@superblocksteam/cli 2.0.155-next.2 → 2.0.155-next.3

package/dist/{chunk-OBRNLKIW.js → chunk-EB6EWBNB.js}

@@ -1,7 +1,7 @@
 if (typeof process === 'object' && process !== null &&
     process.env !== null && typeof process.env === 'object') {
   process.env.DD_GIT_REPOSITORY_URL = 'https://token@github.com/superblocksteam/superblocks.git';
-  process.env.DD_GIT_COMMIT_SHA = '0b0bad522666bac55f96fe9112b3f6fe9a889eb2';
+  process.env.DD_GIT_COMMIT_SHA = '2ee59e9d024805e249f694ef52557d46e859a5f3';
 }
 import { createRequire as $dd_createRequire } from 'module';
 import { fileURLToPath as $dd_fileURLToPath } from 'url';
@@ -16,7 +16,7 @@ import {
   require_lib as require_lib2,
   require_lib2 as require_lib3,
   require_picocolors
-} from "./chunk-5GXT3M4S.js";
+} from "./chunk-4T3WLZPG.js";
 import {
   debounce_default,
   get_default,
@@ -33,18 +33,18 @@ import {
   require_lib,
   require_slugify,
   throttle_default
-} from "./chunk-RK5T2VWH.js";
+} from "./chunk-D4566SJ7.js";
 import {
   require_dd_trace,
   require_import_in_the_middle,
   require_js_yaml,
   require_module_details_from_path,
   require_src
-} from "./chunk-XMJLHLTP.js";
+} from "./chunk-LVBXHCNA.js";
 import {
   require_dc_polyfill,
   require_storage2 as require_storage
-} from "./chunk-GWFAUQTA.js";
+} from "./chunk-TGCCW35O.js";
 import {
   ATTR_SUPERBLOCKS_BASE_URL,
   ATTR_SUPERBLOCKS_CSB_ID,
@@ -53,10 +53,10 @@ import {
   SERVICE_NAME,
   getEnvironmentFromHostname,
   otlpBaseUrl
-} from "./chunk-Z2QKVFPF.js";
+} from "./chunk-DB3LEK4O.js";
 import {
   require_token_error
-} from "./chunk-5LQ6FPMG.js";
+} from "./chunk-WEX5IXBC.js";
 import {
   ROOT_CONTEXT,
   SpanKind,
@@ -69,7 +69,7 @@ import {
   metrics,
   propagation,
   trace
-} from "./chunk-SUNMMSNA.js";
+} from "./chunk-VJIYWOYI.js";
 import {
   __commonJS,
   __esm,
@@ -79,7 +79,7 @@ import {
   __toESM,
   init_cjs_shims,
   require_register
-} from "./chunk-LC2I3LIU.js";
+} from "./chunk-4ZEAMO2U.js";
 
 // ../../../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/internal/constants.js
 var require_constants2 = __commonJS({
@@ -38844,6 +38844,7 @@ var require_response = __commonJS({
       SuperblocksError2["AuthenticatedUserNotFound"] = "AuthenticatedUserNotFound";
       SuperblocksError2["UserTokenInvalid"] = "UserTokenInvalid";
       SuperblocksError2["JWTExpired"] = "JWTExpired";
+      SuperblocksError2["JWTVerificationUnavailable"] = "JWTVerificationUnavailable";
     })(SuperblocksError || (exports.SuperblocksError = SuperblocksError = {}));
     function isResponseMetadata(responseMetadata) {
       if (responseMetadata instanceof ResponseMeta) {
@@ -41781,7 +41782,18 @@ var require_policyGate = __commonJS({
     init_cjs_shims();
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.POLICY_GATE_STALE_LIVE_EDIT_ERROR = exports.POLICY_GATE_BLOCKED_ERROR = exports.SECURITY_SCANS_ENABLED = void 0;
+    exports.isHardBlockingPolicyItem = isHardBlockingPolicyItem;
+    exports.areReadinessItemsAckEligible = areReadinessItemsAckEligible;
     exports.SECURITY_SCANS_ENABLED = false;
+    function isHardBlockingPolicyItem(item) {
+      if (item.mode !== "blocking" && item.mode !== "approval") {
+        return false;
+      }
+      return item.status === "blocked" || item.status === "failed";
+    }
+    function areReadinessItemsAckEligible(items) {
+      return items.length > 0 && items.every((item) => item.status === "blocked" || item.status === "passed" || item.status === "advisory_findings");
+    }
     exports.POLICY_GATE_BLOCKED_ERROR = "POLICY_GATE_BLOCKED";
