/sources\", { method: \"POST\", body }),\n    sourcesList: () => call(\"/api/v1/sources\"),\n    sourceSync: (id) => call(`/api/v1/sources/${id}/sync`, { method: \"POST\", body: {} }),\n    jobGet: (jobId) => call(`/api/v1/jobs/${jobId}`),\n    sourceCandidates: (id) => call(`/api/v1/sources/${id}/candidates`),\n    assetPreview: (id) => call(`/api/v1/assets/${id}/preview`),\n    assetPublish: (id, body, dryRun) =>\n      call(`/api/v1/assets/${id}/publish`, {\n        method: \"POST\",\n        body,\n        ...(dryRun ? { params: { dryRun: \"1\" } } : {}),\n      }),\n    assetUnpublish: (id) => call(`/api/v1/assets/${id}/unpublish`, { method: \"POST\", body: {} }),\n    namespaceAvailability: (ns) =>\n      call(`/api/v1/namespaces/${encodeURIComponent(ns)}/availability`),\n  };\n}\n","/**\n * Shared store-interaction core for the two publish front-ends — the curator\n * sidecar flow (`source manifest publish`) and the first-party library flow\n * (`library publish`). Both differ only in their git side-effects + how they\n * resolve the source repo; the store orchestration below (register → sync →\n * candidates → per-asset preview+publish) is identical.\n *\n * The store REST surface is reached through the injectable {@link PublisherClient}\n * so the orchestration stays unit/integration-testable without a live store.\n *\n * @docLink cli/commands/source#manifest-publish\n */\n\nimport type { SkPublishManifest } from \"@skaile/workspaces/core\";\nimport { logErr, logInfo, logOk, logWarn, S } from \"../helpers.ts\";\nimport type { PublisherClient } from \"../store-publisher.ts\";\n\n/**\n * One-line rendering of a namespace-availability probe for a `--dry-run` plan.\n * The `message` is store-authored (identical to what a real publish would echo)\n * — we only prepend a status glyph so the reader sees green/amber/red at a\n * glance without the CLI re-deriving any authorization logic.\n */\nexport function formatNamespaceAvailability(a: {\n  status: \"owned-by-you\" | \"claimable-by-you\" | \"reserved\" | \"available\";\n  message: string;\n}): string {\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return `${S.ok(\"✓\")} ${a.message}`;\n    case \"claimable-by-you\":\n      return `${S.warn(\"!\")} ${a.message}`;\n    default:\n      return `${S.err(\"✗\")} ${a.message}`;\n  }\n}\n\n/**\n * Preflight the target namespace against the store's availability probe BEFORE a\n * publish does any irreversible work (a public git push). Returns `{ ok: false }`\n * with a guided message for `reserved` (not yours) and `claimable-by-you` (must\n * claim first) — the two states a real publish would reject — so the caller can\n * abort with actionable guidance instead of a raw 422 after pushing bytes.\n *\n * The probe is advisory: any failure (offline, older store) returns `{ ok: true }`\n * so the store stays the authority and a valid publish is never blocked.\n */\nexport async function preflightNamespace(\n  client: PublisherClient,\n  namespace: string,\n): Promise<{ ok: boolean; message?: string }> {\n  let a: Awaited<ReturnType<PublisherClient[\"namespaceAvailability\"]>>;\n  try {\n    a = await client.namespaceAvailability(namespace);\n  } catch {\n    return { ok: true };\n  }\n  switch (a.status) {\n    case \"owned-by-you\":\n    case \"available\":\n      return { ok: true };\n    case \"claimable-by-you\":\n      return {\n        ok: false,\n        message:\n          `@${namespace} isn't yours yet — claim it in the store first` +\n          `${a.claimMethod ? ` (${a.claimMethod})` : \"\"}, then re-run. ${a.message}`,\n      };\n    default: // reserved, or any unrecognized future status (fail safe → block)\n      return { ok: false, message: `Cannot publish under @${namespace} — ${a.message}` };\n  }\n}\n\n/** One candidate row shape the matcher operates on (kind + name are the key). */\ninterface CandidateLike {\n  kind: string;\n  name: string;\n}\n\n/**\n * Keep only candidates whose `(kind, name)` pair is declared in the manifest.\n * The backend may merge extra assets from the base repo into the candidate\n * list; a publish only touches what the manifest curated/declared.