bitfab-cli 0.2.387 → 0.2.389

package/dist/index.js

@@ -5093,34 +5093,15 @@ var require_data = __commonJS({
   }
 });
 
-// ../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js
+// ../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
-    var isPort = RegExp.prototype.test.bind(/^\d*$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-    var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
-    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
-    var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
-    var BYTE_HEX = new Array(256);
-    {
-      const HEX_DIGITS = "0123456789ABCDEF";
-      for (let i = 0; i < 256; i++) {
-        BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
-      }
-    }
-    function percentEncodeNonAscii(cp) {
-      if (cp < 2048) {
-        return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
-      }
-      if (cp < 65536) {
-        return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
-      }
-      return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
-    }
+    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code2 = 0;
@@ -5145,105 +5126,91 @@ var require_utils = __commonJS({
       }
       return acc;
     }
-    var isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
-    var isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
-    var isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
     var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-    function isZoneIdentifier(zone) {
-      if (zone.length === 0) return false;
-      for (let i = 0; i < zone.length; i++) {
-        if (isZoneCharacter(zone[i])) continue;
-        if (zone[i] === "%" && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
-          i += 2;
-          continue;
+    function consumeIsZone(buffer) {
+      buffer.length = 0;
+      return true;
+    }
+    function consumeHextets(buffer, address, output) {
+      if (buffer.length) {
+        const hex3 = stringArrayToHexStripped(buffer);
+        if (hex3 !== "") {
+          address.push(hex3);
+        } else {
+          output.error = true;
+          return false;
         }
-        return false;
+        buffer.length = 0;
       }
       return true;
     }
-    function compressIPv6ZeroRun(hextets) {
-      let bestStart = -1;
-      let bestLength = 0;
-      let runStart = -1;
-      let runLength = 0;
-      for (let i = 0; i < hextets.length; i++) {
-        if (hextets[i] === "0") {
-          if (runStart === -1) runStart = i;
-          runLength++;
-          if (runLength > bestLength) {
-            bestLength = runLength;
-            bestStart = runStart;
+    function getIPV6(input) {
+      let tokenCount = 0;
+      const output = { error: false, address: "", zone: "" };
+      const address = [];
+      const buffer = [];
+      let endipv6Encountered = false;
+      let endIpv6 = false;
+      let consume = consumeHextets;
+      for (let i = 0; i < input.length; i++) {
+        const cursor = input[i];
+        if (cursor === "[" || cursor === "]") {
+          continue;
+        }
+        if (cursor === ":") {
+          if (endipv6Encountered === true) {
+            endIpv6 = true;
+          }
+          if (!consume(buffer, address, output)) {
+            break;
+          }
+          if (++tokenCount > 7) {
+            output.error = true;
+            break;
           }
+          if (i > 0 && input[i - 1] === ":") {
+            endipv6Encountered = true;
+          }
+          address.push(":");
+          continue;
+        } else if (cursor === "%") {
+          if (!consume(buffer, address, output)) {
+            break;
+          }
+          consume = consumeIsZone;
         } else {
-          runStart = -1;
-          runLength = 0;
-        }
-      }
-      if (bestLength < 2) return hextets.join(":");
-      const head = hextets.slice(0, bestStart).join(":");
-      const tail = hextets.slice(bestStart + bestLength).join(":");
-      return head + "::" + tail;
-    }
-    function normalizeIPv6Address(input) {
-      const compression = input.indexOf("::");
-      if (compression !== -1 && input.indexOf("::", compression + 1) !== -1) return void 0;
-      const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
-      const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
-      if (compression !== -1) {
-        if (left.length === 1 && left[0] === "") left.length = 0;
-        if (right.length === 1 && right[0] === "") right.length = 0;
-      }
-      const parts = left.concat(right);
-      let hextetCount = 0;
-      for (let i = 0; i < parts.length; i++) {
-        const part = parts[i];
-        if (part === "") return void 0;
-        if (part.indexOf(".") !== -1) {
-          if (i !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part)) return void 0;
-          hextetCount += 2;
+          buffer.push(cursor);
           continue;
         }
-        if (!isHextet(part)) return void 0;
-        parts[i] = parseInt(part, 16).toString(16);
-        hextetCount++;
       }
-      if (compression === -1) {
-        if (hextetCount !== 8) return void 0;
-        return compressIPv6ZeroRun(parts);
+      if (buffer.length) {
+        if (consume === consumeIsZone) {
+          output.zone = buffer.join("");
+        } else if (endIpv6) {
+          address.push(buffer.join(""));
+        } else {
+          address.push(stringArrayToHexStripped(buffer));
+        }
       }
-      if (hextetCount >= 8) return void 0;
-      const expanded = parts.slice(0, left.length);
-      for (let i = hextetCount; i < 8; i++) expanded.push("0");
-      for (let i = left.length; i < parts.length; i++) expanded.push(parts[i]);
-      return compressIPv6ZeroRun(expanded);
+      output.address = address.join("");
+      return output;
     }
     function normalizeIPv6(host) {
-      const bracketed = host[0] === "[" && host[host.length - 1] === "]";
-      const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
-      if (hasBracket && !bracketed) return { host, isIPV6: false, error: true };
-      let input = bracketed ? host.slice(1, -1) : host;
-      if (bracketed && isIPvFuture(input)) {
-        input = input.toLowerCase();
-        return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
-      }
-      if (findToken(input, ":") < 2) {
-        return { host, isIPV6: false, error: bracketed };
-      }
-      let zoneIdentifier = "";
-      const zoneSeparator = input.indexOf("%");
-      if (zoneSeparator !== -1) {
-        const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
-        zoneIdentifier = input.slice(zoneSeparator + separatorLength);
-        if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true };
-        input = input.slice(0, zoneSeparator);
-      }
-      const address = normalizeIPv6Address(input);
-      if (address === void 0) return { host, isIPV6: false, error: true };
-      return {
-        host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
-        escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
-        isIPV6: true
-      };
+      if (findToken(host, ":") < 2) {
+        return { host, isIPV6: false };
+      }
+      const ipv63 = getIPV6(host);
+      if (!ipv63.error) {
+        let newHost = ipv63.address;
+        let escapedHost = ipv63.address;
+        if (ipv63.zone) {
+          newHost += "%" + ipv63.zone;
+          escapedHost += "%25" + ipv63.zone;
+        }
+        return { host: newHost, isIPV6: true, escapedHost };
+      } else {
+        return { host, isIPV6: false };
+      }
     }
     function findToken(str, token) {
       let ind = 0;
@@ -5362,8 +5329,7 @@ var require_utils = __commonJS({
