@stackbone/cli 0.4.0 → 0.4.1

package/main.js

@@ -1427,7 +1427,9 @@ var init_errors$1 = __esmMin((() => {
 		"connector_installation_required",
 		"principal_required",
 		"access_denied",
-		"invalid_grant"
+		"invalid_grant",
+		"precondition_failed",
+		"cardinality_mismatch"
 	];
 	BROKER_ERROR_CODES = z.enum([...CONNECTOR_EXECUTION_ERROR_CODES, ...BROKER_SPECIFIC_ERROR_CODES]);
 	z.object({
@@ -1460,6 +1462,19 @@ var init_errors$1 = __esmMin((() => {
 		connector_installation_required: false,
 		/** The refresh token is dead. Needs a fresh authorization, not another try. */
 		invalid_grant: false,
+		/**
+		* A write carrying a precondition matched no rows: somebody moved the row
+		* between the read and the write, so the write was NOT applied (PLA-1403).
+		*
+		* Terminal, and this one is the whole point rather than a classification
+		* detail. The condition is a fact about the provider's current state, so the
+		* identical call refuses identically; and a retry is precisely the wrong move,
+		* because the value the caller is guarding on is the stale one. What has to
+		* happen next is a fresh read, which only the caller can do.
+		*/
+		precondition_failed: false,
+		/** A narrower target is needed; repeating the same write exceeds the same limit. */
+		cardinality_mismatch: false,
 		/** Transport, or the provider answering 5xx. */
 		execute_failed: true,
 		/** The deadline passed. The next attempt may fit inside it. */
@@ -1479,7 +1494,6 @@ var init_errors$1 = __esmMin((() => {
 		no_token: true,
 		user_authorization_required: true
 	};
-	Object.entries(BROKER_ERROR_RETRYABILITY).filter(([, retryable]) => !retryable).map(([code]) => code);
 	REASON_ALIASES = { app_not_installed: "connector_installation_required" };
 }));
 //#endregion
@@ -1969,7 +1983,19 @@ var init_connect_surface = __esmMin((() => {
 		error: z.object({
 			/** The broker taxonomy code, e.g. `not_found`, `no_token`, `execute_failed`. */
 			code: z.string(),
-			message: z.string()
+			message: z.string(),
+			/**
+			* The broker's own retry classification, decided one code at a time and
+			* overridable per site. It has to cross the wire (PLA-1349): the workflow
+			* engine re-runs a failed step unless the error is fatal, and the SDK cannot
+			* mark it fatal from a code alone without keeping a second copy of the
+			* taxonomy that would drift from the broker's.
+			*
+			* Optional because an older box may not send it, and an absent value means
+			* "not classified" rather than "retryable" — the SDK leaves such a failure
+			* retryable, which is the safe direction for a transient outage.
+			*/
+			retryable: z.boolean().optional()
 		})
 	});
 	connectEvictResponseSchema = z.object({
@@ -9694,14 +9720,17 @@ var init_connector_invoker = __esmMin((() => {
 * @param connector The connect connector id registered in Studio.
 * @param operation The operation / tool id to run on that connector.
 * @param args      The operation arguments (path/query/body params). Defaults `{}`.
-* @param opts      Optional `{ principal }` — defaults to `{ type: 'app' }`.
+* @param opts      Optional `{ principal, idempotent }`. `principal` defaults to
+*                  `{ type: 'app' }`; `idempotent` is UNSET by default and only
+*                  an explicit `false` changes how a failure is retried.
 */
 async function callConnector(connector, operation, args, opts) {
 	return (await getConnectorInvoker().invoke({
 		connector,
 		operation,
 		...args !== void 0 ? { args } : {},
-		...opts?.principal !== void 0 ? { principal: opts.principal } : {}
+		...opts?.principal !== void 0 ? { principal: opts.principal } : {},
+		...opts?.idempotent !== void 0 ? { idempotent: opts.idempotent } : {}
 	})).output;
 }
 var connectorHandle, connection;
@@ -15221,7 +15250,8 @@ var createTriggerSubscriptionsStore = (opts) => {
 			assertOpen();
 			await pool.query(`UPDATE stackbone_platform.trigger_deliveries
             SET status = 'rejected', issues = $3::jsonb, updated_at = now()
-          WHERE subscription_id = $1::uuid AND provider_item_id = $2`, [
+          WHERE subscription_id = $1::uuid AND provider_item_id = $2
+            AND status IN ('claimed', 'starting')`, [
 				subscriptionId,
 				providerItemId,
 				JSON.stringify(issues)
@@ -15669,7 +15699,7 @@ var emulatorCors = (allowlist) => cors({
 var STACKBONE_CLI_BUILD_VERSION, EMULATOR_CAPABILITY_ROUTES, EMULATOR_CAPABILITIES, buildContractResponse;
 var init_contract = __esmMin((() => {
 	init_src$19();
-	STACKBONE_CLI_BUILD_VERSION = "0.4.0";
+	STACKBONE_CLI_BUILD_VERSION = "0.4.1";
 	EMULATOR_CAPABILITY_ROUTES = {
 		"database.postgres_direct": "/api/db",
 		"rag.basic": "/api/rag",
@@ -30692,6 +30722,8 @@ var init_types$1 = __esmMin((() => {
 		description: z.string().optional(),
 		parameters: z.array(operationParameterSchema).optional(),
 		requestBodySchema: z.unknown().optional(),
+		/** Original Swagger body parameter name; allows body values alongside query filters. */
+		bodyArgName: z.string().optional(),
 		responseSchema: z.unknown().optional(),
 		/**
 		* This operation's body is BYTES, not JSON. The executor then resolves the
@@ -31615,7 +31647,9 @@ var init_types = __esmMin((() => {
 			/** A policy denial on a VALID key: no credential eviction, no retry loop. */
 			accessDenied: z.array(z.string()).default([]),
 			/** A data conflict on a write (unique / FK violation): terminal, handleable. */
-			conflict: z.array(z.string()).default([])
+			conflict: z.array(z.string()).default([]),
+			/** The provider rejected a write that exceeded its requested row limit. */
+			cardinalityMismatch: z.array(z.string()).optional()
 		}).optional(),
 		/**
 		* The query parameter that carries "which columns to return" on this
@@ -33944,7 +33978,8 @@ var init_supabase_connector = __esmMin((() => {
 				"42"
 			],
 			accessDenied: ["42501"],
-			conflict: ["23"]
+			conflict: ["23"],
+			cardinalityMismatch: ["PGRST124"]
 		},
 		scopes: [],
 		triggers: [{
@@ -34465,6 +34500,7 @@ function buildOperation(rawPath, resolvedPath, method, operation, pathLevelParam
 	const parameters = [];
 	const seen = /* @__PURE__ */ new Set();
 	let bodyParamSchema;
+	let bodyArgName;
 	for (let i = rawParameters.length - 1; i >= 0; i--) {
 		const raw = derefParameter(rawParameters[i], root);
 		if (raw === void 0) {
@@ -34474,7 +34510,10 @@ function buildOperation(rawPath, resolvedPath, method, operation, pathLevelParam
 		if (isRecord$2(raw) && source === "swagger") {
 			const location = asString$1(raw["in"]);
 			if (location === "body") {
-				if (bodyParamSchema === void 0 && raw["schema"] !== void 0) bodyParamSchema = raw["schema"];
+				if (bodyParamSchema === void 0 && raw["schema"] !== void 0) {
+					bodyParamSchema = raw["schema"];
+					bodyArgName = asString$1(raw["name"]);
+				}
 				continue;
 			}
 			if (location === "formData") {
@@ -34507,6 +34546,7 @@ function buildOperation(rawPath, resolvedPath, method, operation, pathLevelParam
 		...description !== void 0 ? { description } : {},
 		...parameters.length > 0 ? { parameters } : {},
 		...requestBodySchema !== void 0 ? { requestBodySchema } : {},
+		...bodyArgName !== void 0 ? { bodyArgName } : {},
 		...responseSchema !== void 0 ? { responseSchema } : {},
 		...rawBody ? { rawBody } : {},
 		...rawResponse !== void 0 ? { rawResponse } : {},
@@ -36148,17 +36188,18 @@ function narrows(value, narrowingOperators) {
 	return !(operator === "is" && NEGATED_IS.has(rest.toLowerCase()));
 }
 /**
-* Should this call be refused as an unfiltered delete?