     exports.POLICY_GATE_STALE_LIVE_EDIT_ERROR = "Policy gates can only run for the current app state. Deploy the current changes or restore to this commit and then deploy.";
   }
@@ -78840,7 +78852,9 @@ var require_verifier = __commonJS({
           const result = await (0, jose_1.jwtVerify)(token2, jwkSet, options8);
           return result.payload;
         } catch (err) {
-          throw new index_js_1.UnauthorizedError(`JWT verification failed: ${err.message}`);
+          const failure = new index_js_1.UnauthorizedError(`JWT verification failed: ${err.message}`);
+          failure.cause = err;
+          throw failure;
         }
       }
       async resolveJwkSet() {
@@ -99490,15 +99504,15 @@ var require_api_files = __commonJS({
     exports.readAppApiYamlFile = readAppApiYamlFile4;
     exports.resolveLanguageSpecificStepContentFromBlocks = resolveLanguageSpecificStepContentFromBlocks2;
     async function writeApiFiles3(...args) {
-      const esmFunction = await import("./api-R44YCAXS.js");
+      const esmFunction = await import("./api-WIV6M7TY.js");
       return esmFunction.writeApiFiles(...args);
     }
     async function readAppApiYamlFile4(...args) {
-      const esmFunction = await import("./api-R44YCAXS.js");
+      const esmFunction = await import("./api-WIV6M7TY.js");
       return esmFunction.readAppApiYamlFile(...args);
     }
     async function resolveLanguageSpecificStepContentFromBlocks2(...args) {
-      const esmFunction = await import("./api-R44YCAXS.js");
+      const esmFunction = await import("./api-WIV6M7TY.js");
       return esmFunction.resolveLanguageSpecificStepContentFromBlocks(...args);
     }
   }
@@ -105718,19 +105732,19 @@ var require_getMachineId = __commonJS({
       if (!getMachineIdImpl) {
         switch (process5.platform) {
           case "darwin":
-            getMachineIdImpl = (await import("./getMachineId-darwin-AAJJU6MN.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-darwin-BSFO7XMW.js")).getMachineId;
             break;
           case "linux":
-            getMachineIdImpl = (await import("./getMachineId-linux-7RTUU34G.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-linux-6NVJ5V5T.js")).getMachineId;
             break;
           case "freebsd":
-            getMachineIdImpl = (await import("./getMachineId-bsd-MR2XKG2B.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-bsd-D5RAZQ2D.js")).getMachineId;
             break;
           case "win32":
-            getMachineIdImpl = (await import("./getMachineId-win-75LZYSM6.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-win-YUDPXOPQ.js")).getMachineId;
             break;
           default:
-            getMachineIdImpl = (await import("./getMachineId-unsupported-OG5YTFWL.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-unsupported-4VOVSAF3.js")).getMachineId;
             break;
         }
       }
@@ -166383,8 +166397,8 @@ var require_get_vercel_oidc_token = __commonJS({
       }
       try {
         const [{ getTokenPayload, isExpired }, { refreshToken }] = await Promise.all([
-          await import("./token-util-AK3PIXPA.js"),
-          await import("./token-NUDX2H6B.js")
+          await import("./token-util-2MHFIMFV.js"),
+          await import("./token-AKUP2Q7O.js")
         ]);
         if (!token2 || isExpired(getTokenPayload(token2))) {
           await refreshToken();
@@ -437806,7 +437820,7 @@ var require_config_loader = __commonJS({
        * @returns {Promise<{createJiti: Function|undefined, version: string;}>} A promise that fulfills with an object containing the jiti module's createJiti function and version.
