@warble/claude-agent-sdk 0.4.0

package/dist/chunk-F4QDKVP7.js

@@ -0,0 +1,2844 @@
+// src/error.ts
+var DispatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DispatchError";
+  }
+};
+
+// src/codegen.ts
+function ident(verb) {
+  const base = verb.replace(/[^A-Za-z0-9_$]/g, "_");
+  return /^[0-9]/.test(base) ? `_${base}` : base;
+}
+function json(value) {
+  return JSON.stringify(value, null, 2);
+}
+var RUN_RESULT_TYPE = "{ finalText: string; trace: Trace; htmlPath: string | null; denials: Denial[]; renderDegraded: { reason: string } | null }";
+function runBody(fn) {
+  return `  const cwd = ${fn}_options.cwd ?? process.cwd();
+  const gate = ${fn}_meta.render;
+  const writeScope = gate.kind === "realize" && gate.flavor === "prompt" ? gate.scope : null;
+  const { canUseTool, denials, hooks } = makeReadOnlyGuard({
+    readOnly: ${fn}_meta.readOnly,
+    writeScope,
+    cwd,
+    setupScope: ${fn}_meta.setupScope,
+  });
+
+  // Read never reaches \`canUseTool\` for an in-cwd path in the real SDK (see guardrails.ts in the
+  // warble repo); this hook is the live enforcement point for the +Setup dotenv-read gate's Read
+  // side. Mirrors run.ts's wiring exactly \u2014 merge, don't clobber, any hooks already on the options.
+  const messages: SDKMessage[] = [];
+  for await (const m of query({
+    prompt: question,
+    options: {
+      ...${fn}_options,
+      canUseTool,
+      hooks: { ...${fn}_options.hooks, PreToolUse: [...(${fn}_options.hooks?.PreToolUse ?? []), ...hooks] },
+    },
+  })) {
+    messages.push(m);
+  }
+
+  const result = messages.find((m): m is Extract<SDKMessage, { type: "result" }> => m.type === "result");
+  if (!result || result.subtype !== "success") {
+    throw new Error(\`agent run failed: \${result ? result.subtype : "no result message"}\`);
+  }
+  const finalText = result.result;
+  const trace = aggregateTrace(
+    messages,
+    { target: ${fn}_meta.target, verb: ${fn}_meta.verb, model: ${fn}_meta.model, split: ${fn}_meta.split },
+    denials,
+  );
+
+  let htmlPath: string | null = null;
+  let renderDegraded: { reason: string } | null = null;
+  if (gate.kind === "realize" && gate.flavor === "programmatic" && opts.outDir) {
+    const out = join(opts.outDir, "dashboard.html");
+    try {
+      renderEnvelope(finalText, out, { warbleBin: opts.warbleBin ?? "warble", ...(opts.title ? { title: opts.title } : {}) });
+      htmlPath = out;
+    } catch (err) {
+      // best-effort render_contract: degrade to the agent's own text instead of failing the whole
+      // run (capability-model.md \u2014 only safety-critical/required capabilities never silently
+      // degrade). \`onFailure\` absent/"fail" preserves the prior hard-fail behavior exactly.
+      if (gate.onFailure !== "degrade") throw err;
+      renderDegraded = { reason: err instanceof Error ? err.message : String(err) };
+    }
+  }
+  return { finalText, trace, htmlPath, denials, renderDegraded };`;
+}
+function componentBlock(fn, verb, options, meta) {
+  return `// ---- component: ${verb} ----
+const ${fn}_options = ${json(options)} satisfies Options;
+const ${fn}_meta: EmittedMeta = ${json(meta)};
+
+/** Run the \`${verb}\` agent against the live Agent SDK loop. */
+export async function ${fn}(question: string, opts: RunOptions = {}): Promise<RunResult> {
+${runBody(fn)}
+}`;
+}
+var THIN_IMPORTS = `import { join } from "node:path";
+import { query, type Options, type SDKMessage } from "@anthropic-ai/claude-agent-sdk";
+import {
+  makeReadOnlyGuard,
+  aggregateTrace,
+  renderEnvelope,
+  type Trace,
+  type Denial,
+} from "@warble/claude-agent-sdk";`;
+var STANDALONE_IMPORTS = `import { join, sep } from "node:path";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { query, type Options, type SDKMessage } from "@anthropic-ai/claude-agent-sdk";`;
+var STANDALONE_HELPERS = `interface Denial { tool: string; reason: string; command?: string }
+interface Trace {
+  target: string; verb: string; model: string; split: boolean;
+  run: { total_cost_usd: number; duration_ms: number; duration_api_ms: number; num_turns: number } | null;
+  modelUsage: Record<string, unknown>;
+  steps: { model: string; parent_tool_use_id: string | null; usage: unknown }[];
+  denials: Denial[];
+}
+
+const DESTRUCTIVE = /\\b(rm|sudo|dd|mkfs|shutdown|reboot|kill|chmod|chown|mv|cp)\\b/;
+const REDIRECTION = /(^|[^>])>>?[^>]/;
+// Kept byte-identical to guardrails.ts's DOTENV_READER_COMMANDS/DOTENV_PATH pair (see that file's doc
+// comment for the incident this closes) \u2014 checked FIRST and unconditionally in the Bash branch below,
+// exactly like canonical, never gated behind any config field. tests/guard-drift.test.ts asserts this
+// inlined guard stays behaviorally equivalent to guardrails.ts on the surface standalone mode actually
+// supports (setupScope always null here \u2014 see the wall-hit above).
+const DOTENV_READER_COMMANDS = /\\b(cat|head|tail|less|more|od|xxd|strings|grep|awk|sed)\\b/;
+const DOTENV_PATH = /(^|[\\s"'\\/=])\\.env(\\.[\\w.-]+)?(?=$|[\\s"'\\/])/;
+
+function referencesDotenvPath(text: string): boolean {
+  return DOTENV_PATH.test(text);
+}
+
+function makeReadOnlyGuard(cfg: {
+  readOnly: boolean;
+  writeScope: string | null;
+  cwd: string;
+  mutation?: { mustDryRun: boolean; approvalRequired: boolean };
+  // \`emitAgentModule\` wall-hits before generating any component code if a setup-scoped component is
+  // combined with --standalone (see codegen.ts), so this is always null here in practice \u2014 the field
+  // only exists so this inlined guard's call signature matches the thin-mode \`makeReadOnlyGuard\`
+  // import that runBody() (shared between both modes) calls. This guard's Bash branch DOES carry the
+  // unconditional dotenv-read denylist (see DOTENV_READER_COMMANDS/DOTENV_PATH above) \u2014 that applies to
+  // every component, not just +Setup ones, so it stays in sync here. What it deliberately does NOT
+  // carry is any setupScope-aware widening (Bash beyond \`wren\`, Write/Edit scoped to a project root, a
+  // Read-side PreToolUse hook) \u2014 the wall-hit above refuses --standalone for a setup-scoped component
+  // rather than hand-syncing that logic and risking exactly the copy-drift this fix exists to close.
+  // tests/guard-drift.test.ts is the tripwire: it fails if this copy and guardrails.ts::makeReadOnlyGuard
+  // diverge on the setupScope == null surface, or if guardrails.ts grows new reachable behavior on that
+  // surface that this copy doesn't (yet) have.
+  setupScope?: string | null;
+}) {
+  const denials: Denial[] = [];
+  const hooks: never[] = [];
+  const canUseTool = async (toolName: string, input: Record<string, unknown>) => {
+    if (toolName === "Read" || toolName === "Task" || toolName === "TodoWrite") {
+      return { behavior: "allow" as const, updatedInput: input };
+    }
+    if (toolName === "Bash") {
+      const command = typeof input.command === "string" ? input.command : "";
+      // Dotenv-read pair: checked FIRST and unconditionally, before DESTRUCTIVE/REDIRECTION and the
+      // wren-only check below \u2014 mirrors guardrails.ts::makeReadOnlyGuard exactly (see that file's
+      // comment; standalone mode never has setupScope set, but the same compound-command bypass
+      // guardrails.ts closes here applies to every component, not just +Setup ones).
+      if (DOTENV_READER_COMMANDS.test(command) && referencesDotenvPath(command)) {
+        const reason =
+          "reading a dotenv file's contents is blocked by the read_only_execution guardrail; the " +
+          "setup credential design writes an empty .env template and is never meant to read it back.";
+        denials.push({ tool: "Bash", reason, command });
+        return { behavior: "deny" as const, message: reason };
+      }
+      if (DESTRUCTIVE.test(command) || REDIRECTION.test(command)) {
+        const reason =
+          "destructive or file-writing bash is blocked by the read_only_execution guardrail; " +
+          "all data access must go through the read-only \`wren\` CLI.";
+        denials.push({ tool: "Bash", reason, command });
+        return { behavior: "deny" as const, message: reason };
+      }
+      if (command.trim().split(/\\s+/)[0] !== "wren") {
+        const reason =
+          "only \`wren\` CLI invocations are permitted (data access goes through the semantic " +
+          "layer); this command is blocked by the read_only_execution guardrail.";
+        denials.push({ tool: "Bash", reason, command });
+        return { behavior: "deny" as const, message: reason };
+      }
+      return { behavior: "allow" as const, updatedInput: input };
+    }
+    if (toolName === "Write" || toolName === "Edit") {
+      if (cfg.mutation) {
+        const gate = cfg.mutation.approvalRequired ? "human approval" : "the must_dry_run gate";
+        const reason = \`\${toolName} is the gated apply of a mutating component and requires \${gate} to clear first; that approval is borrowed from the SDK embedder's own canUseTool/approval channel, which this guard does not provide, so it denies by default (fail-closed).\`;
+        denials.push({ tool: toolName, reason });
+        return { behavior: "deny" as const, message: reason };
+      }
+      if (cfg.writeScope) {
+        const target = typeof input.file_path === "string" ? input.file_path : "";
+        const abs = join(cfg.cwd, target);
+        // Path-boundary-safe containment (mirrors guardrails.ts::withinScope): an exact match or a
+        // real separator boundary \u2014 never a bare prefix, which would admit a sibling like models-export/.
+        const scopeAbs = join(cfg.cwd, cfg.writeScope);
+        if (abs === scopeAbs || abs.startsWith(scopeAbs.endsWith(sep) ? scopeAbs : scopeAbs + sep)) return { behavior: "allow" as const, updatedInput: input };
+        const reason = \`write to '\${target}' is outside the permitted artifact scope '\${cfg.writeScope}'.\`;
+        denials.push({ tool: toolName, reason, command: target });
+        return { behavior: "deny" as const, message: reason };
+      }
+      const reason =
+        \`\${toolName} is blocked: this component is read-only (programmatic render flavor keeps the \` +
+        \`agent from writing files; the dispatcher renders the dashboard from your envelope).\`;
+      denials.push({ tool: toolName, reason });
+      return { behavior: "deny" as const, message: reason };
+    }
+    const reason = \`tool '\${toolName}' is not permitted for this component.\`;
+    denials.push({ tool: toolName, reason });
+    return { behavior: "deny" as const, message: reason };
+  };
+  return { canUseTool, denials, hooks };
+}
+
+function aggregateTrace(
+  messages: readonly SDKMessage[],
+  meta: { target: string; verb: string; model: string; split: boolean },
+  denials: Denial[],
+): Trace {
+  const steps = messages
+    .filter((m): m is Extract<SDKMessage, { type: "assistant" }> => m.type === "assistant")
+    .map((m) => ({ model: m.message.model, parent_tool_use_id: m.parent_tool_use_id, usage: m.message.usage }));
+  const result = messages.find((m): m is Extract<SDKMessage, { type: "result" }> => m.type === "result");
+  const run = result === undefined ? null : {
+    total_cost_usd: result.total_cost_usd, duration_ms: result.duration_ms,
+    duration_api_ms: result.duration_api_ms, num_turns: result.num_turns,
+  };
+  return {
+    target: meta.target, verb: meta.verb, model: meta.model, split: meta.split, run,
+    modelUsage: (result?.modelUsage ?? {}) as Record<string, unknown>, steps, denials,
+  };
+}
+
+function renderEnvelope(finalText: string, outPath: string, opts: { warbleBin: string; title?: string }): void {
+  const dir = mkdtempSync(join(tmpdir(), "warble-emit-"));
+  const envelopePath = join(dir, "envelope.txt");
+  writeFileSync(envelopePath, finalText, "utf8");
+  const args = ["render", envelopePath, "--out", outPath];
+  if (opts.title) args.push("--title", opts.title);
+  const proc = spawnSync(opts.warbleBin, args, { encoding: "utf8" });
+  if (proc.error) {
+    const err = proc.error as NodeJS.ErrnoException;
+    const base = \`failed to run '\${opts.warbleBin} render': \${err.message}\`;
+    if (err.code === "ENOENT") {
+      throw new Error(
+        \`\${base}\\nThe 'warble' binary was not found. Install it with 'cargo install warble-cli' \` +
+          \`(requires a Rust toolchain; installs from crates.io), or set the 'warbleBin' option \` +
+          \`(CLI: --warble-bin <path>) to point at an existing 'warble' binary.\`,
+      );
+    }
+    throw new Error(\`\${base} (set the 'warbleBin' option, or pass --warble-bin <path> on the CLI, to point at a different binary)\`);
+  }
+  if (proc.status !== 0) throw new Error(\`warble render exited \${proc.status}: \${proc.stderr?.trim() ?? ""}\`);
+}`;
+var PREAMBLE_TYPES = `export interface RunOptions { outDir?: string; warbleBin?: string; title?: string }
+export type RunResult = ${RUN_RESULT_TYPE};
+
+interface EmittedMeta {
+  target: string; verb: string; model: string; split: boolean; readOnly: boolean;
+  render: {
+    kind: "realize" | "degrade" | "none"; scope: string | null; flavor: "programmatic" | "prompt" | null;
+    onFailure?: "degrade" | "fail";
+  };
+  setupScope: string | null;
+}`;
+function emitAgentModule(prepared, opts = {}) {
+  const standalone = opts.standalone ?? false;
+  const header = [
+    "// Generated by `warble-agent-sdk emit` \u2014 do not edit by hand.",
+    `// Target: ${prepared.target}. Regenerate from the IR instead of editing.`,
+    standalone ? "// Mode: standalone (runtime helpers inlined; only @anthropic-ai/claude-agent-sdk + the `warble` binary needed)." : "// Mode: thin (imports runtime helpers from @warble/claude-agent-sdk)."
