@vibesdotdev/storage 0.0.2 → 1.0.0-rc.3

package/dist/client/storage-explorer-capability.js

@@ -0,0 +1,125 @@
+export { StorageExplorerScopeSchema, RendererStorageTargetSchema, StorageExplorerStatusSchema } from "../schemas/explorer/capability.js";
+import { createRuntimeKind, RuntimeDescriptorSchema } from '@vibesdotdev/kernel';
+import { defineRemoteExposure } from '@vibesdotdev/kernel/federation';
+// RPC request, option, result, and projection schemas live in
+// `src/schemas/explorer/rpc.ts`; this module keeps the callable port, the
+// kind/descriptor, and the exposure wiring (ids, versions, byte limits).
+import { StorageExplorerListDrivesRequestSchema, StorageExplorerListDrivesResultSchema, StorageExplorerListEntriesRequestSchema, StorageExplorerListEntriesResultSchema, StorageExplorerListTargetsRequestSchema, StorageExplorerListTargetsResultSchema, StorageExplorerReadCancellation, StorageExplorerResolveObjectUrlRequestSchema, StorageExplorerResolveObjectUrlResultSchema, StorageExplorerSearchRequestSchema, StorageExplorerSearchResultSchema, StorageExplorerStatusRequestSchema, StorageExplorerStatusSchema, StorageTargetsRendererProjection, StorageExplorerUserRead } from "../schemas/explorer/rpc.js";
+export { projectStorageTargetForRenderer, StorageExplorerListDrivesRequestSchema, StorageExplorerListDrivesResultSchema, StorageExplorerListEntriesRequestSchema, StorageExplorerListEntriesResultSchema, StorageExplorerListTargetsRequestSchema, StorageExplorerListTargetsResultSchema, StorageExplorerReadCancellation, StorageExplorerResolveObjectUrlRequestSchema, StorageExplorerResolveObjectUrlResultSchema, StorageExplorerSearchRequestSchema, StorageExplorerSearchResultSchema, StorageExplorerStatusRequestSchema, StorageTargetsRendererProjection, StorageExplorerUserRead } from "../schemas/explorer/rpc.js";
+export const STORAGE_EXPLORER_CAPABILITY_ID = 'storage.explorer';
+export const storageExplorerCapabilityKind = createRuntimeKind({
+    id: 'storage/explorer',
+    descriptorSchema: RuntimeDescriptorSchema
+});
+export const storageExplorerCapabilityDescriptor = {
+    id: STORAGE_EXPLORER_CAPABILITY_ID,
+    kind: storageExplorerCapabilityKind.id,
+    name: 'Storage explorer',
+    description: 'Renderer-safe account storage browsing through a trusted runtime owner',
+    enabled: true,
+    hardware: ['consumer', 'cloud']
+};
+const userRead = StorageExplorerUserRead;
+const readCancellation = StorageExplorerReadCancellation;
+export const storageExplorerCapabilityExposure = defineRemoteExposure({
+    protocolVersion: 1,
+    discoverable: true,
+    audiences: ['consumer-renderer'],
+    methods: {
+        status: {
+            request: {
+                id: 'storage.explorer.status.request',
+                version: 1,
+                schema: StorageExplorerStatusRequestSchema
+            },
+            result: {
+                id: 'storage.explorer.status.result',
+                version: 1,
+                schema: StorageExplorerStatusSchema
+            },
+            dataClassification: 'public',
+            rendererView: 'redacted',
+            retry: { mode: 'read', retry: 'safe' },
+            cancellation: readCancellation,
+            maxRequestBytes: 512,
+            maxResultBytes: 512
+        },
+        listTargets: {
+            request: {
+                id: 'storage.explorer.list-targets.request',
+                version: 1,
+                schema: StorageExplorerListTargetsRequestSchema
+            },
+            result: {
+                id: 'storage.explorer.list-targets.result',
+                version: 1,
+                schema: StorageExplorerListTargetsResultSchema
+            },
+            ...userRead,
+            projectRenderer: StorageTargetsRendererProjection,
+            maxRequestBytes: 8 * 1024,
+            maxResultBytes: 2 * 1024 * 1024
+        },
+        listDrives: {
+            request: {
+                id: 'storage.explorer.list-drives.request',
+                version: 1,
+                schema: StorageExplorerListDrivesRequestSchema
+            },
+            result: {
+                id: 'storage.explorer.list-drives.result',
+                version: 1,
+                schema: StorageExplorerListDrivesResultSchema
+            },
+            ...userRead,
+            maxRequestBytes: 1_024,
+            maxResultBytes: 2 * 1024 * 1024
+        },
+        listEntries: {
+            request: {
+                id: 'storage.explorer.list-entries.request',
+                version: 1,
+                schema: StorageExplorerListEntriesRequestSchema
+            },
+            result: {
+                id: 'storage.explorer.list-entries.result',
+                version: 1,
+                schema: StorageExplorerListEntriesResultSchema
+            },
+            ...userRead,
+            maxRequestBytes: 16 * 1024,
+            maxResultBytes: 8 * 1024 * 1024
+        },
+        search: {
+            request: {
+                id: 'storage.explorer.search.request',
+                version: 1,
+                schema: StorageExplorerSearchRequestSchema
+            },
+            result: {
+                id: 'storage.explorer.search.result',
+                version: 1,
+                schema: StorageExplorerSearchResultSchema
+            },
+            ...userRead,
+            maxRequestBytes: 20 * 1024,
+            maxResultBytes: 8 * 1024 * 1024
+        },
+        resolveObjectUrl: {
+            request: {
+                id: 'storage.explorer.resolve-object-url.request',
+                version: 1,
+                schema: StorageExplorerResolveObjectUrlRequestSchema
+            },
+            result: {
+                id: 'storage.explorer.resolve-object-url.result',
+                version: 1,
+                schema: StorageExplorerResolveObjectUrlResultSchema
+            },
+            ...userRead,
+            maxRequestBytes: 20 * 1024,
+            maxResultBytes: 16 * 1024
+        }
+    }
+});
+//# sourceMappingURL=storage-explorer-capability.js.map