\n */\nexport function matchCandidatesToManifest<T extends CandidateLike>(\n  candidates: T[],\n  manifest: SkPublishManifest,\n): T[] {\n  const wanted = new Set((manifest.assets ?? []).map((a) => `${a.kind}:${a.name}`));\n  return candidates.filter((c) => wanted.has(`${c.kind}:${c.name}`));\n}\n\n/** A canonical ref string `kind:@publisher/name[#version]` for reporting. */\nexport function refFor(kind: string, publisher: string, name: string, version?: string): string {\n  const base = `${kind}:@${publisher}/${name}`;\n  return version ? `${base}#${version}` : base;\n}\n\n/** The bare asset name from a `kind:@publisher/name#version` ref or a plain name. */\nexport function bareName(ref: string): string {\n  const afterKind = ref.includes(\":\") ? ref.slice(ref.indexOf(\":\") + 1) : ref;\n  const afterScope = afterKind.includes(\"/\")\n    ? afterKind.slice(afterKind.indexOf(\"/\") + 1)\n    : afterKind;\n  return afterScope.split(\"#\")[0];\n}\n\n/**\n * Poll a job until it leaves `running` or the deadline passes. Returns the last\n * observed state — the caller MUST treat a still-`running` result as a timeout\n * (not success), since it means the deadline was hit before the job finished.\n */\nexport async function pollJob(\n  client: PublisherClient,\n  jobId: string,\n  intervalMs = 1_500,\n  timeoutMs = 60_000,\n): Promise<{ status: string; items?: Array<{ label: string; status: string; error?: string }> }> {\n  const deadline = Date.now() + timeoutMs;\n  let job = await client.jobGet(jobId);\n  while (job.status === \"running\" && Date.now() < deadline) {\n    await new Promise((r) => setTimeout(r, intervalMs));\n    job = await client.jobGet(jobId);\n  }\n  return job;\n}\n\n/**\n * True when a `sourcesAdd` rejection is a duplicate-URL conflict (the source is\n * already registered) — the only error the publish flow recovers from by looking\n * the existing row up. Every other failure (auth, 5xx, network) must propagate.\n */\nexport function isDupSourceError(err: unknown): boolean {\n  const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();\n  return /\\b409\\b|conflict|duplicate|already exists|already registered|unique/.test(msg);\n}\n\n/**\n * Register + sync the source, then publish its curated/declared candidates —\n * the store-side steps shared by both publish front-ends. Git side-effects (the\n * sidecar push, or the library commit+push) happen in the caller *before* this;\n * this function is purely store interaction.\n *\n * The sidecar front-end passes `sidecar` (so `sourcesAdd` carries the sidecar\n * pin); the library front-end omits it (the source repo IS the manifest host).\n * `assetName`, when set, narrows publication to the single candidate of that\n * name. Fatal store states (`sourcesAdd` non-dup failure) surface; sync failures\n * and empty candidate sets `process.exit(1)` with the same messages as before.\n */\nexport async function publishToStore(opts: {\n  sourceUrl: string;\n  ref: string;\n  sidecar?: { url: string; ref: string };\n  manifest: SkPublishManifest;\n  assetName?: string;\n  client: PublisherClient;\n}): Promise<{ published: string[] }> {\n  const { sourceUrl, ref, sidecar, manifest, assetName, client: pub } = opts;\n\n  let sourceId: string;\n  try {\n    const added = await pub.sourcesAdd({\n      url: sourceUrl,\n      ref,\n      ...(sidecar ? { sidecarUrl: sidecar.url, sidecarRef: sidecar.ref } : {}),\n      // Publish under the manifest's declared namespace; the store resolves a\n      // claimed Publisher when it differs from the caller's login, else defaults\n      // to `@<username>`. Omitted when the manifest carries no publisher.\n      ...(manifest.publisher ? { namespace: manifest.publisher } : {}),\n    });\n    sourceId = added.id;\n  } catch (err) {\n    // Only a duplicate-url conflict is recoverable (source already registered);\n    // auth/5xx/network failures must surface, not silently reuse a stale row.\n    if (!isDupSourceError(err)) throw err;\n    const rows = await pub.sourcesList();\n    const found = rows.find((r) => r.url === sourceUrl);\n    if (!found) {\n      throw new Error(\n        `Source ${sourceUrl} looked already-registered but no owned row matched: ` +\n          `${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n    sourceId = found.id;\n  }\n\n  const { jobId } = await pub.sourceSync(sourceId);\n  const job = await pollJob(pub, jobId);\n  if (job.status === \"failed\" || job.status === \"cancelled\") {\n    const failed = (job.items ?? []).filter((i) => i.status === \"failed\");\n    for (const i of failed) logErr(`sync: ${i.label}: ${i.error ?? \"failed\"}`);\n    logErr(`Source sync ${job.status}.