@superblocksteam/vite-plugin-file-sync 2.0.141 → 2.0.142-next.1

package/dist/ai-service/resolve-generation-state-for-ui.d.ts

@@ -1,8 +1,9 @@
 import type { AiGenerationStateSnapshot } from "@superblocksteam/library-shared/types";
 import type { ClarkState } from "./state-machine/clark-fsm.js";
-export type UiGenerationStateSnapshot = AiGenerationStateSnapshot;
+type UiGenerationStateSnapshot = AiGenerationStateSnapshot;
 export declare function resolveGenerationStateForUi(input: {
     clarkState: ClarkState;
     lastGenerationState?: UiGenerationStateSnapshot;
 }): UiGenerationStateSnapshot | undefined;
+export {};
 //# sourceMappingURL=resolve-generation-state-for-ui.d.ts.map

package/dist/ai-service/resolve-generation-state-for-ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-generation-state-for-ui.d.ts","sourceRoot":"","sources":["../../src/ai-service/resolve-generation-state-for-ui.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAEvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D,MAAM,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AASlE,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,UAAU,EAAE,UAAU,CAAC;IACvB,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;CACjD,GAAG,yBAAyB,GAAG,SAAS,CAmBxC"}
+{"version":3,"file":"resolve-generation-state-for-ui.d.ts","sourceRoot":"","sources":["../../src/ai-service/resolve-generation-state-for-ui.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAEvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D,KAAK,yBAAyB,GAAG,yBAAyB,CAAC;AAS3D,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,UAAU,EAAE,UAAU,CAAC;IACvB,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;CACjD,GAAG,yBAAyB,GAAG,SAAS,CAmBxC"}

package/dist/ai-service/security/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Provides secret scanning, safety classification, and other security-related functionality.
  */
-export { scanContentForSecrets, isTrufflehogAvailable, disposeSecretScanner, } from "./secret-scanner-service.js";
-export { formatSecretFindings, redactSecrets, SecretRedactor, type SecretFinding, type SecretScanOptions, type SecretScanResult, } from "./secret-scanner.js";
-export { classifyPromptSafety, createBlockedUserMessage, FAIL_CLOSED_RESULT, FAIL_OPEN_RESULT, type SafetyCategory, type SafetyClassificationConfig, type SafetyClassificationOptions, type SafetyClassificationResult, } from "./safety-classifier.js";
+export { scanContentForSecrets } from "./secret-scanner-service.js";
+export { SecretRedactor } from "./secret-scanner.js";
+export { classifyPromptSafety, createBlockedUserMessage, FAIL_CLOSED_RESULT, } from "./safety-classifier.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/ai-service/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ai-service/security/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ai-service/security/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC"}

package/dist/ai-service/security/index.js

@@ -3,7 +3,7 @@
  *
  * Provides secret scanning, safety classification, and other security-related functionality.
  */
-export { scanContentForSecrets, isTrufflehogAvailable, disposeSecretScanner, } from "./secret-scanner-service.js";
-export { formatSecretFindings, redactSecrets, SecretRedactor, } from "./secret-scanner.js";
-export { classifyPromptSafety, createBlockedUserMessage, FAIL_CLOSED_RESULT, FAIL_OPEN_RESULT, } from "./safety-classifier.js";
+export { scanContentForSecrets } from "./secret-scanner-service.js";
+export { SecretRedactor } from "./secret-scanner.js";
+export { classifyPromptSafety, createBlockedUserMessage, FAIL_CLOSED_RESULT, } from "./safety-classifier.js";
 //# sourceMappingURL=index.js.map

package/dist/ai-service/security/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ai-service/security/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,cAAc,GAIf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,GAKjB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ai-service/security/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC"}

package/dist/ai-service/security/safety-classifier.d.ts

@@ -11,10 +11,8 @@
  */
 import type { LanguageModelV3 } from "@ai-sdk/provider";
 import type { UserModelMessage } from "ai";
-import { type SafetyCategory, type SafetyClassificationResult } from "@superblocksteam/shared";
+import { type SafetyClassificationResult } from "@superblocksteam/shared";
 import type { LLMClient, LLMClientProviderConfig } from "../llm/client.js";
-export type { SafetyCategory, SafetyClassificationResult };
-export declare const FAIL_OPEN_RESULT: SafetyClassificationResult;
 export declare const FAIL_CLOSED_RESULT: SafetyClassificationResult;
 /**
  * Options for safety classification.
@@ -22,7 +20,7 @@ export declare const FAIL_CLOSED_RESULT: SafetyClassificationResult;
  * The caller resolves the classification model and providerConfig together and
  * supplies the LLMClient so this one-shot call uses the shared retry/obs path.
  */
-export interface SafetyClassificationOptions {
+interface SafetyClassificationOptions {
     /** Model to use for classification (should be a fast model like Haiku) */
     model: LanguageModelV3;
     /** Provider metadata resolved alongside the classification model */
@@ -34,23 +32,6 @@ export interface SafetyClassificationOptions {
     /** Abort signal for cancellation */
     abortSignal?: AbortSignal;
 }
-/**
- * Configuration for safety classification in LLMClient.
- */
-export interface SafetyClassificationConfig {
-    /** Whether safety classification is enabled */
-    enabled: boolean;
-    /** Model to use for classification */
-    model?: LanguageModelV3;
-    /** Provider metadata resolved alongside the classification model */
-    providerConfig?: LLMClientProviderConfig;
-    /** Custom timeout in milliseconds (default: 5000) */
-    timeout?: number;
-    /** Whether to fail-open (allow) or fail-closed (block) on classification errors (default: true) */
-    failOpen?: boolean;
-    /** Which text parts to scan: "all" (default) or "last" (user prompt only) */
-    scope?: "all" | "last";
-}
 /**
  * Classifies a user prompt for safety.
  *
@@ -98,4 +79,5 @@ export declare function classifyPromptSafety(prompt: string, options: SafetyClas
  * ```
  */
 export declare function createBlockedUserMessage(_originalUser: UserModelMessage, classification: SafetyClassificationResult): UserModelMessage;
+export {};
 //# sourceMappingURL=safety-classifier.d.ts.map

package/dist/ai-service/security/safety-classifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety-classifier.d.ts","sourceRoot":"","sources":["../../../src/ai-service/security/safety-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,IAAI,CAAC;AAG3C,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,YAAY,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC;AAE3D,eAAO,MAAM,gBAAgB,EAAE,0BAI9B,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,0BAKhC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,0EAA0E;IAC1E,KAAK,EAAE,eAAe,CAAC;IACvB,oEAAoE;IACpE,cAAc,EAAE,uBAAuB,CAAC;IACxC,oFAAoF;IACpF,SAAS,EAAE,SAAS,CAAC;IACrB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,oEAAoE;IACpE,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxB;AAqED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CA6DrC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,gBAAgB,EAC/B,cAAc,EAAE,0BAA0B,GACzC,gBAAgB,CAclB"}
+{"version":3,"file":"safety-classifier.d.ts","sourceRoot":"","sources":["../../../src/ai-service/security/safety-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,IAAI,CAAC;AAG3C,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,eAAO,MAAM,kBAAkB,EAAE,0BAKhC,CAAC;AAEF;;;;;GAKG;AACH,UAAU,2BAA2B;IACnC,0EAA0E;IAC1E,KAAK,EAAE,eAAe,CAAC;IACvB,oEAAoE;IACpE,cAAc,EAAE,uBAAuB,CAAC;IACxC,oFAAoF;IACpF,SAAS,EAAE,SAAS,CAAC;IACrB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAyED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CA6DrC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,gBAAgB,EAC/B,cAAc,EAAE,0BAA0B,GACzC,gBAAgB,CAclB"}

package/dist/ai-service/security/safety-classifier.js

@@ -12,15 +12,14 @@
 import { z } from "zod";
 import { SAFETY_CATEGORIES, } from "@superblocksteam/shared";
 import { getLogger } from "../../util/logger.js";
-export const FAIL_OPEN_RESULT = {
-    safe: true,
-    justification: "Classification failed, allowing request to proceed (fail-open policy).",
-};
 export const FAIL_CLOSED_RESULT = {
     safe: false,
     justification: "Classification failed, blocking request (fail-closed policy).",
     categories: ["other"],
 };
+/**
+ * Configuration for safety classification in LLMClient.
+ */
 const SAFETY_CLASSIFICATION_SYSTEM_PROMPT = `You are a safety classifier for a low-code application builder AI assistant. Your task is to determine if a user's request is safe to process.
 
 ## Classification Criteria

package/dist/ai-service/security/safety-classifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"safety-classifier.js","sourceRoot":"","sources":["../../../src/ai-service/security/safety-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,GAGlB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAKjD,MAAM,CAAC,MAAM,gBAAgB,GAA+B;IAC1D,IAAI,EAAE,IAAI;IACV,aAAa,EACX,wEAAwE;CAC3E,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAA+B;IAC5D,IAAI,EAAE,KAAK;IACX,aAAa,EACX,+DAA+D;IACjE,UAAU,EAAE,CAAC,OAAO,CAAC;CACtB,CAAC;AAuCF,MAAM,mCAAmC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA4CwB,CAAC;AAErE;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC;SACJ,OAAO,EAAE;SACT,QAAQ,CACP,uEAAuE,CACxE;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,CACP,qEAAqE,CACtE;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;SAChC,QAAQ,EAAE;SACV,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,OAAoC;IAEpC,MAAM,EACJ,KAAK,EACL,cAAc,EACd,SAAS,EACT,OAAO,GAAG,IAAI,EACd,WAAW,GACZ,GAAG,OAAO,CAAC;IACZ,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;QACjE,YAAY,EAAE,MAAM,CAAC,MAAM;KAC5B,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,kCAAkC;IAClC,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAEvE,IAAI,CAAC;QACH,iDAAiD;QACjD,MAAM,cAAc,GAAG,WAAW;YAChC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC;YAC5C,KAAK;YACL,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,mCAAmC;YAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAC9B,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,kBAAkB,MAAM,GAAG;aACrC;YACD,cAAc;YACd,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,EAAE;gBACN,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAClC,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;aAClC;YACD,mEAAmE;YACnE,wEAAwE;YACxE,gBAAgB,EAAE,KAAK;YACvB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;YACzB,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;YAC1D,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,MAAoC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAA+B,EAC/B,cAA0C;IAE1C,MAAM,WAAW,GACf,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC/D,CAAC,CAAC,gBAAgB,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACzD,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,cAAc,GAClB,yEAAyE;QACzE,WAAW,cAAc,CAAC,aAAa,GAAG,WAAW,EAAE,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,cAAc;KACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"safety-classifier.js","sourceRoot":"","sources":["../../../src/ai-service/security/safety-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,MAAM,CAAC,MAAM,kBAAkB,GAA+B;IAC5D,IAAI,EAAE,KAAK;IACX,aAAa,EACX,+DAA+D;IACjE,UAAU,EAAE,CAAC,OAAO,CAAC;CACtB,CAAC;AAqBF;;GAEG;AAEH,MAAM,mCAAmC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA4CwB,CAAC;AAErE;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC;SACJ,OAAO,EAAE;SACT,QAAQ,CACP,uEAAuE,CACxE;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,CACP,qEAAqE,CACtE;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;SAChC,QAAQ,EAAE;SACV,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,OAAoC;IAEpC,MAAM,EACJ,KAAK,EACL,cAAc,EACd,SAAS,EACT,OAAO,GAAG,IAAI,EACd,WAAW,GACZ,GAAG,OAAO,CAAC;IACZ,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;QACjE,YAAY,EAAE,MAAM,CAAC,MAAM;KAC5B,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,kCAAkC;IAClC,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAEvE,IAAI,CAAC;QACH,iDAAiD;QACjD,MAAM,cAAc,GAAG,WAAW;YAChC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC;YAC5C,KAAK;YACL,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,mCAAmC;YAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAC9B,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,kBAAkB,MAAM,GAAG;aACrC;YACD,cAAc;YACd,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,EAAE;gBACN,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAClC,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;aAClC;YACD,mEAAmE;YACnE,wEAAwE;YACxE,gBAAgB,EAAE,KAAK;YACvB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;YACzB,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;YAC1D,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,MAAoC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAA+B,EAC/B,cAA0C;IAE1C,MAAM,WAAW,GACf,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC/D,CAAC,CAAC,gBAAgB,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACzD,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,cAAc,GAClB,yEAAyE;QACzE,WAAW,cAAc,CAAC,aAAa,GAAG,WAAW,EAAE,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,cAAc;KACxB,CAAC;AACJ,CAAC"}

package/dist/ai-service/security/secret-scanner-service.d.ts

@@ -16,14 +16,8 @@
  *   logging errors.
  */
 import { type SecretScanOptions, type SecretScanResult } from "./secret-scanner.js";
-/** Default timeout for a single TruffleHog scan (ms). */
-export declare const DEFAULT_SCAN_TIMEOUT_MS = 10000;
-/** Maximum number of cached scan results. */
-export declare const MAX_CACHE_SIZE = 200;
 /** Time-to-live for cached scan results (ms). */
 export declare const CACHE_TTL_MS: number;
-/** Maximum concurrent TruffleHog child processes. */
-export declare const MAX_CONCURRENCY = 2;
 /**
  * Scans text content for secrets using TruffleHog, with caching,
  * concurrency control, and availability gating.

