antpath 0.6.2 → 0.8.0

package/dist/blueprint.d.ts

@@ -1,16 +1,25 @@
-import type { JsonValue, PlatformCleanupPolicy, PlatformProxyEndpoint, PlatformTemplateEnvironment } from "./_shared/index.js";
+import type { JsonValue, PlatformCleanupPolicy, PlatformTemplateEnvironment } from "./_shared/index.js";
 import type { McpServer } from "./mcp-server.js";
+import type { ProxyEndpoint } from "./proxy-endpoint.js";
 import type { Skill } from "./skill.js";
 /**
  * SDK-side blueprint. Mirrors the shared `Blueprint` shape but uses the
- * SDK's `Skill` and `McpServer` classes so call sites can write
- * `skills: [rules]` and `mcpServers: [gh]` instead of repeating the
- * underlying wire types. The `submitRun` method normalises these into
- * the wire submission + secrets bag before sending.
+ * SDK's `Skill`, `McpServer`, and `ProxyEndpoint` classes so call sites
+ * can write `skills: [rules]`, `mcpServers: [gh]`, and
+ * `proxyEndpoints: [stripe]` instead of repeating the underlying wire
+ * types. The `submitRun` method normalises these into the wire
+ * submission + secrets bag before sending.
  *
  * `Blueprint` is intentionally `Omit<SubmitRunOptions, "secrets" |
  * "idempotencyKey" | "signal">` so it can be embedded as a reusable,
  * credential-free fragment via `defineRun`.
+ *
+ * Note: Blueprints can legally contain unstaged transient Skills built
+ * via `Skill.fromFiles` / `Skill.fromPath`. The transient bytes ride
+ * via multipart at `submitRun` time and never persist anywhere —
+ * exactly the right shape for a per-run, throwaway skill. Passing a
+ * Blueprint through `JSON.stringify`, however, will fail (unstaged
+ * Skills are not JSON-serialisable; see `Skill.toJSON`).
  */
 export interface Blueprint {
     readonly model: string;
@@ -20,7 +29,7 @@ export interface Blueprint {
     readonly mcpServers?: readonly McpServer[];
     readonly environment?: PlatformTemplateEnvironment;
     readonly cleanup?: PlatformCleanupPolicy;
-    readonly proxyEndpoints?: readonly PlatformProxyEndpoint[];
+    readonly proxyEndpoints?: readonly ProxyEndpoint[];
     readonly metadata?: Record<string, JsonValue>;
 }
 /**

package/dist/blueprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint.js","sourceRoot":"","sources":["../src/blueprint.ts"],"names":[],"mappings":"AAgCA;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAU,QAAwC;IACzE,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,MAAe,EAAa,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"blueprint.js","sourceRoot":"","sources":["../src/blueprint.ts"],"names":[],"mappings":"AAwCA;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAU,QAAwC;IACzE,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,MAAe,EAAa,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC"}

package/dist/bundle.d.ts

@@ -6,7 +6,13 @@
  * (`validateSkillBundleEntry`: no `..`, no absolute paths, no Windows
  * backslashes, depth/length limits). The BFF re-canonicalises and
  * recomputes the canonical hash on receipt — SDK-side hashing is NOT
- * part of any contract, so we don't expose one.
+ * part of any contract, so we don't expose one for workspace uploads.
+ *
+ * For transient (per-run) skills the SDK does compute an advisory
+ * `sha256` of the canonicalised zip via `hashSkillBundle()` — it travels
+ * in the `TransientSkillRef.contentHash` field, is used for retry
+ * de-dup and janitor reconciliation, and is recomputed server-side
+ * (mismatch → submission rejected).
  */
 export interface BundledSkill {
     readonly zip: Uint8Array;
@@ -16,3 +22,12 @@ export interface BundledSkill {
 /** Inline files map: path -> contents (UTF-8 string or raw bytes). */
 export type SkillFiles = Readonly<Record<string, string | Uint8Array>>;
 export declare function bundleSkillFiles(files: SkillFiles): BundledSkill;
+/**
+ * Compute `sha256:<hex>` of the given canonicalised zip bytes. Used by
+ * `Skill.fromFiles` / `Skill.fromPath` to populate the
+ * `TransientSkillRef.contentHash` field. The hash is advisory — the BFF
+ * recomputes server-side after re-canonicalising the zip; a mismatch is
+ * rejected. Web-Crypto-only so the SDK works in Node, edge runtimes,
+ * and browsers without polyfills.
+ */
+export declare function hashSkillBundle(zipBytes: Uint8Array): Promise<string>;

