@yanlinglabs/winter-agent-runtime 0.0.29 → 0.0.31

package/dist/embedded-worker.js

@@ -1,13 +1,15 @@
-import"./index-jz5d90c6.js";
+import"./index-d4pmmr27.js";
 import {
   liveProcessGroups,
   onProcessGroupChange
-} from "./index-8jgwp1px.js";
+} from "./index-9s68t0pd.js";
+import"./index-z6s3r4xm.js";
+import"./index-bgeqc7ax.js";
 import"./index-bef62z3r.js";
-import"./index-gmxxtqpe.js";
+import"./index-0xqzk1hm.js";
 import {
   runEmbeddedSession2
-} from "./index-eyddzcgs.js";
+} from "./index-c7kq6erg.js";
 import {
   Queue
 } from "./index-97t2rmtf.js";

package/dist/embedded.js

@@ -1,10 +1,12 @@
 import {
   runEmbeddedSession2
-} from "./index-eyddzcgs.js";
-import"./index-gmxxtqpe.js";
-import"./index-jz5d90c6.js";
+} from "./index-c7kq6erg.js";
+import"./index-0xqzk1hm.js";
+import"./index-d4pmmr27.js";
+import"./index-bgeqc7ax.js";
 import"./index-bef62z3r.js";
-import"./index-8jgwp1px.js";
+import"./index-9s68t0pd.js";
+import"./index-z6s3r4xm.js";
 export {
   runEmbeddedSession2 as runEmbeddedSession
 };

package/dist/engine.d.ts

@@ -12,6 +12,8 @@ import { type StructuredOutputSeam } from "./structured/seam.js";
 import { type FileCheckpointSink } from "./checkpoint/seam.js";
 import { type CommandResolver } from "./commands/seam.js";
 import { type McpServerSource } from "./mcp/lifecycle.js";
+import type { McpOAuthStore } from "./mcp-auth/store.js";
+import type { HostCredentialChannel } from "./provider/host-credentials.js";
 import { type ChildHandle } from "./subagents/child-handle.js";
 import { type SourcedRuleEntry } from "./permissions/ruleset.js";
 import { type AutoAuditRecorder, type ClassifierInterface } from "./permissions/auto/engine.js";
@@ -981,6 +983,20 @@ export interface EngineOptions {
      * clone connects freely.
      */
     extraMcpServerSources?: readonly McpServerSource[];
+    /**
+     * WS-25 (MCP OAuth): where this session READS its MCP sign-ins -- the session's own Keychain service,
+     * supplied by production wiring (`resolveSessionMcpOAuthStore`). Present, every remote (`http`/`sse`)
+     * server without a static `Authorization` header connects with a read-only bearer provider that asks
+     * the host (`mcp_oauth_refresh`) to refresh. ABSENT -- every direct `runEngine` caller, every unit test --
+     * no provider is attached anywhere, the Keychain is never touched, and a 401 is `needs-auth` as before.
+     */
+    mcpOAuthStore?: McpOAuthStore;
+    /**
+     * WS-25 §7: the host-credential channel production wiring built for a host-brokered session
+     * (`RuntimeConfig.hostCredentials`). Bound to this run's control bridge the moment it exists, so every
+     * `credential_resolve` rides the session's own stdio pipe. Absent: nothing to bind.
+     */
+    hostCredentialChannel?: HostCredentialChannel;
     /**
      * `system/init.slash_commands`. Produced by `slashCommandNames(resolver, cwd)`, which ALREADY
      * includes the engine's own `/compact` -- the engine must not prepend it a second time.

