@warble/claude-agent-sdk 0.11.0 → 0.13.0

package/dist/{chunk-3ON7TSGW.js → chunk-2VDMVARW.js}

@@ -254,6 +254,11 @@ interface EmittedMeta {
 }`;
 function emitAgentModule(prepared, opts = {}) {
   const standalone = opts.standalone ?? false;
+  if (prepared.dependencies.length > 0) {
+    throw new DispatchError(
+      "emit does not support component_invocation (wall-hit): a generated single-plan run() cannot carry the immutable prepared-callee registry, trusted active-step alias binding, or root budget ledger. Use the Agent SDK dispatch() runtime for composed entries."
+    );
+  }
   const header = [
     "// Generated by `warble-agent-sdk emit` \u2014 do not edit by hand.",
     `// Target: ${prepared.target}. Regenerate from the IR instead of editing.`,
@@ -294,6 +299,118 @@ function emitAgentModule(prepared, opts = {}) {
   ].join("\n");
 }
 
+// src/closure.ts
+function freezeArray(values) {
+  return Object.freeze(values);
+}
+function componentDependencies(ir) {
+  const dependencies = [];
+  for (const node of ir.components) {
+    const declaresCalls = node.llm_calls.some((step) => step.component_calls.length > 0);
+    if (declaresCalls && !node.required_capabilities.includes("component_invocation")) {
+      throw new DispatchError(
+        `invalid IR: component '${node.id}' declares component calls but does not require component_invocation, so the target capability wall could be bypassed`
+      );
+    }
+    for (const step of node.llm_calls) {
+      const aliases = /* @__PURE__ */ new Set();
+      for (const call of step.component_calls) {
+        if (aliases.has(call.alias)) {
+          throw new DispatchError(
+            `invalid IR: duplicate component call alias '${call.alias}' on '${node.id}.${step.name}'`
+          );
+        }
+        aliases.add(call.alias);
+        dependencies.push(
+          Object.freeze({ caller: node.id, step: step.name, alias: call.alias, component: call.component })
+        );
+      }
+    }
+  }
+  return freezeArray(dependencies);
+}
+function resolveComponentClosure(ir, requestedRoots) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const node of ir.components) {
+    if (byId.has(node.id)) {
+      throw new DispatchError(`invalid IR: duplicate mounted component id '${node.id}'`);
+    }
+    byId.set(node.id, node);
+  }
+  const roots = requestedRoots ?? ir.components.filter((node) => node.entrypoint).map((node) => node.id);
+  const rootNodes = roots.map((id) => {
+    const node = byId.get(id);
+    if (!node) {
+      throw new DispatchError(
+        `component '${id}' not found in IR (available: ${ir.components.map((candidate) => candidate.id).join(", ")})`
+      );
+    }
+    if (!node.entrypoint) {
+      throw new DispatchError(
+        `component '${id}' is entrypoint:false and cannot be selected as a root entry`
+      );
+    }
+    return node;
+  });
+  const dependencies = componentDependencies(ir);
+  const outgoing = /* @__PURE__ */ new Map();
+  for (const node of ir.components) {
+    outgoing.set(
+      node.id,
+      dependencies.filter((dependency) => dependency.caller === node.id)
+    );
+  }
+  const entries = [];
+  const union = /* @__PURE__ */ new Set();
+  for (const root of rootNodes) {
+    const visited = /* @__PURE__ */ new Set();
+    const active = [];
+    const walk = (id) => {
+      if (active.includes(id)) {
+        const start = active.indexOf(id);
+        throw new DispatchError(
+          `invalid IR: component call cycle detected: ${[...active.slice(start), id].join(" -> ")}`
+        );
+      }
+      if (visited.has(id)) return;
+      const node = byId.get(id);
+      if (!node) {
+        const edge = dependencies.find((dependency) => dependency.component === id);
+        throw new DispatchError(
+          `invalid IR: component '${edge?.caller ?? root.id}' step '${edge?.step ?? "?"}' alias '${edge?.alias ?? "?"}' references missing mounted component '${id}'`
+        );
+      }
+      active.push(id);
+      visited.add(id);
+      union.add(id);
+      for (const edge of outgoing.get(id) ?? []) {
+        if (edge.component === id) {
+          throw new DispatchError(
+            `invalid IR: component '${id}' step '${edge.step}' alias '${edge.alias}' cannot call itself`
+          );
+        }
+        walk(edge.component);
+      }
+      active.pop();
+    };
+    walk(root.id);
+    entries.push(Object.freeze({ root: root.id, components: freezeArray([...visited]) }));
+  }
+  const components = ir.components.filter((node) => union.has(node.id));
+  const scopedDependencies = dependencies.filter(
+    (dependency) => union.has(dependency.caller) && union.has(dependency.component)
+  );
+  const calleeIds = new Set(scopedDependencies.map((dependency) => dependency.component));
+  const callees = components.filter((node) => calleeIds.has(node.id));
+  return Object.freeze({
+    roots: freezeArray([...rootNodes]),
+    callees: freezeArray(callees),
+    components: freezeArray(components),
+    entries: freezeArray(entries),
+    dependencies: freezeArray([...scopedDependencies])
+  });
+}
+
 // src/ir.ts
 var REALIZATION_KINDS = ["skill", "tool", "gated-tool"];
 var COMPONENT_TYPES = [
@@ -305,7 +422,7 @@ var COMPONENT_TYPES = [
 ];
 var TRIGGER_KINDS = ["one_shot", "scheduled", "event"];
 var OUTCOME_KINDS = ["none", "assertion", "mutation", "dispatch"];
-var SUPPORTED_IR_VERSIONS = ["0.7"];
+var SUPPORTED_IR_VERSIONS = ["0.8"];
 function assertSupportedIrVersion(version) {
   if (!SUPPORTED_IR_VERSIONS.includes(version)) {
     throw new DispatchError(
@@ -313,6 +430,53 @@ function assertSupportedIrVersion(version) {
     );
   }
 }
+function parseIrInput(input) {
+  if (typeof input === "string") return parseIr(input);
+  let raw;
+  try {
+    raw = JSON.stringify(input);
+  } catch (error) {
+    throw new DispatchError(`invalid IR object: ${String(error)}`);
+  }
+  if (raw === void 0) throw new DispatchError("invalid IR object: value is not serializable");
+  return parseIr(raw);
+}
+function assertComponentCompositionNodeFields(node) {
+  if (typeof node.entrypoint !== "boolean") {
+    fail(`component '${node.id}'.entrypoint must be a boolean`);
+  }
+  for (const call of node.llm_calls) {
+    if (!Array.isArray(call.component_calls)) {
+      fail(`component '${node.id}' step '${call.name}'.component_calls must be an array`);
+    }
+    for (const [index, componentCall] of call.component_calls.entries()) {
+      if (!isObject(componentCall) || typeof componentCall["alias"] !== "string" || typeof componentCall["component"] !== "string") {
+        fail(
+          `component '${node.id}' step '${call.name}'.component_calls[${index}] must contain string alias/component`
+        );
+      }
+    }
+  }
+}
+function assertComponentCompositionFields(ir) {
+  for (const node of ir.components) assertComponentCompositionNodeFields(node);
+}
+function assertNoComponentCompositionNode(node) {
+  assertComponentCompositionNodeFields(node);
+  if (!node.entrypoint) {
+    throw new DispatchError(
+      `component '${node.id}' is entrypoint:false, but this target cannot prepare callee-only mounts yet (component composition wall-hit)`
+    );
+  }
+  for (const call of node.llm_calls) {
+    const componentCall = call.component_calls[0];
+    if (componentCall) {
+      throw new DispatchError(
+        `step '${call.name}' on component '${node.id}' authorizes component call alias '${componentCall.alias}' to '${componentCall.component}', but this target cannot realize component invocation yet (wall-hit)`
+      );
+    }
+  }
+}
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -328,6 +492,11 @@ function requireString(obj, key, at) {
   if (typeof value !== "string") fail(`${at}.${key} must be a string`);
   return value;
 }
+function requireNumber(obj, key, at) {
+  const value = obj[key];
+  if (typeof value !== "number") fail(`${at}.${key} must be a number`);
+  return value;
+}
 function requireBool(obj, key, at) {
   const value = obj[key];
   if (typeof value !== "boolean") fail(`${at}.${key} must be a boolean`);
@@ -413,7 +582,17 @@ function parseLlmCall(value, at) {
     produces: optString(obj, "produces"),
     prompt: requireString(obj, "prompt", at),
     conditional: boolWithDefault(obj, "conditional", at),
-    when: whenRaw === void 0 || whenRaw === null ? null : parseWhenGuard(whenRaw, `${at}.when`)
+    when: whenRaw === void 0 || whenRaw === null ? null : parseWhenGuard(whenRaw, `${at}.when`),
+    component_calls: obj["component_calls"] === void 0 ? [] : requireArray(obj, "component_calls", at).map(
+      (call, index) => parseComponentCall(call, `${at}.component_calls[${index}]`)
+    )
+  };
+}
+function parseComponentCall(value, at) {
+  const obj = requireObject(value, at);
+  return {
+    alias: requireString(obj, "alias", at),
+    component: requireString(obj, "component", at)
   };
 }
 function parseGuardrail(value, at) {
@@ -495,6 +674,7 @@ function parseComponent(value, at) {
   const trigger = requireObject(obj["trigger"], `${at}.trigger`);
   return {
     id: requireString(obj, "id", at),
+    entrypoint: requireBool(obj, "entrypoint", at),
     verb: requireString(obj, "verb", at),
     type: requireEnum(obj, "type", at, COMPONENT_TYPES),
     realization_kind: requireEnum(obj, "realization_kind", at, REALIZATION_KINDS),
@@ -519,7 +699,46 @@ function parseComponent(value, at) {
     context_precondition: preconditionArray(obj, "context_precondition", at),
     params: paramArray(obj, "params", at),
     eval: obj["eval"] === void 0 || obj["eval"] === null ? null : parseEvalSpec(obj["eval"], `${at}.eval`),
-    brief: optStringU(obj, "brief")
+    brief: optStringU(obj, "brief"),
+    ...slotsField(obj, at),
+    ...assetsField(obj, at)
+  };
+}
+function assetsField(obj, at) {
+  if (obj["assets"] === void 0) return {};
+  const assets = requireArray(obj, "assets", at).map((value, i) => {
+    const entry2 = requireObject(value, `${at}.assets[${i}]`);
+    return {
+      path: requireString(entry2, "path", `${at}.assets[${i}]`),
+      hash: requireString(entry2, "hash", `${at}.assets[${i}]`),
+      bytes: requireNumber(entry2, "bytes", `${at}.assets[${i}]`)
+    };
+  });
+  return { assets };
+}
+function slotsField(obj, at) {
+  if (obj["slots"] === void 0) return {};
+  const slots = requireArray(obj, "slots", at).map((v, i) => parseSlot(v, `${at}.slots[${i}]`));
+  return { slots };
+}
+function parseSlot(value, at) {
+  const obj = requireObject(value, at);
+  const variantsRaw = requireObject(obj["variants"], `${at}.variants`);
+  const variants = {};
+  for (const [key, text] of Object.entries(variantsRaw)) {
+    if (typeof text !== "string") fail(`${at}.variants.${key} must be a string`);
+    variants[key] = text;
+  }
+  const name = requireString(obj, "name", at);
+  const dflt = requireString(obj, "default", at);
+  if (!(dflt in variants)) {
+    fail(`${at}.default is '${dflt}', which is not one of its variants (${Object.keys(variants).join(", ")})`);
+  }
+  return {
+    name,
+    default: dflt,
+    variants,
+    ...obj["present_when"] === void 0 ? {} : { present_when: obj["present_when"] }
   };
 }
 function parseIr(json2) {
@@ -544,7 +763,8 @@ function parseIr(json2) {
     config,
     components: requireArray(obj, "components", "<root>").map(
       (c, i) => parseComponent(c, `components[${i}]`)
-    )
+    ),
+    ...slotsField(obj, "<root>")
   };
 }
 function distinctTiers(calls) {
@@ -559,6 +779,124 @@ function distinctTiers(calls) {
   return out;
 }
 
+// src/slots.ts
+var SLOT_NAME = /^[a-z_][a-z0-9_]*$/;
+function slotReferences(raw) {
+  const found = [];
+  let cursor = 0;
+  for (; ; ) {
+    const open = raw.indexOf("{{", cursor);
+    if (open === -1) return found;
+    const bodyStart = open + 2;
+    const close = raw.indexOf("}}", bodyStart);
+    if (close === -1) return found;
+    const body = raw.slice(bodyStart, close).trim();
+    if (body.startsWith("slot.")) {
+      const name = body.slice("slot.".length);
+      if (SLOT_NAME.test(name)) found.push({ start: open, end: close + 2, name });
+    }
+    cursor = close + 2;
+  }
+}
+function resolveSlots(decls, supply, scope, unanswered = "fail") {
+  const byName = new Map(decls.map((d) => [d.name, d]));
+  const resolved = /* @__PURE__ */ new Map();
+  const visiting = /* @__PURE__ */ new Set();
+  const resolve4 = (name) => {
+    if (resolved.has(name)) return resolved.get(name);
+    if (visiting.has(name)) {
+      throw new DispatchError(
+        `slot '${name}' in ${scope} is defined in terms of itself: a variant's text references a slot whose own variant references it back (chain: ${[...visiting, name].join(" -> ")}).`
+      );
+    }
+    const decl = byName.get(name);
+    const choice = supply[name];
+    if (choice === null) {
+      resolved.set(name, null);
+      return null;
+    }
+    if (choice === void 0) {
+      if (decl.present_when !== void 0 && unanswered === "fail") {
+        throw new DispatchError(
+          `slot '${name}' in ${scope} declares a present_when condition, and nothing answered it. Supply the slot as a variant name to include it, or as null to remove it; falling back to the default would ship wording for something that may not be there.`
+        );
+      }
+    }
+    const key = choice ?? decl.default;
+    const text = decl.variants[key];
+    if (text === void 0) {
+      throw new DispatchError(
+        `slot '${name}' in ${scope} was given variant '${key}', which it does not declare (declared: ${Object.keys(decl.variants).join(", ")}).`
+      );
+    }
+    visiting.add(name);
+    const expanded = substitute(text, resolve4, byName, scope);
+    visiting.delete(name);
+    resolved.set(name, expanded);
+    return expanded;
+  };
+  for (const decl of decls) resolve4(decl.name);
+  return resolved;
+}
+function substitute(raw, resolve4, byName, scope) {
+  const refs = slotReferences(raw);
+  if (refs.length === 0) return raw;