     function normalizePathEncoding(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        const ch = input[i];
-        if (ch === "%" && i + 2 < input.length) {
+        if (input[i] === "%" && i + 2 < input.length) {
           const hex3 = input.slice(i + 1, i + 3);
           if (isHexPair(hex3)) {
             const normalizedHex = hex3.toUpperCase();
@@ -5377,152 +5343,10 @@ var require_utils = __commonJS({
             continue;
           }
         }
-        if (isPathCharacter(ch)) {
-          output += ch;
+        if (isPathCharacter(input[i])) {
+          output += input[i];
         } else {
-          const code2 = input.charCodeAt(i);
-          if (code2 < 128) {
-            output += isEscapeSafe(code2) ? ch : BYTE_HEX[code2];
-          } else if (code2 < 55296 || code2 > 57343) {
-            output += percentEncodeNonAscii(code2);
-          } else if (code2 <= 56319 && i + 1 < input.length) {
-            const low = input.charCodeAt(i + 1);
-            if (low >= 56320 && low <= 57343) {
-              output += percentEncodeNonAscii(65536 + (code2 - 55296 << 10) + (low - 56320));
-              i++;
-            } else {
-              output += percentEncodeNonAscii(65533);
-            }
-          } else {
-            output += percentEncodeNonAscii(65533);
-          }
-        }
-      }
-      return output;
-    }
-    function serializePathEncoding(input, pathNoScheme = false) {
-      let output = "";
-      let firstSegment = pathNoScheme && input[0] !== "/";
-      for (let i = 0; i < input.length; i++) {
-        const ch = input[i];
-        if (ch === "%" && i + 2 < input.length) {
-          const hex3 = input.slice(i + 1, i + 3);
-          if (isHexPair(hex3)) {
-            output += "%" + hex3.toUpperCase();
-            i += 2;
-            continue;
-          }
-        }
-        if (ch === "/") {
-          firstSegment = false;
-        }
-        if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
-          output += ch;
-        } else {
-          const code2 = input.charCodeAt(i);
-          if (code2 < 128) {
-            output += BYTE_HEX[code2];
-          } else if (code2 < 55296 || code2 > 57343) {
-            output += percentEncodeNonAscii(code2);
-          } else if (code2 <= 56319 && i + 1 < input.length) {
-            const low = input.charCodeAt(i + 1);
-            if (low >= 56320 && low <= 57343) {
-              output += percentEncodeNonAscii(65536 + (code2 - 55296 << 10) + (low - 56320));
-              i++;
-            } else {
-              output += percentEncodeNonAscii(65533);
-            }
-          } else {
-            output += percentEncodeNonAscii(65533);
-          }
-        }
-      }
-      return output;
-    }
-    function encodeComponent(input, isAllowed) {
-      let output = "";
-      for (let i = 0; i < input.length; i++) {
-        const ch = input[i];
-        if (ch === "%" && i + 2 < input.length) {
-          const hex3 = input.slice(i + 1, i + 3);
-          if (isHexPair(hex3)) {
-            output += "%" + hex3.toUpperCase();
-            i += 2;
-            continue;
-          }
-        }
-        if (isAllowed(ch)) {
-          output += ch;
-        } else {
-          const code2 = input.charCodeAt(i);
-          if (code2 < 128) {
-            output += BYTE_HEX[code2];
-          } else if (code2 < 55296 || code2 > 57343) {
-            output += percentEncodeNonAscii(code2);
-          } else if (code2 <= 56319 && i + 1 < input.length) {
-            const low = input.charCodeAt(i + 1);
-            if (low >= 56320 && low <= 57343) {
-              output += percentEncodeNonAscii(65536 + (code2 - 55296 << 10) + (low - 56320));
-              i++;
-            } else {
-              output += percentEncodeNonAscii(65533);
-            }
-          } else {
-            output += percentEncodeNonAscii(65533);
-          }
-        }
-      }
-      return output;
-    }
-    function encodeUserinfo(input) {
-      return encodeComponent(input, isUserinfoCharacter);
-    }
-    function encodeQuery(input) {
-      return encodeComponent(input, isQueryFragmentCharacter);
-    }
-    function encodeFragment(input) {
-      return encodeComponent(input, isQueryFragmentCharacter);
-    }
-    function isEscapeSafe(cp) {
-      return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
-    }
-    function normalizeQueryFragmentEncoding(input) {
-      let output = "";
-      for (let i = 0; i < input.length; i++) {
-        const ch = input[i];
-        if (ch === "%" && i + 2 < input.length) {
-          const hex3 = input.slice(i + 1, i + 3);
-          if (isHexPair(hex3)) {
-            const normalizedHex = hex3.toUpperCase();
-            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
-            if (isUnreserved(decoded)) {
-              output += decoded;
-            } else {
-              output += "%" + normalizedHex;
-            }
-            i += 2;
-            continue;
-          }
-        }
-        if (isQueryFragmentCharacter(ch)) {
-          output += ch;
-        } else {
-          const code2 = input.charCodeAt(i);
-          if (code2 < 128) {
-            output += isEscapeSafe(code2) ? ch : BYTE_HEX[code2];
-          } else if (code2 < 55296 || code2 > 57343) {
-            output += percentEncodeNonAscii(code2);
-          } else if (code2 <= 56319 && i + 1 < input.length) {
-            const low = input.charCodeAt(i + 1);
-            if (low >= 56320 && low <= 57343) {
-              output += percentEncodeNonAscii(65536 + (code2 - 55296 << 10) + (low - 56320));
-              i++;
-            } else {
-              output += percentEncodeNonAscii(65533);
-            }
-          } else {
-            output += percentEncodeNonAscii(65533);
-          }
+          output += escape(input[i]);
         }
       }
       return output;
@@ -5545,18 +5369,14 @@ var require_utils = __commonJS({
     function recomposeAuthority(component) {
       const uriTokens = [];
       if (component.userinfo !== void 0) {
-        uriTokens.push(encodeUserinfo(component.userinfo));
+        uriTokens.push(component.userinfo);
         uriTokens.push("@");
       }
       if (component.host !== void 0) {
-        let host = component.host;
+        let host = unescape(component.host);
         if (!isIPv4(host)) {
-          let ipV6res = normalizeIPv6(host);
-          if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
-            host = normalizePercentEncoding(host, true);
-            ipV6res = normalizeIPv6(host);
-          }
-          if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
+          const ipV6res = normalizeIPv6(host);
+          if (ipV6res.isIPV6 === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
             host = reescapeHostDelimiters(host, false);
@@ -5565,12 +5385,8 @@ var require_utils = __commonJS({
         uriTokens.push(host);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
-        const port = String(component.port);
-        if (!isPort(port)) {
-          throw new TypeError("URI port is malformed.");
-        }
         uriTokens.push(":");
-        uriTokens.push(port);
+        uriTokens.push(String(component.port));
       }
       return uriTokens.length ? uriTokens.join("") : void 0;
     }
@@ -5580,11 +5396,6 @@ var require_utils = __commonJS({
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
-      serializePathEncoding,
-      normalizeQueryFragmentEncoding,
-      encodeUserinfo,
-      encodeQuery,
-      encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -5595,12 +5406,12 @@ var require_utils = __commonJS({
   }
 });
 