package/dist/{index-gmxxtqpe.js → index-0xqzk1hm.js}

@@ -15,6 +15,12 @@ import {
   mcpServerHasRegistrations,
   STRUCTURED_OUTPUT_TOOL_NAME,
   looksLikeCommand,
+  capBytes,
+  neutralizeReminderTags,
+  readWhole,
+  readCappedLinesAndBytes,
+  registerAttachmentRenderer,
+  attachmentsIn,
   registerChildEngineFactory,
   matchFileRule,
   rawToRuleValue,
@@ -29,12 +35,6 @@ import {
   resolveProjectDirName2,
   buildForkDirectiveText,
   buildForkInitialMessages,
-  capBytes,
-  neutralizeReminderTags,
-  readWhole,
-  readCappedLinesAndBytes,
-  registerAttachmentRenderer,
-  attachmentsIn,
   gitInstructionsEnabled,
   isUserInvocable,
   buildSkillListing,
@@ -79,15 +79,23 @@ import {
   childTranscriptSubpath,
   buildChildTranscriptWriter,
   listChildAgentIds,
-  createKeychainCredentialStore,
-  createKeychainSecretReader,
   resolveSessionProvider,
   redactCredentialRef,
   createProviderContext,
   providerCredentialRef2,
   createModelClassifier2,
   selectClassifierRoute2
-} from "./index-jz5d90c6.js";
+} from "./index-d4pmmr27.js";
+import {
+  createKeychainCredentialStore,
+  createKeychainSecretReader,
+  createHostCredentialChannel,
+  createHostBrokeredCredentialStore,
+  createHostBrokeredSecretReader,
+  mcpOAuthTestStoreEnvName,
+  resolveSessionMcpOAuthStore,
+  createHostBrokeredMcpOAuthStore
+} from "./index-z6s3r4xm.js";
 import {
   createInMemoryChannel2
 } from "./index-97t2rmtf.js";
@@ -1700,8 +1708,8 @@ function apiProviderFor(providerId) {
   return providerId === undefined ? undefined : API_PROVIDER_BY_PROVIDER_ID[providerId];
 }
 var DEFAULT_PROVIDER_ACCOUNT_ID = "default";
-function createProductionCredentialStore(config, env, home) {
-  const keychain = createKeychainCredentialStore(resolveSessionKeychainService(config));
+function createProductionCredentialStore(config, env, home, keychainMember) {
+  const keychain = keychainMember ?? createKeychainCredentialStore(resolveSessionKeychainService(config));
   return createCompositeCredentialStore([
     {
       ...keychain,
@@ -2201,7 +2209,8 @@ var ALL_TIER_REFUSED_ENV = [
   storeHomeEnvName(WINTER_BRAND5),
   pluginCacheDirEnvName(WINTER_BRAND5),
   providerManagedByHostEnvName(WINTER_BRAND5),
-  disableCronEnvName(WINTER_BRAND5)
+  disableCronEnvName(WINTER_BRAND5),
+  mcpOAuthTestStoreEnvName(WINTER_BRAND5)
 ];
 function escapeRegExpLiteral2(literal) {
   return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -5469,6 +5478,7 @@ function describeCatalogModel(catalog, model, providerId) {
 async function buildProductionWiring(opts) {
   const { config, env } = opts;
   const brand = config.brand ?? WINTER_BRAND15;
+  const mcpOAuthTestStoreFile = env[mcpOAuthTestStoreEnvName(brand)];
   const winterHome = opts.winterHome ?? config.winterHome ?? resolveWinterHome2(env, brand);
   const storeHomeEnv = env[storeHomeEnvName2(brand)];
   const storeHome = config.storeHome ?? (isUnset(storeHomeEnv) ? undefined : storeHomeEnv);
@@ -5643,9 +5653,15 @@ async function buildProductionWiring(opts) {
     ...skillListingBudgetFraction !== undefined ? { budgetFraction: skillListingBudgetFraction } : {},
     ...config.contextWindowTokens !== undefined ? { contextWindowTokens: config.contextWindowTokens } : {}
   });
+  const hostCredentialChannel = config.hostCredentials === true ? createHostCredentialChannel() : undefined;
+  const hostCredentialOptions = hostCredentialChannel !== undefined ? {
+    credentials: createProductionCredentialStore(config, env, opts.provider?.home ?? env["HOME"] ?? "", createHostBrokeredCredentialStore(hostCredentialChannel)),
+    readKeychainSecret: createHostBrokeredSecretReader(hostCredentialChannel)
+  } : {};
   const providerWiring = buildSessionProvider({
     config,
     env,
+    ...hostCredentialOptions,
     providerSettings: () => providerSettingsFrom(settingsGetter()),
     resolveSlot: (requested, currentModelKey) => resolveSlot(requested, currentModelKey),
     advisorModelSetting: () => settingsGetter()?.advisor?.model,
@@ -5912,6 +5928,8 @@ async function buildProductionWiring(opts) {
       ...pluginWorkflows.length > 0 ? { pluginWorkflows } : {},
       ...settingSources !== undefined ? { settingSources } : {},
       extraMcpServerSources,
+      mcpOAuthStore: hostCredentialChannel !== undefined ? createHostBrokeredMcpOAuthStore(hostCredentialChannel) : resolveSessionMcpOAuthStore({ keychainService: resolveSessionKeychainService(config), testStoreFile: mcpOAuthTestStoreFile }),
+      ...hostCredentialChannel !== undefined ? { hostCredentialChannel } : {},
       initSlashCommands,
       initSkills,
       initPlugins,