+* Should this call be refused as an unfiltered DELETE or PATCH?
 *
 * Returns the refusal — `invalid_args`, not retryable, naming the columns that
-* would narrow it — or `null` when the call may proceed. Applies to DELETE
-* only: a read with no filter is a legitimate "select everything", and an
-* unfiltered PATCH, while sweeping, writes the caller's own values rather than
-* destroying data it never saw.
+* would narrow it — or `null` when the call may proceed. DELETE and PATCH
+* both affect existing rows. Reads and inserts keep their existing behavior.
+* Only declared query arguments count; values inside the named body do not.
 */
 function unfilteredDeleteError(def, operation, args) {
 	const guard = def.unfilteredDeleteGuard;
-	if (guard === void 0 || operation.method.toUpperCase() !== "DELETE") return null;
+	const method = operation.method.toUpperCase();
+	if (guard === void 0 || method !== "DELETE" && method !== "PATCH") return null;
+	const effect = method === "PATCH" ? "update" : "remove";
 	const nonFilter = new Set(guard.nonFilterParams);
 	const filterParams = (operation.parameters ?? []).filter((param) => param.in === "query" && !nonFilter.has(param.name)).map((param) => param.name);
 	const present = filterParams.filter((name) => {
@@ -36169,9 +36210,9 @@ function unfilteredDeleteError(def, operation, args) {
 	if (narrowingOperators === void 0) {
 		if (present.length > 0) return null;
 	} else if (present.some((name) => narrows(args[name], narrowingOperators))) return null;
-	if (narrowingOperators !== void 0 && present.length > 0) return refusal(operation, `no filter it carries narrows which rows go, so it would remove every row in the table.`, `Filters read: ${present.join(", ")}. Narrow it with one of: ${narrowingOperators.join(", ")}.`);
-	if (filterParams.length === 0) return refusal(operation, "a delete with no row filter would remove every row in the table.", "The operation declares no filterable parameter, so nothing could narrow it.");
-	return refusal(operation, "a delete with no row filter would remove every row in the table.", `Add at least one column filter: ${filterParams.join(", ")}.`);
+	if (narrowingOperators !== void 0 && present.length > 0) return refusal(operation, `no filter it carries narrows which rows go, so it would ${effect} every row in the table.`, `Filters read: ${present.join(", ")}. Narrow it with one of: ${narrowingOperators.join(", ")}.`);
+	if (filterParams.length === 0) return refusal(operation, `a ${method.toLowerCase()} with no row filter would ${effect} every row in the table.`, "The operation declares no filterable parameter, so nothing could narrow it.");
+	return refusal(operation, `a ${method.toLowerCase()} with no row filter would ${effect} every row in the table.`, `Add at least one column filter: ${filterParams.join(", ")}.`);
 }
 /** The one refusal shape, so every path names the operation the same way. */
 function refusal(operation, reason, remedy) {
@@ -36261,6 +36302,7 @@ function classifyProviderError(def, status, body, operationId) {
 	if (matched !== null && provider !== null) {
 		const said = providerSaid(provider);
 		switch (matched) {
+			case "cardinalityMismatch": return makeBrokerError("cardinality_mismatch", `operation "${operationId}" exceeded the provider's requested row limit: ${said}`);
 			case "invalidArgs": return makeBrokerError("invalid_args", `operation "${operationId}" was refused by the provider as a bad request: ${said}`);
 			case "accessDenied": return makeBrokerError("access_denied", `operation "${operationId}" was denied by the provider's own policy — the credential is valid, the policy said no: ${said}`, false);
 			case "conflict": return makeBrokerError("execute_failed", `operation "${operationId}" hit a constraint conflict: ${said}`, false);
@@ -36295,7 +36337,8 @@ function longestMatch(classes, code) {
 	const lists = [
 		["invalidArgs", classes.invalidArgs],
 		["accessDenied", classes.accessDenied],
-		["conflict", classes.conflict]
+		["conflict", classes.conflict],
+		["cardinalityMismatch", classes.cardinalityMismatch ?? []]
 	];
 	for (const [kind, prefixes] of lists) for (const prefix of prefixes) if (code.startsWith(prefix) && (best === null || prefix.length > best.prefix.length)) best = {
 		prefix,
@@ -36578,14 +36621,66 @@ async function runOperation(def, operation, args, token, http, timeoutMs, opts =
 		headerValue: responseHeader(response, continuation.urlHeader)
 	}) : void 0;
 	const output = response.ok && wantsRawResponse(operation, args) ? await storeRawResponse(operation, args, response, opts) : await parseResponse(response);
+	const matchedRows = matchedRowTotal(response);
 	return {
 		status: response.status,
 		ok: response.ok,
 		output,
+		...matchedRows !== void 0 ? { matchedRows } : {},
 		...continuationUrl !== void 0 ? { continuationUrl } : {}
 	};
 }
 /**
+* The TOTAL out of a `Content-Range` response header — how many rows the call
+* matched — or `undefined` when the provider did not count.