package/dist/ai-service/security/secret-scanner-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-scanner-service.d.ts","sourceRoot":"","sources":["../../../src/ai-service/security/secret-scanner-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAC;AAM7B,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,6CAA6C;AAC7C,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,iDAAiD;AACjD,eAAO,MAAM,YAAY,QAAgB,CAAC;AAE1C,qDAAqD;AACrD,eAAO,MAAM,eAAe,IAAI,CAAC;AA2QjC;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAK3C"}
+{"version":3,"file":"secret-scanner-service.d.ts","sourceRoot":"","sources":["../../../src/ai-service/security/secret-scanner-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAC;AAY7B,iDAAiD;AACjD,eAAO,MAAM,YAAY,QAAgB,CAAC;AA8Q1C;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAK3C"}

package/dist/ai-service/security/secret-scanner-service.js

@@ -22,13 +22,13 @@ import { isTrufflehogAvailable as checkTrufflehogAvailable, runTrufflehog, redac
 // Constants
 // ---------------------------------------------------------------------------
 /** Default timeout for a single TruffleHog scan (ms). */
-export const DEFAULT_SCAN_TIMEOUT_MS = 10_000;
+const DEFAULT_SCAN_TIMEOUT_MS = 10_000;
 /** Maximum number of cached scan results. */
-export const MAX_CACHE_SIZE = 200;
+const MAX_CACHE_SIZE = 200;
 /** Time-to-live for cached scan results (ms). */
 export const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
 /** Maximum concurrent TruffleHog child processes. */
-export const MAX_CONCURRENCY = 2;
+const MAX_CONCURRENCY = 2;
 // ---------------------------------------------------------------------------
 // SecretScannerService
 // ---------------------------------------------------------------------------

package/dist/ai-service/security/secret-scanner-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-scanner-service.js","sourceRoot":"","sources":["../../../src/ai-service/security/secret-scanner-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EACL,qBAAqB,IAAI,wBAAwB,EACjD,aAAa,EACb,aAAa,GAId,MAAM,qBAAqB,CAAC;AAE7B,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,iDAAiD;AACjD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEvD,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAWjC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,oBAAoB;IACxB,uCAAuC;IAC/B,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE9C,6EAA6E;IACrE,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IAE/D,wDAAwD;IAChD,eAAe,GAAG,CAAC,CAAC;IAE5B,6CAA6C;IACrC,SAAS,GAAsB,EAAE,CAAC;IAE1C;;;;;OAKG;IACK,SAAS,CAAsB;IAEvC;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CACR,OAAe,EACf,UAA6B,EAAE;QAE/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,EAAE,OAAO,GAAG,uBAAuB,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QAE5E,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,wBAAwB,EAAE,CAAC;YACrD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBAClE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,EAAE;oBACZ,KAAK,EAAE,0DAA0D;oBACjE,kBAAkB,EAAE,KAAK;oBACzB,UAAU,EAAE,KAAK;oBACjB,eAAe,EAAE,OAAO;iBACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpD,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC/B,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;aAClD,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,QAAQ;oBACR,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;oBACpD,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAC/B,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;iBAClD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,EAAE;oBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,kBAAkB,EAAE,KAAK;oBACzB,UAAU,EAAE,KAAK;oBACjB,eAAe,EAAE,OAAO;iBACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAChD,OAAO,EACP,OAAO,EACP,YAAY,EACZ,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpD,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC/B,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,kBAAkB,EAAE,KAAK;gBACzB,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,OAAO;aACzB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,wBAAwB,EAAE,CAAC;YACrD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;IAClB,0EAA0E;IAE1E;;OAEG;IACK,WAAW,CAAC,OAAe,EAAE,YAAqB;QACxD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,yBAAyB,CACrC,OAAe,EACf,OAAe,EACf,YAAqB,EACrB,QAAgB;QAEhB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAErE,2BAA2B;YAC3B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAErC,OAAO,QAAQ,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,eAAe,GAAG,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,WAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,IAAI,EAAE,CAAC;YACT,4CAA4C;YAC5C,IAAI,EAAE,CAAC;QACT,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW,EAAE,QAAyB;QACxD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACtC,wDAAwD;YACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;SACrC,CAAC,CAAC;IACL,CAAC;CACF;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,IAAI,QAA0C,CAAC;AAE/C,SAAS,WAAW;IAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,UAA6B,EAAE;IAE/B,OAAO,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,OAAO,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"secret-scanner-service.js","sourceRoot":"","sources":["../../../src/ai-service/security/secret-scanner-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EACL,qBAAqB,IAAI,wBAAwB,EACjD,aAAa,EACb,aAAa,GAId,MAAM,qBAAqB,CAAC;AAE7B,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,yDAAyD;AACzD,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,6CAA6C;AAC7C,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,iDAAiD;AACjD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEvD,qDAAqD;AACrD,MAAM,eAAe,GAAG,CAAC,CAAC;AAW1B,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,oBAAoB;IACxB,uCAAuC;IAC/B,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE9C,6EAA6E;IACrE,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IAE/D,wDAAwD;IAChD,eAAe,GAAG,CAAC,CAAC;IAE5B,6CAA6C;IACrC,SAAS,GAAsB,EAAE,CAAC;IAE1C;;;;;OAKG;IACK,SAAS,CAAsB;IAEvC;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CACR,OAAe,EACf,UAA6B,EAAE;QAE/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,EAAE,OAAO,GAAG,uBAAuB,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QAE5E,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,wBAAwB,EAAE,CAAC;YACrD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBAClE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,EAAE;oBACZ,KAAK,EAAE,0DAA0D;oBACjE,kBAAkB,EAAE,KAAK;oBACzB,UAAU,EAAE,KAAK;oBACjB,eAAe,EAAE,OAAO;iBACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpD,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC/B,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;aAClD,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,QAAQ;oBACR,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;oBACpD,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAC/B,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;iBAClD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,EAAE;oBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,kBAAkB,EAAE,KAAK;oBACzB,UAAU,EAAE,KAAK;oBACjB,eAAe,EAAE,OAAO;iBACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAChD,OAAO,EACP,OAAO,EACP,YAAY,EACZ,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpD,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC/B,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,kBAAkB,EAAE,KAAK;gBACzB,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,OAAO;aACzB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,wBAAwB,EAAE,CAAC;YACrD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;IAClB,0EAA0E;IAE1E;;OAEG;IACK,WAAW,CAAC,OAAe,EAAE,YAAqB;QACxD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,yBAAyB,CACrC,OAAe,EACf,OAAe,EACf,YAAqB,EACrB,QAAgB;QAEhB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAErE,2BAA2B;YAC3B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAErC,OAAO,QAAQ,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,eAAe,GAAG,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,WAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,IAAI,EAAE,CAAC;YACT,4CAA4C;YAC5C,IAAI,EAAE,CAAC;QACT,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW,EAAE,QAAyB;QACxD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACtC,wDAAwD;YACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;SACrC,CAAC,CAAC;IACL,CAAC;CACF;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,IAAI,QAA0C,CAAC;AAE/C,SAAS,WAAW;IAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,UAA6B,EAAE;IAE/B,OAAO,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,OAAO,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/ai-service/skills/index.d.ts

@@ -9,7 +9,7 @@ export * from "./types.js";
 /**
  * Metadata for a skill extracted from its SKILL.md frontmatter.
  */
-export interface SkillMetadata {
+interface SkillMetadata {
     name: string;
     description: string;
     location: string;

package/dist/ai-service/skills/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ai-service/skills/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,cAAc,YAAY,CAAC;AAI3B;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AA0BD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAEpB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,aAAa,EAAE,CA+BzD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,GAAG,MAAM,GAAG,IAAI,CAwBhB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ai-service/skills/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,cAAc,YAAY,CAAC;AAI3B;;GAEG;AACH,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AA0BD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAEpB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,aAAa,EAAE,CA+BzD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,GAAG,MAAM,GAAG,IAAI,CAwBhB"}

package/dist/ai-service/skills/system/_registry.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_registry.generated.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/skills/system/_registry.generated.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAiBhD,CAAC"}
+{"version":3,"file":"_registry.generated.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/skills/system/_registry.generated.ts"],"names":[],"mappings":"AAqBA;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkBhD,CAAC"}

package/dist/ai-service/skills/system/_registry.generated.js

@@ -1,6 +1,7 @@
 // Auto-generated skills registry
 // Do not edit directly - run npm run generate-skills
 import { content as common_import_issues_skill } from "./common-import-issues/skill.generated.js";
+import { content as migration_api_verification_skill } from "./migration-api-verification/skill.generated.js";
 import { content as superblocks_api_references_code_blocks } from "./superblocks-api/references/code-blocks.generated.js";
 import { content as superblocks_api_references_graphql } from "./superblocks-api/references/graphql.generated.js";
 import { content as superblocks_api_references_rest_apis } from "./superblocks-api/references/rest-apis.generated.js";
@@ -22,6 +23,7 @@ import { content as third_party_migration_v0 } from "./third-party-migration/v0.