package/dist/{index-8jgwp1px.js → index-9s68t0pd.js}

@@ -1,3 +1,11 @@
+import {
+  mcpOAuthTokenAccount2,
+  MCP_OAUTH_EXPIRY_SKEW_MS2,
+  MCP_OAUTH_SESSION_CACHE_MS2,
+  readTokenRecordLenient,
+  refreshMcpOAuthToken2
+} from "./index-z6s3r4xm.js";
+
 // src/process-groups.ts
 var live = new Map;
 var listeners = new Set;
@@ -109,8 +117,117 @@ function toWireElicitContent(content) {
   return out;
 }
 
+// src/mcp-auth/session-provider.ts
+class McpNeedsAuthError extends Error {
+  serverName;
+  constructor(serverName, why, hint) {
+    super(`MCP server "${serverName}" needs sign-in (${why}). ${hint}`);
+    this.name = "McpNeedsAuthError";
+    this.serverName = serverName;
+  }
+}
+
+class McpAuthRefreshUnavailableError extends Error {
+  constructor(serverName) {
+    super(`MCP server "${serverName}": its sign-in could not be refreshed right now (the authorization server did not answer); reconnect it later`);
+    this.name = "McpAuthRefreshUnavailableError";
+  }
+}
+function createSessionAuthProvider(opts) {
+  const { serverName, oauth } = opts;
+  const account = mcpOAuthTokenAccount2(opts.serverUrl);
+  const now = oauth.now ?? Date.now;
+  let cached;
+  let refreshing;
+  const needsAuth = (why) => new McpNeedsAuthError(serverName, why, oauth.signInHint(serverName));
+  let refreshedGeneration;
+  const usable = (record) => {
+    if (record.expiresAt === undefined)
+      return true;
+    const margin = record.refreshToken !== undefined && record.generation !== refreshedGeneration ? MCP_OAUTH_EXPIRY_SKEW_MS2 : 0;
+    return record.expiresAt - now() > margin;
+  };
+  async function read(force) {
+    if (!force && cached !== undefined && now() - cached.readAt < MCP_OAUTH_SESSION_CACHE_MS2 && (cached.record === null || usable(cached.record)))
+      return cached.record;
+    const record = await readTokenRecordLenient(oauth.store, account);
+    cached = { record, readAt: now() };
+    return record;
+  }
+  async function ask(generation, stepUpScope) {
+    const request = { server: serverName, account, generation, ...stepUpScope !== undefined ? { stepUpScope } : {} };
+    if (oauth.askHost !== undefined) {
+      const answer = await oauth.askHost(request).catch(() => ({ ok: false, reason: "transient" }));
+      if (answer !== "unhandled")
+        return answer;
+      if (oauth.hostOwnsRefresh === true)
+        return { ok: false, reason: "transient" };
+    }
+    if (oauth.hostOwnsRefresh === true)
+      return { ok: false, reason: "transient" };
+    const result = await refreshMcpOAuthToken2({ account, store: oauth.store, generation, ...stepUpScope !== undefined ? { stepUpScope } : {}, ...oauth.fetch !== undefined ? { fetch: oauth.fetch } : {}, ...oauth.now !== undefined ? { now: oauth.now } : {} });
+    return result.ok ? { ok: true } : result;
+  }
+  function refresh(generation) {
+    refreshing ??= ask(generation).finally(() => {
+      refreshing = undefined;
+    });
+    return refreshing;
+  }
+  async function refreshed(record) {
+    if (record.refreshToken === undefined)
+      throw needsAuth("the stored token has expired and there is no refresh token");
+    const answer = await refresh(record.generation);
+    if (!answer.ok) {
+      if (answer.reason === "needs_auth")
+        throw needsAuth("the sign-in could not be refreshed");
+      throw new McpAuthRefreshUnavailableError(serverName);
+    }
+    const next = await read(true);
+    if (next === null || next.generation === record.generation)
+      throw needsAuth("the refreshed sign-in was not found");
+    refreshedGeneration = next.generation;
+    return next;
+  }
+  async function current() {
+    const record = await read(false);
+    if (record === null)
+      return;
+    if (usable(record))
+      return record.accessToken;
+    return (await refreshed(record)).accessToken;
+  }
+  return {
+    token: current,
+    async preflight() {
+      await current();
+    },
+    async onUnauthorized() {
+      const before = cached?.record ?? null;
+      const record = await read(true);
+      if (record === null)
+        throw needsAuth("the server requires a sign-in");
+      if (before === null || record.accessToken !== before.accessToken)
+        return;
+      await refreshed(record);
+    },
+    async reportInsufficientScope(scope) {
+      const record = await read(true).catch(() => null);
+      if (record === null || scope === undefined || scope.trim() === "")
+        return;
+      await ask(record.generation, scope).catch(() => {
+        return;
+      });
+    }
+  };
+}
+function mcpSignInHint(brand, serverName) {
+  const cli = brand.homeDirName.replace(/^\./, "");
+  return `Sign in with \`${cli} mcp login ${serverName}\` (or ${brand.productName} Settings -> MCP), then reconnect the server.`;
+}
+
 // src/mcp/client.ts
-import { Client, ProtocolError, ProtocolErrorCode, SdkError, SdkErrorCode, SdkHttpError, SseError, UnauthorizedError, UnsupportedProtocolVersionError } from "@modelcontextprotocol/client";
+import { Client, InsufficientScopeError, ProtocolError, ProtocolErrorCode, SdkError, SdkErrorCode, SdkHttpError, SseError, UnauthorizedError, UnsupportedProtocolVersionError } from "@modelcontextprotocol/client";
 
