@spotpatch/shared 1.14.2 → 1.15.0

package/dist/external-agent-node.d.ts

@@ -1,6 +1,6 @@
 import { Stats } from 'node:fs';
 import { z } from 'zod';
-import { E as EXTERNAL_HANDOFF_LIMITS, A as ActiveAdapterSummary, D as DispatchSummary, a as ExternalHandoffSnapshot } from './external-handoff-5zHu-fz2.js';
+import { E as EXTERNAL_HANDOFF_LIMITS, A as ActiveAdapterSummary, D as DispatchSummary, a as ExternalHandoffSnapshot } from './external-handoff-BpoxbpPk.js';
 import './annotation-Cz-NNgR4.js';
 
 declare const SPOTPATCH_BRIDGE_TOKEN_HEADER: "X-SpotPatch-Bridge-Token";
@@ -21,9 +21,9 @@ declare const externalHandoffDescriptorSchema: z.ZodObject<{
     projectKey: z.ZodString;
     sessionId: z.ZodString;
     framework: z.ZodEnum<{
-        astro: "astro";
         vite: "vite";
         next: "next";
+        astro: "astro";
     }>;
     endpoint: z.ZodURL;
     bridgeToken: z.ZodString;
@@ -56,11 +56,11 @@ declare const bridgeActiveReportRequestSchema: z.ZodObject<{
     leaseToken: z.ZodString;
     cursor: z.ZodString;
     phase: z.ZodEnum<{
-        failed: "failed";
-        dispatched: "dispatched";
-        completed: "completed";
         dispatching: "dispatching";
+        dispatched: "dispatched";
         working: "working";
+        completed: "completed";
+        failed: "failed";
         "delivery-unknown": "delivery-unknown";
     }>;
 }, z.core.$strict>;
@@ -72,16 +72,16 @@ declare const bridgeStatusSchema: z.ZodObject<{
     projectKey: z.ZodString;
     sessionId: z.ZodString;
     framework: z.ZodEnum<{
-        astro: "astro";
         vite: "vite";
         next: "next";
+        astro: "astro";
     }>;
     current: z.ZodNullable<z.ZodObject<{
         sessionId: z.ZodString;
         framework: z.ZodEnum<{
-            astro: "astro";
             vite: "vite";
             next: "next";
+            astro: "astro";
         }>;
         revision: z.ZodNumber;
         cursor: z.ZodString;
@@ -93,8 +93,8 @@ declare const bridgeStatusSchema: z.ZodObject<{
         publishedAt: z.ZodISODateTime;
         expiresAt: z.ZodISODateTime;
         state: z.ZodEnum<{
-            expired: "expired";
             available: "available";
+            expired: "expired";
             superseded: "superseded";
         }>;
         pickupCount: z.ZodNumber;
@@ -109,9 +109,9 @@ declare const bridgeCurrentResultSchema: z.ZodObject<{
         session: z.ZodObject<{
             id: z.ZodString;
             framework: z.ZodEnum<{
-                astro: "astro";
                 vite: "vite";
                 next: "next";
+                astro: "astro";
             }>;
         }, z.core.$strict>;
         revision: z.ZodNumber;
@@ -216,9 +216,9 @@ declare const bridgeCurrentResultSchema: z.ZodObject<{
                 code: z.ZodOptional<z.ZodObject<{
                     relativePath: z.ZodString;
                     language: z.ZodEnum<{
+                        astro: "astro";
                         tsx: "tsx";
                         jsx: "jsx";
-                        astro: "astro";
                     }>;
                     startLine: z.ZodNumber;
                     endLine: z.ZodNumber;
@@ -242,9 +242,9 @@ declare const bridgeWaitResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         session: z.ZodObject<{
             id: z.ZodString;
             framework: z.ZodEnum<{
-                astro: "astro";
                 vite: "vite";
                 next: "next";
+                astro: "astro";
             }>;
         }, z.core.$strict>;
         revision: z.ZodNumber;
@@ -349,9 +349,9 @@ declare const bridgeWaitResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 code: z.ZodOptional<z.ZodObject<{
                     relativePath: z.ZodString;
                     language: z.ZodEnum<{
+                        astro: "astro";
                         tsx: "tsx";
                         jsx: "jsx";
-                        astro: "astro";
                     }>;
                     startLine: z.ZodNumber;
                     endLine: z.ZodNumber;
@@ -373,9 +373,9 @@ declare const bridgeAckResultSchema: z.ZodObject<{
     summary: z.ZodObject<{
         sessionId: z.ZodString;
         framework: z.ZodEnum<{
-            astro: "astro";
             vite: "vite";
             next: "next";
+            astro: "astro";
         }>;
         revision: z.ZodNumber;
         cursor: z.ZodString;
@@ -387,8 +387,8 @@ declare const bridgeAckResultSchema: z.ZodObject<{
         publishedAt: z.ZodISODateTime;
         expiresAt: z.ZodISODateTime;
         state: z.ZodEnum<{
-            expired: "expired";
             available: "available";
+            expired: "expired";
             superseded: "superseded";
         }>;
         pickupCount: z.ZodNumber;
@@ -406,8 +406,8 @@ declare const bridgeActiveClaimResultSchema: z.ZodObject<{
         }>;
         state: z.ZodEnum<{
             ready: "ready";
-            blocked: "blocked";
             busy: "busy";
+            blocked: "blocked";
         }>;
         canDispatch: z.ZodBoolean;
         connectedAt: z.ZodISODateTime;
@@ -422,8 +422,8 @@ declare const bridgeActiveStateResultSchema: z.ZodObject<{
         }>;
         state: z.ZodEnum<{
             ready: "ready";
-            blocked: "blocked";
             busy: "busy";
+            blocked: "blocked";
         }>;
         canDispatch: z.ZodBoolean;
         connectedAt: z.ZodISODateTime;
@@ -436,13 +436,13 @@ declare const bridgeActiveStateResultSchema: z.ZodObject<{
         }>;
         revision: z.ZodNumber;
         phase: z.ZodEnum<{
-            queued: "queued";
-            failed: "failed";
-            dispatched: "dispatched";
-            completed: "completed";
             dispatching: "dispatching";
+            dispatched: "dispatched";
             working: "working";
+            completed: "completed";
+            failed: "failed";
             "delivery-unknown": "delivery-unknown";
+            queued: "queued";
         }>;
         updatedAt: z.ZodISODateTime;
     }, z.core.$strict>>;
@@ -455,8 +455,8 @@ declare const bridgeActiveHeartbeatResultSchema: z.ZodObject<{
         }>;
         state: z.ZodEnum<{
             ready: "ready";
-            blocked: "blocked";
             busy: "busy";
+            blocked: "blocked";
         }>;
         canDispatch: z.ZodBoolean;
         connectedAt: z.ZodISODateTime;
@@ -469,13 +469,13 @@ declare const bridgeActiveHeartbeatResultSchema: z.ZodObject<{
         }>;
         revision: z.ZodNumber;
         phase: z.ZodEnum<{
-            queued: "queued";
-            failed: "failed";
-            dispatched: "dispatched";
-            completed: "completed";
             dispatching: "dispatching";
+            dispatched: "dispatched";
             working: "working";
+            completed: "completed";
+            failed: "failed";
             "delivery-unknown": "delivery-unknown";
+            queued: "queued";
         }>;
         updatedAt: z.ZodISODateTime;
     }, z.core.$strict>>;
@@ -488,8 +488,8 @@ declare const bridgeActiveReportResultSchema: z.ZodObject<{
         }>;
         state: z.ZodEnum<{
             ready: "ready";
-            blocked: "blocked";
             busy: "busy";
+            blocked: "blocked";
         }>;
         canDispatch: z.ZodBoolean;
         connectedAt: z.ZodISODateTime;
@@ -502,13 +502,13 @@ declare const bridgeActiveReportResultSchema: z.ZodObject<{
         }>;