  */
 export const SYSTEM_SKILLS = {
     "common-import-issues/SKILL.md": common_import_issues_skill,
+    "migration-api-verification/SKILL.md": migration_api_verification_skill,
     "superblocks-api/SKILL.md": superblocks_api_skill,
     "superblocks-api/references/code-blocks.md": superblocks_api_references_code_blocks,
     "superblocks-api/references/graphql.md": superblocks_api_references_graphql,

package/dist/ai-service/skills/system/_registry.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"_registry.generated.js","sourceRoot":"","sources":["../../../../src/ai-service/skills/system/_registry.generated.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,qDAAqD;AAErD,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAE,OAAO,IAAI,sCAAsC,EAAE,MAAM,uDAAuD,CAAC;AAC1H,OAAO,EAAE,OAAO,IAAI,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAClH,OAAO,EAAE,OAAO,IAAI,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AACtH,OAAO,EAAE,OAAO,IAAI,wCAAwC,EAAE,MAAM,yDAAyD,CAAC;AAC9H,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,yCAAyC,EAAE,MAAM,0DAA0D,CAAC;AAChI,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAE,OAAO,IAAI,8CAA8C,EAAE,MAAM,+DAA+D,CAAC;AAC1I,OAAO,EAAE,OAAO,IAAI,mDAAmD,EAAE,MAAM,oEAAoE,CAAC;AACpJ,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACpG,OAAO,EAAE,OAAO,IAAI,mCAAmC,EAAE,MAAM,oDAAoD,CAAC;AACpH,OAAO,EAAE,OAAO,IAAI,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AACxG,OAAO,EAAE,OAAO,IAAI,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AACtG,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACpG,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAE9F;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,+BAA+B,EAAE,0BAA0B;IAC3D,0BAA0B,EAAE,qBAAqB;IACjD,2CAA2C,EAAE,sCAAsC;IACnF,uCAAuC,EAAE,kCAAkC;IAC3E,yCAAyC,EAAE,oCAAoC;IAC/E,6CAA6C,EAAE,wCAAwC;IACvF,+BAA+B,EAAE,0BAA0B;IAC3D,8CAA8C,EAAE,yCAAyC;IACzF,gCAAgC,EAAE,2BAA2B;IAC7D,mDAAmD,EAAE,8CAA8C;IACnG,wDAAwD,EAAE,mDAAmD;IAC7G,gCAAgC,EAAE,2BAA2B;IAC7D,wCAAwC,EAAE,mCAAmC;IAC7E,kCAAkC,EAAE,6BAA6B;IACjE,iCAAiC,EAAE,4BAA4B;IAC/D,6BAA6B,EAAE,wBAAwB;CACxD,CAAC"}
+{"version":3,"file":"_registry.generated.js","sourceRoot":"","sources":["../../../../src/ai-service/skills/system/_registry.generated.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,qDAAqD;AAErD,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAE,OAAO,IAAI,gCAAgC,EAAE,MAAM,iDAAiD,CAAC;AAC9G,OAAO,EAAE,OAAO,IAAI,sCAAsC,EAAE,MAAM,uDAAuD,CAAC;AAC1H,OAAO,EAAE,OAAO,IAAI,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAClH,OAAO,EAAE,OAAO,IAAI,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AACtH,OAAO,EAAE,OAAO,IAAI,wCAAwC,EAAE,MAAM,yDAAyD,CAAC;AAC9H,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,yCAAyC,EAAE,MAAM,0DAA0D,CAAC;AAChI,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAE,OAAO,IAAI,8CAA8C,EAAE,MAAM,+DAA+D,CAAC;AAC1I,OAAO,EAAE,OAAO,IAAI,mDAAmD,EAAE,MAAM,oEAAoE,CAAC;AACpJ,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACpG,OAAO,EAAE,OAAO,IAAI,mCAAmC,EAAE,MAAM,oDAAoD,CAAC;AACpH,OAAO,EAAE,OAAO,IAAI,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AACxG,OAAO,EAAE,OAAO,IAAI,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AACtG,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACpG,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAE9F;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,+BAA+B,EAAE,0BAA0B;IAC3D,qCAAqC,EAAE,gCAAgC;IACvE,0BAA0B,EAAE,qBAAqB;IACjD,2CAA2C,EAAE,sCAAsC;IACnF,uCAAuC,EAAE,kCAAkC;IAC3E,yCAAyC,EAAE,oCAAoC;IAC/E,6CAA6C,EAAE,wCAAwC;IACvF,+BAA+B,EAAE,0BAA0B;IAC3D,8CAA8C,EAAE,yCAAyC;IACzF,gCAAgC,EAAE,2BAA2B;IAC7D,mDAAmD,EAAE,8CAA8C;IACnG,wDAAwD,EAAE,mDAAmD;IAC7G,gCAAgC,EAAE,2BAA2B;IAC7D,wCAAwC,EAAE,mCAAmC;IAC7E,kCAAkC,EAAE,6BAA6B;IACjE,iCAAiC,EAAE,4BAA4B;IAC/D,6BAA6B,EAAE,wBAAwB;CACxD,CAAC"}

package/dist/ai-service/skills/system/materialized.d.ts

@@ -1,6 +1,7 @@
 import type { Logger } from "../../../util/logger.js";
-export interface MaterializedSystemSkills {
+interface MaterializedSystemSkills {
     systemSkillsDir: string;
 }
 export declare function ensureMaterializedSystemSkills(appRootDirPath: string, skills: Record<string, string>, logger: Logger): Promise<MaterializedSystemSkills>;
+export {};
 //# sourceMappingURL=materialized.d.ts.map

package/dist/ai-service/skills/system/materialized.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"materialized.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/skills/system/materialized.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC;CACzB;AA+BD,wBAAsB,8BAA8B,CAClD,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC,CAWnC"}
+{"version":3,"file":"materialized.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/skills/system/materialized.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,UAAU,wBAAwB;IAChC,eAAe,EAAE,MAAM,CAAC;CACzB;AA+BD,wBAAsB,8BAA8B,CAClD,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC,CAWnC"}

package/dist/ai-service/skills/system/migration-api-verification/skill.generated.d.ts

@@ -0,0 +1,2 @@
+export declare const content = "---\nname: migration-api-verification\ndescription: |\n  Author step-by-step, UI-oriented manual test instructions for an upgraded API\n  during a v2\u2192v3 upgrade. Load when the user asks how to test a specific API\n  that was skipped from automatic verification (write-policy \"Don't test\" or\n  testApi permission denial).\nreadOnly: true\nmetadata:\n  author: superblocks\n  version: \"1.0\"\n---\n\n# Manual API verification instructions (upgrade)\n\nYou are helping a user **manually verify** an upgraded API that Clark did **not**\nauto-test. The user opted out of automatic testing; your job is to translate the\nAPI name into **click-through steps inside their app preview** \u2014 not to re-run\n`testApi` or `runMigrationVerification`.\n\n## When to use this skill\n\n- The user clicked **Get test instructions** on a skipped upgrade checklist row.\n- The user asks how to test a specific API during an active v2\u2192v3 upgrade.\n- A prompt explicitly references this skill file.\n\n## Hard rules\n\n1. **Read-only guidance.** Do **NOT** call `testApi`, `runMigrationVerification`,\n   or mutate checklist state while writing instructions.\n2. **UI-first, not API-first.** Never tell the user to \"verify `GetOrders`\" without\n   explaining **where in the app** that API is triggered and **what they should see**.\n3. **Use the app preview.** Steps must be actions the user can perform in the\n   running preview (navigate, click, type, select, submit).\n4. **Be concrete.** Name pages, routes, buttons, tables, and fields using labels\n   from the codebase when you can find them.\n5. **If you cannot map the API to UI**, say so explicitly and suggest the most\n   likely pages to inspect \u2014 do not invent buttons or routes.\n\n## Procedure\n\nGiven `<ApiName>` (matches `server/apis/<ApiName>/api.ts` and `useApi(\"<ApiName>\")`):\n\n1. **Orient on the API**\n   - Read `server/apis/<ApiName>/api.ts` for a one-line summary of what it does\n     (integration, read vs write, key inputs).\n   - Optionally read `scratch/v2-backup/apis/<ApiName>/api.yaml` if the TS file\n     alone is ambiguous.\n\n2. **Find frontend call sites**\n   - Search `client/**` for `useApi(\"<ApiName>\")` (exact string match on the API name).\n   - For each call site, read the surrounding component to learn:\n     - Which **page/route** renders it (`client/router.tsx`, page module path).\n     - What **user action** triggers the call (button click, form submit, page load,\n       table refresh, dropdown change, etc.).\n     - What **inputs** the user must supply (form fields, selections, filters).\n     - What **observable outcome** indicates success (data appears, toast, navigation,\n       row update, empty state clears, error banner absent).\n\n3. **Write the instruction list**\n   - Use a numbered checklist the user can follow top-to-bottom.\n   - Start with navigation: \"Open the app preview and go to `<route>`.\"\n   - Each step is one user action: \"Click **Save**\", \"Enter `123` in **Order ID**\".\n   - End with an explicit **expected result** tied to the API's behavior.\n   - If multiple UI surfaces call the same API, list separate paths (Path A / Path B)\n     or pick the primary one and note alternates briefly.\n\n4. **Close with verification options**\n   - Tell the user that after they confirm the behavior matches v2 expectations,\n     they can:\n     - Reply in chat (e.g. \"I verified `<ApiName>` \u2014 mark it complete\"), or\n     - Use **Mark as verified** on the skipped checklist row.\n\n## Output format\n\nUse this structure in your reply:\n\n```markdown\n## How to test `<ApiName>`\n\n**What this API does:** <one sentence>\n\n**Prerequisites:** <auth state, seed data, or inputs needed \u2014 or \"none\">\n\n### Steps\n\n1. ...\n2. ...\n3. ...\n\n**Expected result:** <what the user should see when v3 behaves correctly>\n\n**If something looks wrong:** <brief note on what to report back \u2014 error message,\nmissing data, wrong shape \u2014 without attempting auto-fix unless asked>\n```\n\nKeep steps short (typically 3\u20138). Prefer button/link labels from the UI over\ninternal component names unless labels are missing.\n\n## Mapping tips\n\n| Signal in code                              | Turn into a user step                                                |\n| ------------------------------------------- | -------------------------------------------------------------------- |\n| `useApi(\"X\").run()` in `onClick`            | \"Click **\\<button label\\>**\"                                         |\n| `useApi(\"X\").run()` in `useEffect` on mount | \"Navigate to **\\<route\\>** and wait for **\\<section\\>** to load\"     |\n| API `input` schema field `orderId`          | \"Enter a value in **Order ID**\"                                      |\n| Table bound to API result                   | \"Confirm the table shows **\\<describe rows/columns\\>**\"              |\n| Mutation / POST-style API                   | Note any side effect the user should verify (new row, updated field) |\n\n## Forbidden shortcuts\n\n- \"Just call the API\" or \"Run GetOrders in the API panel\"\n- Marking the checklist item complete yourself while only writing instructions\n- Running automatic verification because you \"want to double-check\"\n- Generic advice with no route or click path (\"exercise the relevant UI\")\n";
+//# sourceMappingURL=skill.generated.d.ts.map

package/dist/ai-service/skills/system/migration-api-verification/skill.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.generated.d.ts","sourceRoot":"","sources":["../../../../../src/ai-service/skills/system/migration-api-verification/skill.generated.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,0wKAmHnB,CAAC"}

package/dist/ai-service/skills/system/migration-api-verification/skill.generated.js

@@ -0,0 +1,119 @@
+// Auto-generated from src/ai-service/skills/system/migration-api-verification/SKILL.md
+// Do not edit directly - edit the .md file instead
+export const content = `---
+name: migration-api-verification
+description: |
+  Author step-by-step, UI-oriented manual test instructions for an upgraded API
+  during a v2→v3 upgrade. Load when the user asks how to test a specific API
+  that was skipped from automatic verification (write-policy "Don't test" or
+  testApi permission denial).
+readOnly: true
+metadata:
+  author: superblocks
+  version: "1.0"
+---
+
+# Manual API verification instructions (upgrade)
+
+You are helping a user **manually verify** an upgraded API that Clark did **not**
+auto-test. The user opted out of automatic testing; your job is to translate the
+API name into **click-through steps inside their app preview** — not to re-run
+\`testApi\` or \`runMigrationVerification\`.
+
+## When to use this skill
+
+- The user clicked **Get test instructions** on a skipped upgrade checklist row.
+- The user asks how to test a specific API during an active v2→v3 upgrade.
+- A prompt explicitly references this skill file.
+
+## Hard rules
+
+1. **Read-only guidance.** Do **NOT** call \`testApi\`, \`runMigrationVerification\`,
+   or mutate checklist state while writing instructions.
+2. **UI-first, not API-first.** Never tell the user to "verify \`GetOrders\`" without
+   explaining **where in the app** that API is triggered and **what they should see**.
+3. **Use the app preview.** Steps must be actions the user can perform in the
+   running preview (navigate, click, type, select, submit).
+4. **Be concrete.** Name pages, routes, buttons, tables, and fields using labels
+   from the codebase when you can find them.
+5. **If you cannot map the API to UI**, say so explicitly and suggest the most
+   likely pages to inspect — do not invent buttons or routes.
+
+## Procedure
+
+Given \`<ApiName>\` (matches \`server/apis/<ApiName>/api.ts\` and \`useApi("<ApiName>")\`):
+
+1. **Orient on the API**
+   - Read \`server/apis/<ApiName>/api.ts\` for a one-line summary of what it does
+     (integration, read vs write, key inputs).
+   - Optionally read \`scratch/v2-backup/apis/<ApiName>/api.yaml\` if the TS file
+     alone is ambiguous.
+
+2. **Find frontend call sites**
+   - Search \`client/**\` for \`useApi("<ApiName>")\` (exact string match on the API name).
+   - For each call site, read the surrounding component to learn:
+     - Which **page/route** renders it (\`client/router.tsx\`, page module path).
+     - What **user action** triggers the call (button click, form submit, page load,
+       table refresh, dropdown change, etc.).
+     - What **inputs** the user must supply (form fields, selections, filters).
+     - What **observable outcome** indicates success (data appears, toast, navigation,
+       row update, empty state clears, error banner absent).
+
+3. **Write the instruction list**
+   - Use a numbered checklist the user can follow top-to-bottom.
+   - Start with navigation: "Open the app preview and go to \`<route>\`."
+   - Each step is one user action: "Click **Save**", "Enter \`123\` in **Order ID**".
+   - End with an explicit **expected result** tied to the API's behavior.
+   - If multiple UI surfaces call the same API, list separate paths (Path A / Path B)
+     or pick the primary one and note alternates briefly.
+
+4. **Close with verification options**
+   - Tell the user that after they confirm the behavior matches v2 expectations,
+     they can:
+     - Reply in chat (e.g. "I verified \`<ApiName>\` — mark it complete"), or
+     - Use **Mark as verified** on the skipped checklist row.
+
+## Output format
+
+Use this structure in your reply:
+
+\`\`\`markdown
+## How to test \`<ApiName>\`
+
+**What this API does:** <one sentence>
+
+**Prerequisites:** <auth state, seed data, or inputs needed — or "none">
+
+### Steps
+
+1. ...
+2. ...
+3. ...
+
+**Expected result:** <what the user should see when v3 behaves correctly>
+
+**If something looks wrong:** <brief note on what to report back — error message,
+missing data, wrong shape — without attempting auto-fix unless asked>
+\`\`\`
+
+Keep steps short (typically 3–8). Prefer button/link labels from the UI over
+internal component names unless labels are missing.