+  ].join("\n");
+  if (standalone) {
+    const setupScoped = prepared.components.filter((c) => c.plan.meta.setupScope != null);
+    if (setupScoped.length > 0) {
+      const verbs = setupScoped.map((c) => c.node.verb).join(", ");
+      throw new DispatchError(
+        `emit --standalone does not support setup-scoped component(s) [${verbs}] (wall-hit): the inlined standalone guard has no dotenv-read Read hook and no setupScope-aware Bash/Write widening, so a standalone-ejected setup agent would have zero protection against the dotenv-read gap that guardrails.ts's PreToolUse hook closes for the thin (default) mode. Emit without --standalone for these component(s), or omit them from this IR.`
+      );
+    }
+  }
+  const blocks = prepared.components.map((c) => {
+    const fn = ident(c.node.verb);
+    const meta = {
+      target: c.plan.meta.target,
+      verb: c.plan.meta.verb,
+      model: c.plan.meta.model,
+      split: c.plan.meta.split,
+      readOnly: c.plan.meta.readOnly,
+      render: c.plan.meta.render,
+      setupScope: c.plan.meta.setupScope
+    };
+    return componentBlock(fn, c.node.verb, c.plan.options, meta);
+  });
+  return [
+    header,
+    "",
+    standalone ? STANDALONE_IMPORTS : THIN_IMPORTS,
+    "",
+    PREAMBLE_TYPES,
+    ...standalone ? ["", STANDALONE_HELPERS] : [],
+    "",
+    ...blocks,
+    ""
+  ].join("\n");
+}
+
+// src/ir.ts
+var REALIZATION_KINDS = ["skill", "tool", "gated-tool"];
+var COMPONENT_TYPES = [
+  "analytical",
+  "assertive",
+  "mutating",
+  "constitutive",
+  "orchestrating"
+];
+var TRIGGER_KINDS = ["one_shot", "scheduled", "event"];
+var OUTCOME_KINDS = ["none", "assertion", "mutation", "dispatch"];
+var SUPPORTED_IR_VERSIONS = ["0.6"];
+function assertSupportedIrVersion(version) {
+  if (!SUPPORTED_IR_VERSIONS.includes(version)) {
+    throw new DispatchError(
+      `unsupported warble_ir_version '${version}' (this back-end understands: ${SUPPORTED_IR_VERSIONS.join(", ")})`
+    );
+  }
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fail(message) {
+  throw new DispatchError(`invalid IR: ${message}`);
+}
+function requireObject(value, at) {
+  if (!isObject(value)) fail(`${at} must be an object`);
+  return value;
+}
+function requireString(obj, key, at) {
+  const value = obj[key];
+  if (typeof value !== "string") fail(`${at}.${key} must be a string`);
+  return value;
+}
+function requireBool(obj, key, at) {
+  const value = obj[key];
+  if (typeof value !== "boolean") fail(`${at}.${key} must be a boolean`);
+  return value;
+}
+function optString(obj, key) {
+  const value = obj[key];
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "string") fail(`${key} must be a string when present`);
+  return value;
+}
+function optStringU(obj, key) {
+  const value = obj[key];
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "string") fail(`${key} must be a string when present`);
+  return value;
+}
+function optStringArrayU(obj, key, at) {
+  if (obj[key] === void 0 || obj[key] === null) return void 0;
+  return requireArray(obj, key, at).map((v, i) => {
+    if (typeof v !== "string") fail(`${at}.${key}[${i}] must be a string`);
+    return v;
+  });
+}
+function boolWithDefault(obj, key, at) {
+  const value = obj[key];
+  if (value === void 0) return false;
+  if (typeof value !== "boolean") fail(`${at}.${key} must be a boolean when present`);
+  return value;
+}
+function requireArray(obj, key, at) {
+  const value = obj[key];
+  if (!Array.isArray(value)) fail(`${at}.${key} must be an array`);
+  return value;
+}
+function stringArray(obj, key, at) {
+  if (obj[key] === void 0) return [];
+  return requireArray(obj, key, at).map((v, i) => {
+    if (typeof v !== "string") fail(`${at}.${key}[${i}] must be a string`);
+    return v;
+  });
+}
+function requireEnum(obj, key, at, allowed) {
+  const value = requireString(obj, key, at);
+  if (!allowed.includes(value)) {
+    fail(`${at}.${key} '${value}' is not one of: ${allowed.join(", ")}`);
+  }
+  return value;
+}
+function parseContextBinding(value, at) {
+  const obj = requireObject(value, at);
+  return {
+    project: requireString(obj, "project", at),
+    binding_mode: requireString(obj, "binding_mode", at),
+    // v0.3 fine-grained resolved binding; carried opaquely (not consumed by this back-end).
+    resolved: obj["resolved"]
+  };
+}
+function parseChecks(obj, at) {
+  if (obj["checks"] === void 0) return [];
+  return requireArray(obj, "checks", at).map((c, i) => {
+    const check = requireObject(c, `${at}.checks[${i}]`);
+    return {
+      predicate: requireString(check, "predicate", `${at}.checks[${i}]`),
+      outcome: requireString(check, "outcome", `${at}.checks[${i}]`)
+    };
+  });
+}
+function parseWhenGuard(value, at) {
+  const obj = requireObject(value, at);
+  return {
+    guard: requireString(obj, "guard", at),
+    target: requireString(obj, "target", at)
+  };
+}
+function parseLlmCall(value, at) {
+  const obj = requireObject(value, at);
+  const whenRaw = obj["when"];
+  return {
+    name: requireString(obj, "name", at),
+    tier: requireString(obj, "tier", at),
+    consumes: stringArray(obj, "consumes", at),
+    produces: optString(obj, "produces"),
+    prompt: requireString(obj, "prompt", at),
+    conditional: boolWithDefault(obj, "conditional", at),
+    when: whenRaw === void 0 || whenRaw === null ? null : parseWhenGuard(whenRaw, `${at}.when`)
+  };
+}
+function parseGuardrail(value, at) {
+  const obj = requireObject(value, at);
+  return {
+    name: requireString(obj, "name", at),
+    locked: requireBool(obj, "locked", at),
+    scope: optString(obj, "scope"),
+    threshold: obj["threshold"]
+  };
+}
+function parsePrecondition(value, at) {
+  const obj = requireObject(value, at);
+  const argsRaw = obj["args"];
+  const args = argsRaw === void 0 || argsRaw === null ? void 0 : requireObject(argsRaw, `${at}.args`);
+  return { predicate: requireString(obj, "predicate", at), args };
+}
+function parseParamSpec(value, at) {
+  const obj = requireObject(value, at);
+  return {
+    name: requireString(obj, "name", at),
+    bind: optStringU(obj, "bind"),
+    source: optStringU(obj, "source"),
+    default: obj["default"]
+  };
+}
+function parseEvalSpec(value, at) {
+  const obj = requireObject(value, at);
+  return {
+    template_ref: requireString(obj, "template_ref", at),
+    metrics: stringArray(obj, "metrics", at)
+  };
+}
+function preconditionArray(obj, key, at) {
+  if (obj[key] === void 0) return [];
+  return requireArray(obj, key, at).map((v, i) => parsePrecondition(v, `${at}.${key}[${i}]`));
+}
+function paramArray(obj, key, at) {
+  if (obj[key] === void 0) return [];
+  return requireArray(obj, key, at).map((v, i) => parseParamSpec(v, `${at}.${key}[${i}]`));
+}
+function parseRenderBlock(value, at) {
+  const obj = requireObject(value, at);
+  const fieldsRaw = obj["fields"];
+  const fields = {};
+  if (fieldsRaw !== void 0) {
+    const fieldsObj = requireObject(fieldsRaw, `${at}.fields`);
+    for (const [k, v] of Object.entries(fieldsObj)) {
+      if (typeof v !== "string") fail(`${at}.fields.${k} must be a string`);
+      fields[k] = v;
+    }
+  }
+  return { type: requireString(obj, "type", at), fields };
+}
+function parseOutcome(value, at) {
+  const obj = requireObject(value, at);
+  return {
+    kind: requireEnum(obj, "kind", at, OUTCOME_KINDS),
+    verdict_type: optStringU(obj, "verdict_type"),
+    emits: optStringArrayU(obj, "emits", at),
+    target: optStringU(obj, "target"),
+    change_type: optStringU(obj, "change_type"),
+    routable_scope: obj["routable_scope"]
+  };
+}
+function parseEffect(value, at) {
+  const obj = requireObject(value, at);
+  const blocks = obj["render_blocks"] === void 0 ? [] : requireArray(obj, "render_blocks", at).map(
+    (b, i) => parseRenderBlock(b, `${at}.render_blocks[${i}]`)
+  );
+  return {
+    render_blocks: blocks,
+    outcome: parseOutcome(obj["outcome"], `${at}.outcome`)
+  };
+}
+function parseComponent(value, at) {
+  const obj = requireObject(value, at);
+  const precondition = requireObject(obj["precondition_result"], `${at}.precondition_result`);
+  const trigger = requireObject(obj["trigger"], `${at}.trigger`);
+  return {
+    id: requireString(obj, "id", at),
+    verb: requireString(obj, "verb", at),
+    type: requireEnum(obj, "type", at, COMPONENT_TYPES),
+    realization_kind: requireEnum(obj, "realization_kind", at, REALIZATION_KINDS),
+    context_binding: parseContextBinding(obj["context_binding"], `${at}.context_binding`),
+    precondition_result: {
+      status: requireString(precondition, "status", `${at}.precondition_result`),
+      checks: parseChecks(precondition, `${at}.precondition_result`)
+    },
+    prompt_fragment: requireString(obj, "prompt_fragment", at),
+    llm_calls: requireArray(obj, "llm_calls", at).map(
+      (c, i) => parseLlmCall(c, `${at}.llm_calls[${i}]`)
+    ),
+    guardrails: requireArray(obj, "guardrails", at).map(
+      (g, i) => parseGuardrail(g, `${at}.guardrails[${i}]`)
+    ),
+    trigger: { kind: requireEnum(trigger, "kind", `${at}.trigger`, TRIGGER_KINDS) },
+    required_capabilities: stringArray(obj, "required_capabilities", at),
+    borrowed_actions: stringArray(obj, "borrowed_actions", at),
+    eval_ref: requireString(obj, "eval_ref", at),
+    effect: parseEffect(obj["effect"], `${at}.effect`),
+    context_requirements: stringArray(obj, "context_requirements", at),
+    context_precondition: preconditionArray(obj, "context_precondition", at),
+    params: paramArray(obj, "params", at),
+    eval: obj["eval"] === void 0 || obj["eval"] === null ? null : parseEvalSpec(obj["eval"], `${at}.eval`),
+    brief: optStringU(obj, "brief")
+  };
+}
+function parseIr(json2) {
+  let root;
+  try {
+    root = JSON.parse(json2);
+  } catch (e) {
+    fail(`not valid JSON: ${e.message}`);
+  }
+  const obj = requireObject(root, "<root>");
+  const version = requireString(obj, "warble_ir_version", "<root>");
+  assertSupportedIrVersion(version);
+  const configRaw = obj["config"];
+  const config = {};
+  if (configRaw !== void 0) {
+    requireObject(configRaw, "config");
+  }
+  return {
+    warble_ir_version: version,
+    profile: requireString(obj, "profile", "<root>"),
+    context_binding: parseContextBinding(obj["context_binding"], "context_binding"),
+    config,
+    components: requireArray(obj, "components", "<root>").map(
+      (c, i) => parseComponent(c, `components[${i}]`)
+    )
+  };
+}
+function distinctTiers(calls) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const call of calls) {
+    if (!seen.has(call.tier)) {
+      seen.add(call.tier);
+      out.push(call.tier);
+    }
+  }
+  return out;
+}
+
+// src/models.ts
+import { parse as parseYaml } from "yaml";
+var STRONG_TIER = "strong";
+var CHEAP_TIER = "cheap";
+var ORCHESTRATOR_TIER = "orchestrator";
+var ANTHROPIC_PROVIDER = "anthropic";
+var OPENAI_COMPAT_PROVIDER = "openai_compat";
+function anthropicBinding(model) {
+  return { provider: ANTHROPIC_PROVIDER, endpoint: null, model };
+}
+var ModelConfig = class _ModelConfig {
+  /** `[tier name, binding]` in declaration order (earliest = strongest). */
+  tiers;
+  constructor(tiers) {
+    this.tiers = tiers;
+  }
+  /** The Agent SDK defaults, matching the file target: strong→opus, cheap→haiku, orchestrator→sonnet. */
+  static default() {
+    return new _ModelConfig([
+      [STRONG_TIER, anthropicBinding("opus")],
+      [CHEAP_TIER, anthropicBinding("haiku")],
+      [ORCHESTRATOR_TIER, anthropicBinding("sonnet")]
+    ]);
+  }
+  /**
+   * Build from the inline `--strong/--cheap/--orchestrator` flags. Inline flags are always
+   * Anthropic-provider aliases — provider/endpoint routing is `--models-config` only, so a non-alias
+   * inline flag still loud-fails on the SDK split path (unchanged behavior).
+   */
+  static fromFlags(strong, cheap, orchestrator) {
+    return new _ModelConfig([
+      [STRONG_TIER, anthropicBinding(strong)],
+      [CHEAP_TIER, anthropicBinding(cheap)],
+      [ORCHESTRATOR_TIER, anthropicBinding(orchestrator)]
+    ]);
+  }
+  /**
+   * Parse a `--models-config` YAML document — the same shape the file target accepts. A tier value is
+   * EITHER a bare model-alias string (Anthropic shorthand) OR a `{ provider, endpoint?, model }` map:
+   *
+   * ```yaml
+   * tiers:
+   *   strong: opus                          # shorthand ⇒ provider: anthropic
+   *   cheap:                                # structured binding (docs/spec/capability-model.md §7.2)
+   *     provider: openai_compat
+   *     endpoint: http://localhost:11434/v1
+   *     model: qwen2.5
+   *   orchestrator: sonnet                  # reserved: the per-step-tier driver
+   * ```
+   */
+  static fromYaml(text) {
+    let doc;
+    try {
+      doc = parseYaml(text);
+    } catch (e) {
+      throw new DispatchError(`invalid models config: ${e.message}`);
+    }
+    if (typeof doc !== "object" || doc === null) {
+      throw new DispatchError("invalid models config: expected a mapping with a `tiers:` key");
+    }
+    const tiersRaw = doc["tiers"];
+    if (typeof tiersRaw !== "object" || tiersRaw === null || Array.isArray(tiersRaw)) {
+      throw new DispatchError("models config: `tiers` must be a mapping");
+    }
+    const tiers = [];
+    for (const [name, value] of Object.entries(tiersRaw)) {
+      tiers.push([name, parseTierValue(name, value)]);
+    }
+    if (tiers.length === 0) {
+      throw new DispatchError("models config: `tiers` must not be empty");
+    }
+    return new _ModelConfig(tiers);
+  }
+  bindingFor(tier) {
+    return this.tiers.find(([name]) => name === tier)?.[1];
+  }
+  /** Priority rank of a tier (declaration order); unknown tiers rank last. */
+  rank(tier) {
+    const idx = this.tiers.findIndex(([name]) => name === tier);
+    return idx === -1 ? Number.MAX_SAFE_INTEGER : idx;
+  }
+  tierNames() {
+    return this.tiers.map(([name]) => name).join(", ");
+  }
+  /** The model a tier maps to, or a loud-fail naming the undefined tier. */
+  require(tier) {
+    return this.binding(tier).model;
+  }
+  /**
+   * The full `{provider, endpoint, model}` binding a tier maps to (see docs/spec/capability-model.md
+   * §7.2), or a loud-fail.
+   * The per-step provider router (route.ts) reads this to send a step cloud-vs-local.