        */
       static async loadJiti() {
-        const { createJiti } = await import("./jiti-NUS2263O.js");
+        const { createJiti } = await import("./jiti-R3YSBCRO.js");
         const version3 = require_package5().version;
         return { createJiti, version: version3 };
       }
@@ -438135,7 +438149,7 @@ var require_eslint_helpers = __commonJS({
     }
     async function globMatch({ basePath, pattern }) {
       let found = false;
-      const { hfs } = await import("./src-DG5OVYSC.js");
+      const { hfs } = await import("./src-PHVWXSHO.js");
       const patternToUse = normalizeToPosix(path84.relative(basePath, pattern));
       const matcher = new Minimatch2(patternToUse, MINIMATCH_OPTIONS);
       const walkSettings = {
@@ -438175,7 +438189,7 @@ var require_eslint_helpers = __commonJS({
         return new Minimatch2(patternToUse, MINIMATCH_OPTIONS);
       });
       const unmatchedPatterns = /* @__PURE__ */ new Set([...relativeToPatterns.keys()]);
-      const { hfs } = await import("./src-DG5OVYSC.js");
+      const { hfs } = await import("./src-PHVWXSHO.js");
       const walk2 = hfs.walk(basePath, {
         async directoryFilter(entry) {
           if (!matchers.some((matcher) => matcher.match(entry.path, true))) {
@@ -507658,7 +507672,7 @@ init_cjs_shims();
 // ../sdk/package.json
 var package_default = {
   name: "@superblocksteam/sdk",
-  version: "2.0.155-next.2",
+  version: "2.0.155-next.3",
   description: "Superblocks JS SDK",
   homepage: "https://www.superblocks.com",
   license: "Superblocks Community Software License",
@@ -508027,7 +508041,7 @@ var config = void 0;
 var configured = false;
 var ddTracePromise = void 0;
 async function getDdTrace() {
-  ddTracePromise ??= import("./dd-trace-YVXACI2R.js").then((module) => module.default);
+  ddTracePromise ??= import("./dd-trace-V65JTNHD.js").then((module) => module.default);
   return await ddTracePromise;
 }
 var deploymentType = (() => {
@@ -545075,6 +545089,7 @@ import path11 from "node:path";
 
 // ../../../../node_modules/.pnpm/chokidar@4.0.3/node_modules/chokidar/esm/index.js
 init_cjs_shims();
+import { stat as statcb } from "fs";
 import { stat as stat4, readdir as readdir5 } from "fs/promises";
 import { EventEmitter } from "events";
 import * as sysPath2 from "path";
@@ -546593,7 +546608,7 @@ var FSWatcher = class extends EventEmitter {
     const now2 = /* @__PURE__ */ new Date();
     const writes = this._pendingWrites;
     function awaitWriteFinishFn(prevStat) {
-      $stat(fullPath, (err, curStat) => {
+      statcb(fullPath, (err, curStat) => {
         if (err || !writes.has(path84)) {
           if (err && err.code !== "ENOENT")
             awfEmit(err);
@@ -560201,7 +560216,7 @@ var MAX_ATTRIBUTE_LENGTH = 64e3;
 var LLMObsSpanWriter = null;
 async function loadLLMObsSpanWriter() {
   if (!LLMObsSpanWriter) {
-    const module = await import("./spans-AL3VDU2M.js");
+    const module = await import("./spans-VA2N5JX4.js");
     LLMObsSpanWriter = module.default;
   }
   return LLMObsSpanWriter;
@@ -586016,7 +586031,8 @@ function computeContextUsed(usage) {
 
 // ../../../vite-plugin-file-sync/dist/ai-service/util/llm-config-utils.js
 init_cjs_shims();
-function processLLMConfig(llmConfig, defaultBudgetTokens = 5e3, logContext, contextManagementOptions) {
+var DEFAULT_THINKING_BUDGET_TOKENS = 5e3;
+function processLLMConfig(llmConfig, defaultBudgetTokens = DEFAULT_THINKING_BUDGET_TOKENS, logContext, contextManagementOptions) {
   const logger26 = getLogger3();
   const thinkingEnabled = llmConfig?.thinkingEnabled ?? true;
   let thinkingBudgetTokens = llmConfig?.thinkingBudgetTokens ? parseInt(llmConfig.thinkingBudgetTokens) : defaultBudgetTokens;
@@ -586069,6 +586085,29 @@ function processLLMConfig(llmConfig, defaultBudgetTokens = 5e3, logContext, cont
     headers: thinkingOptions.headers
   };
 }
+function buildModelConfigAttributes(llmConfig) {
+  const context2 = resolveContextOptionsV2(llmConfig?.contextOptionsV2);
+  return {
+    context_limit: context2.contextLimit,
+    max_output_tokens: context2.maxOutputTokens,
+    context_buffer_tokens: context2.contextBufferTokens,
+    // Only an explicit `true` opts in to server-side compaction; `false`,
+    // `undefined`, and a missing flag payload all stay on the client path.