+  let out = "";
+  let cursor = 0;
+  for (const ref of refs) {
+    if (!byName.has(ref.name)) {
+      throw new DispatchError(
+        `prompt text in ${scope} references slot '${ref.name}', which is neither one of the component's slots nor one of the profile's.`
+      );
+    }
+    out += raw.slice(cursor, ref.start) + (resolve4(ref.name) ?? "");
+    cursor = ref.end;
+  }
+  return out + raw.slice(cursor);
+}
+function applySlots(raw, resolved, scope) {
+  const refs = slotReferences(raw);
+  if (refs.length === 0) return raw;
+  let out = "";
+  let cursor = 0;
+  for (const ref of refs) {
+    if (!resolved.has(ref.name)) {
+      throw new DispatchError(
+        `prompt text in ${scope} references slot '${ref.name}', which is not declared there.`
+      );
+    }
+    out += raw.slice(cursor, ref.start) + (resolved.get(ref.name) ?? "");
+    cursor = ref.end;
+  }
+  return out + raw.slice(cursor);
+}
+function assertNoSlotReferences(raw, owner) {
+  const refs = slotReferences(raw);
+  if (refs.length > 0) {
+    const names = [...new Set(refs.map((r) => r.name))].join(", ");
+    throw new DispatchError(
+      `${owner} still contains unresolved slot reference(s) (${names}) at dispatch. Prompt text must go through slot resolution before it is sent; shipping the placeholder would put literal '{{ slot.\u2026 }}' in front of the model.`
+    );
+  }
+}
+function parseSlotFlags(flags) {
+  const supply = {};
+  for (const flag of flags) {
+    const at = flag.indexOf("=");
+    if (at === -1) {
+      throw new DispatchError(
+        `--slot '${flag}' must be NAME=VARIANT, or NAME= to remove a conditional slot`
+      );
+    }
+    const name = flag.slice(0, at);
+    const variant = flag.slice(at + 1);
+    if (name === "") throw new DispatchError(`--slot '${flag}' has an empty slot name`);
+    if (name in supply) throw new DispatchError(`--slot ${name} was given more than once`);
+    supply[name] = variant === "" ? null : variant;
+  }
+  return supply;
+}
+
 // src/models.ts
 import { parse as parseYaml } from "yaml";
 var STRONG_TIER = "strong";
@@ -766,14 +1104,14 @@ function planProviderRouting(node, models, anthropicSplit) {
   }
   return { mode, steps, providers };
 }
-function buildStepMessages(step, question, slots) {
+function buildStepMessages(step, question, artifacts) {
   const parts = [`Question: ${question}`];
-  for (const slot of step.consumes) {
-    const value = slots[slot];
+  for (const artifact of step.consumes) {
+    const value = artifacts[artifact];
     parts.push(
       value === void 0 ? `
-[input '${slot}' was not produced by an earlier step]` : `
-Input '${slot}':
+[input '${artifact}' was not produced by an earlier step]` : `
+Input '${artifact}':
 ${value}`
     );
   }
@@ -797,6 +1135,13 @@ function entry(outcome, via, provided_by, criticality, note) {
 }
 function localProfile() {
   return {
+    component_invocation: entry(
+      "native",
+      "isolated-child-query",
+      "runtime",
+      "required",
+      null
+    ),
     "sql_execution:read_only": entry("native", "bash-wren", "runtime", "required", null),
     genbi_build: entry("native", "bash-wren", "runtime", "required", null),
     // Reading the semantic model's structure (models/metrics/lineage) is borrowed from the `wren`
@@ -1193,9 +1538,9 @@ function buildDriverBody(node) {
       `Run the \`${subagentName(node.verb, call.name)}\` subagent (step \`${call.name}\`) via the Task tool.`
     ];
     if (call.consumes.length > 0) {
-      const sources = call.consumes.map((slot) => {
-        const producer = producers.get(slot);
-        return producer ? `\`${slot}\` (the \`${producer}\` subagent's output)` : `\`${slot}\``;
+      const sources = call.consumes.map((artifact) => {
+        const producer = producers.get(artifact);
+        return producer ? `\`${artifact}\` (the \`${producer}\` subagent's output)` : `\`${artifact}\``;
       }).join(", ");
       parts.push(`Pass it ${sources} as input.`);
     }
@@ -1239,6 +1584,29 @@ function tierCollapseNote(node, model) {
   return `per-step tiers [${steps}] collapsed to single model '${model}'`;
 }
 function buildDispatchPlan(node, report, cfg) {
+  assertNoComponentCompositionNode(node);
+  const plan = buildDispatchPlanUnchecked(node, report, cfg);
+  assertPlanHasNoSlotReferences(plan, node.id);
+  return plan;
+}
+function buildPreparedNodePlan(node, report, cfg) {
+  const plan = buildDispatchPlanUnchecked(node, report, cfg);
+  assertPlanHasNoSlotReferences(plan, node.id);
+  return plan;
+}
+function assertPlanHasNoSlotReferences(plan, componentId) {
+  const system = plan.options.systemPrompt;
+  if (typeof system === "string") {
+    assertNoSlotReferences(system, `the system prompt of component '${componentId}'`);
+  }
+  for (const [name, agent] of Object.entries(plan.options.agents ?? {})) {
+    assertNoSlotReferences(agent.prompt, `subagent '${name}' of component '${componentId}'`);
+  }
+  for (const step of plan.meta.stagedSteps) {
+    assertNoSlotReferences(step.prompt, `staged step '${step.name}' of component '${componentId}'`);
+  }
+}
+function buildDispatchPlanUnchecked(node, report, cfg) {
   if (!realizationSupported(node)) {
     throw unsupported("realization_kind", node.realization_kind);
   }
@@ -1329,7 +1697,8 @@ function buildDispatchPlan(node, report, cfg) {
         mode: "sdk-split",
         providers: ["anthropic"],
         stagedSteps: [],
-        setupScope
+        setupScope,
+        componentInvocation: node.llm_calls.some((step) => step.component_calls.length > 0)
       }
     };
   }
@@ -1369,7 +1738,8 @@ function buildDispatchPlan(node, report, cfg) {
       mode: "single",
       providers: ["anthropic"],
       stagedSteps: [],
-      setupScope
+      setupScope,
+      componentInvocation: node.llm_calls.some((step) => step.component_calls.length > 0)
     }
   };
 }
@@ -1421,7 +1791,8 @@ function buildHybridStagedPlan(node, gate, cfg, base, readOnly, providers, steps
       // Hybrid+setup is out of scope (locked decision): a setup component's steps are not staged
       // across providers, so this path never sees setup_execution in practice; null is the safe,
       // explicit default rather than silently inheriting a scope this path doesn't enforce.
-      setupScope: null
+      setupScope: null,
+      componentInvocation: node.llm_calls.some((step) => step.component_calls.length > 0)
     }
   };
 }
@@ -1488,6 +1859,7 @@ function inspectCapabilities(node, targetId, profile) {
       provided_by: e.provided_by,
       criticality: e.criticality
     };
+    if (e.via !== null) resolved.via = e.via;
     if (e.note !== null) resolved.note = e.note;
     return resolved;
   });
@@ -1524,11 +1896,147 @@ function inspectNodeCapabilities(node, targetId) {
   return inspectCapabilities(node, targetId, localProfile());
 }
 
+// src/assets.ts
+import { createHash } from "crypto";
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { dirname, isAbsolute, join, parse, resolve, sep } from "path";
+function assetDirForIr(irPath) {
+  const { dir, name } = parse(resolve(irPath));
+  return join(dir, `${name}.assets`);
+}
+function prepareAssetLanding(ir, irPath, cwd) {
+  const sourceRoot = assetDirForIr(irPath);
+  const pending = [];
+  for (const node of ir.components) {
+    for (const asset of node.assets ?? []) {
+      assertContainedRelativePath(asset.path, node.id);
+      const source = join(sourceRoot, node.id, asset.path);
+      try {
+        lstatSync(source);
+      } catch (e) {
+        throw new DispatchError(
+          `asset '${asset.path}' of component '${node.id}' is declared in the IR but missing from ${sourceRoot} (${e.message}). An IR's assets travel in that directory; copying the IR without it leaves a component without the files it declared.`
+        );
+      }
+      assertResolvesInside(sourceRoot, source, "asset source");
+      if (!statSync(source).isFile()) {
+        throw new DispatchError(
+          `asset '${asset.path}' of component '${node.id}' is not a regular file. Reading a pipe or device would block the dispatch indefinitely instead of failing, so anything that is not a plain file is refused.`
+        );
+      }
+      const data = readFileSync(source);
+      const actual = `sha256:${createHash("sha256").update(data).digest("hex")}`;
+      if (actual !== asset.hash) {
+        throw new DispatchError(
+          `asset '${asset.path}' of component '${node.id}' does not match its manifest (expected ${asset.hash}, found ${actual}). The file changed after the IR was compiled; recompile rather than dispatching content the manifest does not name.`
+        );
+      }
+      const target = join(cwd, asset.path);
+      assertResolvesInside(cwd, target, "asset target");
+      pending.push({ target, data });
+    }
+  }
+  return pending;
+}
+function validateAssets(ir, irPath, cwd) {
+  prepareAssetLanding(ir, irPath, cwd);
+}
+function landAssets(ir, irPath, cwd) {
+  const pending = prepareAssetLanding(ir, irPath, cwd);
+  for (const { target, data } of pending) {
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, data);
+  }
+  return pending.map(({ target }) => target);
+}
+function assertContainedRelativePath(relative, componentId) {
+  const climbs = relative.split(/[\\/]/).includes("..");
+  if (isAbsolute(relative) || climbs || relative.startsWith(sep)) {
+    throw new DispatchError(
+      `asset path '${relative}' of component '${componentId}' must be a relative path with no '..' segments. A manifest naming a path outside the directory it lands in would be an arbitrary file write, so it is refused rather than resolved.`
+    );
+  }
+}
+function assertResolvesInside(root, target, what) {
+  const canonicalRoot = realpathSync(root);
+  let existing = resolve(target);
+  while (!existsSync(existing)) {
+    const parent = dirname(existing);
+    if (parent === existing) {
+      throw new DispatchError(`${what} '${target}' has no resolvable ancestor`);
+    }
+    existing = parent;
+  }
+  const anchor = realpathSync(existing);
+  const contained = anchor === canonicalRoot || anchor.startsWith(canonicalRoot + sep);
+  if (!contained) {
+    throw new DispatchError(
+      `${what} '${target}' resolves outside ${canonicalRoot} once symlinks are followed. A path that looks contained but is not is refused rather than followed, because the manifest is data and the filesystem is what decides where a write actually lands.`
+    );
+  }
+}
+
+// src/fingerprint.ts
+import { createHash as createHash2 } from "crypto";
+var ALGORITHM = "sha256";
+function sha256(text) {
+  return createHash2(ALGORITHM).update(text, "utf8").digest("hex");
+}
+function fingerprintSurfaces(surfaces) {
+  const perSurface = {};
+  const parts = [];
+  for (const name of Object.keys(surfaces).sort()) {
+    const text = surfaces[name];
+    perSurface[name] = sha256(text);
+    parts.push(`${name.length}:${name} ${text.length}:${text}`);
+  }
+  return { algorithm: ALGORITHM, digest: sha256(parts.join(" ")), surfaces: perSurface };
+}
+function promptSurfacesOf(options) {
+  const surfaces = {};
+  const system = options.systemPrompt;
+  if (typeof system === "string") surfaces["driver.systemPrompt"] = system;
+  for (const [name, agent] of Object.entries(options.agents ?? {})) {
+    surfaces[`subagent.${name}`] = agent.prompt;
+  }
+  return surfaces;
+}
+function promptSurfacesOfMessages(messages) {
+  return Object.fromEntries(
+    messages.map((message, index) => [`local.${index}.${message.role}`, message.content])
+  );
+}
+function promptSurfaces(plan) {
+  return promptSurfacesOf(plan.options);
+}
+function fingerprintPrompts(plan) {
+  return fingerprintSurfaces(promptSurfaces(plan));
+}
+
 // src/guardrails.ts
 import { resolve as resolvePath, sep as pathSep } from "path";
 function withinScope(abs, scopeAbs) {
   return abs === scopeAbs || abs.startsWith(scopeAbs.endsWith(pathSep) ? scopeAbs : scopeAbs + pathSep);
 }
+function composeCanUseTool(embedder, floor) {
+  if (embedder === void 0) return floor;
+  return async (toolName, input, options) => {
+    const fromEmbedder = await embedder(toolName, input, options);
+    if (fromEmbedder.behavior !== "allow") return fromEmbedder;
+    return floor(toolName, fromEmbedder.updatedInput, options);
+  };
+}
+function composeHooks(embedder, guardHooks) {
+  return { ...embedder, PreToolUse: [...embedder?.PreToolUse ?? [], ...guardHooks] };
+}
 var DESTRUCTIVE = /\b(rm|sudo|dd|mkfs|shutdown|reboot|kill|chmod|chown|mv|cp)\b/;
 var REDIRECTION = /(^|[^>])>>?[^>]/;
 var DOTENV_READER_COMMANDS = /\b(cat|head|tail|less|more|od|xxd|strings|grep|awk|sed)\b/;
@@ -1693,8 +2201,8 @@ async function callOpenAiCompat(opts) {
 }
 
 // src/hybridTool.ts
-import { existsSync, mkdirSync, writeFileSync } from "fs";
-import { join } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2 } from "path";
 import { query, tool, createSdkMcpServer } from "@anthropic-ai/claude-agent-sdk";
 import { z } from "zod";
 function isResult(msg) {
@@ -1728,9 +2236,9 @@ function buildToolDriverPrompt(steps) {
   const lines = steps.map((s, i) => {
     const parts = [`${i + 1}. Call the \`dispatch_step\` tool with step="${s.name}".`];
     if (s.consumes.length > 0) {
-      const srcs = s.consumes.map((slot) => {
-        const p = producers.get(slot);
-        return p ? `the text step "${p}" returned` : `"${slot}"`;
+      const srcs = s.consumes.map((artifact) => {
+        const p = producers.get(artifact);
+        return p ? `the text step "${p}" returned` : `"${artifact}"`;
       }).join(", ");
       parts.push(`Pass ${srcs} as the tool's \`inputs\` argument.`);
     }
@@ -1748,6 +2256,9 @@ function buildToolDriverPrompt(steps) {
     "Marshal each step's returned text into the next step's `inputs` exactly as noted above. Your FINAL message MUST be the last executed step's returned text verbatim \u2014 do not summarize it or add commentary."