         revision: z.ZodNumber;
         phase: z.ZodEnum<{
-            queued: "queued";
-            failed: "failed";
-            dispatched: "dispatched";
-            completed: "completed";
             dispatching: "dispatching";
+            dispatched: "dispatched";
             working: "working";
+            completed: "completed";
+            failed: "failed";
             "delivery-unknown": "delivery-unknown";
+            queued: "queued";
         }>;
         updatedAt: z.ZodISODateTime;
     }, z.core.$strict>>;
@@ -521,8 +521,8 @@ declare const bridgeActiveReleaseResultSchema: z.ZodObject<{
         }>;
         state: z.ZodEnum<{
             ready: "ready";
-            blocked: "blocked";
             busy: "busy";
+            blocked: "blocked";
         }>;
         canDispatch: z.ZodBoolean;
         connectedAt: z.ZodISODateTime;
@@ -535,13 +535,13 @@ declare const bridgeActiveReleaseResultSchema: z.ZodObject<{
         }>;
         revision: z.ZodNumber;
         phase: z.ZodEnum<{
-            queued: "queued";
-            failed: "failed";
-            dispatched: "dispatched";
-            completed: "completed";
             dispatching: "dispatching";
+            dispatched: "dispatched";
             working: "working";
+            completed: "completed";
+            failed: "failed";
             "delivery-unknown": "delivery-unknown";
+            queued: "queued";
         }>;
         updatedAt: z.ZodISODateTime;
     }, z.core.$strict>>;

package/dist/external-agent-node.js

@@ -37,6 +37,7 @@ var SPOTPATCH_BRIDGE_PATHS = Object.freeze({
 });
 var EXTERNAL_HANDOFF_PROJECT_KEY_SALT = "spotpatch-external-agent-project-v1";
 var execFileAsync = promisify(execFile);
+var WINDOWS_ACL_COMMAND_TIMEOUT_MS = 3e4;
 var WINDOWS_ACL_VERIFY_ATTEMPTS = 3;
 var WINDOWS_ACL_RETRY_DELAY_MS = 25;
 var WINDOWS_ACL_SCRIPT = String.raw`
@@ -212,7 +213,7 @@ async function verifyWindowsAcl(candidate, kind, initialize) {
           SPOTPATCH_ACL_OPERATION: initialize ? "initialize" : "verify",
           SPOTPATCH_ACL_TARGET: candidate
         },
-        timeout: 1e4,
+        timeout: WINDOWS_ACL_COMMAND_TIMEOUT_MS,
         windowsHide: true
       }
     );

package/dist/external-agent-node.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/external-agent-node.ts"],"sourcesContent":["/// <reference types=\"node\" />\n\nimport { createHash } from \"node:crypto\";\nimport { execFile } from \"node:child_process\";\nimport type { Stats } from \"node:fs\";\nimport { lstat, mkdir, realpath } from \"node:fs/promises\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { promisify } from \"node:util\";\n\nimport { z } from \"zod\";\n\nimport {\n  EXTERNAL_HANDOFF_ACTIVE_ADAPTER_KINDS,\n  EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION,\n  EXTERNAL_HANDOFF_FRAMEWORKS,\n  EXTERNAL_HANDOFF_LIMITS,\n  activeAdapterSummarySchema,\n  dispatchSummarySchema,\n  externalHandoffReportableDispatchPhaseSchema,\n  externalHandoffSnapshotSchema,\n  externalHandoffSummarySchema,\n  type ActiveAdapterSummary,\n  type DispatchSummary,\n  type ExternalHandoffSnapshot,\n} from \"./protocol/external-handoff.js\";\nimport { ERROR_CODES } from \"./errors/error-code.js\";\nimport { SpotPatchError } from \"./errors/spotpatch-error.js\";\n\nexport const SPOTPATCH_BRIDGE_TOKEN_HEADER = \"X-SpotPatch-Bridge-Token\" as const;\nexport const SPOTPATCH_BRIDGE_PATHS = Object.freeze({\n  status: \"/bridge/v1/status\",\n  current: \"/bridge/v1/handoff/current\",\n  wait: \"/bridge/v1/handoff/wait\",\n  ack: \"/bridge/v1/handoff/ack\",\n  activeClaim: \"/bridge/v1/active/claim\",\n  activeHeartbeat: \"/bridge/v1/active/heartbeat\",\n  activeReport: \"/bridge/v1/active/report\",\n  activeRelease: \"/bridge/v1/active/release\",\n});\nexport const EXTERNAL_HANDOFF_PROJECT_KEY_SALT =\n  \"spotpatch-external-agent-project-v1\" as const;\n\nconst execFileAsync = promisify(execFile);\nconst WINDOWS_ACL_VERIFY_ATTEMPTS = 3;\nconst WINDOWS_ACL_RETRY_DELAY_MS = 25;\nconst WINDOWS_ACL_SCRIPT = String.raw`\n$ErrorActionPreference = 'Stop'\n$target = $env:SPOTPATCH_ACL_TARGET\n$kind = $env:SPOTPATCH_ACL_KIND\n$operation = $env:SPOTPATCH_ACL_OPERATION\n$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent().User\n$allowed = @($identity.Value, 'S-1-5-18', 'S-1-5-32-544')\nif ($kind -eq 'directory') {\n  $item = [System.IO.DirectoryInfo]::new($target)\n  if ($operation -eq 'initialize') {\n    $security = [System.Security.AccessControl.DirectorySecurity]::new()\n    $security.SetOwner($identity)\n    foreach ($sidValue in $allowed) {\n      $sid = [System.Security.Principal.SecurityIdentifier]::new($sidValue)\n      $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(\n        $sid,\n        [System.Security.AccessControl.FileSystemRights]::FullControl,\n        [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit',\n        [System.Security.AccessControl.PropagationFlags]::None,\n        [System.Security.AccessControl.AccessControlType]::Allow\n      )\n      [void]$security.AddAccessRule($rule)\n    }\n    $security.SetAccessRuleProtection($true, $false)\n    $item.SetAccessControl($security)\n  }\n  $acl = $item.GetAccessControl(\n    [System.Security.AccessControl.AccessControlSections]'Access, Owner'\n  )\n} elseif ($kind -eq 'file') {\n  $item = [System.IO.FileInfo]::new($target)\n  if ($operation -eq 'initialize') {\n    $security = [System.Security.AccessControl.FileSecurity]::new()\n    $security.SetOwner($identity)\n    foreach ($sidValue in $allowed) {\n      $sid = [System.Security.Principal.SecurityIdentifier]::new($sidValue)\n      $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(\n        $sid,\n        [System.Security.AccessControl.FileSystemRights]::FullControl,\n        [System.Security.AccessControl.AccessControlType]::Allow\n      )\n      [void]$security.AddAccessRule($rule)\n    }\n    $security.SetAccessRuleProtection($true, $false)\n    $item.SetAccessControl($security)\n  }\n  $acl = $item.GetAccessControl(\n    [System.Security.AccessControl.AccessControlSections]'Access, Owner'\n  )\n} else {\n  exit 10\n}\nif ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $identity.Value) {\n  exit 11\n}\nforeach ($rule in $acl.GetAccessRules(\n  $true,\n  $true,\n  [System.Security.Principal.SecurityIdentifier]\n)) {\n  if (\n    $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow -and\n    $allowed -notcontains $rule.IdentityReference.Value\n  ) {\n    exit 12\n  }\n}\n`;\n\nconst opaqueIdSchema = z\n  .string()\n  .min(22)\n  .max(128)\n  .regex(/^[A-Za-z0-9_-]+$/u);\nconst projectKeySchema = z\n  .string()\n  .length(64)\n  .regex(/^[a-f0-9]+$/u);\nconst loopbackEndpointSchema = z.url().refine((value) => {\n  const match = /^http:\\/\\/127\\.0\\.0\\.1:([1-9][0-9]{0,4})$/u.exec(value);\n\n  if (match?.