package/dist/client/storage-explorer-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-explorer-capability.js","sourceRoot":"","sources":["../../src/client/storage-explorer-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,2BAA2B,EAAqF,MAAM,mCAAmC,CAAC;AAE5N,OAAO,EACN,iBAAiB,EACjB,uBAAuB,EAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,8DAA8D;AAC9D,0EAA0E;AAC1E,yEAAyE;AACzE,OAAO,EACN,sCAAsC,EACtC,qCAAqC,EACrC,uCAAuC,EACvC,sCAAsC,EACtC,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,4CAA4C,EAC5C,2CAA2C,EAC3C,kCAAkC,EAClC,iCAAiC,EACjC,kCAAkC,EAClC,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,+BAA+B,EAC/B,sCAAsC,EACtC,qCAAqC,EACrC,uCAAuC,EACvC,sCAAsC,EACtC,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,4CAA4C,EAC5C,2CAA2C,EAC3C,kCAAkC,EAClC,iCAAiC,EACjC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EAcvB,MAAM,4BAA4B,CAAC;AAOpC,MAAM,CAAC,MAAM,8BAA8B,GAAG,kBAAkB,CAAC;AA6BjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAG5D;IACD,EAAE,EAAE,kBAAkB;IACtB,gBAAgB,EAAE,uBAAuB;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAsB;IACrE,EAAE,EAAE,8BAA8B;IAClC,IAAI,EAAE,6BAA6B,CAAC,EAAE;IACtC,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,wEAAwE;IACrF,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AACzC,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,oBAAoB,CAAC;IACrE,eAAe,EAAE,CAAC;IAClB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,OAAO,EAAE;QACR,MAAM,EAAE;YACP,OAAO,EAAE;gBACR,EAAE,EAAE,iCAAiC;gBACrC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,kCAAkC;aAC1C;YACD,MAAM,EAAE;gBACP,EAAE,EAAE,gCAAgC;gBACpC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,2BAA2B;aACnC;YACD,kBAAkB,EAAE,QAAQ;YAC5B,YAAY,EAAE,UAAU;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;YACtC,YAAY,EAAE,gBAAgB;YAC9B,eAAe,EAAE,GAAG;YACpB,cAAc,EAAE,GAAG;SACnB;QACD,WAAW,EAAE;YACZ,OAAO,EAAE;gBACR,EAAE,EAAE,uCAAuC;gBAC3C,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,uCAAuC;aAC/C;YACD,MAAM,EAAE;gBACP,EAAE,EAAE,sCAAsC;gBAC1C,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,sCAAsC;aAC9C;YACD,GAAG,QAAQ;YACX,eAAe,EAAE,gCAAgC;YACjD,eAAe,EAAE,CAAC,GAAG,IAAI;YACzB,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;SAC/B;QACD,UAAU,EAAE;YACX,OAAO,EAAE;gBACR,EAAE,EAAE,sCAAsC;gBAC1C,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,sCAAsC;aAC9C;YACD,MAAM,EAAE;gBACP,EAAE,EAAE,qCAAqC;gBACzC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,qCAAqC;aAC7C;YACD,GAAG,QAAQ;YACX,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;SAC/B;QACD,WAAW,EAAE;YACZ,OAAO,EAAE;gBACR,EAAE,EAAE,uCAAuC;gBAC3C,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,uCAAuC;aAC/C;YACD,MAAM,EAAE;gBACP,EAAE,EAAE,sCAAsC;gBAC1C,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,sCAAsC;aAC9C;YACD,GAAG,QAAQ;YACX,eAAe,EAAE,EAAE,GAAG,IAAI;YAC1B,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;SAC/B;QACD,MAAM,EAAE;YACP,OAAO,EAAE;gBACR,EAAE,EAAE,iCAAiC;gBACrC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,kCAAkC;aAC1C;YACD,MAAM,EAAE;gBACP,EAAE,EAAE,gCAAgC;gBACpC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,iCAAiC;aACzC;YACD,GAAG,QAAQ;YACX,eAAe,EAAE,EAAE,GAAG,IAAI;YAC1B,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;SAC/B;QACD,gBAAgB,EAAE;YACjB,OAAO,EAAE;gBACR,EAAE,EAAE,6CAA6C;gBACjD,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,4CAA4C;aACpD;YACD,MAAM,EAAE;gBACP,EAAE,EAAE,4CAA4C;gBAChD,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,2CAA2C;aACnD;YACD,GAAG,QAAQ;YACX,eAAe,EAAE,EAAE,GAAG,IAAI;YAC1B,cAAc,EAAE,EAAE,GAAG,IAAI;SACzB;KACD;CACD,CAAC,CAAC"}