`);\n    process.exit(1);\n  }\n  // A still-`running` job means the poll deadline was hit — do NOT proceed on an\n  // unfinished sync (it would read incomplete candidates).\n  if (job.status === \"running\") {\n    logErr(\"Source sync timed out before completing — re-run `publish`, or check the store.\");\n    process.exit(1);\n  }\n\n  let candidates = matchCandidatesToManifest(await pub.sourceCandidates(sourceId), manifest);\n  if (assetName) candidates = candidates.filter((c) => c.name === assetName);\n  if (candidates.length === 0) {\n    logWarn(\"No candidates discovered — check the manifest and the source ref.\");\n    process.exit(1);\n  }\n\n  const published: string[] = [];\n  for (const c of candidates) {\n    try {\n      const preview = await pub.assetPreview(c.id);\n      const res = await pub.assetPublish(c.id, { ref, files: preview.discoveredFiles });\n      // Publish is async — wait for the job so we only report refs that actually\n      // landed, not ones whose import is still in flight or about to fail.\n      if (res.jobId) {\n        const pubJob = await pollJob(pub, res.jobId);\n        if (pubJob.status !== \"succeeded\") {\n          const errs = (pubJob.items ?? [])\n            .filter((i) => i.status === \"failed\")\n            .map((i) => i.error)\n            .filter(Boolean);\n          logWarn(\n            `Publish of ${c.kind}:${c.name} did not succeed (${pubJob.status})` +\n              (errs.length ? `: ${errs.join(\"; \")}` : \"\"),\n          );\n          continue;\n        }\n      }\n      published.push(refFor(c.kind, preview.candidate.publisherNamespace, c.name, c.version));\n    } catch (err) {\n      logWarn(\n        `Failed to publish ${c.kind}:${c.name}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  logOk(`Published ${published.length} asset(s):`);\n  for (const r of published) logInfo(`  ${r}`);\n  return { published };\n}\n"]}

package/dist/{chunk-N5XNEKHC.js → chunk-XZO4TMAQ.js}

@@ -1,24 +1,24 @@
-import { WorkspacePlugin } from './chunk-OPSKLUB4.js';
-import { buildWorkspaceToolDefs } from './chunk-5FMWNSAQ.js';
+import { WorkspacePlugin } from './chunk-R2RFFXK7.js';
+import { buildWorkspaceToolDefs } from './chunk-HMUFI3L5.js';
 import { findAiAssetsRoot } from './chunk-7IH3RKKK.js';
 import { WebSocketServerTransport } from './chunk-73ZXUUL6.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-PE3A6FFW.js';
-import { resolveFlowPath } from './chunk-SY2HSULI.js';
+import { resolveFlowPath } from './chunk-3GOU3VEH.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-Q6NDQ6BH.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-ZDSZGV5F.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-IBUY53DN.js';
 import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-MC2MF4U5.js';
-import { EventNormalizer } from './chunk-XBMCUMZT.js';
+import { EventNormalizer } from './chunk-IN466NSZ.js';
 import { probeResumeTranscript, transcriptStoreForRuntime } from './chunk-6S5KL76M.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
-import { dispatchCapability } from './chunk-RLACUE4X.js';
+import { dispatchCapability } from './chunk-D3UARV3Z.js';
 import { classifyClaudeSdkError } from './chunk-BGY4KTU6.js';
 import { agentExecRequested } from './chunk-YROR332M.js';
-import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-RTD5KAM4.js';
+import { toAgentEffort, createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS, AgentDriver } from './chunk-IRGI7Q62.js';
 import { loadFlow } from './chunk-KTCMBEEB.js';
 import { parseFlowDefinition } from './chunk-ALLCAFHQ.js';
 import { renderStimulusPrompt } from './chunk-RQLL7L72.js';
-import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-S5A5MVJN.js';
+import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-GRBB4CQL.js';
 import { resolveSettings, loadProviderRegistry } from './chunk-UWU572Q6.js';
