antpath 0.6.2 → 0.7.0

package/dist/_shared/blueprint.d.ts

@@ -4,11 +4,16 @@
  * Concepts (mirrored in references/architecture-decisions.md):
  *
  *   - `SkillRef` is the wire-level reference to a skill — either an
- *     `skl_*` id pointing at a workspace-uploaded bundle, or a
- *     `{vendor, skillId, version}` reference to a provider built-in.
- *     The two shapes are discriminated by `kind` so consumers branch
- *     mechanically and providers can never accidentally be looked up
- *     in `skill_bundles`.
+ *     `skl_*` id pointing at a workspace-uploaded bundle, a
+ *     `{vendor, skillId, version}` reference to a provider built-in, or
+ *     a `{slot, name, contentHash}` reference to per-run bytes attached
+ *     as a multipart part on the submitRun call (and torn down at run
+ *     terminal). The three shapes are discriminated by `kind` so
+ *     consumers branch mechanically and providers can never accidentally
+ *     be looked up in `skill_bundles`. Transient refs do NOT round-trip
+ *     through JSON (bytes can't be serialised back); `parseBlueprint`
+ *     therefore rejects them while the BFF multipart submission parser
+ *     accepts them.
  *
  *   - `McpServerRef` is the non-secret part of an MCP server declaration:
  *     `name` and `url`. Bearer / cookie / per-request headers travel in
@@ -73,7 +78,7 @@ export declare const SKILL_BUNDLE_LIMITS: {
     /** Stored directory mode. */
     readonly defaultDirMode: 493;
 };
-export type SkillRef = WorkspaceSkillRef | ProviderSkillRef;
+export type SkillRef = WorkspaceSkillRef | ProviderSkillRef | TransientSkillRef;
 export interface WorkspaceSkillRef {
     readonly kind: "workspace";
     readonly id: string;
@@ -84,14 +89,68 @@ export interface ProviderSkillRef {
     readonly skillId: string;
     readonly version?: string;
 }
+/**
+ * Per-run, non-persistent skill. The bytes ride alongside the JSON
+ * submission as a `name="skill:<slot>"` multipart body part and are
+ * uploaded by the BFF directly to the provider's per-run file storage.
+ * No `skill_bundles` row, no `run_skill_snapshots` entry, no platform
+ * storage stop — the BFF tears the file down at run terminal.
+ *
+ * `slot` is an SDK-assigned local id that pairs this ref with its
+ * multipart part within a single `submitRun` call. The BFF rejects any
+ * submission where the set of `kind:"transient"` refs doesn't have a
+ * strict 1:1 match against `name="skill:<slot>"` body parts.
+ *
+ * `contentHash` is a client-side advisory hash of the canonicalised zip
+ * (`sha256:<64 hex>`). The BFF recomputes server-side and rejects on
+ * mismatch; the value is also used by the janitor for orphan
+ * reconciliation. It MUST be deterministic across retries so the
+ * idempotency hash converges.
+ *
+ * Transient refs DO NOT round-trip safely through JSON — the bytes are
+ * not in the JSON and cannot be reconstructed. `parseBlueprint` rejects
+ * them (Blueprints are JSON-persistable and bytes are gone by the time
+ * `run.json` is loaded). `parseFlatSkills` accepts them (the BFF
+ * multipart parser is the only place that carries the matching bytes).
+ */
+export interface TransientSkillRef {
+    readonly kind: "transient";
+    readonly slot: string;
+    readonly name: string;
+    readonly contentHash: string;
+}
+/**
+ * Slot id format: `^[a-z][a-z0-9_-]{0,63}$`. The SDK generates these
+ * positionally as `transient-0`, `transient-1`, … but any client may
+ * supply an explicit slot as long as it matches the pattern and is
+ * unique within the submission.
+ */
+export declare const TRANSIENT_SLOT_PATTERN: RegExp;
+/**
+ * Content-hash format: `^sha256:[0-9a-f]{64}$` (lowercase hex). The
+ * BFF accepts only this exact prefix; uppercase, base64, or any other
+ * digest is rejected so the wire form has one stable representation.
+ */
+export declare const TRANSIENT_CONTENT_HASH_PATTERN: RegExp;
 export declare function isWorkspaceSkillRef(ref: SkillRef): ref is WorkspaceSkillRef;
 export declare function isProviderSkillRef(ref: SkillRef): ref is ProviderSkillRef;
+export declare function isTransientSkillRef(ref: SkillRef): ref is TransientSkillRef;
+/**
+ * Options accepted by `parseSkillRef`. The default (`allowTransient: true`)
+ * is the BFF submission parser path. The Blueprint parser passes
+ * `allowTransient: false` because Blueprints can be persisted to disk
+ * (`antpath run --config run.json`) and the bytes carrying the
+ * transient slot would already be gone.
+ */
+export interface ParseSkillRefOptions {
+    readonly allowTransient?: boolean;
+}
 /**
  * Parse a `SkillRef` from untrusted input. Used by the BFF run parser
  * and by the operations module when deserialising API responses. Throws
  * with a precise path so the caller can surface a usable error.
  */
-export declare function parseSkillRef(input: unknown, path: string): SkillRef;
+export declare function parseSkillRef(input: unknown, path: string, options?: ParseSkillRefOptions): SkillRef;
 /**
  * Manifest entry persisted in `skill_bundles.manifest` and
  * `run_skill_snapshots.manifest`. `path` is forward-slash, relative,