   ].join("\n");
 }
+var MCP_SERVER_NAME = "warble";
+var DISPATCH_STEP_NAME = "dispatch_step";
+var DISPATCH_STEP_TOOL = `mcp__${MCP_SERVER_NAME}__${DISPATCH_STEP_NAME}`;
 async function runCloudStep(step, question, inputsText, ctx) {
   const options = {
     cwd: ctx.cwd,
@@ -1763,15 +2274,16 @@ ${step.prompt}`,
     canUseTool: ctx.canUseTool,
     // Read never reaches `canUseTool` for an in-cwd path in the real SDK (see guardrails.ts); this
     // hook is the live enforcement point for the +Setup dotenv-read gap's Read side.
-    hooks: { PreToolUse: ctx.hooks },
+    hooks: ctx.hooks,
     env: ctx.env
   };
+  ctx.cfg.onPromptFingerprint?.(fingerprintSurfaces(promptSurfacesOf(options)));
   const msgs = [];
   for await (const m of query({ prompt: stepUserPrompt(question, inputsText), options })) msgs.push(m);
   return requireFinalText(msgs.find(isResult));
 }
 async function runHybridTool(plan, cfg) {
-  mkdirSync(cfg.outDir, { recursive: true });
+  mkdirSync2(cfg.outDir, { recursive: true });
   const cwd = plan.options.cwd ?? process.cwd();
   const { canUseTool, denials, hooks } = makeReadOnlyGuard({
     readOnly: plan.meta.readOnly,
@@ -1779,15 +2291,18 @@ async function runHybridTool(plan, cfg) {
     cwd,
     setupScope: plan.meta.setupScope
   });
-  const venvBin = join(cwd, ".venv", "bin");
-  const pathEnv = existsSync(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
+  const venvBin = join2(cwd, ".venv", "bin");
+  const pathEnv = existsSync2(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
   const env = { ...process.env, PATH: pathEnv };
+  const stepCanUseTool = composeCanUseTool(plan.options.canUseTool, canUseTool);
+  const stepHooks = composeHooks(plan.options.hooks, hooks);
+  const driverCanUseTool = async (toolName, input, options) => toolName === DISPATCH_STEP_TOOL ? { behavior: "allow", updatedInput: input } : stepCanUseTool(toolName, input, options);
   const steps = plan.meta.stagedSteps;
   const question = plan.prompt;
   const maxTurns = plan.options.maxTurns ?? 40;
   const traceSteps = [];
   const dispatchStep = tool(
-    "dispatch_step",
+    DISPATCH_STEP_NAME,
     "Execute one named step of the task on its own configured model and return its text output.",
     { step: z.string(), inputs: z.string().optional() },
     async (args) => {
@@ -1799,18 +2314,20 @@ async function runHybridTool(plan, cfg) {
       let text;
       if (step.provider === "openai_compat") {
         if (!step.endpoint) throw new DispatchError(`local step '${step.name}' has no endpoint`);
+        const localMessages = [
+          { role: "system", content: step.prompt },
+          { role: "user", content: stepUserPrompt(question, inputsText) }
+        ];
+        cfg.onPromptFingerprint?.(fingerprintSurfaces(promptSurfacesOfMessages(localMessages)));
         text = await callOpenAiCompat({
           endpoint: step.endpoint,
           model: step.model,
-          messages: [
-            { role: "system", content: step.prompt },
-            { role: "user", content: stepUserPrompt(question, inputsText) }
-          ]
+          messages: localMessages
         });
         process.stderr.write(`warble hybrid-tool: step '${step.name}' \u2192 local ${step.model}
 `);
       } else {
-        text = await runCloudStep(step, question, inputsText, { cwd, env, maxTurns, canUseTool, hooks });
+        text = await runCloudStep(step, question, inputsText, { cfg, cwd, env, maxTurns, canUseTool: stepCanUseTool, hooks: stepHooks });
         process.stderr.write(`warble hybrid-tool: step '${step.name}' \u2192 cloud ${step.model}
 `);
       }
@@ -1818,7 +2335,7 @@ async function runHybridTool(plan, cfg) {
       return { content: [{ type: "text", text }] };
     }
   );
-  const server = createSdkMcpServer({ name: "warble", version: "0.0.0", tools: [dispatchStep] });
+  const server = createSdkMcpServer({ name: MCP_SERVER_NAME, version: "0.0.0", tools: [dispatchStep] });
   const driverModel = plan.options.model ?? "sonnet";
   const driverOptions = {
     cwd,
@@ -1827,9 +2344,22 @@ async function runHybridTool(plan, cfg) {
     model: driverModel,
     systemPrompt: buildToolDriverPrompt(steps),
     mcpServers: { warble: server },
-    allowedTools: ["mcp__warble__dispatch_step"],
-    env
+    allowedTools: [DISPATCH_STEP_TOOL],
+    env,
+    // The floor is composed in here too, even though the driver prompt asks this turn to do nothing
+    // but call `dispatch_step`. `allowedTools` does not restrict the toolset — the SDK documents it
+    // as "auto-allowed without prompting" and says to use `tools` to restrict — and `tools` is not
+    // set here, so the default built-in set (Bash, Write, Edit, …) is on the table for this turn.
+    // Composing the floor is therefore the difference between the prompt asking the model not to
+    // reach for them and something actually stopping it.
+    //
+    // This tightens behaviour rather than preserving it: before, no `canUseTool` reached this turn
+    // at all. That is the intended direction — a guardrail floor applying where it previously did
+    // not — and it is why this is not spread conditionally like an embedder-only passthrough.
+    canUseTool: driverCanUseTool,
+    hooks: stepHooks
   };
+  cfg.onPromptFingerprint?.(fingerprintSurfaces(promptSurfacesOf(driverOptions)));
   const msgs = [];
   for await (const m of query({ prompt: question, options: driverOptions })) msgs.push(m);
   const result = msgs.find(isResult);
@@ -1848,8 +2378,8 @@ async function runHybridTool(plan, cfg) {
     steps: traceSteps,
     denials
   };
-  writeFileSync(join(cfg.outDir, "result.txt"), finalText, "utf8");
-  writeFileSync(join(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
+  writeFileSync2(join2(cfg.outDir, "result.txt"), finalText, "utf8");
+  writeFileSync2(join2(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
   return {
     finalText,
     trace,
@@ -1862,13 +2392,13 @@ async function runHybridTool(plan, cfg) {
 
 // src/render.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
+import { mkdtempSync, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 function renderEnvelope(finalText, outPath, opts) {
-  const dir = mkdtempSync(join2(tmpdir(), "warble-sdk-"));
-  const envelopePath = join2(dir, "envelope.txt");
-  writeFileSync2(envelopePath, finalText, "utf8");
+  const dir = mkdtempSync(join3(tmpdir(), "warble-sdk-"));
+  const envelopePath = join3(dir, "envelope.txt");
+  writeFileSync3(envelopePath, finalText, "utf8");
   const args = ["render", envelopePath, "--out", outPath];
   if (opts.title) args.push("--title", opts.title);
   const proc = spawnSync(opts.warbleBin, args, { encoding: "utf8" });
@@ -1892,8 +2422,8 @@ The 'warble' binary was not found. Install it with 'cargo install warble-cli' (r
 }
 
 // src/run.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join4 } from "path";
 import { query as query2 } from "@anthropic-ai/claude-agent-sdk";
 
 // src/conditional.ts
@@ -1905,10 +2435,10 @@ function tryParseJson(text) {
     return void 0;
   }
 }
-function readFlag(slots, target) {
-  const [slotName, ...path] = target.split(".");
-  if (slotName === void 0) return false;
-  const raw = slots[slotName];
+function readFlag(artifacts, target) {
+  const [artifactName, ...path] = target.split(".");
+  if (artifactName === void 0) return false;
+  const raw = artifacts[artifactName];
   if (raw === void 0) return false;
   let cur = tryParseJson(raw);
   for (const key of path) {
@@ -1922,9 +2452,9 @@ function evaluateGuard(when, state) {
     case "on_failure":
       return state.outcomes[when.target] === "failure";
     case "on_flag":
-      return readFlag(state.slots, when.target);
+      return readFlag(state.artifacts, when.target);
     case "on_missing":
-      return state.slots[when.target] === void 0;
+      return state.artifacts[when.target] === void 0;
     default:
       throw new DispatchError(
         `unknown guard '${when.guard}' (closed vocabulary: on_failure, on_flag, on_missing)`
@@ -2106,10 +2636,15 @@ function requireFinalText2(result) {
   return result.result;
 }
 async function runDispatch(plan, cfg) {
+  if (plan.meta.componentInvocation) {
+    throw new DispatchError(
+      "component_invocation requires the immutable prepared registry and trusted active-step runtime; use dispatch() or runComposedDispatch() instead of runDispatch(plan)"
+    );
+  }
   if (plan.meta.mode === "hybrid-staged") {
     return process.env["WARBLE_HYBRID_MODE"] === "tool" ? runHybridTool(plan, cfg) : runHybridStaged(plan, cfg);
   }
-  mkdirSync2(cfg.outDir, { recursive: true });
+  mkdirSync3(cfg.outDir, { recursive: true });
   const cwd = plan.options.cwd ?? process.cwd();
   const gate = plan.meta.render;
   const writeScope = gate.kind === "realize" && gate.flavor === "prompt" ? gate.scope : null;
@@ -2119,18 +2654,20 @@ async function runDispatch(plan, cfg) {
     cwd,
     setupScope: plan.meta.setupScope
   });
-  const venvBin = join3(cwd, ".venv", "bin");
-  const pathEnv = existsSync2(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
+  const venvBin = join4(cwd, ".venv", "bin");
+  const pathEnv = existsSync3(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
   const env = { ...process.env, PATH: pathEnv };
   const options = {
     ...plan.options,
-    canUseTool,
+    canUseTool: composeCanUseTool(plan.options.canUseTool, canUseTool),
     // Read never reaches `canUseTool` for an in-cwd path in the real SDK (see guardrails.ts); this
     // hook is the live enforcement point for the +Setup dotenv-read gap's Read side.
-    hooks: { ...plan.options.hooks, PreToolUse: [...plan.options.hooks?.PreToolUse ?? [], ...hooks] },
+    hooks: composeHooks(plan.options.hooks, hooks),
     env,
     ...cfg.resume ? { resume: cfg.resume } : {}
   };
+  if (cfg.assets) landAssets(cfg.assets.ir, cfg.assets.irPath, cwd);
+  reportPromptFingerprint(cfg, options);
   const mapper = new ChatEventMapper(plan.meta.verb);
   const messages = [];
   for await (const message of query2({ prompt: plan.prompt, options })) {
@@ -2142,12 +2679,12 @@ async function runDispatch(plan, cfg) {
   if (cfg.onEvent) for (const event of mapper.finish(true)) cfg.onEvent(event);
   const trace = aggregateTrace(messages, plan.meta, denials);
   const sessionId = result?.session_id ?? null;
-  writeFileSync3(join3(cfg.outDir, "result.txt"), finalText, "utf8");
-  writeFileSync3(join3(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
+  writeFileSync4(join4(cfg.outDir, "result.txt"), finalText, "utf8");
+  writeFileSync4(join4(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
   let htmlPath = null;
   let renderDegraded = null;
   if (gate.kind === "realize" && gate.flavor === "programmatic") {
-    const out = join3(cfg.outDir, "dashboard.html");
+    const out = join4(cfg.outDir, "dashboard.html");
     const realized = realizeRender(gate, finalText, out, {
       warbleBin: cfg.warbleBin,
       ...cfg.title ? { title: cfg.title } : {}
@@ -2155,7 +2692,7 @@ async function runDispatch(plan, cfg) {
     htmlPath = realized.htmlPath;
     renderDegraded = realized.renderDegraded;
   } else if (plan.meta.assertion) {
-    const out = join3(cfg.outDir, "status.html");
+    const out = join4(cfg.outDir, "status.html");
     renderEnvelope(finalText, out, {
       warbleBin: cfg.warbleBin,
       ...cfg.title ? { title: cfg.title } : {}
@@ -2170,15 +2707,19 @@ function hybridCloudPreamble(cwd) {
     "All data access MUST go through the `wren` CLI \u2014 never raw SQL clients."