 import { resolveRuntimeAssets } from './chunk-5RHPNNWP.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
@@ -2715,7 +2715,11 @@ async function createAgentSession(config) {
   ]);
   logAssembledSystemPrompt(systemPrompt, sessionLog);
   const thinking = config.thinking ?? wsConfig.agent_config?.default?.thinking;
-  const effort = config.effort ?? (managed ? void 0 : wsConfig.agent_config?.default?.effort);
+  const wsEffort = managed ? void 0 : wsConfig.agent_config?.default?.effort;
+  const effort = config.effort ?? toAgentEffort(wsEffort);
+  if (config.effort === void 0 && wsEffort !== void 0 && effort === void 0) {
+    sessionLog.warn("ignoring unknown effort", { effort: wsEffort, source: "skaile.yaml" });
+  }
   const maxTurns = maxTurnsOverride ?? manifest?.runtime?.max_turns;
   let driver;
   try {
@@ -4501,6 +4505,55 @@ async function handleCredentialRotatedSignal(deps) {
   }
 }
 
+// runner/src/reconfigure-handler.ts
+function driverAppliesReconfigure(driver) {
+  return typeof driver.reconfigure === "function" && driver.reconfigure !== AgentDriver.prototype.reconfigure;
+}
+function applyReconfigurePatch(config, patch) {
+  if (patch.model !== void 0) {
+    config.model = patch.model;
+    if (config.modelRef !== void 0) config.modelRef = patch.model;
+  }
+  if (patch.thinking !== void 0) config.thinking = patch.thinking;
+  if (patch.effort !== void 0) config.effort = patch.effort;
+}
+function carryLiveReconfigure(config, patch, wireAgentConfigChanged) {
+  if (wireAgentConfigChanged || !patch) return void 0;
+  applyReconfigurePatch(config, patch);
+  return patch;
+}
+function buildReconfigureHandler(deps) {
+  const { getDriver, rememberPatch, log } = deps;
+  return async (patch) => {
+    const fields = Object.keys(patch).join(", ");
+    const driver = getDriver();
+    if (!driver) {
+      log(`[reconfigure] no driver is running; ${fields} not applied`);
+      return {
+        ok: false,
+        code: "no_driver",
+        message: "No agent driver is running; the change applies when the session next starts."
+      };
+    }
+    const driverId = driver.driverInfo?.id ?? "unknown";
+    if (!driverAppliesReconfigure(driver)) {
+      log(
+        `[reconfigure] driver ${driverId} cannot apply a live reconfigure; ${fields} not applied`
+      );
+      return {
+        ok: false,
+        code: "not_supported",
+        message: `The ${driverId} driver cannot change ${fields} live; the change applies when the session next starts.`
+      };
+    }
+    driver.reconfigure(patch);
+    rememberPatch(patch);
+    const model = driver.getModel() ?? null;
+    log(`[reconfigure] driver ${driverId} took ${fields} (model=${model ?? "(default)"})`);
+    return { ok: true, model };
+  };
+}
+
 // runner/src/runtime-session-emit.ts
 function planRuntimeSessionEmit(input) {
   const { driverSessionId, model, capabilitySignature, lastEmitted } = input;
@@ -4898,7 +4951,9 @@ function awaitAgentEnd(driver, prompt, timeoutMs) {
 async function routeReply(deps) {
   const current = deps.getDriver();
   if (current.hasPendingQuestion()) {
-    return current.answerQuestion(deps.answer, deps.question, deps.requestId) ? "answered" : "fresh-turn";
+    if (!current.answerQuestion(deps.answer, deps.question, deps.requestId)) return "fresh-turn";
+    deps.onAnswered?.();
+    return "answered";
   }
   await deps.awaitSwap();
   return "fresh-turn";
@@ -5003,6 +5058,68 @@ var EventGapBuffer = class _EventGapBuffer {
   }
 };
 
+// runner/src/compaction/context-window.ts
+var DEFAULT_CONTEXT_WINDOW = 2e5;
+var ONE_MILLION_CONTEXT_WINDOW = 1e6;
+var ONE_MILLION_ALIAS_PATTERN = /\[1m\]|-1m$/i;
+var ContextWindowResolver = class {
+  constructor(opts = {}) {
+    this.opts = opts;
+  }
+  opts;
+  key = null;
+  lastReported = null;
+  contextReport = null;
+  last = null;
+  /** Whether any non-assumed window was ever resolved; the first one is not a change. */
+  everKnown = false;
+  resolve(driver) {
+    const model = driver.getModel?.() || null;
+    this.syncKey(model);
+    const resolved = this.pick(driver.getContextWindow(), model);
+    const firstKnown = !this.everKnown && this.last?.source === "assumed";
+    if (this.last && !firstKnown && this.last.window !== resolved.window) {
