@tangle-network/agent-app 0.18.0 → 0.19.0

package/dist/sandbox/index.d.ts

@@ -0,0 +1,146 @@
+import { AgentProfileFileMount, AgentProfileMcpServer, AgentProfile, ScopedTokenScope, SandboxInstance, Sandbox } from '@tangle-network/sandbox';
+import { a as AppToolName, c as ToolHeaderNames } from '../auth-BlS9GWfL.js';
+import { b as AppToolContext } from '../types-2rOJo8Hc.js';
+import { Harness } from '../harness/index.js';
+
+type Outcome<T> = {
+    succeeded: true;
+    value: T;
+} | {
+    succeeded: false;
+    error: Error;
+};
+interface SandboxClientCredentials {
+    apiKey: string;
+    baseUrl: string;
+}
+interface SandboxResourceConfig {
+    image: string;
+    cpuCores: number;
+    memoryMB: number;
+    diskGB: number;
+    maxLifetimeSeconds: number;
+    idleTimeoutSeconds: number;
+}
+interface ProviderResolutionConfig {
+    routerBaseUrl?: string;
+    apiKey?: string;
+    providerName?: string;
+    modelName?: string;
+    defaultModel?: string;
+    openaiApiKey?: string;
+}
+interface SandboxBuildContext {
+    workspaceId: string;
+    connectedIntegrationIds: string[];
+}
+interface ProfileComposeOptions {
+    systemPrompt?: string;
+    extraFiles?: AgentProfileFileMount[];
+    extraMcp?: Record<string, AgentProfileMcpServer>;
+    name?: string;
+}
+interface SandboxRuntimeConfig {
+    credentials: () => SandboxClientCredentials | null;
+    name: (workspaceId: string) => string;
+    metadata: (harness: Harness) => Record<string, unknown>;
+    connectedIntegrationIds: (workspaceId: string) => Promise<string[]>;
+    env: (ctx: SandboxBuildContext) => Promise<Record<string, string>>;
+    files: (ctx: SandboxBuildContext) => Promise<AgentProfileFileMount[]>;
+    secrets: (workspaceId: string) => Promise<string[]>;
+    profile: (options: ProfileComposeOptions) => AgentProfile;
+    permissionRole?: (workspaceRole: string) => SandboxPermissionLevel;
+    resources?: SandboxResourceConfig;
+    provider?: ProviderResolutionConfig;
+}
+declare const DEFAULT_SANDBOX_RESOURCES: SandboxResourceConfig;
+declare function getClient(shell: SandboxRuntimeConfig): Sandbox;
+declare function resetClientCache(): void;
+interface AppToolDescriptor {
+    tool: AppToolName;
+    key: string;
+    description: string;
+}
+interface BuildAppToolMcpServersOptions {
+    tools: AppToolDescriptor[];
+    baseUrl: string;
+    token: string;
+    ctx: AppToolContext;
+    headerNames?: ToolHeaderNames;
+}
+declare function buildAppToolMcpServers(options: BuildAppToolMcpServersOptions): Record<string, AgentProfileMcpServer>;
+interface EnsureWorkspaceSandboxOptions {
+    workspaceId: string;
+    userId?: string;
+    harness: Harness;
+}
+declare function ensureWorkspaceSandbox(shell: SandboxRuntimeConfig, options: EnsureWorkspaceSandboxOptions): Promise<SandboxInstance>;
+interface ResolvedModel {
+    model: string;
+    provider: string;
+    apiKey: string;
+    baseUrl?: string;
+}
+declare function resolveModel(config: ProviderResolutionConfig | undefined, override?: {
+    model?: string;
+    modelApiKey?: string;
+}): ResolvedModel | undefined;
+declare function flattenHistory(message: string, history?: Array<{
+    role: 'user' | 'assistant';
+    content: string;
+}>): string;
+declare function mergeExtraMcp(appToolMcp: Record<string, AgentProfileMcpServer>, baseProfileMcp: Record<string, AgentProfileMcpServer>, extra: Record<string, AgentProfileMcpServer> | undefined): Record<string, AgentProfileMcpServer>;
+declare function attachReasoningEffort(profile: AgentProfile, harness: Harness, effort: 'auto' | 'low' | 'medium' | 'high' | undefined): AgentProfile;
+interface StreamSandboxPromptOptions {
+    sessionId?: string;
+    executionId?: string;
+    lastEventId?: string;
+    systemPrompt?: string;
+    model?: string;
+    modelApiKey?: string;
+    history?: Array<{
+        role: 'user' | 'assistant';
+        content: string;
+    }>;
+    harness?: Harness;
+    effort?: 'auto' | 'low' | 'medium' | 'high';
+    appToolMcp?: Record<string, AgentProfileMcpServer>;
+    baseProfileMcp?: Record<string, AgentProfileMcpServer>;
+    extraMcp?: Record<string, AgentProfileMcpServer>;
+}
+declare function streamSandboxPrompt(shell: SandboxRuntimeConfig, box: SandboxInstance, message: string, options?: StreamSandboxPromptOptions): AsyncGenerator<unknown>;
+declare function runSandboxPrompt(shell: SandboxRuntimeConfig, box: SandboxInstance, message: string, options?: StreamSandboxPromptOptions): Promise<string>;
+type SandboxPermissionLevel = 'owner' | 'admin' | 'developer' | 'viewer';
+interface MemberSyncSeam {
+    roleToSandboxRole: (workspaceRole: string) => SandboxPermissionLevel;
+}
+declare function syncSandboxMemberAdd(box: SandboxInstance, seam: MemberSyncSeam, userId: string, role: string): Promise<Outcome<void>>;
+declare function syncSandboxMemberRemove(box: SandboxInstance, userId: string): Promise<Outcome<void>>;
+declare function syncSandboxMemberRole(box: SandboxInstance, seam: MemberSyncSeam, userId: string, role: string): Promise<Outcome<void>>;
+interface SecretStore {
+    create: (name: string, value: string) => Promise<void>;
+    update: (name: string, value: string) => Promise<void>;
+    get: (name: string) => Promise<string>;
+    delete: (name: string) => Promise<void>;
+}
+declare function secretStoreFromClient(shell: SandboxRuntimeConfig): SecretStore;
+declare function storeSecret(store: SecretStore, name: string, value: string): Promise<Outcome<void>>;
+declare function readSecret(store: SecretStore, name: string): Promise<Outcome<string>>;
+declare function deleteSecret(store: SecretStore, name: string): Promise<Outcome<void>>;
+interface ScopedTokenResult {
+    token: string;
+    expiresAt: Date;
+    scope: ScopedTokenScope;
+}
+/**
+ * Mint a scoped token for an already-provisioned box (e.g. to hand a terminal
+ * proxy a narrowed credential). Uses the SDK's native `box.mintScopedToken`,
+ * which normalizes `expiresAt` to a Date — no hand-rolled wire call.