-// ../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js
+// ../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
-    var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
+    var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
     var supportedSchemeNames = (
       /** @type {const} */
       [
@@ -5661,10 +5472,9 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path15 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        const [path15, query] = wsComponent.resourceName.split("?");
         wsComponent.path = path15 && path15 !== "/" ? path15 : void 0;
-        wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
+        wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
       wsComponent.fragment = void 0;
@@ -5676,7 +5486,7 @@ var require_schemes = __commonJS({
         return urnComponent;
       }
       const matches = urnComponent.path.match(URN_REG);
-      if (matches && matches[0] === urnComponent.path) {
+      if (matches) {
         const scheme = options.scheme || urnComponent.scheme || "urn";
         urnComponent.nid = matches[1].toLowerCase();
         urnComponent.nss = matches[2];
@@ -5806,21 +5616,12 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js
+// ../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js"(exports, module) {
+  "../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
-    var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
-    function decodeValidScheme(scheme) {
-      const decodedScheme = unescape(String(scheme));
-      if (!VALID_SCHEME.test(decodedScheme)) {
-        throw new TypeError(MALFORMED_SCHEME_ERROR);
-      }
-      return decodedScheme;
-    }
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
@@ -5833,34 +5634,12 @@ var require_fast_uri = __commonJS({
     }
     function resolve5(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const {
-        parsed: baseParsed,
-        malformedAuthorityOrPort: baseMalformed,
-        malformedPercentEncoding: baseMalformedPercentEncoding,
-        malformedSchemeSpecific: baseMalformedSchemeSpecific,
-        malformedHost: baseMalformedHost,
-        malformedScheme: baseMalformedScheme
-      } = parseWithStatus(baseURI, schemelessOptions);
-      const {
-        parsed: relativeParsed,
-        malformedAuthorityOrPort: relativeMalformed,
-        malformedPercentEncoding: relativeMalformedPercentEncoding,
-        malformedSchemeSpecific: relativeMalformedSchemeSpecific,
-        malformedHost: relativeMalformedHost,
-        malformedScheme: relativeMalformedScheme
-      } = parseWithStatus(relativeURI, schemelessOptions);
-      if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
+      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed) {
         throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
       }
       const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
-      const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
-      const resolvedHost = resolved.host;
-      const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
-      canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
-      const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
-      if (resolved.error && !encodedASCIIHost) {
-        throw new Error(resolved.error);
-      }
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -5920,7 +5699,7 @@ var require_fast_uri = __commonJS({
     function equal(uriA, uriB, options) {
       const normalizedA = normalizeComparableURI(uriA, options);
       const normalizedB = normalizeComparableURI(uriB, options);
-      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA === normalizedB;
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -5941,22 +5720,19 @@ var require_fast_uri = __commonJS({
       };
       const options = Object.assign({}, opts);
       const uriTokens = [];
-      if (component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
-      }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
-      const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = serializePathEncoding(component.path, pathNoScheme);
+          component.path = escapePreservingEscapes(component.path);
+          if (component.scheme !== void 0) {
+            component.path = component.path.split("%3A").join(":");
+          }
         } else {
           component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -5974,19 +5750,16 @@ var require_fast_uri = __commonJS({
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
           s2 = removeDotSegments(s2);
         }
-        if (pathNoScheme) {
-          s2 = serializePathEncoding(s2, true);
-        }
         if (authority === void 0 && s2[0] === "/" && s2[1] === "/") {
           s2 = "/%2F" + s2.slice(2);
         }
         uriTokens.push(s2);
       }
       if (component.query !== void 0) {
-        uriTokens.push("?", encodeQuery(component.query));
+        uriTokens.push("?", component.query);
       }
       if (component.fragment !== void 0) {
-        uriTokens.push("#", encodeFragment(component.fragment));
+        uriTokens.push("#", component.fragment);
       }
       return uriTokens.join("");
     }
@@ -6002,35 +5775,6 @@ var require_fast_uri = __commonJS({
       }
       return void 0;
     }
-    function hasMalformedPercentEncoding(component) {
-      if (component === void 0) return false;
-      let percent = component.indexOf("%");
-      while (percent !== -1) {
-        if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
-          return true;
-        }
-        percent = component.indexOf("%", percent + 3);
-      }
-      return false;
-    }
-    function isIPLiteral(host) {
-      return host[0] === "[" && host[host.length - 1] === "]";
-    }
-    function hasMalformedComponentPercentEncoding(matches) {
-      const host = matches[4];
-      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
-    }
-    function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
-        try {
-          parsed.host = new URL("http://" + parsed.host).hostname;
-        } catch (e) {
-          parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
-          return true;
-        }
-      }
-      return false;
-    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -6043,11 +5787,6 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
-      let malformedPercentEncoding = false;
-      let malformedSchemeSpecific = false;
-      let malformedHost = false;
-      let malformedIPLiteral = false;
-      let malformedScheme = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -6084,19 +5823,6 @@ var require_fast_uri = __commonJS({
         parsed.path = matches[6] || "";
         parsed.query = matches[7];
         parsed.fragment = matches[8];
-        if (parsed.scheme !== void 0) {
-          const decodedScheme = unescape(parsed.scheme);
-          if (VALID_SCHEME.test(decodedScheme)) {
-            parsed.scheme = decodedScheme.toLowerCase();
-          } else {
-            parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
-            malformedScheme = true;
-          }
-        }
-        malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
-        if (malformedPercentEncoding) {
-          parsed.error = parsed.error || "URI contains malformed percent-encoding.";
-        }
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
@@ -6108,16 +5834,9 @@ var require_fast_uri = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
-            const bracketedIPLiteral = isIPLiteral(parsed.host);
-            const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
-            isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
-            malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
-            parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
-            if (malformedIPLiteral) {
-              parsed.error = parsed.error || "URI host is malformed.";
-              malformedAuthorityOrPort = true;
-            }
+            parsed.host = ipv6result.host.toLowerCase();
+            isIP = ipv6result.isIPV6;
           } else {
             isIP = true;
           }
@@ -6135,37 +5854,42 @@ var require_fast_uri = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        if (!malformedIPLiteral) {
-          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
-        }
-        if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
-          let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-          if (!isIP) {
-            host = normalizePercentEncoding(host.toLowerCase());
+        if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+            try {
+              parsed.host = new URL("http://" + parsed.host).hostname;
+            } catch (e) {
+              parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+            }
           }
-          parsed.host = reescapeHostDelimiters(host, isIP);
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
+          if (uri.indexOf("%") !== -1) {
+            if (parsed.scheme !== void 0) {
+              parsed.scheme = unescape(parsed.scheme);
+            }
+            if (parsed.host !== void 0) {
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+            }
+          }
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
-          if (parsed.query) {
-            parsed.query = normalizeQueryFragmentEncoding(parsed.query);
-          }
           if (parsed.fragment) {
-            parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
+            try {
+              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            } catch {
+              parsed.error = parsed.error || "URI malformed";
+            }
           }
         }
         if (schemeHandler && schemeHandler.parse) {
           schemeHandler.parse(parsed, options);
-          if (schemeHandler === SCHEMES.urn && parsed.nid === void 0) {
-            malformedSchemeSpecific = true;
-          }
         }
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
+      return { parsed, malformedAuthorityOrPort };
     }
     function parse3(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
@@ -6174,28 +5898,20 @@ var require_fast_uri = __commonJS({
       return normalizeStringWithStatus(uri, opts).normalized;
     }
     function normalizeStringWithStatus(uri, opts) {
-      const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
+      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
       return {
-        normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
-        malformedAuthorityOrPort,
-        malformedPercentEncoding,
-        malformedSchemeSpecific,
-        malformedHost,
-        malformedScheme
+        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort
       };
     }
     function normalizeComparableURI(uri, opts) {
-      if (typeof uri !== "string" && typeof uri !== "object") {
-        return void 0;
+      if (typeof uri === "string") {
+        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
+        return malformedAuthorityOrPort ? void 0 : normalized;
       }
-      let value;
-      try {
-        value = typeof uri === "string" ? uri : serialize(uri, opts);
-      } catch {
-        return void 0;
+      if (typeof uri === "object") {
+        return serialize(uri, opts);
       }
-      const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
-      return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? void 0 : normalized;
     }
     var fastUri = {
       SCHEMES,
@@ -24194,7 +23910,7 @@ var listExperimentTraces = {
 var getReplayStatus = {
   name: "get_replay_status",
   title: "Get Replay Status",
-  description: "Read the current status of an experiment's replay, including local replay trace ID to server replay trace ID mapping. Safe to poll while replay is still running.",
+  description: "Read an experiment's replay progress: status, local to server replay trace IDs, and finished and remaining trace attempts. Call it while a replay runs, or after one crashes to check `resumable` before rerunning with `--resume <experimentId>`.",
   inputSchema: {
     experimentId: external_exports.uuid().describe("The experiment ID to get status for")
   }
@@ -24962,8 +24678,8 @@ var semver3 = __toESM(require_semver2(), 1);
 
