@tool-bridge/server 0.22.1 → 0.24.0

package/dist/{chunk-HA4BGL6C.js → chunk-7MUNQNXG.js}

@@ -2170,10 +2170,10 @@ function createFederationModule(deps) {
 }
 
 // ../core/src/builtin/registry.ts
-import { z as z15 } from "zod/v4";
+import { z as z16 } from "zod/v4";
 
 // ../core/src/protocol/wire.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // ../core/src/secret/keyring.ts
 function validateEncryptionKeyring(input) {
@@ -2833,109 +2833,125 @@ var DeviceMailboxService = class {
   }
 };
 
-// ../core/src/protocol/errorWire.ts
+// ../core/src/device/environment.ts
 import { z as z13 } from "zod";
-var tbErrorCodeSchema = z13.enum(TB_ERROR_CODES);
-var tbErrorBodySchema = z13.object({
+var deviceEnvironmentSchema = z13.strictObject({
+  platform: z13.enum(["darwin", "linux", "win32", "android", "ios", "other"]),
+  arch: z13.string().min(1).max(32).regex(/^[a-zA-Z0-9._-]+$/).optional(),
+  runtime: z13.enum(["node", "bun", "react-native", "other"]).optional(),
+  runtimeVersion: z13.string().min(1).max(64).regex(/^[a-zA-Z0-9.+_-]+$/).optional(),
+  runtimeId: z13.string().min(1).max(128).regex(/^[a-zA-Z0-9._-]+$/).optional()
+});
+
+// ../core/src/protocol/errorWire.ts
+import { z as z14 } from "zod";
+var tbErrorCodeSchema = z14.enum(TB_ERROR_CODES);
+var tbErrorBodySchema = z14.object({
   code: tbErrorCodeSchema,
-  message: z13.string(),
-  retryable: z13.boolean()
+  message: z14.string(),
+  retryable: z14.boolean()
 });
 