+
+## Mapping tips
+
+| Signal in code                              | Turn into a user step                                                |
+| ------------------------------------------- | -------------------------------------------------------------------- |
+| \`useApi("X").run()\` in \`onClick\`            | "Click **\\<button label\\>**"                                         |
+| \`useApi("X").run()\` in \`useEffect\` on mount | "Navigate to **\\<route\\>** and wait for **\\<section\\>** to load"     |
+| API \`input\` schema field \`orderId\`          | "Enter a value in **Order ID**"                                      |
+| Table bound to API result                   | "Confirm the table shows **\\<describe rows/columns\\>**"              |
+| Mutation / POST-style API                   | Note any side effect the user should verify (new row, updated field) |
+
+## Forbidden shortcuts
+
+- "Just call the API" or "Run GetOrders in the API panel"
+- Marking the checklist item complete yourself while only writing instructions
+- Running automatic verification because you "want to double-check"
+- Generic advice with no route or click path ("exercise the relevant UI")
+`;
+//# sourceMappingURL=skill.generated.js.map

package/dist/ai-service/skills/system/migration-api-verification/skill.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.generated.js","sourceRoot":"","sources":["../../../../../src/ai-service/skills/system/migration-api-verification/skill.generated.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,mDAAmD;AAEnD,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmHtB,CAAC"}

package/dist/ai-service/skills/system/superblocks-migration/skill.generated.d.ts

@@ -1,2 +1,2 @@
-export declare const content = "---\nname: superblocks-migration\ndescription: |\n  Convert legacy Superblocks 2.0 YAML APIs (\"block-chain\" format) to the new 3.0 sdk-api TypeScript format.\n  Load when executing a v2\u2192v3 migration turn \u2014 the runtime prompt will tell you to.\nreadOnly: true\nmetadata:\n  author: superblocks\n  version: \"1.0\"\n---\n\n# v2 \u2192 v3 API Translation\n\nYou are converting **legacy Superblocks \"block-chain\" YAML APIs** into the **new code-mode `@superblocksteam/sdk-api` TypeScript format**. Each YAML file under `scratch/v2-backup/apis/<ApiName>/api.yaml` must be emitted as a single TypeScript file at `server/apis/<ApiName>/api.ts` that compiles, typechecks, and preserves behavior exactly.\n\n## Meta-rule: ZERO judgment calls\n\nIf any situation below is not resolved deterministically by this document, **STOP** for that API. Do **not** pick a default. Do **not** guess a factory, a shape, or an import. Skip it, continue with other APIs, and mark the checklist item as `failed` via `build_manageChecklist` with a short `failureReason` describing the exact ambiguity (failing rule, block name if any, what would be needed to proceed). This rule overrides everything else.\n\nCorollary: do not add `// TODO` comments that silently ship. Unresolved items live only as `failed` checklist entries.\n\nCorollary for `migration_page_route_verification_*`: see the _Page route verification_ section below \u2014 screenshot timeout/error \u2192 `failed`, never `completed`, never \"verified via router/source inspection.\" The full rule (including the hard-rule restatements) lives there to avoid drift.\n\n## Inputs and outputs\n\n- **Source tree:** `scratch/v2-backup/apis/<ApiName>/api.yaml`. Discover the actual set by listing the directory \u2014 do not hardcode a count or list.\n- **Target tree:** `server/apis/<ApiName>/api.ts`. Do not create scaffolding trees that do not already exist (see \"Registry registration\" below).\n- **Checklist:** the migration checklist has already been seeded with one item per API (id `api_<ApiName>`, origin `2.0-upgrade`, status `pending`, `clearOnFinalize: false`). Legacy in-flight runs may still have `origin: \"seed_api\"` for these API items. Pull the live set by calling `build_manageChecklist` with `action: \"get\"` and filtering to `status: \"pending\"` plus API-migration origins (`origin: \"2.0-upgrade\"` or legacy `origin: \"seed_api\"`) \u2014 that is your authoritative API list and count for this turn.\n\n## Required reading (read these BEFORE writing any output)\n\nAuthoritative. If a rule here conflicts with your priors, these win.\n\n1. `node_modules/@superblocksteam/sdk-api/README.md` \u2014 whole thing (api() contract, execution model, `ctx.*`, exports, error classes, performance best practices, `useApi` frontend hook, integration method table).\n2. `node_modules/@superblocksteam/sdk-api/src/index.ts` (the **barrel**) \u2014 the authoritative list of exported factory names. Integration factory names are whatever this file exports, not whatever the directory name is. Never invent or case-fold a factory name without confirming it here.\n3. The README for **every integration** referenced by the YAMLs you convert:\n   - `node_modules/@superblocksteam/sdk-api/src/integrations/<kind>/README.md`\n   - If a vendor-specific factory exists for the target service (e.g., a dedicated one for a given LLM provider), prefer it over a generic HTTP one.\n4. `skills/system/superblocks-migration/references/yaml-block-mapping.md` \u2014 full YAML \u2192 TS mapping for each legacy block type.\n\nThere is **no `javascript` integration** in sdk-api \u2014 inline JS/TS lives directly inside `run(ctx, input)`. Any block whose YAML key is `javascript:` becomes plain TypeScript in `run()`. The same applies to **`python:` blocks**: there is no `python` integration in sdk-api, so port the body to inline TypeScript inside `run(ctx, input)` (see \"Substituting unsupported integrations\" below and the Python section in `yaml-block-mapping.md`).\n\n## Substituting unsupported integrations\n\nThe pre-migration UI warns the user when an app references integrations whose v2 plugin is not present in sdk-api. The migration is **not** aborted on those APIs \u2014 they are still in your `seed_api` checklist and you are expected to make a best-effort port rather than immediately marking them `failed`.\n\nSubstitution rules (apply in order; first match wins):\n\n1. **`python:` step \u2192 inline TypeScript.** Re-write the Python body as equivalent TypeScript inside `run(ctx, input)`, exactly the way `javascript:` blocks are inlined. Translate Python idioms to JS/TS (e.g. `requests.get(...)` \u2192 `fetch(...)`, list comprehensions \u2192 `array.map`/`filter`, `len(x)` \u2192 `x.length`, dict access \u2192 object property access, `os.environ[...]` \u2192 `process.env[...]`, raise/except \u2192 `throw`/`try\u2026catch`). If the Python relied on a third-party PyPI package with no obvious JS equivalent, mark that one API `failed` with a `failureReason` naming the package \u2014 do not ship a guess.\n2. **HTTP-shaped vendor plugin \u2192 REST.** If an unsupported integration was effectively making REST calls (e.g. a thin wrapper around an HTTP API) and you can read the request shape from the YAML, port it to the `restApi` factory from sdk-api (or the dedicated vendor factory if one exists in the barrel \u2014 check `node_modules/@superblocksteam/sdk-api/src/index.ts`).\n3. **Otherwise, mark `failed`.** Per the meta-rule, do not invent a factory or fabricate behavior. Use `build_manageChecklist` with `status: \"failed\"` and a concrete `failureReason` (e.g. `\"unsupported integration <pluginId> with no JS-equivalent path\"`).\n\nDo **not** silently skip a step or replace it with a `// TODO` \u2014 every API still needs a deterministic outcome (`completed` or `failed`) on the checklist.\n\n## Preflight gate (MUST pass before any file edits)\n\nComplete this orientation sequence before writing or modifying any API file:\n\n0. **Install recommended user dependencies (before API work).** The platform restructure already computed exactly which v2 user-added packages the migrated client/server code imports, and persisted them at `scratch/migration-state.json` \u2192 `recommendedUserDeps` (each entry has `name`, `version`, and `dev`). Your job is to install that list \u2014 not to recompute it.\n   - Mark `migration_dependency_verification` as `in_progress` via `build_manageChecklist`.\n   - Read `scratch/migration-state.json` and extract `recommendedUserDeps`.\n   - If `recommendedUserDeps` is missing or empty, mark `migration_dependency_verification` as `completed` and continue to step 1.\n   - Otherwise, call `build_installPackages` **once** with every entry from `recommendedUserDeps` (passing `name`, `version`, and `dev` through unchanged). Do **not** skip because `node_modules` exists on disk; the platform never wrote these packages into `package.json`.\n   - **Failure semantics (covers every non-success outcome \u2014 no judgment calls):**\n     - On full success \u2192 mark `migration_dependency_verification` as `completed`.\n     - On **any** failure \u2014 full, partial (some packages installed, others did not), structured registry error (`not_in_registry`, `registry_auth_failed`, `registry_unreachable`), or unstructured error \u2014 mark `migration_dependency_verification` as `failed` with a `failureReason` that lists the affected package names and the tool's verbatim error code or message. Treat partial success the same as full failure for checklist purposes; do not split into multiple checklist items. Then continue to step 1 so API translation can still proceed. The user/operator will repair the registry/packages and re-trigger the migration turn.\n   - If `scratch/migration-state.json` also contains `recommendedUserDepsPinnedToLatest` (a string array of package names), include those names in the `failureReason` of `migration_dependency_verification` even on full success \u2014 phrased as \"pinned to latest, may need user confirmation: <names>\" \u2014 so the user can downgrade them before runtime if the latest major is incompatible. Use status `completed` in this case (the install succeeded), but the surfaced reason gives the user a checkpoint to act on.\n   - Do **not** scan imports yourself, edit `package.json`, or add packages outside `recommendedUserDeps`. If you believe a package is missing from the list, that is a platform bug: mark `migration_dependency_verification` as `failed` with `failureReason: \"platform bug: <pkg> imported by <file> but absent from recommendedUserDeps\"` and continue with API work using the packages that did install. (`build_manageChecklist` has no `note` action \u2014 `failed` with a structured `failureReason` is the only way to record this.)\n1. Call `build_manageChecklist` with `action: \"get\"` and filter to `status: \"pending\"` and API-migration origins (`origin: \"2.0-upgrade\"` or legacy `origin: \"seed_api\"`) \u2014 this is your authoritative API list and count for this turn.\n2. Read `node_modules/@superblocksteam/sdk-api/src/index.ts` and treat it as the **only** source of truth for sdk-api export/factory names.\n3. Read `node_modules/@superblocksteam/sdk-api/README.md`.\n4. For each API, read only the integration README(s) needed for that API right before migrating it (just-in-time). Do **not** preload every integration README for the entire app.\n\nHard constraints:\n\n- Do **not** rely on prior conversation memory, \"knowledge\" summaries, or inferred export names.\n- Do **not** start editing API files until preflight steps 0\u20133 are complete.\n- If a required file cannot be read, mark that API's checklist item `failed` with a concrete `failureReason` that names the missing path.\n\n## File layout & exports\n\n- One API per file, default export: `export default api({ ... });`.\n- Use ESM-style relative `.js` specifiers in imports.\n- File path: `server/apis/<ApiName>/api.ts` where `<ApiName>` is the YAML `metadata.name` (for example, `GetFloors` \u2192 `server/apis/GetFloors/api.ts`).\n- The `api({ name })` string and the registry key must both equal the YAML `metadata.name` verbatim \u2014 frontends call `useApi(\"<metadata.name>\")`.\n\n### Registry registration (conditional)\n\n- If `server/apis/index.ts` exists in the target tree: add an import + entry for each new module. Do not reorder existing entries.\n- If it does **not** exist: do **not** create it, do not create scaffolding. Mark the checklist item `failed` with a `failureReason` noting the missing registry.\n\n## Critical rules\n\n1. **Integration IDs are opaque per-YAML.** Extract each distinct `step.integration` UUID to a named `const` at the top of the file. Never carry UUIDs across files.\n2. **SQL: parameterize always.** Zero `${\u2026}` interpolations may remain inside any SQL string. Dynamic lists use `= ANY($N::<type>[])` \u2014 never string-building `IN (\u2026)`.\n3. **`query` vs `execute`.** Rows returned \u2192 `query` with Zod schema. Nothing actionable \u2192 `execute`.\n4. **Output shape preservation.** Mirror the legacy API's externally-visible response exactly \u2014 shape, nullability, cardinality. Do not wrap in envelopes.\n5. **Default is sequential.** `TYPE_FOREACH` \u2192 `for ... of` with sequential `await`. `Promise.all` only when YAML explicitly used a `parallel:` block.\n6. **Determinism, no slop.** No retries, no caching, no extra logging beyond a single `ctx.log.info(\"<ApiName> start\", {...})` at the top of `run`. No narrative code comments.\n7. **Never invent client methods.** If the integration README only documents `apiRequest`, use `apiRequest`.\n\n## Security / user identity\n\n- `authorization.type: AUTHORIZATION_TYPE_APP_USERS` is enforced by the server; rely on `ctx.user` in TS.\n- If the YAML accepts `userId` / `email` / etc. as API input, remove that input and read from `ctx.user` instead.\n\n## Observability\n\n- One `ctx.log.info(\"<ApiName> start\", { <safe-ids> })` at the top of `run` is allowed. Never log secrets, tokens, or PII.\n\n## Verification before you hand off\n\nRuntime verification (required):\n\n1. `build_debug` passing is required but not sufficient. Do not treat compile/typecheck success as proof that runtime behavior is correct.\n2. Use risk-based runtime checks: run `testApi` for APIs with integrations (REST/vendor/SQL), multi-step control flow, transformed outputs, or any uncertainty. For obviously simple APIs, you may skip `testApi`.\n3. If `testApi` output appears stale or mismatched, run `build_reloadFile` once and re-test. If runtime still fails after documented-method verification + one reload/retest cycle, record a concrete `failureReason` and continue.