package/dist/bundle.js

@@ -52,4 +52,36 @@ export function bundleSkillFiles(files) {
     return { zip, fileCount: entries.length, compressedSize: zip.byteLength };
 }
 const ZIP_EPOCH = new Date(Date.UTC(1980, 0, 1));
+/**
+ * Compute `sha256:<hex>` of the given canonicalised zip bytes. Used by
+ * `Skill.fromFiles` / `Skill.fromPath` to populate the
+ * `TransientSkillRef.contentHash` field. The hash is advisory — the BFF
+ * recomputes server-side after re-canonicalising the zip; a mismatch is
+ * rejected. Web-Crypto-only so the SDK works in Node, edge runtimes,
+ * and browsers without polyfills.
+ */
+export async function hashSkillBundle(zipBytes) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error("hashSkillBundle: globalThis.crypto.subtle is not available; Node 18+ or a Web-Crypto-capable runtime is required");
+    }
+    // crypto.subtle.digest expects a BufferSource. Pass a freshly-sliced
+    // copy to detach from any external Uint8Array view (Web Crypto rejects
+    // non-zero byteOffset SharedArrayBuffer views, and view detach also
+    // protects against the caller mutating the input after the digest is
+    // computed).
+    const view = new Uint8Array(zipBytes.byteLength);
+    view.set(zipBytes);
+    const digest = await subtle.digest("SHA-256", view.buffer);
+    return "sha256:" + bufferToHex(digest);
+}
+function bufferToHex(buffer) {
+    const view = new Uint8Array(buffer);
+    let out = "";
+    for (let i = 0; i < view.length; i++) {
+        const byte = view[i];
+        out += byte.toString(16).padStart(2, "0");
+    }
+    return out;
+}
 //# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAkBhF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAK/B,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wBAAwB,mBAAmB,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAChD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC;QACtC,IAAI,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,4CAA4C,mBAAmB,CAAC,oBAAoB,QAAQ,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,0CAA0C,mBAAmB,CAAC,kBAAkB,eAAe,GAAG,CAAC,UAAU,GAAG,CACjH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAwBhF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAK/B,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wBAAwB,mBAAmB,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAChD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC;QACtC,IAAI,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,4CAA4C,mBAAmB,CAAC,oBAAoB,QAAQ,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,0CAA0C,mBAAmB,CAAC,kBAAkB,eAAe,GAAG,CAAC,UAAU,GAAG,CACjH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAoB;IACxD,MAAM,MAAM,GAAI,UAAqD,CAAC,MAAM,EAAE,MAAM,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,aAAa;IACb,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC/B,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli.mjs

@@ -6,7 +6,12 @@ var __export = (target, all) => {
 };
 
 // dist/cli.js
-import { readFile as readFile2, writeFile } from "node:fs/promises";
+import { readFile as readFile2, writeFile, readdir as readdir2, stat as stat2 } from "node:fs/promises";
+import { resolve as resolvePath4 } from "node:path";
+
+// dist/internal.js
+var ANTPATH_INDEX_PATH = "/antpath/index.json";
+var ANTPATH_RUN_TOKEN_PATH = "/antpath/run-token";
 
 // ../shared/dist/config.js
 var DEFAULT_CAPS = {
@@ -54,6 +59,7 @@ var terminalRunStatuses = new Set(TERMINAL_RUN_STATUSES);
 