package/dist/_shared/blueprint.js

@@ -4,11 +4,16 @@
  * Concepts (mirrored in references/architecture-decisions.md):
  *
  *   - `SkillRef` is the wire-level reference to a skill — either an
- *     `skl_*` id pointing at a workspace-uploaded bundle, or a
- *     `{vendor, skillId, version}` reference to a provider built-in.
- *     The two shapes are discriminated by `kind` so consumers branch
- *     mechanically and providers can never accidentally be looked up
- *     in `skill_bundles`.
+ *     `skl_*` id pointing at a workspace-uploaded bundle, a
+ *     `{vendor, skillId, version}` reference to a provider built-in, or
+ *     a `{slot, name, contentHash}` reference to per-run bytes attached
+ *     as a multipart part on the submitRun call (and torn down at run
+ *     terminal). The three shapes are discriminated by `kind` so
+ *     consumers branch mechanically and providers can never accidentally
+ *     be looked up in `skill_bundles`. Transient refs do NOT round-trip
+ *     through JSON (bytes can't be serialised back); `parseBlueprint`
+ *     therefore rejects them while the BFF multipart submission parser
+ *     accepts them.
  *
  *   - `McpServerRef` is the non-secret part of an MCP server declaration:
  *     `name` and `url`. Bearer / cookie / per-request headers travel in
@@ -78,18 +83,34 @@ export const SKILL_BUNDLE_LIMITS = {
     /** Stored directory mode. */
     defaultDirMode: 0o755
 };
+/**
+ * Slot id format: `^[a-z][a-z0-9_-]{0,63}$`. The SDK generates these
+ * positionally as `transient-0`, `transient-1`, … but any client may
+ * supply an explicit slot as long as it matches the pattern and is
+ * unique within the submission.
+ */
+export const TRANSIENT_SLOT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+/**
+ * Content-hash format: `^sha256:[0-9a-f]{64}$` (lowercase hex). The
+ * BFF accepts only this exact prefix; uppercase, base64, or any other
+ * digest is rejected so the wire form has one stable representation.
+ */
+export const TRANSIENT_CONTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
 export function isWorkspaceSkillRef(ref) {
     return ref.kind === "workspace";
 }
 export function isProviderSkillRef(ref) {
     return ref.kind === "provider";
 }
+export function isTransientSkillRef(ref) {
+    return ref.kind === "transient";
+}
 /**
  * Parse a `SkillRef` from untrusted input. Used by the BFF run parser
  * and by the operations module when deserialising API responses. Throws
  * with a precise path so the caller can surface a usable error.
  */
-export function parseSkillRef(input, path) {
+export function parseSkillRef(input, path, options = {}) {
     if (input === null || typeof input !== "object" || Array.isArray(input)) {
         throw new Error(`${path} must be a SkillRef object`);
     }
@@ -132,7 +153,31 @@ export function parseSkillRef(input, path) {
             ...(version !== undefined ? { version } : {})
         };
     }
-    throw new Error(`${path}.kind must be 'workspace' or 'provider'`);
+    if (kind === "transient") {
+        if (options.allowTransient === false) {
+            throw new Error(`${path} carries a transient SkillRef, which cannot round-trip through JSON — ` +