   ].join("\n");
 }
-function slotKey(step) {
+function reportPromptFingerprint(cfg, options) {
+  cfg.onPromptFingerprint?.(fingerprintSurfaces(promptSurfacesOf(options)));
+}
+function artifactKey(step) {
   return step.produces ?? step.name;
 }
-async function executeStep(step, slots, ctx, tolerant) {
-  const messages = buildStepMessages(step, ctx.plan.prompt, slots);
+async function executeStep(step, artifacts, ctx, tolerant) {
+  const messages = buildStepMessages(step, ctx.plan.prompt, artifacts);
   const userPrompt = messages.find((m) => m.role === "user")?.content ?? ctx.plan.prompt;
   try {
     if (step.provider === "openai_compat") {
       if (!step.endpoint) throw new DispatchError(`local step '${step.name}' has no endpoint`);
+      ctx.cfg.onPromptFingerprint?.(fingerprintSurfaces(promptSurfacesOfMessages(messages)));
       const text2 = await callOpenAiCompat({ endpoint: step.endpoint, model: step.model, messages });
       ctx.steps.push({ model: `openai_compat:${step.model}`, parent_tool_use_id: step.name, usage: null });
       process.stderr.write(`warble hybrid: step '${step.name}' \u2192 local ${step.model}
@@ -2199,9 +2740,10 @@ ${step.prompt}`,
       canUseTool: ctx.canUseTool,
       // Read never reaches `canUseTool` for an in-cwd path in the real SDK (see guardrails.ts); this
       // hook is the live enforcement point for the +Setup dotenv-read gap's Read side.
-      hooks: { PreToolUse: ctx.hooks },
+      hooks: ctx.hooks,
       env: ctx.env
     };
+    reportPromptFingerprint(ctx.cfg, stepOptions);
     const msgs = [];
     for await (const message of query2({ prompt: userPrompt, options: stepOptions })) {
       msgs.push(message);
@@ -2226,7 +2768,7 @@ ${step.prompt}`,
   }
 }
 async function runHybridStaged(plan, cfg) {
-  mkdirSync2(cfg.outDir, { recursive: true });
+  mkdirSync3(cfg.outDir, { recursive: true });
   const cwd = plan.options.cwd ?? process.cwd();
   const { canUseTool, denials, hooks } = makeReadOnlyGuard({
     readOnly: plan.meta.readOnly,
@@ -2234,19 +2776,20 @@ async function runHybridStaged(plan, cfg) {
     cwd,
     setupScope: plan.meta.setupScope
   });
-  const venvBin = join3(cwd, ".venv", "bin");
-  const pathEnv = existsSync2(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
+  const venvBin = join4(cwd, ".venv", "bin");
+  const pathEnv = existsSync3(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
   const env = { ...process.env, PATH: pathEnv };
-  const slots = {};
+  const artifacts = {};
   const outcomes = {};
   const steps = [];
   let finalText = "";
   let totalCost = 0;
   const startedAll = Date.now();
   const execCtx = {
+    cfg,
     cwd,
-    canUseTool,
-    hooks,
+    canUseTool: composeCanUseTool(plan.options.canUseTool, canUseTool),
+    hooks: composeHooks(plan.options.hooks, hooks),
     env,
     plan,
     steps,
@@ -2270,7 +2813,7 @@ async function runHybridStaged(plan, cfg) {
       const preceding = i > 0 ? stagedSteps[i - 1] : null;
       const precedingIdentity = preceding === null ? null : { name: preceding.name, produces: preceding.produces };
       const decision = classifyConditionalStep(step.when, step.consumes, precedingIdentity, {
-        slots,
+        artifacts,
         outcomes
       });
       if (decision.kind === "skip") {
@@ -2279,11 +2822,11 @@ async function runHybridStaged(plan, cfg) {
         continue;
       }
       if (decision.kind === "repair") {
-        let lastFailureText = slots[decision.target.produces ?? decision.target.name] ?? "";
+        let lastFailureText = artifacts[decision.target.produces ?? decision.target.name] ?? "";
         const { recovered, attempts } = await runRepairLoop(DEFAULT_MAX_REPAIR_ATTEMPTS, async () => {
-          const attempt = await executeStep(step, slots, execCtx, true);
+          const attempt = await executeStep(step, artifacts, execCtx, true);
           outcomes[step.name] = attempt.outcome;
-          slots[slotKey(step)] = attempt.text;
+          artifacts[artifactKey(step)] = attempt.text;
           if (attempt.outcome === "success") finalText = attempt.text;
           else lastFailureText = attempt.text;
           return { failed: attempt.outcome === "failure" };
@@ -2300,9 +2843,9 @@ async function runHybridStaged(plan, cfg) {
         continue;
       }
     }
-    const outcome = await executeStep(step, slots, execCtx, failureGuardTargets.has(step.name));
+    const outcome = await executeStep(step, artifacts, execCtx, failureGuardTargets.has(step.name));
     outcomes[step.name] = outcome.outcome;
-    slots[slotKey(step)] = outcome.text;
+    artifacts[artifactKey(step)] = outcome.text;
     if (outcome.outcome === "success") finalText = outcome.text;
   }
   const trace = {
@@ -2321,15 +2864,947 @@ async function runHybridStaged(plan, cfg) {
     steps,
     denials
   };
-  writeFileSync3(join3(cfg.outDir, "result.txt"), finalText, "utf8");
-  writeFileSync3(join3(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
+  writeFileSync4(join4(cfg.outDir, "result.txt"), finalText, "utf8");
+  writeFileSync4(join4(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
   return { finalText, trace, htmlPath: null, denials, sessionId: null, renderDegraded: null };
 }
 
+// src/componentInvocation.ts
+import { randomUUID } from "crypto";
+var DEFAULT_COMPONENT_INVOCATION_LIMITS = Object.freeze({
+  maxDepth: 8,
+  maxAttempts: 32,
+  maxRequestBytes: 65536,
+  maxResultBytes: 1048576,
+  maxTurns: 40,
+  maxTurnsPerChild: 12
+});
+var ComponentStepExecutionError = class extends DispatchError {
+  constructor(message, telemetry, retryable) {
+    super(message);
+    this.telemetry = telemetry;
+    this.retryable = retryable;
+    this.name = "ComponentStepExecutionError";
+  }
+  telemetry;
+  retryable;
+};
+var FORBIDDEN_CALLEE_CAPABILITIES = /* @__PURE__ */ new Set([
+  "artifact_write",
+  "data_write",
+  "context_write",
+  "setup_execution",
+  "human_approval",
+  "scheduler",
+  "event_bus",
+  "notify_channel",
+  "write_authz",
+  "version_control",
+  "source_connect",
+  "context_build",
+  "blast_radius"
+]);
+var FORBIDDEN_CALLEE_GUARDRAILS = /* @__PURE__ */ new Set([
+  "artifact_write",
+  "data_write",
+  "context_write",
+  "context_write_authz",
+  "setup_execution",
+  "human_approval"
+]);
+function positiveInteger(value, fallback, name) {
+  const resolved = value ?? fallback;
+  if (!Number.isInteger(resolved) || resolved < 1 || resolved > fallback) {
+    throw new DispatchError(`${name} must be an integer between 1 and ${fallback}`);
+  }
+  return resolved;
+}
+function resolveLimits(input) {
+  assertSupportedComponentInvocationLimits(input);
+  const limits = {
+    maxDepth: positiveInteger(input?.maxDepth, DEFAULT_COMPONENT_INVOCATION_LIMITS.maxDepth, "maxDepth"),
+    maxAttempts: positiveInteger(input?.maxAttempts, DEFAULT_COMPONENT_INVOCATION_LIMITS.maxAttempts, "maxAttempts"),
+    maxRequestBytes: positiveInteger(input?.maxRequestBytes, DEFAULT_COMPONENT_INVOCATION_LIMITS.maxRequestBytes, "maxRequestBytes"),
+    maxResultBytes: positiveInteger(input?.maxResultBytes, DEFAULT_COMPONENT_INVOCATION_LIMITS.maxResultBytes, "maxResultBytes"),
+    maxTurns: positiveInteger(input?.maxTurns, DEFAULT_COMPONENT_INVOCATION_LIMITS.maxTurns, "maxTurns"),
+    maxTurnsPerChild: positiveInteger(input?.maxTurnsPerChild, DEFAULT_COMPONENT_INVOCATION_LIMITS.maxTurnsPerChild, "maxTurnsPerChild")
+  };
+  if (input?.deadlineAt !== void 0) {
+    if (!Number.isFinite(input.deadlineAt)) throw new DispatchError("deadlineAt must be a finite epoch timestamp");
+    limits.deadlineAt = input.deadlineAt;
+  }
+  return limits;
+}
+function assertSupportedComponentInvocationLimits(input) {
+  if (input?.maxCostUsd !== void 0) {
+    throw new DispatchError(
+      "unsupported_component_budget: maxCostUsd cannot be enforced before Agent SDK provider spend; component composition requires a reservable hard dollar cap"
+    );
+  }
+}
+function byteLength(value) {
+  return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function boundedMessage(message) {
+  const collapsed = message.replace(/[\r\n\t]+/g, " ").replace(/\s+/g, " ").trim();
+  const withoutPaths = collapsed.replace(/(?:^|\s)\/(?:[^\s/]+\/)*[^\s]*/g, " [redacted path]");
+  const safe = /\b(select|insert|update|delete|merge|alter|drop|create)\b/i.test(withoutPaths) ? "The callee did not complete the request." : withoutPaths;
+  return (safe || "The child run did not complete.").slice(0, 240);
+}
+function isJsonValue(value, seen = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (typeof value !== "object") return false;
+  if (seen.has(value)) return false;
+  seen.add(value);
+  let valid;
+  if (Array.isArray(value)) {
+    valid = value.every((entry2) => isJsonValue(entry2, seen));
+  } else {
+    const prototype = Object.getPrototypeOf(value);
+    valid = (prototype === Object.prototype || prototype === null) && Object.values(value).every((entry2) => isJsonValue(entry2, seen));
+  }
+  seen.delete(value);
+  return valid;
+}
+function errorResult(code, message, retryable = false) {
+  return { status: "error", code, message: boundedMessage(message), retryable };
+}
+function normalizeComponentRequest(value, maxBytes = DEFAULT_COMPONENT_INVOCATION_LIMITS.maxRequestBytes) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return { error: errorResult("invalid_request", "The component request must be a JSON object.") };
+  }
+  const obj = value;
+  const keys = Object.keys(obj);
+  if (keys.some((key) => key !== "request" && key !== "input")) {
+    return { error: errorResult("invalid_request", "The component request contains an unsupported field.") };
+  }
+  if (typeof obj["request"] !== "string" || obj["request"].trim() === "") {
+    return { error: errorResult("invalid_request", "The component request must contain a non-empty request string.") };
+  }
+  if (obj["input"] !== void 0 && (typeof obj["input"] !== "object" || obj["input"] === null || Array.isArray(obj["input"]))) {
+    return { error: errorResult("invalid_request", "The component request input must be a JSON object.") };
+  }
+  if (!isJsonValue(obj["input"] ?? {})) {
+    return { error: errorResult("invalid_request", "The component request input must contain only JSON values.") };
+  }
+  const normalized = {
+    request: obj["request"],
+    input: JSON.parse(JSON.stringify(obj["input"] ?? {}))
+  };
+  let bytes;
+  try {
+    bytes = byteLength(normalized);
+  } catch {
+    return { error: errorResult("invalid_request", "The component request must be JSON serializable.") };
+  }
+  if (bytes > maxBytes) {
+    return { error: errorResult("invalid_request", "The component request exceeds the configured byte limit.") };
+  }
+  return { value: normalized, bytes };
+}
+function parseJsonText(text) {
+  const trimmed = text.trim();
+  const fenced = /^```(?:json)?\s*([\s\S]*?)\s*```$/i.exec(trimmed);
+  return JSON.parse(fenced ? fenced[1] : trimmed);
+}
+function matchesFieldType(value, type) {
+  const nullable = type.endsWith("?");
+  if (value === null || value === void 0) return nullable;
+  const normalized = nullable ? type.slice(0, -1) : type;
+  if (normalized.includes("|")) {
+    const variants = normalized.split("|");
+    const primitives = /* @__PURE__ */ new Set(["string", "number", "boolean", "row"]);
+    return variants.every((variant) => primitives.has(variant)) ? variants.some((variant) => matchesFieldType(value, variant)) : typeof value === "string" && variants.includes(value);
+  }
+  if (normalized.endsWith("[]")) {
+    if (!Array.isArray(value)) return false;
+    const element = normalized.slice(0, -2);
+    return value.every((entry2) => matchesFieldType(entry2, element));
+  }
+  switch (normalized) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && Number.isFinite(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "row":
+      return Array.isArray(value) && value.every(
+        (entry2) => entry2 === null || typeof entry2 === "string" || typeof entry2 === "boolean" || typeof entry2 === "number" && Number.isFinite(entry2)
+      );
+    default:
+      return typeof value === "string" && value === normalized;
+  }
+}
+function validateRenderBlocks(value, contract) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const envelope = value;
+  if (!Array.isArray(envelope["blocks"])) return null;
+  const contracts = new Map(contract.map((block) => [block.type, block]));
+  const blocks = [];
+  for (const raw of envelope["blocks"]) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+    const block = raw;
+    if (typeof block["type"] !== "string") return null;
+    const expected = contracts.get(block["type"]);
+    if (!expected) return null;
+    for (const [field, type] of Object.entries(expected.fields)) {
+      if (!matchesFieldType(block[field], type)) return null;
+    }
+    blocks.push(block);
+  }
+  if (envelope["summary"] !== void 0 && typeof envelope["summary"] !== "string") return null;
+  const provenance = {};
+  if (typeof envelope["verified"] === "boolean") provenance.verified = envelope["verified"];
+  if (envelope["definition"] !== void 0) provenance.definition = envelope["definition"];
+  return {
+    blocks,
+    ...typeof envelope["summary"] === "string" ? { summary: envelope["summary"] } : {},
+    ...Object.keys(provenance).length > 0 ? { provenance } : {}
+  };
+}
+function normalizeComponentResult(finalText, renderContract, maxBytes = DEFAULT_COMPONENT_INVOCATION_LIMITS.maxResultBytes) {
+  let parsed;
+  try {
+    parsed = parseJsonText(finalText);
+  } catch {
+    const value2 = errorResult("invalid_result", "The child returned a non-JSON result.");
+    return { value: value2, bytes: byteLength(value2) };
+  }
+  if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+    const obj = parsed;
+    if (obj["status"] === "refused") {
+      const value2 = {
+        status: "refused",
+        code: "callee_refused",
+        // Child-authored prose may contain provider errors, paths, SQL, or secrets.