 // ../bitfab-plugin-lib/dist/bakedSdkVersions.js
 var BAKED_SDK_VERSIONS = {
-  typescript: "0.61.0",
-  python: "0.61.0",
+  typescript: "0.61.2",
+  python: "0.61.2",
   ruby: "0.61.0",
   go: "0.61.0"
 };
@@ -26073,7 +25789,7 @@ import { dirname as dirname3, resolve as resolve3 } from "path";
 import { createInterface } from "readline";
 
 // ../bitfab-plugin-lib/dist/replayItemWriter.js
-import { mkdirSync as mkdirSync3, renameSync, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, renameSync, writeFileSync as writeFileSync3 } from "fs";
 import { join as join3 } from "path";
 
 // ../bitfab-plugin-lib/dist/bestEffortFs.js
@@ -28925,7 +28641,7 @@ var assistantFlow = Flow.parse({
     },
     replayProgress: {
       description: "Run a replay and emit one ready-to-relay line per trace to stdout (header, then per trace: a pass/fail glyph, running n/total, and that trace's duration, with the error reason inline on failure; a liveness heartbeat line when a slow trace goes quiet; then a summary with total + average time), write a per-run replay event index to .bitfab/replays/<run-id>/events.jsonl, and write full item payloads to .bitfab/replays/<run-id>/items/*.json. Background it and relay each new line to the user",
-      args: "[--label <key>] [--total N] [--run-dir <path>] -- <replay command...>"
+      args: "[--label <key>] [--total N] [--run-dir <path>] [--resume <experimentId> [--force]] -- <replay command...>"
     },
     readTracesBatched: {
       description: "Read many traces at once: fans get_traces out in parallel batches of 10, writes the concatenated result to a temp file, and prints its path as JSON",
@@ -30516,7 +30232,8 @@ If \`completed === 0\`, do not score pass/fail on an empty set, branch to \`chec
             "edit",
             "getTraces",
             "searchTraces",
-            "ask"
+            "ask",
+            "getReplayStatus"
           ],
           title: "Check replay health",
           body: `**Route on the counts and exit code.** Goal: keep infra noise out of evaluation. Read a sample of \`item.error\` strings (and stderr on crash) first to identify the DB-shaped pattern (missing record, FK / unique constraint, write rejected, connection refused, missing env).
@@ -30539,6 +30256,11 @@ After whichever workaround the user picks, re-run \`replay-against-dataset\` and
               description: `the function's shape drifted since these traces were captured, so replay can't call it with the recorded inputs. This is recoverable: route to \`adapt-replay-inputs\` to map the recorded inputs onto the current signature, then re-run`,
               next: "iterate/adapt-replay-inputs"
             },
+            {
+              when: "whole replay command crashed after it printed an experiment ID (the `[replay] Experiment <id>` line, the `Resume with:` line, or `experimentId` in this run's `run.json`), and the experiment's status reports `resumable: true`",
+              description: `before any other crash handling, call {{tool:getReplayStatus}} with that experiment ID. When it returns \`resumable: true\`, tell the user in plain words how many traces already finished (\`finishedCount\`) and how many are left (\`remainingCount\`), and that the finished ones will be kept, not replayed again. Then show stderr and the exit code, diagnose the crash, confirm the fix with the user, and apply it. When the cause was outside the code (the process was killed, the network dropped, a rate limit, running out of memory, or the machine went to sleep), resume as described next. If that resume is refused because the working tree differs from the one the experiment started with (the refusal names the stored commit and tree, and {{tool:getReplayStatus}} returns them as \`commitSha\` and \`experimentSha\`), do not change the user's working tree yourself. Relay the refusal, name the commit and tree, and give the user three choices: return their working tree to that state their own way and ask you to resume again, resume on their current code by adding \`--force\` to the same command (finished traces from the old code are kept alongside new ones), or start a fresh replay through the crash route below. When fixing the crash needed a code change, do not resume: tell the user plainly that resuming would run the old code the experiment started with, which would hit the same crash, and start a fresh replay with the fixed code through the crash route below. Loop back to \`replay-against-dataset\`, but instead of a fresh replay, run the same \`{{command:replayProgress}}\` command with \`--resume <experimentId>\` added before \`--\`, and the replay command after \`--\` changed to the \`Resume with:\` line the crashed run printed, or else \`bitfab-replay --registry <registry-path> <pipeline-name> --resume <experimentId>\` behind the same package runner. Keep the same \`--code-change\` file, \`--mock\`, and \`--param\` / \`--params\` flags as the crashed run. Drop \`--trace-ids\`, \`--dataset-id\`, \`--limit\`, \`--attempts\`, \`--grader-ids\`, \`--only-with-assertions\`, \`--name\`, and \`--experiment-group-id\`, because the experiment already stores its traces and settings. Keep the same run directory, since resume adds to that run's \`events.jsonl\` and item files, and items marked \`carriedOver\` in the final result count as already finished. If the resume is refused, relay the refusal message as is. When it says the replay may still be running, wait two minutes and try again. For any other refusal, or when {{tool:getReplayStatus}} does not return \`resumable: true\`, use the crash route below and start a fresh replay`,
+              next: "iterate/replay-against-dataset"
+            },
             {
               when: "whole replay command crashed (non-zero child exit, or the server confirms zero replay items)",
               description: `show stderr / exit code, diagnose, confirm a script fix with the user, apply, loop back to \`replay-against-dataset\``,
@@ -31536,7 +31258,7 @@ If the block prints \`ERROR: Bitfab plugin not installed\`, the user hasn't inst
 {{/plugin-dir-lookup}}
 **SDK reference:** https://docs.bitfab.ai is the source of truth for SDK install, initialization, API surface, and replay. Every docs path below ends in \`.md\`: that suffix returns the page as plain markdown (no HTML chrome), so fetch the URLs exactly as written. Fetch in this order before writing any code, do not improvise from memory:
 - **Canonical API surface (preferred for agents):** the dense reference pages at \`/reference/typescript.md\`, \`/reference/python.md\`, \`/reference/ruby.md\`, \`/reference/go.md\`. These list every public export, signature, type, default, and error semantic, no tutorials, no prose. Read these first.
-- **Default to opt-out tracing.** For TypeScript, install and wire the matching \`@bitfab/transform\` build adapter, then use \`withTrace\`/\`trace\` for the workflow root and \`withNode\`/\`node\` only where a discovered call needs naming, typing, capture, finalization, or replay-mocking policy. For Python 3.12+, use \`@client.trace\` and \`@client.node\` the same way. Opt-in \`withSpan\`/\`span\` remains supported, but setup chooses it only when opt-out is technically impossible: Ruby, Go, Python before 3.12, a TypeScript build path for which the documented transform adapters truly cannot be wired, or a live streaming root whose output opt-out tracing cannot finalize without changing behavior. Framework handlers, processors, and their generated spans are compatible descendants of an opt-out root and are never by themselves a reason to choose spans. Keep the framework integration and use \`withNode\`/\`node\` for first-party calls that need explicit policy. Existing manual spans in the selected call stack are also not a reason to fall back. Convert that whole call stack to one opt-out surface. Before converting a span-bearing helper in place, inspect every production caller and confirm each caller belongs to the same opt-out surface; a helper shared with an opt-in caller requires a disjoint trace boundary or explicit refactor confirmation. Remove redundant span wrappers and replace policy-bearing spans with nodes. Preserve their names, types, capture controls, finalizers, and replay-mocking behavior. TypeScript \`withNode\` requires a named function, so preserve an existing name or use an additive named function form; stop for refactor confirmation if naming it would require a non-additive rewrite. Never put \`withSpan\` beneath \`withTrace\`. The SDK raises \`MixedTracingError\`. Name all three primitives when fetching a reference page so the fetched guidance cannot collapse back to spans alone.
+- **Default to opt-out tracing.** For TypeScript, wire the matching \`@bitfab/sdk/transform\` build adapter included with the SDK, then use \`withTrace\`/\`trace\` for the workflow root and \`withNode\`/\`node\` only where a discovered call needs naming, typing, capture, finalization, or replay-mocking policy. For Python 3.12+, use \`@client.trace\` and \`@client.node\` the same way. Opt-in \`withSpan\`/\`span\` remains supported, but setup chooses it only when opt-out is technically impossible: Ruby, Go, Python before 3.12, a TypeScript build path for which the documented transform adapters truly cannot be wired, or a live streaming root whose output opt-out tracing cannot finalize without changing behavior. Framework handlers, processors, and their generated spans are compatible descendants of an opt-out root and are never by themselves a reason to choose spans. Keep the framework integration and use \`withNode\`/\`node\` for first-party calls that need explicit policy. Existing manual spans in the selected call stack are also not a reason to fall back. Convert that whole call stack to one opt-out surface. Before converting a span-bearing helper in place, inspect every production caller and confirm each caller belongs to the same opt-out surface; a helper shared with an opt-in caller requires a disjoint trace boundary or explicit refactor confirmation. Remove redundant span wrappers and replace policy-bearing spans with nodes. Preserve their names, types, capture controls, finalizers, and replay-mocking behavior. TypeScript \`withNode\` requires a named function, so preserve an existing name or use an additive named function form; stop for refactor confirmation if naming it would require a non-additive rewrite. Never put \`withSpan\` beneath \`withTrace\`. The SDK raises \`MixedTracingError\`. Name all three primitives when fetching a reference page so the fetched guidance cannot collapse back to spans alone.
 - **Cross-SDK shared semantics:** \`/reference/overview.md\` (invariants), \`/reference/span-types.md\` (the \`SpanType\` enum), \`/reference/http.md\` (wire protocol).
 - **Framework integrations (fetch when a framework is detected in step 1 of Instrument):** {{frameworkDocsPaths}}. Each page documents the SDK's native handler/processor/wrapper for that framework, which is usually preferable to hand-wrapping every node/agent call with \`withSpan\`/\`@span\`.
 - **Tutorials / walkthroughs / replay registry module template:** the language-specific documentation pages (\`/typescript-sdk.md\`, \`/python-sdk.md\`, \`/ruby-sdk.md\`, \`/go-sdk.md\`). Use these for the copy-pasteable replay registry module and the replay output contract. During Instrument, fetch the Replay section before Instrument's write-instrumentation step so the replay registry module can be written alongside the instrumentation in the same cycle without re-fetching.
@@ -31798,7 +31520,7 @@ Bitfab provides opt-out tracing and safe replay during development. For TypeScri
 - \`withNode(...)\` / \`node(...)\` to configure a discovered call
 - \`replay(...)\` to run recorded scenarios against current code
 