[1] === undefined) {\n    return false;\n  }\n\n  const port = Number(match[1]);\n  return Number.isSafeInteger(port) && port <= 65_535;\n});\n\nexport const externalHandoffDescriptorSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  brokerProtocolVersion: z.literal(EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION),\n  projectKey: projectKeySchema,\n  sessionId: opaqueIdSchema,\n  framework: z.enum(EXTERNAL_HANDOFF_FRAMEWORKS),\n  endpoint: loopbackEndpointSchema,\n  bridgeToken: z\n    .string()\n    .min(43)\n    .max(128)\n    .regex(/^[A-Za-z0-9_-]+$/u),\n  pid: z.number().int().positive(),\n  createdAt: z.iso.datetime(),\n});\n\nexport const bridgeStatusRequestSchema = z.strictObject({});\nexport const bridgeCurrentRequestSchema = z.strictObject({\n  cursor: opaqueIdSchema.optional(),\n});\nexport const bridgeWaitRequestSchema = z.strictObject({\n  afterCursor: opaqueIdSchema.optional(),\n  timeoutMs: z\n    .number()\n    .int()\n    .positive()\n    .max(EXTERNAL_HANDOFF_LIMITS.maximumWaitMs)\n    .default(EXTERNAL_HANDOFF_LIMITS.defaultWaitMs),\n});\nexport const bridgeAckRequestSchema = z.strictObject({\n  cursor: opaqueIdSchema,\n  connectorInstanceId: opaqueIdSchema,\n});\nexport const bridgeActiveClaimRequestSchema = z.strictObject({\n  adapterKind: z.enum(EXTERNAL_HANDOFF_ACTIVE_ADAPTER_KINDS),\n  connectorInstanceId: opaqueIdSchema,\n});\nexport const bridgeActiveHeartbeatRequestSchema = z.strictObject({\n  leaseToken: opaqueIdSchema,\n});\nexport const bridgeActiveReportRequestSchema = z.strictObject({\n  leaseToken: opaqueIdSchema,\n  cursor: opaqueIdSchema,\n  phase: externalHandoffReportableDispatchPhaseSchema,\n});\nexport const bridgeActiveReleaseRequestSchema = z.strictObject({\n  leaseToken: opaqueIdSchema,\n});\nexport const bridgeStatusSchema = z.strictObject({\n  brokerProtocolVersion: z.literal(EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION),\n  projectKey: projectKeySchema,\n  sessionId: opaqueIdSchema,\n  framework: z.enum(EXTERNAL_HANDOFF_FRAMEWORKS),\n  current: externalHandoffSummarySchema.nullable(),\n});\nexport const bridgeCurrentResultSchema = z.strictObject({\n  outcome: z.literal(\"handoff\"),\n  snapshot: externalHandoffSnapshotSchema,\n});\nexport const bridgeWaitResultSchema = z.discriminatedUnion(\"outcome\", [\n  bridgeCurrentResultSchema,\n  z.strictObject({ outcome: z.literal(\"timeout\") }),\n]);\nexport const bridgeAckResultSchema = z.strictObject({\n  summary: externalHandoffSummarySchema,\n});\nexport const bridgeActiveClaimResultSchema = z.strictObject({\n  leaseToken: opaqueIdSchema,\n  heartbeatIntervalMs: z.literal(EXTERNAL_HANDOFF_LIMITS.activeHeartbeatIntervalMs),\n  baselineCursor: opaqueIdSchema.nullable(),\n  activeAdapter: activeAdapterSummarySchema,\n});\nexport const bridgeActiveStateResultSchema = z.strictObject({\n  activeAdapter: activeAdapterSummarySchema.nullable(),\n  dispatch: dispatchSummarySchema.nullable(),\n});\nexport const bridgeActiveHeartbeatResultSchema = bridgeActiveStateResultSchema;\nexport const bridgeActiveReportResultSchema = bridgeActiveStateResultSchema;\nexport const bridgeActiveReleaseResultSchema = bridgeActiveStateResultSchema;\n\nexport type ExternalHandoffDescriptor = z.infer<typeof externalHandoffDescriptorSchema>;\nexport type BridgeStatus = z.infer<typeof bridgeStatusSchema>;\nexport type BridgeWaitResult =\n  | Readonly<{ outcome: \"handoff\"; snapshot: ExternalHandoffSnapshot }>\n  | Readonly<{ outcome: \"timeout\" }>;\nexport interface BridgeActiveClaimResult {\n  readonly leaseToken: string;\n  readonly heartbeatIntervalMs: typeof EXTERNAL_HANDOFF_LIMITS.activeHeartbeatIntervalMs;\n  readonly baselineCursor: string | null;\n  readonly activeAdapter: ActiveAdapterSummary;\n}\nexport interface BridgeActiveStateResult {\n  readonly activeAdapter: ActiveAdapterSummary | null;\n  readonly dispatch: DispatchSummary | null;\n}\n\nfunction windowsPowerShellExecutable(): string {\n  const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;\n  if (systemRoot === undefined || !path.win32.isAbsolute(systemRoot)) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n  return path.win32.join(\n    systemRoot,\n    \"System32\",\n    \"WindowsPowerShell\",\n    \"v1.0\",\n    \"powershell.exe\",\n  );\n}\n\nasync function verifyWindowsAcl(\n  candidate: string,\n  kind: \"directory\" | \"file\",\n  initialize: boolean,\n): Promise<void> {\n  try {\n    await execFileAsync(\n      windowsPowerShellExecutable(),\n      [\"-NoLogo\", \"-NoProfile\", \"-NonInteractive\", \"-Command\", WINDOWS_ACL_SCRIPT],\n      {\n        encoding: \"utf8\",\n        env: {\n          ...process.env,\n          SPOTPATCH_ACL_KIND: kind,\n          SPOTPATCH_ACL_OPERATION: initialize ? \"initialize\" : \"verify\",\n          SPOTPATCH_ACL_TARGET: candidate,\n        },\n        timeout: 10_000,\n        windowsHide: true,\n      },\n    );\n  } catch (error: unknown) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED, undefined, {\n      cause: error,\n    });\n  }\n}\n\nexport async function assertPrivateExternalHandoffPath(\n  candidate: string,\n  kind: \"directory\" | \"file\",\n): Promise<Stats> {\n  const status = await lstat(candidate);\n  const correctKind = kind === \"directory\" ? status.isDirectory() : status.isFile();\n\n  if (!correctKind || status.isSymbolicLink()) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  if (process.platform === \"win32\") {\n    for (let attempt = 0; attempt < WINDOWS_ACL_VERIFY_ATTEMPTS; attempt += 1) {\n      try {\n        await verifyWindowsAcl(candidate, kind, false);\n        return status;\n      } catch (error: unknown) {\n        if (attempt === WINDOWS_ACL_VERIFY_ATTEMPTS - 1) throw error;\n        let current: Stats;\n        try {\n          current = await lstat(candidate);\n        } catch {\n          throw error;\n        }\n        const sameKind =\n          kind === \"directory\" ? current.isDirectory() : current.isFile();\n        if (\n          !sameKind ||\n          current.isSymbolicLink() ||\n          current.dev !== status.dev ||\n          current.ino !== status.ino\n        ) {\n          throw error;\n        }\n        await new Promise<void>((resolve) => {\n          setTimeout(resolve, WINDOWS_ACL_RETRY_DELAY_MS * (attempt + 1));\n        });\n      }\n    }\n    return status;\n  }\n\n  const uid = process.getuid?.();\n  if (uid === undefined || status.uid !== uid || (status.mode & 0o077) !== 0) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  return status;\n}\n\nexport async function initializePrivateExternalHandoffFile(\n  candidate: string,\n): Promise<void> {\n  if (process.platform === \"win32\") {\n    await verifyWindowsAcl(candidate, \"file\", true);\n  }\n}\n\nasync function initializeWindowsDirectory(directory: string): Promise<void> {\n  if (process.platform === \"win32\") {\n    await verifyWindowsAcl(directory, \"directory\", true);\n  }\n}\n\nasync function ensurePrivateSubdirectory(\n  base: string,\n  create: boolean,\n): Promise<string> {\n  const directory = path.join(base, \"spotpatch\");\n  let created = false;\n\n  if (create) {\n    try {\n      await mkdir(directory, { mode: 0o700 });\n      created = true;\n    } catch (error: unknown) {\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") {\n        throw error;\n      }\n    }\n  }\n\n  if (created) await initializeWindowsDirectory(directory);\n  await assertPrivateExternalHandoffPath(directory, \"directory\");\n  return realpath(directory);\n}\n\nasync function resolveWindowsRuntimeDirectory(create: boolean): Promise<string> {\n  const configuredBase = process.env.LOCALAPPDATA;\n\n  if (configuredBase !== undefined && !path.isAbsolute(configuredBase)) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  const base = configuredBase ?? path.join(os.homedir(), \"AppData\", \"Local\");\n  const directory = path.join(base, \"SpotPatch\", \"external-agent-runtime-v1\");\n  let created = false;\n\n  if (create) {\n    created = (await mkdir(directory, { mode: 0o700, recursive: true })) !