 // ../core/src/protocol/wire.ts
-var actionSchema = z14.enum(ACTIONS);
-var nodeKindSchema = z14.enum(NODE_KINDS);
-var nodeInputConfigSchema = z14.record(z14.string(), z14.unknown()).optional().describe(
+var actionSchema = z15.enum(ACTIONS);
+var nodeKindSchema = z15.enum(NODE_KINDS);
+var nodeInputConfigSchema = z15.record(z15.string(), z15.unknown()).optional().describe(
   "kind-specific config, e.g. mcp: { url, auth?, authRef?, oauthClient?: { clientId, clientSecretRef? } } / http: { endpoint, tools } / context: { provider, bucket, \u2026 } / remote: { baseUrl, skRef }; credentials go by SecretStore reference name, never inline"
 );
-var nodeInputVirtualizeSchema = z14.strictObject({
-  prefix: z14.string().optional(),
-  rename: z14.record(z14.string(), z14.string()).optional(),
-  hide: z14.array(z14.string()).optional(),
-  describe: z14.record(z14.string(), z14.string()).optional()
+var nodeInputVirtualizeSchema = z15.strictObject({
+  prefix: z15.string().optional(),
+  rename: z15.record(z15.string(), z15.string()).optional(),
+  hide: z15.array(z15.string()).optional(),
+  describe: z15.record(z15.string(), z15.string()).optional()
 }).optional().describe(
   "optional tool virtualization: { prefix?, rename?: {from:to}, hide?: [name], describe?: {name:text} }"
 );
-var nodeInputSchema = z14.strictObject({
-  path: z14.string().min(1).describe('tree path to mount at, e.g. "docs/context7"'),
+var nodeInputSchema = z15.strictObject({
+  path: z15.string().min(1).describe('tree path to mount at, e.g. "docs/context7"'),
   kind: nodeKindSchema.describe("node kind; determines the config shape"),
-  description: z14.string().min(1).describe("one-line description shown in parent ~help"),
+  description: z15.string().min(1).describe("one-line description shown in parent ~help"),
   config: nodeInputConfigSchema,
   virtualize: nodeInputVirtualizeSchema
 });
-var presenceStateSchema = z14.enum(["online", "stale", "offline"]);
-var presenceSchema = z14.object({
-  lastSeenAt: z14.string().optional(),
+var presenceStateSchema = z15.enum(["online", "stale", "offline"]);
+var presenceSchema = z15.object({
+  lastSeenAt: z15.string().optional(),
   state: presenceStateSchema
 });
-var helpFeedbackItemSchema = z14.object({
-  id: z14.string(),
-  score: z14.number(),
-  title: z14.string()
+var helpFeedbackItemSchema = z15.object({
+  id: z15.string(),
+  score: z15.number(),
+  title: z15.string()
 });
-var helpChildSchema = z14.object({
-  description: z14.string(),
+var helpChildSchema = z15.object({
+  description: z15.string(),
   kind: nodeKindSchema,
-  path: z14.string()
+  path: z15.string()
 });
-var helpCommandSchema = z14.object({
-  confirm: z14.boolean().optional(),
-  delivery: z14.enum(["realtime", "mailbox", "both"]).optional(),
-  effect: z14.string().optional(),
-  h: z14.string().optional(),
-  inputSchema: z14.unknown().optional(),
-  method: z14.literal("POST"),
-  name: z14.string(),
-  outputSchema: z14.unknown().optional(),
-  path: z14.string(),
-  returns: z14.string().optional(),
+var helpCommandSchema = z15.object({
+  confirm: z15.boolean().optional(),
+  delivery: z15.enum(["realtime", "mailbox", "both"]).optional(),
+  effect: z15.string().optional(),
+  h: z15.string().optional(),
+  inputSchema: z15.unknown().optional(),
+  method: z15.literal("POST"),
+  name: z15.string(),
+  outputSchema: z15.unknown().optional(),
+  path: z15.string(),
+  returns: z15.string().optional(),
   scope: actionSchema
 });
-var helpJsonSchema = z14.object({
-  children: z14.array(helpChildSchema).optional(),
-  cmds: z14.array(helpCommandSchema),
-  feedback: z14.array(helpFeedbackItemSchema).optional(),
-  hint: z14.string().optional(),
-  htbp: z14.string(),
-  node: z14.object({
-    description: z14.string(),
+var deviceContextSchema = z15.strictObject({
+  environment: deviceEnvironmentSchema,
+  reportedAt: z15.iso.datetime({ offset: true }),
+  presence: presenceSchema.optional()
+});
+var helpJsonSchema = z15.object({
+  children: z15.array(helpChildSchema).optional(),
+  cmds: z15.array(helpCommandSchema),
+  deviceContext: deviceContextSchema.optional(),
+  feedback: z15.array(helpFeedbackItemSchema).optional(),
+  hint: z15.string().optional(),
+  htbp: z15.string(),
+  node: z15.object({
+    description: z15.string(),
     kind: nodeKindSchema,
-    path: z14.string()
+    path: z15.string()
   }),
-  note: z14.string().optional()
+  note: z15.string().optional()
 });
-var treeJsonSchema = z14.lazy(() => z14.object({
-  children: z14.array(treeJsonSchema).optional(),
-  description: z14.string(),
+var treeJsonSchema = z15.lazy(() => z15.object({
+  children: z15.array(treeJsonSchema).optional(),
+  description: z15.string(),
   kind: nodeKindSchema,
-  path: z14.string(),
+  path: z15.string(),
   presence: presenceSchema.optional(),
-  truncated: z14.boolean().optional()
+  truncated: z15.boolean().optional()
 }));
-var toolSpecSchema = z14.object({
-  confirm: z14.boolean().optional(),
-  delivery: z14.enum(["realtime", "mailbox", "both"]).optional(),
-  description: z14.string().optional(),
-  effect: z14.string().optional(),
-  inputSchema: z14.unknown().optional(),
-  name: z14.string(),
-  outputSchema: z14.unknown().optional()
+var toolSpecSchema = z15.object({
+  confirm: z15.boolean().optional(),
+  delivery: z15.enum(["realtime", "mailbox", "both"]).optional(),
+  description: z15.string().optional(),
+  effect: z15.string().optional(),
+  inputSchema: z15.unknown().optional(),
+  name: z15.string(),
+  outputSchema: z15.unknown().optional()
 });
-var toolSearchRelevanceSchema = z14.strictObject({
-  coverage: z14.number().min(0).max(1),
-  matchedTermCount: z14.number().int().nonnegative(),
-  rankingVersion: z14.literal("keyword-v2"),
-  totalTermCount: z14.number().int().positive()
+var toolSearchRelevanceSchema = z15.strictObject({
+  coverage: z15.number().min(0).max(1),
+  matchedTermCount: z15.number().int().nonnegative(),
+  rankingVersion: z15.literal("keyword-v2"),
+  totalTermCount: z15.number().int().positive()
 }).refine(
   (value) => value.matchedTermCount <= value.totalTermCount && value.coverage === value.matchedTermCount / value.totalTermCount,
   { message: "coverage must equal matchedTermCount / totalTermCount" }
 );
-var toolSearchSourceSchema = z14.strictObject({
-  path: z14.string()
+var toolSearchSourceSchema = z15.strictObject({
+  path: z15.string()
 });
-var toolSearchSourceResultSchema = z14.strictObject({
-  path: z14.string(),
-  status: z14.enum([
+var toolSearchSourceResultSchema = z15.strictObject({
+  path: z15.string(),
+  status: z15.enum([
     "ok",
     "unsupported",
     "timed_out",
@@ -2946,206 +2962,209 @@ var toolSearchSourceResultSchema = z14.strictObject({
     "invalid_response"
   ])
 });
-var toolSearchItemSchema = z14.strictObject({
-  path: z14.string(),
+var toolSearchItemSchema = z15.strictObject({
+  path: z15.string(),
   relevance: toolSearchRelevanceSchema,
   source: toolSearchSourceSchema.optional(),
   tool: toolSpecSchema
 });
 function pageSchema(itemSchema) {
-  return z14.object({
-    cursor: z14.string().optional(),
-    items: z14.array(itemSchema)
+  return z15.object({
+    cursor: z15.string().optional(),
+    items: z15.array(itemSchema)
   });
 }
-var toolSearchPageSchema = z14.strictObject({
-  cursor: z14.string().optional(),
-  items: z14.array(toolSearchItemSchema),
-  partial: z14.boolean().optional(),
-  snapshot: z14.string().optional(),
-  sources: z14.array(toolSearchSourceResultSchema).optional()
+var toolSearchPageSchema = z15.strictObject({
+  cursor: z15.string().optional(),
+  items: z15.array(toolSearchItemSchema),
+  partial: z15.boolean().optional(),
+  snapshot: z15.string().optional(),
+  sources: z15.array(toolSearchSourceResultSchema).optional()
 });
-var toolSearchRequestSchema = z14.strictObject({
-  opts: z14.strictObject({
-    cursor: z14.string().optional(),
-    detail: z14.enum(["compact", "full"]).optional(),
-    effects: z14.array(z14.enum(["read", "write", "destructive", "unknown"])).min(1).optional(),
-    federation: z14.enum(["local", "recursive"]).optional(),
-    limit: z14.number().int().optional(),
-    matching: z14.enum(["best", "all"]).optional(),
-    minCoverage: z14.number().gt(0).max(1).optional(),
-    mode: z14.enum(["keyword"]).optional(),
-    pathPrefix: z14.string().optional()
-  }).optional(),
-  query: z14.string().trim().min(1)
+var toolSearchOptionsSchema = z15.strictObject({
+  cursor: z15.string().optional(),
+  detail: z15.enum(["compact", "full"]).optional(),
+  effects: z15.array(z15.enum(["read", "write", "destructive", "unknown"])).min(1).optional(),
+  federation: z15.enum(["local", "recursive"]).optional(),
+  limit: z15.number().int().optional(),
+  matching: z15.enum(["best", "all"]).optional(),
+  minCoverage: z15.number().gt(0).max(1).optional(),
+  mode: z15.enum(["keyword"]).optional(),
+  pathPrefix: z15.string().optional()
+});
+var toolSearchRequestSchema = z15.strictObject({
+  opts: toolSearchOptionsSchema.optional(),
+  query: z15.string().trim().min(1)
 });
-var deviceOperationStateSchema = z14.enum(
+var deviceOperationStateSchema = z15.enum(
   DEVICE_OPERATION_STATES
 );
-var deviceOperationCallerSchema = z14.object({
-  keyId: z14.string().min(1),
-  owner: z14.string().min(1)
+var deviceOperationCallerSchema = z15.object({
+  keyId: z15.string().min(1),
+  owner: z15.string().min(1)
 });
 var deviceOperationSummaryShape = {
-  attempt: z14.number().int().nonnegative(),
+  attempt: z15.number().int().nonnegative(),
   caller: deviceOperationCallerSchema,
-  cancelRequestedAt: z14.iso.datetime({ offset: true }).optional(),
-  createdAt: z14.iso.datetime({ offset: true }),
-  deviceId: z14.string().min(1),
-  executionMayHaveOccurred: z14.boolean(),
-  expiresAt: z14.iso.datetime({ offset: true }),
-  leaseUntil: z14.iso.datetime({ offset: true }).optional(),
-  mountPath: z14.string().min(1),
-  operationId: z14.string().min(1),
+  cancelRequestedAt: z15.iso.datetime({ offset: true }).optional(),
+  createdAt: z15.iso.datetime({ offset: true }),
+  deviceId: z15.string().min(1),
+  executionMayHaveOccurred: z15.boolean(),
+  expiresAt: z15.iso.datetime({ offset: true }),
+  leaseUntil: z15.iso.datetime({ offset: true }).optional(),
+  mountPath: z15.string().min(1),
+  operationId: z15.string().min(1),
   state: deviceOperationStateSchema,
-  targetPath: z14.string().min(1),
-  terminalAt: z14.iso.datetime({ offset: true }).optional(),
-  traceId: z14.string().min(1),
-  updatedAt: z14.iso.datetime({ offset: true })
+  targetPath: z15.string().min(1),
+  terminalAt: z15.iso.datetime({ offset: true }).optional(),
+  traceId: z15.string().min(1),
+  updatedAt: z15.iso.datetime({ offset: true })
 };
-var deviceOperationSummarySchema = z14.object(
+var deviceOperationSummarySchema = z15.object(
   deviceOperationSummaryShape
 );
-var deviceOperationDetailSchema = z14.object({
+var deviceOperationDetailSchema = z15.object({
   ...deviceOperationSummaryShape,
   error: tbErrorBodySchema.optional(),
-  result: z14.json().optional()
+  result: z15.json().optional()
 });
-var deviceOperationListRequestSchema = z14.strictObject({
-  deviceId: z14.string().min(1),
-  opts: z14.strictObject({
-    cursor: z14.string().min(1).optional(),
-    limit: z14.number().int().positive().optional(),
-    states: z14.array(deviceOperationStateSchema).min(1).optional()
+var deviceOperationListRequestSchema = z15.strictObject({
+  deviceId: z15.string().min(1),
+  opts: z15.strictObject({
+    cursor: z15.string().min(1).optional(),
+    limit: z15.number().int().positive().optional(),
+    states: z15.array(deviceOperationStateSchema).min(1).optional()
   }).optional()
 });
 var deviceOperationListResponseSchema = pageSchema(deviceOperationSummarySchema);
-var deviceOperationIdentityRequestSchema = z14.strictObject({
-  deviceId: z14.string().min(1),
-  operationId: z14.string().min(1)
+var deviceOperationIdentityRequestSchema = z15.strictObject({
+  deviceId: z15.string().min(1),
+  operationId: z15.string().min(1)
 });
-var deviceOperationClaimRequestSchema = z14.strictObject({
-  cursor: z14.string().min(1).optional(),
-  deviceId: z14.string().min(1),
-  limit: z14.number().int().positive().optional()
+var deviceOperationClaimRequestSchema = z15.strictObject({
+  cursor: z15.string().min(1).optional(),
+  deviceId: z15.string().min(1),
+  limit: z15.number().int().positive().optional()
 });
-var deviceOperationClaimSchema = z14.object({
-  arguments: z14.record(z14.string(), z14.json()),
-  attempt: z14.number().int().positive(),
+var deviceOperationClaimSchema = z15.object({
+  arguments: z15.record(z15.string(), z15.json()),
+  attempt: z15.number().int().positive(),
   caller: deviceOperationCallerSchema,
-  cancelRequestedAt: z14.iso.datetime({ offset: true }).optional(),
-  createdAt: z14.iso.datetime({ offset: true }),
-  expiresAt: z14.iso.datetime({ offset: true }),
-  leaseId: z14.string().min(1),
-  leaseUntil: z14.iso.datetime({ offset: true }),
-  operationId: z14.string().min(1),
-  path: z14.string().min(1),
-  targetPath: z14.string().min(1),
-  traceId: z14.string().min(1)
+  cancelRequestedAt: z15.iso.datetime({ offset: true }).optional(),
+  createdAt: z15.iso.datetime({ offset: true }),
+  expiresAt: z15.iso.datetime({ offset: true }),
+  leaseId: z15.string().min(1),
+  leaseUntil: z15.iso.datetime({ offset: true }),
+  operationId: z15.string().min(1),
+  path: z15.string().min(1),
+  targetPath: z15.string().min(1),
+  traceId: z15.string().min(1)
 });
-var deviceOperationClaimResponseSchema = z14.object({
-  cursor: z14.string().optional(),
+var deviceOperationClaimResponseSchema = z15.object({
+  cursor: z15.string().optional(),
   operation: deviceOperationClaimSchema.optional(),
-  serverNow: z14.iso.datetime({ offset: true })
+  serverNow: z15.iso.datetime({ offset: true })
 });
 var deviceOperationLeaseShape = {
-  deviceId: z14.string().min(1),
-  leaseId: z14.string().min(1),
-  operationId: z14.string().min(1)
+  deviceId: z15.string().min(1),
+  leaseId: z15.string().min(1),
+  operationId: z15.string().min(1)
 };
-var deviceOperationRenewRequestSchema = z14.strictObject(deviceOperationLeaseShape);
-var deviceOperationRenewResponseSchema = z14.object({
-  cancelRequestedAt: z14.iso.datetime({ offset: true }).optional(),
-  leaseUntil: z14.iso.datetime({ offset: true }),
-  serverNow: z14.iso.datetime({ offset: true })
+var deviceOperationRenewRequestSchema = z15.strictObject(deviceOperationLeaseShape);
+var deviceOperationRenewResponseSchema = z15.object({
+  cancelRequestedAt: z15.iso.datetime({ offset: true }).optional(),
+  leaseUntil: z15.iso.datetime({ offset: true }),
+  serverNow: z15.iso.datetime({ offset: true })
 });
-var deviceOperationCompleteRequestSchema = z14.discriminatedUnion("outcome", [
-  z14.strictObject({
+var deviceOperationCompleteRequestSchema = z15.discriminatedUnion("outcome", [
+  z15.strictObject({
     ...deviceOperationLeaseShape,
-    outcome: z14.literal("succeeded"),
-    result: z14.json()
+    outcome: z15.literal("succeeded"),
+    result: z15.json()
   }),
-  z14.strictObject({
+  z15.strictObject({
     ...deviceOperationLeaseShape,
     error: tbErrorBodySchema,
-    outcome: z14.literal("rejected")
+    outcome: z15.literal("rejected")
   }),
-  z14.strictObject({
+  z15.strictObject({
     ...deviceOperationLeaseShape,
     error: tbErrorBodySchema,
-    outcome: z14.literal("failed")
+    outcome: z15.literal("failed")
   }),
-  z14.strictObject({
+  z15.strictObject({
     ...deviceOperationLeaseShape,
     error: tbErrorBodySchema.optional(),
-    outcome: z14.literal("result_unknown")
+    outcome: z15.literal("result_unknown")
   })
 ]);
-var registryNodeSchema = z14.object({
-  config: z14.record(z14.string(), z14.unknown()).optional(),
-  createdAt: z14.string().optional(),
-  description: z14.string(),
-  deviceId: z14.string().optional(),
+var registryNodeSchema = z15.object({
+  config: z15.record(z15.string(), z15.unknown()).optional(),
+  createdAt: z15.string().optional(),
+  description: z15.string(),
+  deviceId: z15.string().optional(),
+  deviceEnvironment: deviceEnvironmentSchema.optional(),
+  deviceReportedAt: z15.iso.datetime({ offset: true }).optional(),
   kind: nodeKindSchema,
-  lastSeenAt: z14.string().optional(),
-  online: z14.boolean().optional(),
-  path: z14.string(),
-  registeredBy: z14.string().optional(),
-  updatedAt: z14.string().optional(),
-  virtualize: z14.record(z14.string(), z14.unknown()).optional()
+  lastSeenAt: z15.string().optional(),
+  online: z15.boolean().optional(),
+  path: z15.string(),
+  registeredBy: z15.string().optional(),
+  updatedAt: z15.string().optional(),
+  virtualize: z15.record(z15.string(), z15.unknown()).optional()
 });
 var feedbackViewShape = {
-  at: z14.string(),
-  by: z14.string(),
-  down: z14.number().int().nonnegative(),
-  id: z14.string(),
-  score: z14.number().int(),
-  title: z14.string(),
-  up: z14.number().int().nonnegative()
+  at: z15.string(),
+  by: z15.string(),
+  down: z15.number().int().nonnegative(),
+  id: z15.string(),
+  score: z15.number().int(),
+  title: z15.string(),
+  up: z15.number().int().nonnegative()
 };
-var feedbackViewSchema = z14.object(feedbackViewShape);
-var feedbackDetailSchema = z14.object({
+var feedbackViewSchema = z15.object(feedbackViewShape);
+var feedbackDetailSchema = z15.object({
   ...feedbackViewShape,
-  detail: z14.string(),
-  path: z14.string()
+  detail: z15.string(),
+  path: z15.string()
 });
-var feedbackListSchema = z14.object({ items: z14.array(feedbackViewSchema) });
-var feedbackSubmitRequestSchema = z14.strictObject({
-  detail: z14.string(),
-  title: z14.string()
+var feedbackListSchema = z15.object({ items: z15.array(feedbackViewSchema) });
+var feedbackSubmitRequestSchema = z15.strictObject({
+  detail: z15.string(),
+  title: z15.string()
 });
-var feedbackSubmitResponseSchema = z14.object({
-  at: z14.string().optional(),
-  id: z14.string(),
-  path: z14.string(),
-  title: z14.string()
+var feedbackSubmitResponseSchema = z15.object({
+  at: z15.string().optional(),
+  id: z15.string(),
+  path: z15.string(),
+  title: z15.string()
 });
-var feedbackVoteRequestSchema = z14.strictObject({
-  vote: z14.enum(["up", "down", "clear"])
+var feedbackVoteRequestSchema = z15.strictObject({
+  vote: z15.enum(["up", "down", "clear"])
 });
-var feedbackRemoveResponseSchema = z14.object({ ok: z14.literal(true) });
-var oauthAuthorizeRequestSchema = z14.strictObject({
-  redirectUri: z14.string().optional()
+var feedbackRemoveResponseSchema = z15.object({ ok: z15.literal(true) });
+var oauthAuthorizeRequestSchema = z15.strictObject({
+  redirectUri: z15.string().optional()
 });
-var oauthAuthorizeResponseSchema = z14.discriminatedUnion("status", [
-  z14.object({ status: z14.literal("authorized") }),
-  z14.object({ authorizationUrl: z14.url(), status: z14.literal("redirect") })
+var oauthAuthorizeResponseSchema = z15.discriminatedUnion("status", [
+  z15.object({ status: z15.literal("authorized") }),
+  z15.object({ authorizationUrl: z15.url(), status: z15.literal("redirect") })
 ]);
-var healthResponseSchema = z14.object({
-  catalog: z14.object({
-    count: z14.number().int().nonnegative(),
-    digest: z14.string()
+var healthResponseSchema = z15.object({
+  catalog: z15.object({
+    count: z15.number().int().nonnegative(),
+    digest: z15.string()
   }).optional(),
-  healthy: z14.boolean(),
-  version: z14.string()
+  healthy: z15.boolean(),
+  version: z15.string()
 });
-var livenessResponseSchema = z14.object({ live: z14.boolean() });
-var readinessResponseSchema = z14.object({
-  checks: z14.record(z14.string(), z14.object({
-    detail: z14.string().optional(),
-    ok: z14.boolean()
+var livenessResponseSchema = z15.object({ live: z15.boolean() });
+var readinessResponseSchema = z15.object({
+  checks: z15.record(z15.string(), z15.object({
+    detail: z15.string().optional(),
+    ok: z15.boolean()
   })),
-  ready: z14.boolean()
+  ready: z15.boolean()
 });
 