+ */
+declare function mintSandboxScopedToken(box: SandboxInstance, options: {
+    scope: ScopedTokenScope;
+    sessionId?: string;
+    ttlMinutes?: number;
+}): Promise<Outcome<ScopedTokenResult>>;
+
+export { type AppToolDescriptor, type BuildAppToolMcpServersOptions, DEFAULT_SANDBOX_RESOURCES, type EnsureWorkspaceSandboxOptions, type MemberSyncSeam, type Outcome, type ProfileComposeOptions, type ProviderResolutionConfig, type ResolvedModel, type SandboxBuildContext, type SandboxClientCredentials, type SandboxPermissionLevel, type SandboxResourceConfig, type SandboxRuntimeConfig, type ScopedTokenResult, type SecretStore, type StreamSandboxPromptOptions, attachReasoningEffort, buildAppToolMcpServers, deleteSecret, ensureWorkspaceSandbox, flattenHistory, getClient, mergeExtraMcp, mintSandboxScopedToken, readSecret, resetClientCache, resolveModel, runSandboxPrompt, secretStoreFromClient, storeSecret, streamSandboxPrompt, syncSandboxMemberAdd, syncSandboxMemberRemove, syncSandboxMemberRole };

package/dist/sandbox/index.js

@@ -0,0 +1,304 @@
+import "../chunk-MH6AVXQ7.js";
+import {
+  buildAppToolMcpServer
+} from "../chunk-A76ZHWNF.js";
+import "../chunk-JZZ6AWF4.js";
+
+// src/sandbox/index.ts
+import {
+  Sandbox
+} from "@tangle-network/sandbox";
+var ok = (value) => ({ succeeded: true, value });
+var fail = (error) => ({
+  succeeded: false,
+  error: error instanceof Error ? error : new Error(String(error))
+});
+var DEFAULT_SANDBOX_RESOURCES = {
+  image: "universal",
+  cpuCores: 2,
+  memoryMB: 4096,
+  diskGB: 10,
+  maxLifetimeSeconds: 86400,
+  idleTimeoutSeconds: 3600
+};
+var _cached = null;
+function getClient(shell) {
+  const creds = shell.credentials();
+  if (!creds) throw new Error("sandbox credentials are required (apiKey/baseUrl)");
+  const fingerprint = `${creds.apiKey} ${creds.baseUrl}`;
+  if (_cached && _cached.fingerprint === fingerprint) return _cached.client;
+  const client = new Sandbox({ apiKey: creds.apiKey, baseUrl: creds.baseUrl });
+  _cached = { client, fingerprint };
+  return client;
+}
+function resetClientCache() {
+  _cached = null;
+}
+function buildAppToolMcpServers(options) {
+  const entries = {};
+  for (const { tool, key, description } of options.tools) {
+    entries[key] = buildAppToolMcpServer({
+      tool,
+      baseUrl: options.baseUrl,
+      token: options.token,
+      ctx: options.ctx,
+      description,
+      headerNames: options.headerNames
+    });
+  }
+  return entries;
+}
+async function listRunning(client, name) {
+  try {
+    const running = await client.list({ status: "running" });
+    return ok(running.find((s) => s.name === name) ?? null);
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function deleteBox(box) {
+  try {
+    await box.delete();
+    return ok(void 0);
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function ensureWorkspaceSandbox(shell, options) {
+  const { workspaceId, userId, harness } = options;
+  const client = getClient(shell);
+  const name = shell.name(workspaceId);
+  const resources = shell.resources ?? DEFAULT_SANDBOX_RESOURCES;
+  const existing = await listRunning(client, name);
+  if (existing.succeeded && existing.value) {
+    const found = existing.value;
+    if (found.metadata?.harness === harness) return found;
+    const dropped = await deleteBox(found);
+    if (!dropped.succeeded) {
+      throw new Error(
+        `harness-mismatched sandbox ${name} (was ${String(found.metadata?.harness ?? "unknown")}, want ${harness}) could not be deleted`,
+        { cause: dropped.error }
+      );
+    }
+  }
+  const connectedIntegrationIds = await shell.connectedIntegrationIds(workspaceId);
+  const buildCtx = { workspaceId, connectedIntegrationIds };
+  const [secrets, env, files] = await Promise.all([
+    shell.secrets(workspaceId),
+    shell.env(buildCtx),
+    shell.files(buildCtx)
+  ]);
+  const profile = shell.profile({ extraFiles: files });
+  const role = userId && shell.permissionRole ? shell.permissionRole("developer") : void 0;
+  const payload = {
+    name,
+    image: resources.image,
+    metadata: shell.metadata(harness),
+    ...userId ? { permissions: { initialUsers: [{ userId, role }] } } : {},
+    env,
+    secrets,
+    backend: { type: harness, profile },
+    maxLifetimeSeconds: resources.maxLifetimeSeconds,
+    idleTimeoutSeconds: resources.idleTimeoutSeconds,
+    resources: {
+      cpuCores: resources.cpuCores,
+      memoryMB: resources.memoryMB,
+      diskGB: resources.diskGB
+    }
+  };
+  const box = await client.create(payload);
+  await box.waitFor("running", { timeoutMs: 12e4 });
+  if (!box.connection?.runtimeUrl) await box.refresh();
+  return box;
+}
+function resolveModel(config, override) {
+  const c = config ?? {};
+  const explicitBaseUrl = c.routerBaseUrl;
+  const explicitApiKey = override?.modelApiKey ?? c.apiKey;
+  const provider = c.providerName ?? (explicitApiKey ? "openai-compat" : c.openaiApiKey ? "openai" : void 0);
+  const modelName = override?.model ?? c.modelName ?? (provider === "openai" || provider === "openai-compat" ? c.defaultModel : void 0);
+  const apiKey = explicitApiKey ?? (provider === "openai" ? c.openaiApiKey : void 0);
+  if (!provider || !modelName || !apiKey) return void 0;
+  return {
+    model: modelName,
+    provider,
+    apiKey,
+    ...explicitBaseUrl ? { baseUrl: explicitBaseUrl } : {}
+  };
+}
+function flattenHistory(message, history) {
+  if (!history?.length) return message;
+  const transcript = history.map((entry) => `${entry.role === "assistant" ? "Assistant" : "User"}: ${entry.content}`).join("\n\n");
+  return `${transcript}
+
+User: ${message}`;
+}
+function mergeExtraMcp(appToolMcp, baseProfileMcp, extra) {