package/dist/client/storage-failure.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The storage surfaces' one reading of a caught failure.
+ *
+ * Tools, the explorer worker, the TUI, the Svelte surface and the daemon all
+ * call the Platform client (or an adapter) and must report what went wrong
+ * without repeating it: a Platform error's message carries the server's body
+ * (`Platform API 403: <body> (<path>)`), and an adapter's can echo a signed
+ * request. {@link storageSurfaceFailure} turns any caught value into a
+ * `CapabilityError` whose code and reason say what failed, never its text:
+ *
+ * - a `CapabilityError` stays itself;
+ * - an error carrying an HTTP failure `status` (the Platform client's
+ *   `PlatformApiError` / `PlatformApiClientError`) becomes `storage-request-failed`
+ *   with that status in `details` and its code classified by the status;
+ * - anything else is `INTERNAL untyped` (`CapabilityError.from`).
+ *
+ * The original always travels as `cause` for logs. Surfaces render
+ * {@link describeStorageFailure} (code and reason only) wherever the failure
+ * reaches an agent, a renderer or a terminal.
+ */
+import { CapabilityError, type CaughtFailure } from '@vibesdotdev/kernel';
+/** The reason of a failure classified by its HTTP status. */
+export declare const STORAGE_REQUEST_FAILED = "storage-request-failed";
+/** A caught failure as the typed failure every storage surface reports. */
+export declare function storageSurfaceFailure(error: CaughtFailure): CapabilityError;
+/** What a surface may print about a failure: its code and reason (and HTTP status), never its text. */
+export declare function describeStorageFailure(failure: CapabilityError): string;
+/** What a storage operation produced, or the failure it raised (parsed at the catch boundary). */
+export type StorageAttempt<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly cause: CaughtFailure;
+};
+/**
+ * Run one storage operation whose failure the caller reports rather than
+ * propagates (one drive of an aggregate search, a UI action): a throw or a
+ * rejection becomes `{ ok: false, cause }`. The caller owns the decision and
+ * reads the cause through {@link storageSurfaceFailure}.
+ */
+export declare function settleStorage<T>(work: () => PromiseLike<T> | T): Promise<StorageAttempt<T>>;
+//# sourceMappingURL=storage-failure.d.ts.map

package/dist/client/storage-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-failure.d.ts","sourceRoot":"","sources":["../../src/client/storage-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,eAAe,EAAiD,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzH,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAuD/D,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAG3E;AAED,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAGvE;AAED,kGAAkG;AAClG,MAAM,MAAM,cAAc,CAAC,CAAC,IACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAEzD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAMjG"}