+                `transient skills must be supplied at submitRun time with their bytes attached`);
+        }
+        for (const key of Object.keys(record)) {
+            if (key !== "kind" && key !== "slot" && key !== "name" && key !== "contentHash") {
+                throw new Error(`${path} contains unexpected field for transient SkillRef: ${key}`);
+            }
+        }
+        const slot = record.slot;
+        if (typeof slot !== "string" || !TRANSIENT_SLOT_PATTERN.test(slot)) {
+            throw new Error(`${path}.slot must match ${TRANSIENT_SLOT_PATTERN.source}`);
+        }
+        const name = record.name;
+        if (typeof name !== "string" || !SKILL_NAME_PATTERN.test(name)) {
+            throw new Error(`${path}.name must match ${SKILL_NAME_PATTERN.source}`);
+        }
+        const contentHash = record.contentHash;
+        if (typeof contentHash !== "string" || !TRANSIENT_CONTENT_HASH_PATTERN.test(contentHash)) {
+            throw new Error(`${path}.contentHash must match ${TRANSIENT_CONTENT_HASH_PATTERN.source}`);
+        }
+        return { kind: "transient", slot, name, contentHash };
+    }
+    throw new Error(`${path}.kind must be 'workspace', 'provider', or 'transient'`);
 }
 export class SkillBundleValidationError extends Error {
     constructor(message) {
@@ -466,7 +511,7 @@ function parseBlueprintSkills(value) {
     if (!Array.isArray(value)) {
         throw new Error("Blueprint.skills must be an array");
     }
-    return value.map((item, index) => parseSkillRef(item, `Blueprint.skills[${index}]`));
+    return value.map((item, index) => parseSkillRef(item, `Blueprint.skills[${index}]`, { allowTransient: false }));
 }
 function parseBlueprintMcpServers(value) {
     if (value === undefined) {

package/dist/_shared/operations.d.ts

@@ -23,6 +23,25 @@ export declare function cancelRun(http: HttpClient, runId: string): Promise<void
 export declare function deleteRun(http: HttpClient, runId: string): Promise<void>;
 export declare function whoami(http: HttpClient): Promise<WhoAmI>;
 export declare function submitRunFlat(http: HttpClient, request: PlatformFlatRunSubmissionInput): Promise<Run>;
+/**
+ * Multipart variant of `submitRunFlat` for runs that carry transient
+ * (per-run) skill bundles. The JSON submission travels as the
+ * `submission` part; each `TransientSkillRef.slot` in
+ * `request.submission.skills` MUST be mirrored by exactly one
+ * `skill:<slot>` part with the bundle bytes.
+ *
+ * The BFF re-canonicalises and re-hashes each bundle; a `contentHash`
+ * mismatch between the JSON ref and the recomputed hash of the bytes
+ * is rejected with a deterministic error.
+ *
+ * Bytes never persist on antpath storage; the dashboard BFF uploads
+ * them straight to Anthropic Files for the lifetime of the run.
+ */
+export declare function submitRunFlatMultipart(http: HttpClient, request: PlatformFlatRunSubmissionInput, bundles: ReadonlyArray<{
+    readonly slot: string;
+    readonly bytes: Uint8Array;
+    readonly filename: string;
+}>): Promise<Run>;
 /**
  * Upload a workspace skill bundle as a zip blob. The dashboard BFF runs
  * the two-phase flow internally (insert pending row, stream bytes into