 // ../core/src/builtin/registry.ts
@@ -3168,8 +3187,8 @@ var COMMANDS6 = new BuiltinCommandRegistry("registry", DESCRIPTION6).register(
   "list",
   {
     h: "list registered nodes, optionally under a path prefix",
-    inputSchema: z15.strictObject({
-      prefix: z15.string().optional().describe("only nodes under this path prefix"),
+    inputSchema: z16.strictObject({
+      prefix: z16.string().optional().describe("only nodes under this path prefix"),
       opts: HTBP_LIST_OPTIONS_SCHEMA.optional()
     }),
     returns: "Page<Node>",
@@ -3185,8 +3204,8 @@ var COMMANDS6 = new BuiltinCommandRegistry("registry", DESCRIPTION6).register(
   "get",
   {
     h: "fetch one node registration (kind, description, config) by path",
-    inputSchema: z15.strictObject({
-      path: z15.string().min(1).describe("exact tree path")
+    inputSchema: z16.strictObject({
+      path: z16.string().min(1).describe("exact tree path")
     }),
     returns: "Node",
     scope: "read"
@@ -3210,8 +3229,8 @@ var COMMANDS6 = new BuiltinCommandRegistry("registry", DESCRIPTION6).register(
   "update",
   {
     h: "patch fields of a mounted node (description, config, virtualize, \u2026) without remounting",
-    inputSchema: z15.strictObject({
-      path: z15.string().min(1).describe("exact tree path"),
+    inputSchema: z16.strictObject({
+      path: z16.string().min(1).describe("exact tree path"),
       patch: nodePatchSchema
     }),
     returns: "Node",
@@ -3222,8 +3241,8 @@ var COMMANDS6 = new BuiltinCommandRegistry("registry", DESCRIPTION6).register(
   "delete",
   {
     h: "unmount a node (and reclaim empty auto-created parents); a node registered by another key can only be removed by its registrar or by a key holding the 'admin' scope on that path",
-    inputSchema: z15.strictObject({
-      path: z15.string().min(1).describe("exact tree path")
+    inputSchema: z16.strictObject({
+      path: z16.string().min(1).describe("exact tree path")
     }),
     returns: "void",
     scope: "register"
@@ -3238,7 +3257,7 @@ function createRegistryModule(store, now, visibility) {
 }
 
 // ../core/src/builtin/secret.ts
-import { z as z16 } from "zod/v4";
+import { z as z17 } from "zod/v4";
 var DESCRIPTION7 = "Upstream credential vault: write-only; mounts reference entries by name (authRef), values can never be read back (admin only)";
 function assertUserSecretName(name) {
   if (name.includes(":")) {
@@ -3252,11 +3271,11 @@ var COMMANDS7 = new BuiltinCommandRegistry("secret", DESCRIPTION7).register(
   "set",
   {
     h: "store or rotate a credential under a name; mount configs reference it as authRef",
-    inputSchema: z16.strictObject({
-      name: z16.string().min(1).describe(
+    inputSchema: z17.strictObject({
+      name: z17.string().min(1).describe(
         'reference name used as authRef in mount configs (":" is reserved)'
       ),
-      value: z16.string().min(1).describe(
+      value: z17.string().min(1).describe(
         "the credential (token / key / JSON); encrypted at rest, never echoed"
       )
     }),
@@ -3272,7 +3291,7 @@ var COMMANDS7 = new BuiltinCommandRegistry("secret", DESCRIPTION7).register(
   "list",
   {
     h: "list stored credential names (names and timestamps only, never values)",
-    inputSchema: z16.strictObject({ opts: HTBP_LIST_OPTIONS_SCHEMA.optional() }),
+    inputSchema: z17.strictObject({ opts: HTBP_LIST_OPTIONS_SCHEMA.optional() }),
     returns: "Page<{ name, updatedAt }>",
     scope: "admin"
   },
@@ -3281,8 +3300,8 @@ var COMMANDS7 = new BuiltinCommandRegistry("secret", DESCRIPTION7).register(
   "delete",
   {
     h: "delete a credential; mounts still referencing it will fail to resolve",
-    inputSchema: z16.strictObject({
-      name: z16.string().min(1).describe("reference name")
+    inputSchema: z17.strictObject({
+      name: z17.string().min(1).describe("reference name")
     }),
     returns: "void",
     scope: "admin"
@@ -3298,13 +3317,13 @@ function createSecretModule(store, now) {
 }
 
 // ../core/src/builtin/status.ts
-import { z as z17 } from "zod/v4";
+import { z as z18 } from "zod/v4";
 var DESCRIPTION8 = "Gateway health and summary (readable without admin)";
 var COMMANDS8 = new BuiltinCommandRegistry("status", DESCRIPTION8).register(
   "get",
   {
     h: "health summary: gateway version and node count; no arguments",
-    inputSchema: z17.strictObject({}),
+    inputSchema: z18.strictObject({}),
     returns: "{ healthy, version, nodeCount }",
     scope: "read"
   },
@@ -3322,41 +3341,41 @@ function createStatusModule(deps) {
 }
 
 // ../core/src/builtin/sk.ts
-import { z as z18 } from "zod/v4";
+import { z as z19 } from "zod/v4";
 var DESCRIPTION9 = "Secret Key registry: issue / list / update / revoke access keys (the only credential form; admin only)";
-var actionSchema2 = z18.enum(["read", "write", "call", "register", "admin"]);
-var scopeSchema = z18.strictObject({
-  pattern: z18.string().describe('tree path glob, e.g. "**" (everything) or "docs/**"'),
-  actions: z18.array(actionSchema2),
-  effect: z18.enum(["allow", "deny"]).optional().describe('default "allow"')
+var actionSchema2 = z19.enum(["read", "write", "call", "register", "admin"]);
+var scopeSchema = z19.strictObject({
+  pattern: z19.string().describe('tree path glob, e.g. "**" (everything) or "docs/**"'),
+  actions: z19.array(actionSchema2),
+  effect: z19.enum(["allow", "deny"]).optional().describe('default "allow"')
 });
-var ownerSchema = z18.string().min(1).describe(
+var ownerSchema = z19.string().min(1).describe(
   'owner ref: "user:<name>" | "agent:<name>" | "device:<id>"'
 );
-var descriptionSchema = z18.string().optional().describe("what this key is for (shown in list)");
-var scopesSchema = z18.array(scopeSchema).describe(
+var descriptionSchema = z19.string().optional().describe("what this key is for (shown in list)");
+var scopesSchema = z19.array(scopeSchema).describe(
   "permission grants; deny wins over allow, no match = denied"
 );
-var registerPathsSchema = z18.array(z18.string()).optional().describe(
+var registerPathsSchema = z19.array(z19.string()).optional().describe(
   "path prefixes this key may self-register nodes under (via ~register)"
 );
-var expiresAtSchema = z18.string().optional().describe(
+var expiresAtSchema = z19.string().optional().describe(
   "expiry, ISO 8601 timestamp with timezone; omit = never"
 );
-var writeSchema = z18.strictObject({
+var writeSchema = z19.strictObject({
   owner: ownerSchema,
   description: descriptionSchema,
   scopes: scopesSchema,
   registerPaths: registerPathsSchema,
   expiresAt: expiresAtSchema
 });
-var patchSchema2 = z18.strictObject({
+var patchSchema2 = z19.strictObject({
   owner: ownerSchema.optional(),
   description: descriptionSchema,
   scopes: scopesSchema.optional(),
   registerPaths: registerPathsSchema,
   expiresAt: expiresAtSchema,
-  disabled: z18.boolean().optional().describe("true = key rejected until re-enabled")
+  disabled: z19.boolean().optional().describe("true = key rejected until re-enabled")
 }).describe("fields to change; same shape as write (all optional) plus disabled");
 function toSecretKeyInput(input) {
   return {
@@ -3381,7 +3400,7 @@ var COMMANDS9 = new BuiltinCommandRegistry("sk", DESCRIPTION9).register(
   "list",
   {
     h: "list issued keys (id, owner, scopes; the secret itself is never returned)",
-    inputSchema: z18.strictObject({ opts: HTBP_LIST_OPTIONS_SCHEMA.optional() }),
+    inputSchema: z19.strictObject({ opts: HTBP_LIST_OPTIONS_SCHEMA.optional() }),
     returns: "Page<SecretKey without hash>",
     scope: "admin"
   },
@@ -3390,8 +3409,8 @@ var COMMANDS9 = new BuiltinCommandRegistry("sk", DESCRIPTION9).register(
   "get",
   {
     h: "fetch one key by id",
-    inputSchema: z18.strictObject({
-      id: z18.string().min(1).describe("key id (from list or the issue response)")
+    inputSchema: z19.strictObject({
+      id: z19.string().min(1).describe("key id (from list or the issue response)")
     }),
     returns: "SecretKey without hash",
     scope: "admin"
@@ -3410,8 +3429,8 @@ var COMMANDS9 = new BuiltinCommandRegistry("sk", DESCRIPTION9).register(
   "update",
   {
     h: "patch fields of an issued key (scopes, expiresAt, disabled, \u2026); takes effect immediately",
-    inputSchema: z18.strictObject({
-      id: z18.string().min(1).describe("key id"),
+    inputSchema: z19.strictObject({
+      id: z19.string().min(1).describe("key id"),
       patch: patchSchema2
     }),
     returns: "SecretKey without hash",
@@ -3422,7 +3441,7 @@ var COMMANDS9 = new BuiltinCommandRegistry("sk", DESCRIPTION9).register(
   "delete",
   {
     h: "revoke a key permanently; takes effect immediately",
-    inputSchema: z18.strictObject({ id: z18.string().min(1).describe("key id") }),
+    inputSchema: z19.strictObject({ id: z19.string().min(1).describe("key id") }),
     returns: "void",
     scope: "admin"
   },
@@ -3436,24 +3455,24 @@ function createSkModule(store, now) {
 }
 