 // src/mcp/transports/stdio.ts
 import { spawn } from "node:child_process";
@@ -261,19 +378,22 @@ function buildStdioTransport(cfg, cwd) {
 
 // src/mcp/transports/http.ts
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+var refusingRedirectsFetch = (url, init) => fetch(url, { ...init, redirect: "error" });
 function buildHttpTransport(cfg, opts = {}) {
   const requestInit = { ...cfg.headers !== undefined ? { headers: cfg.headers } : {}, ...opts.refuseRedirects === true ? { redirect: "error" } : {} };
   const transport = new StreamableHTTPClientTransport(new URL(cfg.url), {
-    ...Object.keys(requestInit).length > 0 ? { requestInit } : {}
+    ...Object.keys(requestInit).length > 0 ? { requestInit } : {},
+    ...opts.authProvider !== undefined ? { authProvider: opts.authProvider, fetch: refusingRedirectsFetch } : {}
   });
   return transport;
 }
 
 // src/mcp/transports/sse.ts
 import { SSEClientTransport } from "@modelcontextprotocol/client";
-function buildSseTransport(cfg) {
+function buildSseTransport(cfg, opts = {}) {
   const transport = new SSEClientTransport(new URL(cfg.url), {
-    ...cfg.headers !== undefined ? { requestInit: { headers: cfg.headers } } : {}
+    ...cfg.headers !== undefined ? { requestInit: { headers: cfg.headers } } : {},
+    ...opts.authProvider !== undefined ? { authProvider: opts.authProvider, fetch: refusingRedirectsFetch } : {}
   });
   return transport;
 }
@@ -310,6 +430,12 @@ function toSdkNegotiationMode(mode) {
 function classifyConnectError(err, facts = { transportClosed: false, pinned: false }) {
   if (err instanceof McpConnectError2)
     return err;
+  if (err instanceof McpNeedsAuthError)
+    return new McpConnectError2("needs_auth", err.message);
+  if (err instanceof McpAuthRefreshUnavailableError)
+    return new McpConnectError2("auth_refresh_failed", err.message);
+  if (err instanceof InsufficientScopeError)
+    return new McpConnectError2("needs_auth", "the server requires additional permission (403 insufficient_scope); sign in again to grant it", 403);
   if (err instanceof UnauthorizedError)
     return new McpConnectError2("needs_auth", err.message);
   if (err instanceof SdkError && err.code === SdkErrorCode.RequestTimeout)
@@ -367,7 +493,7 @@ function autoProbeTimeoutMs(connectTimeoutMs) {
   return Math.max(1, Math.min(AUTO_PROBE_TIMEOUT_CAP_MS, Math.floor(connectTimeoutMs / 3)));
 }
 function retriesAsLegacy(err) {
-  if (err.code === "needs_auth" || err.code === "spawn_failed" || err.code === "version_mismatch")
+  if (err.code === "needs_auth" || err.code === "auth_refresh_failed" || err.code === "spawn_failed" || err.code === "version_mismatch")
     return false;
   return err.httpStatus !== 401 && err.httpStatus !== 403;
 }
@@ -428,10 +554,11 @@ async function connectOnce(opts, mode, connectTimeoutMs, probeTimeoutMs) {
         throw new McpConnectError2("spawn_failed", `mcp client: server "${name}" is configured as type "sdk" but no in-process server instance was supplied to connectMcpServer`);
       }
       transport = await buildSdkTransport(opts.inProcessServer);