+*
+* `Content-Range` is `<first>-<last>/<total>`, and either half may be `*`. The
+* range says which rows came back in THIS response and the total says how many
+* exist; only the total answers "did my filter hit anything", because a write
+* that asks for no representation returns no rows either way. Measured against
+* PostgREST v12.2.3: a matched update answers `0-0/1`, one that matched nothing
+* answers a star range over a zero total, and one that asked for no count
+* answers a star over a star (`docs/investigations/pla-1345/README-live.md`).
+*
+* A `*` total is dropped rather than read as zero. That distinction is the guard
+* on the whole feature: see `matchedRows`.
+*/
+function matchedRowTotal(response) {
+	const total = responseHeader(response, "Content-Range")?.split("/")[1];
+	if (total === void 0 || total === "*") return void 0;
+	const parsed = Number(total);
+	return Number.isInteger(parsed) && parsed >= 0 ? parsed : void 0;
+}
+/**
+* Did a write carrying a precondition match nothing (PLA-1403)?
+*
+* Returns the terminal refusal, or `null` when the call may be reported as the
+* success it looks like. A conditional write sends the value it read as part of
+* the row filter, so a row somebody else moved matches nothing and is left
+* alone — the protection working. Without this the caller cannot tell, because
+* `execute` returns `{ ok: true, output }` and the count never leaves the
+* broker.
+*
+* TWO conditions, and both are load-bearing:
+*
+*   * The method changes EXISTING rows: `PATCH` and `DELETE`, the same pair
+*     `unfilteredDeleteError` guards. A `GET` that matches nothing is a correct
+*     answer to a question and must stay a success — the one case this must
+*     never break. `POST` is out because an insert matches nothing by
+*     definition, and `PUT` is out because PostgREST upserts on it: a PUT that
+*     matches nothing CREATES the row, so zero matched is not a refusal there.
+*     Unmeasured on our side, which is the second reason to leave it out.
+*   * The provider reported a total of exactly zero, which it only does when the
+*     caller asked for the count. Asking IS the declaration, so a write that did
+*     not ask keeps the behaviour it has always had. An empty body is NOT the
+*     trigger.
+*/
+function unmatchedWriteError(operation, matchedRows, operationId) {
+	const method = operation.method.toUpperCase();
+	if (matchedRows !== 0 || method !== "PATCH" && method !== "DELETE") return null;
+	return makeBrokerError("precondition_failed", `operation "${operationId}" matched no rows, so it changed nothing — the row moved since it was read. Re-read it and decide.`);
+}
+/**
 * Render a parsed operation-call body to a short single-line string for an error
 * message. Shared by the action executor (here) and the inbound-trigger poll
 * context, so the two never drift. `empty` is returned for null/undefined (the
@@ -36599,13 +36694,36 @@ function formatOperationBody(output, opts = {}) {
 	return max > 0 && text.length > max ? `${text.slice(0, max)}…` : text;
 }
 /**
+* Fallback classification after provider-specific body codes (PLA-1321).
+* Known input, access and resource refusals are terminal. Unclassified statuses
+* retain the existing unknown-outcome policy, including 409: conflict vocabulary
+* is outside this slice. The caller's idempotency option still governs that path.
+*/
+function brokerCodeForProviderStatus(status) {
+	switch (status) {
+		case 400:
+		case 405:
+		case 422: return "invalid_args";
+		case 403: return "access_denied";
+		case 404:
+		case 410: return "not_found";
+		default: return "execute_failed";
+	}
+}
+/**
 * Build the JSON request body for an OpenAPI operation. When the operation
-* declares a request body, every payload key that is NOT a declared path/query/
+* names a Swagger body argument containing an object, send that object directly.
+* Otherwise, every payload key that is NOT a declared path/query/
 * header param becomes the body. Sets `content-type` when a body is produced.
 * Returns `undefined` for body-less operations (e.g. GET).
 */
 function buildRequestBody(operation, args, headers) {
 	if (operation.requestBodySchema === void 0) return void 0;
+	const namedBody = operation.bodyArgName === void 0 ? void 0 : args[operation.bodyArgName];
+	if (namedBody !== null && typeof namedBody === "object") {
+		headers["content-type"] = "application/json";
+		return JSON.stringify(namedBody);
+	}
 	const consumed = /* @__PURE__ */ new Set();
 	for (const param of operation.parameters ?? []) if (param.in === "path" || param.in === "query" || param.in === "header") consumed.add(param.name);
 	for (const arg of brokerConsumedArgs(operation)) consumed.add(arg.name);
@@ -36786,6 +36904,41 @@ function fail(error) {
 		error
 	};
 }
+/**
+* A PROVIDER ROUND-TRIP that failed with an outcome nobody here can determine,
+* classified against the caller's own idempotency assertion (PLA-1349).
+*
+* `execute_failed` and `timeout` are the two retryable codes in
+* `BROKER_ERROR_RETRYABILITY`, and that default is right: a transport failure or
+* a gateway 5xx usually did not land. But they are also the only two where it
+* MIGHT have — the provider committed and the response was lost, or the deadline
+* fired after the write was accepted and the abort only closed the socket. A
+* durable step is retried whole, so retrying one of these re-sends the write and
+* one run creates two objects.
+*
+* Which of the two it is cannot be read off the code, the status or the connector
+* definition: `commentCreate` and `listComments` fail identically, and an
+* operation the provider deduplicates only deduplicates when the CALLER minted
+* the key. So the caller states it and this decides accordingly:
+*
+* - `false` → `retryable: false`. The SDK turns that into `fatal: true`, the
+*   engine stops the step on its first failure, and a human reconciles. Same
+*   trade the World already made for a dispatch past `httpTimeoutMs`.
+* - `true`, or NOT STATED → the code's own default, untouched. Passing
+*   `undefined` as the override is byte-identical to omitting the argument, which
+*   is what keeps an unstated option a true no-op.
+*
+* ONLY these two codes go through here. A code that was already terminal stays
+* terminal with no second decision, and a retryable code whose outcome is KNOWN —
+* a 401 the provider refused before doing anything, a stale-spec refusal, a 429
+* a rate limiter answered in front of the operation, a 408 for a request the
+* provider never received whole — keeps its retry, because there is nothing to
+* reconcile. Callers pass `undefined` for those rather than the assertion; see
+* the provider non-2xx exit.