 // ../shared/dist/blueprint.js
 var SKILL_ID_PATTERN = /^skl_[A-Za-z0-9_-]{8,128}$/;
+var SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,127}$/;
 var SKILL_BUNDLE_LIMITS = {
   /** Compressed (.zip) ceiling. */
   maxCompressedBytes: 10 * 1024 * 1024,
@@ -70,7 +76,9 @@ var SKILL_BUNDLE_LIMITS = {
   /** Stored directory mode. */
   defaultDirMode: 493
 };
-function parseSkillRef(input, path) {
+var TRANSIENT_SLOT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+var TRANSIENT_CONTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
+function parseSkillRef(input, path, options = {}) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new Error(`${path} must be a SkillRef object`);
   }
@@ -113,7 +121,30 @@ function parseSkillRef(input, path) {
       ...version !== void 0 ? { version } : {}
     };
   }
-  throw new Error(`${path}.kind must be 'workspace' or 'provider'`);
+  if (kind === "transient") {
+    if (options.allowTransient === false) {
+      throw new Error(`${path} carries a transient SkillRef, which cannot round-trip through JSON \u2014 transient skills must be supplied at submitRun time with their bytes attached`);
+    }
+    for (const key of Object.keys(record)) {
+      if (key !== "kind" && key !== "slot" && key !== "name" && key !== "contentHash") {
+        throw new Error(`${path} contains unexpected field for transient SkillRef: ${key}`);
+      }
+    }
+    const slot = record.slot;
+    if (typeof slot !== "string" || !TRANSIENT_SLOT_PATTERN.test(slot)) {
+      throw new Error(`${path}.slot must match ${TRANSIENT_SLOT_PATTERN.source}`);
+    }
+    const name = record.name;
+    if (typeof name !== "string" || !SKILL_NAME_PATTERN.test(name)) {
+      throw new Error(`${path}.name must match ${SKILL_NAME_PATTERN.source}`);
+    }
+    const contentHash = record.contentHash;
+    if (typeof contentHash !== "string" || !TRANSIENT_CONTENT_HASH_PATTERN.test(contentHash)) {
+      throw new Error(`${path}.contentHash must match ${TRANSIENT_CONTENT_HASH_PATTERN.source}`);
+    }
+    return { kind: "transient", slot, name, contentHash };
+  }
+  throw new Error(`${path}.kind must be 'workspace', 'provider', or 'transient'`);
 }
 var SkillBundleValidationError = class extends Error {
   constructor(message) {
@@ -315,7 +346,7 @@ function parseBlueprintSkills(value) {
   if (!Array.isArray(value)) {
     throw new Error("Blueprint.skills must be an array");
   }
-  return value.map((item, index) => parseSkillRef(item, `Blueprint.skills[${index}]`));
+  return value.map((item, index) => parseSkillRef(item, `Blueprint.skills[${index}]`, { allowTransient: false }));
 }
 function parseBlueprintMcpServers(value) {
   if (value === void 0) {
@@ -501,6 +532,9 @@ __export(operations_exports, {
   createSkillBundle: () => createSkillBundle,
   deleteRun: () => deleteRun,
   deleteSkill: () => deleteSkill,
+  downloadRunArchive: () => downloadRunArchive,
+  findSkillByHash: () => findSkillByHash,
+  findSkillByName: () => findSkillByName,
   getRun: () => getRun,
   getSkill: () => getSkill,
   listOutputs: () => listOutputs,
@@ -508,6 +542,7 @@ __export(operations_exports, {
   listSkills: () => listSkills,
   submitRun: () => submitRun,
   submitRunFlat: () => submitRunFlat,
+  submitRunFlatMultipart: () => submitRunFlatMultipart,
   whoami: () => whoami
 });
 async function submitRun(http, request) {
@@ -540,12 +575,39 @@ async function deleteRun(http, runId) {
 async function whoami(http) {
   return http.request("/api/whoami");
 }
+async function downloadRunArchive(http, runId) {
+  const { response } = await http.download(`/api/runs/${encodeURIComponent(runId)}/download`);
+  return response;
+}
 async function submitRunFlat(http, request) {
   return http.request("/api/runs", {
     method: "POST",
     body: JSON.stringify(request)
   });
 }
+async function submitRunFlatMultipart(http, request, bundles) {
+  if (!Array.isArray(bundles) || bundles.length === 0) {
+    throw new Error("submitRunFlatMultipart: bundles must be a non-empty array");
+  }
+  const form = new FormData();
+  form.append("submission", new Blob([JSON.stringify(request)], { type: "application/json" }), "submission.json");
+  const seen = /* @__PURE__ */ new Set();
+  for (const bundle of bundles) {
+    if (typeof bundle.slot !== "string" || !bundle.slot) {
+      throw new Error("submitRunFlatMultipart: each bundle must have a non-empty slot id");
+    }
+    if (seen.has(bundle.slot)) {
+      throw new Error(`submitRunFlatMultipart: duplicate transient skill slot "${bundle.slot}"`);
+    }
+    seen.add(bundle.slot);
+    const blob = toBlob(bundle.bytes, "application/zip");
+    form.append(`skill:${bundle.slot}`, blob, bundle.filename);
+  }
+  return http.request("/api/runs", {
+    method: "POST",
+    body: form
+  });
+}
 async function createSkillBundle(http, args) {
   const form = new FormData();
   form.append("name", args.name);
@@ -573,6 +635,18 @@ async function deleteSkill(http, skillId) {
     method: "DELETE"
   });
 }
+async function findSkillByHash(http, args) {
+  const params = new URLSearchParams({
+    name: args.name,
+    content_hash: args.contentHash
+  });
+  const result = await http.request(`/api/skills/by-hash?${params.toString()}`);
+  return result.skill ?? null;
+}
+async function findSkillByName(http, name) {
+  const skills = await listSkills(http);
+  return skills.find((skill) => skill.name === name) ?? null;
+}
 function unwrapSkill(result) {
   if (result && typeof result === "object" && "skill" in result) {
     return result.skill;
@@ -619,10 +693,6 @@ function validateProxyAuth(endpoints, auth) {
   }
 }
 