-Default to opt-out tracing. A trace root records its serializable inputs and output plus every first-party call beneath it. Most descendants need no wrapper. Add a node only when a call needs a name, type, capture override, finalizer, or replay-mocking policy. TypeScript requires the matching \`@bitfab/transform\` build adapter; setup installs and configures it. Python requires 3.12+. Opt-in spans remain supported; setup uses them as the fallback for Ruby, Go, unsupported runtimes, and live streaming roots that opt-out tracing cannot finalize without changing behavior. Keep one tracing surface per call stack. Never mix \`withSpan\` beneath \`withTrace\`; the SDK rejects mixed tracing surfaces.
+Default to opt-out tracing. A trace root records its serializable inputs and output plus every first-party call beneath it. Most descendants need no wrapper. Add a node only when a call needs a name, type, capture override, finalizer, or replay-mocking policy. TypeScript requires the matching \`@bitfab/sdk/transform\` build adapter included with the SDK; setup configures it. Python requires 3.12+. Opt-in spans remain supported; setup uses them as the fallback for Ruby, Go, unsupported runtimes, and live streaming roots that opt-out tracing cannot finalize without changing behavior. Keep one tracing surface per call stack. Never mix \`withSpan\` beneath \`withTrace\`; the SDK rejects mixed tracing surfaces.
 
 \`replay\` calls into your trace root and can modify each captured descendant in one of five ways:
 
@@ -32059,7 +31781,7 @@ Confirm the change to the user.`,
 
 **Install the SDK now.** Detect the project's package manager from its manifest (\`pyproject.toml\` \u2192 \`uv\`/\`poetry\`; \`package.json\` \u2192 \`pnpm\`/\`npm\`/\`yarn\`/\`bun\`; \`Gemfile\` \u2192 \`bundle\`; \`go.mod\` \u2192 \`go get\`; \`requirements.txt\` \u2192 edit file + \`pip install -r\`) and run its canonical add command, do NOT stop to ask about version pinning, dependency groups, package publishing, or whether a supported transform adapter should be added. The user's request to instrument authorizes the dependencies and build wiring required by the selected approach. Prefer \`uv add\`/\`poetry add\` over bare \`pip install\` (bare \`pip install\` doesn't persist to pyproject.toml). In monorepos, scope to the correct workspace (e.g. \`pnpm add --filter <pkg>\`, or cd into the app directory first), running from the repo root will install into the wrong package. Install the SDK as a runtime dependency whenever instrumented code ships or executes from the package, including published libraries and CLIs. Use a development dependency only when the instrumented code is excluded from the published/runtime artifact. Then set the \`BITFAB_API_KEY\` environment variable.
 
-**Install opt-out capture support at the same time.** For TypeScript, add \`@bitfab/transform\` as a development dependency in the same application workspace and wire its adapter into the actual server build before instrumenting. Inspect the build tool and use the matching documented adapter. For Next.js, wrap the existing config with \`@bitfab/transform/next\` while preserving existing wrappers such as Sentry; do not replace or bypass them. For tsup, add the \`@bitfab/transform/esbuild\` plugin to the existing tsup esbuild options. For direct Node or \`tsx\`, update the real start command to register \`@bitfab/transform/register\`. The package also ships documented adapters for Vite, Rollup, webpack, Rspack, Rsbuild, Rolldown, Bun, SWC, Babel, Nest, and the TypeScript compiler. Verify the transformed build path covers the production entrypoint. Do not call a build unsupported until you have checked these adapters and the language guide. For Python, verify the runtime is 3.12+ before choosing \`trace\`/\`node\`. Fall back to opt-in spans only when the language/runtime or build path truly cannot support subtree capture, or when the selected root returns a live stream that opt-out tracing cannot finalize without changing behavior. A published package, a framework-generated span model, or the need to add a supported transform adapter is not a fallback reason. State the concrete technical blocker to the user and keep the whole selected call stack on one tracing surface.
+**Install opt-out capture support at the same time.** For TypeScript, the SDK already includes every transform adapter; do not install a second transform package. Wire the matching \`@bitfab/sdk/transform\` adapter into the actual server build before instrumenting. Inspect the build tool and use the matching documented adapter. For Next.js, wrap the existing config with \`@bitfab/sdk/transform/next\` while preserving existing wrappers such as Sentry; do not replace or bypass them. For tsup, add the \`@bitfab/sdk/transform/esbuild\` plugin to the existing tsup esbuild options. For direct Node or \`tsx\`, update the real start command to register \`@bitfab/sdk/transform/register\`. The package also ships documented adapters for Vite, Rollup, webpack, Rspack, Rsbuild, Rolldown, Bun, SWC, Babel, Nest, and the TypeScript compiler. Verify the transformed build path covers the production entrypoint. Do not call a build unsupported until you have checked these adapters and the language guide. For Python, verify the runtime is 3.12+ before choosing \`trace\`/\`node\`. Fall back to opt-in spans only when the language/runtime or build path truly cannot support subtree capture, or when the selected root returns a live stream that opt-out tracing cannot finalize without changing behavior. A published package, a framework-generated span model, or the need to add a supported transform adapter is not a fallback reason. State the concrete technical blocker to the user and keep the whole selected call stack on one tracing surface.
 
 **Keep organization-specific keys isolated.** Inspect how the selected application already names and loads Bitfab keys before changing its client initialization. A TypeScript client whose configured \`apiKey\` is missing or resolves empty falls back to \`BITFAB_API_KEY\`. If this client intentionally uses a dedicated key for another organization or environment, also set \`captureEnabled\` from the presence of that dedicated key. Never rely on an empty dedicated key to disable tracing because the fallback can send traces to the organization bound to \`BITFAB_API_KEY\`. Do not replace an existing general-purpose \`BITFAB_API_KEY\` when the application deliberately keeps these destinations separate.
 
@@ -32194,7 +31916,7 @@ Recommend one to start with. **Ask the user to pick exactly ONE workflow to inst
 
 **Delegate 11b to a subagent only when 11a is itself a large mechanical fan-out** (>10 files) whose generation genuinely overlaps the registry work. The subagent must follow the same registry-only contract.
 