package/dist/_shared/operations.js

@@ -50,6 +50,46 @@ export async function submitRunFlat(http, request) {
         body: JSON.stringify(request)
     });
 }
+/**
+ * Multipart variant of `submitRunFlat` for runs that carry transient
+ * (per-run) skill bundles. The JSON submission travels as the
+ * `submission` part; each `TransientSkillRef.slot` in
+ * `request.submission.skills` MUST be mirrored by exactly one
+ * `skill:<slot>` part with the bundle bytes.
+ *
+ * The BFF re-canonicalises and re-hashes each bundle; a `contentHash`
+ * mismatch between the JSON ref and the recomputed hash of the bytes
+ * is rejected with a deterministic error.
+ *
+ * Bytes never persist on antpath storage; the dashboard BFF uploads
+ * them straight to Anthropic Files for the lifetime of the run.
+ */
+export async function submitRunFlatMultipart(http, request, bundles) {
+    if (!Array.isArray(bundles) || bundles.length === 0) {
+        throw new Error("submitRunFlatMultipart: bundles must be a non-empty array");
+    }
+    const form = new FormData();
+    // Submission rides as a typed JSON Blob so the BFF reads
+    // `multipart["submission"]` with the right content-type and never
+    // has to re-detect the body shape.
+    form.append("submission", new Blob([JSON.stringify(request)], { type: "application/json" }), "submission.json");
+    const seen = new Set();
+    for (const bundle of bundles) {
+        if (typeof bundle.slot !== "string" || !bundle.slot) {
+            throw new Error("submitRunFlatMultipart: each bundle must have a non-empty slot id");
+        }
+        if (seen.has(bundle.slot)) {
+            throw new Error(`submitRunFlatMultipart: duplicate transient skill slot "${bundle.slot}"`);
+        }
+        seen.add(bundle.slot);
+        const blob = toBlob(bundle.bytes, "application/zip");
+        form.append(`skill:${bundle.slot}`, blob, bundle.filename);
+    }
+    return http.request("/api/runs", {
+        method: "POST",
+        body: form
+    });
+}
 /**
  * Upload a workspace skill bundle as a zip blob. The dashboard BFF runs
  * the two-phase flow internally (insert pending row, stream bytes into

package/dist/_shared/submission.js

@@ -795,6 +795,7 @@ function parseFlatSkills(input) {
     }
     const seenWorkspace = new Set();
     const seenProvider = new Set();
+    const seenTransientSlot = new Set();
     return input.map((item, index) => {
         const ref = parseSkillRef(item, `submission.skills[${index}]`);
         if (ref.kind === "workspace") {
@@ -803,13 +804,20 @@ function parseFlatSkills(input) {
             }
             seenWorkspace.add(ref.id);
         }
-        else {
+        else if (ref.kind === "provider") {
             const key = `${ref.vendor}:${ref.skillId}:${ref.version ?? ""}`;
             if (seenProvider.has(key)) {
                 throw new Error(`submission.skills duplicate provider skill: ${ref.vendor}:${ref.skillId}${ref.version ? `:${ref.version}` : ""}`);
             }
             seenProvider.add(key);
         }
+        else {
+            // transient
+            if (seenTransientSlot.has(ref.slot)) {
+                throw new Error(`submission.skills duplicate transient slot: ${ref.slot}`);
+            }
+            seenTransientSlot.add(ref.slot);
+        }
         return ref;
     });
 }