+*/
+function unknownOutcome(code, message, idempotent) {
+	return makeBrokerError(code, message, idempotent === false ? false : void 0);
+}
 function messageOf$6(err) {
 	return err instanceof Error ? err.message : String(err);
 }
@@ -36840,7 +36993,7 @@ var init_connect_action_executor = __esmMin((() => {
 			this.resumableStallTimeoutMs = deps.resumableStallTimeoutMs ?? 45e3;
 		}
 		async execute(input) {
-			const { orgId, runId, connectConnectorId, connectOperationId, payload } = input;
+			const { orgId, runId, connectConnectorId, connectOperationId, payload, idempotent } = input;
 			const runDef = runId !== void 0 ? await this.deps.runConnectors?.resolve(runId, orgId, connectConnectorId) ?? null : null;
 			const record = await this.deps.connectorRows?.resolve(orgId, connectConnectorId) ?? null;
 			let def;
@@ -36903,13 +37056,13 @@ var init_connect_action_executor = __esmMin((() => {
 					if (followUp === void 0) return this.missingFromSpec(specEntry, cached, `operation "${connectOperationId}" continues as "${declared.operationId}", which is not on connector "${connectConnectorId}"`);
 					if (declared.operationId === operation.operationId) return fail(makeBrokerError("invalid_args", `operation "${connectOperationId}" declares itself as its own continuation; a two-phase call needs a second, different operation`));
 				}
-				return this.runOpenApi(def, operation, payload, tokenResponse, caller, specEntry, cached, followUp);
+				return this.runOpenApi(def, operation, payload, tokenResponse, caller, specEntry, cached, followUp, idempotent);
 			}
 			const tool = findTool(introspection.tools, connectOperationId);
 			if (tool === void 0) return this.missingFromSpec(specEntry, cached, `tool "${connectOperationId}" not found on connector "${connectConnectorId}"`);
-			return this.runMcp(def, tool, payload, tokenResponse, caller);
+			return this.runMcp(def, tool, payload, tokenResponse, caller, idempotent);
 		}
-		async runOpenApi(def, operation, payload, token, caller, specEntry, cached, followUp) {
+		async runOpenApi(def, operation, payload, token, caller, specEntry, cached, followUp, idempotent) {
 			const args = isRecord$1(payload) ? payload : {};
 			for (const phase of followUp === void 0 ? [operation] : [operation, followUp]) {
 				const refused = unfilteredDeleteError(def, phase, args);
@@ -36933,11 +37086,12 @@ var init_connect_action_executor = __esmMin((() => {
 					});
 				}
 			} catch (err) {
-				if (err instanceof ActionTimeoutError) return fail(makeBrokerError("timeout", `operation "${reported.operationId}" timed out`));
-				if (isTransferStalled(err)) return fail(makeBrokerError("timeout", `operation "${reported.operationId}" stalled mid-transfer: ${messageOf$6(err)}`));
-				if (err instanceof ContinuationError) return fail(makeBrokerError(err.code, err.message, err.retryable));
-				if (err instanceof RawBodyError || err instanceof RawResponseError) return fail(makeBrokerError(err.code, err.message));
-				return fail(makeBrokerError("execute_failed", messageOf$6(err)));
+				if (err instanceof ActionTimeoutError) return fail(unknownOutcome("timeout", `operation "${reported.operationId}" timed out`, idempotent));
+				if (isTransferStalled(err)) return fail(unknownOutcome("timeout", `operation "${reported.operationId}" stalled mid-transfer: ${messageOf$6(err)}`, idempotent));
+				if (err instanceof ContinuationError) return fail(makeBrokerError(err.code, err.message, idempotent === false ? false : err.retryable));
+				if (err instanceof RawResponseError) return fail(makeBrokerError(err.code, err.message, idempotent === false ? false : void 0));
+				if (err instanceof RawBodyError) return fail(makeBrokerError(err.code, err.message));
+				return fail(unknownOutcome("execute_failed", messageOf$6(err), idempotent));
 			}
 			const classified = classifyProviderError(def, result.status, result.output, reported.operationId);
 			if (classified?.code === "access_denied") return fail(classified);
@@ -36948,8 +37102,13 @@ var init_connect_action_executor = __esmMin((() => {
 				const body = formatOperationBody(result.output);
 				if (specEntry !== null && cached?.servedFromCache() === true && isStaleSpecError(def, result.output)) return this.onStaleSpec(specEntry, `operation "${reported.operationId}" failed with status ${result.status} against a stale spec${body ? `: ${body}` : ""}`);
 				if (classified !== null) return fail(classified);
-				return fail(makeBrokerError("execute_failed", `operation "${reported.operationId}" failed with status ${result.status}${body ? `: ${body}` : ""}`));
+				const code = brokerCodeForProviderStatus(result.status);
+				const message = `operation "${reported.operationId}" failed with status ${result.status}${body ? `: ${body}` : ""}`;
+				if (code !== "execute_failed") return fail(makeBrokerError(code, message));
+				return fail(unknownOutcome("execute_failed", message, result.status === 429 || result.status === 408 ? void 0 : idempotent));
 			}
+			const unmatched = unmatchedWriteError(operation, result.matchedRows, reported.operationId);
+			if (unmatched !== null) return fail(unmatched);
 			return {
 				ok: true,
 				output: result.output
@@ -36974,7 +37133,7 @@ var init_connect_action_executor = __esmMin((() => {
 				...this.deps.maxRawResponseBytes !== void 0 ? { maxRawResponseBytes: this.deps.maxRawResponseBytes } : {}
 			};
 		}
-		async runMcp(def, tool, payload, token, caller) {
+		async runMcp(def, tool, payload, token, caller, idempotent) {
 			if (this.deps.mcp === void 0) return fail(makeBrokerError("execute_failed", `connector "${def.id}" is an MCP connector but no MCP caller was wired`));
 			let output;
 			try {
@@ -36985,9 +37144,9 @@ var init_connect_action_executor = __esmMin((() => {
 					token: token.token
 				}), this.timeoutMs);
 			} catch (err) {
-				if (err instanceof ActionTimeoutError) return fail(makeBrokerError("timeout", `tool "${tool.name}" timed out`));
+				if (err instanceof ActionTimeoutError) return fail(unknownOutcome("timeout", `tool "${tool.name}" timed out`, idempotent));
 				if (statusOf(err) === 401) return this.on401(def, caller, `tool "${tool.name}" returned 401`);
-				return fail(makeBrokerError("execute_failed", messageOf$6(err)));
+				return fail(unknownOutcome("execute_failed", messageOf$6(err), idempotent));
 			}
 			return {
 				ok: true,
@@ -51785,11 +51944,12 @@ var init_broker_refusal = __esmMin((() => {