package/dist/client/storage-failure.js

@@ -0,0 +1,100 @@
+/**
+ * The storage surfaces' one reading of a caught failure.
+ *
+ * Tools, the explorer worker, the TUI, the Svelte surface and the daemon all
+ * call the Platform client (or an adapter) and must report what went wrong
+ * without repeating it: a Platform error's message carries the server's body
+ * (`Platform API 403: <body> (<path>)`), and an adapter's can echo a signed
+ * request. {@link storageSurfaceFailure} turns any caught value into a
+ * `CapabilityError` whose code and reason say what failed, never its text:
+ *
+ * - a `CapabilityError` stays itself;
+ * - an error carrying an HTTP failure `status` (the Platform client's
+ *   `PlatformApiError` / `PlatformApiClientError`) becomes `storage-request-failed`
+ *   with that status in `details` and its code classified by the status;
+ * - anything else is `INTERNAL untyped` (`CapabilityError.from`).
+ *
+ * The original always travels as `cause` for logs. Surfaces render
+ * {@link describeStorageFailure} (code and reason only) wherever the failure
+ * reaches an agent, a renderer or a terminal.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+/** The reason of a failure classified by its HTTP status. */
+export const STORAGE_REQUEST_FAILED = 'storage-request-failed';
+/** The fixed message of a status-classified failure. */
+const REQUEST_FAILED_MESSAGE = 'The storage request failed.';
+/** An HTTP failure status as an error carries it. */
+const HttpFailureStatusSchema = z.object({ status: z.number().int().min(400).max(599) });
+/** The code a failure status projects to. */
+function codeForStatus(status) {
+    switch (status) {
+        case 401:
+            return 'AUTH_REQUIRED';
+        case 403:
+            return 'PERMISSION_DENIED';
+        case 404:
+        case 410:
+            return 'NOT_FOUND';
+        case 408:
+        case 504:
+            return 'TIMEOUT';
+        case 409:
+            return 'CONFLICT';
+        case 429:
+            return 'RATE_LIMITED';
+        default:
+            return status >= 500 || status === 412 ? 'UNAVAILABLE' : 'INVALID_INPUT';
+    }
+}
+/**
+ * The status an untyped failure carries, read once inside a guard. A value
+ * whose `status` read throws (a hostile getter or Proxy) is reported as its
+ * own typed failure, carrying what the read threw.
+ */
+function classifyUntyped(failure) {
+    let read;
+    try {
+        read = HttpFailureStatusSchema.safeParse(failure.cause);
+    }
+    catch (unreadable) {
+        return new CapabilityError('A storage failure could not be read.', 'INTERNAL', {
+            reason: 'storage-failure-unreadable',
+            retryable: false,
+            cause: unreadable
+        });
+    }
+    if (!read.success)
+        return failure;
+    const { status } = read.data;
+    return new CapabilityError(REQUEST_FAILED_MESSAGE, codeForStatus(status), {
+        reason: STORAGE_REQUEST_FAILED,
+        details: { status },
+        cause: failure.cause
+    });
+}
+/** A caught failure as the typed failure every storage surface reports. */
+export function storageSurfaceFailure(error) {
+    const failure = CapabilityError.from(error);
+    return failure.reason === 'untyped' ? classifyUntyped(failure) : failure;
+}
+/** What a surface may print about a failure: its code and reason (and HTTP status), never its text. */
+export function describeStorageFailure(failure) {
+    const status = failure.reason === STORAGE_REQUEST_FAILED ? HttpFailureStatusSchema.safeParse(failure.details) : undefined;
+    return status?.success ? `${failure.code} ${failure.reason} ${status.data.status}` : `${failure.code} ${failure.reason}`;
+}
+/**
+ * Run one storage operation whose failure the caller reports rather than
+ * propagates (one drive of an aggregate search, a UI action): a throw or a
+ * rejection becomes `{ ok: false, cause }`. The caller owns the decision and
+ * reads the cause through {@link storageSurfaceFailure}.
+ */
+export async function settleStorage(work) {
+    try {
+        return { ok: true, value: await work() };
+    }
+    catch (error) {
+        return { ok: false, cause: CaughtFailureSchema.parse(error) };
+    }
+}
+//# sourceMappingURL=storage-failure.js.map