package/dist/blueprint.d.ts

@@ -1,16 +1,25 @@
-import type { JsonValue, PlatformCleanupPolicy, PlatformProxyEndpoint, PlatformTemplateEnvironment } from "./_shared/index.js";
+import type { JsonValue, PlatformCleanupPolicy, PlatformTemplateEnvironment } from "./_shared/index.js";
 import type { McpServer } from "./mcp-server.js";
+import type { ProxyEndpoint } from "./proxy-endpoint.js";
 import type { Skill } from "./skill.js";
 /**
  * SDK-side blueprint. Mirrors the shared `Blueprint` shape but uses the
- * SDK's `Skill` and `McpServer` classes so call sites can write
- * `skills: [rules]` and `mcpServers: [gh]` instead of repeating the
- * underlying wire types. The `submitRun` method normalises these into
- * the wire submission + secrets bag before sending.
+ * SDK's `Skill`, `McpServer`, and `ProxyEndpoint` classes so call sites
+ * can write `skills: [rules]`, `mcpServers: [gh]`, and
+ * `proxyEndpoints: [stripe]` instead of repeating the underlying wire
+ * types. The `submitRun` method normalises these into the wire
+ * submission + secrets bag before sending.
  *
  * `Blueprint` is intentionally `Omit<SubmitRunOptions, "secrets" |
  * "idempotencyKey" | "signal">` so it can be embedded as a reusable,
  * credential-free fragment via `defineRun`.
+ *
+ * Note: Blueprints can legally contain unstaged transient Skills built
+ * via `Skill.fromFiles` / `Skill.fromPath`. The transient bytes ride
+ * via multipart at `submitRun` time and never persist anywhere —
+ * exactly the right shape for a per-run, throwaway skill. Passing a
+ * Blueprint through `JSON.stringify`, however, will fail (unstaged
+ * Skills are not JSON-serialisable; see `Skill.toJSON`).
  */
 export interface Blueprint {
     readonly model: string;
@@ -20,7 +29,7 @@ export interface Blueprint {
     readonly mcpServers?: readonly McpServer[];
     readonly environment?: PlatformTemplateEnvironment;
     readonly cleanup?: PlatformCleanupPolicy;
-    readonly proxyEndpoints?: readonly PlatformProxyEndpoint[];
+    readonly proxyEndpoints?: readonly ProxyEndpoint[];
     readonly metadata?: Record<string, JsonValue>;
 }
 /**

package/dist/blueprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint.js","sourceRoot":"","sources":["../src/blueprint.ts"],"names":[],"mappings":"AAgCA;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAU,QAAwC;IACzE,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,MAAe,EAAa,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"blueprint.js","sourceRoot":"","sources":["../src/blueprint.ts"],"names":[],"mappings":"AAwCA;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAU,QAAwC;IACzE,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,MAAe,EAAa,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC"}

package/dist/bundle.d.ts

@@ -6,7 +6,13 @@
  * (`validateSkillBundleEntry`: no `..`, no absolute paths, no Windows
  * backslashes, depth/length limits). The BFF re-canonicalises and
  * recomputes the canonical hash on receipt — SDK-side hashing is NOT
- * part of any contract, so we don't expose one.
+ * part of any contract, so we don't expose one for workspace uploads.
+ *
+ * For transient (per-run) skills the SDK does compute an advisory
+ * `sha256` of the canonicalised zip via `hashSkillBundle()` — it travels
+ * in the `TransientSkillRef.contentHash` field, is used for retry
+ * de-dup and janitor reconciliation, and is recomputed server-side
+ * (mismatch → submission rejected).
  */
 export interface BundledSkill {
     readonly zip: Uint8Array;
@@ -16,3 +22,12 @@ export interface BundledSkill {
 /** Inline files map: path -> contents (UTF-8 string or raw bytes). */
 export type SkillFiles = Readonly<Record<string, string | Uint8Array>>;
 export declare function bundleSkillFiles(files: SkillFiles): BundledSkill;
+/**
+ * Compute `sha256:<hex>` of the given canonicalised zip bytes. Used by
+ * `Skill.fromFiles` / `Skill.fromPath` to populate the
+ * `TransientSkillRef.contentHash` field. The hash is advisory — the BFF
+ * recomputes server-side after re-canonicalising the zip; a mismatch is
+ * rejected. Web-Crypto-only so the SDK works in Node, edge runtimes,
+ * and browsers without polyfills.
+ */
+export declare function hashSkillBundle(zipBytes: Uint8Array): Promise<string>;