+  for (const key of Object.keys(extra ?? {})) {
+    if (key in appToolMcp || key in baseProfileMcp) {
+      throw new Error(`extraMcp key '${key}' collides with an existing profile MCP server`);
+    }
+  }
+  return { ...appToolMcp, ...extra ?? {} };
+}
+function attachReasoningEffort(profile, harness, effort) {
+  if (!effort || effort === "auto") return profile;
+  return {
+    ...profile,
+    extensions: {
+      ...profile.extensions ?? {},
+      [harness]: {
+        ...profile.extensions?.[harness] ?? {},
+        reasoningEffort: effort
+      }
+    }
+  };
+}
+async function* streamSandboxPrompt(shell, box, message, options) {
+  const harness = options?.harness ?? "opencode";
+  const model = resolveModel(shell.provider, {
+    model: options?.model,
+    modelApiKey: options?.modelApiKey
+  });
+  const prompt = flattenHistory(message, options?.history);
+  const appToolMcp = options?.appToolMcp ?? {};
+  const extraMcp = mergeExtraMcp(appToolMcp, options?.baseProfileMcp ?? {}, options?.extraMcp);
+  const profile = shell.profile({ systemPrompt: options?.systemPrompt, extraMcp });
+  const profileWithEffort = attachReasoningEffort(profile, harness, options?.effort);
+  const stream = box.streamPrompt(prompt, {
+    sessionId: options?.sessionId,
+    executionId: options?.executionId,
+    lastEventId: options?.lastEventId,
+    backend: {
+      type: harness,
+      profile: profileWithEffort,
+      ...model ? { model } : {}
+    }
+  });
+  for await (const event of stream) yield event;
+}
+async function runSandboxPrompt(shell, box, message, options) {
+  let fullText = "";
+  let firstTextSeen = false;
+  for await (const rawEvent of streamSandboxPrompt(shell, box, message, options)) {
+    const event = rawEvent;
+    if (!event.type) continue;
+    if (event.type === "message.part.updated") {
+      const part = event.data?.part;
+      const delta = typeof event.data?.delta === "string" ? event.data.delta : null;
+      if (String(part?.type ?? "") === "text") {
+        if (!firstTextSeen) {
+          firstTextSeen = true;
+          continue;
+        }
+        if (delta) fullText += delta;
+        else if (typeof part?.text === "string") fullText = part.text;
+      }
+    } else if (event.type === "result") {
+      const finalText = typeof event.data?.finalText === "string" ? event.data.finalText : null;
+      if (finalText) fullText = finalText;
+    }
+  }
+  return fullText;
+}
+async function syncSandboxMemberAdd(box, seam, userId, role) {
+  try {
+    await box.permissions.add({ userId, role: seam.roleToSandboxRole(role) });
+    return ok(void 0);
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function syncSandboxMemberRemove(box, userId) {
+  try {
+    await box.permissions.remove(userId, { preserveHomeDir: true });
+    return ok(void 0);
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function syncSandboxMemberRole(box, seam, userId, role) {
+  try {
+    await box.permissions.update(userId, { role: seam.roleToSandboxRole(role) });
+    return ok(void 0);
+  } catch (err) {
+    return fail(err);
+  }
+}
+function secretStoreFromClient(shell) {
+  const client = getClient(shell);
+  return {
+    create: async (name, value) => {
+      await client.secrets.create(name, value);
+    },
+    update: async (name, value) => {
+      await client.secrets.update(name, value);
+    },
+    get: (name) => client.secrets.get(name),
+    delete: async (name) => {
+      await client.secrets.delete(name);
+    }
+  };
+}
+async function storeSecret(store, name, value) {
+  try {
+    await store.create(name, value);
+    return ok(void 0);
+  } catch {
+    try {
+      await store.update(name, value);
+      return ok(void 0);
+    } catch (err) {
+      return fail(new Error(`Failed to store sandbox secret ${name}`, { cause: err }));
+    }
+  }
+}
+async function readSecret(store, name) {
+  try {
+    return ok(await store.get(name));
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function deleteSecret(store, name) {
+  try {
+    await store.delete(name);
+    return ok(void 0);
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function mintSandboxScopedToken(box, options) {
+  try {
+    const token = await box.mintScopedToken({
+      scope: options.scope,
+      ...options.sessionId ? { sessionId: options.sessionId } : {},
+      ...options.ttlMinutes ? { ttlMinutes: options.ttlMinutes } : {}
+    });
+    return ok({ token: token.token, expiresAt: token.expiresAt, scope: token.scope });
+  } catch (err) {
+    return fail(err);
+  }
+}
+export {
+  DEFAULT_SANDBOX_RESOURCES,
+  attachReasoningEffort,
+  buildAppToolMcpServers,
+  deleteSecret,
+  ensureWorkspaceSandbox,
+  flattenHistory,
+  getClient,
+  mergeExtraMcp,
+  mintSandboxScopedToken,
+  readSecret,
+  resetClientCache,
+  resolveModel,
+  runSandboxPrompt,
+  secretStoreFromClient,
+  storeSecret,
+  streamSandboxPrompt,
+  syncSandboxMemberAdd,
+  syncSandboxMemberRemove,
+  syncSandboxMemberRole
+};
