@skaile/workspaces 6.14.0 → 6.15.0

package/dist/{chunk-J3FJTH3V.js → chunk-HCIXCCUH.js}

@@ -1,4 +1,4 @@
-import { mcpNotRunnableReason } from './chunk-7UBCUKJO.js';
+import { mcpNotRunnableReason } from './chunk-MUQBP2BK.js';
 import { fetchAssetFilesFromGitHub } from './chunk-F3D25RGM.js';
 import { isValidAssetName } from './chunk-7HRZACI4.js';
 import { createHash } from 'crypto';
@@ -27,5 +27,5 @@ async function mcpNotRunnableHere(manifest, name, fetcher = fetchAssetFilesFromG
 }
 
 export { mcpNotRunnableHere, storeNotInstallableReason };
-//# sourceMappingURL=chunk-J3FJTH3V.js.map
-//# sourceMappingURL=chunk-J3FJTH3V.js.map
+//# sourceMappingURL=chunk-HCIXCCUH.js.map
+//# sourceMappingURL=chunk-HCIXCCUH.js.map

package/dist/{chunk-J3FJTH3V.js.map → chunk-HCIXCCUH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-addable.ts"],"names":[],"mappings":";;;;;AAsBO,SAAS,0BACd,CAAA,EACoB;AACpB,EAAA,IAAI,CAAC,gBAAA,CAAiB,CAAA,CAAE,IAAI,CAAA,EAAG;AAC7B,IAAA,OAAO,CAAA,UAAA,EAAa,EAAE,IAAI,CAAA,mDAAA,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA;AACT;AAUA,eAAsB,kBAAA,CACpB,QAAA,EACA,IAAA,EACA,OAAA,GAAwB,yBAAA,EACK;AAC7B,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,QAAA,CAAS,SAAS,CAAC,CAAA;AACzF,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,MAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,MACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,MAC3B,KAAA,EAAO,CAAC,IAAA,CAAK,IAAI;AAAA,KAClB,CAAA;AACD,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAC3B,IAAA,IAAI,CAAC,GAAA,IAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,KAAM,IAAA,CAAK,QAAQ,OAAO,KAAA,CAAA;AACnF,IAAA,OAAO,oBAAA,CAAqB,GAAA,CAAI,QAAA,CAAS,MAAM,GAAG,IAAI,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF","file":"chunk-J3FJTH3V.js","sourcesContent":["/**\n * Which store entries `skaile add` can take. The store lists only what `add` can install\n * (owner decision, RCV p385): one rule for `search`, `store search`, `store show` and the\n * `manage` store feed, so a listing never offers a ref that then fails.\n *\n * Every store kind is installable (owner decision, RCW p610): `add` stages the pointer's files\n * into the store cache and deploys them (skills, agents, contracts) or composes them at session\n * start (mcp-server). Only a name that is no canonical asset name cannot be added.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mcpNotRunnableReason } from \"@skaile/workspaces/asset-manager\";\nimport { isValidAssetName } from \"@skaile/workspaces/core\";\nimport { type AssetFetcher, fetchAssetFilesFromGitHub } from \"@skaile/workspaces/library\";\nimport type { CatalogAsset } from \"@skaile/workspaces/plugins\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n\n/**\n * Why `skaile add` cannot take a store row as printed, or `undefined` when it can: a name that\n * is not a canonical asset name (`UI Rendering` copied from a listing is two shell arguments\n * and no ref).\n */\nexport function storeNotInstallableReason(\n  a: Pick<CatalogAsset, \"kind\" | \"name\">,\n): string | undefined {\n  if (!isValidAssetName(a.name)) {\n    return `the name \"${a.name}\" is not a canonical asset name, so no ref names it`;\n  }\n  return undefined;\n}\n\n/**\n * Why the `mcp-server` of `manifest` gets no `.mcp.json` entry from this CLI (a Nix-recipe\n * server, a placeholder url), read from its pinned `MCP.md`: the catalog row carries no manifest\n * fields. `undefined` when it would get one, or when the file cannot be fetched or does not match\n * the recorded sha256: nothing is claimed then (p1491).\n *\n * @param fetcher - Fetches the file at the pinned commit; GitHub's raw host by default.\n */\nexport async function mcpNotRunnableHere(\n  manifest: Pick<InstallManifest, \"files\" | \"source\">,\n  name: string,\n  fetcher: AssetFetcher = fetchAssetFilesFromGitHub,\n): Promise<string | undefined> {\n  const file = manifest.files.find((f) => f.path === \"MCP.md\" || f.path.endsWith(\"/MCP.md\"));\n  if (!file) return undefined;\n  try {\n    const bytes = await fetcher({\n      url: manifest.source.url,\n      commitSha: manifest.source.commitSha,\n      paths: [file.path],\n    });\n    const buf = bytes[file.path];\n    if (!buf || createHash(\"sha256\").update(buf).digest(\"hex\") !== file.sha256) return undefined;\n    return mcpNotRunnableReason(buf.toString(\"utf8\"), name);\n  } catch {\n    return undefined;\n  }\n}\n"]}