 			case "access_denied": return 401;
 			case "invalid_args": return 400;
 			case "invalid_grant": return 400;
+			case "precondition_failed":
+			case "cardinality_mismatch": return 409;
 			case "credential_error":
 			case "execute_failed":
 			case "timeout":
 			case "invalid_output": return 502;
-			default: return 502;
 		}
 	};
 	brokerRefusal = (err) => {
@@ -53105,7 +53265,8 @@ var init_support = __esmMin((() => {
 		args: z.record(z.string(), z.unknown()).default({}),
 		principal: principalSchema.default({ type: "app" }),
 		installationId: z.string().min(1).optional(),
-		runId: z.string().min(1).optional()
+		runId: z.string().min(1).optional(),
+		idempotent: z.boolean().optional()
 	});
 	requireBrokerSignature = (secret) => async (c, next) => {
 		if (!verifyTokenRequestSignature(c, secret)) return c.json({
@@ -53123,13 +53284,15 @@ var init_support = __esmMin((() => {
 			ok: false,
 			error: {
 				code: error.code,
-				message: error.message
+				message: error.message,
+				...error.retryable !== void 0 ? { retryable: error.retryable } : {}
 			}
 		};
 		switch (statusForBrokerCode(error.code)) {
 			case 400: return c.json(body, 400);
 			case 401: return c.json(body, 401);
 			case 404: return c.json(body, 404);
+			case 409: return c.json(body, 409);
 			default: return c.json(body, 502);
 		}
 	};
@@ -53269,13 +53432,14 @@ var createConnectTokenRouter = (opts, sharedContext) => {
 		security: HMAC_ROUTE_SECURITY,
 		middleware: [requireBrokerSignature(opts.hmacSecret)],
 		summary: "Run one connector operation",
-		description: "Mints the credential, applies it in the connector’s declared placement, calls the operation and hands back ONLY its output. Nothing about the credential — not the token, not its placement — crosses this boundary, which is the whole reason a workflow step calls the box instead of the provider.\n\n`operation` names an operation id (OpenAPI) or a tool (MCP) as `GET /api/connect/connectors/{connectorId}/operations` reports it. `runId` is the one field that changes WHICH connector answers: a run wired to a stand-in reaches the stand-in and never leaves the box, which is how an eval exercises a send without sending anything.\n\nA refusal comes back in TWO shapes on the same statuses: `{ ok: false, error }` when the executor completed and the provider or the broker said no, and the box’s `{ code, message }` envelope when the request never got that far.",
+		description: "Mints the credential, applies it in the connector’s declared placement, calls the operation and hands back ONLY its output. Nothing about the credential — not the token, not its placement — crosses this boundary, which is the whole reason a workflow step calls the box instead of the provider.\n\n`operation` names an operation id (OpenAPI) or a tool (MCP) as `GET /api/connect/connectors/{connectorId}/operations` reports it. `runId` is the one field that changes WHICH connector answers: a run wired to a stand-in reaches the stand-in and never leaves the box, which is how an eval exercises a send without sending anything.\n\nA refusal comes back in TWO shapes on the same statuses: `{ ok: false, error }` when the executor completed and the provider or the broker said no, including a broker error thrown before execution completes. Signature and payload validation failures use the box’s `{ code, message }` envelope.",
 		request: { body: jsonBody(named("ConnectExecuteRequest", executeRequestSchema), "The connector, the operation, and the args to run it with.") },
 		responses: {
 			200: jsonResponse(named("ConnectExecuteSuccess", connectExecuteSuccessSchema), "The operation’s own output, passed through untouched."),
 			400: executeRefusal("The body failed its schema (`invalid_payload`), or the broker refused the arguments (`invalid_args`, `invalid_grant`)."),
 			401: executeRefusal("The signature is missing or wrong (`access_denied`), or the connector has no usable authorization (`no_token`, `user_authorization_required`, `principal_required`)."),
 			404: executeRefusal("No such connector on this box, or no such operation on it (`not_found`, `connector_installation_required`)."),
+			409: executeRefusal("The provider refused a guarded write: no rows matched (`precondition_failed`), or the requested row limit was exceeded (`cardinality_mismatch`). Terminal: change the guard or narrow the target before retrying."),
 			502: executeRefusal("The provider call failed (`execute_failed`, `timeout`, `credential_error`, `invalid_output`). Upstream, not the box.")
 		}
 	}), async (c) => {
@@ -53291,7 +53455,8 @@ var createConnectTokenRouter = (opts, sharedContext) => {
 				connectConnectorId: request.connector,
 				connectOperationId: request.operation,
 				payload: request.args,
-				...request.runId !== void 0 ? { runId: request.runId } : {}
+				...request.runId !== void 0 ? { runId: request.runId } : {},
+				...request.idempotent !== void 0 ? { idempotent: request.idempotent } : {}
 			});
 			if (result.ok) return c.json({
 				ok: true,
@@ -53299,7 +53464,8 @@ var createConnectTokenRouter = (opts, sharedContext) => {
 			}, 200);
 			return answerExecuteFailure(c, result.error);
 		} catch (err) {
-			return answerBrokerRefusal(c, err);
+			if (isBrokerError(err)) return answerExecuteFailure(c, err);
+			throw err;
 		}
 	});
 	app.openapi(createRoute({
@@ -65380,6 +65546,30 @@ var init_serial_execution_coordinator = __esmMin((() => {
 	createSerialExecutionCoordinator = (gate) => {
 		const held = /* @__PURE__ */ new Map();
 		return {
+			async beginStart(workflowName) {
+				const owner = held.get(workflowName);
+				if (!owner) return null;
+				const abandon = () => {
+					if (held.get(workflowName) === owner) held.delete(workflowName);
+				};
+				try {
+					if (!await gate.markAttempt(workflowName, owner.token)) {
+						abandon();
+						return null;
+					}
+				} catch (err) {
+					abandon();
+					throw err;
+				}
+				return {
+					noteStarted(runId) {
+						if (held.get(workflowName) === owner) owner.runId = runId;
+					},
+					acknowledge: () => gate.acknowledge(workflowName, owner.token),
+					requeue: (trigger) => gate.requeue(workflowName, trigger, owner.token),
+					abandon
+				};
+			},
 			async tryAdmit(workflowName, trigger) {
 				const verdict = await gate.tryAdmit(workflowName, trigger);
 				if (verdict.admitted) {
@@ -65420,26 +65610,34 @@ var init_serial_execution_coordinator = __esmMin((() => {
 				held.delete(workflowName);