-**Default instrumentation policy:** use opt-out tracing whenever the selected TypeScript or Python workflow supports it. TypeScript setup must install and configure \`@bitfab/transform\` in the application build, then put \`withTrace\`/\`trace\` on the existing workflow root. Python 3.12+ uses \`trace\` on the root. Let first-party descendants be discovered automatically and use \`withNode\`/\`node\` for external reads, unsafe side effects, model calls, naming, typing, capture overrides, finalization, and replay mocking. Do not add \`withSpan\` inside an opt-out trace. Existing \`withSpan\` usage is not a reason to extend the opt-in pattern. When a manual span already runs inside the selected call stack, migrate the call stack instead of abandoning opt-out. Before converting a span-bearing helper in place, inspect every production caller and confirm each caller belongs to the same opt-out surface; if an opt-in caller remains, use a disjoint trace boundary or stop for refactor confirmation. Remove redundant span wrappers. Replace spans that carry policy with nodes and preserve that policy. TypeScript \`withNode\` requires a named function, so preserve an existing name or use an additive named function form; stop for refactor confirmation if naming it requires a non-additive rewrite. This tracing-surface migration is instrumentation work, not an application refactor. Stop for refactor confirmation only if preserving application behavior requires changing the underlying function or its callers. Spans remain supported, but during setup choose them only when opt-out is technically impossible: Ruby, Go, unsupported Python runtimes, a TypeScript build path unsupported by every documented transform adapter, or a live streaming root whose output opt-out tracing cannot finalize without changing behavior. Framework integrations and their generated spans remain nested beneath the opt-out root; they do not justify a span root. Adding a supported transform adapter, including the esbuild adapter used by tsup, is required setup work rather than a fallback reason. Report the concrete technical blocker and keep the selected call stack on one tracing surface.
+**Default instrumentation policy:** use opt-out tracing whenever the selected TypeScript or Python workflow supports it. TypeScript setup must configure the bundled \`@bitfab/sdk/transform\` adapter in the application build, then put \`withTrace\`/\`trace\` on the existing workflow root. Python 3.12+ uses \`trace\` on the root. Let first-party descendants be discovered automatically and use \`withNode\`/\`node\` for external reads, unsafe side effects, model calls, naming, typing, capture overrides, finalization, and replay mocking. Do not add \`withSpan\` inside an opt-out trace. Existing \`withSpan\` usage is not a reason to extend the opt-in pattern. When a manual span already runs inside the selected call stack, migrate the call stack instead of abandoning opt-out. Before converting a span-bearing helper in place, inspect every production caller and confirm each caller belongs to the same opt-out surface; if an opt-in caller remains, use a disjoint trace boundary or stop for refactor confirmation. Remove redundant span wrappers. Replace spans that carry policy with nodes and preserve that policy. TypeScript \`withNode\` requires a named function, so preserve an existing name or use an additive named function form; stop for refactor confirmation if naming it requires a non-additive rewrite. This tracing-surface migration is instrumentation work, not an application refactor. Stop for refactor confirmation only if preserving application behavior requires changing the underlying function or its callers. Spans remain supported, but during setup choose them only when opt-out is technically impossible: Ruby, Go, unsupported Python runtimes, a TypeScript build path unsupported by every documented transform adapter, or a live streaming root whose output opt-out tracing cannot finalize without changing behavior. Framework integrations and their generated spans remain nested beneath the opt-out root; they do not justify a span root. Adding a supported transform adapter, including the esbuild adapter used by tsup, is required setup work rather than a fallback reason. Report the concrete technical blocker and keep the selected call stack on one tracing surface.
 
 - **11a. Instrumentation edits**: follow the SDK reference exactly, purely additive. Never change behavior, arguments, return values, error handling, variable names, types, control flow, or code structure. **Wrapping means wrapping, not silently rewriting.** Attach the opt-out trace to the existing root and configure only the discovered nodes that need policy. Rewriting, re-implementing, inlining, or hand-reconstructing a framework/SDK call to seat a root is sometimes genuinely necessary, but it is a refactor, not additive instrumentation: never do it silently as part of the write step. Any such rewrite must preserve behavior exactly (labeled *visibility* or *structural* in the refactor plan); a rewrite that would change behavior is never allowed, fall back to an additive root or move the boundary inward instead. Try the additive root first, when the natural root is opaque or stream-returning, reach for the framework handler/middleware or the \`finalize\` option wrapped around the *unchanged* call. If none of those fit and a rewrite really is required, STOP, present the refactor plan to the user in plain terms and get an explicit yes before touching the code (the "Refactor confirmation" rules below say what the plan must contain), then proceed once they approve. **Likewise, if the additive wrap doesn't typecheck, STOP and surface it rather than dropping or loosening an argument, weakening validation, or otherwise quietly changing runtime behavior to make it compile** (the same "no type-checker escape hatches, don't paper over it" rule the replay step enforces): a compile error on a purely-additive wrap means the wrap isn't additive, so either find the additive form or present it to the user as a refactor and get approval first. Batch repetitive edits into one message (many Edit calls); for large mechanical fan-outs (>10 files of the same wrapper pattern), validate the pattern on one file, then delegate the rest to a subagent. **For each external read or unsafe side effect that replay must mock, configure the discovered node with replay mocking** (TypeScript \`withNode({ type, mockOnReplay: true }, fn)\` / \`@client.node(...)\`; Python \`@client.node(type=..., mock_on_replay=True)\`). Under opt-in fallback, put the equivalent option on the span. This lets replay's \`mock: "marked"\` strategy serve its recorded output without mixing tracing surfaces.
 
@@ -32212,7 +31934,7 @@ Recommend one to start with. **Ask the user to pick exactly ONE workflow to inst
   - **Side-effect check**: if importing the instrumented function triggers module-level side effects (booting listeners/ports/prod connections), do not work around it silently; flag it to the user (a subagent returns that fact in its report so the main agent can flag it).
   - **Result**: confirm the registry module path and the exact \`bitfab-replay --registry ...\` command. Surface signature mismatches or import side effects.{{/codex}}{{#codex}}**Write instrumentation AND the replay registry module for this trace function in the same cycle.** Skip the registry for Go-only projects.
 
-**Default instrumentation policy:** use opt-out tracing whenever the selected TypeScript or Python workflow supports it. TypeScript setup must install and configure \`@bitfab/transform\` in the application build, then put \`withTrace\`/\`trace\` on the existing workflow root. Python 3.12+ uses \`trace\` on the root. Let first-party descendants be discovered automatically and use \`withNode\`/\`node\` for external reads, unsafe side effects, model calls, naming, typing, capture overrides, finalization, and replay mocking. Do not add \`withSpan\` inside an opt-out trace. Existing \`withSpan\` usage is not a reason to extend the opt-in pattern. When a manual span already runs inside the selected call stack, migrate the call stack instead of abandoning opt-out. Before converting a span-bearing helper in place, inspect every production caller and confirm each caller belongs to the same opt-out surface; if an opt-in caller remains, use a disjoint trace boundary or stop for refactor confirmation. Remove redundant span wrappers. Replace spans that carry policy with nodes and preserve that policy. TypeScript \`withNode\` requires a named function, so preserve an existing name or use an additive named function form; stop for refactor confirmation if naming it requires a non-additive rewrite. This tracing-surface migration is instrumentation work, not an application refactor. Stop for refactor confirmation only if preserving application behavior requires changing the underlying function or its callers. Spans remain supported, but during setup choose them only when opt-out is technically impossible: Ruby, Go, unsupported Python runtimes, a TypeScript build path unsupported by every documented transform adapter, or a live streaming root whose output opt-out tracing cannot finalize without changing behavior. Framework integrations and their generated spans remain nested beneath the opt-out root; they do not justify a span root. Adding a supported transform adapter, including the esbuild adapter used by tsup, is required setup work rather than a fallback reason. Report the concrete technical blocker and keep the selected call stack on one tracing surface.
+**Default instrumentation policy:** use opt-out tracing whenever the selected TypeScript or Python workflow supports it. TypeScript setup must configure the bundled \`@bitfab/sdk/transform\` adapter in the application build, then put \`withTrace\`/\`trace\` on the existing workflow root. Python 3.12+ uses \`trace\` on the root. Let first-party descendants be discovered automatically and use \`withNode\`/\`node\` for external reads, unsafe side effects, model calls, naming, typing, capture overrides, finalization, and replay mocking. Do not add \`withSpan\` inside an opt-out trace. Existing \`withSpan\` usage is not a reason to extend the opt-in pattern. When a manual span already runs inside the selected call stack, migrate the call stack instead of abandoning opt-out. Before converting a span-bearing helper in place, inspect every production caller and confirm each caller belongs to the same opt-out surface; if an opt-in caller remains, use a disjoint trace boundary or stop for refactor confirmation. Remove redundant span wrappers. Replace spans that carry policy with nodes and preserve that policy. TypeScript \`withNode\` requires a named function, so preserve an existing name or use an additive named function form; stop for refactor confirmation if naming it requires a non-additive rewrite. This tracing-surface migration is instrumentation work, not an application refactor. Stop for refactor confirmation only if preserving application behavior requires changing the underlying function or its callers. Spans remain supported, but during setup choose them only when opt-out is technically impossible: Ruby, Go, unsupported Python runtimes, a TypeScript build path unsupported by every documented transform adapter, or a live streaming root whose output opt-out tracing cannot finalize without changing behavior. Framework integrations and their generated spans remain nested beneath the opt-out root; they do not justify a span root. Adding a supported transform adapter, including the esbuild adapter used by tsup, is required setup work rather than a fallback reason. Report the concrete technical blocker and keep the selected call stack on one tracing surface.
 