-// dist/internal.js
-var ANTPATH_INDEX_PATH = "/antpath/index.json";
-var ANTPATH_RUN_TOKEN_PATH = "/antpath/run-token";
-
 // dist/host/common.js
 var SUCCESS = { code: 0 };
 var USAGE_ERR = { code: 2 };
@@ -780,6 +850,52 @@ function takeBooleanFlag(rest, flag) {
   return { present, remaining };
 }
 
+// dist/outputs-sync.js
+async function runOutputsSyncCmd(io2, dirs) {
+  if (dirs.length === 0) {
+    io2.stderr("usage: antpath outputs sync <dir> [<dir> ...]\n");
+    return USAGE_ERR;
+  }
+  try {
+    await io2.readFile(ANTPATH_INDEX_PATH);
+  } catch {
+    io2.stderr("`antpath outputs sync` is an in-container internal command and cannot run on the host.\n");
+    return USAGE_ERR;
+  }
+  if (!io2.walkDirectory) {
+    io2.stderr("antpath outputs sync: walkDirectory IO is not available\n");
+    return RUNTIME_ERR;
+  }
+  let scanned = 0;
+  let missing = 0;
+  for (const dir of dirs) {
+    if (!dir.startsWith("/")) {
+      io2.stderr(JSON.stringify({ dir, error: "non_absolute_path", message: "skipping non-absolute output dir" }) + "\n");
+      missing++;
+      continue;
+    }
+    let entries;
+    try {
+      entries = await io2.walkDirectory(dir);
+    } catch (err2) {
+      io2.stderr(JSON.stringify({ dir, error: "walk_failed", message: err2.message ?? "walk failed" }) + "\n");
+      missing++;
+      continue;
+    }
+    if (entries === null) {
+      io2.stderr(JSON.stringify({ dir, error: "missing_or_unreadable" }) + "\n");
+      missing++;
+      continue;
+    }
+    for (const entry of entries) {
+      io2.stdout(JSON.stringify({ dir, path: entry.path, sizeBytes: entry.sizeBytes }) + "\n");
+      scanned++;
+    }
+  }
+  io2.stdout(JSON.stringify({ summary: { dirs: dirs.length, files: scanned, missing } }) + "\n");
+  return SUCCESS;
+}
+
 // dist/proxy.js
 function parseProxyFlags(rest) {
   let endpointName = null;
@@ -2594,7 +2710,7 @@ async function runOutputsCmd(io2, argv) {
 }
 