== undefined;\n  }\n\n  if (created) await initializeWindowsDirectory(directory);\n  await assertPrivateExternalHandoffPath(directory, \"directory\");\n  return realpath(directory);\n}\n\nexport async function resolveExternalHandoffRuntimeDirectory(\n  create: boolean,\n): Promise<string> {\n  const xdgRuntimeDirectory = process.env.XDG_RUNTIME_DIR;\n\n  if (xdgRuntimeDirectory !== undefined && !path.isAbsolute(xdgRuntimeDirectory)) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  if (xdgRuntimeDirectory !== undefined) {\n    try {\n      if (process.platform !== \"win32\") {\n        await assertPrivateExternalHandoffPath(xdgRuntimeDirectory, \"directory\");\n      }\n      return await ensurePrivateSubdirectory(xdgRuntimeDirectory, create);\n    } catch (error: unknown) {\n      if (!create && (error as NodeJS.ErrnoException).code === \"ENOENT\") {\n        throw new SpotPatchError(ERROR_CODES.SESSION_NOT_FOUND);\n      }\n\n      throw error;\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      return await resolveWindowsRuntimeDirectory(create);\n    } catch (error: unknown) {\n      if (!create && (error as NodeJS.ErrnoException).code === \"ENOENT\") {\n        throw new SpotPatchError(ERROR_CODES.SESSION_NOT_FOUND);\n      }\n\n      throw error;\n    }\n  }\n\n  const uid = process.getuid?.();\n  if (uid === undefined) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  const fallback = path.join(os.tmpdir(), `spotpatch-${String(uid)}`);\n\n  if (create) {\n    try {\n      await mkdir(fallback, { mode: 0o700 });\n    } catch (error: unknown) {\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") {\n        throw error;\n      }\n    }\n  }\n\n  try {\n    await assertPrivateExternalHandoffPath(fallback, \"directory\");\n  } catch (error: unknown) {\n    if (!create && (error as NodeJS.ErrnoException).code === \"ENOENT\") {\n      throw new SpotPatchError(ERROR_CODES.SESSION_NOT_FOUND);\n    }\n\n    throw error;\n  }\n\n  return realpath(fallback);\n}\n\nexport async function computeExternalHandoffProjectKey(root: string): Promise<string> {\n  const canonicalRoot = await realpath(root);\n  return createHash(\"sha256\")\n    .update(`${EXTERNAL_HANDOFF_PROJECT_KEY_SALT}\\0${canonicalRoot}`)\n    .digest(\"hex\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAEA,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AAEzB,SAAS,OAAO,OAAO,gBAAgB;AACvC,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAE1B,SAAS,SAAS;AAmBX,IAAM,gCAAgC;AACtC,IAAM,yBAAyB,OAAO,OAAO;AAAA,EAClD,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,MAAM;AAAA,EACN,KAAK;AAAA,EACL,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,eAAe;AACjB,CAAC;AACM,IAAM,oCACX;AAEF,IAAM,gBAAgB,UAAU,QAAQ;AACxC,IAAM,8BAA8B;AACpC,IAAM,6BAA6B;AACnC,IAAM,qBAAqB,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqElC,IAAM,iBAAiB,EACpB,OAAO,EACP,IAAI,EAAE,EACN,IAAI,GAAG,EACP,MAAM,mBAAmB;AAC5B,IAAM,mBAAmB,EACtB,OAAO,EACP,OAAO,EAAE,EACT,MAAM,cAAc;AACvB,IAAM,yBAAyB,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU;AACvD,QAAM,QAAQ,6CAA6C,KAAK,KAAK;AAErE,MAAI,QAAQ,CAAC,MAAM,QAAW;AAC5B,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,SAAO,OAAO,cAAc,IAAI,KAAK,QAAQ;AAC/C,CAAC;AAEM,IAAM,kCAAkC,EAAE,aAAa;AAAA,EAC5D,eAAe,EAAE,QAAQ,CAAC;AAAA,EAC1B,uBAAuB,EAAE,QAAQ,wCAAwC;AAAA,EACzE,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,WAAW,EAAE,KAAK,2BAA2B;AAAA,EAC7C,UAAU;AAAA,EACV,aAAa,EACV,OAAO,EACP,IAAI,EAAE,EACN,IAAI,GAAG,EACP,MAAM,mBAAmB;AAAA,EAC5B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,IAAI,SAAS;AAC5B,CAAC;AAEM,IAAM,4BAA4B,EAAE,aAAa,CAAC,CAAC;AACnD,IAAM,6BAA6B,EAAE,aAAa;AAAA,EACvD,QAAQ,eAAe,SAAS;AAClC,CAAC;AACM,IAAM,0BAA0B,EAAE,aAAa;AAAA,EACpD,aAAa,eAAe,SAAS;AAAA,EACrC,WAAW,EACR,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,wBAAwB,aAAa,EACzC,QAAQ,wBAAwB,aAAa;AAClD,CAAC;AACM,IAAM,yBAAyB,EAAE,aAAa;AAAA,EACnD,QAAQ;AAAA,EACR,qBAAqB;AACvB,CAAC;AACM,IAAM,iCAAiC,EAAE,aAAa;AAAA,EAC3D,aAAa,EAAE,KAAK,qCAAqC;AAAA,EACzD,qBAAqB;AACvB,CAAC;AACM,IAAM,qCAAqC,EAAE,aAAa;AAAA,EAC/D,YAAY;AACd,CAAC;AACM,IAAM,kCAAkC,EAAE,aAAa;AAAA,EAC5D,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,OAAO;AACT,CAAC;AACM,IAAM,mCAAmC,EAAE,aAAa;AAAA,EAC7D,YAAY;AACd,CAAC;AACM,IAAM,qBAAqB,EAAE,aAAa;AAAA,EAC/C,uBAAuB,EAAE,QAAQ,wCAAwC;AAAA,EACzE,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,WAAW,EAAE,KAAK,2BAA2B;AAAA,EAC7C,SAAS,6BAA6B,SAAS;AACjD,CAAC;AACM,IAAM,4BAA4B,EAAE,aAAa;AAAA,EACtD,SAAS,EAAE,QAAQ,SAAS;AAAA,EAC5B,UAAU;AACZ,CAAC;AACM,IAAM,yBAAyB,EAAE,mBAAmB,WAAW;AAAA,EACpE;AAAA,EACA,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE,CAAC;AAClD,CAAC;AACM,IAAM,wBAAwB,EAAE,aAAa;AAAA,EAClD,SAAS;AACX,CAAC;AACM,IAAM,gCAAgC,EAAE,aAAa;AAAA,EAC1D,YAAY;AAAA,EACZ,qBAAqB,EAAE,QAAQ,wBAAwB,yBAAyB;AAAA,EAChF,gBAAgB,eAAe,SAAS;AAAA,EACxC,eAAe;AACjB,CAAC;AACM,IAAM,gCAAgC,EAAE,aAAa;AAAA,EAC1D,eAAe,2BAA2B,SAAS;AAAA,EACnD,UAAU,sBAAsB,SAAS;AAC3C,CAAC;AACM,IAAM,oCAAoC;AAC1C,IAAM,iCAAiC;AACvC,IAAM,kCAAkC;AAkB/C,SAAS,8BAAsC;AAC7C,QAAM,aAAa,QAAQ,IAAI,cAAc,QAAQ,IAAI;AACzD,MAAI,eAAe,UAAa,CAAC,KAAK,MAAM,WAAW,UAAU,GAAG;AAClE,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AACA,SAAO,KAAK,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,iBACb,WACA,MACA,YACe;AACf,MAAI;AACF,UAAM;AAAA,MACJ,4BAA4B;AAAA,MAC5B,CAAC,WAAW,cAAc,mBAAmB,YAAY,kBAAkB;AAAA,MAC3E;AAAA,QACE,UAAU;AAAA,QACV,KAAK;AAAA,UACH,GAAG,QAAQ;AAAA,UACX,oBAAoB;AAAA,UACpB,yBAAyB,aAAa,eAAe;AAAA,UACrD,sBAAsB;AAAA,QACxB;AAAA,QACA,SAAS;AAAA,QACT,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF,SAAS,OAAgB;AACvB,UAAM,IAAI,eAAe,YAAY,qBAAqB,QAAW;AAAA,MACnE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,iCACpB,WACA,MACgB;AAChB,QAAM,SAAS,MAAM,MAAM,SAAS;AACpC,QAAM,cAAc,SAAS,cAAc,OAAO,YAAY,IAAI,OAAO,OAAO;AAEhF,MAAI,CAAC,eAAe,OAAO,eAAe,GAAG;AAC3C,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,MAAI,QAAQ,aAAa,SAAS;AAChC,aAAS,UAAU,GAAG,UAAU,6BAA6B,WAAW,GAAG;AACzE,UAAI;AACF,cAAM,iBAAiB,WAAW,MAAM,KAAK;AAC7C,eAAO;AAAA,MACT,SAAS,OAAgB;AACvB,YAAI,YAAY,8BAA8B,EAAG,OAAM;AACvD,YAAI;AACJ,YAAI;AACF,oBAAU,MAAM,MAAM,SAAS;AAAA,QACjC,QAAQ;AACN,gBAAM;AAAA,QACR;AACA,cAAM,WACJ,SAAS,cAAc,QAAQ,YAAY,IAAI,QAAQ,OAAO;AAChE,YACE,CAAC,YACD,QAAQ,eAAe,KACvB,QAAQ,QAAQ,OAAO,OACvB,QAAQ,QAAQ,OAAO,KACvB;AACA,gBAAM;AAAA,QACR;AACA,cAAM,IAAI,QAAc,CAAC,YAAY;AACnC,qBAAW,SAAS,8BAA8B,UAAU,EAAE;AAAA,QAChE,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,QAAQ,SAAS;AAC7B,MAAI,QAAQ,UAAa,OAAO,QAAQ,QAAQ,OAAO,OAAO,QAAW,GAAG;AAC1E,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,SAAO;AACT;AAEA,eAAsB,qCACpB,WACe;AACf,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,iBAAiB,WAAW,QAAQ,IAAI;AAAA,EAChD;AACF;AAEA,eAAe,2BAA2B,WAAkC;AAC1E,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,iBAAiB,WAAW,aAAa,IAAI;AAAA,EACrD;AACF;AAEA,eAAe,0BACb,MACA,QACiB;AACjB,QAAM,YAAY,KAAK,KAAK,MAAM,WAAW;AAC7C,MAAI,UAAU;AAEd,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,MAAM,WAAW,EAAE,MAAM,IAAM,CAAC;AACtC,gBAAU;AAAA,IACZ,SAAS,OAAgB;AACvB,UAAK,MAAgC,SAAS,UAAU;AACtD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAS,OAAM,2BAA2B,SAAS;AACvD,QAAM,iCAAiC,WAAW,WAAW;AAC7D,SAAO,SAAS,SAAS;AAC3B;AAEA,eAAe,+BAA+B,QAAkC;AAC9E,QAAM,iBAAiB,QAAQ,IAAI;AAEnC,MAAI,mBAAmB,UAAa,CAAC,KAAK,WAAW,cAAc,GAAG;AACpE,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,QAAM,OAAO,kBAAkB,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,OAAO;AACzE,QAAM,YAAY,KAAK,KAAK,MAAM,aAAa,2BAA2B;AAC1E,MAAI,UAAU;AAEd,MAAI,QAAQ;AACV,cAAW,MAAM,MAAM,WAAW,EAAE,MAAM,KAAO,WAAW,KAAK,CAAC,MAAO;AAAA,EAC3E;AAEA,MAAI,QAAS,OAAM,2BAA2B,SAAS;AACvD,QAAM,iCAAiC,WAAW,WAAW