+{"version":3,"sources":["../cli/src/store-addable.ts"],"names":[],"mappings":";;;;;AAsBO,SAAS,0BACd,CAAA,EACoB;AACpB,EAAA,IAAI,CAAC,gBAAA,CAAiB,CAAA,CAAE,IAAI,CAAA,EAAG;AAC7B,IAAA,OAAO,CAAA,UAAA,EAAa,EAAE,IAAI,CAAA,mDAAA,CAAA;AAAA,EAC5B;AACA,EAAA,OAAO,MAAA;AACT;AAUA,eAAsB,kBAAA,CACpB,QAAA,EACA,IAAA,EACA,OAAA,GAAwB,yBAAA,EACK;AAC7B,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,QAAA,CAAS,SAAS,CAAC,CAAA;AACzF,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ;AAAA,MAC1B,GAAA,EAAK,SAAS,MAAA,CAAO,GAAA;AAAA,MACrB,SAAA,EAAW,SAAS,MAAA,CAAO,SAAA;AAAA,MAC3B,KAAA,EAAO,CAAC,IAAA,CAAK,IAAI;AAAA,KAClB,CAAA;AACD,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAC3B,IAAA,IAAI,CAAC,GAAA,IAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,KAAM,IAAA,CAAK,QAAQ,OAAO,KAAA,CAAA;AACnF,IAAA,OAAO,oBAAA,CAAqB,GAAA,CAAI,QAAA,CAAS,MAAM,GAAG,IAAI,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF","file":"chunk-HCIXCCUH.js","sourcesContent":["/**\n * Which store entries `skaile add` can take. The store lists only what `add` can install\n * (owner decision, RCV p385): one rule for `search`, `store search`, `store show` and the\n * `manage` store feed, so a listing never offers a ref that then fails.\n *\n * Every store kind is installable (owner decision, RCW p610): `add` stages the pointer's files\n * into the store cache and deploys them (skills, agents, contracts) or composes them at session\n * start (mcp-server). Only a name that is no canonical asset name cannot be added.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mcpNotRunnableReason } from \"@skaile/workspaces/asset-manager\";\nimport { isValidAssetName } from \"@skaile/workspaces/core\";\nimport { type AssetFetcher, fetchAssetFilesFromGitHub } from \"@skaile/workspaces/library\";\nimport type { CatalogAsset } from \"@skaile/workspaces/plugins\";\nimport type { InstallManifest } from \"@skaile/workspaces/types\";\n\n/**\n * Why `skaile add` cannot take a store row as printed, or `undefined` when it can: a name that\n * is not a canonical asset name (`UI Rendering` copied from a listing is two shell arguments\n * and no ref).\n */\nexport function storeNotInstallableReason(\n  a: Pick<CatalogAsset, \"kind\" | \"name\">,\n): string | undefined {\n  if (!isValidAssetName(a.name)) {\n    return `the name \"${a.name}\" is not a canonical asset name, so no ref names it`;\n  }\n  return undefined;\n}\n\n/**\n * Why the `mcp-server` of `manifest` gets no `.mcp.json` entry from this CLI (a Nix-recipe\n * server, a placeholder url), read from its pinned `MCP.md`: the catalog row carries no manifest\n * fields. `undefined` when it would get one, or when the file cannot be fetched or does not match\n * the recorded sha256: nothing is claimed then (p1491).\n *\n * @param fetcher - Fetches the file at the pinned commit; GitHub's raw host by default.\n */\nexport async function mcpNotRunnableHere(\n  manifest: Pick<InstallManifest, \"files\" | \"source\">,\n  name: string,\n  fetcher: AssetFetcher = fetchAssetFilesFromGitHub,\n): Promise<string | undefined> {\n  const file = manifest.files.find((f) => f.path === \"MCP.md\" || f.path.endsWith(\"/MCP.md\"));\n  if (!file) return undefined;\n  try {\n    const bytes = await fetcher({\n      url: manifest.source.url,\n      commitSha: manifest.source.commitSha,\n      paths: [file.path],\n    });\n    const buf = bytes[file.path];\n    if (!buf || createHash(\"sha256\").update(buf).digest(\"hex\") !== file.sha256) return undefined;\n    return mcpNotRunnableReason(buf.toString(\"utf8\"), name);\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/{chunk-GJT2Q5XD.js → chunk-HXST2IYJ.js}