-    } else if (config.type === "http") {
-      transport = buildHttpTransport(config, opts.refuseHttpRedirects === true ? { refuseRedirects: true } : {});
-    } else if (config.type === "sse") {
-      transport = buildSseTransport(config);
+    } else if (config.type === "http" || config.type === "sse") {
+      if (opts.auth !== undefined)
+        await boundedPreflight(opts.auth, connectTimeoutMs);
+      const authProvider = opts.auth !== undefined ? { token: () => opts.auth.token(), onUnauthorized: () => opts.auth.onUnauthorized() } : undefined;
+      transport = config.type === "http" ? buildHttpTransport(config, { ...opts.refuseHttpRedirects === true ? { refuseRedirects: true } : {}, ...authProvider !== undefined ? { authProvider } : {} }) : buildSseTransport(config, authProvider !== undefined ? { authProvider } : {});
     } else {
       if (opts.cwd === undefined) {
         throw new McpConnectError2("spawn_failed", `mcp client: stdio server "${name}" has no session cwd to start in; it is never started in the host process's cwd`);
@@ -516,10 +643,13 @@ async function connectOnce(opts, mode, connectTimeoutMs, probeTimeoutMs) {
       }
     };
   } catch (err) {
+    const scopeChallenge = insufficientScopeOf(err);
+    if (scopeChallenge !== undefined && opts.auth !== undefined)
+      await opts.auth.reportInsufficientScope(scopeChallenge.requiredScope).catch(() => {});
     const stderrTail = transport instanceof WinterStdioTransport ? transport.stderrTail.trim() : "";
     const facts = { transportClosed: transport instanceof WinterStdioTransport && transport.exitedOnItsOwn, pinned: typeof mode === "object" };
     try {
-      await transport.close();
+      await transport?.close();
     } catch {}
     const classified = classifyConnectError(err, facts);
     if (stderrTail === "" || classified.message.includes(stderrTail))
@@ -529,5 +659,34 @@ async function connectOnce(opts, mode, connectTimeoutMs, probeTimeoutMs) {
 ${stderrTail}`, classified.httpStatus);
   }
 }
+function boundedPreflight(auth, timeoutMs) {
+  let timer;
+  const outer = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new McpConnectError2("timeout", `mcp client: the sign-in check exceeded ${timeoutMs}ms`)), timeoutMs);
+    timer.unref?.();
+  });
+  return Promise.race([auth.preflight(), outer]).finally(() => {
+    if (timer !== undefined)
+      clearTimeout(timer);
+  });
+}
+function insufficientScopeOf(err) {
+  for (let e = err, depth = 0;e !== undefined && e !== null && depth < 4; e = e.cause, depth++) {
+    if (e instanceof InsufficientScopeError)
+      return e;
+  }
+  return;
+}
+function classifyMcpAuthFailure(err) {
+  for (let e = err, depth = 0;e !== undefined && e !== null && depth < 4; e = e.cause, depth++) {
+    if (e instanceof InsufficientScopeError)
+      return "insufficient_scope";
+    if (e instanceof McpNeedsAuthError || e instanceof UnauthorizedError)
+      return "needs_auth";
+    if (e instanceof SdkHttpError && e.status === 401)
+      return "needs_auth";
+  }
+  return;
+}
 