 // ../core/src/builtin/keys.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 
 // ../core/src/keyManagement.ts
-import { z as z19 } from "zod";
-var keyRotateSchema = z19.strictObject({
-  expectedRevision: z19.number().int().nonnegative(),
-  target: z19.enum(["encryption", "signing"]),
-  revokeExisting: z19.boolean().optional()
+import { z as z20 } from "zod";
+var keyRotateSchema = z20.strictObject({
+  expectedRevision: z20.number().int().nonnegative(),
+  target: z20.enum(["encryption", "signing"]),
+  revokeExisting: z20.boolean().optional()
 });
-var keyRetireSchema = z19.strictObject({
-  expectedRevision: z19.number().int().nonnegative(),
-  keyId: z19.string().regex(/^[A-Za-z0-9_-]{1,64}$/),
-  target: z19.enum(["encryption", "signing"])
+var keyRetireSchema = z20.strictObject({
+  expectedRevision: z20.number().int().nonnegative(),
+  keyId: z20.string().regex(/^[A-Za-z0-9_-]{1,64}$/),
+  target: z20.enum(["encryption", "signing"])
 });
-var keyResumeSchema = z19.strictObject({ jobId: z19.string().min(1).max(128) });
+var keyResumeSchema = z20.strictObject({ jobId: z20.string().min(1).max(128) });
 
 // ../core/src/builtin/keys.ts
-var commands = new BuiltinCommandRegistry("keys", "\u52A0\u5BC6\u6839\u3001\u7B7E\u540D\u5BC6\u94A5\u4E0E\u53EF\u6062\u590D\u8F6E\u6362\uFF08\u7BA1\u7406\u5458\uFF09").register("status", { inputSchema: z20.strictObject({}), scope: "admin", h: "\u67E5\u770B\u5BC6\u94A5\u7248\u672C\u3001\u5F15\u7528\u548C\u8F6E\u6362\u8FDB\u5EA6\uFF0C\u4E0D\u542B\u6839\u6750\u6599", returns: "KeyStatus" }, async (_, { deps }) => deps.status()).register("rotate", { inputSchema: keyRotateSchema, scope: "admin", h: "\u7EF4\u62A4\u7A97\u53E3\u5185\u751F\u6210\u65B0\u6839\uFF1B\u65E7\u6839\u9ED8\u8BA4\u4FDD\u7559\uFF0C\u91CD\u52A0\u5BC6\u53EF\u6062\u590D", returns: "KeyStatus" }, async (input, { deps }) => deps.rotate(input)).register("resume", { inputSchema: keyResumeSchema, scope: "admin", h: "\u7EE7\u7EED\u4E00\u6279\u91CD\u52A0\u5BC6\u4EFB\u52A1\uFF0C\u5B8C\u6210\u540E\u68C0\u67E5\u65E7\u5BC6\u6587\u5F15\u7528", returns: "KeyStatus" }, async (input, { deps }) => deps.resume(input)).register("retire", { inputSchema: keyRetireSchema, scope: "admin", h: "\u4EC5\u5728\u65E0\u5F15\u7528\u4E14\u7B7E\u540D\u5B89\u5168\u7A97\u53E3\u5DF2\u8FC7\u540E\u5220\u9664\u65E7\u6839", returns: "KeyStatus" }, async (input, { deps }) => deps.retire(input)).register("backup", { inputSchema: z20.strictObject({}), scope: "admin", h: "\u663E\u5F0F\u5BFC\u51FA\u5305\u542B\u5BC6\u94A5\u7684\u5B9E\u4F8B\u6062\u590D\u6587\u4EF6\uFF1B\u8BF7\u5B89\u5168\u4FDD\u5B58", returns: "KeyBackup" }, async (_, { deps }) => deps.backup());
+var commands = new BuiltinCommandRegistry("keys", "\u52A0\u5BC6\u6839\u3001\u7B7E\u540D\u5BC6\u94A5\u4E0E\u53EF\u6062\u590D\u8F6E\u6362\uFF08\u7BA1\u7406\u5458\uFF09").register("status", { inputSchema: z21.strictObject({}), scope: "admin", h: "\u67E5\u770B\u5BC6\u94A5\u7248\u672C\u3001\u5F15\u7528\u548C\u8F6E\u6362\u8FDB\u5EA6\uFF0C\u4E0D\u542B\u6839\u6750\u6599", returns: "KeyStatus" }, async (_, { deps }) => deps.status()).register("rotate", { inputSchema: keyRotateSchema, scope: "admin", h: "\u7EF4\u62A4\u7A97\u53E3\u5185\u751F\u6210\u65B0\u6839\uFF1B\u65E7\u6839\u9ED8\u8BA4\u4FDD\u7559\uFF0C\u91CD\u52A0\u5BC6\u53EF\u6062\u590D", returns: "KeyStatus" }, async (input, { deps }) => deps.rotate(input)).register("resume", { inputSchema: keyResumeSchema, scope: "admin", h: "\u7EE7\u7EED\u4E00\u6279\u91CD\u52A0\u5BC6\u4EFB\u52A1\uFF0C\u5B8C\u6210\u540E\u68C0\u67E5\u65E7\u5BC6\u6587\u5F15\u7528", returns: "KeyStatus" }, async (input, { deps }) => deps.resume(input)).register("retire", { inputSchema: keyRetireSchema, scope: "admin", h: "\u4EC5\u5728\u65E0\u5F15\u7528\u4E14\u7B7E\u540D\u5B89\u5168\u7A97\u53E3\u5DF2\u8FC7\u540E\u5220\u9664\u65E7\u6839", returns: "KeyStatus" }, async (input, { deps }) => deps.retire(input)).register("backup", { inputSchema: z21.strictObject({}), scope: "admin", h: "\u663E\u5F0F\u5BFC\u51FA\u5305\u542B\u5BC6\u94A5\u7684\u5B9E\u4F8B\u6062\u590D\u6587\u4EF6\uFF1B\u8BF7\u5B89\u5168\u4FDD\u5B58", returns: "KeyBackup" }, async (_, { deps }) => deps.backup());
 var createKeysModule = (deps) => commands.module(deps);
 
 // ../core/src/builtin/index.ts
@@ -3498,47 +3517,47 @@ function createBuiltins(deps) {
 }
 
 // ../core/src/builtin/deployment.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 
 // ../core/src/deployment.ts
-import { z as z21 } from "zod";
-var directory = z21.string().min(2).startsWith("/").refine((value) => !/(?:^|\/)\.\.(?:\/|$)/.test(value) && !/^\/(?:etc|proc|sys|dev|var\/run)(?:\/|$)/.test(value), "\u8BF7\u9009\u62E9\u90E8\u7F72\u76EE\u5F55\u5185\u7684\u7EDD\u5BF9\u8DEF\u5F84");
-var deploymentSettingsSchema = z21.strictObject({
-  image: z21.string().min(1).max(512).regex(/^[a-zA-Z0-9][a-zA-Z0-9._:/@-]*$/).describe("\u5E94\u7528\u955C\u50CF"),
-  hostPort: z21.number().int().min(1).max(65535).describe("\u5BBF\u4E3B\u8BBF\u95EE\u7AEF\u53E3"),
-  bindAddress: z21.enum(["127.0.0.1", "0.0.0.0"]).describe("\u76D1\u542C\u8303\u56F4"),
+import { z as z22 } from "zod";
+var directory = z22.string().min(2).startsWith("/").refine((value) => !/(?:^|\/)\.\.(?:\/|$)/.test(value) && !/^\/(?:etc|proc|sys|dev|var\/run)(?:\/|$)/.test(value), "\u8BF7\u9009\u62E9\u90E8\u7F72\u76EE\u5F55\u5185\u7684\u7EDD\u5BF9\u8DEF\u5F84");
+var deploymentSettingsSchema = z22.strictObject({
+  image: z22.string().min(1).max(512).regex(/^[a-zA-Z0-9][a-zA-Z0-9._:/@-]*$/).describe("\u5E94\u7528\u955C\u50CF"),
+  hostPort: z22.number().int().min(1).max(65535).describe("\u5BBF\u4E3B\u8BBF\u95EE\u7AEF\u53E3"),
+  bindAddress: z22.enum(["127.0.0.1", "0.0.0.0"]).describe("\u76D1\u542C\u8303\u56F4"),
   stateDirectory: directory.optional().describe("\u5BBF\u4E3B\u6570\u636E\u76EE\u5F55\uFF08\u53EF\u9009\uFF09"),
   uiDirectory: directory.optional().describe("\u5BBF\u4E3B\u7BA1\u7406\u754C\u9762\u76EE\u5F55\uFF08\u53EF\u9009\uFF09")
 });
-var deploymentUpdateSchema = z21.strictObject({ expectedRevision: z21.number().int().nonnegative(), settings: deploymentSettingsSchema });
-var deploymentClaimSchema = z21.strictObject({ agentId: z21.string().min(1).max(128), instanceId: z21.string().min(1), observed: deploymentSettingsSchema });
-var deploymentCompleteSchema = z21.strictObject({ jobId: z21.string().min(1), leaseToken: z21.string().min(1), ok: z21.boolean(), error: z21.enum(["preflight_failed", "apply_failed", "health_failed", "rollback_failed"]).optional() });
+var deploymentUpdateSchema = z22.strictObject({ expectedRevision: z22.number().int().nonnegative(), settings: deploymentSettingsSchema });
+var deploymentClaimSchema = z22.strictObject({ agentId: z22.string().min(1).max(128), instanceId: z22.string().min(1), observed: deploymentSettingsSchema });
+var deploymentCompleteSchema = z22.strictObject({ jobId: z22.string().min(1), leaseToken: z22.string().min(1), ok: z22.boolean(), error: z22.enum(["preflight_failed", "apply_failed", "health_failed", "rollback_failed"]).optional() });
 