;AAC7D,SAAO,SAAS,SAAS;AAC3B;AAEA,eAAsB,uCACpB,QACiB;AACjB,QAAM,sBAAsB,QAAQ,IAAI;AAExC,MAAI,wBAAwB,UAAa,CAAC,KAAK,WAAW,mBAAmB,GAAG;AAC9E,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,MAAI,wBAAwB,QAAW;AACrC,QAAI;AACF,UAAI,QAAQ,aAAa,SAAS;AAChC,cAAM,iCAAiC,qBAAqB,WAAW;AAAA,MACzE;AACA,aAAO,MAAM,0BAA0B,qBAAqB,MAAM;AAAA,IACpE,SAAS,OAAgB;AACvB,UAAI,CAAC,UAAW,MAAgC,SAAS,UAAU;AACjE,cAAM,IAAI,eAAe,YAAY,iBAAiB;AAAA,MACxD;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,QAAQ,aAAa,SAAS;AAChC,QAAI;AACF,aAAO,MAAM,+BAA+B,MAAM;AAAA,IACpD,SAAS,OAAgB;AACvB,UAAI,CAAC,UAAW,MAAgC,SAAS,UAAU;AACjE,cAAM,IAAI,eAAe,YAAY,iBAAiB;AAAA,MACxD;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,QAAQ,SAAS;AAC7B,MAAI,QAAQ,QAAW;AACrB,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,QAAM,WAAW,KAAK,KAAK,GAAG,OAAO,GAAG,aAAa,OAAO,GAAG,CAAC,EAAE;AAElE,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,MAAM,UAAU,EAAE,MAAM,IAAM,CAAC;AAAA,IACvC,SAAS,OAAgB;AACvB,UAAK,MAAgC,SAAS,UAAU;AACtD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,iCAAiC,UAAU,WAAW;AAAA,EAC9D,SAAS,OAAgB;AACvB,QAAI,CAAC,UAAW,MAAgC,SAAS,UAAU;AACjE,YAAM,IAAI,eAAe,YAAY,iBAAiB;AAAA,IACxD;AAEA,UAAM;AAAA,EACR;AAEA,SAAO,SAAS,QAAQ;AAC1B;AAEA,eAAsB,iCAAiC,MAA+B;AACpF,QAAM,gBAAgB,MAAM,SAAS,IAAI;AACzC,SAAO,WAAW,QAAQ,EACvB,OAAO,GAAG,iCAAiC,KAAK,aAAa,EAAE,EAC/D,OAAO,KAAK;AACjB;","names":[]}
+{"version":3,"sources":["../src/external-agent-node.ts"],"sourcesContent":["/// <reference types=\"node\" />\n\nimport { createHash } from \"node:crypto\";\nimport { execFile } from \"node:child_process\";\nimport type { Stats } from \"node:fs\";\nimport { lstat, mkdir, realpath } from \"node:fs/promises\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { promisify } from \"node:util\";\n\nimport { z } from \"zod\";\n\nimport {\n  EXTERNAL_HANDOFF_ACTIVE_ADAPTER_KINDS,\n  EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION,\n  EXTERNAL_HANDOFF_FRAMEWORKS,\n  EXTERNAL_HANDOFF_LIMITS,\n  activeAdapterSummarySchema,\n  dispatchSummarySchema,\n  externalHandoffReportableDispatchPhaseSchema,\n  externalHandoffSnapshotSchema,\n  externalHandoffSummarySchema,\n  type ActiveAdapterSummary,\n  type DispatchSummary,\n  type ExternalHandoffSnapshot,\n} from \"./protocol/external-handoff.js\";\nimport { ERROR_CODES } from \"./errors/error-code.js\";\nimport { SpotPatchError } from \"./errors/spotpatch-error.js\";\n\nexport const SPOTPATCH_BRIDGE_TOKEN_HEADER = \"X-SpotPatch-Bridge-Token\" as const;\nexport const SPOTPATCH_BRIDGE_PATHS = Object.freeze({\n  status: \"/bridge/v1/status\",\n  current: \"/bridge/v1/handoff/current\",\n  wait: \"/bridge/v1/handoff/wait\",\n  ack: \"/bridge/v1/handoff/ack\",\n  activeClaim: \"/bridge/v1/active/claim\",\n  activeHeartbeat: \"/bridge/v1/active/heartbeat\",\n  activeReport: \"/bridge/v1/active/report\",\n  activeRelease: \"/bridge/v1/active/release\",\n});\nexport const EXTERNAL_HANDOFF_PROJECT_KEY_SALT =\n  \"spotpatch-external-agent-project-v1\" as const;\n\nconst execFileAsync = promisify(execFile);\nconst WINDOWS_ACL_COMMAND_TIMEOUT_MS = 30_000;\nconst WINDOWS_ACL_VERIFY_ATTEMPTS = 3;\nconst WINDOWS_ACL_RETRY_DELAY_MS = 25;\nconst WINDOWS_ACL_SCRIPT = String.raw`\n$ErrorActionPreference = 'Stop'\n$target = $env:SPOTPATCH_ACL_TARGET\n$kind = $env:SPOTPATCH_ACL_KIND\n$operation = $env:SPOTPATCH_ACL_OPERATION\n$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent().User\n$allowed = @($identity.Value, 'S-1-5-18', 'S-1-5-32-544')\nif ($kind -eq 'directory') {\n  $item = [System.IO.DirectoryInfo]::new($target)\n  if ($operation -eq 'initialize') {\n    $security = [System.Security.AccessControl.DirectorySecurity]::new()\n    $security.SetOwner($identity)\n    foreach ($sidValue in $allowed) {\n      $sid = [System.Security.Principal.SecurityIdentifier]::new($sidValue)\n      $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(\n        $sid,\n        [System.Security.AccessControl.FileSystemRights]::FullControl,\n        [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit',\n        [System.Security.AccessControl.PropagationFlags]::None,\n        [System.Security.AccessControl.AccessControlType]::Allow\n      )\n      [void]$security.AddAccessRule($rule)\n    }\n    $security.SetAccessRuleProtection($true, $false)\n    $item.SetAccessControl($security)\n  }\n  $acl = $item.GetAccessControl(\n    [System.Security.AccessControl.AccessControlSections]'Access, Owner'\n  )\n} elseif ($kind -eq 'file') {\n  $item = [System.IO.FileInfo]::new($target)\n  if ($operation -eq 'initialize') {\n    $security = [System.Security.AccessControl.FileSecurity]::new()\n    $security.SetOwner($identity)\n    foreach ($sidValue in $allowed) {\n      $sid = [System.Security.Principal.SecurityIdentifier]::new($sidValue)\n      $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(\n        $sid,\n        [System.Security.AccessControl.FileSystemRights]::FullControl,\n        [System.Security.AccessControl.AccessControlType]::Allow\n      )\n      [void]$security.AddAccessRule($rule)\n    }\n    $security.SetAccessRuleProtection($true, $false)\n    $item.SetAccessControl($security)\n  }\n  $acl = $item.GetAccessControl(\n    [System.Security.AccessControl.AccessControlSections]'Access, Owner'\n  )\n} else {\n  exit 10\n}\nif ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $identity.Value) {\n  exit 11\n}\nforeach ($rule in $acl.GetAccessRules(\n  $true,\n  $true,\n  [System.Security.Principal.SecurityIdentifier]\n)) {\n  if (\n    $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow -and\n    $allowed -notcontains $rule.IdentityReference.Value\n  ) {\n    exit 12\n  }\n}\n`;\n\nconst opaqueIdSchema = z\n  .string()\n  .min(22)\n  .max(128)\n  .regex(/^[A-Za-z0-9_-]+$/u);\nconst projectKeySchema = z\n  .string()\n  .length(64)\n  .regex(/^[a-f0-9]+$/u);\nconst loopbackEndpointSchema = z.url().refine((value) => {\n  const match = /^http:\\/\\/127\\.0\\.0\\.1:([1-9][0-9]{0,4})$/u.exec(value);\n\n  if (match?.[1] === undefined) {\n    return false;\n  }\n\n  const port = Number(match[1]);\n  return Number.isSafeInteger(port) && port <= 65_535;\n});\n\nexport const externalHandoffDescriptorSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  brokerProtocolVersion: z.literal(EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION),\n  projectKey: projectKeySchema,\n  sessionId: opaqueIdSchema,\n  framework: z.enum(EXTERNAL_HANDOFF_FRAMEWORKS),\n  endpoint: loopbackEndpointSchema,\n  bridgeToken: z\n    .string()\n    .min(43)\n    .max(128)\n    .regex(/^[A-Za-z0-9_-]+$/u),\n  pid: z.number().int().positive(),\n  createdAt: z.iso.datetime(),\n});\n\nexport const bridgeStatusRequestSchema = z.strictObject({});\nexport const bridgeCurrentRequestSchema = z.strictObject({\n  cursor: opaqueIdSchema.optional(),\n});\nexport const bridgeWaitRequestSchema = z.strictObject({\n  afterCursor: opaqueIdSchema.optional(),\n  timeoutMs: z\n    .number()\n    .int()\n    .positive()\n    .max(EXTERNAL_HANDOFF_LIMITS.maximumWaitMs)\n    .default(EXTERNAL_HANDOFF_LIMITS.defaultWaitMs),\n});\nexport const bridgeAckRequestSchema = z.strictObject({\n  cursor: opaqueIdSchema,\n  connectorInstanceId: opaqueIdSchema,\n});\nexport const bridgeActiveClaimRequestSchema = z.strictObject({\n  adapterKind: z.enum(EXTERNAL_HANDOFF_ACTIVE_ADAPTER_KINDS),\n  connectorInstanceId: opaqueIdSchema,\n});\nexport const bridgeActiveHeartbeatRequestSchema = z.strictObject({\n  leaseToken: opaqueIdSchema,\n});\nexport const