-export { trackProcessGroup, liveProcessGroups, onProcessGroupChange, createElicitationAsker2, McpConnectError2, resolveVersionNegotiation2, connectMcpServer2 };
+export { trackProcessGroup, liveProcessGroups, onProcessGroupChange, createElicitationAsker2, createSessionAuthProvider, mcpSignInHint, McpConnectError2, resolveVersionNegotiation2, connectMcpServer2, insufficientScopeOf, classifyMcpAuthFailure };

package/dist/index-bgeqc7ax.js

@@ -0,0 +1,52 @@
+import {
+  evaluateMcpAuthUrl2,
+  isLoopbackMcpServer
+} from "./index-z6s3r4xm.js";
+
+// src/mcp-auth/config.ts
+var OAUTH_KEYS = new Set(["clientId", "clientSecretRef", "callbackPort", "authServerMetadataUrl", "scopes"]);
+var SECRET_REF_KEYS = new Set(["kind"]);
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateMcpOAuthConfig2(oauth, serverUrl) {
+  if (!isPlainObject(oauth))
+    return "MCP server config 'oauth' must be an object";
+  for (const key of Object.keys(oauth)) {
+    if (key === "clientSecret")
+      return `MCP server config 'oauth.clientSecret' is refused: a client secret never lives in a config -- store it in the Keychain (the host's sign-in door) and mark it with 'oauth.clientSecretRef': { kind: "keychain" }`;
+    if (!OAUTH_KEYS.has(key))
+      return `MCP server config 'oauth' has an unknown key ${JSON.stringify(key)} (expected clientId, clientSecretRef, callbackPort, authServerMetadataUrl, scopes)`;
+  }
+  const { clientId, clientSecretRef, callbackPort, authServerMetadataUrl, scopes } = oauth;
+  if (clientId !== undefined && (typeof clientId !== "string" || clientId.trim() === ""))
+    return "MCP server config 'oauth.clientId' must be a non-empty string";
+  if (clientSecretRef !== undefined) {
+    if (clientId === undefined)
+      return "MCP server config 'oauth.clientSecretRef' needs 'oauth.clientId': a secret belongs to a pre-registered client";
+    if (!isPlainObject(clientSecretRef))
+      return `MCP server config 'oauth.clientSecretRef' must be { kind: "keychain" }`;
+    for (const key of Object.keys(clientSecretRef)) {
+      if (!SECRET_REF_KEYS.has(key))
+        return `MCP server config 'oauth.clientSecretRef' has the key ${JSON.stringify(key)}, which is refused: it is { kind: "keychain" } only -- the secret's Keychain account is derived from the server URL, never named by a config`;
+    }
+    if (clientSecretRef.kind !== "keychain")
+      return `MCP server config 'oauth.clientSecretRef.kind' must be "keychain"`;
+  }
+  if (callbackPort !== undefined && (typeof callbackPort !== "number" || !Number.isInteger(callbackPort) || callbackPort < 1 || callbackPort > 65535)) {
+    return "MCP server config 'oauth.callbackPort' must be an integer port (1-65535)";
+  }
+  if (authServerMetadataUrl !== undefined) {
+    if (typeof authServerMetadataUrl !== "string")
+      return "MCP server config 'oauth.authServerMetadataUrl' must be a URL string";
+    const verdict = evaluateMcpAuthUrl2(authServerMetadataUrl, { allowLoopback: serverUrl !== undefined && isLoopbackMcpServer(serverUrl) });
+    if (!verdict.ok)
+      return `MCP server config 'oauth.authServerMetadataUrl' is refused: ${verdict.reason}`;
+  }
+  if (scopes !== undefined && (!Array.isArray(scopes) || scopes.some((s) => typeof s !== "string" || s === "" || /\s/.test(s)))) {
+    return "MCP server config 'oauth.scopes' must be an array of scope tokens (non-empty, no whitespace)";
+  }
+  return;
+}
+
+export { validateMcpOAuthConfig2 };

package/dist/{index-eyddzcgs.js → index-c7kq6erg.js}

@@ -9,14 +9,14 @@ import {
   resolveEngineSession2,
   resolveProductionWinterHome2,
   resolveProductionStoreHome
-} from "./index-jz5d90c6.js";
+} from "./index-d4pmmr27.js";
 import {
   registerDefaultChildEngineFactory,
   loadResumedChain,
   buildProductionWiring,
   withAutoSkillPermissions,
   restoreChildRoster
-} from "./index-gmxxtqpe.js";
+} from "./index-0xqzk1hm.js";
 
 // src/embedded.ts
 import { splitFrames, encodeFrame } from "@yanlinglabs/winter-agent-sdk";