+   */
+  binding(tier) {
+    const b = this.bindingFor(tier);
+    if (b === void 0) {
+      throw new DispatchError(
+        `tier '${tier}' has no model binding \u2014 define it in --models-config or via --strong/--cheap (known tiers: ${this.tierNames()})`
+      );
+    }
+    return b;
+  }
+  /** The model for the reserved `orchestrator` tier, or a loud-fail if a config omitted it. */
+  orchestrator() {
+    return this.require(ORCHESTRATOR_TIER);
+  }
+  /** The model for a single collapsed call: the strongest (lowest-rank) tier among the calls. */
+  collapsedModel(calls) {
+    if (calls.length === 0) {
+      throw new DispatchError("component has no llm_calls; cannot select a model");
+    }
+    let strongest = calls[0];
+    for (const call of calls) {
+      if (this.rank(call.tier) < this.rank(strongest.tier)) strongest = call;
+    }
+    return this.require(strongest.tier);
+  }
+  /** Validate every step tier in the IR maps to a model (front-loaded so dispatch is infallible). */
+  validate(ir) {
+    const checked = /* @__PURE__ */ new Set();
+    for (const node of ir.components) {
+      for (const call of node.llm_calls) {
+        if (!checked.has(call.tier)) {
+          checked.add(call.tier);
+          this.require(call.tier);
+        }
+      }
+    }
+  }
+};
+function parseTierValue(name, value) {
+  if (typeof value === "string") {
+    return anthropicBinding(value);
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new DispatchError(
+      `models config: tier '${name}' must be a model-alias string or a {provider, endpoint?, model} map`
+    );
+  }
+  const map = value;
+  const model = map["model"];
+  if (typeof model !== "string") {
+    throw new DispatchError(`models config: tier '${name}' map is missing a string \`model\``);
+  }
+  const providerRaw = map["provider"];
+  let provider = ANTHROPIC_PROVIDER;
+  if (providerRaw !== void 0) {
+    if (typeof providerRaw !== "string") {
+      throw new DispatchError(`models config: tier '${name}' has a non-string \`provider\``);
+    }
+    provider = providerRaw;
+  }
+  const endpointRaw = map["endpoint"];
+  const endpoint = typeof endpointRaw === "string" ? endpointRaw : null;
+  if (provider === OPENAI_COMPAT_PROVIDER && endpoint === null) {
+    throw new DispatchError(
+      `models config: tier '${name}' uses provider openai_compat but has no \`endpoint\``
+    );
+  }
+  return { provider, endpoint, model };
+}
+
+// src/route.ts
+function resolveStagedSteps(node, models) {
+  return node.llm_calls.map((call) => {
+    const binding = models.binding(call.tier);
+    return {
+      name: call.name,
+      tier: call.tier,
+      provider: binding.provider,
+      endpoint: binding.endpoint,
+      model: binding.model,
+      consumes: call.consumes,
+      produces: call.produces,
+      prompt: call.prompt,
+      conditional: call.conditional,
+      when: call.when
+    };
+  });
+}
+function distinctProviders(steps) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const s of steps) {
+    if (!seen.has(s.provider)) {
+      seen.add(s.provider);
+      out.push(s.provider);
+    }
+  }
+  return out;
+}
+function usesLocalProvider(steps) {
+  return steps.some((s) => s.provider !== "anthropic");
+}
+function planProviderRouting(node, models, anthropicSplit) {
+  const steps = resolveStagedSteps(node, models);
+  const providers = distinctProviders(steps);
+  let mode;
+  if (usesLocalProvider(steps)) {
+    mode = "hybrid-staged";
+  } else if (anthropicSplit) {
+    mode = "sdk-split";
+  } else {
+    mode = "single";
+  }
+  return { mode, steps, providers };
+}
+function buildStepMessages(step, question, slots) {
+  const parts = [`Question: ${question}`];
+  for (const slot of step.consumes) {
+    const value = slots[slot];
+    parts.push(
+      value === void 0 ? `
+[input '${slot}' was not produced by an earlier step]` : `
+Input '${slot}':
+${value}`
+    );
+  }
+  return [
+    { role: "system", content: step.prompt },
+    { role: "user", content: parts.join("\n") }
+  ];
+}
+
+// src/targets.ts
+var DEFAULT_TARGET = "claude-agent-sdk:local";
+var KNOWN_TARGETS = ["claude-agent-sdk:local"];
+function isKnownTarget(value) {
+  return KNOWN_TARGETS.includes(value);
+}
+function knownTargetNames() {
+  return KNOWN_TARGETS;
+}
+function entry(outcome, via, provided_by, criticality, note) {
+  return { outcome, via, provided_by, criticality, note };
+}
+function localProfile() {
+  return {
+    "sql_execution:read_only": entry("native", "bash-wren", "runtime", "required", null),
+    genbi_build: entry("native", "bash-wren", "runtime", "required", null),
+    // Reading the semantic model's structure (models/metrics/lineage) is borrowed from the `wren`
+    // CLI (`wren context show`), same mechanism as sql_execution/genbi_build — realize-via bash-wren.
+    // Matches the file target's headless/interactive profiles (not a differentiator across back-ends).
+    semantic_introspection: entry("realize-via", "bash-wren", "runtime", "required", null),
+    // Reading bound-project raw material is natively available through the SDK's cwd-scoped Read
+    // tool. This does not grant Bash, network access, or writes; the read_only_execution guardrail
+    // still confines every filesystem access to the resolved project root.
+    raw_material_read: entry("native", "sdk-read", "runtime", "required", null),
+    // +Constitutive: reading the semantic model's structure to propose a context edit (models/
+    // metrics/knowledge) — realized the same way as semantic_introspection, via the `wren` CLI.
+    // Matches the file target (not a differentiator across back-ends).
+    schema_introspection: entry("realize-via", "bash-wren", "runtime", "required", null),
+    // genbi-setup: onboarding a NEW wren project (no pre-bound context yet). Realized the same way as
+    // the other `wren`-CLI-backed capabilities — bash-setup covers `wren` onboarding/context-build
+    // commands plus (under setup_execution's broadened Bash) connector CLIs like `dlt`. `required`,
+    // not safety-critical: unlike human_approval, a target without it should just wall-hit the
+    // specific setup component, not gate every other capability.
+    source_connect: entry("realize-via", "bash-setup", "runtime", "required", null),
+    context_build: entry("realize-via", "bash-setup", "runtime", "required", null),
+    "llm:strong": entry("native", null, "runtime", "required", null),
+    "llm:cheap": entry("native", null, "runtime", "required", null),
+    // The differentiator vs the file target: the SDK varies the model per call in-loop, so per-step
+    // tier is NATIVE here — no static subagent files, no isolated-invocation marshaling required.
+    "llm:per_step_tier": entry("native", "in-loop-model", "runtime", "required", null),
+    // Per-step PROVIDER routing (cloud+local mixed in one run) — the hybrid capability, distinct from
+    // per_step_tier (same-provider model selection). Warble realizes it two ways (WARBLE_HYBRID_MODE):
+    // `staged-executor` (the back-end drives the steps) or `in-process-mcp` (an orchestrator query()
+    // calls a dispatch_step tool). provided_by warble because Warble supplies the executor/tool; the
+    // model runtimes (Claude SDK loop, ollama) are borrowed.
+    "llm:per_step_provider": entry(
+      "realize-via",
+      "staged-executor|in-process-mcp",
+      "warble",
+      "required",
+      null
+    ),
+    // Reuse the Warble reference renderer (shell out to `warble render`) — realize-via, same
+    // deterministic HTML the file target produces.
+    render_contract: entry("realize-via", "warble-render", "runtime", "best-effort", null),
+    // Captured directly from the query() message stream (usage/cost per step) — no --output-format
+    // plumbing needed; it is inherent to the in-loop runtime.
+    structured_output_capture: entry("native", "message-stream", "runtime", "required", null),
+    // MVP is read-only, so no component requires approval; keep it a safety-critical loud-fail so a
+    // future mutating component targeting this profile fails loudly rather than running unapproved.
+    human_approval: entry(
+      "fail",
+      null,
+      "none",
+      "safety-critical",
+      "no approval channel wired for the programmatic local run in MVP"
+    ),
+    write_authz: entry("realize-via", "fs", "runtime", "safety-critical", null),
+    artifact_write: entry("realize-via", "fs", "runtime", "safety-critical", null),
+    // +Assertive borrows the scheduling / event / notify transports from the runtime (OS cron,
+    // pub/sub, MCP). The IR names the capability + criticality only; the mechanism is legalized here,
+    // never in the IR (capability-model §6/§7). A target with no mechanism wired keeps these `fail`.
+    scheduler: entry("realize-via", "os-cron", "runtime", "required", null),
+    event_bus: entry("realize-via", "pub-sub", "runtime", "required", null),
+    notify_channel: entry("realize-via", "mcp-notify", "runtime", "required", null),
+    blast_radius: entry(
+      "fail",
+      null,
+      "warble",
+      "safety-critical",
+      "requires fine_grained_binding"
+    ),
+    // +Mutating borrows checkpoint/rollback from version control (git), the same mechanism the
+    // workspace conventions already require before a mutating apply. This single SDK target has no
+    // human/approval channel wired (see human_approval/blast_radius above), so a mutating component
+    // that also requires those still correctly loud-fails here — version_control alone does not
+    // authorize the apply.
+    version_control: entry("realize-via", "git", "runtime", "required", null)
+  };
+}
+function profileFor(targetId) {
+  return isKnownTarget(targetId) ? localProfile() : null;
+}
+
+// src/options.ts
+var PER_STEP_PROVIDER_CAPABILITY = "llm:per_step_provider";
+var DEFAULT_RENDER_FLAVOR = "programmatic";
+function parseRenderFlavor(value) {
+  if (value === "programmatic" || value === "prompt") return value;
+  throw new DispatchError(
+    `unknown --render-flavor '${value}' (expected: programmatic, prompt)`
+  );
+}
+var DATA_ACCESS_CAPABILITIES = [
+  "sql_execution:read_only",
+  "genbi_build",
+  "semantic_introspection",
+  "schema_introspection",
+  // +Setup (genbi-setup): source_connect/context_build are realized via Bash (the `wren` CLI plus,
+  // under the setup_execution guardrail below, connector CLIs like `dlt`), so they grant Bash too.
+  "source_connect",
+  "context_build"
+];
+var READ_ONLY_GUARDRAIL_NAME = "read_only_execution";
+var ARTIFACT_WRITE_GUARDRAIL_NAME = "artifact_write";
+var SETUP_GUARDRAIL_NAME = "setup_execution";
+var RENDER_CONTRACT_CAPABILITY = "render_contract";
+var DEFAULT_ARTIFACT_SCOPE = ".";
+var DESTRUCTIVE_BASH_DENY = ["Bash(rm:*)", "Bash(sudo:*)", "Bash(dd:*)"];
+var DEFAULT_MAX_TURNS = 40;
+function unsupported(field, value) {
+  return new DispatchError(
+    `${field} '${value}' is not supported by the claude-agent-sdk:local target (wall-hit)`
+  );
+}
+function realizationSupported(node) {
+  return node.realization_kind === "skill" || node.realization_kind === "tool" || node.realization_kind === "gated-tool";
+}
+function triggerSupported(node) {
+  return node.trigger.kind === "one_shot" || node.trigger.kind === "scheduled";
+}
+function outcomeSupported(node) {
+  return node.effect.outcome.kind === "none" || node.effect.outcome.kind === "assertion" || node.effect.outcome.kind === "mutation";
+}
+function isAssertion(node) {
+  return node.effect.outcome.kind === "assertion";
+}
+function isMutation(node) {
+  return node.effect.outcome.kind === "mutation";
+}
+function hasDataAccess(caps) {
+  return caps.some((c) => DATA_ACCESS_CAPABILITIES.includes(c));
+}
+function isReadOnly(guardrails) {
+  return guardrails.some((g) => g.name === READ_ONLY_GUARDRAIL_NAME);
+}
+function isSetup(guardrails) {
+  return guardrails.some((g) => g.name === SETUP_GUARDRAIL_NAME);
+}
+function findGuardrail(guardrails, name) {
+  return guardrails.find((g) => g.name === name);
+}
+function computeSetupScope(guardrails) {
+  const g = findGuardrail(guardrails, SETUP_GUARDRAIL_NAME);
+  if (!g) return null;
+  return g.scope ?? DEFAULT_ARTIFACT_SCOPE;
+}
+function shouldSplitPerStepTier(node) {
+  return distinctTiers(node.llm_calls).length > 1;
+}
+function onFailureFor(criticality) {
+  return criticality === "best-effort" ? "degrade" : "fail";
+}
+function resolveRenderGate(node, report, flavor) {
+  const artifactWrite = findGuardrail(node.guardrails, ARTIFACT_WRITE_GUARDRAIL_NAME);
+  if (!artifactWrite || node.effect.render_blocks.length === 0) {
+    return { kind: "none", scope: null, flavor: null };
+  }
+  const renderEntry = report.find((r) => r.capability === RENDER_CONTRACT_CAPABILITY);
+  switch (renderEntry?.outcome) {
+    case "realize-via":
+      return {
+        kind: "realize",
+        scope: artifactWrite.scope ?? DEFAULT_ARTIFACT_SCOPE,
+        flavor,
+        onFailure: onFailureFor(renderEntry.criticality)
+      };
+    case "degrade":
+      return { kind: "degrade", scope: null, flavor: null };
+    default:
+      return { kind: "none", scope: null, flavor: null };
+  }
+}
+function gateGrantsWrite(gate) {
+  return gate.kind === "realize" && gate.flavor === "prompt";
+}
+function buildTools(node, gate) {
+  const dataAccess = hasDataAccess(node.required_capabilities);
+  const readOnly = isReadOnly(node.guardrails);
+  const setup = isSetup(node.guardrails);
+  const grantsWrite = gateGrantsWrite(gate);
+  const mutating = !readOnly;
+  const tools = ["Read"];
+  if (dataAccess) tools.push("Bash");
+  if (mutating) tools.push("Edit");
+  if (mutating || grantsWrite) tools.push("Write");
+  const allowedTools = ["Read"];
+  const disallowedTools = readOnly || setup ? [...DESTRUCTIVE_BASH_DENY] : [];
+  return { tools, allowedTools, disallowedTools };
+}
+var ENVELOPE_EXAMPLE = `\`\`\`json
+{
+  "blocks": [
+    { "type": "kpi_card", "label": "Total revenue", "value": 1672.4, "unit": "USD" },
+    { "type": "table", "columns": ["status", "orders"], "rows": [["completed", 67], ["shipped", 32]] },
+    { "type": "chart", "chart_type": "bar", "x": "status", "series": ["orders"],
+      "rows": [["completed", 67], ["shipped", 32]] },
+    { "type": "definition", "sql": "SELECT status, count(*) AS orders FROM orders GROUP BY status",
+      "source_tables": ["orders"], "filters": [] }
+  ],
+  "verified": true,
+  "summary": "One or two sentences of prose (optional)."
+}
+\`\`\``;
+var VERIFY_DEFINITION_CONTRACT = 'Before you answer you MUST verify (per-answer verify, required): actually execute the query through `wren`, then validate the result set is legitimate (non-empty where a value is expected, types/units sane, grain matches the question). If it is not, repair the query and re-run; if it still cannot be validated, REFUSE \u2014 say so plainly and do not fabricate a number. Set the envelope\'s top-level `"verified": true` ONLY when a query ran and its result set passed validation. Always include one `definition` block \u2014 the shallow "how this was computed" card: the exact `sql` you ran, the `source_tables` it read, and the `filters` you applied. This is run-level provenance only; do not invent unit/owner/formal-metric lineage (that is Phase 2).';
+function formatRenderBlock(block) {
+  const fields = Object.entries(block.fields).map(([k, v]) => `${k}: ${v}`).join(", ");
+  return `- \`${block.type}\`: { ${fields} }`;
+}
+function buildProgrammaticRenderSection(node) {
+  return [
+    "## Render output",
+    "",
+    "Block contract (produce data matching these shapes, not prose):",
+    "",
+    ...node.effect.render_blocks.map(formatRenderBlock),
+    "",
+    "Do NOT write any files and do NOT format the answer as prose or markdown. After gathering the data via `wren`, your FINAL message must be a SINGLE JSON object \u2014 the render envelope \u2014 and nothing else: a `blocks` array of instances conforming to the contract above, plus an optional `summary` string. A downstream renderer turns this envelope into the dashboard deterministically; you stay read-only.",
+    "",
+    VERIFY_DEFINITION_CONTRACT,
+    "",
+    "Envelope shape:",
+    "",
+    ENVELOPE_EXAMPLE
+  ].join("\n");
+}
+function buildPromptRenderSection(node, gate) {
+  const scope = gate.scope ?? DEFAULT_ARTIFACT_SCOPE;
+  return [
+    "## Render output",
+    "",
+    "Block contract (produce data matching these shapes, not prose):",
+    "",
+    ...node.effect.render_blocks.map(formatRenderBlock),
+    "",
+    `After gathering the data via \`wren\`, write a SINGLE self-contained \`dashboard.html\` file into the artifact-write scope directory (\`${scope}\`), rendering the blocks above: KPI cards, an HTML table, and a simple chart (inline SVG or a CDN-loaded chart library \u2014 no build step). Also render a \`\u2713 Verified\` pill next to the title and a "how this was computed" definition panel (the SQL you ran, source tables, filters). End your reply stating the path of the file you wrote.`,
+    "",
+    VERIFY_DEFINITION_CONTRACT
+  ].join("\n");
+}
+function buildRenderSection(node, gate) {
+  switch (gate.kind) {
+    case "realize":
+      return gate.flavor === "prompt" ? buildPromptRenderSection(node, gate) : buildProgrammaticRenderSection(node);
+    case "degrade":
+      return [
+        "## Render output",
+        "",
+        "This target has no artifact-write surface for render output: render the results as a markdown table plus a short prose summary instead. Do not write any files."