+        message: "The callee refused the request."
+      };
+      return { value: value2, bytes: byteLength(value2) };
+    }
+  }
+  let value;
+  if (renderContract.length > 0) {
+    const render = validateRenderBlocks(parsed, renderContract);
+    value = render ? {
+      status: "ok",
+      output: { kind: "render", blocks: render.blocks, ...render.summary ? { summary: render.summary } : {} },
+      ...render.provenance ? { provenance: render.provenance } : {}
+    } : errorResult("invalid_result", "The child result does not satisfy its render contract.");
+  } else {
+    const provenance = {};
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+      const obj = parsed;
+      if (typeof obj["verified"] === "boolean") provenance.verified = obj["verified"];
+      if (obj["definition"] !== void 0) provenance.definition = obj["definition"];
+    }
+    value = {
+      status: "ok",
+      output: { kind: "value", value: parsed },
+      ...Object.keys(provenance).length > 0 ? { provenance } : {}
+    };
+  }
+  const bytes = byteLength(value);
+  if (bytes > maxBytes) {
+    const oversized = errorResult("invalid_result", "The normalized child result exceeds the configured byte limit.");
+    return { value: oversized, bytes };
+  }
+  return { value, bytes };
+}
+function assertEligibleComponentCallee(component) {
+  const node = component.node;
+  const reason = node.trigger.kind !== "one_shot" ? `trigger '${node.trigger.kind}'` : node.realization_kind !== "skill" ? `realization '${node.realization_kind}'` : node.effect.outcome.kind !== "none" ? `outcome '${node.effect.outcome.kind}'` : !node.guardrails.some((guardrail) => guardrail.name === "read_only_execution" && guardrail.locked) ? "missing locked read_only_execution guardrail" : node.required_capabilities.some((capability) => FORBIDDEN_CALLEE_CAPABILITIES.has(capability)) ? `capability '${node.required_capabilities.find((capability) => FORBIDDEN_CALLEE_CAPABILITIES.has(capability))}'` : node.guardrails.some((guardrail) => FORBIDDEN_CALLEE_GUARDRAILS.has(guardrail.name)) ? `guardrail '${node.guardrails.find((guardrail) => FORBIDDEN_CALLEE_GUARDRAILS.has(guardrail.name)).name}'` : node.borrowed_actions.length > 0 ? "borrowed action transport" : null;
+  const providerReason = component.steps.find((step) => step.provider !== "anthropic");
+  if (reason !== null || providerReason) {
+    throw new DispatchError(
+      `unsupported_callee: component '${node.id}' is not eligible for isolated invocation (${reason ?? `provider '${providerReason.provider}' cannot propagate the Agent SDK cancellation/tool boundary`})`
+    );
+  }
+}
+function assertEligibleComponentCaller(component) {
+  const readOnly = component.node.guardrails.some(
+    (guardrail) => guardrail.name === "read_only_execution" && guardrail.locked
+  );
+  const callingStepNames = new Set(
+    component.node.llm_calls.filter((step) => step.component_calls.length > 0).map((step) => step.name)
+  );
+  const unsupportedProvider = component.steps.find((step) => step.provider !== "anthropic");
+  const tools = Array.isArray(component.plan.options.tools) ? component.plan.options.tools : [];
+  const unsafeCommandSurface = callingStepNames.size > 0 && tools.includes("Bash");
+  const unsupportedPromptRender = component.plan.meta.render.kind === "realize" && component.plan.meta.render.flavor === "prompt";
+  if (!readOnly || unsupportedProvider || unsafeCommandSurface || unsupportedPromptRender) {
+    const reason = !readOnly ? "missing locked read_only_execution guardrail" : unsupportedProvider ? `provider '${unsupportedProvider.provider}' on executable step '${unsupportedProvider.name}'` : unsafeCommandSurface ? "a calling step has an effective Bash command surface that can execute SQL directly" : "prompt-render roots require model-owned artifact writes";
+    throw new DispatchError(
+      `unsupported_callee: component '${component.id}' cannot expose a trusted step-scoped invocation surface (${reason})`
+    );
+  }
+}
+function stepOf(component, call) {
+  const staged = component.steps.find((candidate) => candidate.name === call.name);
+  if (!staged) throw new DispatchError(`prepared component '${component.id}' has no resolved step '${call.name}'`);
+  return staged;
+}
+function artifactKey2(step) {
+  return step.produces ?? step.name;
+}
+function aggregateTokenUsage(entries) {
+  const totals = {
+    input_tokens: 0,
+    output_tokens: 0,
+    cache_creation_input_tokens: 0,
+    cache_read_input_tokens: 0
+  };
+  let observed = false;
+  for (const entry2 of entries) {
+    if (typeof entry2.usage !== "object" || entry2.usage === null) continue;
+    const usage = entry2.usage;
+    for (const key of Object.keys(totals)) {
+      const value = usage[key];
+      if (typeof value === "number" && Number.isFinite(value) && value >= 0) {
+        totals[key] += value;
+        observed = true;
+      }
+    }
+  }
+  return observed ? totals : null;
+}
+var ComponentInvocationRuntime = class {
+  constructor(options) {
+    this.options = options;
+    this.limits = resolveLimits(options.limits);
+    this.availableTurns = this.limits.maxTurns;
+    this.now = options.now ?? Date.now;
+    this.newId = options.newId ?? randomUUID;
+    this.rootRunId = this.newId();
+    for (const component of [...options.prepared.components, ...options.prepared.preparedCallees]) {
+      this.byId.set(component.id, component);
+    }
+    for (const dependency of options.prepared.dependencies) {
+      const key = `${dependency.caller}\0${dependency.step}`;
+      const aliases = new Map(this.edgeByStep.get(key) ?? []);
+      const callee = this.byId.get(dependency.component);
+      if (!callee) throw new DispatchError(`prepared callee '${dependency.component}' is absent from the immutable registry`);
+      aliases.set(dependency.alias, callee);
+      this.edgeByStep.set(key, aliases);
+    }
+    if (options.signal) {
+      if (options.signal.aborted) this.cancel();
+      else options.signal.addEventListener("abort", () => this.cancel(), { once: true });
+    }
+    if (this.limits.deadlineAt !== void 0) {
+      const delay = Math.max(0, this.limits.deadlineAt - this.now());
+      this.deadlineTimer = setTimeout(() => this.cancel(), delay);
+    }
+  }
+  options;
+  rootRunId;
+  componentCalls = [];
+  limits;
+  abortController = new AbortController();
+  now;
+  newId;
+  byId = /* @__PURE__ */ new Map();
+  edgeByStep = /* @__PURE__ */ new Map();
+  descendantDepth = /* @__PURE__ */ new Map();
+  attempts = 0;
+  availableTurns;
+  totalTurnsObserved = 0;
+  totalCostUsd = 0;
+  allUsage = [];
+  cancelledAt = null;
+  deadlineTimer = null;
+  get signal() {
+    return this.abortController.signal;
+  }
+  cancel() {
+    if (this.cancelledAt !== null) return;
+    this.cancelledAt = this.now();
+    this.abortController.abort();
+  }
+  async runRoot(componentId, request) {
+    const component = this.options.prepared.components.find((candidate) => candidate.id === componentId);
+    if (!component) throw new DispatchError(`component '${componentId}' is not a prepared root entry`);
+    const normalized = normalizeComponentRequest(request, this.limits.maxRequestBytes);
+    if ("error" in normalized) throw new DispatchError(normalized.error.status === "error" ? normalized.error.message : "invalid request");
+    const frame = {
+      component,
+      callId: null,
+      parentCallId: null,
+      ancestry: [component.id],
+      depth: 0,
+      reservation: null,
+      queue: Promise.resolve()
+    };
+    try {
+      const result = await this.executeComponent(frame, normalized.value);
+      this.throwIfCancelled();
+      return {
+        finalText: result.text,
+        turns: this.totalTurnsObserved,
+        totalCostUsd: this.totalCostUsd,
+        usage: [...this.allUsage],
+        componentCalls: [...this.componentCalls]
+      };
+    } finally {
+      if (this.deadlineTimer) clearTimeout(this.deadlineTimer);
+    }
+  }
+  throwIfCancelled() {
+    if (this.cancelledAt !== null) throw new DispatchError("cancelled: the root component run was cancelled");
+    if (this.limits.deadlineAt !== void 0 && this.now() >= this.limits.deadlineAt) {
+      this.cancel();
+      throw new DispatchError("cancelled: the root component run deadline elapsed");
+    }
+  }
+  aliasesFor(frame, step) {
+    if (!frame.component.node.llm_calls.some((candidate) => candidate === step)) {
+      throw new DispatchError("unauthorized_call: forged active-step identity");
+    }
+    return this.edgeByStep.get(`${frame.component.id}\0${step.name}`) ?? /* @__PURE__ */ new Map();
+  }
+  availableFor(frame) {
+    return frame.reservation?.remainingTurns ?? this.availableTurns;
+  }
+  charge(frame, result) {
+    if (!Number.isInteger(result.turns) || result.turns < 0) throw new DispatchError("callee_failed: invalid child turn telemetry");
+    if (!Number.isFinite(result.totalCostUsd) || result.totalCostUsd < 0) throw new DispatchError("callee_failed: invalid child cost telemetry");
+    this.totalTurnsObserved += result.turns;
+    this.totalCostUsd += result.totalCostUsd;
+    this.allUsage.push(...result.usage ?? []);
+    if (result.turns > this.availableFor(frame)) {
+      if (frame.reservation) frame.reservation.remainingTurns = 0;
+      else this.availableTurns = 0;
+      throw new DispatchError("budget_exhausted: model turn budget was exceeded");
+    }
+    if (frame.reservation) frame.reservation.remainingTurns -= result.turns;
+    else this.availableTurns -= result.turns;
+  }
+  maxDescendantDepth(componentId, visiting = /* @__PURE__ */ new Set()) {
+    const cached = this.descendantDepth.get(componentId);
+    if (cached !== void 0) return cached;
+    if (visiting.has(componentId)) return this.limits.maxDepth;
+    visiting.add(componentId);
+    let depth = 0;
+    for (const dependency of this.options.prepared.dependencies) {
+      if (dependency.caller !== componentId) continue;
+      depth = Math.max(depth, 1 + this.maxDescendantDepth(dependency.component, visiting));
+    }
+    visiting.delete(componentId);
+    this.descendantDepth.set(componentId, depth);
+    return depth;
+  }
+  descendantDepthForStep(frame, step) {
+    let depth = 0;
+    for (const callee of this.aliasesFor(frame, step).values()) {
+      depth = Math.max(depth, 1 + this.maxDescendantDepth(callee.id));
+    }
+    return depth;
+  }
+  /** Reserve an active root SDK query before its synchronous child handlers may be admitted. */
+  reserveRootStep(frame, step) {
+    const available = this.availableTurns;
+    if (available < 1) throw new DispatchError("budget_exhausted: no model turns remain");
+    const desiredDescendantTurns = this.descendantDepthForStep(frame, step) * this.limits.maxTurnsPerChild;
+    const heldForDescendants = Math.min(desiredDescendantTurns, Math.max(0, available - 1));
+    const reservedTurns = available - heldForDescendants;
+    this.availableTurns -= reservedTurns;
+    return { reservedTurns, remainingTurns: reservedTurns };
+  }
+  async executeComponent(frame, request) {
+    this.throwIfCancelled();
+    const artifacts = {};
+    const outcomes = {};
+    const usage = [];
+    let finalText = "";
+    let turns = 0;
+    let totalCostUsd = 0;
+    let degradation = null;
+    const failureTargets = new Set(
+      frame.component.node.llm_calls.filter((step) => step.conditional && step.when?.guard === "on_failure").map((step) => step.when.target)
+    );
+    const execute = async (call, tolerant) => {
+      const step = stepOf(frame.component, call);
+      const aliases = this.aliasesFor(frame, call);
+      const rootStepReservation = frame.reservation === null ? this.reserveRootStep(frame, call) : null;
+      const accountingFrame = rootStepReservation === null ? frame : { ...frame, reservation: rootStepReservation };
+      try {
+        this.throwIfCancelled();
+        const maxTurns = this.availableFor(accountingFrame);
+        if (maxTurns < 1) throw new DispatchError("budget_exhausted: no model turns remain");
+        const result = await this.options.runStep({
+          rootRunId: this.rootRunId,
+          callId: frame.callId,
+          parentCallId: frame.parentCallId,
+          component: frame.component,
+          step,
+          request,
+          artifacts,
+          aliases: [...aliases.keys()],
+          signal: this.signal,
+          maxTurns,
+          invoke: (alias, childRequest) => this.enqueueInvocation(frame, call, alias, childRequest)
+        });
+        this.charge(accountingFrame, result);
+        turns += result.turns;
+        totalCostUsd += result.totalCostUsd;
+        usage.push(...result.usage ?? []);
+        degradation ??= result.degradation ?? null;
+        this.throwIfCancelled();
+        return { outcome: "success", text: result.text };
+      } catch (caught) {
+        let error = caught;
+        if (caught instanceof ComponentStepExecutionError) {
+          try {
+            this.charge(accountingFrame, caught.telemetry);
+            turns += caught.telemetry.turns;
+            totalCostUsd += caught.telemetry.totalCostUsd;
+            usage.push(...caught.telemetry.usage ?? []);
+            degradation ??= caught.telemetry.degradation ?? null;
+          } catch (chargeError) {
+            error = chargeError;
+          }
+        }
+        const terminal = error instanceof DispatchError && /^(?:budget_exhausted|cancelled|unauthorized_call):/.test(error.message);
+        if (!tolerant || terminal) throw error;
+        return { outcome: "failure", text: boundedMessage(error instanceof Error ? error.message : String(error)) };
+      } finally {
+        if (rootStepReservation !== null) {
+          this.availableTurns += rootStepReservation.remainingTurns;
+        }
+      }
+    };
+    const calls = frame.component.node.llm_calls;
+    for (let index = 0; index < calls.length; index++) {