package/dist/client/storage-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-failure.js","sourceRoot":"","sources":["../../src/client/storage-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAgD,MAAM,qBAAqB,CAAC;AAEzH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,wDAAwD;AACxD,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AAE7D,qDAAqD;AACrD,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAEzF,6CAA6C;AAC7C,SAAS,aAAa,CAAC,MAAc;IACpC,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,GAAG;YACP,OAAO,eAAe,CAAC;QACxB,KAAK,GAAG;YACP,OAAO,mBAAmB,CAAC;QAC5B,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACP,OAAO,WAAW,CAAC;QACpB,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACP,OAAO,SAAS,CAAC;QAClB,KAAK,GAAG;YACP,OAAO,UAAU,CAAC;QACnB,KAAK,GAAG;YACP,OAAO,cAAc,CAAC;QACvB;YACC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC;IAC3E,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAAwB;IAChD,IAAI,IAAmE,CAAC;IACxE,IAAI,CAAC;QACJ,IAAI,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACrB,OAAO,IAAI,eAAe,CAAC,sCAAsC,EAAE,UAAU,EAAE;YAC9E,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,UAAU;SACjB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IAC7B,OAAO,IAAI,eAAe,CAAC,sBAAsB,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;QACzE,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACzD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,OAAwB;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1H,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;AAC1H,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,IAA8B;IACpE,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/D,CAAC;AACF,CAAC"}

package/dist/daemon/commands/browse.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Storage Browse Command Handlers
+ *
+ * RPC commands that expose the canonical `@vibesdotdev/storage/client`
+ * browse surface to CEF / other transports, on the runtime the command host
+ * hands each handler (`deps.runtime`):
+ *
+ * - storage.browse.list-adapters → descriptor-only browsable adapters
+ * - storage.browse.list-drives    → browseStorageDrives(runtime, adapterId, config?)
+ * - storage.browse.list-entries   → browseStorageEntries(runtime, adapterId, driveId, path?, config?)
+ */
+import type { RuntimeCommandDeps, RuntimeCommandPayload, RuntimeCommandResult } from '@vibesdotdev/kernel/plugin-types';
+/**
+ * List every `storage/adapter` descriptor whose `capabilities[]` includes `'browse'`.
+ */
+export declare function handleBrowseListAdapters(_message: RuntimeCommandPayload, deps: RuntimeCommandDeps): Promise<RuntimeCommandResult>;
+/**
+ * Enumerate drives for a browse-capable storage adapter.
+ *
+ * Payload: { adapterId, config? }
+ */
+export declare function handleBrowseListDrives(message: RuntimeCommandPayload, deps: RuntimeCommandDeps): Promise<RuntimeCommandResult>;
+/**
+ * List entries at `path` inside `driveId` for a browse-capable adapter.
+ *
+ * Payload: { adapterId, driveId, path?, config? }
+ */
+export declare function handleBrowseListEntries(message: RuntimeCommandPayload, deps: RuntimeCommandDeps): Promise<RuntimeCommandResult>;
+//# sourceMappingURL=browse.d.ts.map

package/dist/daemon/commands/browse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browse.d.ts","sourceRoot":"","sources":["../../../src/daemon/commands/browse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EACX,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,MAAM,kCAAkC,CAAC;AAuB1C;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,qBAAqB,EAC/B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAmB/B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAqB/B"}