+    context_management: llmConfig?.serverContextManagement?.enabled === true ? "server" : "client",
+    ...buildThinkingAttributes(llmConfig)
+  };
+}
+function buildThinkingAttributes(llmConfig) {
+  if (usesAdaptiveEffort(llmConfig?.coreModel)) {
+    return { thinking_mode: "adaptive" };
+  }
+  if (!(llmConfig?.thinkingEnabled ?? true)) {
+    return { thinking_mode: "off" };
+  }
+  const configured2 = llmConfig?.thinkingBudgetTokens;
+  const budget = configured2 ? parseInt(configured2) : DEFAULT_THINKING_BUDGET_TOKENS;
+  return Number.isFinite(budget) ? { thinking_mode: "budgeted", thinking_budget_tokens: budget } : { thinking_mode: "budgeted" };
+}
 
 // ../../../vite-plugin-file-sync/dist/ai-service/state-machine/helpers/prompt-request-metrics.js
 init_cjs_shims();
@@ -587088,6 +587127,10 @@ var Clark = class _Clark extends TracedFSM {
         // they've been consumed.
         pausedForCreditsReason: ctx.pausedForCreditsReason,
         pausedForCreditsMultiChoiceContext: ctx.pausedForCreditsMultiChoiceContext,
+        // same reasoning for an auth failure. The cancel path runs
+        // through Idle, which rebuilds context from this list, so a flag left
+        // off it is gone before the next prompt can read it.
+        resumeAfterAuthFailure: ctx.resumeAfterAuthFailure,
         // APPS-4080: preserve the last generation-state snapshot across
         // resets so reconnect replay in `handleUserConnected` can faithfully
         // reproduce CANCELLED + paywallReason after a mid-stream credit
@@ -649739,6 +649782,7 @@ var LLMClient = class {
       });
       const scope = safetyConfig.scope ?? "all";
       const userText = extractTextFromMessage(user, scope);
+      let classificationInput = safetyConfig.classification?.input ?? userText;
       if (hasSecretRedaction) {
         await tracer3.trace({
           name: "llmclient.safety.secretRedaction",
@@ -649759,6 +649803,7 @@ var LLMClient = class {
               });
             }
             safeUser = redactUserMessage(safeUser, secretRedactor);
+            classificationInput = secretRedactor.redact(classificationInput);
           } catch (error40) {
             this.logger.error("[secret-scan] Secret scanning threw an exception, proceeding without redaction", getErrorMeta2(error40));
           }
@@ -649773,8 +649818,7 @@ var LLMClient = class {
             name: "llmclient.safety.classification",
             kind: "task"
           }, async () => {
-            const textToClassify = extractTextFromMessage(safeUser, scope);
-            const result = await this.applySafetyClassification(safeUser, textToClassify, config4, providerConfig);
+            const result = await this.applySafetyClassification(safeUser, classificationInput, config4, providerConfig);
             safeUser = result.message;
             tracer3.annotate({
               tags: {
@@ -650784,7 +650828,7 @@ var PlaywrightMcpServerManager = class {
       this.logger.info(`Starting embedded Playwright MCP server: browser=${options8?.browser || "chromium"}, headless=${options8?.headless !== false}`);
     }
     try {
-      const { startEmbeddedPlaywrightMcpServer } = await import("./embedded-playwright-mcp-server-MZSNDHEM.js");
+      const { startEmbeddedPlaywrightMcpServer } = await import("./embedded-playwright-mcp-server-XVYGQCP2.js");
       this.server = await startEmbeddedPlaywrightMcpServer({
         storageStatePath: options8?.storageStatePath,
         jwt: options8?.jwt,
@@ -652940,7 +652984,8 @@ Address the errors and return the fixed code.`;
         }
         void params.appShell.warmLinterCache();
         let resolvedUserPrompt = request3.prompt;
-        const isPaywallResume = !!clark.context.pausedForCreditsReason;
+        const isOrganicTurn = !isInternalTurn && !request3.importSource;
+        const isSyntheticResume = !!clark.context.pausedForCreditsReason || !!clark.context.resumeAfterAuthFailure && isOrganicTurn;
         if (clark.context.pausedForCreditsReason) {
           const mcCtx = clark.context.pausedForCreditsMultiChoiceContext;
           if (mcCtx) {
@@ -652957,8 +653002,19 @@ ${request3.prompt}`;
           }
           clark.updateContext({
             pausedForCreditsReason: void 0,
-            pausedForCreditsMultiChoiceContext: void 0
+            pausedForCreditsMultiChoiceContext: void 0,
+            // Both can be pending at once, since an internal turn no longer
+            // consumes the auth flag but can still hit the credits gate. The
+            // credits wrap already asks the model to pick up where it left
+            // off, so drop the auth one rather than let it prefix a later,
+            // unrelated prompt.