\n\nPage route verification (required once per migration run):\n\n**Hard rule:** A route is verified only with **runtime visual evidence on that exact path**. Reading `client/router.tsx`, page source, or backup artifacts is orientation only \u2014 it **never** satisfies verification.\n\n**Hard rule:** `build_debug` passing and `get_runtime_errors` returning `count: 0` are **not sufficient** for route verification. Do not mark routes `completed` because \"only APIs changed\" or \"the frontend files are unchanged.\"\n\n**Hard rule:** If `build_captureScreenshot` errors or times out for a route, mark that `migration_page_route_verification_*` item `failed` with `failureReason` naming the path and outcome (prefix `page_route_screenshot_timeout:` or `page_route_screenshot_error:`). Do **not** mark `completed`. Do **not** substitute router/source inspection.\n\n### Evidence required per route\n\nMark `completed` only when **all** are true:\n\n1. The app preview is on **that route's path** (not merely the default route).\n2. `build_captureScreenshot` **succeeds** and returns an image you inspect.\n3. You **describe** what you see and confirm it is not a loading-only view (follow the screenshot tool's skeleton/spinner retry procedure first).\n4. Any route-specific runtime errors are resolved (re-check after fixes).\n\n### Procedure (one route at a time)\n\n1. Enumerate checklist items whose IDs start with `migration_page_route_verification_`.\n2. Enumerate paths from `scratch/v2-backup/router.tsx` (fallback: `scratch/v2-backup/pages/**/index.tsx` confirmed against `client/router.tsx`).\n3. For each route: set the matching item `in_progress` \u2192 `build_navigatePreview` with that path \u2192 `build_captureScreenshot` \u2192 on success, `completed`.\n4. If the preview looks stale, `build_reloadFile` **once**, then retry screenshot. If capture still fails, `failed` with `failureReason` as above.\n5. Fix import/lazy-load/runtime failures, then repeat from step 3 for that route.\n\n### Forbidden shortcuts\n\n- Marking `completed` because `client/router.tsx` lists the path\n- Marking `completed` because the page module exists under `client/pages/`\n- Marking `completed` after screenshot timeout/error\n- Batch-marking all route items without per-route screenshot evidence\n\nFor each converted API, self-check:\n\n1. File default-exports exactly one `api({...})`; `name` matches `metadata.name`.\n2. Zero `${\u2026}` interpolations remain in any SQL string.\n3. No SQL `IN (\u2026)` built by concatenation; dynamic lists use `= ANY($N::<type>[])`.\n4. Every prior block's `.output` read is replaced by an actual result `const`.\n5. Input is the minimal union of identifiers the YAML references that are not produced by earlier blocks or `Variables`.\n6. Output shape exactly mirrors the legacy API's external response.\n7. If `server/apis/index.ts` exists, it registers the new module under `metadata.name`.\n8. **sdk-api integration wiring:** declare each integration in an `integrations: { \u2026 }` block and call it via `ctx.integrations.<key>` \u2014 never call `postgres(ID)` / `github(ID)` / etc. inside `run()` as if they were clients.\n9. **`input` / `output` schemas:** both are Zod schemas (`input: z.object({\u2026})`, `output: z.\u2026`). Do not use plain `{ field: { type: \"string\" } }` objects.\n10. **`run` signature:** `async run(ctx, input)` (or destructured input fields as the second argument). Never import `ctx` from the module scope.\n\n## Parallelization policy\n\nCount pending APIs from the checklist (`build_manageChecklist` `action: \"get\"`, filter `status: \"pending\"` and API-migration origins: `origin: \"2.0-upgrade\"` or legacy `origin: \"seed_api\"`).\n\n- **If the pending count is `< 8`:** migrate the APIs yourself, sequentially. Do NOT call `spawnCodingSubagents`. Work through each API using the per-API procedure below.\n- **If the pending count is `>= 8`:** you **MUST spawn sub-agents** to migrate these APIs in parallel. There are too many APIs to migrate sequentially yourself. Do NOT attempt to migrate APIs yourself in this run \u2014 use `spawnCodingSubagents`.\n  - Split the APIs into batches of ~5 (aim for 4\u20136 per batch), with a hard cap of **5 sub-agents total**. If more than 25 APIs remain, give later batches larger shares rather than spawning more than 5 workers.\n  - For each batch, craft an `instructions` string that:\n    - Names the exact `<ApiName>` values that sub-agent owns, verbatim, as a bulleted list.\n    - **Directs the sub-agent to `build_readFile` `skills/system/superblocks-migration/SKILL.md` (and the integration README(s) for the APIs it owns) before writing any files.** Do not inline a shortened sdk-api contract \u2014 keep a single source of truth.\n    - Restates the per-API procedure below so the sub-agent is self-contained.\n    - Reminds the sub-agent to update the shared checklist (id `api_<ApiName>`) for every item it owns.\n  - **Also pass `apiNames: [\"<ApiName1>\", \"<ApiName2>\", \u2026]` for every sub-agent**, listing the same names that appear in its `instructions`. The spawn tool stamps each `api_<ApiName>` checklist item with that sub-agent's `id` as `workerId` BEFORE fan-out, which lets the migration UI render one batch row per sub-agent in the chat sidebar. Forgetting `apiNames` is non-fatal (the sub-agents still run) but the sidebar checklist will fall back to one row per API instead of one per batch.\n  - **Call `spawnCodingSubagents` as the ONLY tool call in that turn.** Do not emit any other tool calls alongside it \u2014 no reads, no writes, no checklist updates. The tool blocks until every sub-agent finishes; you cannot do migration work \"while waiting\" because there is no waiting from your perspective \u2014 your next turn only begins after the tool returns. If you emit other tool calls in the same turn, you and the sub-agents will race on the shared checklist and corrupt state.\n  - **After `spawnCodingSubagents` returns** \u2014 only in a subsequent turn \u2014 read the checklist via `build_manageChecklist` with `action: \"get\"`. For any `failed` items, review the `failureReason`. Retry small numbers of recoverable failures yourself (sequentially, using the per-API procedure below). Leave deterministic failures as `failed`.\n\n## Per-API procedure\n\nFor APIs you migrate yourself, or that you embed in a sub-agent's `instructions`:\n\n1. Call `build_manageChecklist` with `action: \"update\"`, `itemId: \"api_<ApiName>\"`, `status: \"in_progress\"`.\n2. Read `scratch/v2-backup/apis/<ApiName>/api.yaml` and any sibling files the blocks reference.\n3. Produce the TypeScript module at `server/apis/<ApiName>/api.ts`, overwriting the stub. Use the YAML block \u2192 TS mapping in `skills/system/superblocks-migration/references/yaml-block-mapping.md`.\n4. If `server/apis/index.ts` exists, update it to register the new module.\n5. Call `build_debug`. If it fails, fix and repeat until it passes. Do not proceed to step 6 until `build_debug` succeeds.\n6. **Call `runMigrationVerification({ apiName: \"<ApiName>\", inputs: <inputs> })` and resolve every divergence in this same chat.** The tool's response includes `attempt` and `maxAttempts` so you don't need to track an attempt counter yourself \u2014 the server reads it from on-disk history per API.\n\n   Your job is to make v3 produce the same response as v2 \u2014 not to \"try a few times and punt to the user\". The user already lived with this API working on v2 with their real data; if v3 doesn't match, that's a regression you introduced, and you fix it here. NEVER leave a `diverged` API for the user to \"Accept divergence\" or \"Try one more attempt\" via the API calls panel \u2014 those buttons exist as escape hatches for situations the policy gate requires (mutations, denied integrations), not as a way for you to skip work.\n\n   Synthesize `inputs` the same way you would for `testApi`. Inspect the v2 YAML from step 2 (`apiInputs` / externally-declared parameters) and the v3 TS from step 3 (`input` schema on `run(ctx, input)`). Every name the caller must supply must appear as a top-level key in `inputs` with a realistic mock value matching its expected type. This includes two categories \u2014 do not conflate them:\n   - **API parameters** \u2014 names declared in `apiInputs` (v2) or the v3 `input` shape (e.g. `sourceContext`, `currentDocument`, `messages`). Pass each parameter name directly as a key in `inputs`. These are what the frontend passes when it invokes the API; they are not unavailable \"runtime bindings.\"\n   - **UI bindings and caller context** \u2014 values the API reads from the app that are not API parameters (component values like `Input1.value`/`Select1.selectedItem.id`, table selections like `Table1.selectedRow`, state variables, workflow `body`/`params` not declared as `apiInputs`). Mock each binding the API references that isn't produced by an earlier block.\n\n   Both v2 and v3 receive the same `inputs`, so this is what makes the diff meaningful \u2014 `{}` for an API that expects parameters or bindings produces a vacuous `both_failed` that tells you nothing. Errors like `'sourceContext' is not defined` (v2) or v3 input-validation failures for missing required fields mean you omitted keys from `inputs`; synthesize mocks and retry. That is not an environmental failure.\n\n   Outcomes and how to resolve them:\n   - **`passed`**: call `build_manageChecklist` with `status: \"completed\"`. Done.\n\n   **Platform gate:** the checklist store rejects `status: \"completed\"` on `api_<ApiName>` items until verification has run at least once (`lastVerificationAt` is set \u2014 normally via this tool). You cannot bulk-mark APIs complete without calling `runMigrationVerification` per API.\n   - **`skipped_mutation`**: this is a policy gate, not a deterministic pass. Do **NOT** mark the checklist item `completed` yet. Leave it unresolved (keep `in_progress`), continue processing other APIs, and resolve all skipped items in one grouped decision at the end of the run (see \"Mutation policy follow-up\" below).\n\n   - **`v2_unrunnable`**: the v2 backup itself couldn't execute, so there is no baseline to match. Call `build_manageChecklist` with `status: \"completed\"` and continue.\n\n   - **`timeout`**: a pipeline stalled past the reporting timeout (`side` says which one). This is transient environment noise \u2014 a dropped editor connection or a backgrounded browser tab \u2014 NOT evidence about the API. Do **NOT** mark the item `completed`. Retry `runMigrationVerification` after finishing your current API. If it times out repeatedly, tell the user verification is stalling (likely tab backgrounded / connection dropped), ask them to keep the app tab focused, and retry \u2014 never convert repeated timeouts into `completed`.\n\n   - **`disconnected`**: the editor connection was down when the pipeline tried to run (`side` says which one) \u2014 the app tab is closed, backgrounded, or reconnecting. Unlike `timeout` this diagnosis is certain, and it says nothing about the API. Do **NOT** mark the item `completed`. Tell the user the app tab must stay open and focused during verification, then retry `runMigrationVerification` \u2014 never convert `disconnected` into `completed`.\n\n   - **`both_failed`**:\n     - If you passed `inputs: {}` or omitted declared API parameters / bindings: synthesize real `inputs` (per the bullet above) and retry. Do NOT mark completed here \u2014 missing inputs caused this, not a real failure.\n     - If the error names a symbol that appears in `apiInputs` or the v3 `input` schema: add that key to `inputs` with a realistic mock and retry. Do NOT classify this as environmental \u2014 the parameter is available; you did not supply it.\n     - If you passed real inputs and v2 still failed: read v2's error. If it is environmental (auth/credentials/integration-unavailable: \"no integration configured\", \"401\", \"ECONNREFUSED\", \"missing API key\"), v2 cannot run in this verification context regardless of what you do \u2014 call `build_manageChecklist` with `status: \"completed\"` and continue; the user will verify manually. If it's a v2 runtime error that v3 also reproduces, treat as `diverged` (your inputs are wrong, or the API expects state that isn't reproducible here \u2014 revise inputs and retry).\n\n   - **`error`**: a system error in the verification flow itself (cannot read v3 source, etc.). Fix what you can; if it persists across one retry, mark the item `failed` with `failureReason: \"<error detail>\"` and continue.\n\n- **`diverged`**: the API ran on both sides and the outputs differ. **Iterate until v3 matches v2 byte-for-byte (modulo the normalizations api-comparator already applies: identical ISO timestamps, near-now ISO timestamps within \u00B160s of each other and \u00B15min of \"now\", UUIDs, monotonic integer IDs differing by \u22641 on fields whose leaf ends with \"id\", floats within 1e-9 relative tolerance, and per-request opaque identifiers at leaves named `requestId`/`traceId`/`spanId`/`correlationId`/`sessionId`/`nonce`/`csrfToken`/`_id` \u2014 note: a bare leaf named `token` is intentionally NOT normalized, since auth/access-token divergence is a security-relevant signal we want to surface).**\n\n  There is one bounded judgment exception: if both v2 and v3 executions succeeded, the output shape/types are equivalent, and the remaining diffs are value-level fields you reasonably infer are inherently non-deterministic outputs for this API, treat the migration as semantically complete for this run. In that case, mark the checklist item `completed` and continue.\n\n  Use this exception only when all of the following are true:\n  - The divergence is not structural (no missing/extra fields, no type mismatch, no changed nesting/cardinality, no changed error/status behavior).\n  - The differing fields are expected to vary per invocation and do not change control flow decisions.\n  - The API's functional contract remains intact for downstream consumers.\n\n  If any of those conditions are not met, the divergence is semantic and must be fixed \u2014 do NOT add code purely to mask values the comparator already tolerates.