 			},
 			async requeue(workflowName, trigger) {
-				await gate.requeue(workflowName, trigger);
+				const owner = held.get(workflowName);
+				if (owner) await gate.requeue(workflowName, trigger, owner.token);
 			}
 		};
 	};
 	createSerialSweepSupport = (deps) => {
 		const startAdmitted = async (name, trigger) => {
+			const attempt = await deps.coordinator.beginStart(name);
+			if (!attempt) return;
 			let started;
 			try {
 				started = await deps.startNext(name, trigger);
 			} catch (err) {
 				try {
-					await deps.coordinator.requeue(name, trigger);
+					await attempt.requeue(trigger);
 				} catch (requeueErr) {
 					console.warn(`[serial-execution] could not re-enqueue an unstarted trigger for "${name}": ${requeueErr instanceof Error ? requeueErr.message : String(requeueErr)}`);
 				}
-				deps.coordinator.abandon(name);
-				console.warn(`[serial-execution] failed to start admitted trigger for "${name}", re-enqueued it and released its lock: ${err instanceof Error ? err.message : String(err)}`);
+				attempt.abandon();
+				console.warn(`[serial-execution] failed to start admitted trigger for "${name}": ${err instanceof Error ? err.message : String(err)}`);
 				return;
 			}
-			deps.coordinator.noteStarted(name, started?.worldRunId);
+			attempt.noteStarted(started?.worldRunId);
+			try {
+				await attempt.acknowledge();
+			} catch (err) {
+				console.warn(`[serial-execution] could not acknowledge started trigger for "${name}": ${err instanceof Error ? err.message : String(err)}`);
+			}
 			await deps.clearWaiting?.(name, trigger.pendingId);
 		};
 		return {
@@ -67254,9 +67452,12 @@ var init_event_forwarder = __esmMin((() => {
 		* the row `claimed` while the attempt went ahead; a later swallowed `markStarted`
 		* would then leave a `claimed` row with a real run behind it, the sweep would
 		* release it, and the customer's workflow would run a second time. Failing here
-		* is instead the ordinary transient path the start and resume catches already
-		* take: nothing was attempted, so release the claim (best-effort) and bubble —
-		* the tick does not advance its cursor and the next one retries the item.
+		* instead bubbles without releasing: a failed marker cannot establish ownership,
+		* and deleting by pair could erase another writer's delivery. The tick holds its
+		* cursor. If the row remains `claimed`, recovery waits for the takeover window
+		* and consumes takeover budget, even for a transient marker failure. An applied
+		* update whose response is lost instead leaves `starting` without an attempt;
+		* this slice cannot resolve that unknown outcome (PLA-1395 investigation).
 		*
 		* Written at most once: a resume that misses falls through to the start below.
 		*/
@@ -67265,13 +67466,7 @@ var init_event_forwarder = __esmMin((() => {
 		*  one must give up where it stands. */
 		const markAttempt = async () => {
 			if (attemptMarked) return true;
-			let matched;
-			try {
-				matched = await deps.deliveries.markStarting(subscription.id, event.id);
-			} catch (err) {
-				await bestEffort(() => deps.deliveries.release(subscription.id, event.id), "release");
-				throw err;
-			}
+			const matched = await deps.deliveries.markStarting(subscription.id, event.id);
 			attemptMarked = matched;
 			return matched;
 		};
@@ -70958,7 +71153,7 @@ var calls_workflow_ts_default = "import { z } from \"zod\";\nimport { streamDeep
 var plain_workflow_ts_default = "import { z } from \"zod\";\n\n/**\n * Workflow \"{{name}}\" — a durable pipeline.\n *\n * Each `\"use step\"` is a durable checkpoint: kill the runtime mid-run and it\n * resumes from the last completed step instead of replaying everything.\n */\n\n// THE contract — sibling exports next to the bare workflow function. The build\n// harvests these (by convention) into the manifest + a live validator. The\n// parameter type is DERIVED from `inputSchema` and the RETURN type from\n// `outputSchema` (both `z.infer`), so neither side can drift from the contract\n// the build harvests. Without the return annotation the schema is published to\n// Studio and the generated types and never compared to what the body returns\n// (PLA-1272).\nexport const inputSchema = z.object({\n  message: z.string().describe(\"The input to process\"),\n});\n\nexport const outputSchema = z.object({\n  message: z.string(),\n  processed: z.boolean(),\n});\n\ntype {{Name}}Input = z.infer<typeof inputSchema>;\n\nexport async function {{export}}(input: {{Name}}Input): Promise<z.infer<typeof outputSchema>> {\n  \"use workflow\";\n\n  const result = await processMessage(input); // step 1 — durable checkpoint\n  return result;\n}\n\nasync function processMessage(input: {{Name}}Input) {\n  \"use step\";\n  // Replace this with the deterministic work of your step (DB write, HTTP call,\n  // an LLM call, …). Returning a value records it as the step's checkpoint.\n  return { message: input.message, processed: true };\n}\n";
 //#endregion
 //#region src/services/scaffold/template-loader.ts
-var SDK_TEMPLATE_VERSION = "0.4.0";
+var SDK_TEMPLATE_VERSION = "0.4.1";
 var PREFIX = "./templates/";
 var templates = new Map(Object.entries(/* @__PURE__ */ Object.assign({
 	"./templates/deep-agents/index.ts.tmpl": index_ts_default,
@@ -78802,6 +78997,7 @@ var generateConnectorTypes = (models) => {
 		HEADER,
 		"",
 		...AUGMENTED_MODULES.map((mod) => `import ${JSON.stringify(mod)};`),
+		`import type { CallConnectorOptions } from ${JSON.stringify(AUGMENTED_MODULES[0])};`,
 		"",
 		augmentations.join("\n"),
 		""
@@ -78817,15 +79013,30 @@ function renderConnectorEntry(model) {
 	].join("\n");
 }
 /**
-* One `      <op>(args: <type>): Promise<<out>>;` line (indent level 3) — or the
-* THREE overload lines a `'when-requested'` raw response takes, because one
-* signature there has two reachable outcomes.
+* One `      <op>(args: <type>, opts?: CallConnectorOptions): Promise<<out>>;` line
+* (indent level 3) — or the THREE overload lines a `'when-requested'` raw response
+* takes, because one signature there has two reachable outcomes.
 */
 function renderOperation(op) {
 	if (takesEitherOutcome(op)) return renderEitherOutcome(op);
-	return `      ${propertyKey(op.name)}(${renderParam(op)}): Promise<${renderReturn(op)}>;`;
+	return `      ${propertyKey(op.name)}(${renderParam(op)}${OPTS_PARAM}): Promise<${renderReturn(op)}>;`;
 }
 /**
+* The second parameter every generated signature carries (PLA-1349).