 - **11a. Instrumentation edits**: follow the SDK reference exactly, purely additive. Never change behavior, arguments, return values, error handling, variable names, types, control flow, or code structure. **Wrapping means wrapping, not silently rewriting.** Attach the opt-out trace to the existing root and configure only the discovered nodes that need policy. Rewriting, re-implementing, inlining, or hand-reconstructing a framework/SDK call to seat a root is sometimes genuinely necessary, but it is a refactor, not additive instrumentation: never do it silently as part of the write step. Any such rewrite must preserve behavior exactly (labeled *visibility* or *structural* in the refactor plan); a rewrite that would change behavior is never allowed, fall back to an additive root or move the boundary inward instead. Try the additive root first, when the natural root is opaque or stream-returning, reach for the framework handler/middleware or the \`finalize\` option wrapped around the *unchanged* call. If none of those fit and a rewrite really is required, STOP, present the refactor plan to the user in plain terms and get an explicit yes before touching the code (the "Refactor confirmation" rules below say what the plan must contain), then proceed once they approve. **Likewise, if the additive wrap doesn't typecheck, STOP and surface it rather than dropping or loosening an argument, weakening validation, or otherwise quietly changing runtime behavior to make it compile** (the same "no type-checker escape hatches, don't paper over it" rule the replay step enforces): a compile error on a purely-additive wrap means the wrap isn't additive, so either find the additive form or present it to the user as a refactor and get approval first. Batch repetitive edits in parallel (one message, many Edit calls); for large mechanical fan-outs (>10 files of the same wrapper pattern), validate the pattern on one file, then do the remaining files. **For each external read or unsafe side effect that replay must mock, configure the discovered node with replay mocking** (TypeScript \`withNode({ type, mockOnReplay: true }, fn)\` / \`@client.node(...)\`; Python \`@client.node(type=..., mock_on_replay=True)\`). Under opt-in fallback, put the equivalent option on the span. This lets replay's \`mock: "marked"\` strategy serve its recorded output without mixing tracing surfaces.
 
@@ -32457,7 +32179,7 @@ Mark each key as \u2705 traces arriving (with most recent timestamp), \u26A0\uFE
    - **Bare trace-processor keys** ({{traceProcessorNames}} over plain \`run()\`): the processor captures the run but its root span records an empty input, so a processor-only key without the run wrapper {{traceProcessorRootWrappers}} or an application root is NOT replayable. Flag it \u26A0\uFE0F root not replayable and recommend adding a \`withTrace\`/\`trace\` root that takes the run input in supported subtree runtimes, or routing through the run wrapper. Recommend a manual \`withSpan\`/\`@span\` root only when opt-out is technically unavailable. When an application root exists, check its signature like any decorated key (next bullet).
    - **Decorated/wrapped keys**: read the root function signature and confirm it's replayable per Instrument's trace-boundary serializability requirement (serializable inputs). Flag any key whose root takes unserializable inputs (live SDK/DB clients, HTTP \`Request\`/\`Response\`, stream writers, sockets, opaque request contexts) as \u26A0\uFE0F root not replayable, reasoning from the signature, not the function name. This is independent of the replay-registry coverage in sub-step 3 above: a non-replayable root is \u26A0\uFE0F whether or not a registry exists for it (a key can be \u274C no replay registry module AND \u26A0\uFE0F root not replayable at once), so never roll a non-replayable root up into \u2705 just because it has no registry entry.
 
-5. **Subtree capture wiring**: an opt-out \`trace\`/\`withTrace\` root records the root and nothing beneath it unless the runtime support is actually there, which looks like healthy tracing until someone opens a trace and finds one node. Only check this when step {{step:inspect/gather-functions}} found an opt-out root; a repo whose roots are all \`withSpan\`/\`span\` needs none of it. **TypeScript** needs two things, both required: (a) \`@bitfab/transform\` in that workspace's manifest, and (b) an adapter wired into the build that produces the server entrypoint. Grep the build configuration and start scripts for \`@bitfab/transform/\`: \`next.config.*\`, \`vite.config.*\`, \`webpack.config.*\`, \`rspack.config.*\`, \`rsbuild.config.*\`, \`rollup.config.*\`, \`tsup.config.*\`, \`babel.config.*\`, Nest's \`webpackConfigPath\` target, or \`--import @bitfab/transform/register\` on the real start command. Mark \u2705 package present and adapter wired, \u26A0\uFE0F package installed but no adapter in the real build path, or \u274C package missing. **Python** needs 3.12+ instead; read the project's declared version and flag anything below it. The application's own log corroborates a \u274C or \u26A0\uFE0F finding: both SDKs log one \`[bitfab]\` warning when an opt-out root runs without its runtime support.
+5. **Subtree capture wiring**: an opt-out \`trace\`/\`withTrace\` root records the root and nothing beneath it unless the runtime support is actually there, which looks like healthy tracing until someone opens a trace and finds one node. Only check this when step {{step:inspect/gather-functions}} found an opt-out root; a repo whose roots are all \`withSpan\`/\`span\` needs none of it. **TypeScript** needs two things, both required: (a) \`@bitfab/sdk\` in that workspace's manifest, and (b) an adapter wired into the build that produces the server entrypoint. Grep the build configuration and start scripts for either the current \`@bitfab/sdk/transform/\` prefix or the still-supported \`@bitfab/transform/\` compatibility prefix: \`next.config.*\`, \`vite.config.*\`, \`webpack.config.*\`, \`rspack.config.*\`, \`rsbuild.config.*\`, \`rollup.config.*\`, \`tsup.config.*\`, \`babel.config.*\`, Nest's \`webpackConfigPath\` target, or the corresponding \`--import .../register\` on the real start command. Treat either adapter prefix as wired; do not add an SDK adapter alongside an existing compatibility adapter. Mark \u2705 package present and adapter wired, \u26A0\uFE0F package installed but no adapter in the real build path, or \u274C package missing. **Python** needs 3.12+ instead; read the project's declared version and flag anything below it. The application's own log corroborates a \u274C or \u26A0\uFE0F finding: both SDKs log one \`[bitfab]\` warning when an opt-out root runs without its runtime support.
 
 Hold these results for the report. (If nothing is instrumented, no trace function keys AND no trace-processor registrations, skip both the **replay** and the **replayability** checks, they are per-workflow, so there's nothing to evaluate; report both as \`n/a (nothing instrumented)\`, never \u2705. Still run the **plugin** and **SDK** checks: the SDK may be installed and stale, or on the legacy \`bitfab\` package needing the \`@bitfab/sdk\` rename, independent of whether any trace functions exist in this repo yet.)`,
           next: "inspect/report"
@@ -32473,13 +32195,13 @@ Hold these results for the report. (If nothing is instrumented, no trace functio
 - **Instrumented here**: the list of keys with \u2705 / \u26A0\uFE0F / \u2753 markers from step {{step:inspect/check-traces}}.
 - **Replay**: \u2705 covers all keys / \u26A0\uFE0F missing keys / \u274C none (from the replay-registry check in step {{step:inspect/check-freshness}}).
 - **Replayable**: \u2705 all roots replayable / \u26A0\uFE0F \`<key>\` root not replayable / \`n/a (nothing instrumented)\` (from the per-root replayability check in step {{step:inspect/check-freshness}}; flagged whether or not a replay registry module exists for the key; never \u2705 when nothing is instrumented).
-- **Subtree capture**: \u2705 wired / \u26A0\uFE0F \`@bitfab/transform\` installed but no adapter in the real build path / \u274C \`@bitfab/transform\` missing / \u274C Python below 3.12 / \`n/a (no opt-out roots)\` (from the subtree-capture check in step {{step:inspect/check-freshness}}).
+- **Subtree capture**: \u2705 wired / \u26A0\uFE0F \`@bitfab/sdk\` installed but no transform adapter in the real build path / \u274C \`@bitfab/sdk\` missing / \u274C Python below 3.12 / \`n/a (no opt-out roots)\` (from the subtree-capture check in step {{step:inspect/check-freshness}}).
 