 // dist/host/download.js
-import { resolve as resolvePath3, basename as basename2 } from "node:path";
+import { resolve as resolvePath3 } from "node:path";
 async function runDownloadCmd(io2, argv) {
   if (await refuseInsideManagedRun(io2, "download"))
     return USAGE_ERR;
@@ -2611,51 +2727,38 @@ async function runDownloadCmd(io2, argv) {
     return USAGE_ERR;
   }
   const positional = outFlag.remaining.filter((arg) => !arg.startsWith("--"));
-  if (positional.length !== 2) {
-    io2.stderr("usage: antpath download <run-id> <output-id> [--out path] [common flags]\n");
+  if (positional.length !== 1) {
+    io2.stderr("usage: antpath download <run-id> [--out path] [common flags]\n");
     return USAGE_ERR;
   }
   const runId = positional[0];
-  const outputId = positional[1];
   const http = makeHttpClient(io2, common.flags);
-  let link;
+  let response;
   try {
-    link = await operations_exports.createOutputLink(http, runId, outputId);
+    response = await operations_exports.downloadRunArchive(http, runId);
   } catch (err2) {
-    return emitJsonError(io2, "link_failed", err2.message ?? "create link failed", { runId, outputId });
+    return emitJsonError(io2, "download_failed", err2.message ?? "download failed", { runId });
   }
-  let response;
+  let bytes;
   try {
-    response = await io2.fetchImpl(link.url, { method: "GET", redirect: "follow" });
+    bytes = new Uint8Array(await response.arrayBuffer());
   } catch (err2) {
-    return emitJsonError(io2, "download_failed", `download fetch failed: ${err2.message}`, { runId, outputId });
+    return emitJsonError(io2, "download_failed", `download read failed: ${err2.message}`, { runId });
   }
-  if (!response.ok) {
-    return emitJsonError(io2, "download_failed", `download HTTP ${response.status}`, { runId, outputId });
-  }
-  const buffer = new Uint8Array(await response.arrayBuffer());
-  const destination = resolveDestination(io2, outFlag.value, outputId, link.url);
+  const destination = resolveDestination(io2, outFlag.value, runId);
   try {
-    await io2.writeFile(destination, buffer);
+    await io2.writeFile(destination, bytes);
   } catch (err2) {
-    return emitJsonError(io2, "write_failed", `failed to write output: ${err2.message}`, { destination });
+    return emitJsonError(io2, "write_failed", `failed to write archive: ${err2.message}`, { destination });
   }
-  io2.stdout(JSON.stringify({ runId, outputId, path: destination, bytes: buffer.byteLength }) + "\n");
+  io2.stdout(JSON.stringify({ runId, path: destination, bytes: bytes.byteLength }) + "\n");
   return SUCCESS;
 }
-function resolveDestination(io2, out, outputId, signedUrl) {
+function resolveDestination(io2, out, runId) {
   if (out) {
     return resolvePath3(io2.cwd(), out);
   }
-  let fileName = `${outputId}`;
-  try {
-    const url = new URL(signedUrl);
-    const tail = basename2(url.pathname);
-    if (tail)
-      fileName = tail;
-  } catch {
-  }
-  return resolvePath3(io2.cwd(), fileName);
+  return resolvePath3(io2.cwd(), `antpath-run-${runId}.zip`);
 }
 
 // dist/host/cancel.js
@@ -2765,6 +2868,9 @@ async function dispatch(io2, args) {
     case "events":
       return runEventsCmd(io2, rest);
     case "outputs":
+      if (rest[0] === "sync") {
+        return runOutputsSyncCmd(io2, rest.slice(1));
+      }
       return runOutputsCmd(io2, rest);
     case "download":
       return runDownloadCmd(io2, rest);
@@ -2814,7 +2920,7 @@ Protocol version: ${manifest.protocolVersion}
   io2.stdout("  antpath status <run-id> --api-token T\n");
   io2.stdout("  antpath events <run-id> [--follow] --api-token T\n");
   io2.stdout("  antpath outputs <run-id> --api-token T\n");
-  io2.stdout("  antpath download <run-id> <output-id> [--out path] --api-token T\n");
+  io2.stdout("  antpath download <run-id> [--out path] --api-token T\n");
   io2.stdout("  antpath cancel <run-id> --api-token T\n");
   io2.stdout("  antpath delete <run-id> --api-token T\n");
   io2.stdout("  antpath whoami --api-token T\n");
@@ -2842,6 +2948,30 @@ Protocol version: ${manifest.protocolVersion}
 }
 
 // dist/cli.js
+async function walkDirectory(root) {
+  try {
+    const rootStat = await stat2(root);
+    if (!rootStat.isDirectory())
+      return null;
+  } catch {
+    return null;
+  }
+  const out = [];
+  async function visit(dir) {
+    const entries = await readdir2(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = resolvePath4(dir, entry.name);
+      if (entry.isDirectory()) {
+        await visit(full);
+      } else if (entry.isFile()) {
+        const s = await stat2(full);
+        out.push({ path: full, sizeBytes: s.size });
+      }
+    }
+  }
+  await visit(root);
+  return out;
+}
 var io = {
   readFile: (path) => readFile2(path, "utf8"),
   writeFile: (path, data) => writeFile(path, data),
@@ -2850,6 +2980,7 @@ var io = {
   stderr: (chunk) => process.stderr.write(chunk),
   exit: (code) => process.exit(code),
   argv: process.argv,
-  cwd: () => process.cwd()
+  cwd: () => process.cwd(),
+  walkDirectory
 };
 await runCli(io);

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-0d11c4f9917f04a478449a308c1a5df2384e0281cea00ad6ecc6adcc284bc6b9  cli.mjs
+e7ee04a6c02d7ddfef1546abddda3b7031c92b8f21471a1e1cec10478a30fa50  cli.mjs