+      this.opts.warn?.(
+        `[context-window] window changed ${this.last.window} (${this.last.source}) -> ${resolved.window} (${resolved.source}), model=${model ?? "unknown"}, seat=${this.opts.seat?.() ?? "unknown"}`
+      );
+    }
+    this.last = resolved;
+    if (resolved.source !== "assumed") this.everKnown = true;
+    return resolved;
+  }
+  /** Record the window a fresh harness measurement gave (claude-sdk: `/context` `maxTokens`). */
+  noteContextReport(driver, window) {
+    if (!window || window <= 0) return;
+    this.syncKey(driver.getModel?.() || null);
+    this.contextReport = window;
+  }
+  pick(driverWindow, model) {
+    const reported = driverWindow && driverWindow > 0 ? driverWindow : null;
+    if (model && ONE_MILLION_ALIAS_PATTERN.test(model)) {
+      if (reported !== null && reported >= ONE_MILLION_CONTEXT_WINDOW) {
+        this.lastReported = reported;
+        return { window: reported, source: "reported" };
+      }
+      return { window: ONE_MILLION_CONTEXT_WINDOW, source: "alias" };
+    }
+    if (reported !== null) {
+      this.lastReported = reported;
+      return { window: reported, source: "reported" };
+    }
+    if (this.lastReported !== null) return { window: this.lastReported, source: "last-known" };
+    if (this.contextReport !== null)
+      return { window: this.contextReport, source: "context-report" };
+    return { window: DEFAULT_CONTEXT_WINDOW, source: "assumed" };
+  }
+  syncKey(model) {
+    const key = `${model ?? ""}\0${this.opts.seat?.() ?? ""}`;
+    if (key === this.key) return;
+    this.key = key;
+    this.lastReported = null;
+    this.contextReport = null;
+  }
+};
+
 // runner/src/compaction/prompt.ts
 var DEFAULT_COMPACTION_PROMPT = `You are being asked to compact this conversation into a structured summary.
 This summary will replace the full conversation history when the session
@@ -5128,9 +5245,6 @@ var TokenThresholdStrategy = class {
 // runner/src/compaction/orchestrator.ts
 var MIN_SUMMARY_CHARS = 200;
 var MAX_COMPRESSION_RATIO = 0.9;
-var DEFAULT_CONTEXT_WINDOW = 2e5;
-var ONE_MILLION_CONTEXT_WINDOW = 1e6;
-var ONE_MILLION_ALIAS_PATTERN = /\[1m\]|-1m$/i;
 var DEFAULT_COMPACTION_TIMEOUT_MS = 10 * 6e4;
 function compactionTimeoutMs() {
   const raw = Number(process.env.SKAILE_COMPACTION_TIMEOUT_MS);
@@ -5170,18 +5284,6 @@ function contextTokens(usage) {
   const cacheCreation = usage?.cacheCreationTokens ?? 0;
   return Math.max(input, cacheRead) + cacheCreation;
 }
-function resolveContextWindow(driverWindow, model) {
-  if (model && ONE_MILLION_ALIAS_PATTERN.test(model)) {
-    return Math.max(driverWindow ?? 0, ONE_MILLION_CONTEXT_WINDOW);
-  }
-  return driverWindow || DEFAULT_CONTEXT_WINDOW;
-}
-function reportedContextWindow(driverWindow, model) {
-  if (model && ONE_MILLION_ALIAS_PATTERN.test(model)) {
-    return Math.max(driverWindow ?? 0, ONE_MILLION_CONTEXT_WINDOW);
-  }
-  return driverWindow && driverWindow > 0 ? driverWindow : null;
-}
 function detectRateLimitInSummary(text2) {
   if (text2.length > RATE_LIMIT_TEXT_MAX_CHARS) return false;
   return RATE_LIMIT_TEXT_PATTERNS.some((p) => p.test(text2));
@@ -5200,6 +5302,7 @@ var CompactionOrchestrator = class {
   strategy;
   config;
   opts;
+  contextWindows;
   _isCompacting = false;
   /** Whether {@link CompactionOrchestratorOptions.onCompactionStart} has fired for the current call. */
   _startFired = false;
@@ -5220,6 +5323,11 @@ var CompactionOrchestrator = class {
     this.opts = opts;
     this.config = { ...COMPACTION_DEFAULTS, ...opts.config };
     this.strategy = new TokenThresholdStrategy(this.config);
+    this.contextWindows = opts.contextWindows ?? new ContextWindowResolver({ warn: (line) => opts.onLog?.(line) });
+  }
+  /** The window the fill is measured against, and where it came from. */
+  resolveContextWindow() {
+    return this.contextWindows.resolve(this.driver);
   }
   /**
    * How full the context window is. Prefers the driver's per-call figure; the
@@ -5234,14 +5342,12 @@ var CompactionOrchestrator = class {
   }
   /**
    * The context fill, in tokens, at which auto-compaction triggers — the same
-   * window and tier {@link shouldCompact} uses. `null` when compaction is off.