package/dist/bundle.js

@@ -52,4 +52,36 @@ export function bundleSkillFiles(files) {
     return { zip, fileCount: entries.length, compressedSize: zip.byteLength };
 }
 const ZIP_EPOCH = new Date(Date.UTC(1980, 0, 1));
+/**
+ * Compute `sha256:<hex>` of the given canonicalised zip bytes. Used by
+ * `Skill.fromFiles` / `Skill.fromPath` to populate the
+ * `TransientSkillRef.contentHash` field. The hash is advisory — the BFF
+ * recomputes server-side after re-canonicalising the zip; a mismatch is
+ * rejected. Web-Crypto-only so the SDK works in Node, edge runtimes,
+ * and browsers without polyfills.
+ */
+export async function hashSkillBundle(zipBytes) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error("hashSkillBundle: globalThis.crypto.subtle is not available; Node 18+ or a Web-Crypto-capable runtime is required");
+    }
+    // crypto.subtle.digest expects a BufferSource. Pass a freshly-sliced
+    // copy to detach from any external Uint8Array view (Web Crypto rejects
+    // non-zero byteOffset SharedArrayBuffer views, and view detach also
+    // protects against the caller mutating the input after the digest is
+    // computed).
+    const view = new Uint8Array(zipBytes.byteLength);
+    view.set(zipBytes);
+    const digest = await subtle.digest("SHA-256", view.buffer);
+    return "sha256:" + bufferToHex(digest);
+}
+function bufferToHex(buffer) {
+    const view = new Uint8Array(buffer);
+    let out = "";
+    for (let i = 0; i < view.length; i++) {
+        const byte = view[i];
+        out += byte.toString(16).padStart(2, "0");
+    }
+    return out;
+}
 //# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAkBhF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAK/B,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wBAAwB,mBAAmB,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAChD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC;QACtC,IAAI,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,4CAA4C,mBAAmB,CAAC,oBAAoB,QAAQ,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,0CAA0C,mBAAmB,CAAC,kBAAkB,eAAe,GAAG,CAAC,UAAU,GAAG,CACjH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAwBhF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAK/B,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wBAAwB,mBAAmB,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAChD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC;QACtC,IAAI,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,4CAA4C,mBAAmB,CAAC,oBAAoB,QAAQ,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,0CAA0C,mBAAmB,CAAC,kBAAkB,eAAe,GAAG,CAAC,UAAU,GAAG,CACjH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAoB;IACxD,MAAM,MAAM,GAAI,UAAqD,CAAC,MAAM,EAAE,MAAM,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,aAAa;IACb,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC/B,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli.mjs

@@ -54,6 +54,7 @@ var terminalRunStatuses = new Set(TERMINAL_RUN_STATUSES);
 