\n\n  For each `summaryForAgent` entry \u2014 every entry names the JSON path that diverged and the v2/v3 values \u2014 find the block in `server/apis/<ApiName>/api.ts` that produces that path and fix the discrepancy. Common causes, in rough order of frequency:\n  - wrong column projection or missing field in a SELECT\n  - missing transform / output shape mismatch (array vs object wrapper, single vs list)\n  - off-by-one or wrong placeholder in a SQL parameter\n  - mistyped binding key (case, plural, dotted path)\n  - type coercion (string vs number, null vs undefined, boolean vs \"true\")\n  - missing default value when the binding is undefined\n  - wrong join order or implicit ordering of rows\n  - filter/where condition different from v2\n  - missing `LIMIT`, `OFFSET`, or pagination handling\n\n  If a divergence stems from the `inputs` you passed (e.g. v2 echoes the input one way and v3 a different way because they normalize it differently), revise the inputs alongside the source.\n\n  Then call `build_debug` (fix any failures), then `runMigrationVerification` again with the revised source/inputs.\n\n  **There is no fixed retry budget \u2014 iterate until `passed` or until you have firm structural evidence that no v3 source change can reconcile v2 and v3.** Acceptable evidence for stopping: v2 references a YAML construct with no v3 SDK equivalent and the divergence is in that construct; v2 derives a value from runtime state v3 cannot observe (e.g. an env var that differs by environment). When you stop on structural grounds, mark the item `failed` with `failureReason: \"verification_diverged_irreconcilable: <one-paragraph reason naming the specific summaryForAgent entry and the structural reason> | summary: <JSON.stringify(summaryForAgent)>\"`.\n\n  Guardrail against infinite loops (NOT a retry budget): if you have iterated 8 times on the same API and the set of divergences has not materially changed across the last 3 attempts (i.e. you are flailing, not converging), stop and mark `failed` with the same `failureReason` shape. If you ARE converging \u2014 fewer divergences each attempt, or the remaining ones look smaller \u2014 keep going past 8.\n\n## Run-level rules\n\n- Do NOT emit a free-text UNRESOLVED report \u2014 every unresolved item must be a `failed` checklist entry with a `failureReason`.\n- Do NOT stop the run because one API failed. Only stop once every API is either `completed` or `failed`.\n\n## Mutation policy follow-up (required once per run if any API returned `skipped_mutation`)\n\nAfter you've done everything deterministic (all non-skipped APIs settled), if one or more APIs ended with `skipped_mutation`, call **one** grouped `askMultiChoice` with exactly these options:\n\n- `Mark all untested APIs as complete`\n- `Test them, and you'll be prompted for permission`\n\nThen:\n\n1. If user picks **`Mark all untested APIs as complete`**:\n   - For each skipped API checklist item, call `build_manageChecklist` update \u2192 `status: \"completed\"`.\n2. If user picks **`Test them, and you'll be prompted for permission`**:\n   - Clear persisted write-policy first so a `deny` modal choice does not keep forcing `skipped_mutation`:\n     - read `scratch/migration-state.json`\n     - remove the `integrationWritePolicy` field\n     - write the file back\n   - Then run `testApi` for each skipped API so the runtime can prompt the user for write approval in-context.\n   - After user approvals and tests settle, update checklist status accordingly (`completed` on success, `failed` with concrete `failureReason` on deterministic blockers).\n\n## Post-batch re-verification\n\nAfter `spawnCodingSubagents` returns (or after all sequential APIs are settled), before updating the checklist overall status:\n\n1. Call `build_manageChecklist` with `action: \"get\"` and read all items.\n2. For any item where `verificationOutcome === \"auto_passed\"` and `lastVerificationAt` is older than any sibling item's `updatedAt` minus 60 seconds: this item may have drifted due to registry edits made by later sub-agents. Re-run `runMigrationVerification({ apiName, inputs: <inputs> })` for each such item \u2014 synthesize `inputs` the same way as in step 6 of the per-API procedure.\n3. If any re-verification produces `diverged`, apply the normal per-API diverge\u2192retry loop (no fixed retry budget; iterate until `passed` or firm structural-irreconcilability evidence, with the anti-flail guardrail at 8 iterations without convergence).\n4. Proceed to mark overall checklist completed/failed only after all re-verifications settle.\n";
+export declare const content = "---\nname: superblocks-migration\ndescription: |\n  Convert legacy Superblocks 2.0 YAML APIs (\"block-chain\" format) to the new 3.0 sdk-api TypeScript format.\n  Load when executing a v2\u2192v3 migration turn \u2014 the runtime prompt will tell you to.\nreadOnly: true\nmetadata:\n  author: superblocks\n  version: \"1.0\"\n---\n\n# v2 \u2192 v3 API Translation\n\nYou are converting **legacy Superblocks \"block-chain\" YAML APIs** into the **new code-mode `@superblocksteam/sdk-api` TypeScript format**. Each YAML file under `scratch/v2-backup/apis/<ApiName>/api.yaml` must be emitted as a single TypeScript file at `server/apis/<ApiName>/api.ts` that compiles, typechecks, and preserves behavior exactly.\n\n## Meta-rule: ZERO judgment calls\n\nIf any situation below is not resolved deterministically by this document, **STOP** for that API. Do **not** pick a default. Do **not** guess a factory, a shape, or an import. Skip it, continue with other APIs, and mark the checklist item as `failed` via `build_manageChecklist` with a short `failureReason` describing the exact ambiguity (failing rule, block name if any, what would be needed to proceed). This rule overrides everything else.\n\nCorollary: do not add `// TODO` comments that silently ship. Unresolved items live only as `failed` checklist entries.\n\nCorollary for `migration_page_route_verification_*`: see the _Page route verification_ section below \u2014 screenshot timeout/error \u2192 `failed`, never `completed`, never \"verified via router/source inspection.\" The full rule (including the hard-rule restatements) lives there to avoid drift.\n\n## Inputs and outputs\n\n- **Source tree:** `scratch/v2-backup/apis/<ApiName>/api.yaml`. Discover the actual set by listing the directory \u2014 do not hardcode a count or list.\n- **Target tree:** `server/apis/<ApiName>/api.ts`. Do not create scaffolding trees that do not already exist (see \"Registry registration\" below).\n- **Checklist:** the migration checklist has already been seeded with one item per API (id `api_<ApiName>`, origin `2.0-upgrade`, status `pending`, `clearOnFinalize: false`). Legacy in-flight runs may still have `origin: \"seed_api\"` for these API items. Pull the live set by calling `build_manageChecklist` with `action: \"get\"` and filtering to `status: \"pending\"` plus API-migration origins (`origin: \"2.0-upgrade\"` or legacy `origin: \"seed_api\"`) \u2014 that is your authoritative API list and count for this turn.\n\n## Required reading (read these BEFORE writing any output)\n\nAuthoritative. If a rule here conflicts with your priors, these win.\n\n1. `node_modules/@superblocksteam/sdk-api/README.md` \u2014 whole thing (api() contract, execution model, `ctx.*`, exports, error classes, performance best practices, `useApi` frontend hook, integration method table).\n2. `node_modules/@superblocksteam/sdk-api/src/index.ts` (the **barrel**) \u2014 the authoritative list of exported factory names. Integration factory names are whatever this file exports, not whatever the directory name is. Never invent or case-fold a factory name without confirming it here.\n3. The README for **every integration** referenced by the YAMLs you convert:\n   - `node_modules/@superblocksteam/sdk-api/src/integrations/<kind>/README.md`\n   - If a vendor-specific factory exists for the target service (e.g., a dedicated one for a given LLM provider), prefer it over a generic HTTP one.\n4. `skills/system/superblocks-migration/references/yaml-block-mapping.md` \u2014 full YAML \u2192 TS mapping for each legacy block type.\n\nThere is **no `javascript` integration** in sdk-api \u2014 inline JS/TS lives directly inside `run(ctx, input)`. Any block whose YAML key is `javascript:` becomes plain TypeScript in `run()`. The same applies to **`python:` blocks**: there is no `python` integration in sdk-api, so port the body to inline TypeScript inside `run(ctx, input)` (see \"Substituting unsupported integrations\" below and the Python section in `yaml-block-mapping.md`).\n\n## Substituting unsupported integrations\n\nThe pre-migration UI warns the user when an app references integrations whose v2 plugin is not present in sdk-api. The migration is **not** aborted on those APIs \u2014 they are still in your `seed_api` checklist and you are expected to make a best-effort port rather than immediately marking them `failed`.\n\nSubstitution rules (apply in order; first match wins):\n\n1. **`python:` step \u2192 inline TypeScript.** Re-write the Python body as equivalent TypeScript inside `run(ctx, input)`, exactly the way `javascript:` blocks are inlined. Translate Python idioms to JS/TS (e.g. `requests.get(...)` \u2192 `fetch(...)`, list comprehensions \u2192 `array.map`/`filter`, `len(x)` \u2192 `x.length`, dict access \u2192 object property access, `os.environ[...]` \u2192 `process.env[...]`, raise/except \u2192 `throw`/`try\u2026catch`). If the Python relied on a third-party PyPI package with no obvious JS equivalent, mark that one API `failed` with a `failureReason` naming the package \u2014 do not ship a guess.\n2. **HTTP-shaped vendor plugin \u2192 REST.** If an unsupported integration was effectively making REST calls (e.g. a thin wrapper around an HTTP API) and you can read the request shape from the YAML, port it to the `restApi` factory from sdk-api (or the dedicated vendor factory if one exists in the barrel \u2014 check `node_modules/@superblocksteam/sdk-api/src/index.ts`).\n3. **Otherwise, mark `failed`.** Per the meta-rule, do not invent a factory or fabricate behavior. Use `build_manageChecklist` with `status: \"failed\"` and a concrete `failureReason` (e.g. `\"unsupported integration <pluginId> with no JS-equivalent path\"`).\n\nDo **not** silently skip a step or replace it with a `// TODO` \u2014 every API still needs a deterministic outcome (`completed` or `failed`) on the checklist.\n\n## Preflight gate (MUST pass before any file edits)\n\nComplete this orientation sequence before writing or modifying any API file:\n\n0. **Install recommended user dependencies (before API work).** The platform restructure already computed exactly which v2 user-added packages the migrated client/server code imports, and persisted them at `scratch/migration-state.json` \u2192 `recommendedUserDeps` (each entry has `name`, `version`, and `dev`). Your job is to install that list \u2014 not to recompute it.\n   - Mark `migration_dependency_verification` as `in_progress` via `build_manageChecklist`.\n   - Read `scratch/migration-state.json` and extract `recommendedUserDeps`.\n   - If `recommendedUserDeps` is missing or empty, mark `migration_dependency_verification` as `completed` and continue to step 1.\n   - Otherwise, call `build_installPackages` **once** with every entry from `recommendedUserDeps` (passing `name`, `version`, and `dev` through unchanged). Do **not** skip because `node_modules` exists on disk; the platform never wrote these packages into `package.json`.\n   - **Failure semantics (covers every non-success outcome \u2014 no judgment calls):**\n     - On full success \u2192 mark `migration_dependency_verification` as `completed`.\n     - On **any** failure \u2014 full, partial (some packages installed, others did not), structured registry error (`not_in_registry`, `registry_auth_failed`, `registry_unreachable`), or unstructured error \u2014 mark `migration_dependency_verification` as `failed` with a `failureReason` that lists the affected package names and the tool's verbatim error code or message. Treat partial success the same as full failure for checklist purposes; do not split into multiple checklist items. Then continue to step 1 so API translation can still proceed. The user/operator will repair the registry/packages and re-trigger the migration turn.\n   - If `scratch/migration-state.json` also contains `recommendedUserDepsPinnedToLatest` (a string array of package names), include those names in the `failureReason` of `migration_dependency_verification` even on full success \u2014 phrased as \"pinned to latest, may need user confirmation: <names>\" \u2014 so the user can downgrade them before runtime if the latest major is incompatible. Use status `completed` in this case (the install succeeded), but the surfaced reason gives the user a checkpoint to act on.\n   - Do **not** scan imports yourself, edit `package.json`, or add packages outside `recommendedUserDeps`. If you believe a package is missing from the list, that is a platform bug: mark `migration_dependency_verification` as `failed` with `failureReason: \"platform bug: <pkg> imported by <file> but absent from recommendedUserDeps\"` and continue with API work using the packages that did install. (`build_manageChecklist` has no `note` action \u2014 `failed` with a structured `failureReason` is the only way to record this.)\n1. Call `build_manageChecklist` with `action: \"get\"` and filter to `status: \"pending\"` and API-migration origins (`origin: \"2.0-upgrade\"` or legacy `origin: \"seed_api\"`) \u2014 this is your authoritative API list and count for this turn.\n2. Read `node_modules/@superblocksteam/sdk-api/src/index.ts` and treat it as the **only** source of truth for sdk-api export/factory names.\n3. Read `node_modules/@superblocksteam/sdk-api/README.md`.\n4. For each API, read only the integration README(s) needed for that API right before migrating it (just-in-time). Do **not** preload every integration README for the entire app.\n\nHard constraints:\n\n- Do **not** rely on prior conversation memory, \"knowledge\" summaries, or inferred export names.\n- Do **not** start editing API files until preflight steps 0\u20133 are complete.\n- If a required file cannot be read, mark that API's checklist item `failed` with a concrete `failureReason` that names the missing path.\n\n## File layout & exports\n\n- One API per file, default export: `export default api({ ... });`.