+      ].join("\n");
+    case "none":
+      return null;
+  }
+}
+var VERDICT_ENVELOPE_EXAMPLE = `\`\`\`json
+{
+  "blocks": [
+    { "type": "status", "state": "stale", "label": "orders freshness",
+      "detail": "max(order_date) is 51h old; expected within 24h", "severity": "critical" }
+  ],
+  "verdict": { "type": "freshness_verdict", "fresh": false, "observed_lag_hours": 51, "expected_cadence": "24h" },
+  "emitted": ["freshness_breach"],
+  "verified": true
+}
+\`\`\``;
+function buildAssertionSection(node) {
+  const outcome = node.effect.outcome;
+  const verdictType = outcome.verdict_type ?? "verdict";
+  const emits = outcome.emits ?? [];
+  const actions = node.borrowed_actions.length > 0 ? node.borrowed_actions.map((a) => `\`${a}\``).join(", ") : "a runtime notify channel";
+  const emitsLine = emits.length === 0 ? "This assertion emits no signals." : `On breach, list the emitted signal name(s) in the envelope's \`emitted\` array: [${emits.map((e) => `\`${e}\``).join(", ")}]. The runtime routes those signals to the borrowed on-breach actions (${actions}) over the notify channel \u2014 Warble declares the wiring (signal \u2194 action); the transport (Slack / Jira / MCP) is borrowed, not owned by this agent.`;
+  return [
+    "## Assertion output",
+    "",
+    `This is an **assertive** component (outcome: assertion, verdict_type \`${verdictType}\`). Its core is a DETERMINISTIC check, not a judgment call: run the freshness assert through \`wren\` \u2014 \`SELECT max(<timestamp column>)\` on the bound model \u2014 and compare the observed lag against the expected cadence (\`expected_cadence\` param, or the MDL's declared cadence). Fresh iff the newest row is within the cadence; stale otherwise. Do NOT ask an LLM to decide fresh-vs-stale \u2014 that is a SQL comparison and must be reproducible.`,
+    "",
+    "Only when the data is STALE do you use judgment, via the `assess_severity` step, to classify how bad it is (e.g. warn vs critical) from the lag magnitude and history. When fresh, there is no severity to assess.",
+    "",
+    "Verdict block contract (produce data matching these shapes, not prose):",
+    "",
+    ...node.effect.render_blocks.map(formatRenderBlock),
+    "",
+    'Stay strictly read-only: only `SELECT` through `wren`, never write to the warehouse and never write any files. Your FINAL message MUST be a SINGLE JSON object \u2014 the verdict envelope \u2014 and nothing else: a `blocks` array (the `status` block above), a `verdict` object (`{ type, fresh, ... }`), and, on breach, an `emitted` array. A downstream renderer turns the `status` block into HTML deterministically; you stay read-only. Set the top-level `"verified": true` only when the assert query actually ran and its result was validated.',
+    "",
+    emitsLine,
+    "",
+    "Envelope shape:",
+    "",
+    VERDICT_ENVELOPE_EXAMPLE
+  ].join("\n");
+}
+var MUTATION_DIFF_ENVELOPE_EXAMPLE = `\`\`\`json
+{
+  "blocks": [
+    { "type": "diff", "target": "models/orders.yml", "change_type": "update",
+      "diff": "--- a/models/orders.yml\\n+++ b/models/orders.yml\\n@@ -3,1 +3,1 @@\\n- grain: order_id\\n+ grain: order_id, order_date" }
+  ],
+  "blast_radius": { "downstream_nodes": ["metric:total_revenue"], "protected_hit": false },
+  "applied": false,
+  "verified": true
+}
+\`\`\``;
+var CONTEXT_MUTATION_DIFF_ENVELOPE_EXAMPLE = `\`\`\`json
+{
+  "blocks": [
+    { "type": "diff", "target": "models/orders.yml", "change_type": "mdl_bootstrap",
+      "diff": "--- a/models/orders.yml\\n+++ b/models/orders.yml\\n@@ -3,1 +3,1 @@\\n- grain: order_id\\n+ grain: order_id, order_date" }
+  ],
+  "applied": false,
+  "verified": true
+}
+\`\`\``;
+function buildContextMutationSection(node) {
+  const outcome = node.effect.outcome;
+  const target = outcome.target ?? "the bound node";
+  const changeType = outcome.change_type ?? "update";
+  const contextGuardrail = findGuardrail(node.guardrails, "context_write_authz");
+  const scope = contextGuardrail?.scope ?? DEFAULT_ARTIFACT_SCOPE;
+  return [
+    "## Mutation output",
+    "",
+    `This is a **constitutive** component (outcome: mutation, target \`${target}\`, change_type \`${changeType}\`). It runs the same two-phase gated lifecycle as any mutating component, never a direct write:`,
+    "",
+    '1. **Dry-run first (must_dry_run).** Propose the edit as a DIFF only \u2014 do not apply it. Your first-phase FINAL message must be a single JSON envelope carrying a `diff` block (the exact unified diff you intend to apply) and `"applied": false`. Never write to the target file in this phase.',
+    "",
+    `2. **Context-write gate (context_write_authz, locked, scope \`${scope}\`).** This is a scoped PATH-AUTHORIZATION check, NOT a downstream-lineage impact computation \u2014 the proposed write must resolve to a path inside the \`${scope}\` scope (the models/metrics/knowledge structure this component owns) or it is denied outright. Writing outside this scope is never permitted, however small the change.`,
+    "",
+    "3. **Human approval (human_approval, locked).** Applying the diff is gated on explicit approval delivered over the runtime's approval channel. On a target with no human/approval channel wired, this component cannot run past the dry-run phase \u2014 that is the honest capability edge, not a bug to route around.",
+    "",
+    '4. **Apply + rollback (rollback_available).** Only apply after approval clears. A git checkpoint is taken first so the apply can be rolled back; rollback is BORROWED from version control, not owned by this agent. After applying, set `"applied": true` in your final envelope.',
+    "",
+    "Diff block contract (produce data matching this shape, not prose):",
+    "",
+    ...node.effect.render_blocks.map(formatRenderBlock),
+    "",
+    'Your FINAL message at each phase MUST be a SINGLE JSON object \u2014 the mutation envelope \u2014 and nothing else: a `blocks` array (the `diff` block above) and "applied" (`false` on the dry-run, `true` only after a real apply). Set the top-level "verified": true only when the diff was actually computed against the live target (never fabricated).',
+    "",
+    "Envelope shape:",
+    "",
+    CONTEXT_MUTATION_DIFF_ENVELOPE_EXAMPLE
+  ].join("\n");
+}
+function buildMutationSection(node) {
+  const outcome = node.effect.outcome;
+  if (outcome.target === "context") {
+    return buildContextMutationSection(node);
+  }
+  const target = outcome.target ?? "the bound node";
+  const changeType = outcome.change_type ?? "update";
+  return [
+    "## Mutation output",
+    "",
+    `This is a **mutating** component (outcome: mutation, target \`${target}\`, change_type \`${changeType}\`). It runs a two-phase gated lifecycle, never a direct write:`,
+    "",
+    '1. **Dry-run first (must_dry_run).** Propose the edit as a DIFF only \u2014 do not apply it. Your first-phase FINAL message must be a single JSON envelope carrying a `diff` block (the exact unified diff you intend to apply) and `"applied": false`. Never write to the target file or the warehouse in this phase.',
+    "",
+    "2. **Blast-radius gate (blast_radius_limit).** The downstream impact of the edited node is computed from Warble's `blast_radius` over the MDL lineage graph, not by you. An empty radius auto-allows; exceeding the guardrail's threshold escalates to human approval; touching a protected asset blocks outright. Report the affected downstream nodes you are aware of in the envelope's `blast_radius` field, but the gate decision itself is made by the runtime, not by your judgment.",
+    "",
+    "3. **Human approval (human_approval, locked).** Applying the diff is gated on explicit approval delivered over the runtime's approval channel. On a target with no human/approval channel wired, this component cannot run past the dry-run phase \u2014 that is the honest capability edge, not a bug to route around.",
+    "",
+    '4. **Apply + rollback (rollback_available).** Only apply after approval clears. A git checkpoint is taken first so the apply can be rolled back; rollback is BORROWED from version control, not owned by this agent. After applying, set `"applied": true` in your final envelope.',
+    "",
+    "Diff block contract (produce data matching this shape, not prose):",
+    "",
+    ...node.effect.render_blocks.map(formatRenderBlock),
+    "",
+    'Your FINAL message at each phase MUST be a SINGLE JSON object \u2014 the mutation envelope \u2014 and nothing else: a `blocks` array (the `diff` block above), a `blast_radius` object, and `"applied"` (`false` on the dry-run, `true` only after a real apply). Set the top-level `"verified": true` only when the diff was actually computed against the live target (never fabricated).',
+    "",
+    "Envelope shape:",
+    "",
+    MUTATION_DIFF_ENVELOPE_EXAMPLE
+  ].join("\n");
+}
+function buildPreamble(cwd) {
+  return [
+    `You are bound to the wren project at \`${cwd}\` (your working directory).`,
+    "All data access MUST go through the `wren` CLI (e.g. `wren --sql ...`, `wren cube list`, `wren genbi build ...`) \u2014 never raw SQL clients, never filesystem tricks against the underlying warehouse."
+  ].join("\n");
+}
+function toAgentModel(model) {
+  if (model === "sonnet" || model === "opus" || model === "haiku" || model === "inherit") {
+    return model;
+  }
+  throw new DispatchError(
+    `per-step-tier realization on claude-agent-sdk:local requires each tier's model to be one of sonnet|opus|haiku|inherit (SDK agents[].model is a restricted alias union), but got '${model}'. Use those aliases in --models-config, or the single-tier collapse path.`
+  );
+}
+function subagentName(verb, callName) {
+  return `${verb}__${callName}`;
+}
+function buildDriverBody(node) {
+  const producers = /* @__PURE__ */ new Map();
+  for (const call of node.llm_calls) {
+    if (call.produces) producers.set(call.produces, call.name);
+  }
+  const steps = node.llm_calls.map((call, i) => {
+    const parts = [
+      `Run the \`${subagentName(node.verb, call.name)}\` subagent (step \`${call.name}\`) via the Task tool.`
+    ];
+    if (call.consumes.length > 0) {
+      const sources = call.consumes.map((slot) => {
+        const producer = producers.get(slot);
+        return producer ? `\`${slot}\` (the \`${producer}\` subagent's output)` : `\`${slot}\``;
+      }).join(", ");
+      parts.push(`Pass it ${sources} as input.`);
+    }
+    if (call.produces) parts.push(`Take its output as \`${call.produces}\` for the steps after it.`);
+    return `${i + 1}. ${parts.join(" ")}`;
+  });
+  return [
+    `You orchestrate the \`${node.verb}\` steps by delegating each one to its dedicated subagent via the Task tool, in order. Do not perform a step's work yourself \u2014 each step's tier-appropriate subagent does it.`,
+    "",
+    "Steps, in order:",
+    "",
+    ...steps,
+    "",
+    "Marshal each subagent's declared output into the next subagent's declared input exactly as named above; do not invent or rename slots."
+  ].join("\n");
+}
+function buildAgents(node, gate, models) {
+  const agents = {};
+  const noGate = { kind: "none", scope: null, flavor: null };
+  const subTools = buildTools(node, noGate);
+  for (const call of node.llm_calls) {
+    const ioNote = `
+
+(consumes [${call.consumes.join(", ")}] / produces ${call.produces ?? "(none)"})`;
+    const prompt = node.brief ? `${node.brief}
+
+${call.prompt}` : call.prompt;
+    agents[subagentName(node.verb, call.name)] = {
+      description: `'${call.name}' step of ${node.verb} (tier: ${call.tier}).`,
+      prompt: prompt + ioNote,
+      tools: subTools.tools,
+      model: toAgentModel(models.require(call.tier))
+    };
+  }
+  return agents;
+}
+function tierCollapseNote(node, model) {
+  const tiers = distinctTiers(node.llm_calls);
+  if (tiers.length <= 1) return null;
+  const steps = node.llm_calls.map((c) => `${c.name}=${c.tier}`).join(", ");
+  return `per-step tiers [${steps}] collapsed to single model '${model}'`;
+}
+function buildDispatchPlan(node, report, cfg) {
+  if (!realizationSupported(node)) {
+    throw unsupported("realization_kind", node.realization_kind);
+  }
+  if (!triggerSupported(node)) {
+    throw unsupported("trigger.kind", node.trigger.kind);
+  }
+  if (!outcomeSupported(node)) {
+    throw unsupported("outcome.kind", node.effect.outcome.kind);
+  }
+  const gate = resolveRenderGate(node, report, cfg.flavor);
+  const readOnly = isReadOnly(node.guardrails);
+  const setupScope = computeSetupScope(node.guardrails);
+  const permissionMode = "default";
+  const maxTurns = cfg.maxTurns ?? DEFAULT_MAX_TURNS;
+  const renderSection = buildRenderSection(node, gate);
+  const assertionSection = isAssertion(node) ? buildAssertionSection(node) : null;
+  const mutationSection = isMutation(node) ? buildMutationSection(node) : null;
+  const split = shouldSplitPerStepTier(node);
+  if (node.realization_kind === "gated-tool" && split) {
+    throw new DispatchError(
+      `llm:per_step_tier: gated-tool component '${node.verb}' has divergent step tiers, but per-step splitting would grant every subagent the mutation guardrail's write/edit authority alongside the approval-gated driver, duplicating write access outside the two-phase approval lifecycle (dry-run diff -> blast-radius -> human approval -> apply) \u2014 refusing to dispatch rather than silently collapsing the tiers or unsafely splitting write authority. Realize this component as \`tool\` (no approval gate) or \`skill\` to enable per-step-tier splitting, or author it with a single tier to keep it a \`gated-tool\`.`
+    );
+  }
+  const routing = planProviderRouting(node, cfg.models, split);
+  const base = {
+    cwd: cfg.cwd,
+    permissionMode,
+    maxTurns
+    // SDK isolation: do NOT load ambient ~/.claude or project .claude settings, so nothing outside
+    // this plan can widen the tool allowlist. wren strict_mode is read by the wren CLI itself.
+    // (settingSources omitted == isolation mode.)