 // ../core/src/builtin/deployment.ts
-var commands2 = new BuiltinCommandRegistry("deployment", "\u90E8\u7F72\u6267\u884C\u5668\u3001\u671F\u671B\u914D\u7F6E\u4E0E\u5B9E\u9645\u751F\u6548\u72B6\u6001\uFF08\u7BA1\u7406\u5458\uFF09").register("schema", { inputSchema: z22.strictObject({}), scope: "admin", h: "\u67E5\u8BE2\u90E8\u7F72\u8BBE\u7F6E\u5B57\u6BB5", returns: "JSON Schema" }, async () => z22.toJSONSchema(deploymentSettingsSchema)).register("get", { inputSchema: z22.strictObject({}), scope: "admin", h: "\u8BFB\u53D6\u90E8\u7F72\u914D\u7F6E\u4E0E\u6267\u884C\u5668\u72B6\u6001", returns: "DeploymentStatus" }, async (_, { deps }) => deps.get()).register("status", { inputSchema: z22.strictObject({}), scope: "admin", h: "\u6838\u5BF9\u90E8\u7F72\u4EFB\u52A1\u4E0E\u5DF2\u5E94\u7528\u7248\u672C", returns: "DeploymentStatus" }, async (_, { deps }) => deps.get()).register("update", { inputSchema: deploymentUpdateSchema, scope: "admin", h: "\u4FDD\u5B58\u914D\u7F6E\u5E76\u521B\u5EFA\u767D\u540D\u5355\u90E8\u7F72\u4EFB\u52A1", returns: "DeploymentStatus" }, async (input, { deps }) => deps.update(input)).register("claim", { inputSchema: deploymentClaimSchema, scope: "admin", h: "\u672C\u673A\u6267\u884C\u5668\u72EC\u5360\u9886\u53D6\u56FA\u5B9A\u90E8\u7F72\u4EFB\u52A1", returns: "{job:DeploymentClaim|null}" }, async (input, { deps }) => deps.claim(input)).register("complete", { inputSchema: deploymentCompleteSchema, scope: "admin", h: "\u63D0\u4EA4\u5B9E\u4F8B\u68C0\u67E5\u6216\u6062\u590D\u7ED3\u679C", returns: "DeploymentStatus" }, async (input, { deps }) => deps.complete(input));
+var commands2 = new BuiltinCommandRegistry("deployment", "\u90E8\u7F72\u6267\u884C\u5668\u3001\u671F\u671B\u914D\u7F6E\u4E0E\u5B9E\u9645\u751F\u6548\u72B6\u6001\uFF08\u7BA1\u7406\u5458\uFF09").register("schema", { inputSchema: z23.strictObject({}), scope: "admin", h: "\u67E5\u8BE2\u90E8\u7F72\u8BBE\u7F6E\u5B57\u6BB5", returns: "JSON Schema" }, async () => z23.toJSONSchema(deploymentSettingsSchema)).register("get", { inputSchema: z23.strictObject({}), scope: "admin", h: "\u8BFB\u53D6\u90E8\u7F72\u914D\u7F6E\u4E0E\u6267\u884C\u5668\u72B6\u6001", returns: "DeploymentStatus" }, async (_, { deps }) => deps.get()).register("status", { inputSchema: z23.strictObject({}), scope: "admin", h: "\u6838\u5BF9\u90E8\u7F72\u4EFB\u52A1\u4E0E\u5DF2\u5E94\u7528\u7248\u672C", returns: "DeploymentStatus" }, async (_, { deps }) => deps.get()).register("update", { inputSchema: deploymentUpdateSchema, scope: "admin", h: "\u4FDD\u5B58\u914D\u7F6E\u5E76\u521B\u5EFA\u767D\u540D\u5355\u90E8\u7F72\u4EFB\u52A1", returns: "DeploymentStatus" }, async (input, { deps }) => deps.update(input)).register("claim", { inputSchema: deploymentClaimSchema, scope: "admin", h: "\u672C\u673A\u6267\u884C\u5668\u72EC\u5360\u9886\u53D6\u56FA\u5B9A\u90E8\u7F72\u4EFB\u52A1", returns: "{job:DeploymentClaim|null}" }, async (input, { deps }) => deps.claim(input)).register("complete", { inputSchema: deploymentCompleteSchema, scope: "admin", h: "\u63D0\u4EA4\u5B9E\u4F8B\u68C0\u67E5\u6216\u6062\u590D\u7ED3\u679C", returns: "DeploymentStatus" }, async (input, { deps }) => deps.complete(input));
 var createDeploymentModule = (deps) => commands2.module(deps);
 
 // ../core/src/builtin/maintenance.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 
 // ../core/src/maintenance.ts
-import { z as z23 } from "zod";
-var revision = z23.number().int().nonnegative();
-var databaseUrl = z23.string().min(1).max(8192);
-var databaseMigrationSchema = z23.strictObject({
+import { z as z24 } from "zod";
+var revision = z24.number().int().nonnegative();
+var databaseUrl = z24.string().min(1).max(8192);
+var databaseMigrationSchema = z24.strictObject({
   expectedRevision: revision,
-  expectedInstanceId: z23.string().min(1),
+  expectedInstanceId: z24.string().min(1),
   databaseUrl
 });
-var databaseCredentialRotationSchema = z23.strictObject({
+var databaseCredentialRotationSchema = z24.strictObject({
   databaseAdminUrl: databaseUrl.optional(),
   expectedRevision: revision,
-  expectedInstanceId: z23.string().min(1),
-  password: z23.string().min(24).max(4096)
+  expectedInstanceId: z24.string().min(1),
+  password: z24.string().min(24).max(4096)
 });
-var redisMaintenanceSchema = z23.strictObject({
+var redisMaintenanceSchema = z24.strictObject({
   expectedRevision: revision,
-  redisUrl: z23.string().min(1).max(8192).nullable()
+  redisUrl: z24.string().min(1).max(8192).nullable()
 });
 
 // ../core/src/builtin/maintenance.ts
@@ -3548,7 +3567,7 @@ var commands3 = new BuiltinCommandRegistry(
 ).register(
   "status",
   {
-    inputSchema: z24.strictObject({}),
+    inputSchema: z25.strictObject({}),
     scope: "admin",
     h: "\u7EF4\u62A4\u9636\u6BB5\u53CA\u5DF2\u8131\u654F\u7684\u8FDE\u63A5\u72B6\u6001",
     returns: "MaintenanceStatus"
@@ -3585,20 +3604,20 @@ var commands3 = new BuiltinCommandRegistry(
 var createMaintenanceModule = (deps) => commands3.module(deps);
 
 // ../core/src/builtin/management.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 
 // ../core/src/managedConfig.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 
 // ../core/src/runtimeConfig.ts
 var DEFAULT_MAX_HOPS = 4;
 
 // ../core/src/managedConfig.ts
-var positive = z25.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var positive = z26.number().int().positive().max(Number.MAX_SAFE_INTEGER);
 var ttl = positive.max(604800);
-var runtimeConfigSchema = z25.strictObject({
-  canonicalOrigin: z25.union([z25.literal(""), z25.url({ protocol: /^https?$/ })]).default("").describe("\u516C\u5F00\u8BBF\u95EE\u5730\u5740"),
-  remoteAllowlist: z25.array(z25.string().min(1)).default([]).describe("\u5141\u8BB8\u8054\u90A6\u8FDE\u63A5\u7684\u4E3B\u673A"),
+var runtimeConfigSchema = z26.strictObject({
+  canonicalOrigin: z26.union([z26.literal(""), z26.url({ protocol: /^https?$/ })]).default("").describe("\u516C\u5F00\u8BBF\u95EE\u5730\u5740"),
+  remoteAllowlist: z26.array(z26.string().min(1)).default([]).describe("\u5141\u8BB8\u8054\u90A6\u8FDE\u63A5\u7684\u4E3B\u673A"),
   maxHops: positive.max(16).default(DEFAULT_MAX_HOPS).describe("\u8054\u90A6\u6700\u5927\u8DF3\u6570"),
   deviceReclaimSec: positive.max(2147483).default(86400).describe("\u79BB\u7EBF\u8BBE\u5907\u56DE\u6536\u7B49\u5F85\uFF08\u79D2\uFF09"),
   toolCacheTtlSec: positive.default(300).describe("\u5DE5\u5177\u7F13\u5B58\u6709\u6548\u671F\uFF08\u79D2\uFF09"),
@@ -3610,7 +3629,7 @@ var runtimeConfigSchema = z25.strictObject({
   storeCallMaxBytes: positive.default(536870912).describe("\u5355\u6B21\u8C03\u7528\u7D2F\u8BA1\u4E0A\u4F20\u5927\u5C0F\uFF08\u5B57\u8282\uFF09"),
   storeCallMaxObjectBytes: positive.max(1073741824).default(268435456).describe("\u8C03\u7528\u5185\u5355\u4E2A\u5BF9\u8C61\u6700\u5927\u5927\u5C0F\uFF08\u5B57\u8282\uFF09"),
   storeCallMaxObjects: positive.default(4).describe("\u5355\u6B21\u8C03\u7528\u6700\u591A\u5BF9\u8C61\u6570"),
-  storeCallAllowedContentTypes: z25.array(z25.string().min(1)).min(1).default(["*/*"]).describe("\u8C03\u7528\u4E0A\u4F20\u5141\u8BB8\u7684 MIME \u7C7B\u578B"),
+  storeCallAllowedContentTypes: z26.array(z26.string().min(1)).min(1).default(["*/*"]).describe("\u8C03\u7528\u4E0A\u4F20\u5141\u8BB8\u7684 MIME \u7C7B\u578B"),
   storeUploadTtlSec: ttl.default(900).describe("\u4E0A\u4F20\u4F1A\u8BDD\u6709\u6548\u671F\uFF08\u79D2\uFF09"),
   storeShareTtlSec: ttl.default(900).describe("\u5206\u4EAB\u6709\u6548\u671F\uFF08\u79D2\uFF09"),
   storeReadTtlSec: ttl.default(900).describe("\u4E0B\u8F7D\u5F15\u7528\u6709\u6548\u671F\uFF08\u79D2\uFF09"),
@@ -3622,37 +3641,37 @@ var runtimeConfigSchema = z25.strictObject({
   searchMinChildWorkMs: positive.default(200).describe("\u5B50\u641C\u7D22\u6700\u5C11\u5DE5\u4F5C\u65F6\u95F4\uFF08\u6BEB\u79D2\uFF09"),
   searchReturnReserveMs: positive.default(100).describe("\u641C\u7D22\u8FD4\u56DE\u9884\u7559\u65F6\u95F4\uFF08\u6BEB\u79D2\uFF09"),
   searchSessionTtlSec: positive.default(300).describe("\u641C\u7D22\u5FEB\u7167\u6709\u6548\u671F\uFF08\u79D2\uFF09"),
-  shutdownDrainSec: z25.number().int().min(0).max(300).default(0).describe("\u5173\u505C\u6392\u7A7A\u7B49\u5F85\uFF08\u79D2\uFF09")
+  shutdownDrainSec: z26.number().int().min(0).max(300).default(0).describe("\u5173\u505C\u6392\u7A7A\u7B49\u5F85\uFF08\u79D2\uFF09")
 });
-var configUpdateSchema = z25.strictObject({
-  expectedRevision: z25.number().int().nonnegative(),
+var configUpdateSchema = z26.strictObject({
+  expectedRevision: z26.number().int().nonnegative(),
   settings: runtimeConfigSchema
 });
-var revisionSchema = z25.strictObject({ expectedRevision: z25.number().int().nonnegative() });
-var s3ConnectionSchema = z25.strictObject({
-  endpoint: z25.url(),
-  bucket: z25.string().min(1).max(255),
-  region: z25.string().min(1).default("us-east-1"),
-  accessKeyId: z25.string().min(1).max(4096),
-  secretAccessKey: z25.string().min(1).max(4096)
+var revisionSchema = z26.strictObject({ expectedRevision: z26.number().int().nonnegative() });
+var s3ConnectionSchema = z26.strictObject({
+  endpoint: z26.url(),
+  bucket: z26.string().min(1).max(255),
+  region: z26.string().min(1).default("us-east-1"),
+  accessKeyId: z26.string().min(1).max(4096),
+  secretAccessKey: z26.string().min(1).max(4096)
 });
-var storageWriteSchema = z25.strictObject({
-  name: z25.string().min(1).max(120),
+var storageWriteSchema = z26.strictObject({
+  name: z26.string().min(1).max(120),
   connection: s3ConnectionSchema
 });
-var storageIdSchema = z25.strictObject({ id: z25.string().min(1).max(128) });
+var storageIdSchema = z26.strictObject({ id: z26.string().min(1).max(128) });
 var storageRevisionSchema = storageIdSchema.extend({
-  expectedRevision: z25.number().int().nonnegative()
+  expectedRevision: z26.number().int().nonnegative()
 });
 var storageActivateSchema = storageRevisionSchema.extend({
-  expectedActiveRevision: z25.number().int().nonnegative()
+  expectedActiveRevision: z26.number().int().nonnegative()
 });
 var storageRotateSchema = storageRevisionSchema.extend({
-  accessKeyId: z25.string().min(1),
-  secretAccessKey: z25.string().min(1)
+  accessKeyId: z26.string().min(1),
+  secretAccessKey: z26.string().min(1)
 });
-var setupInputSchema = z25.strictObject({
-  databaseUrl: z25.string().min(1).refine((value) => {
+var setupInputSchema = z26.strictObject({
+  databaseUrl: z26.string().min(1).refine((value) => {
     try {
       return ["postgres:", "postgresql:"].includes(new URL(value).protocol);
     } catch {
@@ -3660,47 +3679,47 @@ var setupInputSchema = z25.strictObject({
     }
   }, "\u9700\u8981 PostgreSQL \u8FDE\u63A5\u5730\u5740").optional(),
   storage: s3ConnectionSchema.optional(),
-  redisUrl: z25.string().optional(),
+  redisUrl: z26.string().optional(),
   settings: runtimeConfigSchema.default(() => runtimeConfigSchema.parse({}))
 });
-var setupStatusSchema = z25.object({
-  state: z25.enum(["setup", "installing", "ready", "recovery"]),
-  instanceId: z25.string().min(1),
-  pairingRequired: z25.boolean()
+var setupStatusSchema = z26.object({
+  state: z26.enum(["setup", "installing", "ready", "recovery"]),
+  instanceId: z26.string().min(1),
+  pairingRequired: z26.boolean()
 });
-var setupDefaultsSchema = z25.object({
-  databaseConfigured: z25.boolean(),
-  databaseHost: z25.string().optional(),
-  redisConfigured: z25.boolean(),
-  storageConfigured: z25.boolean(),
-  storage: z25.object({ endpoint: z25.string(), bucket: z25.string(), region: z25.string() }).optional()
+var setupDefaultsSchema = z26.object({
+  databaseConfigured: z26.boolean(),
+  databaseHost: z26.string().optional(),
+  redisConfigured: z26.boolean(),
+  storageConfigured: z26.boolean(),
+  storage: z26.object({ endpoint: z26.string(), bucket: z26.string(), region: z26.string() }).optional()
 });
-var setupResultSchema = z25.object({
-  state: z25.literal("ready"),
-  adminSk: z25.string().min(1),
-  baseUrl: z25.string()
+var setupResultSchema = z26.object({
+  state: z26.literal("ready"),
+  adminSk: z26.string().min(1),
+  baseUrl: z26.string()
 });
-var backupKeyringSchema = z25.strictObject({ activeKeyId: z25.string().min(1), keys: z25.record(z25.string(), z25.string()) });
+var backupKeyringSchema = z26.strictObject({ activeKeyId: z26.string().min(1), keys: z26.record(z26.string(), z26.string()) });
 var recoveryInputSchema = setupInputSchema.extend({
-  backup: z25.strictObject({
-    version: z25.literal(1),
-    instanceId: z25.string().min(1),
-    exportedAt: z25.string().min(1),
+  backup: z26.strictObject({
+    version: z26.literal(1),
+    instanceId: z26.string().min(1),
+    exportedAt: z26.string().min(1),
     keyring: backupKeyringSchema,
     storeTokenKeyring: backupKeyringSchema,
-    oauthKey: z25.string().min(1),
-    signingRetireAfter: z25.record(z25.string(), z25.string()).optional()
+    oauthKey: z26.string().min(1),
+    signingRetireAfter: z26.record(z26.string(), z26.string()).optional()
   }).optional()
 });
-var recoveryResultSchema = z25.object({
-  state: z25.literal("ready"),
-  baseUrl: z25.string(),
-  adminSk: z25.string().min(1).optional()
+var recoveryResultSchema = z26.object({
+  state: z26.literal("ready"),
+  baseUrl: z26.string(),
+  adminSk: z26.string().min(1).optional()
 });
 