package/dist/daemon/commands/browse.js

@@ -0,0 +1,91 @@
+/**
+ * Storage Browse Command Handlers
+ *
+ * RPC commands that expose the canonical `@vibesdotdev/storage/client`
+ * browse surface to CEF / other transports, on the runtime the command host
+ * hands each handler (`deps.runtime`):
+ *
+ * - storage.browse.list-adapters → descriptor-only browsable adapters
+ * - storage.browse.list-drives    → browseStorageDrives(runtime, adapterId, config?)
+ * - storage.browse.list-entries   → browseStorageEntries(runtime, adapterId, driveId, path?, config?)
+ */
+import * as z from 'zod/v4';
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { browseStorageDrives, browseStorageEntries } from "../../client/browse-adapter.js";
+import { describeStorageFailure, storageSurfaceFailure } from "../../client/storage-failure.js";
+/** A required id field: non-empty text. */
+const PayloadIdSchema = z.string().min(1);
+/** The optional browse path: text, else the drive root. */
+const PayloadPathSchema = z.string().catch('');
+/** The optional per-call adapter config: an object, else none. */
+const PayloadConfigSchema = z.record(z.string(), z.unknown());
+/** Each payload field is read on its own; a malformed optional field is treated as absent. */
+function payloadConfig(message) {
+    const parsed = PayloadConfigSchema.safeParse(message.config);
+    return parsed.success ? parsed.data : undefined;
+}
+function payloadId(value) {
+    const parsed = PayloadIdSchema.safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+/**
+ * List every `storage/adapter` descriptor whose `capabilities[]` includes `'browse'`.
+ */
+export async function handleBrowseListAdapters(_message, deps) {
+    const adapters = await deps.runtime
+        .query('storage/adapter')
+        .filter((descriptor) => Array.isArray(descriptor.capabilities) && descriptor.capabilities.includes('browse'))
+        .descriptorsAsync();
+    return { success: true, adapters };
+}
+/**
+ * Enumerate drives for a browse-capable storage adapter.
+ *
+ * Payload: { adapterId, config? }
+ */
+export async function handleBrowseListDrives(message, deps) {
+    const adapterId = payloadId(message.adapterId);
+    if (!adapterId) {
+        return { success: false, error: 'Missing required field: adapterId' };
+    }
+    const config = payloadConfig(message);
+    try {
+        const drives = await browseStorageDrives(deps.runtime, adapterId, config);
+        return { success: true, drives };
+    }
+    catch (error) {
+        // The failure's code and reason only: an adapter's message can echo a signed request or a provider body.
+        return {
+            success: false,
+            error: describeStorageFailure(storageSurfaceFailure(CaughtFailureSchema.parse(error))),
+            failure: valueFreeFailure(CaughtFailureSchema.parse(error))
+        };
+    }
+}
+/**
+ * List entries at `path` inside `driveId` for a browse-capable adapter.
+ *
+ * Payload: { adapterId, driveId, path?, config? }
+ */
+export async function handleBrowseListEntries(message, deps) {
+    const adapterId = payloadId(message.adapterId);
+    const driveId = payloadId(message.driveId);
+    const path = PayloadPathSchema.parse(message.path);
+    if (!adapterId || !driveId) {
+        return { success: false, error: 'Missing required fields: adapterId, driveId' };
+    }
+    const config = payloadConfig(message);
+    try {
+        const entries = await browseStorageEntries(deps.runtime, adapterId, driveId, path, config);
+        return { success: true, entries };
+    }
+    catch (error) {
+        // The failure's code and reason only: an adapter's message can echo a signed request or a provider body.
+        return {
+            success: false,
+            error: describeStorageFailure(storageSurfaceFailure(CaughtFailureSchema.parse(error))),
+            failure: valueFreeFailure(CaughtFailureSchema.parse(error))
+        };
+    }
+}
+//# sourceMappingURL=browse.js.map

package/dist/daemon/commands/browse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browse.js","sourceRoot":"","sources":["../../../src/daemon/commands/browse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAO5E,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAiC,MAAM,gCAAgC,CAAC;AAC1H,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAEhG,2CAA2C;AAC3C,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1C,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC/C,kEAAkE;AAClE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAE9D,8FAA8F;AAC9F,SAAS,aAAa,CAAC,OAA8B;IACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,KAAoC;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,QAA+B,EAC/B,IAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO;SACjC,KAAK,CAA2B,iBAAiB,CAAC;SAClD,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;SAC5G,gBAAgB,EAAE,CAAC;IAErB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAA8B,EAC9B,IAAwB;IAExB,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,yGAAyG;QACzG,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACtF,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC3D,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAA8B,EAC9B,IAAwB;IAExB,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,yGAAyG;QACzG,OAAO;YACN,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACtF,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC3D,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/daemon/commands/sync.d.ts

@@ -6,7 +6,7 @@
  * - sync.trigger -> Enqueues an immediate sync job
  * - sync.resolve -> Resolves a conflict (keep-local or keep-remote)
  */
-import type { RuntimeCommandDeps, RuntimeCommandPayload, RuntimeCommandResult } from '@vibesdotdev/runtime-plugin-types';
+import type { RuntimeCommandDeps, RuntimeCommandPayload, RuntimeCommandResult } from '@vibesdotdev/kernel/plugin-types';
 /**
  * Handle `sync.status` — returns current sync state for all manifests.
  */

package/dist/daemon/commands/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/daemon/commands/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,wBAAsB,gBAAgB,CACrC,QAAQ,EAAE,qBAAqB,EAC/B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAuC/B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAiE/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAkF/B"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/daemon/commands/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACX,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,MAAM,kCAAkC,CAAC;AAa1C;;GAEG;AACH,wBAAsB,gBAAgB,CACrC,QAAQ,EAAE,qBAAqB,EAC/B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAkC/B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAsE/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAwE/B"}