+  };
+  if (routing.mode === "hybrid-staged") {
+    return buildHybridStagedPlan(node, gate, cfg, base, readOnly, routing.providers, routing.steps);
+  }
+  if (split) {
+    const agents = buildAgents(node, gate, cfg.models);
+    const driverTools = hasDataAccess(node.required_capabilities) ? ["Task", "Read", "Bash"] : ["Task", "Read"];
+    if (gateGrantsWrite(gate)) driverTools.push("Write");
+    const driverPrompt = [
+      buildPreamble(cfg.cwd),
+      "",
+      ...node.brief ? [node.brief, ""] : [],
+      buildDriverBody(node),
+      ...renderSection ? [
+        "",
+        "You collect the subagents' output and produce the render output yourself (the subagents never do).",
+        "",
+        renderSection
+      ] : [
+        "",
+        // No render section (e.g. answer_query): the final step already produced the user-facing
+        // structured answer — including its `verified` facet and shallow `definition` (G2/G3).
+        // Pass it through verbatim; do NOT re-prose or drop those fields, or the ✓ Verified cue
+        // and definition card are lost on the way out.
+        "Your FINAL message MUST be the terminal step's structured output verbatim \u2014 a single JSON object with its `columns`/`rows` (or refusal) plus the `verified` boolean and the shallow `definition` it emitted. Do not summarize it into prose or drop any field."
+      ],
+      ...assertionSection ? ["", assertionSection] : [],
+      ...mutationSection ? ["", mutationSection] : []
+    ].join("\n");
+    const subagentModels = {};
+    for (const call of node.llm_calls) {
+      subagentModels[subagentName(node.verb, call.name)] = cfg.models.require(call.tier);
+    }
+    const options2 = {
+      ...base,
+      model: cfg.models.orchestrator(),
+      systemPrompt: driverPrompt,
+      agents,
+      tools: driverTools,
+      allowedTools: ["Read", "Task"],
+      disallowedTools: readOnly ? [...DESTRUCTIVE_BASH_DENY] : []
+    };
+    return {
+      prompt: cfg.question,
+      options: options2,
+      meta: {
+        verb: node.verb,
+        target: cfg.target,
+        readOnly,
+        split: true,
+        render: gate,
+        assertion: isAssertion(node),
+        mutation: isMutation(node),
+        model: cfg.models.orchestrator(),
+        subagentModels,
+        tierCollapseNote: null,
+        mode: "sdk-split",
+        providers: ["anthropic"],
+        stagedSteps: [],
+        setupScope
+      }
+    };
+  }
+  const model = cfg.models.collapsedModel(node.llm_calls);
+  const toolPlan = buildTools(node, gate);
+  const systemPrompt = [
+    buildPreamble(cfg.cwd),
+    "",
+    ...node.brief ? [node.brief, ""] : [],
+    node.prompt_fragment,
+    ...renderSection ? ["", renderSection] : [],
+    ...assertionSection ? ["", assertionSection] : [],
+    ...mutationSection ? ["", mutationSection] : []
+  ].join("\n");
+  const options = {
+    ...base,
+    model,
+    systemPrompt,
+    tools: toolPlan.tools,
+    allowedTools: toolPlan.allowedTools,
+    disallowedTools: toolPlan.disallowedTools
+  };
+  return {
+    prompt: cfg.question,
+    options,
+    meta: {
+      verb: node.verb,
+      target: cfg.target,
+      readOnly,
+      split: false,
+      render: gate,
+      assertion: isAssertion(node),
+      mutation: isMutation(node),
+      model,
+      subagentModels: {},
+      tierCollapseNote: tierCollapseNote(node, model),
+      mode: "single",
+      providers: ["anthropic"],
+      stagedSteps: [],
+      setupScope
+    }
+  };
+}
+function buildHybridStagedPlan(node, gate, cfg, base, readOnly, providers, steps) {
+  const perStepProvider = profileFor(cfg.target)?.[PER_STEP_PROVIDER_CAPABILITY];
+  if (!perStepProvider || perStepProvider.outcome === "fail") {
+    throw new DispatchError(
+      `${PER_STEP_PROVIDER_CAPABILITY}: fail on ${cfg.target} \u2014 the binding routes a step to a non-Anthropic provider (${providers.filter((p) => p !== "anthropic").join(", ")}), but this target does not support per-step provider routing (hybrid). Use an all-cloud binding, or a target that realizes ${PER_STEP_PROVIDER_CAPABILITY}.`
+    );
+  }
+  if (gate.kind !== "none") {
+    throw new DispatchError(
+      `hybrid-staged provider routing does not yet realize a '${gate.kind}' render gate on ${cfg.target} (wall-hit); the POC covers render-none components like answer_query. Bind this component all-cloud, or extend the staged executor's render handling.`
+    );
+  }
+  const toolPlan = buildTools(node, gate);
+  let driverModel;
+  try {
+    driverModel = cfg.models.orchestrator();
+  } catch {
+    driverModel = cfg.models.collapsedModel(node.llm_calls);
+  }
+  const options = {
+    ...base,
+    model: driverModel,
+    tools: toolPlan.tools,
+    allowedTools: toolPlan.allowedTools,
+    disallowedTools: toolPlan.disallowedTools
+  };
+  return {
+    // The staged executor assembles each step's prompt from `meta.stagedSteps`; the top-level prompt is
+    // the raw question (marshaled per step by run.ts).
+    prompt: cfg.question,
+    options,
+    meta: {
+      verb: node.verb,
+      target: cfg.target,
+      readOnly,
+      assertion: isAssertion(node),
+      mutation: isMutation(node),
+      split: false,
+      render: gate,
+      model: `hybrid-staged(${providers.join("+")})`,
+      subagentModels: {},
+      tierCollapseNote: null,
+      mode: "hybrid-staged",
+      providers,
+      stagedSteps: steps,
+      // Hybrid+setup is out of scope (locked decision): a setup component's steps are not staged
+      // across providers, so this path never sees setup_execution in practice; null is the safe,
+      // explicit default rather than silently inheriting a scope this path doesn't enforce.
+      setupScope: null
+    }
+  };
+}
+
+// src/resolve.ts
+function unknownCapabilityEntry() {
+  return {
+    outcome: "fail",
+    via: null,
+    provided_by: "none",
+    criticality: "safety-critical",
+    note: "capability is not declared in the target's capability profile \u2014 unknown means it cannot be guaranteed"
+  };
+}
+function impliedCapabilities(node) {
+  const implied = [];
+  if (distinctTiers(node.llm_calls).length > 1) {
+    implied.push("llm:per_step_tier");
+  }
+  switch (node.trigger.kind) {
+    case "scheduled":
+      implied.push("scheduler");
+      break;
+    case "event":
+      implied.push("event_bus");
+      break;
+    case "one_shot":
+      break;
+  }
+  if ((node.effect.outcome.emits?.length ?? 0) > 0) {
+    implied.push("event_bus");
+  }
+  if (node.effect.render_blocks.length > 0) {
+    implied.push("render_contract");
+  }
+  if (node.effect.outcome.kind === "mutation") {
+    implied.push("version_control");
+    if (node.effect.outcome.target === "context") {
+      implied.push("context_write_authz");
+    } else {
+      implied.push("write_authz");
+    }
+  }
+  return implied;
+}
+function collectRequiredCapabilities(node) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const cap of [...node.required_capabilities, ...impliedCapabilities(node)]) {
+    if (!seen.has(cap)) {
+      seen.add(cap);
+      out.push(cap);
+    }
+  }
+  return out;
+}
+function inspectCapabilities(node, targetId, profile) {
+  const fallback = unknownCapabilityEntry();
+  const report = collectRequiredCapabilities(node).map((capability) => {
+    const e = profile[capability] ?? fallback;
+    const resolved = {
+      capability,
+      outcome: e.outcome,
+      provided_by: e.provided_by,
+      criticality: e.criticality
+    };
+    if (e.note !== null) resolved.note = e.note;
+    return resolved;
+  });
+  return report;
+}
+function assertNoFailedCapabilities(report, targetId, verb) {
+  const failed = report.find((r) => r.outcome === "fail");
+  if (failed) {
+    const reason = failed.note ?? "unsupported on this target";
+    throw new DispatchError(
+      `${failed.capability}: fail on ${targetId} (${reason}) \u2014 component '${verb}' cannot be dispatched`
+    );
+  }
+}
+function resolveCapabilities(node, targetId, profile) {
+  const report = inspectCapabilities(node, targetId, profile);
+  assertNoFailedCapabilities(report, targetId, node.verb);
+  return report;
+}
+function resolveNodeCapabilities(node, targetId) {
+  if (!isKnownTarget(targetId)) {
+    throw new DispatchError(
+      `target '${targetId}' has no capability profile (known targets: ${knownTargetNames().join(", ")})`
+    );
+  }
+  return resolveCapabilities(node, targetId, localProfile());
+}
+function inspectNodeCapabilities(node, targetId) {
+  if (!isKnownTarget(targetId)) {
+    throw new DispatchError(
+      `target '${targetId}' has no capability profile (known targets: ${knownTargetNames().join(", ")})`
+    );
+  }
+  return inspectCapabilities(node, targetId, localProfile());
+}
+
+// src/guardrails.ts
+import { resolve as resolvePath, sep as pathSep } from "path";
+function withinScope(abs, scopeAbs) {
+  return abs === scopeAbs || abs.startsWith(scopeAbs.endsWith(pathSep) ? scopeAbs : scopeAbs + pathSep);
+}
+var DESTRUCTIVE = /\b(rm|sudo|dd|mkfs|shutdown|reboot|kill|chmod|chown|mv|cp)\b/;
+var REDIRECTION = /(^|[^>])>>?[^>]/;
+var DOTENV_READER_COMMANDS = /\b(cat|head|tail|less|more|od|xxd|strings|grep|awk|sed)\b/;
+var DOTENV_PATH = /(^|[\s"'/=])\.env(\.[\w.-]+)?(?=$|[\s"'/])/;
+function referencesDotenvPath(text) {
+  return DOTENV_PATH.test(text);
+}
+function firstToken(command) {
+  return command.trim().split(/\s+/)[0] ?? "";
+}
+function allow(input) {
+  return { behavior: "allow", updatedInput: input };
+}
+function deny(message) {
+  return { behavior: "deny", message };
+}
+function makeSetupReadDenyHook(cfg, denials) {
+  if (cfg.setupScope == null) return [];
+  return [
+    {
+      matcher: "Read",
+      hooks: [
+        async (input) => {
+          if (input.hook_event_name !== "PreToolUse") return { continue: true };
+          const toolInput = input.tool_input;
+          const target = toolInput != null && typeof toolInput["file_path"] === "string" ? toolInput["file_path"] : "";
+          if (!referencesDotenvPath(target)) return { continue: true };
+          const reason = "reading a dotenv path via Read is blocked by the read_only_execution guardrail; the setup credential design writes an empty .env template and is never meant to read it back.";
+          denials.push({ tool: "Read", reason, command: target });
+          return {
+            continue: false,
+            decision: "block",
+            reason,
+            hookSpecificOutput: {
+              hookEventName: "PreToolUse",
+              permissionDecision: "deny",
+              permissionDecisionReason: reason
+            }
+          };
+        }
+      ]
+    }
+  ];
+}
+function makeReadOnlyGuard(cfg) {
+  const denials = [];
+  const hooks = makeSetupReadDenyHook(cfg, denials);
+  const canUseTool = async (toolName, input) => {
+    if (toolName === "Read") {
+      if (cfg.setupScope != null) {
+        const target = typeof input["file_path"] === "string" ? input["file_path"] : "";
+        if (referencesDotenvPath(target)) {
+          const reason2 = "reading a dotenv path via Read is blocked by the read_only_execution guardrail; the setup credential design writes an empty .env template and is never meant to read it back.";
+          denials.push({ tool: "Read", reason: reason2, command: target });
+          return deny(reason2);
+        }
+      }
+      return allow(input);
+    }
+    if (toolName === "Task" || toolName === "TodoWrite") {
+      return allow(input);
+    }
+    if (toolName === "Bash") {
+      const command = typeof input["command"] === "string" ? input["command"] : "";
+      if (DOTENV_READER_COMMANDS.test(command) && referencesDotenvPath(command)) {
+        const reason2 = "reading a dotenv file's contents is blocked by the read_only_execution guardrail; the setup credential design writes an empty .env template and is never meant to read it back.";
+        denials.push({ tool: "Bash", reason: reason2, command });
+        return deny(reason2);
+      }
+      if (DESTRUCTIVE.test(command) || REDIRECTION.test(command)) {
+        const reason2 = "destructive or file-writing bash is blocked by the read_only_execution guardrail; all data access must go through the read-only `wren` CLI.";
+        denials.push({ tool: "Bash", reason: reason2, command });
+        return deny(reason2);
+      }
+      if (cfg.setupScope != null) return allow(input);
+      if (firstToken(command) !== "wren") {
+        const reason2 = "only `wren` CLI invocations are permitted (data access goes through the semantic layer); this command is blocked by the read_only_execution guardrail.";
+        denials.push({ tool: "Bash", reason: reason2, command });
+        return deny(reason2);
+      }
+      return allow(input);
+    }
+    if (toolName === "Write" || toolName === "Edit") {
+      if (cfg.mutation) {
+        if (cfg.mutation.contextScope) {
+          const target = typeof input["file_path"] === "string" ? input["file_path"] : "";
+          const abs = resolvePath(cfg.cwd, target);
+          const scopeAbs = resolvePath(cfg.cwd, cfg.mutation.contextScope);
+          if (!withinScope(abs, scopeAbs)) {
+            const reason5 = `write to '${target}' is outside the context_write_authz scope '${cfg.mutation.contextScope}'.`;
+            denials.push({ tool: toolName, reason: reason5, command: target });
+            return deny(reason5);
+          }
+          const gate2 = cfg.mutation.approvalRequired ? "human approval" : "the must_dry_run gate";
+          const reason4 = `${toolName} is inside the context_write_authz scope '${cfg.mutation.contextScope}', but the apply still requires ${gate2} to clear first; that approval is borrowed from the SDK embedder's own canUseTool/approval channel, which this guard does not provide, so it denies by default (fail-closed).`;
+          denials.push({ tool: toolName, reason: reason4, command: target });
+          return deny(reason4);
+        }
+        const gate = cfg.mutation.approvalRequired ? "human approval" : "the must_dry_run gate";
+        const reason3 = `${toolName} is the gated apply of a mutating component and requires ${gate} to clear first; that approval is borrowed from the SDK embedder's own canUseTool/approval channel, which this guard does not provide, so it denies by default (fail-closed).`;
+        denials.push({ tool: toolName, reason: reason3 });
+        return deny(reason3);
+      }
+      if (cfg.setupScope != null) {
+        const target = typeof input["file_path"] === "string" ? input["file_path"] : "";
+        const abs = resolvePath(cfg.cwd, target);
+        const scopeAbs = resolvePath(cfg.cwd, cfg.setupScope);
+        if (withinScope(abs, scopeAbs)) return allow(input);
+        const reason3 = `write to '${target}' is outside the setup project-root scope '${cfg.setupScope}'.`;
+        denials.push({ tool: toolName, reason: reason3, command: target });
+        return deny(reason3);
+      }
+      if (cfg.writeScope) {
+        const target = typeof input["file_path"] === "string" ? input["file_path"] : "";
+        const abs = resolvePath(cfg.cwd, target);
+        const scopeAbs = resolvePath(cfg.cwd, cfg.writeScope);
+        if (withinScope(abs, scopeAbs)) return allow(input);
+        const reason3 = `write to '${target}' is outside the permitted artifact scope '${cfg.writeScope}'.`;
+        denials.push({ tool: toolName, reason: reason3, command: target });
+        return deny(reason3);
+      }
+      const reason2 = `${toolName} is blocked: this component is read-only (programmatic render flavor keeps the agent from writing files; the dispatcher renders the dashboard from your envelope).`;
+      denials.push({ tool: toolName, reason: reason2 });
+      return deny(reason2);
+    }
+    const reason = `tool '${toolName}' is not permitted for this component.`;
+    denials.push({ tool: toolName, reason });
+    return deny(reason);
+  };
+  return { canUseTool, denials, hooks };
+}
+
+// src/localClient.ts
+function buildChatRequest(model, messages) {
+  return { model, messages, stream: false, temperature: 0 };
+}
+function extractCompletionText(body) {
+  const choices = body?.choices;
+  if (!Array.isArray(choices) || choices.length === 0) {
+    throw new Error("openai_compat response has no choices");
+  }
+  const content = choices[0]?.message?.content;
+  if (typeof content !== "string") {
+    throw new Error("openai_compat response choice has no message.content string");
+  }
+  return content;
+}
+async function callOpenAiCompat(opts) {
+  const url = `${opts.endpoint.replace(/\/$/, "")}/chat/completions`;
+  const headers = { "content-type": "application/json" };
+  if (opts.apiKey) headers["authorization"] = `Bearer ${opts.apiKey}`;
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(buildChatRequest(opts.model, opts.messages))
+  });
+  if (!res.ok) {
+    throw new Error(`openai_compat call to ${url} failed: ${res.status} ${res.statusText}`);
+  }
+  return extractCompletionText(await res.json());
+}
+
+// src/hybridTool.ts
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
+import { query, tool, createSdkMcpServer } from "@anthropic-ai/claude-agent-sdk";
+import { z } from "zod";
+function isResult(msg) {
+  return msg.type === "result";
+}
+function isAssistant(msg) {
+  return msg.type === "assistant";
+}
+function requireFinalText(result) {
+  if (result === void 0) throw new DispatchError("the query() stream ended without a result message");
+  if (result.subtype !== "success") {
+    throw new DispatchError(`agent run failed (${result.subtype}): ${result.errors.join("; ")}`);
+  }
+  return result.result;
+}
+function cloudPreamble(cwd) {
+  return [
+    `You are bound to the wren project at \`${cwd}\` (your working directory).`,
+    "All data access MUST go through the `wren` CLI \u2014 never raw SQL clients."