 // ../core/src/builtin/management.ts
-var configCommands = new BuiltinCommandRegistry("config", "\u5B9E\u4F8B\u914D\u7F6E\u4E0E\u751F\u6548\u72B6\u6001\uFF08\u7BA1\u7406\u5458\uFF09").register("schema", { inputSchema: z26.strictObject({}), scope: "admin", h: "\u914D\u7F6E\u76EE\u5F55\u3001\u5B57\u6BB5\u8BF4\u660E\u4E0E\u9ED8\u8BA4\u503C", returns: "JSON Schema" }, async () => z26.toJSONSchema(runtimeConfigSchema)).register("get", { inputSchema: z26.strictObject({}), scope: "admin", h: "\u8BFB\u53D6\u671F\u671B\u503C\u3001\u5B9E\u9645\u503C\u548C revision", returns: "ConfigStatus" }, async (_, { deps }) => deps.get()).register("status", { inputSchema: z26.strictObject({}), scope: "admin", h: "\u68C0\u67E5\u914D\u7F6E\u5E94\u7528\u72B6\u6001", returns: "ConfigStatus" }, async (_, { deps }) => deps.get()).register("validate", { inputSchema: runtimeConfigSchema, scope: "admin", h: "\u6821\u9A8C\u5B8C\u6574\u5019\u9009\u914D\u7F6E", returns: "RuntimeConfig" }, async (input) => input).register("update", { inputSchema: configUpdateSchema, scope: "admin", h: "\u6309 revision \u4FDD\u5B58\u914D\u7F6E\uFF1B\u5C1A\u672A\u5E94\u7528", returns: "ConfigStatus" }, async (input, { deps }) => deps.update(input)).register("apply", { inputSchema: revisionSchema, scope: "admin", h: "\u5E94\u7528\u6307\u5B9A revision \u5E76\u68C0\u67E5\u5B9E\u9645\u72B6\u6001", returns: "ConfigStatus" }, async (input, { deps }) => deps.apply(input));
-var storageCommands = new BuiltinCommandRegistry("storage", "\u5BF9\u8C61\u5B58\u50A8\u540E\u7AEF\u3001\u9A8C\u8BC1\u548C\u9ED8\u8BA4\u4E0A\u4F20\u76EE\u6807\uFF08\u7BA1\u7406\u5458\uFF09").register("list", { inputSchema: z26.strictObject({}), scope: "admin", h: "\u5217\u51FA\u9ED8\u8BA4\u4E0E\u5386\u53F2\u5B58\u50A8\u540E\u7AEF", returns: "Page<StorageBackendView>" }, async (_, { deps }) => deps.list()).register("get", { inputSchema: storageIdSchema, scope: "admin", h: "\u8BFB\u53D6\u540E\u7AEF\u72B6\u6001\uFF0C\u4E0D\u56DE\u663E\u51ED\u8BC1", returns: "StorageBackendView" }, async (input, { deps }) => deps.get(input)).register("write", { inputSchema: storageWriteSchema, scope: "admin", h: "\u521B\u5EFA\u672A\u542F\u7528\u7684\u540E\u7AEF\uFF0C\u51ED\u8BC1\u53EA\u5199\u5165\u52A0\u5BC6\u4FDD\u7BA1\u5E93", returns: "StorageBackendView" }, async (input, { deps }) => deps.write(input)).register("test", { inputSchema: storageRevisionSchema, scope: "admin", h: "\u9A8C\u8BC1\u5B9E\u9645\u8BFB\u5199\u548C\u6761\u4EF6\u5199\u80FD\u529B", returns: "StorageBackendView" }, async (input, { deps }) => deps.test(input)).register("activate", { inputSchema: storageActivateSchema, scope: "admin", h: "\u8BBE\u4E3A\u65B0\u4E0A\u4F20\u9ED8\u8BA4\u503C\uFF1B\u65E7\u5BF9\u8C61\u4FDD\u7559\u539F\u540E\u7AEF", returns: "StorageBackendView" }, async (input, { deps }) => deps.activate(input)).register("update", { inputSchema: storageRotateSchema, scope: "admin", h: "\u9A8C\u8BC1\u5E76\u8F6E\u6362\u51ED\u8BC1\uFF0C\u4F4D\u7F6E\u4E0D\u53D8", returns: "StorageBackendView" }, async (input, { deps }) => deps.update(input)).register("delete", { inputSchema: storageRevisionSchema, scope: "admin", h: "\u5220\u9664\u6CA1\u6709\u5BF9\u8C61\u6216 Context \u5F15\u7528\u7684\u975E\u9ED8\u8BA4\u540E\u7AEF", returns: "{ok:true}" }, async (input, { deps }) => deps.delete(input));
+var configCommands = new BuiltinCommandRegistry("config", "\u5B9E\u4F8B\u914D\u7F6E\u4E0E\u751F\u6548\u72B6\u6001\uFF08\u7BA1\u7406\u5458\uFF09").register("schema", { inputSchema: z27.strictObject({}), scope: "admin", h: "\u914D\u7F6E\u76EE\u5F55\u3001\u5B57\u6BB5\u8BF4\u660E\u4E0E\u9ED8\u8BA4\u503C", returns: "JSON Schema" }, async () => z27.toJSONSchema(runtimeConfigSchema)).register("get", { inputSchema: z27.strictObject({}), scope: "admin", h: "\u8BFB\u53D6\u671F\u671B\u503C\u3001\u5B9E\u9645\u503C\u548C revision", returns: "ConfigStatus" }, async (_, { deps }) => deps.get()).register("status", { inputSchema: z27.strictObject({}), scope: "admin", h: "\u68C0\u67E5\u914D\u7F6E\u5E94\u7528\u72B6\u6001", returns: "ConfigStatus" }, async (_, { deps }) => deps.get()).register("validate", { inputSchema: runtimeConfigSchema, scope: "admin", h: "\u6821\u9A8C\u5B8C\u6574\u5019\u9009\u914D\u7F6E", returns: "RuntimeConfig" }, async (input) => input).register("update", { inputSchema: configUpdateSchema, scope: "admin", h: "\u6309 revision \u4FDD\u5B58\u914D\u7F6E\uFF1B\u5C1A\u672A\u5E94\u7528", returns: "ConfigStatus" }, async (input, { deps }) => deps.update(input)).register("apply", { inputSchema: revisionSchema, scope: "admin", h: "\u5E94\u7528\u6307\u5B9A revision \u5E76\u68C0\u67E5\u5B9E\u9645\u72B6\u6001", returns: "ConfigStatus" }, async (input, { deps }) => deps.apply(input));
+var storageCommands = new BuiltinCommandRegistry("storage", "\u5BF9\u8C61\u5B58\u50A8\u540E\u7AEF\u3001\u9A8C\u8BC1\u548C\u9ED8\u8BA4\u4E0A\u4F20\u76EE\u6807\uFF08\u7BA1\u7406\u5458\uFF09").register("list", { inputSchema: z27.strictObject({}), scope: "admin", h: "\u5217\u51FA\u9ED8\u8BA4\u4E0E\u5386\u53F2\u5B58\u50A8\u540E\u7AEF", returns: "Page<StorageBackendView>" }, async (_, { deps }) => deps.list()).register("get", { inputSchema: storageIdSchema, scope: "admin", h: "\u8BFB\u53D6\u540E\u7AEF\u72B6\u6001\uFF0C\u4E0D\u56DE\u663E\u51ED\u8BC1", returns: "StorageBackendView" }, async (input, { deps }) => deps.get(input)).register("write", { inputSchema: storageWriteSchema, scope: "admin", h: "\u521B\u5EFA\u672A\u542F\u7528\u7684\u540E\u7AEF\uFF0C\u51ED\u8BC1\u53EA\u5199\u5165\u52A0\u5BC6\u4FDD\u7BA1\u5E93", returns: "StorageBackendView" }, async (input, { deps }) => deps.write(input)).register("test", { inputSchema: storageRevisionSchema, scope: "admin", h: "\u9A8C\u8BC1\u5B9E\u9645\u8BFB\u5199\u548C\u6761\u4EF6\u5199\u80FD\u529B", returns: "StorageBackendView" }, async (input, { deps }) => deps.test(input)).register("activate", { inputSchema: storageActivateSchema, scope: "admin", h: "\u8BBE\u4E3A\u65B0\u4E0A\u4F20\u9ED8\u8BA4\u503C\uFF1B\u65E7\u5BF9\u8C61\u4FDD\u7559\u539F\u540E\u7AEF", returns: "StorageBackendView" }, async (input, { deps }) => deps.activate(input)).register("update", { inputSchema: storageRotateSchema, scope: "admin", h: "\u9A8C\u8BC1\u5E76\u8F6E\u6362\u51ED\u8BC1\uFF0C\u4F4D\u7F6E\u4E0D\u53D8", returns: "StorageBackendView" }, async (input, { deps }) => deps.update(input)).register("delete", { inputSchema: storageRevisionSchema, scope: "admin", h: "\u5220\u9664\u6CA1\u6709\u5BF9\u8C61\u6216 Context \u5F15\u7528\u7684\u975E\u9ED8\u8BA4\u540E\u7AEF", returns: "{ok:true}" }, async (input, { deps }) => deps.delete(input));
 var createConfigModule = (deps) => configCommands.module(deps);
 var createStorageModule = (deps) => storageCommands.module(deps);
 