+   * tier {@link shouldCompact} uses. Pass the window a caller already resolved
+   * so the point it reports is computed from exactly that window. `null` when
+   * compaction is off.
    */
-  compactAtTokens() {
+  compactAtTokens(contextWindow = this.resolveContextWindow().window) {
     if (!this.config.enabled) return null;
-    const contextWindow = resolveContextWindow(
-      this.driver.getContextWindow(),
-      this.driver.getModel() ?? null
-    );
     return Math.round(
       contextWindow * resolveCompactionThresholdPercent(contextWindow, this.config) / 100
     );
@@ -5253,10 +5359,7 @@ var CompactionOrchestrator = class {
   shouldCompact() {
     if (!this.config.enabled) return false;
     const usage = this.driver.getTokenUsage();
-    const contextWindow = resolveContextWindow(
-      this.driver.getContextWindow(),
-      this.driver.getModel() ?? null
-    );
+    const contextWindow = this.resolveContextWindow().window;
     const estimatedTokens = this.contextFill(usage);
     if (estimatedTokens <= 0) return false;
     return this.strategy.shouldCompact({
@@ -6066,15 +6169,16 @@ function composeContextUsageSnapshot(input) {
     used = sumBuckets(buckets);
     totalFidelity = used > 0 ? "estimated" : "unknown";
   }
-  const window = input.contextWindow ?? (fresh ? report.contextWindow ?? null : null);
-  if (window !== null && window > 0) {
-    const threshold = input.autoCompactAt !== null ? Math.min(input.autoCompactAt, window) : window;
+  const window = input.contextWindow !== null && input.contextWindow > 0 ? input.contextWindow : null;
+  const autoCompactAt = window !== null ? input.autoCompactAt : null;
+  if (window !== null) {
+    const threshold = autoCompactAt !== null ? Math.min(autoCompactAt, window) : window;
     buckets.set("free", {
       id: "free",
       tokens: Math.max(0, threshold - used),
       fidelity: totalFidelity
     });
-    if (input.autoCompactAt !== null) {
+    if (autoCompactAt !== null) {
       buckets.set("compaction-buffer", {
         id: "compaction-buffer",
         tokens: Math.max(0, window - Math.max(used, threshold)),
@@ -6085,10 +6189,11 @@ function composeContextUsageSnapshot(input) {
   return {
     provider: input.provider,
     model: input.model,
-    contextWindow: window !== null && window > 0 ? window : null,
+    contextWindow: window,
+    ...window !== null && input.contextWindowSource ? { contextWindowSource: input.contextWindowSource } : {},
     usedTokens: used,
     totalFidelity,
-    autoCompactAt: input.autoCompactAt,
+    autoCompactAt,
     buckets: BUCKET_ORDER.flatMap((id) => {
       const bucket = buckets.get(id);
       return bucket ? [bucket] : [];
@@ -6260,6 +6365,7 @@ var ContextUsageCollector = class {
   constructor(deps) {
     this.deps = deps;
     this.estimator = deps.estimator ?? defaultTokenEstimator;
+    this.contextWindows = deps.contextWindows ?? new ContextWindowResolver();
     this.tracker = new TranscriptTokenTracker(this.estimator);
   }
   deps;
@@ -6269,6 +6375,7 @@ var ContextUsageCollector = class {
   inflight = /* @__PURE__ */ new Map();
   skills = null;
   capabilityMemo = null;
+  contextWindows;
   /** A driver was (re)built; everything measured or cached about the old one is void. */
   onDriverBuilt(opts) {
     this.tracker.reset(opts);
@@ -6328,14 +6435,20 @@ var ContextUsageCollector = class {
     const usage = driver?.getTokenUsage() ?? null;
     const perCall = driver?.getContextTokens?.() ?? null;
     const fill = opts.trigger === "compaction" ? null : perCall ?? (usage ? contextTokens(usage) : null);
+    let window = null;
+    if (driver) {
+      if (reportFresh) this.contextWindows.noteContextReport(driver, report?.contextWindow);
+      window = this.contextWindows.resolve(driver);