package/dist/daemon/commands/sync.js

@@ -6,28 +6,31 @@
  * - sync.trigger -> Enqueues an immediate sync job
  * - sync.resolve -> Resolves a conflict (keep-local or keep-remote)
  */
+import * as z from 'zod/v4';
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { cloudAdapterOf, cloudStoreFor, manifestDescriptorOf, syncFailureLine } from "../../sync/cloud-document.js";
+/** `sync.trigger` fields, each read on its own: the manifests to sync (default all) and whether to force (default true). */
+const TriggerManifestIdsSchema = z.array(z.string()).default([]);
+const TriggerForceSchema = z.boolean().default(true);
+/** `sync.resolve` fields: the manifest in conflict and which side wins. */
+const ResolveManifestIdSchema = z.string().min(1);
+const ResolutionSchema = z.enum(['keep-local', 'keep-remote']);
 /**
  * Handle `sync.status` — returns current sync state for all manifests.
  */
 export async function handleSyncStatus(_message, deps) {
-    const { loadSyncState } = await import('../../sync/sync-state.consumer.js');
-    const state = await loadSyncState();
-    // Also check if sync is enabled
-    let syncEnabled = false;
-    try {
-        const manifest = await deps.runtime
-            .query('config/manifest')
-            .filter((d) => d.id === 'ai.core')
-            .resolve();
-        if (manifest) {
-            const config = manifest;
-            const data = await config.load();
-            syncEnabled = data?.syncToCloud === true;
-        }
-    }
-    catch {
-        // Config not available
-    }
+    const { loadSyncState } = await import("../../sync/sync-state.consumer.js");
+    const state = await loadSyncState(deps.runtime);
+    // Cloud sync is declared by each owner manifest. Storage must never depend
+    // on an unrelated feature's config (the historical ai.core gate made every
+    // domain's sync policy an AI setting).
+    // Only an unregistered manifest kind means "no manifest sync targets"; any query failure surfaces.
+    const syncEnabled = deps.runtime.hasKind('storage/manifest') &&
+        deps.runtime
+            .query('storage/manifest')
+            .enabled()
+            .descriptors()
+            .some((descriptor) => descriptor.allowedAdapters.includes('storage.cloud-api'));
     return {
         success: true,
         syncEnabled,
@@ -51,8 +54,13 @@ export async function handleSyncStatus(_message, deps) {
  * Handle `sync.trigger` — enqueues an immediate storage-sync job.
  */
 export async function handleSyncTrigger(message, deps) {
-    const manifestIds = message.manifestIds ?? [];
-    const force = message.force ?? true;
+    const manifestIdsField = TriggerManifestIdsSchema.safeParse(message.manifestIds);
+    const forceField = TriggerForceSchema.safeParse(message.force);
+    if (!manifestIdsField.success || !forceField.success) {
+        return { success: false, error: 'Invalid sync.trigger fields: manifestIds must be a list of ids and force a boolean' };
+    }
+    const manifestIds = manifestIdsField.data;
+    const force = forceField.data;
     // Broadcast that sync was triggered
     deps.subscriptionManager.broadcast?.('activity', {
         type: 'sync-triggered',
@@ -61,10 +69,10 @@ export async function handleSyncTrigger(message, deps) {
         timestamp: new Date().toISOString()
     });
     // Run pull + push inline (for RPC response)
-    const { pullFromCloud } = await import('../../sync/cloud-pull.js');
-    const pullResult = await pullFromCloud({ manifestIds, force });
-    const { SyncBridge } = await import('../../sync/sync-bridge.js');
-    const { resolveSyncTarget } = await import('../../sync/resolve-sync-target.js');
+    const { pullFromCloud } = await import("../../sync/cloud-pull.js");
+    const pullResult = await pullFromCloud(deps.runtime, { manifestIds, force });
+    const { SyncBridge } = await import("../../sync/sync-bridge.js");
+    const { resolveSyncTarget } = await import("../../sync/resolve-sync-target.js");
     const bridgeDescriptors = deps.runtime
         .query('storage/sync-bridge')
         .enabled()
@@ -74,10 +82,10 @@ export async function handleSyncTrigger(message, deps) {
         : bridgeDescriptors;
     const bridgeResults = [];
     if (bridgeTargets.length > 0) {
-        const { syncTarget, apiToken } = await resolveSyncTarget();
+        const { syncTarget, apiToken } = await resolveSyncTarget(deps.runtime);
         if (syncTarget && syncTarget !== 'unknown') {
             for (const descriptor of bridgeTargets) {
-                const bridge = new SyncBridge(descriptor);
+                const bridge = new SyncBridge(descriptor, { runtime: deps.runtime });
                 const result = await bridge.execute(syncTarget, { direction: 'both', dryRun: false, force }, apiToken);