bridgeActiveReportRequestSchema = z.strictObject({\n  leaseToken: opaqueIdSchema,\n  cursor: opaqueIdSchema,\n  phase: externalHandoffReportableDispatchPhaseSchema,\n});\nexport const bridgeActiveReleaseRequestSchema = z.strictObject({\n  leaseToken: opaqueIdSchema,\n});\nexport const bridgeStatusSchema = z.strictObject({\n  brokerProtocolVersion: z.literal(EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION),\n  projectKey: projectKeySchema,\n  sessionId: opaqueIdSchema,\n  framework: z.enum(EXTERNAL_HANDOFF_FRAMEWORKS),\n  current: externalHandoffSummarySchema.nullable(),\n});\nexport const bridgeCurrentResultSchema = z.strictObject({\n  outcome: z.literal(\"handoff\"),\n  snapshot: externalHandoffSnapshotSchema,\n});\nexport const bridgeWaitResultSchema = z.discriminatedUnion(\"outcome\", [\n  bridgeCurrentResultSchema,\n  z.strictObject({ outcome: z.literal(\"timeout\") }),\n]);\nexport const bridgeAckResultSchema = z.strictObject({\n  summary: externalHandoffSummarySchema,\n});\nexport const bridgeActiveClaimResultSchema = z.strictObject({\n  leaseToken: opaqueIdSchema,\n  heartbeatIntervalMs: z.literal(EXTERNAL_HANDOFF_LIMITS.activeHeartbeatIntervalMs),\n  baselineCursor: opaqueIdSchema.nullable(),\n  activeAdapter: activeAdapterSummarySchema,\n});\nexport const bridgeActiveStateResultSchema = z.strictObject({\n  activeAdapter: activeAdapterSummarySchema.nullable(),\n  dispatch: dispatchSummarySchema.nullable(),\n});\nexport const bridgeActiveHeartbeatResultSchema = bridgeActiveStateResultSchema;\nexport const bridgeActiveReportResultSchema = bridgeActiveStateResultSchema;\nexport const bridgeActiveReleaseResultSchema = bridgeActiveStateResultSchema;\n\nexport type ExternalHandoffDescriptor = z.infer<typeof externalHandoffDescriptorSchema>;\nexport type BridgeStatus = z.infer<typeof bridgeStatusSchema>;\nexport type BridgeWaitResult =\n  | Readonly<{ outcome: \"handoff\"; snapshot: ExternalHandoffSnapshot }>\n  | Readonly<{ outcome: \"timeout\" }>;\nexport interface BridgeActiveClaimResult {\n  readonly leaseToken: string;\n  readonly heartbeatIntervalMs: typeof EXTERNAL_HANDOFF_LIMITS.activeHeartbeatIntervalMs;\n  readonly baselineCursor: string | null;\n  readonly activeAdapter: ActiveAdapterSummary;\n}\nexport interface BridgeActiveStateResult {\n  readonly activeAdapter: ActiveAdapterSummary | null;\n  readonly dispatch: DispatchSummary | null;\n}\n\nfunction windowsPowerShellExecutable(): string {\n  const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;\n  if (systemRoot === undefined || !path.win32.isAbsolute(systemRoot)) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n  return path.win32.join(\n    systemRoot,\n    \"System32\",\n    \"WindowsPowerShell\",\n    \"v1.0\",\n    \"powershell.exe\",\n  );\n}\n\nasync function verifyWindowsAcl(\n  candidate: string,\n  kind: \"directory\" | \"file\",\n  initialize: boolean,\n): Promise<void> {\n  try {\n    await execFileAsync(\n      windowsPowerShellExecutable(),\n      [\"-NoLogo\", \"-NoProfile\", \"-NonInteractive\", \"-Command\", WINDOWS_ACL_SCRIPT],\n      {\n        encoding: \"utf8\",\n        env: {\n          ...process.env,\n          SPOTPATCH_ACL_KIND: kind,\n          SPOTPATCH_ACL_OPERATION: initialize ? \"initialize\" : \"verify\",\n          SPOTPATCH_ACL_TARGET: candidate,\n        },\n        timeout: WINDOWS_ACL_COMMAND_TIMEOUT_MS,\n        windowsHide: true,\n      },\n    );\n  } catch (error: unknown) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED, undefined, {\n      cause: error,\n    });\n  }\n}\n\nexport async function assertPrivateExternalHandoffPath(\n  candidate: string,\n  kind: \"directory\" | \"file\",\n): Promise<Stats> {\n  const status = await lstat(candidate);\n  const correctKind = kind === \"directory\" ? status.isDirectory() : status.isFile();\n\n  if (!correctKind || status.isSymbolicLink()) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  if (process.platform === \"win32\") {\n    for (let attempt = 0; attempt < WINDOWS_ACL_VERIFY_ATTEMPTS; attempt += 1) {\n      try {\n        await verifyWindowsAcl(candidate, kind, false);\n        return status;\n      } catch (error: unknown) {\n        if (attempt === WINDOWS_ACL_VERIFY_ATTEMPTS - 1) throw error;\n        let current: Stats;\n        try {\n          current = await lstat(candidate);\n        } catch {\n          throw error;\n        }\n        const sameKind =\n          kind === \"directory\" ? current.isDirectory() : current.isFile();\n        if (\n          !sameKind ||\n          current.isSymbolicLink() ||\n          current.dev !== status.dev ||\n          current.ino !== status.ino\n        ) {\n          throw error;\n        }\n        await new Promise<void>((resolve) => {\n          setTimeout(resolve, WINDOWS_ACL_RETRY_DELAY_MS * (attempt + 1));\n        });\n      }\n    }\n    return status;\n  }\n\n  const uid = process.getuid?.();\n  if (uid === undefined || status.uid !== uid || (status.mode & 0o077) !== 0) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  return status;\n}\n\nexport async function initializePrivateExternalHandoffFile(\n  candidate: string,\n): Promise<void> {\n  if (process.platform === \"win32\") {\n    await verifyWindowsAcl(candidate, \"file\", true);\n  }\n}\n\nasync function initializeWindowsDirectory(directory: string): Promise<void> {\n  if (process.platform === \"win32\") {\n    await verifyWindowsAcl(directory, \"directory\", true);\n  }\n}\n\nasync function ensurePrivateSubdirectory(\n  base: string,\n  create: boolean,\n): Promise<string> {\n  const directory = path.join(base, \"spotpatch\");\n  let created = false;\n\n  if (create) {\n    try {\n      await mkdir(directory, { mode: 0o700 });\n      created = true;\n    } catch (error: unknown) {\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") {\n        throw error;\n      }\n    }\n  }\n\n  if (created) await initializeWindowsDirectory(directory);\n  await assertPrivateExternalHandoffPath(directory, \"directory\");\n  return realpath(directory);\n}\n\nasync function resolveWindowsRuntimeDirectory(create: boolean): Promise<string> {\n  const configuredBase = process.env.LOCALAPPDATA;\n\n  if (configuredBase !== undefined && !path.isAbsolute(configuredBase)) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  const base = configuredBase ?? path.join(os.homedir(), \"AppData\", \"Local\");\n  const directory = path.join(base, \"SpotPatch\", \"external-agent-runtime-v1\");\n  let created = false;\n\n  if (create) {\n    created = (await mkdir(directory, { mode: 0o700, recursive: true })) !== undefined;\n  }\n\n  if (created) await initializeWindowsDirectory(directory);\n  await assertPrivateExternalHandoffPath(directory, \"directory\");\n  return realpath(directory);\n}\n\nexport async function resolveExternalHandoffRuntimeDirectory(\n  create: boolean,\n): Promise<string> {\n  const xdgRuntimeDirectory = process.env.XDG_RUNTIME_DIR;\n\n  if (xdgRuntimeDirectory !== undefined && !path.isAbsolute(xdgRuntimeDirectory)) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  if (xdgRuntimeDirectory !== undefined) {\n    try {\n      if (process.platform !