+    }
     const snapshot = composeContextUsageSnapshot({
       provider: this.deps.provider(),
       model,
       trigger: opts.trigger,
       capturedAt: (this.deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
       contextTokens: fill,
-      contextWindow: driver ? reportedContextWindow(driver.getContextWindow(), model || null) : null,
-      autoCompactAt: this.deps.autoCompactAt(),
+      contextWindow: window?.window ?? null,
+      ...window ? { contextWindowSource: window.source } : {},
+      autoCompactAt: window ? this.deps.autoCompactAt(window.window) : null,
       systemPromptSections: this.deps.systemPromptSections(),
       report,
       reportFresh,
@@ -6793,6 +6906,13 @@ var setStateInput = z7.strictObject({
 var lifecycleInput = z7.strictObject({
   phase: z7.enum(["hibernate", "close", "compact"])
 });
+var reconfigureInputSchema = z7.strictObject({
+  model: z7.string().trim().min(1).optional(),
+  thinking: z7.enum(["adaptive", "enabled", "disabled"]).optional(),
+  effort: z7.enum(["low", "medium", "high", "xhigh", "max"]).optional()
+}).refine((p) => p.model !== void 0 || p.thinking !== void 0 || p.effort !== void 0, {
+  message: "a reconfigure names at least one of model, thinking, effort"
+});
 var VALID_LOG_STORE_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 function buildRunnerCapabilities(handlers) {
   return [
@@ -6967,6 +7087,24 @@ function buildRunnerCapabilities(handlers) {
         }
         return handlers.lifecycle(input);
       }
+    }),
+    defineCapability({
+      name: "runner.reconfigure",
+      displayName: "Reconfigure agent",
+      description: "Change the running agent's model, thinking mode or effort without a restart. Applies from the next turn; a turn in progress finishes on the old settings. Answers no_driver or not_supported when the change cannot apply live.",
+      side: "agent",
+      origin: RUNNER_CAP_ORIGIN,
+      audience: ["runtime"],
+      kind: "effect",
+      input: reconfigureInputSchema,
+      handler: async (input) => {
+        if (!handlers.reconfigure) return notImplemented("runner.reconfigure");
+        const patch = {};
+        if (input.model !== void 0) patch.model = input.model;
+        if (input.thinking !== void 0) patch.thinking = input.thinking;
+        if (input.effort !== void 0) patch.effort = input.effort;
+        return handlers.reconfigure(patch);
+      }
     })
   ];
 }
@@ -6987,6 +7125,8 @@ function wireSessionCapabilities(deps) {
     detachSkillInstance,
     registerLiveAttachedMcp,
     scheduleDriverRestartForToolChanges,
+    getDriver,
+    rememberReconfigure,
     log
   } = deps;
   capabilityRegistry.setRemoteInvoker(remoteCapabilityInvoker);
@@ -7044,6 +7184,11 @@ function wireSessionCapabilities(deps) {
       getCompactionOrchestrator,
       getResourceManager,
       log
+    }),
+    reconfigure: buildReconfigureHandler({
+      getDriver,
+      rememberPatch: rememberReconfigure,
+      log
     })
   });
   for (const cap of runnerCaps) {
@@ -8217,6 +8362,13 @@ async function startAgentServer(opts) {
   wsConfig.secrets?.timeoutMs ?? 3e4;
   const diskProfileHasAgentSettings = (p) => !!p && !!(p.driver || p.model || p.thinking || p.effort);
   function buildSessionConfig(secretProvider2, credentialEnv, fallbackConnectorDeclarations) {
+    const wireEffort = toAgentEffort(wireAgentConfig?.effort);
+    if (wireAgentConfig?.effort && !wireEffort) {
+      serverLog.warn("ignoring unknown effort", {
+        effort: wireAgentConfig.effort,
+        source: "agentConfig"
+      });
+    }
     return {
       projectDir: opts.projectDir,
       agentDir,
@@ -8243,7 +8395,7 @@ async function startAgentServer(opts) {
       // entry references. Omitted entirely when nothing resolved.