+  ].join("\n");
+}
+function stepUserPrompt(question, inputsText) {
+  return inputsText ? `Question: ${question}
+
+Inputs from the previous step:
+${inputsText}` : `Question: ${question}`;
+}
+function buildToolDriverPrompt(steps) {
+  const producers = /* @__PURE__ */ new Map();
+  for (const s of steps) if (s.produces) producers.set(s.produces, s.name);
+  const lines = steps.map((s, i) => {
+    const parts = [`${i + 1}. Call the \`dispatch_step\` tool with step="${s.name}".`];
+    if (s.consumes.length > 0) {
+      const srcs = s.consumes.map((slot) => {
+        const p = producers.get(slot);
+        return p ? `the text step "${p}" returned` : `"${slot}"`;
+      }).join(", ");
+      parts.push(`Pass ${srcs} as the tool's \`inputs\` argument.`);
+    }
+    if (s.conditional) parts.push("(Only if the previous step's output indicates the query failed and needs repair.)");
+    return parts.join(" ");
+  });
+  return [
+    "You orchestrate a multi-step data task by calling the `dispatch_step` tool exactly once per step, in order.",
+    "You have NO other tools and you must NOT try to answer yourself \u2014 each step runs on its own configured model behind the tool.",
+    "",
+    "Steps, in order:",
+    "",
+    ...lines,
+    "",
+    "Marshal each step's returned text into the next step's `inputs` exactly as noted above. Your FINAL message MUST be the last executed step's returned text verbatim \u2014 do not summarize it or add commentary."
+  ].join("\n");
+}
+async function runCloudStep(step, question, inputsText, ctx) {
+  const options = {
+    cwd: ctx.cwd,
+    permissionMode: "default",
+    maxTurns: ctx.maxTurns,
+    model: step.model,
+    systemPrompt: `${cloudPreamble(ctx.cwd)}
+
+${step.prompt}`,
+    tools: ["Read", "Bash"],
+    allowedTools: ["Read"],
+    disallowedTools: [...DESTRUCTIVE_BASH_DENY],
+    canUseTool: ctx.canUseTool,
+    // Read never reaches `canUseTool` for an in-cwd path in the real SDK (see guardrails.ts); this
+    // hook is the live enforcement point for the +Setup dotenv-read gap's Read side.
+    hooks: { PreToolUse: ctx.hooks },
+    env: ctx.env
+  };
+  const msgs = [];
+  for await (const m of query({ prompt: stepUserPrompt(question, inputsText), options })) msgs.push(m);
+  return requireFinalText(msgs.find(isResult));
+}
+async function runHybridTool(plan, cfg) {
+  mkdirSync(cfg.outDir, { recursive: true });
+  const cwd = plan.options.cwd ?? process.cwd();
+  const { canUseTool, denials, hooks } = makeReadOnlyGuard({
+    readOnly: plan.meta.readOnly,
+    writeScope: null,
+    cwd,
+    setupScope: plan.meta.setupScope
+  });
+  const venvBin = join(cwd, ".venv", "bin");
+  const pathEnv = existsSync(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
+  const env = { ...process.env, PATH: pathEnv };
+  const steps = plan.meta.stagedSteps;
+  const question = plan.prompt;
+  const maxTurns = plan.options.maxTurns ?? 40;
+  const traceSteps = [];
+  const dispatchStep = tool(
+    "dispatch_step",
+    "Execute one named step of the task on its own configured model and return its text output.",
+    { step: z.string(), inputs: z.string().optional() },
+    async (args) => {
+      const step = steps.find((s) => s.name === args.step);
+      if (!step) {
+        return { content: [{ type: "text", text: `ERROR: unknown step '${args.step}'` }], isError: true };
+      }
+      const inputsText = args.inputs ?? "";
+      let text;
+      if (step.provider === "openai_compat") {
+        if (!step.endpoint) throw new DispatchError(`local step '${step.name}' has no endpoint`);
+        text = await callOpenAiCompat({
+          endpoint: step.endpoint,
+          model: step.model,
+          messages: [
+            { role: "system", content: step.prompt },
+            { role: "user", content: stepUserPrompt(question, inputsText) }
+          ]
+        });
+        process.stderr.write(`warble hybrid-tool: step '${step.name}' \u2192 local ${step.model}
+`);
+      } else {
+        text = await runCloudStep(step, question, inputsText, { cwd, env, maxTurns, canUseTool, hooks });
+        process.stderr.write(`warble hybrid-tool: step '${step.name}' \u2192 cloud ${step.model}
+`);
+      }
+      traceSteps.push({ model: `${step.provider}:${step.model}`, parent_tool_use_id: step.name, usage: null });
+      return { content: [{ type: "text", text }] };
+    }
+  );
+  const server = createSdkMcpServer({ name: "warble", version: "0.0.0", tools: [dispatchStep] });
+  const driverModel = plan.options.model ?? "sonnet";
+  const driverOptions = {
+    cwd,
+    permissionMode: "default",
+    maxTurns,
+    model: driverModel,
+    systemPrompt: buildToolDriverPrompt(steps),
+    mcpServers: { warble: server },
+    allowedTools: ["mcp__warble__dispatch_step"],
+    env
+  };
+  const msgs = [];
+  for await (const m of query({ prompt: question, options: driverOptions })) msgs.push(m);
+  const result = msgs.find(isResult);
+  const finalText = requireFinalText(result);
+  for (const m of msgs.filter(isAssistant)) {
+    traceSteps.push({ model: m.message.model, parent_tool_use_id: "orchestrator", usage: m.message.usage });
+  }
+  const trace = {
+    target: plan.meta.target,
+    verb: plan.meta.verb,
+    model: `hybrid-tool(driver=${driverModel})`,
+    split: false,
+    run: result && result.subtype === "success" ? { total_cost_usd: result.total_cost_usd, duration_ms: result.duration_ms, duration_api_ms: result.duration_api_ms, num_turns: result.num_turns } : null,
+    usage: null,
+    modelUsage: {},
+    steps: traceSteps,
+    denials
+  };
+  writeFileSync(join(cfg.outDir, "result.txt"), finalText, "utf8");
+  writeFileSync(join(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
+  return {
+    finalText,
+    trace,
+    htmlPath: null,
+    denials,
+    sessionId: result?.session_id ?? null,
+    renderDegraded: null
+  };
+}
+
+// src/render.ts
+import { spawnSync } from "child_process";
+import { mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+function renderEnvelope(finalText, outPath, opts) {
+  const dir = mkdtempSync(join2(tmpdir(), "warble-sdk-"));
+  const envelopePath = join2(dir, "envelope.txt");
+  writeFileSync2(envelopePath, finalText, "utf8");
+  const args = ["render", envelopePath, "--out", outPath];
+  if (opts.title) args.push("--title", opts.title);
+  const proc = spawnSync(opts.warbleBin, args, { encoding: "utf8" });
+  if (proc.error) {
+    throw new DispatchError(missingWarbleBinaryMessage(opts.warbleBin, proc.error));
+  }
+  if (proc.status !== 0) {
+    throw new DispatchError(
+      `warble render exited ${proc.status}: ${proc.stderr?.trim() || proc.stdout?.trim() || "no output"}`
+    );
+  }
+  return { outPath, log: (proc.stderr ?? "").trim() };
+}
+function missingWarbleBinaryMessage(warbleBin, error) {
+  const base = `failed to run '${warbleBin} render': ${error.message}`;
+  if (error.code === "ENOENT") {
+    return `${base}
+The 'warble' binary was not found. Install it with 'cargo install warble-cli' (requires a Rust toolchain; installs from crates.io), or set the 'warbleBin' option (CLI: --warble-bin <path>) to point at an existing 'warble' binary.`;
+  }
+  return `${base} (set the 'warbleBin' option, or pass --warble-bin <path> on the CLI, to point at a different binary)`;
+}
+
+// src/run.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
+import { query as query2 } from "@anthropic-ai/claude-agent-sdk";
+
+// src/conditional.ts
+var DEFAULT_MAX_REPAIR_ATTEMPTS = 1;
+function tryParseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function readFlag(slots, target) {
+  const [slotName, ...path] = target.split(".");
+  if (slotName === void 0) return false;
+  const raw = slots[slotName];
+  if (raw === void 0) return false;
+  let cur = tryParseJson(raw);
+  for (const key of path) {
+    if (typeof cur !== "object" || cur === null) return false;
+    cur = cur[key];
+  }
+  return cur === true;
+}
+function evaluateGuard(when, state) {
+  switch (when.guard) {
+    case "on_failure":
+      return state.outcomes[when.target] === "failure";
+    case "on_flag":
+      return readFlag(state.slots, when.target);
+    case "on_missing":
+      return state.slots[when.target] === void 0;
+    default:
+      throw new DispatchError(
+        `unknown guard '${when.guard}' (closed vocabulary: on_failure, on_flag, on_missing)`
+      );
+  }
+}
+function repairFoldTarget(when, consumes, precedingStep) {
+  if (when.guard !== "on_failure" || precedingStep === null) return null;
+  if (when.target !== precedingStep.name) return null;
+  if (precedingStep.produces === null || !consumes.includes(precedingStep.produces)) return null;
+  return precedingStep;
+}
+function classifyConditionalStep(when, consumes, precedingStep, state) {
+  const target = repairFoldTarget(when, consumes, precedingStep);
+  if (target !== null) {
+    return state.outcomes[target.name] === "failure" ? { kind: "repair", target } : { kind: "skip" };
+  }
+  return evaluateGuard(when, state) ? { kind: "run" } : { kind: "skip" };
+}
+async function runRepairLoop(maxAttempts, attempt) {
+  for (let i = 1; i <= maxAttempts; i++) {
+    const result = await attempt(i);
+    if (!result.failed) return { recovered: true, attempts: i };
+  }
+  return { recovered: false, attempts: maxAttempts };
+}
+
+// src/events.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function isToolUseBlock(block) {
+  return isRecord(block) && block["type"] === "tool_use" && typeof block["id"] === "string" && typeof block["name"] === "string";
+}
+function isToolResultBlock(block) {
+  return isRecord(block) && block["type"] === "tool_result" && typeof block["tool_use_id"] === "string";
+}
+var SUMMARY_MAX_LENGTH = 240;
+function truncate(text, max = SUMMARY_MAX_LENGTH) {
+  return text.length > max ? `${text.slice(0, max - 1)}\u2026` : text;
+}
+function summarizeResultContent(content) {
+  if (typeof content === "string") return truncate(content);
+  if (Array.isArray(content)) {
+    const text = content.map((b) => isRecord(b) && typeof b["text"] === "string" ? b["text"] : "").filter((s) => s.length > 0).join(" ");
+    if (text.length > 0) return truncate(text);
+  }
+  return truncate(JSON.stringify(content ?? null));
+}
+var ChatEventMapper = class {
+  stepId;
+  stepStarted = false;
+  pendingToolNames = /* @__PURE__ */ new Map();
+  /** `name` becomes the enclosing step's `name` (the dispatched verb, e.g. "answer_query"). */
+  constructor(name) {
+    this.stepId = name;
+  }
+  /** Feed one SDK message; returns the events it produces, in arrival order. */
+  next(message) {
+    if (message.type === "assistant") return this.onAssistant(message);
+    if (message.type === "user") return this.onUser(message);
+    return [];
+  }
+  /** Call once the turn is done (successfully or not) to close the enclosing step, if one was opened. */
+  finish(ok, detail) {
+    if (!this.stepStarted) return [];
+    return [{ t: "step_finish", id: this.stepId, ok, ...detail !== void 0 ? { detail } : {} }];
+  }
+  startStepIfNeeded() {
+    if (this.stepStarted) return [];
+    this.stepStarted = true;
+    return [{ t: "step_start", id: this.stepId, name: this.stepId, parent: null, depth: 0 }];
+  }
+  onAssistant(message) {
+    const content = message.message?.content;
+    if (!Array.isArray(content)) return [];
+    const parent = message.parent_tool_use_id ?? null;
+    const depth = parent ? 1 : 0;
+    const events = [];
+    for (const block of content) {
+      if (!isToolUseBlock(block)) continue;
+      events.push(...this.startStepIfNeeded());
+      this.pendingToolNames.set(block.id, block.name);
+      events.push({
+        t: "tool_call",
+        id: block.id,
+        name: block.name,
+        ...block.input !== void 0 ? { input: block.input } : {},
+        parent,
+        depth
+      });
+    }
+    return events;
+  }
+  onUser(message) {
+    const content = message.message?.content;
+    if (!Array.isArray(content)) return [];
+    const events = [];
+    for (const block of content) {
+      if (!isToolResultBlock(block)) continue;
+      const name = this.pendingToolNames.get(block.tool_use_id);
+      if (name === void 0) continue;
+      this.pendingToolNames.delete(block.tool_use_id);
+      const ok = block.is_error !== true;
+      const text = summarizeResultContent(block.content);
+      events.push({
+        t: "tool_result",
+        id: block.tool_use_id,
+        ok,
+        ...ok ? { summary: text } : { error: text }
+      });
+    }
+    return events;
+  }
+};
+
+// src/run.ts
+function isResult2(msg) {
+  return msg.type === "result";
+}
+function isAssistant2(msg) {
+  return msg.type === "assistant";
+}
+function aggregateTrace(messages, meta, denials) {
+  const steps = messages.filter(isAssistant2).map((m) => ({
+    model: m.message.model,
+    parent_tool_use_id: m.parent_tool_use_id,
+    usage: m.message.usage
+  }));
+  const result = messages.find(isResult2);
+  const run = result === void 0 ? null : {
+    total_cost_usd: result.total_cost_usd,
+    duration_ms: result.duration_ms,
+    duration_api_ms: result.duration_api_ms,
+    num_turns: result.num_turns
+  };
+  return {
+    target: meta.target,
+    verb: meta.verb,
+    model: meta.model,
+    split: meta.split,
+    run,
+    usage: result?.usage ?? null,
+    modelUsage: result?.modelUsage ?? {},
+    steps,
+    denials
+  };
+}
+var DispatchSessionError = class extends DispatchError {
+  constructor(message, sessionId) {
+    super(message);
+    this.sessionId = sessionId;
+    this.name = "DispatchSessionError";
+  }
+  sessionId;
+};
+function realizeRender(gate, finalText, outPath, renderOpts) {
+  try {
+    renderEnvelope(finalText, outPath, renderOpts);
+    return { htmlPath: outPath, renderDegraded: null };
+  } catch (err) {
+    if (gate.onFailure !== "degrade") throw err;
+    const reason = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`warble-agent-sdk: render_contract degraded (best-effort) \u2014 ${reason}
+`);
+    return { htmlPath: null, renderDegraded: { reason } };
+  }
+}
+function requireFinalText2(result) {
+  if (result === void 0) {
+    throw new DispatchSessionError("the query() stream ended without a result message", null);
+  }
+  if (result.subtype !== "success") {
+    throw new DispatchSessionError(
+      `agent run failed (${result.subtype}): ${result.errors.join("; ")}`,
+      result.session_id ?? null
+    );
+  }
+  return result.result;
+}
+async function runDispatch(plan, cfg) {
+  if (plan.meta.mode === "hybrid-staged") {
+    return process.env["WARBLE_HYBRID_MODE"] === "tool" ? runHybridTool(plan, cfg) : runHybridStaged(plan, cfg);
+  }
+  mkdirSync2(cfg.outDir, { recursive: true });
+  const cwd = plan.options.cwd ?? process.cwd();
+  const gate = plan.meta.render;
+  const writeScope = gate.kind === "realize" && gate.flavor === "prompt" ? gate.scope : null;
+  const { canUseTool, denials, hooks } = makeReadOnlyGuard({
+    readOnly: plan.meta.readOnly,
+    writeScope,
+    cwd,
+    setupScope: plan.meta.setupScope
+  });
+  const venvBin = join3(cwd, ".venv", "bin");
+  const pathEnv = existsSync2(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
+  const env = { ...process.env, PATH: pathEnv };
+  const options = {
+    ...plan.options,
+    canUseTool,
+    // Read never reaches `canUseTool` for an in-cwd path in the real SDK (see guardrails.ts); this
+    // hook is the live enforcement point for the +Setup dotenv-read gap's Read side.