+//# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/sandbox/index.ts"],"sourcesContent":["import {\n  Sandbox,\n  type AgentProfile,\n  type AgentProfileFileMount,\n  type AgentProfileMcpServer,\n  type SandboxInstance,\n  type ScopedTokenScope,\n} from '@tangle-network/sandbox'\nimport {\n  buildAppToolMcpServer,\n  type AppToolName,\n  type AppToolContext,\n  type ToolHeaderNames,\n} from '../tools/index'\nimport type { Harness } from '../harness/index'\n\nexport type Outcome<T> =\n  | { succeeded: true; value: T }\n  | { succeeded: false; error: Error }\n\nconst ok = <T>(value: T): Outcome<T> => ({ succeeded: true, value })\nconst fail = (error: unknown): Outcome<never> => ({\n  succeeded: false,\n  error: error instanceof Error ? error : new Error(String(error)),\n})\n\nexport interface SandboxClientCredentials {\n  apiKey: string\n  baseUrl: string\n}\n\nexport interface SandboxResourceConfig {\n  image: string\n  cpuCores: number\n  memoryMB: number\n  diskGB: number\n  maxLifetimeSeconds: number\n  idleTimeoutSeconds: number\n}\n\nexport interface ProviderResolutionConfig {\n  routerBaseUrl?: string\n  apiKey?: string\n  providerName?: string\n  modelName?: string\n  defaultModel?: string\n  openaiApiKey?: string\n}\n\nexport interface SandboxBuildContext {\n  workspaceId: string\n  connectedIntegrationIds: string[]\n}\n\nexport interface ProfileComposeOptions {\n  systemPrompt?: string\n  extraFiles?: AgentProfileFileMount[]\n  extraMcp?: Record<string, AgentProfileMcpServer>\n  name?: string\n}\n\nexport interface SandboxRuntimeConfig {\n  credentials: () => SandboxClientCredentials | null\n  name: (workspaceId: string) => string\n  metadata: (harness: Harness) => Record<string, unknown>\n  connectedIntegrationIds: (workspaceId: string) => Promise<string[]>\n  env: (ctx: SandboxBuildContext) => Promise<Record<string, string>>\n  files: (ctx: SandboxBuildContext) => Promise<AgentProfileFileMount[]>\n  secrets: (workspaceId: string) => Promise<string[]>\n  profile: (options: ProfileComposeOptions) => AgentProfile\n  permissionRole?: (workspaceRole: string) => SandboxPermissionLevel\n  resources?: SandboxResourceConfig\n  provider?: ProviderResolutionConfig\n}\n\nexport const DEFAULT_SANDBOX_RESOURCES: SandboxResourceConfig = {\n  image: 'universal',\n  cpuCores: 2,\n  memoryMB: 4096,\n  diskGB: 10,\n  maxLifetimeSeconds: 86400,\n  idleTimeoutSeconds: 3600,\n}\n\ninterface ClientCacheEntry {\n  client: Sandbox\n  fingerprint: string\n}\n\nlet _cached: ClientCacheEntry | null = null\n\nexport function getClient(shell: SandboxRuntimeConfig): Sandbox {\n  const creds = shell.credentials()\n  if (!creds) throw new Error('sandbox credentials are required (apiKey/baseUrl)')\n\n  const fingerprint = `${creds.apiKey} ${creds.baseUrl}`\n  if (_cached && _cached.fingerprint === fingerprint) return _cached.client\n\n  const client = new Sandbox({ apiKey: creds.apiKey, baseUrl: creds.baseUrl })\n  _cached = { client, fingerprint }\n  return client\n}\n\nexport function resetClientCache(): void {\n  _cached = null\n}\n\nexport interface AppToolDescriptor {\n  tool: AppToolName\n  key: string\n  description: string\n}\n\nexport interface BuildAppToolMcpServersOptions {\n  tools: AppToolDescriptor[]\n  baseUrl: string\n  token: string\n  ctx: AppToolContext\n  headerNames?: ToolHeaderNames\n}\n\nexport function buildAppToolMcpServers(\n  options: BuildAppToolMcpServersOptions,\n): Record<string, AgentProfileMcpServer> {\n  const entries: Record<string, AgentProfileMcpServer> = {}\n  for (const { tool, key, description } of options.tools) {\n    entries[key] = buildAppToolMcpServer({\n      tool,\n      baseUrl: options.baseUrl,\n      token: options.token,\n      ctx: options.ctx,\n      description,\n      headerNames: options.headerNames,\n    }) as AgentProfileMcpServer\n  }\n  return entries\n}\n\nexport interface EnsureWorkspaceSandboxOptions {\n  workspaceId: string\n  userId?: string\n  harness: Harness\n}\n\nasync function listRunning(\n  client: Sandbox,\n  name: string,\n): Promise<Outcome<SandboxInstance | null>> {\n  try {\n    const running = await client.list({ status: 'running' })\n    return ok(running.find((s) => s.name === name) ?? null)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nasync function deleteBox(box: SandboxInstance): Promise<Outcome<void>> {\n  try {\n    await box.delete()\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\n// The SDK narrows `backend.type` to its own BackendType union and\n// `initialUsers[].role` to PermissionLevel — neither symbol is exported. The\n// create payload is assembled with the product's Harness/role strings, which\n// are a superset surface; the localized cast at the boundary is the only place\n// this widening is allowed, and the runtime contract (the sidecar boots the\n// named harness) is what enforces correctness.\ntype CreatePayload = Parameters<Sandbox['create']>[0]\n\nexport async function ensureWorkspaceSandbox(\n  shell: SandboxRuntimeConfig,\n  options: EnsureWorkspaceSandboxOptions,\n): Promise<SandboxInstance> {\n  const { workspaceId, userId, harness } = options\n  const client = getClient(shell)\n  const name = shell.name(workspaceId)\n  const resources = shell.resources ?? DEFAULT_SANDBOX_RESOURCES\n\n  const existing = await listRunning(client, name)\n  if (existing.succeeded && existing.value) {\n    const found = existing.value\n    if (found.metadata?.harness === harness) return found\n    const dropped = await deleteBox(found)\n    if (!dropped.succeeded) {\n      throw new Error(\n        `harness-mismatched sandbox ${name} ` +\n          `(was ${String(found.metadata?.harness ?? 'unknown')}, want ${harness}) could not be deleted`,\n        { cause: dropped.error },\n      )\n    }\n  }\n\n  const connectedIntegrationIds = await shell.connectedIntegrationIds(workspaceId)\n  const buildCtx: SandboxBuildContext = { workspaceId, connectedIntegrationIds }\n  const [secrets, env, files] = await Promise.all([\n    shell.secrets(workspaceId),\n    shell.env(buildCtx),\n    shell.files(buildCtx),\n  ])\n  const profile = shell.profile({ extraFiles: files })\n\n  const role = userId && shell.permissionRole ? shell.permissionRole('developer') : undefined\n\n  const payload = {\n    name,\n    image: resources.image,\n    metadata: shell.metadata(harness),\n    ...