== \"win32\") {\n        await assertPrivateExternalHandoffPath(xdgRuntimeDirectory, \"directory\");\n      }\n      return await ensurePrivateSubdirectory(xdgRuntimeDirectory, create);\n    } catch (error: unknown) {\n      if (!create && (error as NodeJS.ErrnoException).code === \"ENOENT\") {\n        throw new SpotPatchError(ERROR_CODES.SESSION_NOT_FOUND);\n      }\n\n      throw error;\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      return await resolveWindowsRuntimeDirectory(create);\n    } catch (error: unknown) {\n      if (!create && (error as NodeJS.ErrnoException).code === \"ENOENT\") {\n        throw new SpotPatchError(ERROR_CODES.SESSION_NOT_FOUND);\n      }\n\n      throw error;\n    }\n  }\n\n  const uid = process.getuid?.();\n  if (uid === undefined) {\n    throw new SpotPatchError(ERROR_CODES.BRIDGE_UNAUTHORIZED);\n  }\n\n  const fallback = path.join(os.tmpdir(), `spotpatch-${String(uid)}`);\n\n  if (create) {\n    try {\n      await mkdir(fallback, { mode: 0o700 });\n    } catch (error: unknown) {\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") {\n        throw error;\n      }\n    }\n  }\n\n  try {\n    await assertPrivateExternalHandoffPath(fallback, \"directory\");\n  } catch (error: unknown) {\n    if (!create && (error as NodeJS.ErrnoException).code === \"ENOENT\") {\n      throw new SpotPatchError(ERROR_CODES.SESSION_NOT_FOUND);\n    }\n\n    throw error;\n  }\n\n  return realpath(fallback);\n}\n\nexport async function computeExternalHandoffProjectKey(root: string): Promise<string> {\n  const canonicalRoot = await realpath(root);\n  return createHash(\"sha256\")\n    .update(`${EXTERNAL_HANDOFF_PROJECT_KEY_SALT}\\0${canonicalRoot}`)\n    .digest(\"hex\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAEA,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AAEzB,SAAS,OAAO,OAAO,gBAAgB;AACvC,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAE1B,SAAS,SAAS;AAmBX,IAAM,gCAAgC;AACtC,IAAM,yBAAyB,OAAO,OAAO;AAAA,EAClD,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,MAAM;AAAA,EACN,KAAK;AAAA,EACL,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,eAAe;AACjB,CAAC;AACM,IAAM,oCACX;AAEF,IAAM,gBAAgB,UAAU,QAAQ;AACxC,IAAM,iCAAiC;AACvC,IAAM,8BAA8B;AACpC,IAAM,6BAA6B;AACnC,IAAM,qBAAqB,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqElC,IAAM,iBAAiB,EACpB,OAAO,EACP,IAAI,EAAE,EACN,IAAI,GAAG,EACP,MAAM,mBAAmB;AAC5B,IAAM,mBAAmB,EACtB,OAAO,EACP,OAAO,EAAE,EACT,MAAM,cAAc;AACvB,IAAM,yBAAyB,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU;AACvD,QAAM,QAAQ,6CAA6C,KAAK,KAAK;AAErE,MAAI,QAAQ,CAAC,MAAM,QAAW;AAC5B,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,SAAO,OAAO,cAAc,IAAI,KAAK,QAAQ;AAC/C,CAAC;AAEM,IAAM,kCAAkC,EAAE,aAAa;AAAA,EAC5D,eAAe,EAAE,QAAQ,CAAC;AAAA,EAC1B,uBAAuB,EAAE,QAAQ,wCAAwC;AAAA,EACzE,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,WAAW,EAAE,KAAK,2BAA2B;AAAA,EAC7C,UAAU;AAAA,EACV,aAAa,EACV,OAAO,EACP,IAAI,EAAE,EACN,IAAI,GAAG,EACP,MAAM,mBAAmB;AAAA,EAC5B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,IAAI,SAAS;AAC5B,CAAC;AAEM,IAAM,4BAA4B,EAAE,aAAa,CAAC,CAAC;AACnD,IAAM,6BAA6B,EAAE,aAAa;AAAA,EACvD,QAAQ,eAAe,SAAS;AAClC,CAAC;AACM,IAAM,0BAA0B,EAAE,aAAa;AAAA,EACpD,aAAa,eAAe,SAAS;AAAA,EACrC,WAAW,EACR,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,wBAAwB,aAAa,EACzC,QAAQ,wBAAwB,aAAa;AAClD,CAAC;AACM,IAAM,yBAAyB,EAAE,aAAa;AAAA,EACnD,QAAQ;AAAA,EACR,qBAAqB;AACvB,CAAC;AACM,IAAM,iCAAiC,EAAE,aAAa;AAAA,EAC3D,aAAa,EAAE,KAAK,qCAAqC;AAAA,EACzD,qBAAqB;AACvB,CAAC;AACM,IAAM,qCAAqC,EAAE,aAAa;AAAA,EAC/D,YAAY;AACd,CAAC;AACM,IAAM,kCAAkC,EAAE,aAAa;AAAA,EAC5D,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,OAAO;AACT,CAAC;AACM,IAAM,mCAAmC,EAAE,aAAa;AAAA,EAC7D,YAAY;AACd,CAAC;AACM,IAAM,qBAAqB,EAAE,aAAa;AAAA,EAC/C,uBAAuB,EAAE,QAAQ,wCAAwC;AAAA,EACzE,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,WAAW,EAAE,KAAK,2BAA2B;AAAA,EAC7C,SAAS,6BAA6B,SAAS;AACjD,CAAC;AACM,IAAM,4BAA4B,EAAE,aAAa;AAAA,EACtD,SAAS,EAAE,QAAQ,SAAS;AAAA,EAC5B,UAAU;AACZ,CAAC;AACM,IAAM,yBAAyB,EAAE,mBAAmB,WAAW;AAAA,EACpE;AAAA,EACA,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,SAAS,EAAE,CAAC;AAClD,CAAC;AACM,IAAM,wBAAwB,EAAE,aAAa;AAAA,EAClD,SAAS;AACX,CAAC;AACM,IAAM,gCAAgC,EAAE,aAAa;AAAA,EAC1D,YAAY;AAAA,EACZ,qBAAqB,EAAE,QAAQ,wBAAwB,yBAAyB;AAAA,EAChF,gBAAgB,eAAe,SAAS;AAAA,EACxC,eAAe;AACjB,CAAC;AACM,IAAM,gCAAgC,EAAE,aAAa;AAAA,EAC1D,eAAe,2BAA2B,SAAS;AAAA,EACnD,UAAU,sBAAsB,SAAS;AAC3C,CAAC;AACM,IAAM,oCAAoC;AAC1C,IAAM,iCAAiC;AACvC,IAAM,kCAAkC;AAkB/C,SAAS,8BAAsC;AAC7C,QAAM,aAAa,QAAQ,IAAI,cAAc,QAAQ,IAAI;AACzD,MAAI,eAAe,UAAa,CAAC,KAAK,MAAM,WAAW,UAAU,GAAG;AAClE,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AACA,SAAO,KAAK,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,iBACb,WACA,MACA,YACe;AACf,MAAI;AACF,UAAM;AAAA,MACJ,4BAA4B;AAAA,MAC5B,CAAC,WAAW,cAAc,mBAAmB,YAAY,kBAAkB;AAAA,MAC3E;AAAA,QACE,UAAU;AAAA,QACV,KAAK;AAAA,UACH,GAAG,QAAQ;AAAA,UACX,oBAAoB;AAAA,UACpB,yBAAyB,aAAa,eAAe;AAAA,UACrD,sBAAsB;AAAA,QACxB;AAAA,QACA,SAAS;AAAA,QACT,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF,SAAS,OAAgB;AACvB,UAAM,IAAI,eAAe,YAAY,qBAAqB,QAAW;AAAA,MACnE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,iCACpB,WACA,MACgB;AAChB,QAAM,SAAS,MAAM,MAAM,SAAS;AACpC,QAAM,cAAc,SAAS,cAAc,OAAO,YAAY,IAAI,OAAO,OAAO;AAEhF,MAAI,CAAC,eAAe,OAAO,eAAe,GAAG;AAC3C,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,MAAI,QAAQ,aAAa,SAAS;AAChC,aAAS,UAAU,GAAG,UAAU,6BAA6B,WAAW,GAAG;AACzE,UAAI;AACF,cAAM,iBAAiB,WAAW,MAAM,KAAK;AAC7C,eAAO;AAAA,MACT,SAAS,OAAgB;AACvB,YAAI,YAAY,8BAA8B,EAAG,OAAM;AACvD,YAAI;AACJ,YAAI;AACF,oBAAU,MAAM,MAAM,SAAS;AAAA,QACjC,QAAQ;AACN,gBAAM;AAAA,QACR;AACA,cAAM,WACJ,SAAS,cAAc,QAAQ,YAAY,IAAI,QAAQ,OAAO;AAChE,YACE,CAAC,YACD,QAAQ,eAAe,KACvB,QAAQ,QAAQ,OAAO,OACvB,QAAQ,QAAQ,OAAO,KACvB;AACA,gBAAM;AAAA,QACR;AACA,cAAM,IAAI,QAAc,CAAC,YAAY;AACnC,qBAAW,SAAS,8BAA8B,UAAU,EAAE;AAAA,QAChE,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,QAAQ,SAAS;AAC7B,MAAI,QAAQ,UAAa,OAAO,QAAQ,QAAQ,OAAO,OAAO,QAAW,GAAG;AAC1E,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,SAAO;AACT;AAEA,eAAsB,qCACpB,WACe;AACf,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,iBAAiB,WAAW,QAAQ,IAAI;AAAA,EAChD;AACF;AAEA,eAAe,2BAA2B,WAAkC;AAC1E,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,iBAAiB,WAAW,aAAa,IAAI;AAAA,EACrD;AACF;AAEA,eAAe,0BACb,MACA,QACiB;AACjB,QAAM,YAAY,KAAK,KAAK,MAAM,WAAW;AAC7C,MAAI,UAAU;AAEd,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,MAAM,WAAW,EAAE,MAAM,IAAM,CAAC;AACtC,gBAAU;AAAA,IACZ,SAAS,OAAgB;AACvB,UAAK,MAAgC,SAAS,UAAU;AACtD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAS,OAAM,2BAA2B,SAAS;AACvD,QAAM,iCAAiC,WAAW,WAAW;AAC7D,SAAO,SAAS,SAAS;AAC3B;AAEA,eAAe,+BAA+B,QAAkC;AAC9E,QAAM,iBAAiB,QAAQ,IAAI;AAEnC,MAAI,mBAAmB,UAAa,CAAC,KAAK,WAAW,cAAc,GAAG;AACpE,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,QAAM,OAAO,kBAAkB,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,OAAO;AACzE,QAAM,YAAY,KAAK,KAAK,MAAM,aAAa,2BAA2B;AAC1E,MAAI,UAAU;AAEd,MAAI,QAAQ;AACV,cAAW,MAAM,MAAM,WAAW,EAAE,MAAM,KAAO,WAAW,KAAK,CAAC,MAAO;AAAA,EAC3E;AAEA,MAAI,QAAS,OAAM,2BAA2B,SAAS;AACvD,QAAM,iCAAiC,WAAW,WAAW;AAC7D,SAAO,SAAS,SAAS;AAC3B;AAEA,eAAsB,uCACpB,QACiB;AACjB,QAAM,sBAAsB,QAAQ,IAAI;AAExC,MAAI,wBAAwB,UAAa,CAAC,KAAK,WAAW,mBAAmB,GAAG;AAC9E,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,MAAI,wBAAwB,QAAW;AACrC,QAAI;AACF,UAAI,QAAQ,aAAa,SAAS;AAChC,cAAM,iCAAiC,qBAAqB,WAAW;AAAA,MACzE;AACA,aAAO,MAAM,0BAA0B,qBAAqB,MAAM;AAAA,IACpE,SAAS,OAAgB;AACvB,UAAI,CAAC,UAAW,MAAgC,SAAS,UAAU;AACjE,cAAM,IAAI,eAAe,YAAY,iBAAiB;AAAA,MACxD;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,QAAQ,aAAa,SAAS;AAChC,QAAI;AACF,aAAO,MAAM,+BAA+B,MAAM;AAAA,IACpD,SAAS,OAAgB;AACvB,UAAI,CAAC,UAAW,MAAgC,SAAS,UAAU;AACjE,cAAM,IAAI,eAAe,YAAY,iBAAiB;AAAA,MACxD;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,QAAQ,SAAS;AAC7B,MAAI,QAAQ,QAAW;AACrB,UAAM,IAAI,eAAe,YAAY,mBAAmB;AAAA,EAC1D;AAEA,QAAM,WAAW,KAAK,KAAK,GAAG,OAAO,GAAG,aAAa,OAAO,GAAG,CAAC,EAAE;AAElE,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,MAAM,UAAU,EAAE,MAAM,IAAM,CAAC;AAAA,IACvC,SAAS,OAAgB;AACvB,UAAK,MAAgC,SAAS,UAAU;AACtD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,iCAAiC,UAAU,WAAW;AAAA,EAC9D,SAAS,OAAgB;AACvB,QAAI,CAAC,UAAW,MAAgC,SAAS,UAAU;AACjE,YAAM,IAAI,eAAe,YAAY,iBAAiB;AAAA,IACxD;AAEA,UAAM;AAAA,EACR;AAEA,SAAO,SAAS,QAAQ;AAC1B;AAEA,eAAsB,iCAAiC,MAA+B;AACpF,QAAM,gBAAgB,MAAM,SAAS,IAAI;AACzC,SAAO,WAAW,QAAQ,EACvB,OAAO,GAAG,iCAAiC,KAAK,aAAa,EAAE,EAC/D,OAAO,KAAK;AACjB;","names":[]}