+    hooks: { ...plan.options.hooks, PreToolUse: [...plan.options.hooks?.PreToolUse ?? [], ...hooks] },
+    env,
+    ...cfg.resume ? { resume: cfg.resume } : {}
+  };
+  const mapper = new ChatEventMapper(plan.meta.verb);
+  const messages = [];
+  for await (const message of query2({ prompt: plan.prompt, options })) {
+    messages.push(message);
+    if (cfg.onEvent) for (const event of mapper.next(message)) cfg.onEvent(event);
+  }
+  const result = messages.find(isResult2);
+  const finalText = requireFinalText2(result);
+  if (cfg.onEvent) for (const event of mapper.finish(true)) cfg.onEvent(event);
+  const trace = aggregateTrace(messages, plan.meta, denials);
+  const sessionId = result?.session_id ?? null;
+  writeFileSync3(join3(cfg.outDir, "result.txt"), finalText, "utf8");
+  writeFileSync3(join3(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
+  let htmlPath = null;
+  let renderDegraded = null;
+  if (gate.kind === "realize" && gate.flavor === "programmatic") {
+    const out = join3(cfg.outDir, "dashboard.html");
+    const realized = realizeRender(gate, finalText, out, {
+      warbleBin: cfg.warbleBin,
+      ...cfg.title ? { title: cfg.title } : {}
+    });
+    htmlPath = realized.htmlPath;
+    renderDegraded = realized.renderDegraded;
+  } else if (plan.meta.assertion) {
+    const out = join3(cfg.outDir, "status.html");
+    renderEnvelope(finalText, out, {
+      warbleBin: cfg.warbleBin,
+      ...cfg.title ? { title: cfg.title } : {}
+    });
+    htmlPath = out;
+  }
+  return { finalText, trace, htmlPath, denials, sessionId, renderDegraded };
+}
+function hybridCloudPreamble(cwd) {
+  return [
+    `You are bound to the wren project at \`${cwd}\` (your working directory).`,
+    "All data access MUST go through the `wren` CLI \u2014 never raw SQL clients."
+  ].join("\n");
+}
+function slotKey(step) {
+  return step.produces ?? step.name;
+}
+async function executeStep(step, slots, ctx, tolerant) {
+  const messages = buildStepMessages(step, ctx.plan.prompt, slots);
+  const userPrompt = messages.find((m) => m.role === "user")?.content ?? ctx.plan.prompt;
+  try {
+    if (step.provider === "openai_compat") {
+      if (!step.endpoint) throw new DispatchError(`local step '${step.name}' has no endpoint`);
+      const text2 = await callOpenAiCompat({ endpoint: step.endpoint, model: step.model, messages });
+      ctx.steps.push({ model: `openai_compat:${step.model}`, parent_tool_use_id: step.name, usage: null });
+      process.stderr.write(`warble hybrid: step '${step.name}' \u2192 local ${step.model}
+`);
+      return { outcome: "success", text: text2 };
+    }
+    const stepOptions = {
+      cwd: ctx.cwd,
+      permissionMode: "default",
+      maxTurns: ctx.plan.options.maxTurns ?? 40,
+      model: step.model,
+      systemPrompt: `${hybridCloudPreamble(ctx.cwd)}
+
+${step.prompt}`,
+      tools: ctx.plan.options.tools,
+      allowedTools: ctx.plan.options.allowedTools,
+      disallowedTools: ctx.plan.options.disallowedTools,
+      canUseTool: ctx.canUseTool,
+      // Read never reaches `canUseTool` for an in-cwd path in the real SDK (see guardrails.ts); this
+      // hook is the live enforcement point for the +Setup dotenv-read gap's Read side.
+      hooks: { PreToolUse: ctx.hooks },
+      env: ctx.env
+    };
+    const msgs = [];
+    for await (const message of query2({ prompt: userPrompt, options: stepOptions })) {
+      msgs.push(message);
+    }
+    for (const m of msgs.filter(isAssistant2)) {
+      ctx.steps.push({ model: m.message.model, parent_tool_use_id: step.name, usage: m.message.usage });
+    }
+    const result = msgs.find(isResult2);
+    const text = requireFinalText2(result);
+    if (result && result.subtype === "success") ctx.recordCost(result.total_cost_usd);
+    process.stderr.write(`warble hybrid: step '${step.name}' \u2192 cloud ${step.model}
+`);
+    return { outcome: "success", text };
+  } catch (err) {
+    if (!tolerant) throw err;
+    const text = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      `warble hybrid: step '${step.name}' failed (tolerant \u2014 a later guard depends on its outcome): ${text}
+`
+    );
+    return { outcome: "failure", text };
+  }
+}
+async function runHybridStaged(plan, cfg) {
+  mkdirSync2(cfg.outDir, { recursive: true });
+  const cwd = plan.options.cwd ?? process.cwd();
+  const { canUseTool, denials, hooks } = makeReadOnlyGuard({
+    readOnly: plan.meta.readOnly,
+    writeScope: null,
+    cwd,
+    setupScope: plan.meta.setupScope
+  });
+  const venvBin = join3(cwd, ".venv", "bin");
+  const pathEnv = existsSync2(venvBin) ? `${venvBin}:${process.env.PATH ?? ""}` : process.env.PATH ?? "";
+  const env = { ...process.env, PATH: pathEnv };
+  const slots = {};
+  const outcomes = {};
+  const steps = [];
+  let finalText = "";
+  let totalCost = 0;
+  const startedAll = Date.now();
+  const execCtx = {
+    cwd,
+    canUseTool,
+    hooks,
+    env,
+    plan,
+    steps,
+    recordCost: (cost) => {
+      totalCost += cost;
+    }
+  };
+  const stagedSteps = plan.meta.stagedSteps;
+  const failureGuardTargets = /* @__PURE__ */ new Set();
+  for (const s of stagedSteps) {
+    if (s.conditional && s.when !== null && s.when.guard === "on_failure") {
+      failureGuardTargets.add(s.when.target);
+    }
+  }
+  for (let i = 0; i < stagedSteps.length; i++) {
+    const step = stagedSteps[i];
+    if (step.conditional) {
+      if (step.when === null) {
+        throw new DispatchError(`conditional step '${step.name}' has no 'when' guard`);
+      }
+      const preceding = i > 0 ? stagedSteps[i - 1] : null;
+      const precedingIdentity = preceding === null ? null : { name: preceding.name, produces: preceding.produces };
+      const decision = classifyConditionalStep(step.when, step.consumes, precedingIdentity, {
+        slots,
+        outcomes
+      });
+      if (decision.kind === "skip") {
+        process.stderr.write(`warble hybrid: guard false \u2014 skipping conditional step '${step.name}'
+`);
+        continue;
+      }
+      if (decision.kind === "repair") {
+        let lastFailureText = slots[decision.target.produces ?? decision.target.name] ?? "";
+        const { recovered, attempts } = await runRepairLoop(DEFAULT_MAX_REPAIR_ATTEMPTS, async () => {
+          const attempt = await executeStep(step, slots, execCtx, true);
+          outcomes[step.name] = attempt.outcome;
+          slots[slotKey(step)] = attempt.text;
+          if (attempt.outcome === "success") finalText = attempt.text;
+          else lastFailureText = attempt.text;
+          return { failed: attempt.outcome === "failure" };
+        });
+        if (!recovered) {
+          throw new DispatchError(
+            `repair step '${step.name}' did not recover '${decision.target.name}' after ${attempts} attempt(s); last failure: ${lastFailureText}`
+          );
+        }
+        process.stderr.write(
+          `warble hybrid: step '${step.name}' recovered '${decision.target.name}' (attempt ${attempts})
+`
+        );
+        continue;
+      }
+    }
+    const outcome = await executeStep(step, slots, execCtx, failureGuardTargets.has(step.name));
+    outcomes[step.name] = outcome.outcome;
+    slots[slotKey(step)] = outcome.text;
+    if (outcome.outcome === "success") finalText = outcome.text;
+  }
+  const trace = {
+    target: plan.meta.target,
+    verb: plan.meta.verb,
+    model: plan.meta.model,
+    split: false,
+    run: {
+      total_cost_usd: totalCost,
+      duration_ms: Date.now() - startedAll,
+      duration_api_ms: 0,
+      num_turns: steps.length
+    },
+    usage: null,
+    modelUsage: {},
+    steps,
+    denials
+  };
+  writeFileSync3(join3(cfg.outDir, "result.txt"), finalText, "utf8");
+  writeFileSync3(join3(cfg.outDir, "trace.json"), JSON.stringify(trace, null, 2) + "\n", "utf8");
+  return { finalText, trace, htmlPath: null, denials, sessionId: null, renderDegraded: null };
+}
+
+// src/dispatch.ts
+import { dirname, isAbsolute, resolve } from "path";
+var UNAVAILABLE_COMPONENT_REASON = "component is unavailable on the configured runtime";
+function buildPreparedComponent(node, report, input, target, models) {
+  const cfg = {
+    target,
+    flavor: input.flavor ?? DEFAULT_RENDER_FLAVOR,
+    models,
+    question: input.question ?? "",
+    cwd: resolveProjectCwd(node, { ...input.project !== void 0 ? { project: input.project } : {}, ...input.irPath !== void 0 ? { irPath: input.irPath } : {} }),
+    ...input.maxTurns !== void 0 ? { maxTurns: input.maxTurns } : {}
+  };
+  return { id: node.id, node, report, plan: buildDispatchPlan(node, report, cfg) };
+}
+function resolveProjectCwd(node, opts) {
+  if (opts.project) return resolve(opts.project);
+  const p = node.context_binding.project;
+  if (isAbsolute(p)) return p;
+  const baseDir = opts.irPath ? dirname(resolve(opts.irPath)) : process.cwd();
+  return resolve(baseDir, p);
+}
+function prepareDispatch(input) {
+  const ir = typeof input.ir === "string" ? parseIr(input.ir) : input.ir;
+  assertSupportedIrVersion(ir.warble_ir_version);
+  const target = input.target ?? DEFAULT_TARGET;
+  const models = input.models ?? ModelConfig.default();
+  models.validate(ir);
+  let scoped = ir.components;
+  if (input.componentId !== void 0) {
+    const node = ir.components.find((candidate) => candidate.id === input.componentId);
+    if (!node) {
+      throw new DispatchError(
+        `component '${input.componentId}' not found in IR (available: ${ir.components.map((c) => c.id).join(", ")})`
+      );
+    }
+    scoped = [node];
+  }
+  const components = scoped.map((node) => {
+    const report = resolveNodeCapabilities(node, target);
+    return buildPreparedComponent(node, report, input, target, models);
+  });
+  return { target, components };
+}
+function prepareDisplayManifest(input) {
+  const ir = typeof input.ir === "string" ? parseIr(input.ir) : input.ir;
+  assertSupportedIrVersion(ir.warble_ir_version);
+  const target = input.target ?? DEFAULT_TARGET;
+  const models = input.models ?? ModelConfig.default();
+  models.validate(ir);
+  const components = ir.components.map((node) => {
+    const report = inspectNodeCapabilities(node, target);
+    if (report.some((entry2) => entry2.outcome === "fail")) {
+      return { id: node.id, node, availability: { status: "unavailable", reason: UNAVAILABLE_COMPONENT_REASON } };
+    }
+    return buildPreparedComponent(node, report, input, target, models);
+  });
+  return { target, components };
+}
+async function dispatch(input, runCfg) {
+  const prepared = prepareDispatch(input);
+  const warbleBin = runCfg.warbleBin ?? "warble";
+  const components = [];
+  for (const c of prepared.components) {
+    const result = await runDispatch(c.plan, {
+      outDir: runCfg.outDir,
+      warbleBin,
+      ...runCfg.title ? { title: runCfg.title } : {}
+    });
+    components.push({ id: c.id, report: c.report, plan: c.plan, result });
+  }
+  return { target: prepared.target, components };
+}
+
+// src/manifest.ts
+var MANIFEST_VERSION = "0.1";
+var MIN_SUPPORTED_IR_VERSION = "0.6";
+var MAX_SUPPORTED_IR_VERSION = "0.6";
+var DEFAULT_MAX_ATTEMPTS = 1;
+function classifyStep(node, stepIndex) {
+  const when = node.llm_calls[stepIndex].when;
+  if (!when) return { kind: "independent" };
+  const adjacentPreceding = stepIndex > 0 && when.guard === "on_failure" && node.llm_calls[stepIndex - 1].name === when.target;
+  if (adjacentPreceding) {
+    return { kind: "repair_fold", fold_into: when.target, max_attempts: DEFAULT_MAX_ATTEMPTS };
+  }
+  return { kind: "guarded_skip" };
+}
+function buildStep(node, stepIndex) {
+  const call = node.llm_calls[stepIndex];
+  return {
+    name: call.name,
+    tier: call.tier,
+    consumes: call.consumes,
+    ...call.produces !== null ? { produces: call.produces } : {},
+    prompt: call.prompt,
+    ...call.when ? { when: { guard: call.when.guard, target: call.when.target } } : {},
+    realization: classifyStep(node, stepIndex)
+  };
+}
+function enforcementFor(name, hasThreshold) {
+  if (name === "read_only_execution") return "read_only";
+  if (name === "artifact_write") return "scoped_write";
+  if (name.includes("_limit") || name.endsWith("_gate") || name === "deterministic_gate" || name === "additivity_guard") {
+    return hasThreshold ? "threshold_limit" : "gated_check";
+  }
+  return "generic";
+}
+function guardrailManifest(g) {
+  return {
+    enforcement: enforcementFor(g.name, g.threshold !== void 0 && g.threshold !== null),
+    locked: g.locked,
+    ...g.scope !== null ? { scope: g.scope } : {},
+    ...g.threshold !== void 0 && g.threshold !== null ? { threshold: g.threshold } : {}
+  };
+}
+function buildGuardrails(node) {
+  const out = {};
+  for (const g of [...node.guardrails].sort((a, b) => a.name.localeCompare(b.name))) {
+    out[g.name] = guardrailManifest(g);
+  }
+  return out;
+}
+var PRIMITIVES = /* @__PURE__ */ new Set(["string", "number", "boolean", "row"]);
+function primitiveSchema(name) {