@@ -1,4 +1,4 @@
-import { declaresActivityLabel, stripActivityLabel } from './chunk-DWPQBMCY.js';
+import { declaresActivityLabel, stripActivityLabel } from './chunk-JPV4WE5L.js';
 import { randomUUID } from 'crypto';
 
 async function dispatchCapability(hooks, name, input, onBackgroundError = () => {
@@ -52,5 +52,5 @@ function filterRenderCapabilities(caps) {
 }
 
 export { dispatchCapability, filterRenderCapabilities, renderFallback };
-//# sourceMappingURL=chunk-GJT2Q5XD.js.map
-//# sourceMappingURL=chunk-GJT2Q5XD.js.map
+//# sourceMappingURL=chunk-HXST2IYJ.js.map
+//# sourceMappingURL=chunk-HXST2IYJ.js.map

package/dist/{chunk-GJT2Q5XD.js.map → chunk-HXST2IYJ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/capability-dispatch.ts"],"names":[],"mappings":";;;AAgFA,eAAsB,kBAAA,CACpB,KAAA,EACA,IAAA,EACA,KAAA,EACA,oBAA4D,MAAM;AAAC,CAAA,EACnE,MAAA,EACmC;AACnC,EAAA,MAAA,EAAQ,cAAA,EAAe;AACvB,EAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AAI9B,EAAA,IAAI,CAAC,qBAAA,CAAsB,GAAA,EAAK,WAAW,CAAA,EAAG,KAAA,GAAQ,mBAAmB,KAAK,CAAA;AAK9E,EAAA,IAAI,GAAA,EAAK,MAAA,IAAU,KAAA,CAAM,UAAA,EAAY;AACnC,IAAA,KAAA,CAAM,UAAA,CAAW;AAAA,MACf,IAAA,EAAM,gBAAA;AAAA,MACN,cAAA,EAAgB,IAAA;AAAA,MAChB,KAAA,EAAO,KAAA;AAAA,MACP;AAAA,KACD,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,CAAO,QAAA,IAAY,KAAA,CAAM,QAAA,EAAU;AACzC,MAAA,MAAM,QAAA,GAAW,cAAA,CAAe,GAAA,CAAI,MAAA,CAAO,UAAU,KAAK,CAAA;AAC1D,MAAA,KAAA,CAAM,SAAS,QAAQ,CAAA;AAAA,IACzB;AAAA,EACF;AAEA,EAAA,IAAI,KAAK,aAAA,EAAe;AAEtB,IAAA,KAAK,KAAA,CAAM,MAAA,CAAO,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,MAAM,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ,iBAAA,CAAkB,GAAA,EAAK,MAAM,CAAC,CAAA;AAC5F,IAAA,OAAO,EAAE,MAAA,EAAQ,EAAC,EAAG,UAAA,EAAY,MAAM,MAAA,EAAO;AAAA,EAChD;AAEA,EAAA,MAAM,SAAS,MAAM,KAAA,CAAM,OAAO,IAAA,EAAM,KAAA,EAAO,QAAQ,MAAM,CAAA;AAC7D,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,KAAA,EAAO,MAAA,EAAO;AAC7C;AAqBO,SAAS,cAAA,CAAe,UAAkB,KAAA,EAAwB;AACvE,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,wBAAA,EAA0B,EAAE,CAAA;AAAA,EACtD;AACA,EAAA,MAAM,KAAA,GAAQ,KAAA;AACd,EAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,0BAAA,EAA4B,CAAC,QAAQ,IAAA,KAAiB;AAC5E,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,EAAO,IAAI,CAAA;AAClC,IAAA,OAAO,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,GAAO,EAAA,GAAK,OAAO,KAAK,CAAA;AAAA,EAClE,CAAC,CAAA;AACH;AAEA,SAAS,QAAA,CAAS,KAA8B,IAAA,EAAuB;AACrE,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC5B,EAAA,IAAI,OAAA,GAAmB,GAAA;AACvB,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,YAAY,IAAA,IAAQ,OAAA,KAAY,MAAA,IAAa,OAAO,YAAY,QAAA,EAAU;AAC5E,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAA,GAAW,QAAoC,IAAI,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,OAAA;AACT;AAYO,SAAS,yBAAyB,IAAA,EAAkC;AACzE,EAAA,OAAO,KAAK,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,MAAS,CAAA;AAClD","file":"chunk-GJT2Q5XD.js","sourcesContent":["/**\n * Capability dispatch helpers for bridge harnesses.\n *\n * The runner builds a {@link BridgeCapabilityHooks} bundle from its\n * `CapabilityRegistry` and threads it through `AgentConfig.capabilities`.\n * Harnesses consume the bundle via these helpers without taking a runtime\n * dependency on `@skaile/workspaces/runner` (which would create a circular dep).\n *\n * Three behaviours are layered into a single dispatch path:\n *\n * 1. **Standard tool call** — the LLM invokes a capability; the bridge calls\n *    `hooks.invoke()`, awaits the result, and returns it to the LLM.\n * 2. **Fire-and-forget** — when the resolved Capability has `fireAndForget`\n *    set, the bridge resolves to `{}` immediately and runs the handler in\n *    the background. Background errors are logged but never surfaced to the\n *    LLM since the call is already settled.\n * 3. **Render capability** — when the resolved Capability has a non-undefined\n *    `render`, the bridge emits `RenderInvokedEvent` to the runner via\n *    `hooks.emitRender` and (when `render.fallback` is set) a parallel text\n *    event via `hooks.emitText` with simple `{{prop}}` substitution. The\n *    placeholder convention follows the v2 spec — top-level keys of `props`\n *    only, with optional dotted-path traversal (`{{user.name}}`). The legacy\n *    AAP `{{props.x}}` form was retired in Phase 6.