+            resumeAfterAuthFailure: void 0
           });
+        } else if (clark.context.resumeAfterAuthFailure && isOrganicTurn) {
+          resolvedUserPrompt = `(My previous turn stopped partway because my session expired. It is working again now. Please continue from where you stopped rather than starting over.)
+
+${request3.prompt}`;
+          clark.updateContext({ resumeAfterAuthFailure: void 0 });
         }
         void transitionTo({
           type: AGENT_PLANNED,
@@ -652976,13 +653032,10 @@ ${request3.prompt}`;
           // `withThirdPartyMigrationSkillInstruction` which trips the
           // classifier as prompt injection. (APPS-4921)
           //
-          // Paywall-resume is intentionally NOT in this list — it still
-          // carries the user's raw `request.prompt` text inside the wrap,
-          // so secret redaction must stay ON. Only the classifier gets
-          // skipped (via `isPaywallResume` below) because the synthetic
-          // resume coaching trips it as prompt injection.
+          // Resume turns still carry raw user text. They keep both safety
+          // features on, but classify the raw prompt instead of the wrapper.
           isUserPrompt: !request3.responseMetadata && !isInternalTurn && !request3.importSource,
-          isPaywallResume,
+          safetyClassificationInput: isSyntheticResume ? request3.prompt : void 0,
           knowledgeMessageId
         });
         break;
@@ -653032,6 +653085,9 @@ ${request3.prompt}`;
           });
           break;
         }
+        if (error40.type === "auth_error" && error40.data?.isClark === true) {
+          clark.updateContext({ resumeAfterAuthFailure: true });
+        }
         const advice = getTerminalErrorMessage(error40);
         void transitionTo({
           type: AGENT_CANCELED,
@@ -654511,6 +654567,7 @@ var buildBaseSystemPrompt = (config4, mode, factsSection, appKnowledgeSection, o
   const planGenerationVariant = options8?.variant === "plan-generation";
   const managedNativeDbAvailable = isManagedNativeDbAvailableForClark(config4);
   const superblocksDocsGuidance = config4.features.superblocksDocsMcpEnabled ? "For Superblocks product documentation, use the `search_superblocks_docs` tool first for setup, integration, and platform behavior questions. If the docs MCP result is missing or incomplete, then use `web_fetch` against `https://docs.superblocks.com` and, if needed, discover pages via `https://docs.superblocks.com/sitemap.xml`.\nWhen referring to Superblocks pages in your response, always include relative links: [Integrations](/integrations) for the integrations page, or [Integration Name](/integrations/{slug}) for a specific integration (e.g., [Salesforce](/integrations/salesforce), [PostgreSQL](/integrations/postgres))." : "For Superblocks product documentation, prefer `https://docs.superblocks.com` as the primary source. If you need to discover the right page first, use the sitemap at `https://docs.superblocks.com/sitemap.xml`, then fetch the specific docs page you need.";
+  const managedNativeDbAvailabilityGuidance = managedNativeDbAvailable ? "" : "\n\n**App Database availability:** App Databases (called Superblocks Database in the product documentation) are not available for this organization. Documentation describing this feature does not override this restriction. Do not propose or attempt to provision an App Database. You may still use existing database integrations or help the user configure a supported integration.";
   let preamble = "";
   if (planGenerationVariant) {
     preamble = `## System Instructions
@@ -654738,6 +654795,7 @@ When an \`<environment_compatibility>\` block is present, treat it as the server
 - Use the Environment mutation tool only when \`canManageEnvironments\` is true and either the user asked to change app environment membership or \`remediationActions\` contains \`change_app_environment\`.
 - If that tool is unavailable, provide a read-only explanation and the server-supplied remediation options instead of claiming to make the change.