\n- Use ESM-style relative `.js` specifiers in imports.\n- File path: `server/apis/<ApiName>/api.ts` where `<ApiName>` is the YAML `metadata.name` (for example, `GetFloors` \u2192 `server/apis/GetFloors/api.ts`).\n- The `api({ name })` string and the registry key must both equal the YAML `metadata.name` verbatim \u2014 frontends call `useApi(\"<metadata.name>\")`.\n\n### Registry registration (conditional)\n\n- If `server/apis/index.ts` exists in the target tree: add an import + entry for each new module. Do not reorder existing entries.\n- If it does **not** exist: do **not** create it, do not create scaffolding. Mark the checklist item `failed` with a `failureReason` noting the missing registry.\n\n## Critical rules\n\n1. **Integration IDs are opaque per-YAML.** Extract each distinct `step.integration` UUID to a named `const` at the top of the file. Never carry UUIDs across files.\n2. **SQL: parameterize always.** Zero `${\u2026}` interpolations may remain inside any SQL string. Dynamic lists use `= ANY($N::<type>[])` \u2014 never string-building `IN (\u2026)`.\n3. **`query` vs `execute`.** Rows returned \u2192 `query` with Zod schema. Nothing actionable \u2192 `execute`.\n4. **Output shape preservation.** Mirror the legacy API's externally-visible response exactly \u2014 shape, nullability, cardinality. Do not wrap in envelopes.\n5. **Default is sequential.** `TYPE_FOREACH` \u2192 `for ... of` with sequential `await`. `Promise.all` only when YAML explicitly used a `parallel:` block.\n6. **Determinism, no slop.** No retries, no caching, no extra logging beyond a single `ctx.log.info(\"<ApiName> start\", {...})` at the top of `run`. No narrative code comments.\n7. **Never invent client methods.** If the integration README only documents `apiRequest`, use `apiRequest`.\n\n## Security / user identity\n\n- `authorization.type: AUTHORIZATION_TYPE_APP_USERS` is enforced by the server; rely on `ctx.user` in TS.\n- If the YAML accepts `userId` / `email` / etc. as API input, remove that input and read from `ctx.user` instead.\n\n## Observability\n\n- One `ctx.log.info(\"<ApiName> start\", { <safe-ids> })` at the top of `run` is allowed. Never log secrets, tokens, or PII.\n\n## Verification before you hand off\n\nRuntime verification (required):\n\n1. `build_debug` passing is required but not sufficient. Do not treat compile/typecheck success as proof that runtime behavior is correct.\n2. Use risk-based runtime checks: run `testApi` for APIs with integrations (REST/vendor/SQL), multi-step control flow, transformed outputs, or any uncertainty. For obviously simple APIs, you may skip `testApi`.\n3. If `testApi` output appears stale or mismatched, run `build_reloadFile` once and re-test. If runtime still fails after documented-method verification + one reload/retest cycle, record a concrete `failureReason` and continue.\n\nPage route verification (required once per migration run):\n\n**Hard rule:** A route is verified only with **runtime visual evidence on that exact path**. Reading `client/router.tsx`, page source, or backup artifacts is orientation only \u2014 it **never** satisfies verification.\n\n**Hard rule:** `build_debug` passing and `get_runtime_errors` returning `count: 0` are **not sufficient** for route verification. Do not mark routes `completed` because \"only APIs changed\" or \"the frontend files are unchanged.\"\n\n**Hard rule:** If `build_captureScreenshot` errors or times out for a route, mark that `migration_page_route_verification_*` item `failed` with `failureReason` naming the path and outcome (prefix `page_route_screenshot_timeout:` or `page_route_screenshot_error:`). Do **not** mark `completed`. Do **not** substitute router/source inspection.\n\n### Evidence required per route\n\nMark `completed` only when **all** are true:\n\n1. The app preview is on **that route's path** (not merely the default route).\n2. `build_captureScreenshot` **succeeds** and returns an image you inspect.\n3. You **describe** what you see and confirm it is not a loading-only view (follow the screenshot tool's skeleton/spinner retry procedure first).\n4. Any route-specific runtime errors are resolved (re-check after fixes).\n\n### Procedure (one route at a time)\n\n1. Enumerate checklist items whose IDs start with `migration_page_route_verification_`.\n2. Enumerate paths from `scratch/v2-backup/router.tsx` (fallback: `scratch/v2-backup/pages/**/index.tsx` confirmed against `client/router.tsx`).\n3. For each route: set the matching item `in_progress` \u2192 `build_navigatePreview` with that path \u2192 `build_captureScreenshot` \u2192 on success, `completed`.\n4. If the preview looks stale, `build_reloadFile` **once**, then retry screenshot. If capture still fails, `failed` with `failureReason` as above.\n5. Fix import/lazy-load/runtime failures, then repeat from step 3 for that route.\n\n### Forbidden shortcuts\n\n- Marking `completed` because `client/router.tsx` lists the path\n- Marking `completed` because the page module exists under `client/pages/`\n- Marking `completed` after screenshot timeout/error\n- Batch-marking all route items without per-route screenshot evidence\n\nFor each converted API, self-check:\n\n1. File default-exports exactly one `api({...})`; `name` matches `metadata.name`.\n2. Zero `${\u2026}` interpolations remain in any SQL string.\n3. No SQL `IN (\u2026)` built by concatenation; dynamic lists use `= ANY($N::<type>[])`.\n4. Every prior block's `.output` read is replaced by an actual result `const`.\n5. Input is the minimal union of identifiers the YAML references that are not produced by earlier blocks or `Variables`.\n6. Output shape exactly mirrors the legacy API's external response.\n7. If `server/apis/index.ts` exists, it registers the new module under `metadata.name`.\n8. **sdk-api integration wiring:** declare each integration in an `integrations: { \u2026 }` block and call it via `ctx.integrations.<key>` \u2014 never call `postgres(ID)` / `github(ID)` / etc. inside `run()` as if they were clients.\n9. **`input` / `output` schemas:** both are Zod schemas (`input: z.object({\u2026})`, `output: z.\u2026`). Do not use plain `{ field: { type: \"string\" } }` objects.\n10. **`run` signature:** `async run(ctx, input)` (or destructured input fields as the second argument). Never import `ctx` from the module scope.\n\n## Parallelization policy\n\nCount pending APIs from the checklist (`build_manageChecklist` `action: \"get\"`, filter `status: \"pending\"` and API-migration origins: `origin: \"2.0-upgrade\"` or legacy `origin: \"seed_api\"`).\n\n- **If the pending count is `< 8`:** migrate the APIs yourself, sequentially. Do NOT call `spawnCodingSubagents`. Work through each API using the per-API procedure below.\n- **If the pending count is `>= 8`:** you **MUST spawn sub-agents** to migrate these APIs in parallel. There are too many APIs to migrate sequentially yourself. Do NOT attempt to migrate APIs yourself in this run \u2014 use `spawnCodingSubagents`.\n  - Split the APIs into batches of ~5 (aim for 4\u20136 per batch), with a hard cap of **5 sub-agents total**. If more than 25 APIs remain, give later batches larger shares rather than spawning more than 5 workers.\n  - For each batch, craft an `instructions` string that:\n    - Names the exact `<ApiName>` values that sub-agent owns, verbatim, as a bulleted list.\n    - **Directs the sub-agent to `build_readFile` `skills/system/superblocks-migration/SKILL.md` (and the integration README(s) for the APIs it owns) before writing any files.** Do not inline a shortened sdk-api contract \u2014 keep a single source of truth.\n    - Restates the per-API procedure below so the sub-agent is self-contained.\n    - Reminds the sub-agent to update the shared checklist (id `api_<ApiName>`) for every item it owns.\n    - **Restates the vacuous-pass rule and the sentinel explicitly**: the sub-agent must apply the `passed` outcome's vacuous-pass check itself (source real inputs before accepting a sad-path-only pass), and when it marks an API `completed` on an exhausted sourcing attempt it MUST set `failureReason` to `vacuous_pass_accepted: <reason>`. This is the only signal that reaches you \u2014 you run the final sweep without the sub-agents' chat context, so an unflagged vacuous pass is invisible to you.\n  - **Also pass `apiNames: [\"<ApiName1>\", \"<ApiName2>\", \u2026]` for every sub-agent**, listing the same names that appear in its `instructions`. The spawn tool stamps each `api_<ApiName>` checklist item with that sub-agent's `id` as `workerId` BEFORE fan-out, which lets the migration UI render one batch row per sub-agent in the chat sidebar. Forgetting `apiNames` is non-fatal (the sub-agents still run) but the sidebar checklist will fall back to one row per API instead of one per batch.\n  - **Call `spawnCodingSubagents` as the ONLY tool call in that turn.** Do not emit any other tool calls alongside it \u2014 no reads, no writes, no checklist updates. The tool blocks until every sub-agent finishes; you cannot do migration work \"while waiting\" because there is no waiting from your perspective \u2014 your next turn only begins after the tool returns. If you emit other tool calls in the same turn, you and the sub-agents will race on the shared checklist and corrupt state.\n  - **After `spawnCodingSubagents` returns** \u2014 only in a subsequent turn \u2014 read the checklist via `build_manageChecklist` with `action: \"get\"`. For any `failed` items, review the `failureReason`. Retry small numbers of recoverable failures yourself (sequentially, using the per-API procedure below). Leave deterministic failures as `failed`.\n\n## Per-API procedure\n\nFor APIs you migrate yourself, or that you embed in a sub-agent's `instructions`:\n\n1. Call `build_manageChecklist` with `action: \"update\"`, `itemId: \"api_<ApiName>\"`, `status: \"in_progress\"`.\n2. Read `scratch/v2-backup/apis/<ApiName>/api.yaml` and any sibling files the blocks reference.\n3. Produce the TypeScript module at `server/apis/<ApiName>/api.ts`, overwriting the stub. Use the YAML block \u2192 TS mapping in `skills/system/superblocks-migration/references/yaml-block-mapping.md`.\n4. If `server/apis/index.ts` exists, update it to register the new module.\n5. Call `build_debug`. If it fails, fix and repeat until it passes. Do not proceed to step 6 until `build_debug` succeeds.\n6. **Call `runMigrationVerification({ apiName: \"<ApiName>\", inputs: <inputs> })` and resolve every divergence in this same chat.** The tool's response includes `attempt` and `maxAttempts` so you don't need to track an attempt counter yourself \u2014 the server reads it from on-disk history per API.\n\n   Your job is to make v3 produce the same response as v2 \u2014 not to \"try a few times and punt to the user\". The user already lived with this API working on v2 with their real data; if v3 doesn't match, that's a regression you introduced, and you fix it here. NEVER leave a `diverged` API for the user to \"Accept divergence\" or \"Try one more attempt\" via the API calls panel \u2014 those buttons exist as escape hatches for situations the policy gate requires (mutations, denied integrations), not as a way for you to skip work.\n\n   Synthesize `inputs` the same way you would for `testApi`. Inspect the v2 YAML from step 2 (`apiInputs` / externally-declared parameters) and the v3 TS from step 3 (`input` schema on `run(ctx, input)`). Every name the caller must supply must appear as a top-level key in `inputs` with a realistic value \u2014 a mock, or a real value harvested per the \"Sourcing input values\" rules below \u2014 matching its expected type. This includes two categories \u2014 do not conflate them:\n   - **API parameters** \u2014 names declared in `apiInputs` (v2) or the v3 `input` shape (e.g. `sourceContext`, `currentDocument`, `messages`). Pass each parameter name directly as a key in `inputs`. These are what the frontend passes when it invokes the API; they are not unavailable \"runtime bindings.\"\n   - **UI bindings and caller context** \u2014 values the API reads from the app that are not API parameters (component values like `Input1.value`/`Select1.selectedItem.id`, table selections like `Table1.selectedRow`, state variables, workflow `body`/`params` not declared as `apiInputs`). Mock each binding the API references that isn't produced by an earlier block.\n\n   Both v2 and v3 receive the same `inputs`, so this is what makes the diff meaningful \u2014 `{}` for an API that expects parameters or bindings produces a vacuous `both_failed` that tells you nothing. Errors like `'sourceContext' is not defined` (v2) or v3 input-validation failures for missing required fields mean you omitted keys from `inputs`; synthesize mocks and retry. That is not an environmental failure.\n\n   **Sourcing input values \u2014 real app data over invented data.** A value is only \"realistic\" if the system the API talks to actually accepts it. Invented values are fine for self-contained inputs (a search string, a page size, a boolean flag). But when an input must reference something that already exists \u2014 any key the target system looks up, such as a row/record ID, a resource name, or an uploaded-file reference \u2014 do NOT invent it: an invented identifier either fails on both sides or exercises only the not-found/guard-clause path, and neither proves the API works. Source a real value instead, in this order:\n   1. **Harvest from the app's own APIs.** Find a read-only API in this app (prefer zero-input \"list\"/\"get all\" APIs) whose output contains the identifier you need, run it via `testApi`, and take a value from its real response. Chain as needed: a list API yields a real ID \u2192 pass it to the detail API \u2192 its response yields the next identifier. Prefer migrating and verifying zero-input read-only APIs first so their outputs become your pool of real test data.\n   2. **Follow the client code.** The `useApi`/`useApiData`/`executeApi` call sites under `client/` (and the v2 pages under `scratch/v2-backup/`) show where the app gets each input \u2014 a table's selected row, a route param, a select populated by another API. Trace that source to a concrete real value.\n   3. Only if neither path yields a value, fall back to an invented mock \u2014 and treat any resulting not-found/empty output as unverified (see the vacuous-pass rule under `passed` below).