(userId ? { permissions: { initialUsers: [{ userId, role }] } } : {}),\n    env,\n    secrets,\n    backend: { type: harness, profile },\n    maxLifetimeSeconds: resources.maxLifetimeSeconds,\n    idleTimeoutSeconds: resources.idleTimeoutSeconds,\n    resources: {\n      cpuCores: resources.cpuCores,\n      memoryMB: resources.memoryMB,\n      diskGB: resources.diskGB,\n    },\n  } as CreatePayload\n\n  const box = await client.create(payload)\n\n  await box.waitFor('running', { timeoutMs: 120_000 })\n  if (!box.connection?.runtimeUrl) await box.refresh()\n  return box\n}\n\nexport interface ResolvedModel {\n  model: string\n  provider: string\n  apiKey: string\n  baseUrl?: string\n}\n\nexport function resolveModel(\n  config: ProviderResolutionConfig | undefined,\n  override?: { model?: string; modelApiKey?: string },\n): ResolvedModel | undefined {\n  const c = config ?? {}\n  const explicitBaseUrl = c.routerBaseUrl\n  const explicitApiKey = override?.modelApiKey ?? c.apiKey\n  const provider =\n    c.providerName ?? (explicitApiKey ? 'openai-compat' : c.openaiApiKey ? 'openai' : undefined)\n  const modelName =\n    override?.model ??\n    c.modelName ??\n    (provider === 'openai' || provider === 'openai-compat' ? c.defaultModel : undefined)\n  const apiKey = explicitApiKey ?? (provider === 'openai' ? c.openaiApiKey : undefined)\n  if (!provider || !modelName || !apiKey) return undefined\n  return {\n    model: modelName,\n    provider,\n    apiKey,\n    ...(explicitBaseUrl ? { baseUrl: explicitBaseUrl } : {}),\n  }\n}\n\nexport function flattenHistory(\n  message: string,\n  history?: Array<{ role: 'user' | 'assistant'; content: string }>,\n): string {\n  if (!history?.length) return message\n  const transcript = history\n    .map((entry) => `${entry.role === 'assistant' ? 'Assistant' : 'User'}: ${entry.content}`)\n    .join('\\n\\n')\n  return `${transcript}\\n\\nUser: ${message}`\n}\n\nexport function mergeExtraMcp(\n  appToolMcp: Record<string, AgentProfileMcpServer>,\n  baseProfileMcp: Record<string, AgentProfileMcpServer>,\n  extra: Record<string, AgentProfileMcpServer> | undefined,\n): Record<string, AgentProfileMcpServer> {\n  for (const key of Object.keys(extra ?? {})) {\n    if (key in appToolMcp || key in baseProfileMcp) {\n      throw new Error(`extraMcp key '${key}' collides with an existing profile MCP server`)\n    }\n  }\n  return { ...appToolMcp, ...(extra ?? {}) }\n}\n\nexport function attachReasoningEffort(\n  profile: AgentProfile,\n  harness: Harness,\n  effort: 'auto' | 'low' | 'medium' | 'high' | undefined,\n): AgentProfile {\n  if (!effort || effort === 'auto') return profile\n  return {\n    ...profile,\n    extensions: {\n      ...(profile.extensions ?? {}),\n      [harness]: {\n        ...(profile.extensions?.[harness] ?? {}),\n        reasoningEffort: effort,\n      },\n    },\n  }\n}\n\nexport interface StreamSandboxPromptOptions {\n  sessionId?: string\n  executionId?: string\n  lastEventId?: string\n  systemPrompt?: string\n  model?: string\n  modelApiKey?: string\n  history?: Array<{ role: 'user' | 'assistant'; content: string }>\n  harness?: Harness\n  effort?: 'auto' | 'low' | 'medium' | 'high'\n  appToolMcp?: Record<string, AgentProfileMcpServer>\n  baseProfileMcp?: Record<string, AgentProfileMcpServer>\n  extraMcp?: Record<string, AgentProfileMcpServer>\n}\n\ntype StreamPromptOptions = Parameters<SandboxInstance['streamPrompt']>[1]\n\nexport async function* streamSandboxPrompt(\n  shell: SandboxRuntimeConfig,\n  box: SandboxInstance,\n  message: string,\n  options?: StreamSandboxPromptOptions,\n): AsyncGenerator<unknown> {\n  const harness = options?.harness ?? 'opencode'\n  const model = resolveModel(shell.provider, {\n    model: options?.model,\n    modelApiKey: options?.modelApiKey,\n  })\n\n  const prompt = flattenHistory(message, options?.history)\n\n  const appToolMcp = options?.appToolMcp ?? {}\n  const extraMcp = mergeExtraMcp(appToolMcp, options?.baseProfileMcp ?? {}, options?.extraMcp)\n\n  const profile = shell.profile({ systemPrompt: options?.systemPrompt, extraMcp })\n  const profileWithEffort = attachReasoningEffort(profile, harness, options?.effort)\n\n  const stream = box.streamPrompt(prompt, {\n    sessionId: options?.sessionId,\n    executionId: options?.executionId,\n    lastEventId: options?.lastEventId,\n    backend: {\n      type: harness,\n      profile: profileWithEffort,\n      ...(model ? { model } : {}),\n    },\n  } as StreamPromptOptions)\n\n  for await (const event of stream) yield event\n}\n\nexport async function runSandboxPrompt(\n  shell: SandboxRuntimeConfig,\n  box: SandboxInstance,\n  message: string,\n  options?: StreamSandboxPromptOptions,\n): Promise<string> {\n  let fullText = ''\n  let firstTextSeen = false\n\n  for await (const rawEvent of streamSandboxPrompt(shell, box, message, options)) {\n    const event = rawEvent as { type?: string; data?: Record<string, unknown> }\n    if (!event.type) continue\n\n    if (event.type === 'message.part.updated') {\n      const part = event.data?.part as Record<string, unknown> | undefined\n      const delta = typeof event.data?.delta === 'string' ? event.data.delta : null\n      if (String(part?.type ?? '') === 'text') {\n        if (!firstTextSeen) {\n          firstTextSeen = true\n          continue\n        }\n        if (delta) fullText += delta\n        else if (typeof part?.text === 'string') fullText = part.text\n      }\n    } else if (event.type === 'result') {\n      const finalText = typeof event.data?.finalText === 'string' ? event.data.finalText : null\n      if (finalText) fullText = finalText\n    }\n  }\n\n  return fullText\n}\n\n// Mirrors the SDK's PermissionLevel union (not re-exported by\n// @tangle-network/sandbox). The product's role-mapping seam must produce one of\n// these; binding the seam's return type to the union makes a wrong mapping a\n// compile error rather than a runtime 400 from the orchestrator.