 `}
+${managedNativeDbAvailabilityGuidance}
 <safety_guidance>
 ${safetyGuidance}
 </safety_guidance>
@@ -656588,7 +656646,7 @@ var doLLMGenerating = (clark, services) => {
   return async ({ event }) => {
     switch (event.type) {
       case AGENT_PLANNED: {
-        const { userPrompt, promptContext, isUserPrompt = true, isPaywallResume = false, knowledgeMessageId } = event;
+        const { userPrompt, promptContext, isUserPrompt = true, safetyClassificationInput, knowledgeMessageId } = event;
         const runPromptId = clark.context.promptId;
         const isStaleRun = () => clark.context.promptId !== runPromptId;
         const provider = services.llmProvider.name;
@@ -656774,20 +656832,12 @@ var doLLMGenerating = (clark, services) => {
           onError: (error40) => {
             clark.logger.error("LLM stream processing failed", getErrorMeta2(error40));
           },
-          // Apply safety features for original user prompts. Responses to
-          // interactive messages and internal turns (isUserPrompt: false)
-          // skip both classifier and redaction — they carry no raw user
-          // text. Paywall-resume turns (isPaywallResume: true) carry raw
-          // user text inside a synthetic resume wrap, so we keep redaction
-          // ON but turn the classifier OFF (the wrap reliably trips it as
-          // prompt injection). (APPS-4080)
           safety: isUserPrompt ? {
             scope: "last",
-            // Unified scope: only scan user prompt, not context parts
             classification: {
-              enabled: !isPaywallResume && (services.features.safetyClassificationEnabled ?? false),
-              // Only resolve model if classification is enabled to avoid unnecessary work
-              model: !isPaywallResume && services.features.safetyClassificationEnabled ? services.llmProvider.modelForTask("fast").model : void 0,
+              enabled: services.features.safetyClassificationEnabled ?? false,
+              input: safetyClassificationInput,
+              model: services.features.safetyClassificationEnabled ? services.llmProvider.modelForTask("fast").model : void 0,
               failOpen: true
             },
             secretRedaction: {
@@ -659604,17 +659654,28 @@ var AiService = class extends import_shared60.TracedEventEmitter {
     return this.clark?.context?.jwt;
   }
   /**
-   * Updates the JWT in Clark context
+   * Updates the JWT in Clark context.
+   *
+   * A token that expires before the one already installed is ignored, because
+   * primes can arrive out of order.
+   *
+   * @returns whether the pod ended up holding a usable token. A rejected token
+   *   used to look exactly like one that landed, and like one that was never
+   *   sent at all, which is why a run could die holding a credential nobody
+   *   knew was stale.
    */
   updateClarkJwt(jwt2) {
     const jwtDetails = describeMigrationInferenceJwt(jwt2);
     if (!jwt2 || !jwtDetails.usable) {
-      return;
+      getLogger3().warn(`[ai-service] Rejected an inference JWT (present: ${jwtDetails.present}, hasFederatedToken: ${jwtDetails.hasFederatedToken}, scope: ${jwtDetails.scope ?? "none"})`);
+      return false;
     }
+    getLogger3().info("[ai-service] Accepted a new inference JWT");
     this.clark.updateContext({ jwt: jwt2 });
     const llmConfig = this.lastMigrationTurnCredentials?.llmConfig ?? this.clark.context.llmConfig ?? buildServerMigrationLlmConfig(this.config.flagBootstrap);
     this.storeMigrationTurnCredentials(jwt2, llmConfig);
     this.tryAutoDispatchMigrationTurnIfReady();
+    return true;
   }
   // ===== Recording API =====
   /**
@@ -660466,6 +660527,7 @@ var AiService = class extends import_shared60.TracedEventEmitter {
       // Note: retry_count for LLM retries is added by orchestrator via providerOptions
       mode: clark.context.currentMode === AiMode.PLAN ? "plan" : "build",
       plan_size: clark.context.planSize,
+      ...buildModelConfigAttributes(clark.context.llmConfig),
       metadata: baseCommitId ? { ...usageMetadata, baseCommitId } : usageMetadata
     };
   }
@@ -662710,11 +662772,13 @@ ${request3.prompt}`;
     this.clark.updateContext({
       activeInteractiveMessage: void 0,
       pendingIntegrationActionPrompt: void 0,
-      pendingToolPermissionRequest: void 0
+      pendingToolPermissionRequest: void 0,
+      resumeAfterAuthFailure: void 0
     });
   }
   /** Clears local LLM context so migration-era memory does not survive abort. */
   async clearMigrationAbortLocalContext() {
+    this.clark.updateContext({ resumeAfterAuthFailure: void 0 });
     const contextId = getContextId(this.clark, this.config);
     await this.contextManagerV2.clearAllContexts();
     if (contextId) {
@@ -665834,7 +665898,7 @@ var import_shared72 = __toESM(require_dist2());
 // ../../../vite-plugin-file-sync/package.json
 var package_default2 = {
   name: "@superblocksteam/vite-plugin-file-sync",
-  version: "2.0.155-next.2",
+  version: "2.0.155-next.3",
   keywords: [
     "vite-plugin"
   ],
@@ -667588,8 +667652,16 @@ var SocketManager = class extends import_shared78.TracedEventEmitter {
             }
           ],
           primeClarkInferenceJwt: [
+            // Fail loudly. The browser is the only thing that can hand
+            // over a working token, so it has to learn that this one
+            // did not land.