 Then, for anything not healthy, name the most likely cause and the fix:
 - **Plugin or SDK out of date, or on the legacy \`bitfab\` package**: apply via the fix prompt below (upgrades the version and/or switches \`bitfab\` \u2192 \`@bitfab/sdk\`; same effect as \`{{cmd}}update\`).
 - **Replay missing or incomplete**: refresh via \`{{cmd}}setup replay\` (non-interactive; creates or extends registry entries to cover every key).
 - **Root not replayable**, two failure modes, with the fix matched to each: **(a) the root takes unserializable inputs** (live SDK/DB clients, HTTP req/res, streams, opaque contexts), with or without a replay registry module: move the trace boundary inward to a serializable-input function or refactor to introduce one; **(b) a bare trace-processor-only key** ({{traceProcessorNames}}) whose root is the processor's empty-input span: add a \`withTrace\`/\`trace\` root that wraps the run and takes its input in a supported subtree runtime, or route the run through the run wrapper ({{traceProcessorRootWrappers}}). Use a manual \`withSpan\`/\`@span\` root only when opt-out is technically unavailable. Either way, re-instrument via \`{{cmd}}setup modify\` (or \`{{cmd}}setup instrument\` for a fresh boundary). This is a code change, recommended here, not applied blanket.
-- **Opt-out roots without subtree capture**: every trace is the root alone, so tracing looks healthy and the traces are useless for per-step diagnosis, replay mocking, and prompt iteration. For TypeScript, install \`@bitfab/transform\` in that workspace and wire the matching adapter into the build behind the server entrypoint, preserving existing config wrappers such as Sentry. For Python, this is a runtime upgrade to 3.12+; report it rather than attempting it.
+- **Opt-out roots without subtree capture**: every trace is the root alone, so tracing looks healthy and the traces are useless for per-step diagnosis, replay mocking, and prompt iteration. For TypeScript, use the installed SDK and wire the matching adapter into the build behind the server entrypoint, preserving existing config wrappers such as Sentry. For Python, this is a runtime upgrade to 3.12+; report it rather than attempting it.
 - **Instrumented but no traces**: the app hasn't run with tracing enabled, or \`BITFAB_API_KEY\` isn't set in the run environment. Run the app with the key loaded.
 - **Key set but traces aren't visible in the browser**: the API key is bound to a different Clerk org/tenant than the browser session. A key resolves \`API key \u2192 organization_id \u2192 clerk_organization_id \u2192 Clerk tenant\` at creation time; browser visibility requires both to be the same tenant.
 - **Nothing instrumented**: run \`{{cmd}}setup instrument\`.
@@ -32532,7 +32254,7 @@ Then continue to the fix prompt. Inspect does not open Bitfab.`,
 - **SDK out of date** (\`updateAvailable: true\`, \`renameFrom\` null), name the workspace and the \`current \u2192 latest\` jump, then {{askVerb}} to upgrade; if yes, run the package manager's upgrade from that workspace directory (the same commands \`{{cmd}}update\` uses): npm / pnpm / yarn / bun \`add @bitfab/sdk@latest\`; uv / poetry / pip \`bitfab-py@latest\`; \`bundle update bitfab\`; \`go get github.com/Project-White-Rabbit/bitfab-go@latest && go mod tidy\`. Read the manifest afterward to confirm the new version. Each workspace is its own decision.
 - **On the legacy \`bitfab\` package** (\`renameFrom\` non-null), this rewrites import sites, so **preview before touching code**: list every \`from "bitfab"\` / \`require("bitfab")\` site you would change, then {{askVerb}} to proceed. If yes, remove the old package and add the new one in one step (e.g. \`pnpm remove bitfab && pnpm add @bitfab/sdk@latest\`, or the npm / yarn / bun equivalent) and rewrite those imports to \`@bitfab/sdk\`. Do this even when \`current\` already equals \`latest\`, the rename is the fix. (TypeScript-only; Python / Ruby / Go package names don't change.)
 - **Replay missing or incomplete**: {{askVerb}} to refresh; if yes, run \`{{cmd}}setup replay\` to create or extend the scripts so every trace function key is covered (it is non-interactive).
-- **Subtree capture not wired** (TypeScript), this edits a build file, so **preview before touching code**: name the workspace, the adapter you would use, and the exact config file or start script you would change, then {{askVerb}} to proceed. If yes, add \`@bitfab/transform\` as a development dependency in that workspace and wire the matching adapter: \`@bitfab/transform/next\` wrapping the existing \`next.config\`, the \`/vite\`, \`/rollup\`, \`/rolldown\`, \`/esbuild\`, \`/bun\`, \`/webpack\`, \`/rspack\`, \`/rsbuild\`, \`/babel\`, \`/nest\`, or \`/typescript\` entry in the existing build config, or \`--import @bitfab/transform/register\` on the real start command. Preserve every existing wrapper; never replace or bypass one. Python below 3.12 is a runtime upgrade, report it and do not attempt it.
+- **Subtree capture not wired** (TypeScript), this edits a build file, so **preview before touching code**: name the workspace, the adapter you would use, and the exact config file or start script you would change, then {{askVerb}} to proceed. If yes, use the installed SDK and wire the matching \`@bitfab/sdk/transform\` adapter: \`@bitfab/sdk/transform/next\` wrapping the existing \`next.config\`, the \`/vite\`, \`/rollup\`, \`/rolldown\`, \`/esbuild\`, \`/bun\`, \`/webpack\`, \`/rspack\`, \`/rsbuild\`, \`/babel\`, \`/nest\`, or \`/typescript\` entry in the existing build config, or \`--import @bitfab/sdk/transform/register\` on the real start command. Preserve every existing wrapper; never replace or bypass one. Python below 3.12 is a runtime upgrade, report it and do not attempt it.
 
 For unusual monorepos or private registries, defer to \`{{cmd}}update\`. Report what was applied and what the user declined. Do not open Bitfab.`,
           next: "cleanup/finish"
@@ -45700,7 +45422,7 @@ import * as p8 from "@clack/prompts";
 
 // src/setupV2Verification.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
 import { basename, relative, resolve as resolve4 } from "path";
 var MUTATING_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write"]);
 var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
@@ -45857,7 +45579,7 @@ function importedSourcePaths(registryPath, source, sourcePaths) {
 }
 function projectTypecheckCoversRegistry(cwd, registryPath) {
   const configPath = resolve4(cwd, "tsconfig.json");
-  if (!existsSync2(configPath)) {
+  if (!existsSync3(configPath)) {
     return false;
   }
   const config4 = readFileSync4(configPath, "utf8");
@@ -45954,7 +45676,7 @@ var SetupV2VerificationGate = class {
         candidatePaths.add(path15);
       }
     }
-    const readableFiles = [...candidatePaths].filter((path15) => existsSync2(path15));
+    const readableFiles = [...candidatePaths].filter((path15) => existsSync3(path15));
     const sources = /* @__PURE__ */ new Map();
     const issues = [];
     for (const path15 of readableFiles) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bitfab-cli",
-  "version": "0.2.387",
+  "version": "0.2.389",
   "description": "Install and configure the Bitfab plugin in Claude Code, Codex, or Cursor, or the Bitfab skill pack in Amp (Alpha).",
   "type": "module",
   "main": "dist/index.js",