@@ -4105,78 +4124,79 @@ function isContextExpired(createdAt, ttlSec, now) {
 }
 
 // ../core/src/device/frames.ts
-import { z as z27 } from "zod";
-var deviceNodeCmdSchema = z27.object({
-  name: z27.string().min(1),
-  delivery: z27.enum(["realtime", "mailbox", "both"]).optional(),
-  description: z27.string().optional(),
-  inputSchema: z27.unknown().optional(),
-  outputSchema: z27.unknown().optional(),
-  effect: z27.string().optional(),
-  confirm: z27.boolean().optional()
+import { z as z28 } from "zod";
+var deviceNodeCmdSchema = z28.object({
+  name: z28.string().min(1),
+  delivery: z28.enum(["realtime", "mailbox", "both"]).optional(),
+  description: z28.string().optional(),
+  inputSchema: z28.unknown().optional(),
+  outputSchema: z28.unknown().optional(),
+  effect: z28.string().optional(),
+  confirm: z28.boolean().optional()
 }).passthrough();
-var nodeInputSchema2 = z27.object({
-  path: z27.string().min(1),
-  kind: z27.enum(NODE_KINDS),
-  description: z27.string(),
-  cmds: z27.array(deviceNodeCmdSchema).optional()
+var nodeInputSchema2 = z28.object({
+  path: z28.string().min(1),
+  kind: z28.enum(NODE_KINDS),
+  description: z28.string(),
+  cmds: z28.array(deviceNodeCmdSchema).optional()
 }).passthrough();
-var deviceExposeSchema = z27.object({
-  shell: z27.object({
-    description: z27.string().optional(),
-    allow: z27.array(z27.string()).optional()
+var deviceExposeSchema = z28.object({
+  environment: deviceEnvironmentSchema.optional(),
+  shell: z28.object({
+    description: z28.string().optional(),
+    allow: z28.array(z28.string()).optional()
   }).optional(),
-  fs: z27.object({
-    roots: z27.array(z27.string().min(1)).min(1),
-    readOnly: z27.boolean().optional()
+  fs: z28.object({
+    roots: z28.array(z28.string().min(1)).min(1),
+    readOnly: z28.boolean().optional()
   }).optional(),
-  nodes: z27.array(nodeInputSchema2).optional()
+  nodes: z28.array(nodeInputSchema2).optional()
 });
-var idSchema = z27.string().min(1);
-var deviceCallContextSchema = z27.object({
-  caller: z27.object({
-    keyId: z27.string().min(1),
-    owner: z27.string().min(1),
-    displayName: z27.string().optional()
+var idSchema = z28.string().min(1);
+var deviceCallContextSchema = z28.object({
+  caller: z28.object({
+    keyId: z28.string().min(1),
+    owner: z28.string().min(1),
+    displayName: z28.string().optional()
   }).passthrough(),
-  traceId: z27.string().min(1),
-  createdAt: z27.string().min(1),
-  expiresAt: z27.string().min(1),
-  upload: z27.object({
-    token: z27.string().min(1),
-    expiresAt: z27.iso.datetime({ offset: true }),
-    maxBytes: z27.number().int().positive(),
-    maxObjects: z27.number().int().positive()
+  traceId: z28.string().min(1),
+  createdAt: z28.string().min(1),
+  expiresAt: z28.string().min(1),
+  upload: z28.object({
+    token: z28.string().min(1),
+    expiresAt: z28.iso.datetime({ offset: true }),
+    maxBytes: z28.number().int().positive(),
+    maxObjects: z28.number().int().positive()
   }).strict().optional()
 }).passthrough();
 var schemaByType = {
-  hello: z27.object({
-    type: z27.literal("hello"),
-    deviceId: z27.string().min(1),
-    mountPath: z27.string().min(1).optional(),
+  hello: z28.object({
+    type: z28.literal("hello"),
+    deviceId: z28.string().min(1),
+    mountPath: z28.string().min(1).optional(),
     expose: deviceExposeSchema
   }),
-  ready: z27.object({ type: z27.literal("ready"), mountPath: z27.string().min(1) }),
-  error: z27.object({ type: z27.literal("error"), error: tbErrorBodySchema }),
-  call: z27.object({
-    type: z27.literal("call"),
+  ready: z28.object({ type: z28.literal("ready"), mountPath: z28.string().min(1) }),
+  error: z28.object({ type: z28.literal("error"), error: tbErrorBodySchema }),
+  call: z28.object({
+    type: z28.literal("call"),
     id: idSchema,
-    path: z27.string().min(1),
-    arguments: z27.record(z27.string(), z27.unknown()),
+    path: z28.string().min(1),
+    arguments: z28.record(z28.string(), z28.unknown()),
     context: deviceCallContextSchema.optional()
   }),
-  result: z27.discriminatedUnion("ok", [
-    z27.object({ type: z27.literal("result"), id: idSchema, ok: z27.literal(true), value: z27.unknown() }),
-    z27.object({
-      type: z27.literal("result"),
+  result: z28.discriminatedUnion("ok", [
+    z28.object({ type: z28.literal("result"), id: idSchema, ok: z28.literal(true), value: z28.unknown() }),
+    z28.object({
+      type: z28.literal("result"),
       id: idSchema,
-      ok: z27.literal(false),
+      ok: z28.literal(false),
       error: tbErrorBodySchema
     })
   ]),
-  ping: z27.object({ type: z27.literal("ping") }),
-  pong: z27.object({ type: z27.literal("pong") }),
-  cancel: z27.object({ type: z27.literal("cancel"), id: idSchema })
+  ping: z28.object({ type: z28.literal("ping") }),
+  pong: z28.object({ type: z28.literal("pong") }),
+  cancel: z28.object({ type: z28.literal("cancel"), id: idSchema })
 };
 var PING_FRAME_JSON = '{"type":"ping"}';
 var PONG_FRAME_JSON = '{"type":"pong"}';
@@ -4263,7 +4283,11 @@ function deviceDirectoryHelpModel(node, children = []) {
       description: `${node.description} (${node.presence.state})`
     },
     cmds: [],
-    children
+    children,
+    ...node.environment === void 0 || node.reportedAt === void 0 ? {} : {
+      deviceContext: { environment: node.environment, reportedAt: node.reportedAt, presence: node.presence },
+      hint: `Environment is the last hello report (${node.presence.state}); inspect authorized child ~help for commands, execution limits and session recovery rules.`
+    }
   };
 }
 
@@ -4670,6 +4694,7 @@ function attrLines(key, value) {
 function renderHelpDsl(model) {
   const lines = [HTBP_HELP_HEADER];
   lines.push(nodeLine(model.node.path, model.node.kind, model.node.description));
+  if (model.deviceContext !== void 0) lines.push(`deviceContext ${JSON.stringify(model.deviceContext)}`);
   if (model.hint !== void 0) lines.push(`hint ${collapseToOneLine(model.hint)}`);
   if (model.note !== void 0) lines.push(`note "${collapseToOneLine(model.note)}"`);
   for (const cmd of model.cmds) {
@@ -4724,6 +4749,7 @@ function renderHelpJson(model) {
     node: { path: model.node.path, kind: model.node.kind, description: model.node.description },
     cmds
   };
+  if (model.deviceContext !== void 0) json.deviceContext = model.deviceContext;
   if (model.hint !== void 0) json.hint = model.hint;
   if (model.note !== void 0) json.note = model.note;
   if (model.feedback !== void 0 && model.feedback.length > 0) {
@@ -4789,6 +4815,11 @@ function renderHelpMarkdown(model) {
   if (model.node.description.trim() !== "") {
     out.push(model.node.description.trim(), "");
   }
+  if (model.deviceContext !== void 0) {
+    out.push("## Device context", "");
+    out.push("Last reported environment (self-reported; presence does not refresh this snapshot):", "");
+    out.push("```json", JSON.stringify(model.deviceContext, null, 2), "```", "");
+  }
   if (model.hint !== void 0) {
     out.push(`> **Next step**: ${collapseToOneLine(model.hint)}`, "");
   }
@@ -4980,7 +5011,7 @@ function assertUploadBinding(existing, requested, now) {
 }
 
 // ../core/src/objectStoreService/service.ts
-import { z as z28 } from "zod/v4";
+import { z as z29 } from "zod/v4";
 