             async (request3) => {
-              aiService?.updateClarkJwt(request3.jwt);
+              if (!aiService) {
+                throw new Error("Cannot prime the Clark inference JWT: the AI service is not running");
+              }
+              if (!aiService.updateClarkJwt(request3.jwt)) {
+                throw new Error("The dev server rejected the Clark inference JWT");
+              }
             }
           ],
           gitCommitLocal: [
@@ -690641,7 +690713,7 @@ var parseYaml3;
 async function loadYaml(file2) {
   const content19 = await read_file_default(file2);
   if (!parseYaml3) {
-    ({ __parsePrettierYamlConfig: parseYaml3 } = await import("./yaml-JGF65MO3.js"));
+    ({ __parsePrettierYamlConfig: parseYaml3 } = await import("./yaml-VUB5VSYH.js"));
   }
   try {
     return parseYaml3(content19);
@@ -696035,7 +696107,7 @@ function createParsersAndPrinters(modules) {
 }
 var estreePlugin = createParsersAndPrinters([
   {
-    importPlugin: () => import("./estree-EZ46OBOV.js"),
+    importPlugin: () => import("./estree-6PWHHM2H.js"),
     printers: ["estree", "estree-json"]
   }
 ]);
@@ -696059,11 +696131,11 @@ var languages = [
 ];
 var { parsers: parsers12, printers } = createParsersAndPrinters([
   {
-    importPlugin: () => import("./acorn-REPR7IWV.js"),
+    importPlugin: () => import("./acorn-R44QJXGX.js"),
     parsers: ["acorn", "espree"]
   },
   {
-    importPlugin: () => import("./angular-XIBF4SFS.js"),
+    importPlugin: () => import("./angular-32M7AVGS.js"),
     parsers: [
       "__ng_action",
       "__ng_binding",
@@ -696072,7 +696144,7 @@ var { parsers: parsers12, printers } = createParsersAndPrinters([
     ]
   },
   {
-    importPlugin: () => import("./babel-7P224XLY.js"),
+    importPlugin: () => import("./babel-PFQW4XYW.js"),
     parsers: [
       "babel",
       "babel-flow",
@@ -696091,44 +696163,44 @@ var { parsers: parsers12, printers } = createParsersAndPrinters([
     ]
   },
   {
-    importPlugin: () => import("./flow-TH3UXLF7.js"),
+    importPlugin: () => import("./flow-KCVOER5U.js"),
     parsers: ["flow"]
   },
   {
-    importPlugin: () => import("./glimmer-GGFKDTMT.js"),
+    importPlugin: () => import("./glimmer-V64NM4J5.js"),
     parsers: ["glimmer"],
     printers: ["glimmer"]
   },
   {
-    importPlugin: () => import("./graphql-OLTPZXYQ.js"),
+    importPlugin: () => import("./graphql-B6AYKOKI.js"),
     parsers: ["graphql"],
     printers: ["graphql"]
   },
   {
-    importPlugin: () => import("./html-2Y3RXJYP.js"),
+    importPlugin: () => import("./html-ZBVVO3ZX.js"),
     parsers: ["html", "angular", "vue", "lwc", "mjml"],
     printers: ["html"]
   },
   {
-    importPlugin: () => import("./markdown-OHLGC5II.js"),
+    importPlugin: () => import("./markdown-REEFWBCX.js"),
     parsers: ["markdown", "mdx", "remark"],
     printers: ["mdast"]
   },
   {
-    importPlugin: () => import("./meriyah-B52FMLO2.js"),
+    importPlugin: () => import("./meriyah-T5IDFQVO.js"),
     parsers: ["meriyah"]
   },
   {
-    importPlugin: () => import("./postcss-TLWBVFUA.js"),
+    importPlugin: () => import("./postcss-3EBJ7C2O.js"),
     parsers: ["css", "less", "scss"],
     printers: ["postcss"]
   },
   {
-    importPlugin: () => import("./typescript-NIR246NT.js"),
+    importPlugin: () => import("./typescript-GWQR45BP.js"),
     parsers: ["typescript"]
   },
   {
-    importPlugin: () => import("./yaml-JGF65MO3.js"),
+    importPlugin: () => import("./yaml-VUB5VSYH.js"),
     parsers: ["yaml"],
     printers: ["yaml"]
   }
@@ -700091,7 +700163,7 @@ function setupCorsAndValidateMethod({ req, res, allowedMethod, allowHeaders }) {
   return true;