 // ../shared/dist/blueprint.js
 var SKILL_ID_PATTERN = /^skl_[A-Za-z0-9_-]{8,128}$/;
+var SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,127}$/;
 var SKILL_BUNDLE_LIMITS = {
   /** Compressed (.zip) ceiling. */
   maxCompressedBytes: 10 * 1024 * 1024,
@@ -70,7 +71,9 @@ var SKILL_BUNDLE_LIMITS = {
   /** Stored directory mode. */
   defaultDirMode: 493
 };
-function parseSkillRef(input, path) {
+var TRANSIENT_SLOT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+var TRANSIENT_CONTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
+function parseSkillRef(input, path, options = {}) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new Error(`${path} must be a SkillRef object`);
   }
@@ -113,7 +116,30 @@ function parseSkillRef(input, path) {
       ...version !== void 0 ? { version } : {}
     };
   }
-  throw new Error(`${path}.kind must be 'workspace' or 'provider'`);
+  if (kind === "transient") {
+    if (options.allowTransient === false) {
+      throw new Error(`${path} carries a transient SkillRef, which cannot round-trip through JSON \u2014 transient skills must be supplied at submitRun time with their bytes attached`);
+    }
+    for (const key of Object.keys(record)) {
+      if (key !== "kind" && key !== "slot" && key !== "name" && key !== "contentHash") {
+        throw new Error(`${path} contains unexpected field for transient SkillRef: ${key}`);
+      }
+    }
+    const slot = record.slot;
+    if (typeof slot !== "string" || !TRANSIENT_SLOT_PATTERN.test(slot)) {
+      throw new Error(`${path}.slot must match ${TRANSIENT_SLOT_PATTERN.source}`);
+    }
+    const name = record.name;
+    if (typeof name !== "string" || !SKILL_NAME_PATTERN.test(name)) {
+      throw new Error(`${path}.name must match ${SKILL_NAME_PATTERN.source}`);
+    }
+    const contentHash = record.contentHash;
+    if (typeof contentHash !== "string" || !TRANSIENT_CONTENT_HASH_PATTERN.test(contentHash)) {
+      throw new Error(`${path}.contentHash must match ${TRANSIENT_CONTENT_HASH_PATTERN.source}`);
+    }
+    return { kind: "transient", slot, name, contentHash };
+  }
+  throw new Error(`${path}.kind must be 'workspace', 'provider', or 'transient'`);
 }
 var SkillBundleValidationError = class extends Error {
   constructor(message) {
@@ -315,7 +341,7 @@ function parseBlueprintSkills(value) {
   if (!Array.isArray(value)) {
     throw new Error("Blueprint.skills must be an array");
   }
-  return value.map((item, index) => parseSkillRef(item, `Blueprint.skills[${index}]`));
+  return value.map((item, index) => parseSkillRef(item, `Blueprint.skills[${index}]`, { allowTransient: false }));
 }
 function parseBlueprintMcpServers(value) {
   if (value === void 0) {
@@ -508,6 +534,7 @@ __export(operations_exports, {
   listSkills: () => listSkills,
   submitRun: () => submitRun,
   submitRunFlat: () => submitRunFlat,
+  submitRunFlatMultipart: () => submitRunFlatMultipart,
   whoami: () => whoami
 });
 async function submitRun(http, request) {
@@ -546,6 +573,29 @@ async function submitRunFlat(http, request) {
     body: JSON.stringify(request)
   });
 }
+async function submitRunFlatMultipart(http, request, bundles) {
+  if (!Array.isArray(bundles) || bundles.length === 0) {
+    throw new Error("submitRunFlatMultipart: bundles must be a non-empty array");
+  }
+  const form = new FormData();
+  form.append("submission", new Blob([JSON.stringify(request)], { type: "application/json" }), "submission.json");
+  const seen = /* @__PURE__ */ new Set();
+  for (const bundle of bundles) {
+    if (typeof bundle.slot !== "string" || !bundle.slot) {
+      throw new Error("submitRunFlatMultipart: each bundle must have a non-empty slot id");
+    }
+    if (seen.has(bundle.slot)) {
+      throw new Error(`submitRunFlatMultipart: duplicate transient skill slot "${bundle.slot}"`);
+    }
+    seen.add(bundle.slot);
+    const blob = toBlob(bundle.bytes, "application/zip");
+    form.append(`skill:${bundle.slot}`, blob, bundle.filename);
+  }
+  return http.request("/api/runs", {
+    method: "POST",
+    body: form
+  });
+}
 async function createSkillBundle(http, args) {
   const form = new FormData();
   form.append("name", args.name);

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-0d11c4f9917f04a478449a308c1a5df2384e0281cea00ad6ecc6adcc284bc6b9  cli.mjs
+974924653a05ddcd4ac437ebc2c1e38f3ddc833c56c113f838f1c6df235b0473  cli.mjs