copilotkit 4.12.0 → 4.13.1

package/index.js

@@ -41,12 +41,205 @@ var __toESM = (mod3, isNodeMode, target) => (target = mod3 != null ? __create(__
 ));
 var __toCommonJS = (mod3) => __copyProps(__defProp({}, "__esModule", { value: true }), mod3);
 
+// libs/feature-flags/src/registry.ts
+function defineFlags(defs) {
+  return Object.fromEntries(
+    Object.entries(defs).map(([key, body]) => [key, { ...body, key }])
+  );
+}
+var FLAG_DEFINITIONS;
+var init_registry = __esm({
+  "libs/feature-flags/src/registry.ts"() {
+    "use strict";
+    FLAG_DEFINITIONS = defineFlags({
+      // Ops can auto-deploy before App API, including in staging. Keep issuance
+      // off in every environment until all verifiers accept this signed claim.
+      "cli.organization-slug": {
+        purpose: "Include the Clerk organization slug in CLI product credentials after App API rollout.",
+        owner: "platform",
+        createdAt: "2026-09-17",
+        status: "rollout",
+        surfaces: ["ops-api"],
+        defaultByEnv: { dev: false, ci: false, prod: false },
+        envVar: "OPS_CLI_ORGANIZATION_SLUG_ENABLED"
+      },
+      // Self-hosted is a seam, not an offered choice yet (PE-94): the target moves
+      // only the app API URL, and no onboarding path offers it. Keep released
+      // binaries on managed until a self-hosted deployment can serve the product.
+      "cli.self-hosted-deployment": {
+        purpose: "Lets the CLI target a self-hosted Intelligence deployment through --deployment or COPILOTKIT_DEPLOYMENT.",
+        owner: "platform",
+        createdAt: "2026-09-22",
+        status: "rollout",
+        surfaces: ["cli"],
+        defaultByEnv: { dev: true, ci: true, prod: false }
+      },
+      "threads.bounded-replay": {
+        purpose: "Stage connect history on disk and require SDK acknowledgements for bounded delivery.",
+        owner: "realtime",
+        createdAt: "2026-09-16",
+        status: "rollout",
+        surfaces: ["realtime-gateway", "copilotkit-core"],
+        defaultByEnv: { dev: true, ci: true, prod: false },
+        envVar: "REALTIME_GATEWAY_BOUNDED_REPLAY_ENABLED"
+      },
+      // `active` (not `rollout`): a long-lived operational kill-switch, default-on
+      // in every env; `envVar` adopts the pre-existing INSPECT_ROUTES_ENABLED name.
+      "inspect.routes": {
+        purpose: "Gates the /api/_inspect/* introspection routes used by the web inspector; operational kill-switch.",
+        owner: "platform",
+        createdAt: "2026-06-23",
+        status: "active",
+        surfaces: ["app-api"],
+        defaultByEnv: { dev: true, ci: true, prod: true },
+        envVar: "INSPECT_ROUTES_ENABLED"
+      },
+      // Rollout flag for the in-progress Channels feature (OSS-373). Lets the
+      // SDK, UI, and infra land incrementally and deploy dark; production stays off
+      // until the rollout completes and the prod default is flipped in a later
+      // build. Server boundaries enforce it via the shared `resolveChannelsRollout`
+      // helper; `envVar` pins the pre-existing FF_MANAGED_BOTS toggle name so the
+      // operational override is byte-identical across the rename.
+      channels: {
+        purpose: "Gates the Channels feature (activation, listener, delivery, egress) so unfinished customer behavior stays dark until rollout completes.",
+        owner: "channels",
+        createdAt: "2026-06-25",
+        status: "rollout",
+        surfaces: ["app-api", "realtime-gateway", "app-frontend"],
+        defaultByEnv: { dev: true, ci: true, prod: false },
+        envVar: "FF_MANAGED_BOTS"
+      },
+      "managed-channels": {
+        purpose: "Canonical Managed Channels rollout gate, evaluated alongside the legacy FF_MANAGED_BOTS override while deployments migrate.",
+        owner: "channels",
+        createdAt: "2026-07-09",
+        status: "rollout",
+        surfaces: ["app-api", "realtime-gateway", "app-frontend"],
+        defaultByEnv: { dev: true, ci: true, prod: true }
+      },
+      "learning.platform-v1": {
+        purpose: "Gates the Learning V1 control API, runtime workers, product UI, and CLI download while the platform rolls out.",
+        owner: "learning",
+        createdAt: "2026-08-06",