 }
 function registerMigrationRoutes(server, options8) {
-  const { appRootDir, getIsInitialized, syncService, logger: logger26, inPlaceTemplateRestartEnabled = false, getAiService, prepareInPlaceRestart: prepareInPlaceRestart2 } = options8;
+  const { appRootDir, checkAuthorization, getIsInitialized, syncService, logger: logger26, inPlaceTemplateRestartEnabled = false, getAiService, prepareInPlaceRestart: prepareInPlaceRestart2 } = options8;
   server.middlewares.use("/sb-migration-status", (req, res, next2) => {
     if (!getIsInitialized())
       return next2();
@@ -700125,6 +700197,13 @@ function registerMigrationRoutes(server, options8) {
       })) {
         return;
       }
+      const authorization = await checkAuthorization(req.headers.authorization);
+      if (!authorization.success) {
+        res.statusCode = authorization.status;
+        res.setHeader("Content-Type", "application/json");
+        res.end(JSON.stringify({ error: authorization.error }));
+        return;
+      }
       const body = req.body;
       const { applicationId, branchName, commitId } = body;
       if (typeof applicationId !== "string" || typeof branchName !== "string" || typeof commitId !== "string") {
@@ -700147,7 +700226,7 @@ function registerMigrationRoutes(server, options8) {
         res.end(JSON.stringify({ error: "Authorization required" }));
         return;
       }
-      aiService.updateClarkJwt(jwt2);
+      const jwtAccepted = aiService.updateClarkJwt(jwt2);
       let cleared = false;
       try {
         await aiService.clearMigrationAbortLocalContext();
@@ -700157,7 +700236,7 @@ function registerMigrationRoutes(server, options8) {
       }
       res.statusCode = 200;
       res.setHeader("Content-Type", "application/json");
-      res.end(JSON.stringify({ ok: true, cleared }));
+      res.end(JSON.stringify({ ok: true, cleared, jwtAccepted }));
     })().catch((error40) => {
       logger26.error("[migrate-route] /sb-migration-restore-context failed", getErrorMeta2(error40));
       res.statusCode = 500;
@@ -701902,11 +701981,11 @@ function fileSyncVitePlugin(pluginParams, options8) {
               try {
                 unlinkSync2(metadataFilePath);
               } catch (cleanupError) {
-                logger26.error("Failed to cleanup metadata file", cleanupError);
+                logger26.error("Failed to cleanup metadata file", getErrorMeta2(cleanupError));
               }
             }
           } catch (error40) {
-            logger26.error("Error creating zip download", error40);
+            logger26.error("Error creating zip download", getErrorMeta2(error40));
             if (!res.headersSent) {
               res.statusCode = 500;
               res.setHeader("Content-Type", "application/json");
@@ -701999,6 +702078,7 @@ function fileSyncVitePlugin(pluginParams, options8) {
       });
       registerMigrationRoutes(server, {
         appRootDir,
+        checkAuthorization: pluginParams.checkAuthorization,
         getIsInitialized: () => isInitialized,
         syncService,
         logger: logger26,
@@ -716994,7 +717074,7 @@ async function handleLockConflict(error40, lockSvc, span, logger26) {
 }
 async function readPkgJson(cwd) {
   try {
-    const { readPackage } = await import("./read-pkg-UHL7NMON.js");
+    const { readPackage } = await import("./read-pkg-6Z3BVK5L.js");
     return await readPackage({ cwd });
   } catch {
     return null;
@@ -719055,4 +719135,4 @@ serve-static/index.js:
 chokidar/esm/index.js:
   (*! chokidar - MIT License (c) 2012 Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=chunk-OBRNLKIW.js.map
+//# sourceMappingURL=chunk-EB6EWBNB.js.map