\nexport type SandboxPermissionLevel = 'owner' | 'admin' | 'developer' | 'viewer'\n\nexport interface MemberSyncSeam {\n  roleToSandboxRole: (workspaceRole: string) => SandboxPermissionLevel\n}\n\nexport async function syncSandboxMemberAdd(\n  box: SandboxInstance,\n  seam: MemberSyncSeam,\n  userId: string,\n  role: string,\n): Promise<Outcome<void>> {\n  try {\n    await box.permissions.add({ userId, role: seam.roleToSandboxRole(role) })\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport async function syncSandboxMemberRemove(\n  box: SandboxInstance,\n  userId: string,\n): Promise<Outcome<void>> {\n  try {\n    await box.permissions.remove(userId, { preserveHomeDir: true })\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport async function syncSandboxMemberRole(\n  box: SandboxInstance,\n  seam: MemberSyncSeam,\n  userId: string,\n  role: string,\n): Promise<Outcome<void>> {\n  try {\n    await box.permissions.update(userId, { role: seam.roleToSandboxRole(role) })\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport interface SecretStore {\n  create: (name: string, value: string) => Promise<void>\n  update: (name: string, value: string) => Promise<void>\n  get: (name: string) => Promise<string>\n  delete: (name: string) => Promise<void>\n}\n\nexport function secretStoreFromClient(shell: SandboxRuntimeConfig): SecretStore {\n  const client = getClient(shell)\n  return {\n    create: async (name, value) => {\n      await client.secrets.create(name, value)\n    },\n    update: async (name, value) => {\n      await client.secrets.update(name, value)\n    },\n    get: (name) => client.secrets.get(name),\n    delete: async (name) => {\n      await client.secrets.delete(name)\n    },\n  }\n}\n\nexport async function storeSecret(\n  store: SecretStore,\n  name: string,\n  value: string,\n): Promise<Outcome<void>> {\n  try {\n    await store.create(name, value)\n    return ok(undefined)\n  } catch {\n    try {\n      await store.update(name, value)\n      return ok(undefined)\n    } catch (err) {\n      return fail(new Error(`Failed to store sandbox secret ${name}`, { cause: err }))\n    }\n  }\n}\n\nexport async function readSecret(store: SecretStore, name: string): Promise<Outcome<string>> {\n  try {\n    return ok(await store.get(name))\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport async function deleteSecret(store: SecretStore, name: string): Promise<Outcome<void>> {\n  try {\n    await store.delete(name)\n    return ok(undefined)\n  } catch (err) {\n    return fail(err)\n  }\n}\n\nexport interface ScopedTokenResult {\n  token: string\n  expiresAt: Date\n  scope: ScopedTokenScope\n}\n\n/**\n * Mint a scoped token for an already-provisioned box (e.g. to hand a terminal\n * proxy a narrowed credential). Uses the SDK's native `box.mintScopedToken`,\n * which normalizes `expiresAt` to a Date — no hand-rolled wire call.\n */\nexport async function mintSandboxScopedToken(\n  box: SandboxInstance,\n  options: { scope: ScopedTokenScope; sessionId?: string; ttlMinutes?: number },\n): Promise<Outcome<ScopedTokenResult>> {\n  try {\n    const token = await box.mintScopedToken({\n      scope: options.scope,\n      ...(options.sessionId ? { sessionId: options.sessionId } : {}),\n      ...(options.ttlMinutes ? { ttlMinutes: options.ttlMinutes } : {}),\n    })\n    return ok({ token: token.token, expiresAt: token.expiresAt, scope: token.scope })\n  } catch (err) {\n    return fail(err)\n  }\n}"],"mappings":";;;;;;;AAAA;AAAA,EACE;AAAA,OAMK;AAaP,IAAM,KAAK,CAAI,WAA0B,EAAE,WAAW,MAAM,MAAM;AAClE,IAAM,OAAO,CAAC,WAAoC;AAAA,EAChD,WAAW;AAAA,EACX,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAmDO,IAAM,4BAAmD;AAAA,EAC9D,OAAO;AAAA,EACP,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,oBAAoB;AAAA,EACpB,oBAAoB;AACtB;AAOA,IAAI,UAAmC;AAEhC,SAAS,UAAU,OAAsC;AAC9D,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mDAAmD;AAE/E,QAAM,cAAc,GAAG,MAAM,MAAM,IAAI,MAAM,OAAO;AACpD,MAAI,WAAW,QAAQ,gBAAgB,YAAa,QAAO,QAAQ;AAEnE,QAAM,SAAS,IAAI,QAAQ,EAAE,QAAQ,MAAM,QAAQ,SAAS,MAAM,QAAQ,CAAC;AAC3E,YAAU,EAAE,QAAQ,YAAY;AAChC,SAAO;AACT;AAEO,SAAS,mBAAyB;AACvC,YAAU;AACZ;AAgBO,SAAS,uBACd,SACuC;AACvC,QAAM,UAAiD,CAAC;AACxD,aAAW,EAAE,MAAM,KAAK,YAAY,KAAK,QAAQ,OAAO;AACtD,YAAQ,GAAG,IAAI,sBAAsB;AAAA,MACnC;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,KAAK,QAAQ;AAAA,MACb;AAAA,MACA,aAAa,QAAQ;AAAA,IACvB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAQA,eAAe,YACb,QACA,MAC0C;AAC1C,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,KAAK,EAAE,QAAQ,UAAU,CAAC;AACvD,WAAO,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,IAAI;AAAA,EACxD,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAEA,eAAe,UAAU,KAA8C;AACrE,MAAI;AACF,UAAM,IAAI,OAAO;AACjB,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAUA,eAAsB,uBACpB,OACA,SAC0B;AAC1B,QAAM,EAAE,aAAa,QAAQ,QAAQ,IAAI;AACzC,QAAM,SAAS,UAAU,KAAK;AAC9B,QAAM,OAAO,MAAM,KAAK,WAAW;AACnC,QAAM,YAAY,MAAM,aAAa;AAErC,QAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AAC/C,MAAI,SAAS,aAAa,SAAS,OAAO;AACxC,UAAM,QAAQ,SAAS;AACvB,QAAI,MAAM,UAAU,YAAY,QAAS,QAAO;AAChD,UAAM,UAAU,MAAM,UAAU,KAAK;AACrC,QAAI,CAAC,QAAQ,WAAW;AACtB,YAAM,IAAI;AAAA,QACR,8BAA8B,IAAI,SACxB,OAAO,MAAM,UAAU,WAAW,SAAS,CAAC,UAAU,OAAO;AAAA,QACvE,EAAE,OAAO,QAAQ,MAAM;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,0BAA0B,MAAM,MAAM,wBAAwB,WAAW;AAC/E,QAAM,WAAgC,EAAE,aAAa,wBAAwB;AAC7E,QAAM,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC9C,MAAM,QAAQ,WAAW;AAAA,IACzB,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ;AAAA,EACtB,CAAC;AACD,QAAM,UAAU,MAAM,QAAQ,EAAE,YAAY,MAAM,CAAC;AAEnD,QAAM,OAAO,UAAU,MAAM,iBAAiB,MAAM,eAAe,WAAW,IAAI;AAElF,QAAM,UAAU;AAAA,IACd;AAAA,IACA,OAAO,UAAU;AAAA,IACjB,UAAU,MAAM,SAAS,OAAO;AAAA,IAChC,GAAI,SAAS,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,QAAQ,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC;AAAA,IACtE;AAAA,IACA;AAAA,IACA,SAAS,EAAE,MAAM,SAAS,QAAQ;AAAA,IAClC,oBAAoB,UAAU;AAAA,IAC9B,oBAAoB,UAAU;AAAA,IAC9B,WAAW;AAAA,MACT,UAAU,UAAU;AAAA,MACpB,UAAU,UAAU;AAAA,MACpB,QAAQ,UAAU;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,OAAO,OAAO,OAAO;AAEvC,QAAM,IAAI,QAAQ,WAAW,EAAE,WAAW,KAAQ,CAAC;AACnD,MAAI,CAAC,IAAI,YAAY,WAAY,OAAM,IAAI,QAAQ;AACnD,SAAO;AACT;AASO,SAAS,aACd,QACA,UAC2B;AAC3B,QAAM,IAAI,UAAU,CAAC;AACrB,QAAM,kBAAkB,EAAE;AAC1B,QAAM,iBAAiB,UAAU,eAAe,EAAE;AAClD,QAAM,WACJ,EAAE,iBAAiB,iBAAiB,kBAAkB,EAAE,eAAe,WAAW;AACpF,QAAM,YACJ,UAAU,SACV,EAAE,cACD,aAAa,YAAY,aAAa,kBAAkB,EAAE,eAAe;AAC5E,QAAM,SAAS,mBAAmB,aAAa,WAAW,EAAE,eAAe;AAC3E,MAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAQ,QAAO;AAC/C,SAAO;AAAA,IACL,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA,GAAI,kBAAkB,EAAE,SAAS,gBAAgB,IAAI,CAAC;AAAA,EACxD;AACF;AAEO,SAAS,eACd,SACA,SACQ;AACR,MAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,QAAM,aAAa,QAChB,IAAI,CAAC,UAAU,GAAG,MAAM,SAAS,cAAc,cAAc,MAAM,KAAK,MAAM,OAAO,EAAE,EACvF,KAAK,MAAM;AACd,SAAO,GAAG,UAAU;AAAA;AAAA,QAAa,OAAO;AAC1C;AAEO,SAAS,cACd,YACA,gBACA,OACuC;AACvC,aAAW,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,GAAG;AAC1C,QAAI,OAAO,cAAc,OAAO,gBAAgB;AAC9C,YAAM,IAAI,MAAM,iBAAiB,GAAG,gDAAgD;AAAA,IACtF;AAAA,EACF;AACA,SAAO,EAAE,GAAG,YAAY,GAAI,SAAS,CAAC,EAAG;AAC3C;AAEO,SAAS,sBACd,SACA,SACA,QACc;AACd,MAAI,CAAC,UAAU,WAAW,OAAQ,QAAO;AACzC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY;AAAA,MACV,GAAI,QAAQ,cAAc,CAAC;AAAA,MAC3B,CAAC,OAAO,GAAG;AAAA,QACT,GAAI,QAAQ,aAAa,OAAO,KAAK,CAAC;AAAA,QACtC,iBAAiB;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;AAmBA,gBAAuB,oBACrB,OACA,KACA,SACA,SACyB;AACzB,QAAM,UAAU,SAAS,WAAW;AACpC,QAAM,QAAQ,aAAa,MAAM,UAAU;AAAA,IACzC,OAAO,SAAS;AAAA,IAChB,aAAa,SAAS;AAAA,EACxB,CAAC;AAED,QAAM,SAAS,eAAe,SAAS,SAAS,OAAO;AAEvD,QAAM,aAAa,SAAS,cAAc,CAAC;AAC3C,QAAM,WAAW,cAAc,YAAY,SAAS,kBAAkB,CAAC,GAAG,SAAS,QAAQ;AAE3F,QAAM,UAAU,MAAM,QAAQ,EAAE,cAAc,SAAS,cAAc,SAAS,CAAC;AAC/E,QAAM,oBAAoB,sBAAsB,SAAS,SAAS,SAAS,MAAM;AAEjF,QAAM,SAAS,IAAI,aAAa,QAAQ;AAAA,IACtC,WAAW,SAAS;AAAA,IACpB,aAAa,SAAS;AAAA,IACtB,aAAa,SAAS;AAAA,IACtB,SAAS;AAAA,MACP,MAAM;AAAA,MACN,SAAS;AAAA,MACT,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IAC3B;AAAA,EACF,CAAwB;AAExB,mBAAiB,SAAS,OAAQ,OAAM;AAC1C;AAEA,eAAsB,iBACpB,OACA,KACA,SACA,SACiB;AACjB,MAAI,WAAW;AACf,MAAI,gBAAgB;AAEpB,mBAAiB,YAAY,oBAAoB,OAAO,KAAK,SAAS,OAAO,GAAG;AAC9E,UAAM,QAAQ;AACd,QAAI,CAAC,MAAM,KAAM;AAEjB,QAAI,MAAM,SAAS,wBAAwB;AACzC,YAAM,OAAO,MAAM,MAAM;AACzB,YAAM,QAAQ,OAAO,MAAM,MAAM,UAAU,WAAW,MAAM,KAAK,QAAQ;AACzE,UAAI,OAAO,MAAM,QAAQ,EAAE,MAAM,QAAQ;AACvC,YAAI,CAAC,eAAe;AAClB,0BAAgB;AAChB;AAAA,QACF;AACA,YAAI,MAAO,aAAY;AAAA,iBACd,OAAO,MAAM,SAAS,SAAU,YAAW,KAAK;AAAA,MAC3D;AAAA,IACF,WAAW,MAAM,SAAS,UAAU;AAClC,YAAM,YAAY,OAAO,MAAM,MAAM,cAAc,WAAW,MAAM,KAAK,YAAY;AACrF,UAAI,UAAW,YAAW;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO;AACT;AAYA,eAAsB,qBACpB,KACA,MACA,QACA,MACwB;AACxB,MAAI;AACF,UAAM,IAAI,YAAY,IAAI,EAAE,QAAQ,MAAM,KAAK,kBAAkB,IAAI,EAAE,CAAC;AACxE,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAEA,eAAsB,wBACpB,KACA,QACwB;AACxB,MAAI;AACF,UAAM,IAAI,YAAY,OAAO,QAAQ,EAAE,iBAAiB,KAAK,CAAC;AAC9D,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAEA,eAAsB,sBACpB,KACA,MACA,QACA,MACwB;AACxB,MAAI;AACF,UAAM,IAAI,YAAY,OAAO,QAAQ,EAAE,MAAM,KAAK,kBAAkB,IAAI,EAAE,CAAC;AAC3E,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AASO,SAAS,sBAAsB,OAA0C;AAC9E,QAAM,SAAS,UAAU,KAAK;AAC9B,SAAO;AAAA,IACL,QAAQ,OAAO,MAAM,UAAU;AAC7B,YAAM,OAAO,QAAQ,OAAO,MAAM,KAAK;AAAA,IACzC;AAAA,IACA,QAAQ,OAAO,MAAM,UAAU;AAC7B,YAAM,OAAO,QAAQ,OAAO,MAAM,KAAK;AAAA,IACzC;AAAA,IACA,KAAK,CAAC,SAAS,OAAO,QAAQ,IAAI,IAAI;AAAA,IACtC,QAAQ,OAAO,SAAS;AACtB,YAAM,OAAO,QAAQ,OAAO,IAAI;AAAA,IAClC;AAAA,EACF;AACF;AAEA,eAAsB,YACpB,OACA,MACA,OACwB;AACxB,MAAI;AACF,UAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,WAAO,GAAG,MAAS;AAAA,EACrB,QAAQ;AACN,QAAI;AACF,YAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,aAAO,GAAG,MAAS;AAAA,IACrB,SAAS,KAAK;AACZ,aAAO,KAAK,IAAI,MAAM,kCAAkC,IAAI,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAEA,eAAsB,WAAW,OAAoB,MAAwC;AAC3F,MAAI;AACF,WAAO,GAAG,MAAM,MAAM,IAAI,IAAI,CAAC;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAEA,eAAsB,aAAa,OAAoB,MAAsC;AAC3F,MAAI;AACF,UAAM,MAAM,OAAO,IAAI;AACvB,WAAO,GAAG,MAAS;AAAA,EACrB,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;AAaA,eAAsB,uBACpB,KACA,SACqC;AACrC,MAAI;AACF,UAAM,QAAQ,MAAM,IAAI,gBAAgB;AAAA,MACtC,OAAO,QAAQ;AAAA,MACf,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5D,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;AAAA,IACjE,CAAC;AACD,WAAO,GAAG,EAAE,OAAO,MAAM,OAAO,WAAW,MAAM,WAAW,OAAO,MAAM,MAAM,CAAC;AAAA,EAClF,SAAS,KAAK;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACF;","names":[]}

package/dist/sequences/index.d.ts

@@ -1,7 +1,8 @@
 import { j as SequenceMediaKind, o as SequenceTimeline, r as TimelineInterval, m as SequenceStore } from '../store-gckrNq-g.js';
 export { M as MIN_SEQUENCE_CLIP_FRAMES, N as NewSequenceClip, a as NewSequenceDecision, b as NewSequenceTrack, S as SequenceClip, c as SequenceClipMedia, d as SequenceClipPatch, e as SequenceDecision, f as SequenceExportFormat, g as SequenceExportRecord, h as SequenceExportStatus, i as SequenceFrameSnapshot, k as SequenceMeta, l as SequenceStatus, n as SequenceStoreScope, p as SequenceTrack, q as SequenceTrackKind, T as TimelineClipBounds, s as assertClipFitsSequence, t as chooseCaptionPlacement, u as clampClipDuration, v as clampClipStart, w as formatSeconds, x as formatTimecode, y as framesToSeconds, z as secondsToFrames, A as snapshotFrame, B as trackIntervals } from '../store-gckrNq-g.js';