\n *\n * @category Capabilities\n * @since 2.0.0\n */\nimport { randomUUID } from \"node:crypto\";\nimport {\n  type Capability,\n  declaresActivityLabel,\n  stripActivityLabel,\n} from \"@skaile/workspaces/types\";\nimport type { BridgeCapabilityHooks } from \"./types.js\";\n\n/**\n * Result of a capability dispatch returned by {@link dispatchCapability}.\n *\n * The bridge feeds `{ result }` back to the LLM tool-use response. For\n * fire-and-forget capabilities `result` is always `{}` and `background` is `true`.\n *\n * @docLink packages/bridge/concepts#capability-dispatch-result\n */\nexport interface CapabilityDispatchResult {\n  /** Value returned to the LLM. `{}` for fire-and-forget capabilities. */\n  result: unknown;\n  /** True when the handler is still running in the background (fire-and-forget). */\n  background: boolean;\n  /** The per-dispatch call id minted for this invocation (see {@link dispatchCapability}). */\n  callId: string;\n}\n\n/**\n * Run a capability invocation through the runner-provided hooks, applying\n * render-event emission and fire-and-forget short-circuit.\n *\n * The result is always shaped for direct return to the LLM. For\n * fire-and-forget capabilities the background promise is fired and any error\n * is logged through `onBackgroundError` (defaulting to a no-op). For all\n * other capabilities the handler is awaited; errors propagate as a rejection\n * so the harness can surface them as tool errors.\n *\n * **Dispatch call id.** Every dispatch mints a fresh `randomUUID()` and uses it\n * for `render_invoked.callId`, `hooks.invoke`'s `callId` and — for client\n * capabilities — the outbound `capability_invoked.callId`. It is deliberately\n * NOT the harness's tool-call id: those are only as unique as the model\n * provider makes them (some harnesses emit `call_0` on every turn), and the\n * runner's pending-call map is keyed by this id, so a late `capability_result`\n * for a timed-out call must never be able to resolve a later call that reused\n * the provider's id. Harnesses map results back to their tool calls through the\n * returned value, never through this id.\n *\n * @param hooks - Capability dispatch bundle from `AgentConfig.capabilities`.\n * @param name - Registered capability name.\n * @param input - Raw tool input from the LLM.\n * @param onBackgroundError - Optional error handler for fire-and-forget failures; receives the dispatch call id.\n * @param signal - Optional abort signal forwarded to the handler.\n * @returns Resolved dispatch result with the LLM-facing value, background flag and dispatch call id.\n * @docLink packages/bridge/concepts#dispatch-capability\n */\nexport async function dispatchCapability(\n  hooks: BridgeCapabilityHooks,\n  name: string,\n  input: unknown,\n  onBackgroundError: (err: unknown, callId: string) => void = () => {},\n  signal?: AbortSignal,\n): Promise<CapabilityDispatchResult> {\n  signal?.throwIfAborted();\n  const callId = randomUUID();\n  const cap = hooks.resolve(name);\n  // The advertised `activity_label` is for the UI only. Strip it before render\n  // props and the handler: strict inputs would reject it and external MCP\n  // passthrough would forward it. Kept when the capability declares it itself.\n  if (!declaresActivityLabel(cap?.inputSchema)) input = stripActivityLabel(input);\n\n  // Render emission happens before invocation so clients see the props the\n  // LLM passed in even if the handler errors. The runner's gateway forwards\n  // the event over the transport.\n  if (cap?.render && hooks.emitRender) {\n    hooks.emitRender({\n      type: \"render_invoked\",\n      capabilityName: name,\n      props: input,\n      callId,\n    });\n    if (cap.render.fallback && hooks.emitText) {\n      const fallback = renderFallback(cap.render.fallback, input);\n      hooks.emitText(fallback);\n    }\n  }\n\n  if (cap?.fireAndForget) {\n    // Resolve immediately; run handler in background.