+      const call = calls[index];
+      if (call.conditional) {
+        if (!call.when) throw new DispatchError(`conditional step '${call.name}' has no 'when' guard`);
+        const preceding = index > 0 ? calls[index - 1] : null;
+        const precedingIdentity = preceding ? { name: preceding.name, produces: preceding.produces } : null;
+        const decision = classifyConditionalStep(call.when, call.consumes, precedingIdentity, { artifacts, outcomes });
+        if (decision.kind === "skip") continue;
+        if (decision.kind === "repair") {
+          const repair = await runRepairLoop(DEFAULT_MAX_REPAIR_ATTEMPTS, async () => {
+            const result2 = await execute(call, true);
+            outcomes[call.name] = result2.outcome;
+            artifacts[artifactKey2(stepOf(frame.component, call))] = result2.text;
+            if (result2.outcome === "success") finalText = result2.text;
+            return { failed: result2.outcome === "failure" };
+          });
+          if (!repair.recovered) throw new DispatchError(`callee_failed: repair step '${call.name}' did not recover`);
+          continue;
+        }
+      }
+      const result = await execute(call, failureTargets.has(call.name));
+      outcomes[call.name] = result.outcome;
+      artifacts[artifactKey2(stepOf(frame.component, call))] = result.text;
+      if (result.outcome === "success") finalText = result.text;
+    }
+    return { text: finalText, turns, totalCostUsd, usage, degradation };
+  }
+  enqueueInvocation(frame, step, alias, request) {
+    let release;
+    const predecessor = frame.queue;
+    frame.queue = new Promise((resolve4) => {
+      release = resolve4;
+    });
+    return predecessor.then(() => this.invoke(frame, step, alias, request)).finally(release);
+  }
+  async invoke(frame, step, alias, request) {
+    this.throwIfCancelled();
+    const aliases = this.aliasesFor(frame, step);
+    const callee = aliases.get(alias);
+    if (!callee) {
+      this.cancel();
+      throw new DispatchError(
+        `unauthorized_call: the requested alias is not authorized for trusted step '${frame.component.id}.${step.name}'`
+      );
+    }
+    const normalized = normalizeComponentRequest(request, this.limits.maxRequestBytes);
+    if ("error" in normalized) return normalized.error;
+    if (frame.depth + 1 > this.limits.maxDepth || this.attempts >= this.limits.maxAttempts) {
+      return errorResult("budget_exhausted", "The root component-call budget is exhausted.");
+    }
+    if (frame.ancestry.includes(callee.id)) {
+      this.cancel();
+      throw new DispatchError(`unauthorized_call: recursive re-entry into component '${callee.id}' was rejected`);
+    }
+    const desiredDescendantTurns = this.maxDescendantDepth(callee.id) * this.limits.maxTurnsPerChild;
+    const heldForDescendants = Math.min(
+      desiredDescendantTurns,
+      Math.max(0, this.availableTurns - 1)
+    );
+    const available = Math.min(
+      this.availableTurns - heldForDescendants,
+      this.limits.maxTurnsPerChild
+    );
+    if (available < 1) return errorResult("budget_exhausted", "The root model-turn budget is exhausted.");
+    this.attempts += 1;
+    this.availableTurns -= available;
+    const reservation = { reservedTurns: available, remainingTurns: available };
+    const callId = this.newId();
+    const admittedAt = this.now();
+    const trace = {
+      call_id: callId,
+      parent_call_id: frame.callId,
+      caller_mount: frame.component.id,
+      trusted_step_id: step.name,
+      alias,
+      callee_mount: callee.id,
+      attempt: this.attempts,
+      depth: frame.depth + 1,
+      admitted_at: admittedAt,
+      completed_at: admittedAt,
+      status: "error",
+      request_bytes: normalized.bytes,
+      result_bytes: 0,
+      model_turns: 0,
+      total_cost_usd: 0,
+      token_usage: null,
+      degradation: null
+    };
+    this.componentCalls.push(trace);
+    const turnsBefore = this.totalTurnsObserved;
+    const costBefore = this.totalCostUsd;
+    const usageBefore = this.allUsage.length;
+    try {
+      const child = await this.executeComponent({
+        component: callee,
+        callId,
+        parentCallId: frame.callId,
+        ancestry: [...frame.ancestry, callee.id],
+        depth: frame.depth + 1,
+        reservation,
+        queue: Promise.resolve()
+      }, normalized.value);
+      trace.model_turns = this.totalTurnsObserved - turnsBefore;
+      trace.total_cost_usd = this.totalCostUsd - costBefore;
+      trace.token_usage = aggregateTokenUsage(this.allUsage.slice(usageBefore));
+      trace.degradation = child.degradation ? boundedMessage(child.degradation) : null;
+      const result = normalizeComponentResult(child.text, callee.node.effect.render_blocks, this.limits.maxResultBytes);
+      trace.result_bytes = result.bytes;
+      trace.completed_at = this.now();
+      if (this.cancelledAt !== null && trace.completed_at >= this.cancelledAt) {
+        trace.status = "late_discarded";
+        return errorResult("cancelled", "The component call was cancelled.");
+      }
+      trace.status = result.value.status === "ok" ? "ok" : result.value.status;
+      return result.value;
+    } catch (error) {
+      trace.completed_at = this.now();
+      trace.model_turns = this.totalTurnsObserved - turnsBefore;
+      trace.total_cost_usd = this.totalCostUsd - costBefore;
+      trace.token_usage = aggregateTokenUsage(this.allUsage.slice(usageBefore));
+      if (error instanceof ComponentStepExecutionError && error.telemetry.degradation) {
+        trace.degradation = boundedMessage(error.telemetry.degradation);
+      }
+      if (this.cancelledAt !== null && trace.completed_at >= this.cancelledAt) {
+        trace.status = "late_discarded";
+        return errorResult("cancelled", "The component call was cancelled.");
+      }
+      trace.status = "error";
+      if (error instanceof DispatchError && error.message.startsWith("budget_exhausted:")) {
+        return errorResult("budget_exhausted", "The root model-turn budget is exhausted.");
+      }
+      if (error instanceof ComponentStepExecutionError && error.retryable) {
+        return errorResult("transient_transport", "The child transport did not complete.", true);
+      }
+      if (error instanceof DispatchError) {
+        return errorResult("callee_failed", "The child run did not complete.");
+      }
+      return errorResult("transient_transport", "The child transport did not complete.", true);
+    } finally {
+      this.availableTurns += reservation.remainingTurns;
+    }
+  }
+};
+
+// src/componentSdk.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join5 } from "path";
+import { createSdkMcpServer as createSdkMcpServer2, query as query3, tool as tool2 } from "@anthropic-ai/claude-agent-sdk";
+import { z as z2 } from "zod";
+var MCP_SERVER_NAME2 = "warble_components";
+function isResult3(message) {
+  return message.type === "result";
+}
+function isAssistant3(message) {
+  return message.type === "assistant";
+}
+function requireFinalText3(result) {
+  if (!result) throw new DispatchError("component step ended without a result message");
+  if (result.subtype !== "success") {
+    if (result.subtype === "error_max_turns" || result.subtype === "error_max_budget_usd") {
+      throw new DispatchError("budget_exhausted: child model limit reached");
+    }
+    throw new DispatchError(`component step failed (${result.subtype})`);
+  }
+  return result.result;
+}
+function stepTelemetry(messages, result) {
+  const assistant = messages.filter(isAssistant3);
+  return {
+    text: "",
+    turns: result?.num_turns ?? assistant.length,
+    totalCostUsd: result?.total_cost_usd ?? 0,
+    usage: assistant.map((message) => ({
+      model: message.message.model,
+      usage: message.message.usage
+    })),
+    degradation: null
+  };
+}
+function componentStepPrompt(run) {
+  const consumed = run.step.consumes.map((name) => {
+    const value = run.artifacts[name];
+    return value === void 0 ? `Input '${name}' was not produced by an earlier step.` : `Input '${name}':
+${value}`;
+  });
+  return [
+    `Request: ${run.request.request}`,
+    `Structured input: ${JSON.stringify(run.request.input)}`,
+    ...consumed
+  ].join("\n\n");
+}
+function componentStepSystemPrompt(run) {
+  const isLast = run.component.steps.at(-1)?.name === run.step.name;
+  const behavior = run.component.steps.length === 1 ? run.component.node.prompt_fragment || run.step.prompt : run.step.prompt;
+  const render = run.component.node.effect.render_blocks;
+  const output = !isLast ? "Return only this step's output for the next declared step." : render.length > 0 ? [
+    "Your final message must be one JSON render envelope with a blocks array and optional summary.",
+    "Every block type and field must satisfy this callee-owned contract:",
+    JSON.stringify(render),
+    "Do not render or write an artifact; return the envelope as data only."
+  ].join("\n") : [
+    "Your final message must be one JSON value and nothing else.",
+    'If policy requires refusal, return {"status":"refused","message":"a bounded explanation"}.'
+  ].join("\n");
+  return [
+    buildPreamble(run.component.plan.options.cwd ?? process.cwd()),
+    ...run.component.node.brief ? [run.component.node.brief] : [],
+    behavior,
+    run.aliases.length > 0 ? `This step may call only these logical component aliases: ${run.aliases.map((alias) => `\`${alias}\``).join(", ")}.` : "This step has no callable component aliases.",
+    output
+  ].join("\n\n");
+}
+function componentTools(component) {
+  const configured = component.plan.options.tools;
+  if (!Array.isArray(configured)) return ["Read"];
+  return configured.filter((name) => name !== "Task" && name !== "Write" && name !== "Edit");
+}
+function createSdkComponentStepRunner(cfg = {}) {
+  const denials = [];
+  const runStep = async (run) => {
+    if (run.step.provider !== "anthropic") {
+      throw new DispatchError(`unsupported_callee: provider '${run.step.provider}' has no step-scoped invocation transport`);
+    }
+    const cwd = run.component.plan.options.cwd ?? process.cwd();
+    const guard = makeReadOnlyGuard({
+      readOnly: true,
+      writeScope: null,
+      cwd,
+      setupScope: null
+    });
+    const planAndFloor = composeCanUseTool(run.component.plan.options.canUseTool, guard.canUseTool);
+    const originalCanUseTool = composeCanUseTool(cfg.hostCanUseTool, planAndFloor);
+    const planHooks = {
+      ...cfg.hostHooks,
+      ...run.component.plan.options.hooks,
+      PreToolUse: [
+        ...cfg.hostHooks?.PreToolUse ?? [],
+        ...run.component.plan.options.hooks?.PreToolUse ?? []
+      ]
+    };
+    const hooks = composeHooks(planHooks, guard.hooks);
+    const toolNames = new Set(run.aliases.map((alias) => `mcp__${MCP_SERVER_NAME2}__${alias}`));
+    const approvedAliasInputs = /* @__PURE__ */ new Map();
+    const approvalKey = (name, input) => JSON.stringify([
+      name,
+      toolNames.has(name) && input["input"] === void 0 ? { ...input, input: {} } : input
+    ]);
+    const rememberApproval = (name, input) => {
+      const key = approvalKey(name, input);
+      approvedAliasInputs.set(key, (approvedAliasInputs.get(key) ?? 0) + 1);
+    };
+    const consumeApproval = (name, input) => {
+      const key = approvalKey(name, input);
+      const count = approvedAliasInputs.get(key) ?? 0;
+      if (count < 1) return false;
+      if (count === 1) approvedAliasInputs.delete(key);
+      else approvedAliasInputs.set(key, count - 1);
+      return true;
+    };
+    const canUseTool = async (name, input, options2) => {
+      if (!toolNames.has(name)) return originalCanUseTool(name, input, options2);
+      if (!cfg.hostCanUseTool) return { behavior: "allow", updatedInput: input };
+      const permission = await cfg.hostCanUseTool(name, input, options2);
+      if (permission.behavior === "allow") rememberApproval(name, permission.updatedInput);
+      return permission;
+    };
+    const componentCalls = run.aliases.map((alias) => tool2(
+      alias,
+      `Invoke the statically authorized '${alias}' component alias with an isolated JSON request.`,
+      { request: z2.string(), input: z2.record(z2.string(), z2.unknown()).optional() },
+      async (args) => {
+        const name = `mcp__${MCP_SERVER_NAME2}__${alias}`;
+        let input = { request: args.request, input: args.input ?? {} };
+        if (cfg.hostCanUseTool && !consumeApproval(name, input)) {
+          const permission = await cfg.hostCanUseTool(name, input, {
+            signal: run.signal,
+            toolUseID: `${run.rootRunId}:${run.callId ?? "root"}:${run.step.name}:${alias}`
+          });
+          if (permission.behavior !== "allow") {
+            throw new DispatchError("component invocation was denied by the embedding host");
+          }
+          input = permission.updatedInput;
+        }
+        const result2 = await run.invoke(alias, input);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result2) }]
+        };
+      }
+    ));
+    const server = componentCalls.length > 0 ? createSdkMcpServer2({ name: MCP_SERVER_NAME2, version: "0.0.0", tools: componentCalls }) : null;
+    const venvBin = join5(cwd, ".venv", "bin");
+    const path = existsSync4(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
+    const abortController = new AbortController();
+    if (run.signal.aborted) abortController.abort();
+    else run.signal.addEventListener("abort", () => abortController.abort(), { once: true });
+    const options = {
+      cwd,
+      permissionMode: "default",
+      persistSession: false,
+      abortController,
+      maxTurns: run.maxTurns,
+      model: run.step.model,
+      systemPrompt: componentStepSystemPrompt(run),
+      tools: componentTools(run.component),
+      // Aliases must reach canUseTool; allowedTools would auto-authorize them ahead of host policy.