+  switch (name) {
+    case "string":
+      return { type: "string" };
+    case "number":
+      return { type: "number" };
+    case "boolean":
+      return { type: "boolean" };
+    case "row":
+      return { type: "object" };
+    default:
+      return { type: "string", enum: [name] };
+  }
+}
+function makeNullable(schema) {
+  const type = schema["type"];
+  if (type === void 0) return schema;
+  let widened;
+  if (typeof type === "string") {
+    widened = [type, "null"];
+  } else if (Array.isArray(type)) {
+    widened = type.includes("null") ? type : [...type, "null"];
+  } else {
+    widened = type;
+  }
+  return { ...schema, type: widened };
+}
+function fieldTypeToSchema(typeStr) {
+  const nullable = typeStr.endsWith("?");
+  const base = nullable ? typeStr.slice(0, -1) : typeStr;
+  let schema;
+  if (base.endsWith("[]")) {
+    schema = { type: "array", items: primitiveSchema(base.slice(0, -2)) };
+  } else if (base.includes("|")) {
+    const alternatives = base.split("|");
+    schema = alternatives.every((alt) => PRIMITIVES.has(alt)) ? { type: alternatives } : { type: "string", enum: alternatives };
+  } else {
+    schema = primitiveSchema(base);
+  }
+  return nullable ? makeNullable(schema) : schema;
+}
+function renderBlockSchema(block) {
+  const properties = { type: { const: block.type } };
+  const required = ["type"];
+  for (const [name, typeStr] of Object.entries(block.fields).sort(([a], [b]) => a.localeCompare(b))) {
+    properties[name] = fieldTypeToSchema(typeStr);
+    if (!typeStr.endsWith("?")) required.push(name);
+  }
+  return { type: "object", properties, required };
+}
+function outputSchemaFor(effect) {
+  const blockSchemas = effect.render_blocks.map(renderBlockSchema);
+  const blocksItems = blockSchemas.length === 0 ? { type: "object" } : blockSchemas.length === 1 ? blockSchemas[0] : { anyOf: blockSchemas };
+  return {
+    type: "object",
+    properties: {
+      blocks: { type: "array", items: blocksItems },
+      summary: { type: ["string", "null"] },
+      verified: { type: ["boolean", "null"] }
+    },
+    required: ["blocks"]
+  };
+}
+var LOCAL_TOOL_MAP = {
+  "sql_execution:read_only": { name: "wren_query", source: "bash-wren" },
+  genbi_build: { name: "wren_build", source: "bash-wren" },
+  semantic_introspection: { name: "wren_context_show", source: "bash-wren" },
+  raw_material_read: { name: "read_raw_material", source: "sdk-read" },
+  schema_introspection: { name: "wren_context_show", source: "bash-wren" },
+  source_connect: { name: "wren_connect", source: "bash-setup" },
+  context_build: { name: "wren_context_build", source: "bash-setup" },
+  artifact_write: { name: "write_artifact", source: "fs" },
+  version_control: { name: "commit", source: "git" },
+  scheduler: { name: "schedule", source: "os-cron" },
+  event_bus: { name: "publish_event", source: "pub-sub" },
+  notify_channel: { name: "notify", source: "mcp-notify" }
+};
+function buildTools2(node) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const capability of collectRequiredCapabilities(node)) {
+    const binding = LOCAL_TOOL_MAP[capability];
+    if (!binding || seen.has(binding.name)) continue;
+    seen.add(binding.name);
+    out.push(binding);
+  }
+  return out;
+}
+function buildAgentManifest(component) {
+  const node = component.node;
+  return {
+    id: node.id,
+    verb: node.verb,
+    component_type: node.type,
+    realization_kind: node.realization_kind,
+    trigger: node.trigger.kind,
+    outcome: node.effect.outcome.kind,
+    steps: node.llm_calls.map((_call, i) => buildStep(node, i)),
+    guardrails: buildGuardrails(node),
+    tools: buildTools2(node),
+    output_schema: outputSchemaFor(node.effect),
+    capabilities: component.report,
+    ...node.brief !== void 0 ? { brief: node.brief } : {}
+  };
+}
+function buildUnavailableAgentManifest(component) {
+  const node = component.node;
+  return {
+    id: node.id,
+    verb: node.verb,
+    component_type: node.type,
+    realization_kind: node.realization_kind,
+    trigger: node.trigger.kind,
+    outcome: node.effect.outcome.kind,
+    steps: [],
+    guardrails: {},
+    tools: [],
+    output_schema: {},
+    capabilities: [],
+    availability: component.availability
+  };
+}
+function buildManifest(prepared, raw) {
+  const ir = parseIr(raw);
+  return {
+    manifest_version: MANIFEST_VERSION,
+    compat: { min_ir_version: MIN_SUPPORTED_IR_VERSION, max_ir_version: MAX_SUPPORTED_IR_VERSION },
+    profile: ir.profile,
+    target: prepared.target,
+    agents: prepared.components.map((component) => "availability" in component ? buildUnavailableAgentManifest(component) : buildAgentManifest(component))
+  };
+}
+
+// src/model_catalog.ts
+import { query as query3 } from "@anthropic-ai/claude-agent-sdk";
+import { resolve as resolve2 } from "path";
+var MODEL_CATALOG_VERSION = 1;
+var CLEANUP_GRACE_MS = 25;
+function unavailable(code, retryable) {
+  return { version: MODEL_CATALOG_VERSION, status: "unavailable", provider: "claude", code, retryable };
+}
+function classify(error) {
+  const message = error instanceof Error ? error.message.toLowerCase() : "";
+  if (message.includes("timed out")) return unavailable("timeout", true);
+  if (/(not authenticated|unauthenticated|authentication|login required|sign in)/.test(message)) {
+    return unavailable("not_authenticated", false);
+  }
+  if (/(enoent|failed to start|not found|runtime unavailable)/.test(message)) {
+    return unavailable("runtime_unavailable", true);
+  }
+  return unavailable("protocol_error", false);
+}
+async function* idleInput() {
+}
+function mapModel(model) {
+  if (typeof model.value !== "string" || typeof model.displayName !== "string") {
+    throw new Error("malformed model catalog response");
+  }
+  return {
+    model: model.value,
+    displayName: model.displayName,
+    ...typeof model.description === "string" && model.description.length > 0 ? { description: model.description } : {}
+  };
+}
+async function withinTimeout(operation, timeoutMs, abortController) {
+  let timer;
+  try {
+    return await Promise.race([
+      operation,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          abortController.abort();
+          reject(new Error("model catalog timed out"));
+        }, timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+async function settleCleanup(operation) {
+  let timer;
+  try {
+    await Promise.race([
+      operation.catch(() => void 0),
+      new Promise((resolve3) => {
+        timer = setTimeout(resolve3, CLEANUP_GRACE_MS);
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+async function discoverClaudeModels(options = {}) {
+  const abortController = new AbortController();
+  const timeoutMs = options.timeoutMs ?? 1e4;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return unavailable("protocol_error", false);
+  let catalogQuery;
+  try {
+    const queryFactory = options.queryFactory ?? query3;
+    catalogQuery = queryFactory({
+      prompt: idleInput(),
+      options: {
+        cwd: resolve2(options.cwd ?? process.cwd()),
+        tools: [],
+        mcpServers: [],
+        settingSources: [],
+        abortController
+      }
+    });
+    const models = await withinTimeout(catalogQuery.supportedModels(), timeoutMs, abortController);
+    if (!Array.isArray(models)) throw new Error("malformed model catalog response");
+    return {
+      version: MODEL_CATALOG_VERSION,
+      status: "ready",
+      provider: "claude",
+      models: models.map(mapModel)
+    };
+  } catch (error) {
+    return classify(error);
+  } finally {
+    abortController.abort();
+    if (catalogQuery !== void 0) {
+      await Promise.all([
+        settleCleanup(catalogQuery.interrupt()),
+        settleCleanup(catalogQuery.return())
+      ]);
+    }
+  }
+}
+
+// src/session.ts
+import { mkdirSync as mkdirSync3 } from "fs";
+import { join as join4 } from "path";
+var BREAKDOWN_RE = /\bby\s+([a-z][a-z0-9_]*(?:\s*(?:,|and)\s*[a-z][a-z0-9_]*)*)/i;
+var FILTER_OVERRIDE_RE = /\b(where|only|instead of|excluding|filtered?\s+to)\b/i;
+function extractBreakdownDimensions(question) {
+  const m = question.match(BREAKDOWN_RE);
+  if (!m) return null;
+  const dims = m[1].split(/\s*(?:,|and)\s*/i).map((s) => s.trim()).filter((s) => s.length > 0);
+  return dims.length > 0 ? dims : null;
+}
+function distillFollowup(prevIntent, newQuestion) {
+  const newDimensions = extractBreakdownDimensions(newQuestion);
+  const dimensions = newDimensions ?? prevIntent.dimensions;
+  const filters = FILTER_OVERRIDE_RE.test(newQuestion) ? [] : prevIntent.filters;
+  const carried = [];
+  if (filters.length > 0) carried.push(`filter(s): ${filters.join(", ")}`);
+  if (dimensions.length > 0) {
+    carried.push(
+      newDimensions ? `breakdown swapped to: ${dimensions.join(", ")} (was: ${prevIntent.dimensions.join(", ") || "none"})` : `dimension(s): ${dimensions.join(", ")}`
+    );
+  }
+  if (prevIntent.measures.length > 0) carried.push(`measure(s): ${prevIntent.measures.join(", ")}`);
+  if (prevIntent.grain) carried.push(`grain: ${prevIntent.grain}`);
+  if (carried.length === 0) return newQuestion;
+  return [
+    "[Context carried from the previous turn \u2014 reuse it unless this question overrides it; you still decide the actual resolution.]",
+    carried.map((c) => `- ${c}`).join("\n"),
+    "",
+    newQuestion
+  ].join("\n");
+}
+var DEFAULT_CLARIFY_THRESHOLD = 0.55;
+function decideClarify(question, confidence, threshold = DEFAULT_CLARIFY_THRESHOLD) {
+  if (confidence < threshold) {
+    return {
+      kind: "clarify",
+      question: `I want to make sure I answer "${question}" correctly \u2014 could you clarify which metric, filter, or time range you mean?`
+    };
+  }
+  return { kind: "answer" };
+}
+function createSessionState() {
+  return { turns: [] };
+}
+function lastTurn(state) {
+  return state.turns[state.turns.length - 1];
+}
+function lastSessionId(state) {
+  return lastTurn(state)?.sessionId ?? null;
+}
+function lastResolvedIntent(state) {
+  return lastTurn(state)?.intent ?? null;
+}
+function appendTurn(state, turn) {
+  return { turns: [...state.turns, turn] };
+}
+function buildTurnPrompt(state, question) {
+  const prevIntent = lastResolvedIntent(state);
+  return prevIntent ? distillFollowup(prevIntent, question) : question;
+}
+var ChatSession = class {
+  constructor(plan, runCfg, initialResumeSessionId) {
+    this.plan = plan;
+    this.runCfg = runCfg;
+    this.initialResumeSessionId = initialResumeSessionId;
+  }
+  plan;
+  runCfg;
+  initialResumeSessionId;
+  state = createSessionState();
+  getState() {
+    return this.state;
+  }
+  async ask(question, opts = {}) {
+    const prompt = buildTurnPrompt(this.state, question);
+    const resume = lastSessionId(this.state) ?? this.initialResumeSessionId ?? null;
+    const turnPlan = { ...this.plan, prompt };
+    const turnOutDir = join4(this.runCfg.outDir, `turn-${this.state.turns.length + 1}`);
+    mkdirSync3(turnOutDir, { recursive: true });
+    const result = await runDispatch(turnPlan, {
+      ...this.runCfg,
+      outDir: turnOutDir,
+      ...resume ? { resume } : {},
+      ...opts.onEvent ? { onEvent: opts.onEvent } : {}
+    });
+    this.state = appendTurn(this.state, {
+      question,
+      prompt,
+      intent: opts.intent ?? null,
+      sessionId: result.sessionId,
+      finalText: result.finalText
+    });
+    return { finalText: result.finalText, sessionId: result.sessionId, trace: result.trace, prompt };
+  }
+};
+function createChatSession(plan, runCfg, initialResumeSessionId) {
+  return new ChatSession(plan, runCfg, initialResumeSessionId);
+}
+
+export {
+  DispatchError,
+  emitAgentModule,
+  REALIZATION_KINDS,
+  COMPONENT_TYPES,
+  TRIGGER_KINDS,
+  OUTCOME_KINDS,
+  SUPPORTED_IR_VERSIONS,
+  parseIr,
+  distinctTiers,
+  ModelConfig,
+  resolveStagedSteps,
+  distinctProviders,
+  usesLocalProvider,
+  planProviderRouting,
+  buildStepMessages,
+  DEFAULT_TARGET,
+  isKnownTarget,
+  knownTargetNames,
+  localProfile,
+  profileFor,
+  DEFAULT_RENDER_FLAVOR,
+  parseRenderFlavor,
+  DESTRUCTIVE_BASH_DENY,
+  shouldSplitPerStepTier,
+  buildDispatchPlan,
+  collectRequiredCapabilities,
+  resolveCapabilities,
+  resolveNodeCapabilities,
+  inspectNodeCapabilities,
+  makeReadOnlyGuard,
+  buildChatRequest,
+  extractCompletionText,
+  callOpenAiCompat,
+  buildToolDriverPrompt,
+  runHybridTool,
+  renderEnvelope,
+  aggregateTrace,
+  DispatchSessionError,
+  runDispatch,
+  UNAVAILABLE_COMPONENT_REASON,
+  resolveProjectCwd,
+  prepareDispatch,
+  prepareDisplayManifest,
+  dispatch,
+  buildAgentManifest,
+  buildUnavailableAgentManifest,
+  buildManifest,
+  MODEL_CATALOG_VERSION,
+  discoverClaudeModels,
+  distillFollowup,
+  DEFAULT_CLARIFY_THRESHOLD,
+  decideClarify,
+  createSessionState,
+  lastSessionId,
+  lastResolvedIntent,
+  appendTurn,
+  buildTurnPrompt,
+  ChatSession,
+  createChatSession
+};
+//# sourceMappingURL=chunk-F4QDKVP7.js.map