 export { A as AddCaptionOperation, C as CaptionTargetResolution, a as CreateTrackOperation, D as DeleteClipOperation, E as ExtendSequenceOperation, M as MoveClipOperation, P as PlaceClipOperation, Q as QueueExportOperation, S as SEQUENCE_OPERATION_TYPES, b as SequenceApplyResult, c as SequenceOperation, d as SequenceOperationContext, e as SequenceOperationType, f as SequencePlan, g as SetClipDisabledOperation, h as SetClipTextOperation, i as SplitClipOperation, T as TrimClipOperation, j as applySequenceOperation, k as applySequenceOperations, l as assertSequenceMediaUrl, m as captionTrackNameForLanguage, n as lastClipEndFrame, p as parseSequenceOperations, r as resolveCaptionPlacement, o as resolveCaptionTarget, q as resolvePlaceClipTrack, v as validateAddCaption, s as validateCreateTrack, t as validateDeleteClip, u as validateExtendSequence, w as validateMoveClip, x as validatePlaceClip, y as validateQueueExport, z as validateSequenceOperation, B as validateSequenceOperations, F as validateSetClipDisabled, G as validateSetClipText, H as validateSplitClip, I as validateTrimClip } from '../apply-Cp8c3K9D.js';
-import { f as ToolHeaderNames, a as AppToolMcpServer } from '../mcp-eZCmkgCF.js';
+import { c as ToolHeaderNames } from '../auth-BlS9GWfL.js';
+import { A as AppToolMcpServer } from '../mcp-BShTlESm.js';
 import { b as AppToolContext } from '../types-2rOJo8Hc.js';
 
 /**

package/dist/skills/index.js

@@ -1,126 +1,10 @@
-// src/skills/index.ts
-function inlineResource(name, content) {
-  return { kind: "inline", name, content };
-}
-function skillMountPath(id) {
-  return `~/.claude/skills/${id}/SKILL.md`;
-}
-function normalizeKey(key, anchor) {
-  const marker = `${anchor}/`;
-  const at = key.lastIndexOf(marker);
-  if (at >= 0) return key.slice(at);
-  return key.startsWith("./") ? key.slice(2) : key;
-}
-function toCorpusId(normalizedKey, anchor) {
-  const nested = normalizedKey.match(new RegExp(`${anchor}/([^/]+)/SKILL\\.md$`));
-  if (nested) return nested[1];
-  const flat = normalizedKey.match(new RegExp(`${anchor}/(.+)\\.md$`));
-  if (flat) return flat[1];
-  return normalizedKey;
-}
-function nodeBuiltins() {
-  const getBuiltin = globalThis.process?.getBuiltinModule;
-  if (typeof getBuiltin !== "function") return void 0;
-  return {
-    fs: getBuiltin("node:fs"),
-    path: getBuiltin("node:path"),
-    url: getBuiltin("node:url")
-  };
-}
-function fsWalkFlat(builtins, root) {
-  const { fs, path } = builtins;
-  const out = {};
-  if (!fs.existsSync(root)) return out;
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry.name.startsWith(".")) continue;
-      const full = path.join(dir, entry.name);
-      if (entry.isDirectory()) walk(full);
-      else if (entry.isFile() && entry.name.endsWith(".md")) out[full] = fs.readFileSync(full, "utf8");
-    }
-  };
-  walk(root);
-  return out;
-}
-function fsWalkNested(builtins, root) {
-  const { fs, path } = builtins;
-  const out = {};
-  if (!fs.existsSync(root)) return out;
-  let entries;
-  try {
-    entries = fs.readdirSync(root, { withFileTypes: true });
-  } catch {
-    return out;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const skillFile = path.join(root, entry.name, "SKILL.md");
-    if (!fs.existsSync(skillFile)) continue;
-    out[skillFile] = fs.readFileSync(skillFile, "utf8");
-  }
-  return out;
-}
-function resolveFsBase(builtins, fsBaseDir, importMetaUrl) {
-  const { path, url } = builtins;
-  if (path.isAbsolute(fsBaseDir)) return fsBaseDir;
-  const here = importMetaUrl ? path.dirname(url.fileURLToPath(importMetaUrl)) : process.cwd();
-  return path.join(here, fsBaseDir);
-}
-function loadMarkdownCorpus(options, importMetaUrl) {
-  const { anchor, globModules, fsBaseDir, fsLayout = "flat", skip } = options;
-  let modules;
-  let source;
-  if (globModules && Object.keys(globModules).length > 0) {
-    modules = globModules;
-    source = "vite";
-  } else {
-    const builtins = nodeBuiltins();
-    if (builtins && fsBaseDir) {
-      const root = resolveFsBase(builtins, fsBaseDir, importMetaUrl);
-      modules = fsLayout === "nested" ? fsWalkNested(builtins, root) : fsWalkFlat(builtins, root);
-      source = Object.keys(modules).length > 0 ? "fs" : "empty";
-    } else {
-      modules = {};
-      source = "empty";
-    }
-  }
-  const entries = [];
-  for (const [rawKey, content] of Object.entries(modules)) {
-    if (typeof content !== "string") continue;
-    const key = normalizeKey(rawKey, anchor);
-    if (skip && skip(key)) continue;
-    entries.push({ id: toCorpusId(key, anchor), key, content });
-  }
-  entries.sort((a, b) => a.id.localeCompare(b.id));
-  return { source, entries };
-}
-function corpusSkills(corpus, anchor) {
-  return corpus.map(
-    (entry) => ({
-      path: `${anchor}/${entry.id}.md`,
-      resource: inlineResource(`${anchor}-${entry.id}`, entry.content)
-    })
-  ).sort((a, b) => a.path.localeCompare(b.path));
-}
-function registrySkills(registry, tier = "free") {
-  return registry.filter((s) => s.tier === tier).map(
-    (s) => ({
-      path: skillMountPath(s.id),
-      resource: inlineResource(s.id, s.skillMd)
-    })
-  ).sort((a, b) => a.path.localeCompare(b.path));
-}
-function composeShellResources(input) {
-  const { skills = [], knowledge = [], evolvable = [], registry = [], predicate } = input;
-  const composed = [...skills, ...knowledge, ...evolvable, ...registry];
-  return predicate ? composed.filter(predicate) : composed;
-}
+import {
+  composeShellResources,
+  corpusSkills,
+  loadMarkdownCorpus,
+  registrySkills,
+  skillMountPath
+} from "../chunk-KOG473C4.js";
 export {
   composeShellResources,
   corpusSkills,