\n\n   Outcomes and how to resolve them:\n   - **`passed`**: `passed` only proves v2 and v3 agree on the inputs you supplied. Before accepting it, check what actually ran: if the shared output is a sad-path/guard-clause result \u2014 a not-found or error object from a caught exception, a validity flag that came back false, an empty result from a lookup that should have matched \u2014 the API's core logic never executed and the pass is vacuous. In that case source real inputs (per the sourcing rules above) and re-run `runMigrationVerification`; only accept a sad-path-only pass after the sourcing steps genuinely produced no usable value. Once a non-vacuous `passed` is in hand, call `build_manageChecklist` with `status: \"completed\"`. Done. If instead you are marking `completed` on an exhausted sourcing attempt (the pass stayed vacuous), you MUST also set `failureReason` to a string beginning `vacuous_pass_accepted:` followed by a one-line reason \u2014 this sentinel is the only durable signal that survives into the final sweep (and across sub-agents, whose chat context the orchestrator cannot see).\n\n   **Platform gate:** the checklist store rejects `status: \"completed\"` on `api_<ApiName>` items until verification has run at least once (`lastVerificationAt` is set \u2014 normally via this tool). You cannot bulk-mark APIs complete without calling `runMigrationVerification` per API.\n   - **`skipped_mutation`**: the runtime marks the checklist item `completed` with `verificationSkippedReason: \"mutation\"` automatically. Do **NOT** keep it `in_progress` or ask the user a grouped decision. Continue translating each API as well as you can from the code; the user will verify mutation-skipped APIs manually at finalize time.\n\n   - **`v2_unrunnable`**: the v2 backup itself couldn't execute, so there is no baseline to match. Call `build_manageChecklist` with `status: \"completed\"` and continue.\n\n   - **`timeout`**: a pipeline stalled past the reporting timeout (`side` says which one). This is transient environment noise \u2014 a dropped editor connection or a backgrounded browser tab \u2014 NOT evidence about the API. Do **NOT** mark the item `completed`. Retry `runMigrationVerification` after finishing your current API. If it times out repeatedly, tell the user verification is stalling (likely tab backgrounded / connection dropped), ask them to keep the app tab focused, and retry \u2014 never convert repeated timeouts into `completed`.\n\n   - **`disconnected`**: the editor connection was down when the pipeline tried to run (`side` says which one) \u2014 the app tab is closed, backgrounded, or reconnecting. Unlike `timeout` this diagnosis is certain, and it says nothing about the API. Do **NOT** mark the item `completed`. Tell the user the app tab must stay open and focused during verification, then retry `runMigrationVerification` \u2014 never convert `disconnected` into `completed`.\n\n   - **`both_failed`**:\n     - If you passed `inputs: {}` or omitted declared API parameters / bindings: synthesize real `inputs` (per the bullet above) and retry. Do NOT mark completed here \u2014 missing inputs caused this, not a real failure.\n     - If the error names a symbol that appears in `apiInputs` or the v3 `input` schema: add that key to `inputs` with a realistic mock and retry. Do NOT classify this as environmental \u2014 the parameter is available; you did not supply it.\n     - If you passed real inputs and v2 still failed: read v2's error. If it is environmental (auth/credentials/integration-unavailable: \"no integration configured\", \"401\", \"ECONNREFUSED\", \"missing API key\"), v2 cannot run in this verification context regardless of what you do \u2014 call `build_manageChecklist` with `status: \"completed\"` and continue; the user will verify manually. If it's a v2 runtime error that v3 also reproduces, treat as `diverged` (your inputs are wrong, or the API expects state that isn't reproducible here \u2014 revise inputs and retry).\n\n   - **`error`**: a system error in the verification flow itself (cannot read v3 source, etc.). Fix what you can; if it persists across one retry, mark the item `failed` with `failureReason: \"<error detail>\"` and continue.\n\n- **`diverged`**: the API ran on both sides and the outputs differ. **Iterate until v3 matches v2 byte-for-byte (modulo the normalizations api-comparator already applies: identical ISO timestamps, near-now ISO timestamps within \u00B160s of each other and \u00B15min of \"now\", UUIDs, monotonic integer IDs differing by \u22641 on fields whose leaf ends with \"id\", floats within 1e-9 relative tolerance, and per-request opaque identifiers at leaves named `requestId`/`traceId`/`spanId`/`correlationId`/`sessionId`/`nonce`/`csrfToken`/`_id` \u2014 note: a bare leaf named `token` is intentionally NOT normalized, since auth/access-token divergence is a security-relevant signal we want to surface).**\n\n  There is one bounded judgment exception: if both v2 and v3 executions succeeded, the output shape/types are equivalent, and the remaining diffs are value-level fields you reasonably infer are inherently non-deterministic outputs for this API, treat the migration as semantically complete for this run. In that case, mark the checklist item `completed` and continue.\n\n  Use this exception only when all of the following are true:\n  - The divergence is not structural (no missing/extra fields, no type mismatch, no changed nesting/cardinality, no changed error/status behavior).\n  - The differing fields are expected to vary per invocation and do not change control flow decisions.\n  - The API's functional contract remains intact for downstream consumers.\n\n  If any of those conditions are not met, the divergence is semantic and must be fixed \u2014 do NOT add code purely to mask values the comparator already tolerates.\n\n  For each `summaryForAgent` entry \u2014 every entry names the JSON path that diverged and the v2/v3 values \u2014 find the block in `server/apis/<ApiName>/api.ts` that produces that path and fix the discrepancy. Common causes, in rough order of frequency:\n  - wrong column projection or missing field in a SELECT\n  - missing transform / output shape mismatch (array vs object wrapper, single vs list)\n  - off-by-one or wrong placeholder in a SQL parameter\n  - mistyped binding key (case, plural, dotted path)\n  - type coercion (string vs number, null vs undefined, boolean vs \"true\")\n  - missing default value when the binding is undefined\n  - wrong join order or implicit ordering of rows\n  - filter/where condition different from v2\n  - missing `LIMIT`, `OFFSET`, or pagination handling\n\n  If a divergence stems from the `inputs` you passed (e.g. v2 echoes the input one way and v3 a different way because they normalize it differently), revise the inputs alongside the source.\n\n  Then call `build_debug` (fix any failures), then `runMigrationVerification` again with the revised source/inputs.\n\n  **There is no fixed retry budget \u2014 iterate until `passed` or until you have firm structural evidence that no v3 source change can reconcile v2 and v3.** Acceptable evidence for stopping: v2 references a YAML construct with no v3 SDK equivalent and the divergence is in that construct; v2 derives a value from runtime state v3 cannot observe (e.g. an env var that differs by environment). When you stop on structural grounds, mark the item `failed` with `failureReason: \"verification_diverged_irreconcilable: <one-paragraph reason naming the specific summaryForAgent entry and the structural reason> | summary: <JSON.stringify(summaryForAgent)>\"`.\n\n  Guardrail against infinite loops (NOT a retry budget): if you have iterated 8 times on the same API and the set of divergences has not materially changed across the last 3 attempts (i.e. you are flailing, not converging), stop and mark `failed` with the same `failureReason` shape. If you ARE converging \u2014 fewer divergences each attempt, or the remaining ones look smaller \u2014 keep going past 8.\n\n## Run-level rules\n\n- Do NOT emit a free-text UNRESOLVED report \u2014 every unresolved item must be a `failed` checklist entry with a `failureReason`.\n- Do NOT stop the run because one API failed. Only stop once every API is either `completed` or `failed`.\n\n## Updating integration write policy (Clark-only, with user consent)\n\nDuring migration, integration write policy (`allow` / `deny` per integration UUID) lives in `scratch/migration-state.json` \u2192 `integrationWritePolicy`. The pre-migration modal sets it once; **there is no mid-migration UI for the user to change it.**\n\n- **Only Clark can update write policy mid-migration**, and only when the user **explicitly asks** (e.g. \"test this API even though I set Don't test\", \"go ahead and run writes against Postgres\").\n- **Never** tell the user to update write policy in the UI \u2014 they cannot.\n- **Never** hand-edit `scratch/migration-state.json` with `build_writeFile` / `build_editFile` to change write policy. Use `updateMigrationWritePolicy` instead; it validates input and shows a permission card when granting `allow`.\n- To find integration ids: read the `const` UUID at the top of `server/apis/<ApiName>/api.ts`, or read existing keys from `scratch/migration-state.json` \u2192 `integrationWritePolicy`.\n- After updating policy to `allow` (with user approval), call `testApi` or `runMigrationVerification` again for the affected APIs.\n\nIf `testApi` is blocked by access control because an integration is still `deny`, explain that the user previously chose \"Don't test\" for that integration and ask whether they want you to update the policy and retry \u2014 do not suggest they change settings in the UI.\n\n## User-reported manual verification\n\nSome APIs are marked `completed` without automatic testing \u2014 write-policy \"Don't test\" (`verificationSkippedReason: \"mutation\"`) or a `testApi` permission denial (`verificationSkippedReason: \"testing_denied\"`). The user is expected to verify these by using the app themselves.\n\n### When the user asks how to test a skipped API\n\nIf the user requests manual test instructions for a specific API (including when the UI sends a prompt referencing `skills/system/migration-api-verification/SKILL.md`):\n\n1. Read `skills/system/migration-api-verification/SKILL.md` and follow it.\n2. Produce UI click-through steps for that API \u2014 do **NOT** call `testApi` or `runMigrationVerification`.\n\n### When the user confirms they verified an API\n\nIf the user tells you they have checked such an API and it works (e.g. \"I clicked through the app and GetOrders works, mark it complete\"), call `markApiManuallyVerified({ apiName })`. Do **NOT** call `testApi` or `runMigrationVerification` for it \u2014 the user opted out of automatic testing. This records the API as user-verified so it no longer appears in the list of APIs needing manual verification.\n\nIf the user instead asks you to **test** a denied or skipped API (not merely confirm they tested it manually), call `updateMigrationWritePolicy` first to grant `allow` for the relevant integration ids, then run `testApi` or `runMigrationVerification`.\n\n## Post-batch re-verification\n\nAfter `spawnCodingSubagents` returns (or after all sequential APIs are settled), before updating the checklist overall status:\n\n1. Call `build_manageChecklist` with `action: \"get\"` and read all items.\n2. For any item where `verificationOutcome === \"auto_passed\"` and `lastVerificationAt` is older than any sibling item's `updatedAt` minus 60 seconds: this item may have drifted due to registry edits made by later sub-agents. Re-run `runMigrationVerification({ apiName, inputs: <inputs> })` for each such item \u2014 synthesize `inputs` the same way as in step 6 of the per-API procedure, including the \"Sourcing input values\" rule (harvest real IDs from the app's read-only APIs; do not invent identifiers).\n3. If any re-verification produces `diverged`, apply the normal per-API diverge\u2192retry loop (no fixed retry budget; iterate until `passed` or firm structural-irreconcilability evidence, with the anti-flail guardrail at 8 iterations without convergence).\n4. Proceed to mark overall checklist completed/failed only after all re-verifications settle and the final sweep below is done.\n\n## Final sweep: retry unverified happy paths with real app data (required once per run)\n\nIf your closing summary would say \"I could not verify the happy path for X\" \u2014 that sentence is a trigger to do more work, not a conclusion to hand the user. Before marking the overall checklist completed/failed, do one last pass:\n\n1. From the checklist, collect every API that (a) is `failed` or unresolved because its test never succeeded, or (b) was marked `completed` but carries the `vacuous_pass_accepted:` sentinel in `failureReason` (set by you or by a sub-agent when a sad-path-only pass was accepted after exhausting sourcing).\n\n   Note on the parallel path: for APIs a sub-agent migrated, you cannot see its chat context or reconstruct its verification outputs \u2014 `verificationOutcome` records only the outcome type (`auto_passed`), not whether the pass was vacuous. The `vacuous_pass_accepted:` sentinel is therefore the ONLY way a sub-agent's vacuous pass surfaces here; APIs a sub-agent completed without it are treated as genuinely verified. This is why the sub-agent `instructions` MUST restate the vacuous-pass rule and the sentinel (see Parallelization policy). If you have specific reason to distrust a sub-agent's `completed` items (e.g. its batch reported many `both_failed` retries), re-verify them here with harvested real inputs rather than trusting the bare `completed`.\n\n2. For each, harvest real inputs from the app itself per the \"Sourcing input values\" rule in the per-API procedure: run the app's read-only APIs via `testApi` (zero-input list APIs first) and chain their real outputs into the inputs of the API under test.\n3. Re-run `runMigrationVerification` with those real inputs and resolve the outcome per the normal per-API rules.\n4. Only APIs whose sourcing steps genuinely produced no usable value (or whose failures are environmental per the `both_failed` rules) may finish the run without a happy-path verification \u2014 and each needs a `failureReason` or verification record saying so.\n";
 //# sourceMappingURL=skill.generated.d.ts.map