\n    void hooks.invoke(name, input, signal, callId).catch((err) => onBackgroundError(err, callId));\n    return { result: {}, background: true, callId };\n  }\n\n  const result = await hooks.invoke(name, input, signal, callId);\n  return { result, background: false, callId };\n}\n\n/**\n * Substitute `{{prop}}` placeholders inside a fallback template using the\n * input record. Top-level keys of `props` resolve directly\n * (`{{name}}` → `props.name`); dotted paths traverse nested records\n * (`{{user.name}}` → `props.user.name`). Missing keys collapse to an empty\n * string; non-record inputs collapse all placeholders.\n *\n * The convention is fixed by the v2 spec (§1, `RenderSpec.fallback`). The\n * legacy AAP form `{{props.x}}` is no longer accepted — author fallbacks\n * with bare keys.\n *\n * Intentionally minimal — full template engines belong in the platform's\n * render layer, not the bridge.\n *\n * @param template - Fallback string from `RenderSpec.fallback` with `{{key}}` placeholders.\n * @param input - LLM tool input object; non-object values collapse all placeholders.\n * @returns Template with all resolvable placeholders replaced.\n * @docLink packages/bridge/concepts#render-fallback\n */\nexport function renderFallback(template: string, input: unknown): string {\n  if (!input || typeof input !== \"object\") {\n    return template.replace(/\\{\\{\\s*[\\w$.]+\\s*\\}\\}/g, \"\");\n  }\n  const props = input as Record<string, unknown>;\n  return template.replace(/\\{\\{\\s*([\\w$.]+)\\s*\\}\\}/g, (_match, path: string) => {\n    const value = readPath(props, path);\n    return value === undefined || value === null ? \"\" : String(value);\n  });\n}\n\nfunction readPath(obj: Record<string, unknown>, path: string): unknown {\n  const parts = path.split(\".\");\n  let current: unknown = obj;\n  for (const part of parts) {\n    if (current === null || current === undefined || typeof current !== \"object\") {\n      return undefined;\n    }\n    current = (current as Record<string, unknown>)[part];\n  }\n  return current;\n}\n\n/**\n * Filter a capability list to those marked as render-capable (having a `render` spec).\n *\n * Used by harnesses that emit a separate render manifest at registration time.\n * Currently unused in production harnesses; reserved for future phases.\n *\n * @param caps - Full capability list to filter.\n * @returns Subset of capabilities with a non-undefined `render` property.\n * @docLink packages/bridge/concepts#filter-render-capabilities\n */\nexport function filterRenderCapabilities(caps: Capability[]): Capability[] {\n  return caps.filter((c) => c.render !== undefined);\n}\n"]}
+{"version":3,"sources":["../bridge/src/capability-dispatch.ts"],"names":[],"mappings":";;;AAgFA,eAAsB,kBAAA,CACpB,KAAA,EACA,IAAA,EACA,KAAA,EACA,oBAA4D,MAAM;AAAC,CAAA,EACnE,MAAA,EACmC;AACnC,EAAA,MAAA,EAAQ,cAAA,EAAe;AACvB,EAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AAI9B,EAAA,IAAI,CAAC,qBAAA,CAAsB,GAAA,EAAK,WAAW,CAAA,EAAG,KAAA,GAAQ,mBAAmB,KAAK,CAAA;AAK9E,EAAA,IAAI,GAAA,EAAK,MAAA,IAAU,KAAA,CAAM,UAAA,EAAY;AACnC,IAAA,KAAA,CAAM,UAAA,CAAW;AAAA,MACf,IAAA,EAAM,gBAAA;AAAA,MACN,cAAA,EAAgB,IAAA;AAAA,MAChB,KAAA,EAAO,KAAA;AAAA,MACP;AAAA,KACD,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,CAAO,QAAA,IAAY,KAAA,CAAM,QAAA,EAAU;AACzC,MAAA,MAAM,QAAA,GAAW,cAAA,CAAe,GAAA,CAAI,MAAA,CAAO,UAAU,KAAK,CAAA;AAC1D,MAAA,KAAA,CAAM,SAAS,QAAQ,CAAA;AAAA,IACzB;AAAA,EACF;AAEA,EAAA,IAAI,KAAK,aAAA,EAAe;AAEtB,IAAA,KAAK,KAAA,CAAM,MAAA,CAAO,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,MAAM,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ,iBAAA,CAAkB,GAAA,EAAK,MAAM,CAAC,CAAA;AAC5F,IAAA,OAAO,EAAE,MAAA,EAAQ,EAAC,EAAG,UAAA,EAAY,MAAM,MAAA,EAAO;AAAA,EAChD;AAEA,EAAA,MAAM,SAAS,MAAM,KAAA,CAAM,OAAO,IAAA,EAAM,KAAA,EAAO,QAAQ,MAAM,CAAA;AAC7D,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,KAAA,EAAO,MAAA,EAAO;AAC7C;AAqBO,SAAS,cAAA,CAAe,UAAkB,KAAA,EAAwB;AACvE,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,wBAAA,EAA0B,EAAE,CAAA;AAAA,EACtD;AACA,EAAA,MAAM,KAAA,GAAQ,KAAA;AACd,EAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,0BAAA,EAA4B,CAAC,QAAQ,IAAA,KAAiB;AAC5E,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,EAAO,IAAI,CAAA;AAClC,IAAA,OAAO,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,GAAO,EAAA,GAAK,OAAO,KAAK,CAAA;AAAA,EAClE,CAAC,CAAA;AACH;AAEA,SAAS,QAAA,CAAS,KAA8B,IAAA,EAAuB;AACrE,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC5B,EAAA,IAAI,OAAA,GAAmB,GAAA;AACvB,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,YAAY,IAAA,IAAQ,OAAA,KAAY,MAAA,IAAa,OAAO,YAAY,QAAA,EAAU;AAC5E,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAA,GAAW,QAAoC,IAAI,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,OAAA;AACT;AAYO,SAAS,yBAAyB,IAAA,EAAkC;AACzE,EAAA,OAAO,KAAK,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,MAAS,CAAA;AAClD","file":"chunk-HXST2IYJ.js","sourcesContent":["/**\n * Capability dispatch helpers for bridge harnesses.