 // ../core/src/objectStoreService/uri.ts
 var STORE_OBJECT_ID_RE = /^[A-Za-z0-9_-]{22,64}$/;
@@ -5019,18 +5050,18 @@ var TOKEN_PREFIX = {
 function stateCorrupt(kind) {
   return new TBError("internal", `Store ${kind} \u72B6\u6001\u635F\u574F`, { retryable: false });
 }
-var persistedId = z28.string().min(1);
-var persistedOwner = z28.string().min(1).refine((value) => !/[\r\n\0]/.test(value));
-var persistedTimestamp = z28.string().refine((value) => Number.isFinite(Date.parse(value)));
-var persistedNonNegativeInt = z28.number().int().nonnegative().refine(Number.isSafeInteger);
+var persistedId = z29.string().min(1);
+var persistedOwner = z29.string().min(1).refine((value) => !/[\r\n\0]/.test(value));
+var persistedTimestamp = z29.string().refine((value) => Number.isFinite(Date.parse(value)));
+var persistedNonNegativeInt = z29.number().int().nonnegative().refine(Number.isSafeInteger);
 var persistedPositiveInt = persistedNonNegativeInt.refine((value) => value > 0);
-var persistedHash = z28.string().regex(/^[0-9a-f]{64}$/);
-var persistedChecksum = z28.looseObject({
-  algorithm: z28.literal("sha256"),
-  value: z28.string().min(1)
+var persistedHash = z29.string().regex(/^[0-9a-f]{64}$/);
+var persistedChecksum = z29.looseObject({
+  algorithm: z29.literal("sha256"),
+  value: z29.string().min(1)
 });
 function stateParser(kind, shape) {
-  const schema = z28.looseObject({ revision: persistedPositiveInt, ...shape });
+  const schema = z29.looseObject({ revision: persistedPositiveInt, ...shape });
   return (value) => {
     const parsed = schema.safeParse(value);
     if (!parsed.success) throw stateCorrupt(kind);
@@ -5041,22 +5072,22 @@ var parseObject = stateParser("object", {
   backendId: persistedId,
   bytesDeletedAt: persistedTimestamp.optional(),
   checksum: persistedChecksum.optional(),
-  contentType: z28.string().min(1),
+  contentType: z29.string().min(1),
   createdAt: persistedTimestamp,
   driverKey: persistedId,
-  etag: z28.string().optional(),
+  etag: z29.string().optional(),
   expectedChecksum: persistedChecksum.optional(),
   expectedSize: persistedNonNegativeInt.optional(),
   expiresAt: persistedTimestamp.optional(),
-  filename: z28.string().optional(),
+  filename: z29.string().optional(),
   id: persistedId,
   originCallId: persistedId.optional(),
   owner: persistedOwner,
   producer: persistedOwner.optional(),
   readyAt: persistedTimestamp.optional(),
   size: persistedNonNegativeInt.optional(),
-  status: z28.enum(["pending", "ready", "failed", "abandoned", "deleted"]),
-  store: z28.literal(DEFAULT_STORE_NAME),
+  status: z29.enum(["pending", "ready", "failed", "abandoned", "deleted"]),
+  store: z29.literal(DEFAULT_STORE_NAME),
   updatedAt: persistedTimestamp,
   uploadId: persistedId
 });
@@ -5066,7 +5097,7 @@ var parseSessionRecord = stateParser("upload session", {
   backendId: persistedId,
   capabilityHash: persistedHash,
   completedAt: persistedTimestamp.optional(),
-  contentType: z28.string().min(1),
+  contentType: z29.string().min(1),
   createdAt: persistedTimestamp,
   expectedChecksum: persistedChecksum.optional(),
   expectedSize: persistedNonNegativeInt.optional(),
@@ -5074,13 +5105,13 @@ var parseSessionRecord = stateParser("upload session", {
   id: persistedId,
   maxBytes: persistedPositiveInt,
   objectId: persistedId,
-  status: z28.enum(["created", "completed", "aborted", "expired", "failed"]),
+  status: z29.enum(["created", "completed", "aborted", "expired", "failed"]),
   terminalAt: persistedTimestamp.optional(),
-  transport: z28.enum(["relay", "presigned-put"])
+  transport: z29.enum(["relay", "presigned-put"])
 });
 var parseCallCapabilityRecord = stateParser("call capability", {
   signingKeyId: persistedId,
-  allowedContentTypes: z28.array(z28.string().min(1)).min(1),
+  allowedContentTypes: z29.array(z29.string().min(1)).min(1),
   callId: persistedId,
   createdAt: persistedTimestamp,
   expiresAt: persistedTimestamp,
@@ -5090,12 +5121,12 @@ var parseCallCapabilityRecord = stateParser("call capability", {
   maxObjects: persistedPositiveInt,
   owner: persistedOwner,
   producer: persistedOwner,
-  reservations: z28.array(z28.looseObject({
+  reservations: z29.array(z29.looseObject({
     maxBytes: persistedPositiveInt,
     objectId: persistedId
   })),
   reservedBytes: persistedNonNegativeInt,
-  status: z28.enum(["active", "exhausted", "revoked", "expired"]),
+  status: z29.enum(["active", "exhausted", "revoked", "expired"]),
   terminalAt: persistedTimestamp.optional(),
   tokenHash: persistedHash
 });
@@ -5106,13 +5137,13 @@ var parseShare = stateParser("share grant", {
   expiresAt: persistedTimestamp,
   id: persistedId,
   objectId: persistedId,
-  status: z28.enum(["active", "revoked", "expired"]),
+  status: z29.enum(["active", "revoked", "expired"]),
   terminalAt: persistedTimestamp.optional(),
   tokenHash: persistedHash
 });
 var parseIdempotencyBinding = stateParser("idempotency binding", {
   createdAt: persistedTimestamp,
-  domain: z28.enum(["owner", "call"]),
+  domain: z29.enum(["owner", "call"]),
   expiresAt: persistedTimestamp,
   fingerprint: persistedHash,
   objectId: persistedId,
@@ -6319,24 +6350,24 @@ var RequestDedupe = class {
 };
 
 // ../core/src/plugin/envelope.ts
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 var HEADER_TB_CONTEXT = "X-TB-Context";
 var HEADER_TB_REQUEST_ID = "X-TB-Request-Id";
 var HEADER_TB_UPSTREAM_AUTH = "X-TB-Upstream-Auth";
 var PLUGIN_PAYLOAD_MAX_BYTES = 1024 * 1024;
-var callContextSchema = z29.object({
-  keyId: z29.string().min(1),
-  owner: z29.string().min(1),
-  scopes: z29.array(
-    z29.object({
-      pattern: z29.string().min(1),
-      actions: z29.array(z29.enum(ACTIONS)),
-      effect: z29.enum(["allow", "deny"]).optional()
+var callContextSchema = z30.object({
+  keyId: z30.string().min(1),
+  owner: z30.string().min(1),
+  scopes: z30.array(
+    z30.object({
+      pattern: z30.string().min(1),
+      actions: z30.array(z30.enum(ACTIONS)),
+      effect: z30.enum(["allow", "deny"]).optional()
     })
   ),
-  registerPaths: z29.array(z29.string()).optional(),
-  traceId: z29.string().min(1),
-  mountPath: z29.string().min(1).optional(),
+  registerPaths: z30.array(z30.string()).optional(),
+  traceId: z30.string().min(1),
+  mountPath: z30.string().min(1).optional(),
   /**
    * 挂载节点的 `providerConfig`。**只发给该节点对应的那个 plugin**(随本次调用的信封),
    * 插件之间不共享 —— 同一 plugin 部署的不同挂载各自收到自己那份。
@@ -6348,9 +6379,9 @@ var callContextSchema = z29.object({
    *
    * 放这里的应当是:region / baseUrl override / 功能开关 / workspace 归属之类的**非敏感**配置。
    */
-  mountConfig: z29.record(z29.string(), z29.unknown()).optional(),
+  mountConfig: z30.record(z30.string(), z30.unknown()).optional(),
   /** v2 多 export 路由:本次调用命中 plugin 的哪个 export。 */
-  exportId: z29.string().min(1).optional()
+  exportId: z30.string().min(1).optional()
 });
 function encodeCallContext(ctx) {
   return base64urlEncode(new TextEncoder().encode(JSON.stringify(ctx)));
@@ -6378,9 +6409,9 @@ function decodeCallContext(header) {
   }
   return parsed.data;
 }
-var pluginCallSchema = z29.object({
-  tool: z29.string().min(1),
-  arguments: z29.record(z29.string(), z29.unknown())
+var pluginCallSchema = z30.object({
+  tool: z30.string().min(1),
+  arguments: z30.record(z30.string(), z30.unknown())
 });
 function assertPluginPayloadSize(payload) {
   const bytes2 = new TextEncoder().encode(payload).length;
@@ -7394,19 +7425,19 @@ function parseFrontmatter(text) {
 }
 
 // ../core/src/skillhub/commands.ts
-import { z as z30 } from "zod/v4";
-var publishFileSchema = z30.strictObject({
-  path: z30.string().describe(
+import { z as z31 } from "zod/v4";
+var publishFileSchema = z31.strictObject({
+  path: z31.string().describe(
     "file path relative to the skill root, e.g. 'SKILL.md', 'scripts/run.sh'"
   ),
-  content: z30.string().describe("UTF-8 text content"),
-  contentType: z30.string().optional().describe("optional; inferred from extension when omitted")
+  content: z31.string().describe("UTF-8 text content"),
+  contentType: z31.string().optional().describe("optional; inferred from extension when omitted")
 });
 var skillhubCommands = new HtbpCommandRegistry().register(
   "list",
   {
     h: "list published skills (id / name / description from SKILL.md frontmatter, paginated)",
-    inputSchema: z30.strictObject({ opts: HTBP_LIST_OPTIONS_SCHEMA.optional() }),
+    inputSchema: z31.strictObject({ opts: HTBP_LIST_OPTIONS_SCHEMA.optional() }),
     returns: "Page<SkillSummary>",
     scope: "read"
   },
@@ -7415,9 +7446,9 @@ var skillhubCommands = new HtbpCommandRegistry().register(
   "get",
   {
     h: "read a skill: SKILL.md body + file manifest; pass 'file' to fetch one bundled file (oversized/binary as { $ref })",
-    inputSchema: z30.strictObject({
-      id: z30.string().describe("skill id"),
-      file: z30.string().optional().describe(
+    inputSchema: z31.strictObject({
+      id: z31.string().describe("skill id"),
+      file: z31.string().optional().describe(
         "optional: path of one bundled file to fetch instead of the manifest"
       )
     }),
@@ -7429,8 +7460,8 @@ var skillhubCommands = new HtbpCommandRegistry().register(
   "search",
   {
     h: "keyword search over skill id / name / description",
-    inputSchema: z30.strictObject({
-      query: z30.string().describe("substring to match"),
+    inputSchema: z31.strictObject({
+      query: z31.string().describe("substring to match"),
       opts: HTBP_LIST_OPTIONS_SCHEMA.optional()
     }),
     returns: "Page<SkillSummary>",
@@ -7441,11 +7472,11 @@ var skillhubCommands = new HtbpCommandRegistry().register(
   "publish",
   {
     h: "publish/replace a skill from a set of text files (must include SKILL.md with name+description frontmatter)",
-    inputSchema: z30.strictObject({
-      id: z30.string().optional().describe(
+    inputSchema: z31.strictObject({
+      id: z31.string().optional().describe(
         "skill id; defaults to a slug derived from the frontmatter name"
       ),
-      files: z30.array(publishFileSchema).describe(
+      files: z31.array(publishFileSchema).describe(
         "the skill files; whole-skill replace (files not listed are removed)"
       )
     }),
@@ -7463,7 +7494,7 @@ var skillhubCommands = new HtbpCommandRegistry().register(
   "remove",
   {
     h: "delete a skill and all its files (not_found if it does not exist)",
-    inputSchema: z30.strictObject({ id: z30.string().describe("skill id") }),
+    inputSchema: z31.strictObject({ id: z31.string().describe("skill id") }),
     scope: "write",
     effect: "destructive"
   },
@@ -8129,6 +8160,8 @@ var NodeRegistryStore = class {
       ...node.config !== void 0 ? { config: node.config } : {},
       ...node.virtualize !== void 0 ? { virtualize: node.virtualize } : {},
       ...opts.deviceId !== void 0 ? { deviceId: opts.deviceId } : {},
+      ...opts.deviceEnvironment !== void 0 ? { deviceEnvironment: opts.deviceEnvironment } : {},
+      ...opts.deviceReportedAt !== void 0 ? { deviceReportedAt: opts.deviceReportedAt } : {},
       ...opts.online !== void 0 ? { online: opts.online } : {},
       ...opts.lastSeenAt !== void 0 ? { lastSeenAt: opts.lastSeenAt } : {},
       registeredBy,
@@ -8252,6 +8285,7 @@ export {
   TBError,
   isTBError,
   normalizePath,
+  canonicalizePath,
   assertNoCollision,
   validatePath,
   KEY_SK_HASH,
@@ -8296,6 +8330,7 @@ export {
   createEncryptionKeyring,
   validateStoreTokenKeyring,
   DeviceMailboxService,
+  deviceEnvironmentSchema,
   tbErrorBodySchema,
   nodeInputSchema,
   helpJsonSchema,
@@ -8304,7 +8339,9 @@ export {
   toolSearchSourceSchema,
   toolSearchSourceResultSchema,
   toolSearchPageSchema,
+  toolSearchOptionsSchema,
   toolSearchRequestSchema,
+  deviceOperationStateSchema,
   deviceOperationSummarySchema,
   deviceOperationDetailSchema,
   deviceOperationListRequestSchema,
@@ -8367,7 +8404,6 @@ export {
   negotiate,
   contentTypeFor,
   MAX_TREE_DEPTH,
-  DEFAULT_MAX_NODES,
   clampDepth,
   buildTree,
   reserveUploadQuota,