                 bridgeResults.push({
                     bridgeId: result.bridgeId,
@@ -103,42 +111,42 @@ export async function handleSyncTrigger(message, deps) {
  * Accepts { manifestId, resolution: 'keep-local' | 'keep-remote' }
  */
 export async function handleSyncResolve(message, deps) {
-    const manifestId = message.manifestId;
-    const resolution = message.resolution;
-    if (!manifestId || !resolution) {
+    const manifestIdField = ResolveManifestIdSchema.safeParse(message.manifestId);
+    const resolutionField = ResolutionSchema.safeParse(message.resolution);
+    if (!manifestIdField.success || !resolutionField.success) {
         return { success: false, error: 'Missing manifestId or resolution' };
     }
-    const { loadSyncState, saveSyncState, getManifestSyncState, markSynced, computeHash } = await import('../../sync/sync-state.consumer.js');
-    const syncState = await loadSyncState();
+    const manifestId = manifestIdField.data;
+    const resolution = resolutionField.data;
+    const { loadSyncState, saveSyncState, getManifestSyncState, markSynced, computeHash } = await import("../../sync/sync-state.consumer.js");
+    const syncState = await loadSyncState(deps.runtime);
     const manifestState = getManifestSyncState(syncState, manifestId);
     if (manifestState.syncStatus !== 'conflict') {
         return { success: false, error: `Manifest ${manifestId} is not in conflict state` };
     }
     if (resolution === 'keep-local') {
         // Push local to cloud
-        const { StorageManifest } = await import('../../manifest/base.js');
-        const localManifest = new StorageManifest(manifestId);
+        const { StorageManifest } = await import("../../manifest/base.js");
+        const localManifest = StorageManifest.fromId(manifestId, deps.runtime);
         const localData = await localManifest.load();
         if (localData) {
             try {
-                const cloudAdapter = await deps.runtime
-                    .query('storage/adapter')
-                    .filter((d) => d.id === 'storage.cloud-api')
-                    .resolve();
-                if (cloudAdapter) {
-                    const descriptor = deps.runtime
-                        .query('storage/manifest')
-                        .filter((d) => d.id === manifestId)
-                        .firstDescriptor();
-                    const adapter = cloudAdapter;
-                    const cloudConfig = descriptor?.config?.['storage.cloud-api'] ?? {};
-                    adapter.configure(cloudConfig);
-                    const store = adapter.documentStore(descriptor.namespace, descriptor.schema);
+                const cloudAdapter = await cloudAdapterOf(deps.runtime);
+                const descriptor = manifestDescriptorOf(deps.runtime, manifestId);
+                if (cloudAdapter && descriptor) {
+                    // The same cloud configuration the pull uses: the manifest's declared
+                    // `adapterConfig['storage.cloud-api']`, resolved on the handed runtime.
+                    const store = await cloudStoreFor(cloudAdapter, descriptor, deps.runtime);
                     await store.save(localData);
                 }
             }
-            catch {
-                return { success: false, error: 'Failed to push local data to cloud' };
+            catch (error) {
+                // The push failure is carried (its value-free facts), never dropped or echoed.
+                return {
+                    success: false,
+                    error: syncFailureLine('Failed to push local data to cloud:', valueFreeFailure(CaughtFailureSchema.parse(error))),
+                    failure: valueFreeFailure(CaughtFailureSchema.parse(error))
+                };
             }
         }
         const hash = localData ? computeHash(localData) : '';
@@ -146,13 +154,13 @@ export async function handleSyncResolve(message, deps) {
     }
     else {
         // Pull remote to local
-        const { pullFromCloud } = await import('../../sync/cloud-pull.js');
-        await pullFromCloud({ manifestIds: [manifestId], force: true });
+        const { pullFromCloud } = await import("../../sync/cloud-pull.js");
+        await pullFromCloud(deps.runtime, { manifestIds: [manifestId], force: true });
         // pullFromCloud updates syncState internally, but we need fresh state
-        const freshState = await loadSyncState();
+        const freshState = await loadSyncState(deps.runtime);
         Object.assign(syncState, freshState);
     }
-    await saveSyncState(syncState);
+    await saveSyncState(syncState, deps.runtime);
     deps.subscriptionManager.broadcast?.('activity', {
         type: 'sync-conflict-resolved',
         manifestId,