\n *\n * The runner builds a {@link BridgeCapabilityHooks} bundle from its\n * `CapabilityRegistry` and threads it through `AgentConfig.capabilities`.\n * Harnesses consume the bundle via these helpers without taking a runtime\n * dependency on `@skaile/workspaces/runner` (which would create a circular dep).\n *\n * Three behaviours are layered into a single dispatch path:\n *\n * 1. **Standard tool call** — the LLM invokes a capability; the bridge calls\n *    `hooks.invoke()`, awaits the result, and returns it to the LLM.\n * 2. **Fire-and-forget** — when the resolved Capability has `fireAndForget`\n *    set, the bridge resolves to `{}` immediately and runs the handler in\n *    the background. Background errors are logged but never surfaced to the\n *    LLM since the call is already settled.\n * 3. **Render capability** — when the resolved Capability has a non-undefined\n *    `render`, the bridge emits `RenderInvokedEvent` to the runner via\n *    `hooks.emitRender` and (when `render.fallback` is set) a parallel text\n *    event via `hooks.emitText` with simple `{{prop}}` substitution. The\n *    placeholder convention follows the v2 spec — top-level keys of `props`\n *    only, with optional dotted-path traversal (`{{user.name}}`). The legacy\n *    AAP `{{props.x}}` form was retired in Phase 6.\n *\n * @category Capabilities\n * @since 2.0.0\n */\nimport { randomUUID } from \"node:crypto\";\nimport {\n  type Capability,\n  declaresActivityLabel,\n  stripActivityLabel,\n} from \"@skaile/workspaces/types\";\nimport type { BridgeCapabilityHooks } from \"./types.js\";\n\n/**\n * Result of a capability dispatch returned by {@link dispatchCapability}.\n *\n * The bridge feeds `{ result }` back to the LLM tool-use response. For\n * fire-and-forget capabilities `result` is always `{}` and `background` is `true`.\n *\n * @docLink packages/bridge/concepts#capability-dispatch-result\n */\nexport interface CapabilityDispatchResult {\n  /** Value returned to the LLM. `{}` for fire-and-forget capabilities. */\n  result: unknown;\n  /** True when the handler is still running in the background (fire-and-forget). */\n  background: boolean;\n  /** The per-dispatch call id minted for this invocation (see {@link dispatchCapability}). */\n  callId: string;\n}\n\n/**\n * Run a capability invocation through the runner-provided hooks, applying\n * render-event emission and fire-and-forget short-circuit.\n *\n * The result is always shaped for direct return to the LLM. For\n * fire-and-forget capabilities the background promise is fired and any error\n * is logged through `onBackgroundError` (defaulting to a no-op). For all\n * other capabilities the handler is awaited; errors propagate as a rejection\n * so the harness can surface them as tool errors.\n *\n * **Dispatch call id.** Every dispatch mints a fresh `randomUUID()` and uses it\n * for `render_invoked.callId`, `hooks.invoke`'s `callId` and — for client\n * capabilities — the outbound `capability_invoked.callId`. It is deliberately\n * NOT the harness's tool-call id: those are only as unique as the model\n * provider makes them (some harnesses emit `call_0` on every turn), and the\n * runner's pending-call map is keyed by this id, so a late `capability_result`\n * for a timed-out call must never be able to resolve a later call that reused\n * the provider's id. Harnesses map results back to their tool calls through the\n * returned value, never through this id.\n *\n * @param hooks - Capability dispatch bundle from `AgentConfig.capabilities`.\n * @param name - Registered capability name.\n * @param input - Raw tool input from the LLM.\n * @param onBackgroundError - Optional error handler for fire-and-forget failures; receives the dispatch call id.