package/dist/external-handoff-browser.d.cts

@@ -1,6 +1,6 @@
-export { A as ActiveAdapterSummary, D as DispatchSummary, b as EXTERNAL_HANDOFF_ACTIVE_ADAPTER_KINDS, c as EXTERNAL_HANDOFF_ACTIVE_ADAPTER_STATES, d as EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION, e as EXTERNAL_HANDOFF_DISPATCH_PHASES, f as EXTERNAL_HANDOFF_FRAMEWORKS, g as EXTERNAL_HANDOFF_REPORTABLE_DISPATCH_PHASES, h as EXTERNAL_HANDOFF_SNAPSHOT_SCHEMA_VERSION, i as EXTERNAL_HANDOFF_STATES, j as ExternalHandoffActiveAdapterKind, k as ExternalHandoffActiveAdapterState, l as ExternalHandoffCapability, m as ExternalHandoffDispatchPhase, n as ExternalHandoffFramework, o as ExternalHandoffPublishDelivery, p as ExternalHandoffPublishRequest, q as ExternalHandoffPublishResult, r as ExternalHandoffReportableDispatchPhase, s as ExternalHandoffResolveDeliveryRequest, a as ExternalHandoffSnapshot, t as ExternalHandoffState, u as ExternalHandoffStatusRequest, v as ExternalHandoffStatusResult, w as ExternalHandoffSummary } from './external-handoff-DeiIvR-2.cjs';
+export { A as ActiveAdapterSummary, D as DispatchSummary, b as EXTERNAL_HANDOFF_ACTIVE_ADAPTER_KINDS, c as EXTERNAL_HANDOFF_ACTIVE_ADAPTER_STATES, d as EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION, e as EXTERNAL_HANDOFF_DISPATCH_PHASES, f as EXTERNAL_HANDOFF_FRAMEWORKS, g as EXTERNAL_HANDOFF_REPORTABLE_DISPATCH_PHASES, h as EXTERNAL_HANDOFF_SNAPSHOT_SCHEMA_VERSION, i as EXTERNAL_HANDOFF_STATES, j as ExternalHandoffActiveAdapterKind, k as ExternalHandoffActiveAdapterState, l as ExternalHandoffCapability, m as ExternalHandoffDispatchPhase, n as ExternalHandoffFramework, o as ExternalHandoffPublishDelivery, p as ExternalHandoffPublishRequest, q as ExternalHandoffPublishResult, r as ExternalHandoffReportableDispatchPhase, s as ExternalHandoffResolveDeliveryRequest, a as ExternalHandoffSnapshot, t as ExternalHandoffState, u as ExternalHandoffStatusRequest, v as ExternalHandoffStatusResult, w as ExternalHandoffSummary } from './external-handoff-D1Ua2jIA.cjs';
 export { S as SPOTPATCH_ENDPOINTS, a as SPOTPATCH_TOKEN_HEADER } from './endpoints-O3ohYyAo.cjs';
-export { E as ExternalAgentAction, a as ExternalAgentConnectionState, b as ExternalAgentControlCancelRequest, c as ExternalAgentControlConnectRequest, d as ExternalAgentControlDisconnectRequest, e as ExternalAgentControlStatus, f as ExternalAgentErrorCode, g as ExternalAgentEvent, h as ExternalAgentEventsRequest, i as ExternalAgentManagedResult, j as ExternalAgentResultRequest } from './external-agent-control-DKxQACUv.cjs';
+export { E as ExternalAgentAction, a as ExternalAgentConnectionState, b as ExternalAgentControlCancelRequest, c as ExternalAgentControlConnectRequest, d as ExternalAgentControlDisconnectRequest, e as ExternalAgentControlStatus, f as ExternalAgentErrorCode, g as ExternalAgentEvent, h as ExternalAgentEventsRequest, i as ExternalAgentManagedResult, j as ExternalAgentResultRequest } from './external-agent-control-yC4ToQXg.cjs';
 export { S as SpotAnnotation, a as SpotPatchLocale } from './annotation-Cz-NNgR4.cjs';
 import 'zod';
 

package/dist/external-handoff-browser.d.ts

@@ -1,6 +1,6 @@
-export { A as ActiveAdapterSummary, D as DispatchSummary, b as EXTERNAL_HANDOFF_ACTIVE_ADAPTER_KINDS, c as EXTERNAL_HANDOFF_ACTIVE_ADAPTER_STATES, d as EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION, e as EXTERNAL_HANDOFF_DISPATCH_PHASES, f as EXTERNAL_HANDOFF_FRAMEWORKS, g as EXTERNAL_HANDOFF_REPORTABLE_DISPATCH_PHASES, h as EXTERNAL_HANDOFF_SNAPSHOT_SCHEMA_VERSION, i as EXTERNAL_HANDOFF_STATES, j as ExternalHandoffActiveAdapterKind, k as ExternalHandoffActiveAdapterState, l as ExternalHandoffCapability, m as ExternalHandoffDispatchPhase, n as ExternalHandoffFramework, o as ExternalHandoffPublishDelivery, p as ExternalHandoffPublishRequest, q as ExternalHandoffPublishResult, r as ExternalHandoffReportableDispatchPhase, s as ExternalHandoffResolveDeliveryRequest, a as ExternalHandoffSnapshot, t as ExternalHandoffState, u as ExternalHandoffStatusRequest, v as ExternalHandoffStatusResult, w as ExternalHandoffSummary } from './external-handoff-5zHu-fz2.js';
+export { A as ActiveAdapterSummary, D as DispatchSummary, b as EXTERNAL_HANDOFF_ACTIVE_ADAPTER_KINDS, c as EXTERNAL_HANDOFF_ACTIVE_ADAPTER_STATES, d as EXTERNAL_HANDOFF_BROKER_PROTOCOL_VERSION, e as EXTERNAL_HANDOFF_DISPATCH_PHASES, f as EXTERNAL_HANDOFF_FRAMEWORKS, g as EXTERNAL_HANDOFF_REPORTABLE_DISPATCH_PHASES, h as EXTERNAL_HANDOFF_SNAPSHOT_SCHEMA_VERSION, i as EXTERNAL_HANDOFF_STATES, j as ExternalHandoffActiveAdapterKind, k as ExternalHandoffActiveAdapterState, l as ExternalHandoffCapability, m as ExternalHandoffDispatchPhase, n as ExternalHandoffFramework, o as ExternalHandoffPublishDelivery, p as ExternalHandoffPublishRequest, q as ExternalHandoffPublishResult, r as ExternalHandoffReportableDispatchPhase, s as ExternalHandoffResolveDeliveryRequest, a as ExternalHandoffSnapshot, t as ExternalHandoffState, u as ExternalHandoffStatusRequest, v as ExternalHandoffStatusResult, w as ExternalHandoffSummary } from './external-handoff-BpoxbpPk.js';
 export { S as SPOTPATCH_ENDPOINTS, a as SPOTPATCH_TOKEN_HEADER } from './endpoints-O3ohYyAo.js';
-export { E as ExternalAgentAction, a as ExternalAgentConnectionState, b as ExternalAgentControlCancelRequest, c as ExternalAgentControlConnectRequest, d as ExternalAgentControlDisconnectRequest, e as ExternalAgentControlStatus, f as ExternalAgentErrorCode, g as ExternalAgentEvent, h as ExternalAgentEventsRequest, i as ExternalAgentManagedResult, j as ExternalAgentResultRequest } from './external-agent-control-DKxQACUv.js';
+export { E as ExternalAgentAction, a as ExternalAgentConnectionState, b as ExternalAgentControlCancelRequest, c as ExternalAgentControlConnectRequest, d as ExternalAgentControlDisconnectRequest, e as ExternalAgentControlStatus, f as ExternalAgentErrorCode, g as ExternalAgentEvent, h as ExternalAgentEventsRequest, i as ExternalAgentManagedResult, j as ExternalAgentResultRequest } from './external-agent-control-yC4ToQXg.js';
 export { S as SpotAnnotation, a as SpotPatchLocale } from './annotation-Cz-NNgR4.js';
 import 'zod';
 

package/dist/index.cjs

@@ -393,7 +393,8 @@ var CONTEXTUAL_ASK_LIMITS = Object.freeze({
 });
 var CONTEXTUAL_ASK_EXECUTOR_KINDS = Object.freeze([
   "configured-key",
-  "managed-codex"
+  "managed-codex",
+  "claude-code"
 ]);
 var CONTEXTUAL_ASK_EXECUTOR_STATES = Object.freeze([
   "ready",
@@ -541,7 +542,8 @@ var contextualAskExecutorPreferenceSchema = import_zod2.z.discriminatedUnion("ki
     providerProfileId: profileIdSchema,
     modelProfileId: profileIdSchema
   }),
-  import_zod2.z.strictObject({ kind: import_zod2.z.literal("managed-codex") })
+  import_zod2.z.strictObject({ kind: import_zod2.z.literal("managed-codex") }),
+  import_zod2.z.strictObject({ kind: import_zod2.z.literal("claude-code") })
 ]);
 var contextualAskOptionsSchema = import_zod2.z.union([
   import_zod2.z.boolean(),