+      allowedTools: ["Read"],
+      disallowedTools: run.component.plan.options.disallowedTools,
+      canUseTool,
+      hooks,
+      env: { ...process.env, PATH: path },
+      ...server ? { mcpServers: { [MCP_SERVER_NAME2]: server } } : {}
+    };
+    cfg.onPromptFingerprint?.(fingerprintSurfaces(promptSurfacesOf(options)));
+    const messages = [];
+    try {
+      for await (const message of query3({ prompt: componentStepPrompt(run), options })) messages.push(message);
+    } catch {
+      denials.push(...guard.denials);
+      throw new ComponentStepExecutionError(
+        "component step transport failed",
+        stepTelemetry(messages, void 0),
+        true
+      );
+    }
+    const result = messages.find(isResult3);
+    denials.push(...guard.denials);
+    let text;
+    try {
+      text = requireFinalText3(result);
+    } catch (error) {
+      throw new ComponentStepExecutionError(
+        error instanceof Error ? error.message : "component step failed",
+        stepTelemetry(messages, result),
+        false
+      );
+    }
+    const telemetry = stepTelemetry(messages, result);
+    return {
+      text,
+      turns: telemetry.turns,
+      totalCostUsd: telemetry.totalCostUsd,
+      usage: telemetry.usage,
+      degradation: null
+    };
+  };
+  return { runStep, denials };
+}
+async function runComposedDispatch(plan, cfg) {
+  const sdk = cfg.runStep ? { runStep: cfg.runStep, denials: [] } : createSdkComponentStepRunner(cfg);
+  const runtime = new ComponentInvocationRuntime({
+    prepared: cfg.prepared,
+    runStep: sdk.runStep,
+    limits: {
+      ...cfg.limits,
+      // Composition may only preserve or lower the established DispatchInput/CLI turn limit.
+      maxTurns: Math.min(
+        typeof plan.options.maxTurns === "number" ? plan.options.maxTurns : DEFAULT_COMPONENT_INVOCATION_LIMITS.maxTurns,
+        cfg.limits?.maxTurns ?? DEFAULT_COMPONENT_INVOCATION_LIMITS.maxTurns
+      )
+    },
+    ...cfg.signal ? { signal: cfg.signal } : {}
+  });
+  const started = Date.now();
+  const result = await runtime.runRoot(cfg.root.id, { request: plan.prompt, input: {} });
+  if (runtime.signal.aborted) throw new DispatchError("cancelled: the root component run was cancelled");
+  const traceSteps = result.usage.map((entry2) => ({
+    model: entry2.model,
+    parent_tool_use_id: null,
+    usage: entry2.usage
+  }));
+  const trace = {
+    target: plan.meta.target,
+    verb: plan.meta.verb,
+    model: plan.meta.model,
+    split: true,
+    run: {
+      total_cost_usd: result.totalCostUsd,
+      duration_ms: Date.now() - started,
+      duration_api_ms: 0,
+      num_turns: result.turns
+    },
+    usage: null,
+    modelUsage: {},
+    steps: traceSteps,
+    denials: sdk.denials.map(() => ({
+      tool: "[redacted]",
+      reason: "component guardrail denied a tool call"
+    })),
+    componentCalls: result.componentCalls
+  };
+  mkdirSync4(cfg.outDir, { recursive: true });
+  writeFileSync5(join5(cfg.outDir, "result.txt"), result.finalText, "utf8");
+  writeFileSync5(join5(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
+  let htmlPath = null;
+  let renderDegraded = null;
+  const gate = plan.meta.render;
+  if (gate.kind === "realize" && gate.flavor === "programmatic") {
+    const rendered = realizeRender(gate, result.finalText, join5(cfg.outDir, "dashboard.html"), {
+      warbleBin: cfg.warbleBin,
+      ...cfg.title ? { title: cfg.title } : {}
+    });
+    htmlPath = rendered.htmlPath;
+    renderDegraded = rendered.renderDegraded;
+  } else if (plan.meta.assertion) {
+    const out = join5(cfg.outDir, "status.html");
+    renderEnvelope(result.finalText, out, {
+      warbleBin: cfg.warbleBin,
+      ...cfg.title ? { title: cfg.title } : {}
+    });
+    htmlPath = out;
+  }
+  return {
+    finalText: result.finalText,
+    trace,
+    htmlPath,
+    denials: trace.denials,
+    sessionId: null,
+    renderDegraded
+  };
+}
+
 // src/dispatch.ts
-import { dirname, isAbsolute, resolve } from "path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 var UNAVAILABLE_COMPONENT_REASON = "component is unavailable on the configured runtime";
-function buildPreparedComponent(node, report, input, target, models) {
+function deepFreeze(value) {
+  if (typeof value !== "object" || value === null || Object.isFrozen(value)) return value;
+  for (const nested of Object.values(value)) deepFreeze(nested);
+  return Object.freeze(value);
+}
+function buildPreparedComponent(node, report, input, target, models, role = "entry") {
   const cfg = {
     target,
     flavor: input.flavor ?? DEFAULT_RENDER_FLAVOR,
@@ -2338,60 +3813,224 @@ function buildPreparedComponent(node, report, input, target, models) {
     cwd: resolveProjectCwd(node, { ...input.project !== void 0 ? { project: input.project } : {}, ...input.irPath !== void 0 ? { irPath: input.irPath } : {} }),
     ...input.maxTurns !== void 0 ? { maxTurns: input.maxTurns } : {}
   };
-  return { id: node.id, node, report, plan: buildDispatchPlan(node, report, cfg) };
+  const plan = buildPreparedNodePlan(node, report, cfg);
+  return deepFreeze({ id: node.id, node, report, plan, steps: resolveStagedSteps(node, models), role });
+}
+function assertExecutableReport(node, report, target, deferInvocationWall) {
+  const failed = report.find(
+    (entry2) => entry2.outcome === "fail" && !(deferInvocationWall && entry2.capability === "component_invocation")
+  );
+  if (!failed) return;
+  const reason = failed.note ?? "unsupported on this target";
+  throw new DispatchError(
+    `${failed.capability}: fail on ${target} (${reason}) \u2014 component '${node.verb}' cannot be dispatched`
+  );
+}
+function assertInvocationRealization(closure, reports, target) {
+  if (closure.dependencies.length === 0) return;
+  const edge = closure.dependencies.find(
+    (dependency) => reports.get(dependency.caller)?.some(
+      (entry2) => entry2.capability === "component_invocation" && entry2.outcome === "fail"
+    )
+  );
+  if (!edge) return;
+  const resolution = reports.get(edge.caller).find((entry2) => entry2.capability === "component_invocation");
+  throw new DispatchError(
+    `step '${edge.step}' on component '${edge.caller}' authorizes component call alias '${edge.alias}' to '${edge.component}', but component_invocation resolves ${resolution.outcome} on ${target} (${resolution.note ?? "no trusted invocation handler"}) (wall-hit)`
+  );
 }
 function resolveProjectCwd(node, opts) {
-  if (opts.project) return resolve(opts.project);
+  if (opts.project) return resolve2(opts.project);
   const p = node.context_binding.project;
-  if (isAbsolute(p)) return p;
-  const baseDir = opts.irPath ? dirname(resolve(opts.irPath)) : process.cwd();
-  return resolve(baseDir, p);
+  if (isAbsolute2(p)) return p;
+  const baseDir = opts.irPath ? dirname2(resolve2(opts.irPath)) : process.cwd();
+  return resolve2(baseDir, p);
 }
 function prepareDispatch(input) {
-  const ir = typeof input.ir === "string" ? parseIr(input.ir) : input.ir;
+  const ir = parseIrInput(input.ir);
   assertSupportedIrVersion(ir.warble_ir_version);
   const target = input.target ?? DEFAULT_TARGET;
   const models = input.models ?? ModelConfig.default();
-  models.validate(ir);
-  let scoped = ir.components;
-  if (input.componentId !== void 0) {
-    const node = ir.components.find((candidate) => candidate.id === input.componentId);
-    if (!node) {
-      throw new DispatchError(
-        `component '${input.componentId}' not found in IR (available: ${ir.components.map((c) => c.id).join(", ")})`
-      );
-    }
-    scoped = [node];
+  const closure = resolveComponentClosure(
+    ir,
+    input.componentId === void 0 ? void 0 : [input.componentId]
+  );
+  models.validate({ ...ir, components: [...closure.components] });
+  const supply = input.slots ?? {};
+  const resolvedNodes = /* @__PURE__ */ new Map();
+  const reports = /* @__PURE__ */ new Map();
+  for (const node of closure.components) {
+    const resolved = resolveSlotsForNode(node, ir, supply);
+    const withSlots = resolved === null ? node : applyNodeSlots(node, resolved);
+    const report = inspectNodeCapabilities(withSlots, target);
+    resolvedNodes.set(node.id, withSlots);
+    reports.set(node.id, report);
+  }
+  for (const node of closure.components) {
+    assertExecutableReport(
+      resolvedNodes.get(node.id),
+      reports.get(node.id),
+      target,
+      closure.dependencies.some((dependency) => dependency.caller === node.id)
+    );
   }
-  const components = scoped.map((node) => {
-    const report = resolveNodeCapabilities(node, target);
-    return buildPreparedComponent(node, report, input, target, models);
+  const components = closure.roots.map(
+    (node) => buildPreparedComponent(resolvedNodes.get(node.id), reports.get(node.id), input, target, models, "entry")
+  );
+  const preparedCallees = closure.callees.map(
+    (node) => buildPreparedComponent(
+      resolvedNodes.get(node.id),
+      reports.get(node.id),
+      input,
+      target,
+      models,
+      "callee"
+    )
+  );
+  for (const callee of preparedCallees) assertEligibleComponentCallee(callee);
+  const preparedById = new Map([...components, ...preparedCallees].map((component) => [component.id, component]));
+  for (const caller of new Set(closure.dependencies.map((dependency) => dependency.caller))) {
+    assertEligibleComponentCaller(preparedById.get(caller));
+  }
+  assertInvocationRealization(closure, reports, target);
+  return Object.freeze({
+    target,
+    profile: ir.profile,
+    // Keep the established mutable TypeScript surface for compatibility while freezing the actual
+    // registry returned for a run. Callers cannot widen it after preflight.