\n * @param signal - Optional abort signal forwarded to the handler.\n * @returns Resolved dispatch result with the LLM-facing value, background flag and dispatch call id.\n * @docLink packages/bridge/concepts#dispatch-capability\n */\nexport async function dispatchCapability(\n  hooks: BridgeCapabilityHooks,\n  name: string,\n  input: unknown,\n  onBackgroundError: (err: unknown, callId: string) => void = () => {},\n  signal?: AbortSignal,\n): Promise<CapabilityDispatchResult> {\n  signal?.throwIfAborted();\n  const callId = randomUUID();\n  const cap = hooks.resolve(name);\n  // The advertised `activity_label` is for the UI only. Strip it before render\n  // props and the handler: strict inputs would reject it and external MCP\n  // passthrough would forward it. Kept when the capability declares it itself.\n  if (!declaresActivityLabel(cap?.inputSchema)) input = stripActivityLabel(input);\n\n  // Render emission happens before invocation so clients see the props the\n  // LLM passed in even if the handler errors. The runner's gateway forwards\n  // the event over the transport.\n  if (cap?.render && hooks.emitRender) {\n    hooks.emitRender({\n      type: \"render_invoked\",\n      capabilityName: name,\n      props: input,\n      callId,\n    });\n    if (cap.render.fallback && hooks.emitText) {\n      const fallback = renderFallback(cap.render.fallback, input);\n      hooks.emitText(fallback);\n    }\n  }\n\n  if (cap?.fireAndForget) {\n    // Resolve immediately; run handler in background.\n    void hooks.invoke(name, input, signal, callId).catch((err) => onBackgroundError(err, callId));\n    return { result: {}, background: true, callId };\n  }\n\n  const result = await hooks.invoke(name, input, signal, callId);\n  return { result, background: false, callId };\n}\n\n/**\n * Substitute `{{prop}}` placeholders inside a fallback template using the\n * input record. Top-level keys of `props` resolve directly\n * (`{{name}}` → `props.name`); dotted paths traverse nested records\n * (`{{user.name}}` → `props.user.name`). Missing keys collapse to an empty\n * string; non-record inputs collapse all placeholders.\n *\n * The convention is fixed by the v2 spec (§1, `RenderSpec.fallback`). The\n * legacy AAP form `{{props.x}}` is no longer accepted — author fallbacks\n * with bare keys.\n *\n * Intentionally minimal — full template engines belong in the platform's\n * render layer, not the bridge.\n *\n * @param template - Fallback string from `RenderSpec.fallback` with `{{key}}` placeholders.\n * @param input - LLM tool input object; non-object values collapse all placeholders.\n * @returns Template with all resolvable placeholders replaced.\n * @docLink packages/bridge/concepts#render-fallback\n */\nexport function renderFallback(template: string, input: unknown): string {\n  if (!input || typeof input !== \"object\") {\n    return template.replace(/\\{\\{\\s*[\\w$.]+\\s*\\}\\}/g, \"\");\n  }\n  const props = input as Record<string, unknown>;\n  return template.replace(/\\{\\{\\s*([\\w$.]+)\\s*\\}\\}/g, (_match, path: string) => {\n    const value = readPath(props, path);\n    return value === undefined || value === null ? \"\" : String(value);\n  });\n}\n\nfunction readPath(obj: Record<string, unknown>, path: string): unknown {\n  const parts = path.split(\".\");\n  let current: unknown = obj;\n  for (const part of parts) {\n    if (current === null || current === undefined || typeof current !== \"object\") {\n      return undefined;\n    }\n    current = (current as Record<string, unknown>)[part];\n  }\n  return current;\n}\n\n/**\n * Filter a capability list to those marked as render-capable (having a `render` spec).\n *\n * Used by harnesses that emit a separate render manifest at registration time.\n * Currently unused in production harnesses; reserved for future phases.\n *\n * @param caps - Full capability list to filter.\n * @returns Subset of capabilities with a non-undefined `render` property.\n * @docLink packages/bridge/concepts#filter-render-capabilities\n */\nexport function filterRenderCapabilities(caps: Capability[]): Capability[] {\n  return caps.filter((c) => c.render !== undefined);\n}\n"]}