       ...credentialEnv && Object.keys(credentialEnv).length > 0 ? { credentialEnv } : {},
       ...wireAgentConfig?.thinking ? { thinking: wireAgentConfig.thinking } : {},
-      ...wireAgentConfig?.effort ? { effort: wireAgentConfig.effort } : {},
+      ...wireEffort ? { effort: wireEffort } : {},
       // Every claude-sdk driver carries the flow tools, so a run can start mid-turn.
       extraInProcessMcpServers: buildPermanentFlowMcpServers,
       // Protocol v2 `<CAPABILITIES>` block — joins each registered capability's
@@ -8332,6 +8484,10 @@ async function startAgentServer(opts) {
   });
   let sessionConfig;
   let agentSession;
+  const contextWindows = new ContextWindowResolver({
+    seat: () => aiProviderConfigId,
+    warn: (line) => serverLog.warn(line)
+  });
   const contextUsage = new ContextUsageCollector({
     driver: () => driver,
     provider: () => agentSession?.driverType ?? "unknown",
@@ -8340,7 +8496,8 @@ async function startAgentServer(opts) {
       (cap) => (cap.audience ?? ["llm", "user"]).includes("llm") && !cap.name.startsWith("host.") && !cap.name.startsWith("runner.")
     ),
     readSkills: () => readSkillListings(join(opts.projectDir, activeSkillsDir())),
-    autoCompactAt: () => compactionOrchestrator?.compactAtTokens() ?? null
+    autoCompactAt: (window) => compactionOrchestrator?.compactAtTokens(window) ?? null,
+    contextWindows
   });
   function noteAgentSessionBuilt(resumeSessionId2) {
     contextUsage.onDriverBuilt({ resuming: !!resumeSessionId2 || !!managedCodex });
@@ -8355,6 +8512,7 @@ async function startAgentServer(opts) {
   let managedInitFingerprint;
   let managedInitComplete = false;
   let appliedWireAgentConfigKey;
+  let liveReconfigurePatch;
   let wireConnectorDeclarationsApplied = false;
   const stagedSkillDirs = /* @__PURE__ */ new Map();
   const withSkillFsLock = createSerialLock();
@@ -8608,6 +8766,7 @@ async function startAgentServer(opts) {
     compactionOrchestrator = new CompactionOrchestrator({
       driver,
       config: compactionConfig,
+      contextWindows,
       onCompactionStart: (trigger) => {
         compacting = true;
         gateHold = compactionGate.begin();
@@ -9098,6 +9257,12 @@ async function startAgentServer(opts) {
       credentialEnv,
       fallbackConnectorDeclarations
     );
+    const incomingWireAgentConfigKey = wireAgentConfig ? JSON.stringify(wireAgentConfig) : void 0;
+    liveReconfigurePatch = carryLiveReconfigure(
+      sessionConfig,
+      liveReconfigurePatch,
+      incomingWireAgentConfigKey !== appliedWireAgentConfigKey
+    );
     let needsWireFallbackRecreate = false;
     const agentSessionExistedBeforeThisInit = !!agentSession;
     if (!agentSession) {
@@ -9148,6 +9313,11 @@ async function startAgentServer(opts) {
       detachSkillInstance,
       registerLiveAttachedMcp,
       scheduleDriverRestartForToolChanges,
+      getDriver: () => driver ?? null,
+      rememberReconfigure: (patch) => {
+        liveReconfigurePatch = { ...liveReconfigurePatch, ...patch };
+        applyReconfigurePatch(sessionConfig, patch);
+      },
       log
     });
     return { needsWireFallbackRecreate, needsWireAgentConfigRecreate };
@@ -9787,7 +9957,15 @@ async function startAgentServer(opts) {
       awaitSwap: () => driverSwapGate.awaitSwap(),
       answer: cmd.answer,
       question: cmd.question,
-      requestId: cmd.requestId
+      requestId: cmd.requestId,
+      // Tells every other attached client the question is answered, so none
+      // keeps a stale question card or a shut status gate.
+      onAnswered: () => sendEvent({
+        type: "question_reply",
+        answer: cmd.answer,
+        ...cmd.question !== void 0 ? { question: cmd.question } : {},
+        ...cmd.requestId !== void 0 ? { requestId: cmd.requestId } : {}
+      })
     });
     if (routed === "answered") return;
     if (!driver.acceptsReplyAsPrompt) return;
@@ -10383,5 +10561,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, WS_AUTH_TOKEN_ENV, WS_AUTH_TOKEN_FILE_ENV, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, computeDirectoryTotals, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, rejectPendingCapabilityCallsOnDisconnect, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, takeRunnerWsAuthToken, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-N5XNEKHC.js.map
-//# sourceMappingURL=chunk-N5XNEKHC.js.map
+//# sourceMappingURL=chunk-XZO4TMAQ.js.map
+//# sourceMappingURL=chunk-XZO4TMAQ.js.map