+    components: Object.freeze(components),
+    preparedCallees: Object.freeze(preparedCallees),
+    entries: closure.entries,
+    dependencies: closure.dependencies
   });
-  return { target, components };
+}
+function resolveSlotsForNode(node, ir, supply, unanswered = "fail") {
+  const decls = [...ir.slots ?? [], ...node.slots ?? []];
+  if (decls.length === 0) return null;
+  return resolveSlots(decls, supply, `component '${node.id}'`, unanswered);
+}
+function applyNodeSlots(node, resolved) {
+  const scope = `component '${node.id}'`;
+  return {
+    ...node,
+    ...node.brief === void 0 ? {} : { brief: applySlots(node.brief, resolved, scope) },
+    prompt_fragment: applySlots(node.prompt_fragment, resolved, scope),
+    llm_calls: node.llm_calls.map((call) => ({
+      ...call,
+      prompt: applySlots(call.prompt, resolved, scope)
+    }))
+  };
 }
 function prepareDisplayManifest(input) {
-  const ir = typeof input.ir === "string" ? parseIr(input.ir) : input.ir;
+  const ir = parseIrInput(input.ir);
   assertSupportedIrVersion(ir.warble_ir_version);
+  assertComponentCompositionFields(ir);
   const target = input.target ?? DEFAULT_TARGET;
   const models = input.models ?? ModelConfig.default();
-  models.validate(ir);
+  const closure = resolveComponentClosure(ir);
+  const calleeIds = new Set(closure.dependencies.map((dependency) => dependency.component));
+  const callerIds = new Set(closure.dependencies.map((dependency) => dependency.caller));
+  const supply = input.slots ?? {};
   const components = ir.components.map((node) => {
-    const report = inspectNodeCapabilities(node, target);
-    if (report.some((entry2) => entry2.outcome === "fail")) {
-      return { id: node.id, node, availability: { status: "unavailable", reason: UNAVAILABLE_COMPONENT_REASON } };
+    const resolved = resolveSlotsForNode(node, ir, supply, "default");
+    const withSlots = resolved === null ? node : applyNodeSlots(node, resolved);
+    const report = inspectNodeCapabilities(withSlots, target);
+    let modelReady = true;
+    try {
+      models.validate({ ...ir, components: [withSlots] });
+    } catch {
+      modelReady = false;
     }
-    return buildPreparedComponent(node, report, input, target, models);
+    if (!modelReady || report.some((entry2) => entry2.outcome === "fail")) {
+      return {
+        id: withSlots.id,
+        node: withSlots,
+        inspection: report,
+        availability: { status: "unavailable", reason: UNAVAILABLE_COMPONENT_REASON }
+      };
+    }
+    const prepared = buildPreparedComponent(withSlots, report, input, target, models, withSlots.entrypoint ? "entry" : "callee");
+    try {
+      if (calleeIds.has(prepared.id)) assertEligibleComponentCallee(prepared);
+      if (callerIds.has(prepared.id)) assertEligibleComponentCaller(prepared);
+    } catch {
+      return {
+        id: withSlots.id,
+        node: withSlots,
+        inspection: report,
+        availability: { status: "unavailable", reason: UNAVAILABLE_COMPONENT_REASON }
+      };
+    }
+    return { id: prepared.id, node: prepared.node, report: prepared.report };
   });
-  return { target, components };
+  return {
+    target,
+    profile: ir.profile,
+    components,
+    entries: closure.entries,
+    dependencies: closure.dependencies
+  };
+}
+function preflightDispatchAssets(input, prepared) {
+  const all = [...new Map(
+    [...prepared.components, ...prepared.preparedCallees].map((component) => [component.id, component])
+  ).values()];
+  if (!all.some((component) => (component.node.assets?.length ?? 0) > 0)) return;
+  if (!input.irPath) {
+    throw new DispatchError(
+      "reachable components declare assets, but executable preparation has no irPath from which to resolve the travelling asset directory"
+    );
+  }
+  const ir = parseIrInput(input.ir);
+  for (const component of all) {
+    if ((component.node.assets?.length ?? 0) === 0) continue;
+    validateAssets(
+      { ...ir, components: [component.node] },
+      input.irPath,
+      component.plan.options.cwd ?? process.cwd()
+    );
+  }
 }
 async function dispatch(input, runCfg) {
   const prepared = prepareDispatch(input);
+  if (prepared.dependencies.length > 0) {
+    assertSupportedComponentInvocationLimits(runCfg.componentLimits);
+  }
+  preflightDispatchAssets(input, prepared);
   const warbleBin = runCfg.warbleBin ?? "warble";
+  if (input.irPath && prepared.dependencies.length > 0) {
+    const ir = parseIrInput(input.ir);
+    const all = [...new Map(
+      [...prepared.components, ...prepared.preparedCallees].map((component) => [component.id, component])
+    ).values()];
+    for (const component of all) {
+      if ((component.node.assets?.length ?? 0) === 0) continue;
+      landAssets(
+        { ...ir, components: [component.node] },
+        input.irPath,
+        component.plan.options.cwd ?? process.cwd()
+      );
+    }
+  }
   const components = [];
   for (const c of prepared.components) {
-    const result = await runDispatch(c.plan, {
+    const entry2 = prepared.entries.find((candidate) => candidate.root === c.id);
+    const composed = prepared.dependencies.some((dependency) => entry2?.components.includes(dependency.caller));
+    const result = composed ? await runComposedDispatch(c.plan, {
+      prepared,
+      root: c,
       outDir: runCfg.outDir,
       warbleBin,
+      ...runCfg.title ? { title: runCfg.title } : {},
+      ...runCfg.componentLimits ? { limits: runCfg.componentLimits } : {},
+      ...runCfg.signal ? { signal: runCfg.signal } : {},
+      ...runCfg.componentStepRunner ? { runStep: runCfg.componentStepRunner } : {},
+      ...runCfg.hostCanUseTool ? { hostCanUseTool: runCfg.hostCanUseTool } : {},
+      ...runCfg.hostHooks ? { hostHooks: runCfg.hostHooks } : {}
+    }) : await runDispatch(c.plan, {
+      outDir: runCfg.outDir,
+      warbleBin,
+      ...input.irPath ? { assets: { ir: { ...parseIrInput(input.ir), components: [c.node] }, irPath: input.irPath } } : {},
       ...runCfg.title ? { title: runCfg.title } : {}
     });
     components.push({ id: c.id, report: c.report, plan: c.plan, result });
@@ -2400,9 +4039,9 @@ async function dispatch(input, runCfg) {
 }
 
 // src/manifest.ts
-var MANIFEST_VERSION = "0.1";
-var MIN_SUPPORTED_IR_VERSION = "0.7";
-var MAX_SUPPORTED_IR_VERSION = "0.7";
+var MANIFEST_VERSION = "0.3";
+var MIN_SUPPORTED_IR_VERSION = "0.8";
+var MAX_SUPPORTED_IR_VERSION = "0.8";
 var DEFAULT_MAX_ATTEMPTS = 1;
 function classifyStep(node, stepIndex) {
   const when = node.llm_calls[stepIndex].when;
@@ -2537,10 +4176,11 @@ function buildTools2(node) {
   }
   return out;
 }
-function buildAgentManifest(component) {
+function buildAgentManifest(component, dependencies = []) {
   const node = component.node;
   return {
     id: node.id,
+    entrypoint: node.entrypoint,
     verb: node.verb,
     component_type: node.type,
     realization_kind: node.realization_kind,
@@ -2551,13 +4191,15 @@ function buildAgentManifest(component) {
     tools: buildTools2(node),
     output_schema: outputSchemaFor(node.effect),
     capabilities: component.report,
+    dependencies: dependencies.filter((dependency) => dependency.caller === node.id).map(({ step, alias, component: callee }) => ({ step, alias, component: callee })),
     ...node.brief !== void 0 ? { brief: node.brief } : {}
   };
 }
-function buildUnavailableAgentManifest(component) {
+function buildUnavailableAgentManifest(component, dependencies = []) {
   const node = component.node;
   return {
     id: node.id,
+    entrypoint: node.entrypoint,
     verb: node.verb,
     component_type: node.type,
     realization_kind: node.realization_kind,
@@ -2568,23 +4210,48 @@ function buildUnavailableAgentManifest(component) {
     tools: [],
     output_schema: {},
     capabilities: [],
+    capability_inspection: component.inspection,
+    dependencies: dependencies.filter((dependency) => dependency.caller === node.id).map(({ step, alias, component: callee }) => ({ step, alias, component: callee })),
     availability: component.availability
   };
 }
 function buildManifest(prepared, raw) {
   const ir = parseIr(raw);
+  const manifestComponents = "preparedCallees" in prepared ? [...new Map(
+    [...prepared.components, ...prepared.preparedCallees].map((component) => [component.id, component])
+  ).values()] : prepared.components;
+  const byId = new Map(manifestComponents.map((component) => [component.id, component]));
+  const entries = prepared.entries.map((entry2) => {
+    const closureComponents = entry2.components.map((id) => byId.get(id)).filter((component) => component !== void 0);
+    const unavailable2 = closureComponents.find((component) => "availability" in component);
+    const closureIds = new Set(entry2.components);
+    const declaresInvocation = prepared.dependencies.some(
+      (dependency) => closureIds.has(dependency.caller)
+    );
+    const invocation = declaresInvocation ? closureComponents.flatMap((component) => {
+      const report = "report" in component ? component.report : component.inspection;
+      return report.filter((capability) => capability.capability === "component_invocation");
+    })[0] ?? null : null;
+    return {
+      id: entry2.root,
+      closure: [...entry2.components],
+      availability: unavailable2 ? { status: "unavailable", reason: UNAVAILABLE_COMPONENT_REASON } : { status: "available" },
+      invocation_realization: invocation
+    };
+  });
   return {
     manifest_version: MANIFEST_VERSION,
     compat: { min_ir_version: MIN_SUPPORTED_IR_VERSION, max_ir_version: MAX_SUPPORTED_IR_VERSION },
     profile: ir.profile,
     target: prepared.target,
-    agents: prepared.components.map((component) => "availability" in component ? buildUnavailableAgentManifest(component) : buildAgentManifest(component))
+    entries,
+    agents: manifestComponents.map((component) => "availability" in component ? buildUnavailableAgentManifest(component, prepared.dependencies) : buildAgentManifest(component, prepared.dependencies))
   };
 }
 
 // src/model_catalog.ts
-import { query as query3 } from "@anthropic-ai/claude-agent-sdk";
-import { resolve as resolve2 } from "path";
+import { query as query4 } from "@anthropic-ai/claude-agent-sdk";
+import { resolve as resolve3 } from "path";
 var MODEL_CATALOG_VERSION = 1;
 var CLEANUP_GRACE_MS = 25;
 function unavailable(code, retryable) {
@@ -2634,8 +4301,8 @@ async function settleCleanup(operation) {
   try {
     await Promise.race([
       operation.catch(() => void 0),
-      new Promise((resolve3) => {
-        timer = setTimeout(resolve3, CLEANUP_GRACE_MS);
+      new Promise((resolve4) => {
+        timer = setTimeout(resolve4, CLEANUP_GRACE_MS);
       })
     ]);
   } finally {
@@ -2648,11 +4315,11 @@ async function discoverClaudeModels(options = {}) {
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return unavailable("protocol_error", false);
   let catalogQuery;
   try {
-    const queryFactory = options.queryFactory ?? query3;
+    const queryFactory = options.queryFactory ?? query4;
     catalogQuery = queryFactory({
       prompt: idleInput(),
       options: {
-        cwd: resolve2(options.cwd ?? process.cwd()),
+        cwd: resolve3(options.cwd ?? process.cwd()),
         tools: [],
         mcpServers: [],
         settingSources: [],
@@ -2681,8 +4348,8 @@ async function discoverClaudeModels(options = {}) {
 }
 
 // src/session.ts
-import { mkdirSync as mkdirSync3 } from "fs";
-import { join as join4 } from "path";
+import { mkdirSync as mkdirSync5 } from "fs";
+import { join as join6 } from "path";
 var BREAKDOWN_RE = /\bby\s+([a-z][a-z0-9_]*(?:\s*(?:,|and)\s*[a-z][a-z0-9_]*)*)/i;
 var FILTER_OVERRIDE_RE = /\b(where|only|instead of|excluding|filtered?\s+to)\b/i;
 function extractBreakdownDimensions(question) {
@@ -2758,8 +4425,8 @@ var ChatSession = class {
     const prompt = buildTurnPrompt(this.state, question);
     const resume = lastSessionId(this.state) ?? this.initialResumeSessionId ?? null;
     const turnPlan = { ...this.plan, prompt };
-    const turnOutDir = join4(this.runCfg.outDir, `turn-${this.state.turns.length + 1}`);
-    mkdirSync3(turnOutDir, { recursive: true });
+    const turnOutDir = join6(this.runCfg.outDir, `turn-${this.state.turns.length + 1}`);
+    mkdirSync5(turnOutDir, { recursive: true });
     const result = await runDispatch(turnPlan, {
       ...this.runCfg,
       outDir: turnOutDir,
@@ -2783,6 +4450,8 @@ function createChatSession(plan, runCfg, initialResumeSessionId) {
 export {
   DispatchError,
   emitAgentModule,
+  componentDependencies,
+  resolveComponentClosure,
   REALIZATION_KINDS,
   COMPONENT_TYPES,
   TRIGGER_KINDS,
@@ -2790,6 +4459,10 @@ export {
   SUPPORTED_IR_VERSIONS,
   parseIr,
   distinctTiers,
+  resolveSlots,
+  applySlots,
+  assertNoSlotReferences,
+  parseSlotFlags,
   ModelConfig,
   resolveStagedSteps,
   distinctProviders,
@@ -2810,6 +4483,15 @@ export {
   resolveCapabilities,
   resolveNodeCapabilities,
   inspectNodeCapabilities,
+  assetDirForIr,
+  validateAssets,
+  landAssets,
+  fingerprintSurfaces,
+  promptSurfacesOf,
+  promptSurfaces,
+  fingerprintPrompts,
+  composeCanUseTool,
+  composeHooks,
   makeReadOnlyGuard,
   buildChatRequest,
   extractCompletionText,
@@ -2820,10 +4502,20 @@ export {
   aggregateTrace,
   DispatchSessionError,
   runDispatch,
+  DEFAULT_COMPONENT_INVOCATION_LIMITS,
+  ComponentStepExecutionError,
+  normalizeComponentRequest,
+  normalizeComponentResult,
+  assertEligibleComponentCallee,
+  assertEligibleComponentCaller,
+  ComponentInvocationRuntime,
+  createSdkComponentStepRunner,
+  runComposedDispatch,
   UNAVAILABLE_COMPONENT_REASON,
   resolveProjectCwd,
   prepareDispatch,
   prepareDisplayManifest,
+  preflightDispatchAssets,
   dispatch,
   buildAgentManifest,
   buildUnavailableAgentManifest,
@@ -2841,4 +4533,4 @@ export {
   ChatSession,
   createChatSession
 };
-//# sourceMappingURL=chunk-3ON7TSGW.js.map
+//# sourceMappingURL=chunk-2VDMVARW.js.map