package/dist/{chunk-243Z3BNB.js → chunk-IRIWNKQS.js}

@@ -1,4 +1,4 @@
-import { getAccessToken, loadStoreAuthConfig, hasStoredAuth } from './chunk-OC3AIMZH.js';
+import { getAccessToken, loadStoreAuthConfig, hasStoredAuth } from './chunk-6WIZC6GM.js';
 import { globalSettingsPath, mapLegacyFields } from './chunk-MEU2HHGV.js';
 import { existsSync, readFileSync } from 'fs';
 
@@ -60,5 +60,5 @@ function isStoreAuthenticated() {
 }
 
 export { getStoreConfig, getStoreToken, isStoreAuthenticated, storeFetch };
-//# sourceMappingURL=chunk-243Z3BNB.js.map
-//# sourceMappingURL=chunk-243Z3BNB.js.map
+//# sourceMappingURL=chunk-IRIWNKQS.js.map
+//# sourceMappingURL=chunk-IRIWNKQS.js.map

package/dist/{chunk-243Z3BNB.js.map → chunk-IRIWNKQS.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-client.ts"],"names":[],"mappings":";;;;AAuBO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAM,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-243Z3BNB.js","sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}
+{"version":3,"sources":["../cli/src/store-client.ts"],"names":[],"mappings":";;;;AAuBO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAM,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-IRIWNKQS.js","sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}

package/dist/{chunk-LMUNQYJQ.js → chunk-IYXOSBQ4.js}

@@ -1,15 +1,15 @@
-import { ompRegistryModelRefusal, renderOmpRegistry, materializeOmpProviders } from './chunk-ZQL6HGTW.js';
-import { sessionSurfaceNotice } from './chunk-QNHW26AT.js';
-import { buildCodexConfigDocument } from './chunk-B6W5DCH5.js';
-import { materializeOpenCodeConfig } from './chunk-6ISJMEDX.js';
+import { ompRegistryModelRefusal, renderOmpRegistry, materializeOmpProviders } from './chunk-J7FEWDRQ.js';
+import { sessionSurfaceNotice } from './chunk-TYRAEMWE.js';
+import { buildCodexConfigDocument } from './chunk-SXRN27TU.js';
+import { materializeOpenCodeConfig } from './chunk-AEFDFCS2.js';
 import { harnessSessionConfigHome } from './chunk-NBAGV6L2.js';
-import { bindSingleProviderEntry, resolveEnvHarnessSession, credentialsForEveryProvider, harnessProviderName } from './chunk-NAAFRZTA.js';
+import { bindSingleProviderEntry, resolveEnvHarnessSession, credentialsForEveryProvider, harnessProviderName } from './chunk-O74SRQ3W.js';
 import { HARNESS_BINARIES, resolveHarnessBinary, harnessSpawnPath, harnessSearchDirs, SDK_CLI_BINARIES, overrideVar, isExecutableFile } from './chunk-YKD2MYLU.js';
 import { classifyClaudeSdkError, stripRunnerPrivateEnv } from './chunk-5DE3DGVR.js';
-import { registryHarnessConfig, toMergedRegistry } from './chunk-XHLRMUMO.js';
-import { BUILTIN_HARNESS_CATALOG, listHarnesses, listModelsForHarness, createHarness } from './chunk-3BRBTQ6M.js';
+import { registryHarnessConfig, toMergedRegistry } from './chunk-CWUHUL6W.js';
+import { BUILTIN_HARNESS_CATALOG, listHarnesses, listModelsForHarness, createHarness } from './chunk-U7EJB6LY.js';
 import { getProviderPreset, resolvePresetBaseUrl, expandPreset, resolveProbeUrl, buildCredentialHeaders, AI_PROVIDER_PRESETS } from './chunk-6UP2EDFN.js';
-import { stripActivityLabel, TOOL_ACTIVITY_LABEL_PARAM, TOOL_ACTIVITY_LABEL_MAX_CHARS } from './chunk-DWPQBMCY.js';
+import { stripActivityLabel, TOOL_ACTIVITY_LABEL_PARAM, TOOL_ACTIVITY_LABEL_MAX_CHARS } from './chunk-JPV4WE5L.js';
 import { loadHarnessSdk, sdkLookupPlaces, installCommandFor } from './chunk-MEU2HHGV.js';
 import { registryEntries, isEntryEnabled, parseModelRef } from './chunk-RXGPFAMN.js';
 import { openSqlite } from './chunk-RZL4TOK3.js';
@@ -1224,5 +1224,5 @@ async function validateApiKey(provider, key, options = {}) {
 }
 
 export { BridgeRuntime, EventNormalizer, HARNESS_SDKS, checkHarnessModel, checkModelProvider, checkModelSurface, checkOmpListedModel, checkOmpServeModel, createRuntime, detectFileChange, detectFileChanges, detectHarness, detectHarnesses, discoverHarnessModels, isUnlistedModel, labelToolCall, sdkMissingProblem, summarizeToolCall, summarizeToolResult, validateApiKey };
-//# sourceMappingURL=chunk-LMUNQYJQ.js.map
-//# sourceMappingURL=chunk-LMUNQYJQ.js.map
+//# sourceMappingURL=chunk-IYXOSBQ4.js.map
+//# sourceMappingURL=chunk-IYXOSBQ4.js.map