+*
+* `connection(id).<op>(args, opts)` has always forwarded a second argument at run
+* time (`call-connector.ts`), and no generated signature declared it — so
+* `idempotent` was reachable only through the untyped `.call(...)`, which is not
+* the path a creator is steered to. Typed as the whole options object rather than
+* one field, because PLA-1351's `echoPath` lands in exactly the same place.
+*
+* It is ALWAYS second, and `renderParam` is what guarantees that: an operation
+* with nothing to put in `args` still prints `args?: undefined` ahead of this. The
+* proxy is `(args?, opts?)` for every operation, so a signature that let `opts`
+* come first would hand the caller's options to the provider as arguments.
+*/
+var OPTS_PARAM = ", opts?: CallConnectorOptions";
+/**
 * Does ONE signature of this operation have two reachable outcomes?
 *
 * Only `'when-requested'`, and only while the switch is actually IN its arguments
@@ -78865,7 +79076,7 @@ function takesEitherOutcome(op) {
 function renderEitherOutcome(op) {
 	const receipt = printType(rawResponseReceiptJsonSchema(), 3);
 	const response = op.outputSchema === void 0 ? "unknown" : printType(op.outputSchema, 3);
-	const signature = (presence, out) => `      ${propertyKey(op.name)}(args: ${printType(withKeyPresence(op.argsSchema, presence), 3)}): Promise<${out}>;`;
+	const signature = (presence, out) => `      ${propertyKey(op.name)}(args: ${printType(withKeyPresence(op.argsSchema, presence), 3)}${OPTS_PARAM}): Promise<${out}>;`;
 	return [
 		signature("required", receipt),
 		signature("forbidden", response),
@@ -78881,6 +79092,8 @@ function renderEitherOutcome(op) {
 */
 function withKeyPresence(schema, presence) {
 	if (!isObject(schema)) return schema;
+	const union = schema["anyOf"] ?? schema["oneOf"];
+	if (Array.isArray(union)) return { anyOf: union.map((branch) => withKeyPresence(branch, presence)) };
 	const properties = { ...isObject(schema["properties"]) ? schema["properties"] : {} };
 	const required = new Set(Array.isArray(schema["required"]) ? schema["required"].filter((k) => typeof k === "string") : []);
 	if (presence === "required") required.add(RAW_RESPONSE_KEY_ARG);
@@ -78896,7 +79109,7 @@ function withKeyPresence(schema, presence) {
 }
 /** `args: <type>` for an operation with arguments, and nothing for one without. */
 function renderParam(op) {
-	return schemaHasProperties(op.argsSchema) ? `args: ${printType(op.argsSchema, 3)}` : "";
+	return schemaHasProperties(op.argsSchema) ? `args: ${printType(op.argsSchema, 3)}` : "args?: undefined";
 }
 /**
 * What the operation ACTUALLY answers (PLA-1203).
@@ -79142,8 +79355,9 @@ function answeredResponseSchema(op, byId) {
 * BROKER-consumed arguments into ONE flat args object schema — exactly how the
 * broker executor reads the payload (`args[param.name]` for path/query, the
 * broker's own keys off the raw flags, the rest as the JSON body). A non-object
-* request body (rare) is dropped from the flat shape; the dynamic form still sends
-* it.
+* request body (rare) is dropped from the flat shape. Swagger's named body is
+* also offered as an optional argument for writes whose column names overlap
+* query filters.
 *
 * The three sources are merged in the order the executor reads them, and the
 * broker's come LAST because they are the only ones it will not put on the wire.
@@ -79167,19 +79381,44 @@ function operationArgsSchema(op, trustBodyRequired) {
 		Object.assign(properties, bodyProperties);
 		if (trustBodyRequired && Array.isArray(body["required"])) required.push(...body["required"].filter((k) => typeof k === "string" && !isServerGenerated(bodyProperties[k])));
 	}
+	const bodyRequired = [...required];
+	const sharedRequired = [];
+	const consumedNames = /* @__PURE__ */ new Set();
+	if (op.bodyArgName !== void 0 && isObject(body)) {
+		const namedBody = { ...body };
+		if (!trustBodyRequired) delete namedBody["required"];
+		else if (Array.isArray(body["required"]) && isObject(body["properties"])) {
+			const bodyProperties = body["properties"];
+			namedBody["required"] = body["required"].filter((key) => typeof key === "string" && !isServerGenerated(bodyProperties[key]));
+		}
+		properties[op.bodyArgName] = namedBody;
+	}
 	for (const param of op.parameters ?? []) {
 		properties[param.name] = param.schema ?? {};
-		if (param.required) required.push(param.name);
+		consumedNames.add(param.name);
+		if (param.required) {
+			required.push(param.name);
+			sharedRequired.push(param.name);
+		}
 	}
 	for (const arg of brokerConsumedArgs(op)) {
 		properties[arg.name] = arg.schema;
-		if (arg.required) required.push(arg.name);
+		consumedNames.add(arg.name);
+		if (arg.required) {
+			required.push(arg.name);
+			sharedRequired.push(arg.name);
+		}
 	}
-	return {
+	const flat = {
 		type: "object",
 		properties,
 		...required.length > 0 ? { required: [...new Set(required)] } : {}
 	};
+	if (op.bodyArgName === void 0 || bodyRequired.length === 0 || consumedNames.has(op.bodyArgName)) return flat;
+	return { anyOf: [flat, {
+		...flat,
+		required: [...new Set([...sharedRequired, op.bodyArgName])]
+	}] };
 }
 /**
 * Whether a body property is one the SERVER produces rather than one the caller
@@ -79202,11 +79441,17 @@ function isServerGenerated(property) {
 }
 /** Whether an object schema declares ONE named property. */
 function schemaHasProperty(schema, name) {
-	return isObject(schema) && isObject(schema["properties"]) && name in schema["properties"];
+	if (!isObject(schema)) return false;
+	const union = schema["anyOf"] ?? schema["oneOf"];
+	if (Array.isArray(union)) return union.some((branch) => schemaHasProperty(branch, name));
+	return isObject(schema["properties"]) && name in schema["properties"];
 }
 /** Whether an object schema declares at least one property (else the op takes no args). */
 function schemaHasProperties(schema) {
-	return isObject(schema) && isObject(schema["properties"]) && Object.keys(schema["properties"]).length > 0;
+	if (!isObject(schema)) return false;
+	const union = schema["anyOf"] ?? schema["oneOf"];
+	if (Array.isArray(union)) return union.some(schemaHasProperties);
+	return isObject(schema["properties"]) && Object.keys(schema["properties"]).length > 0;
 }
 /**
 * Print a TypeScript type literal for a JSON Schema node. Handles the subset
@@ -81823,6 +82068,64 @@ var createDevCommand = (ctx) => defineCommand({
 	})(args)
 });
 //#endregion
+//#region ../../libs/shared/format/src/lib/coding-agent-prompt.ts
+/**
+* The pasteable prompt, and nothing around it, with no "open your coding agent"
+* preamble. Each surface draws its own instruction: the CLI as a `note`, the
+* web as the label above a copy button.
+*
+* `null` is the empty workspace, which is what the web always passes: the
+* browser cannot see which piece the reader picked at `init`'s own prompt. That
+* costs nothing, because `stackbone-coder` detects the workspace on disk by
+* itself and adds to it rather than re-scaffolding.
+*/
+function codingAgentPrompt(piece) {
+	if (!piece) return "Use the stackbone-coder skill to build my first piece in this workspace: interview me about what it should do, then wire it up.";
+	return `Use the stackbone-coder skill. The "${piece.name}" ${piece.kind} is already scaffolded in this workspace, so skip the scaffolding: interview me about what it should do, then wire it up.`;
+}
+//#endregion
+//#region ../../libs/shared/format/src/lib/coding-agents.ts
+var CODING_AGENT_LABELS = [
+	{
+		id: "claude-code",
+		label: "Claude Code"
+	},
+	{
+		id: "cursor",
+		label: "Cursor"
+	},
+	{
+		id: "github-copilot",
+		label: "GitHub Copilot (VS Code)"
+	},
+	{
+		id: "gemini-cli",
+		label: "Gemini CLI"
+	},
+	{
+		id: "windsurf",
+		label: "Windsurf"
+	},
+	{
+		id: "cline",
+		label: "Cline"
+	},
+	{
+		id: "codex",
+		label: "Codex CLI"
+	}
+];
+/**
+* Throws rather than falling back to the id: a registry row whose label is
+* missing here is a mistake to fix at build time, not a menu entry reading
+* `github-copilot`.
+*/
+var codingAgentLabel = (id) => {
+	const found = CODING_AGENT_LABELS.find((agent) => agent.id === id);
+	if (!found) throw new Error(`no label for coding agent "${id}"`);
+	return found.label;
+};
+//#endregion
 //#region src/services/coding-agents/registry.ts
 /**
 * The one place that knows which coding agents Stackbone supports and what
@@ -81831,6 +82134,10 @@ var createDevCommand = (ctx) => defineCommand({
 * that pre-ticks the menu, and the MCP config writer — so adding an agent is a
 * row here and nothing else.
 *
+* The one thing a row does NOT own is its label: that is in `@stackbone/format`,
+* because the browser renders the same list and cannot import this file — it
+* resolves paths against `homedir()` and reads `process.platform`.
+*
 * The four DIFFERENT MCP entry shapes below are the reason this is data rather
 * than a switch. There is no convention: `mcpServers` vs `servers`, `url` vs
 * `httpUrl` vs `serverUrl`, `http` vs `streamableHttp`, JSON vs TOML. Each was
@@ -81870,7 +82177,7 @@ var CODEX_MCP = {
 var CODING_AGENTS = [
 	{
 		id: "claude-code",
-		label: "Claude Code",
+		label: codingAgentLabel("claude-code"),
 		skillsId: "claude-code",
 		skillsDir: ".claude",
 		detect: [".claude", "~/.claude"],
@@ -81884,7 +82191,7 @@ var CODING_AGENTS = [
 	},
 	{
 		id: "cursor",
-		label: "Cursor",
+		label: codingAgentLabel("cursor"),
 		skillsId: "cursor",
 		skillsDir: ".agents",
 		detect: [".cursor", "~/.cursor"],
@@ -81898,7 +82205,7 @@ var CODING_AGENTS = [
 	},
 	{
 		id: "github-copilot",
-		label: "GitHub Copilot (VS Code)",
+		label: codingAgentLabel("github-copilot"),
 		skillsId: "github-copilot",
 		skillsDir: ".agents",
 		detect: [".vscode"],
@@ -81912,7 +82219,7 @@ var CODING_AGENTS = [
 	},
 	{
 		id: "gemini-cli",
-		label: "Gemini CLI",
+		label: codingAgentLabel("gemini-cli"),
 		skillsId: "gemini-cli",
 		skillsDir: ".agents",
 		detect: [".gemini", "~/.gemini"],
@@ -81926,7 +82233,7 @@ var CODING_AGENTS = [
 	},
 	{
 		id: "windsurf",
-		label: "Windsurf",
+		label: codingAgentLabel("windsurf"),
 		skillsId: "windsurf",
 		skillsDir: ".windsurf",
 		detect: [".windsurf", "~/.codeium"],
@@ -81944,7 +82251,7 @@ var CODING_AGENTS = [
 	},
 	{
 		id: "cline",
-		label: "Cline",
+		label: codingAgentLabel("cline"),
 		skillsId: "cline",
 		skillsDir: ".agents",
 		detect: [
@@ -81965,7 +82272,7 @@ var CODING_AGENTS = [
 	},
 	{
 		id: "codex",
-		label: "Codex CLI",
+		label: codingAgentLabel("codex"),
 		skillsId: "codex",
 		skillsDir: ".agents",
 		detect: [".codex", "~/.codex"],
@@ -82642,22 +82949,6 @@ var createHitlCommand = defineGroup({
 	}
 });
 //#endregion
-//#region ../../libs/shared/format/src/lib/coding-agent-prompt.ts
-/**
-* The pasteable prompt, and nothing around it, with no "open your coding agent"
-* preamble. Each surface draws its own instruction: the CLI as a `note`, the
-* web as the label above a copy button.
-*
-* `null` is the empty workspace, which is what the web always passes: the
-* browser cannot see which piece the reader picked at `init`'s own prompt. That
-* costs nothing, because `stackbone-coder` detects the workspace on disk by
-* itself and adds to it rather than re-scaffolding.
-*/
-function codingAgentPrompt(piece) {
-	if (!piece) return "Use the stackbone-coder skill to build my first piece in this workspace: interview me about what it should do, then wire it up.";
-	return `Use the stackbone-coder skill. The "${piece.name}" ${piece.kind} is already scaffolded in this workspace, so skip the scaffolding: interview me about what it should do, then wire it up.`;
-}
-//#endregion
 //#region src/core/npm-exec.ts
 var execFileAsync = promisify(execFile);
 var NEEDS_SHELL = process.platform === "win32";