+        status: "rollout",
+        surfaces: ["app-api", "app-frontend", "cli"],
+        defaultByEnv: { dev: false, ci: false, prod: false },
+        envVar: "LEARNING_ENABLED"
+      },
+      "analytics.pipeline": {
+        purpose: "Gates project-scoped analytics reads and realtime projection while the durable pipeline rolls out.",
+        owner: "analytics",
+        createdAt: "2026-08-16",
+        status: "rollout",
+        surfaces: ["app-api", "realtime-gateway"],
+        defaultByEnv: { dev: false, ci: false, prod: false },
+        envVar: "ANALYTICS_ENABLED"
+      },
+      "ops.stripe-billing-v1": {
+        purpose: "Gates the direct Stripe Checkout, Portal, projection, and provider-aware billing API during rollout.",
+        owner: "ops",
+        createdAt: "2026-09-08",
+        status: "rollout",
+        surfaces: ["ops-api"],
+        defaultByEnv: { dev: true, ci: true, prod: false }
+      }
+    });
+  }
+});
+
+// libs/feature-flags/src/resolve.ts
+function resolveEnvironment(env5) {
+  const explicit = env5.FF_ENV;
+  if (explicit === "dev" || explicit === "ci" || explicit === "prod") {
+    return explicit;
+  }
+  if (env5.CI === "true") {
+    return "ci";
+  }
+  if (env5.NODE_ENV === "production") {
+    return "prod";
+  }
+  return "dev";
+}
+function flagEnvVarName(def) {
+  return def.envVar ?? `FF_${def.key.toUpperCase().replace(/[.-]/g, "_")}`;
+}
+function resolveFlag(def, env5, environment = resolveEnvironment(env5)) {
+  const raw2 = env5[flagEnvVarName(def)];
+  if (raw2 === "true") {
+    return true;
+  }
+  if (raw2 === "false") {
+    return false;
+  }
+  return def.defaultByEnv[environment];
+}
+function isFlagEnabled(key, env5, environment = resolveEnvironment(env5)) {
+  return resolveFlag(FLAG_DEFINITIONS[key], env5, environment);
+}
+var init_resolve = __esm({
+  "libs/feature-flags/src/resolve.ts"() {
+    "use strict";
+    init_registry();
+  }
+});
+
+// libs/feature-flags/src/manifest.ts
+var init_manifest = __esm({
+  "libs/feature-flags/src/manifest.ts"() {
+    "use strict";
+    init_registry();
+  }
+});
+
+// libs/feature-flags/src/ci.ts
+var init_ci = __esm({
+  "libs/feature-flags/src/ci.ts"() {
+    "use strict";
+    init_registry();
+    init_resolve();
+  }
+});
+
+// libs/feature-flags/src/index.ts
+var init_src = __esm({
+  "libs/feature-flags/src/index.ts"() {
+    "use strict";
+    init_registry();
+    init_resolve();
+    init_manifest();
+    init_ci();
+  }
+});
+
+// apps/cli/src/feature-flags.ts
+function cliReleaseChannel() {
+  return true ? "release" : "local";
+}
+function resolveCliEnvironment(env5 = process.env, channel2 = cliReleaseChannel()) {
+  const explicit = env5.FF_ENV;
+  if (explicit === "dev" || explicit === "ci" || explicit === "prod") {
+    return explicit;
+  }
+  return channel2 === "release" ? "prod" : "dev";
+}
+function isCliFlagEnabled(key, env5 = process.env) {
+  return isFlagEnabled(key, env5, resolveCliEnvironment(env5));
+}
+var init_feature_flags = __esm({
+  "apps/cli/src/feature-flags.ts"() {
+    "use strict";
+    init_src();
+  }
+});
+
 // apps/cli/src/config.ts
 var config_exports = {};
 __export(config_exports, {
   getAppApiUrl: () => getAppApiUrl,
   getBuildInfo: () => getBuildInfo,
   getC15tBackendUrl: () => getC15tBackendUrl,
+  getDeploymentTarget: () => getDeploymentTarget,
   getHostedGatewayUrl: () => getHostedGatewayUrl,
   getHostedRuntimeUrl: () => getHostedRuntimeUrl,
   getHostedSlEnabled: () => getHostedSlEnabled,
@@ -59,12 +252,52 @@ __export(config_exports, {
   getTeamsIngressBaseUrl: () => getTeamsIngressBaseUrl,
   getTelemetryEndpointUrl: () => getTelemetryEndpointUrl,
   getTemplateRef: () => getTemplateRef,
+  resetDeploymentTarget: () => resetDeploymentTarget,
   setAppApiUrl: () => setAppApiUrl,
+  setDeploymentTarget: () => setDeploymentTarget,
   setOpsApiUrl: () => setOpsApiUrl,
   setOpsFrontendUrl: () => setOpsFrontendUrl,
   setSlackIngressBaseUrl: () => setSlackIngressBaseUrl,
   setTeamsIngressBaseUrl: () => setTeamsIngressBaseUrl
 });
+function setDeploymentTarget(target) {
+  if (target.name === "self-hosted" && !isCliFlagEnabled("cli.self-hosted-deployment")) {
+    throw new Error(
+      'Self-hosted deployments are not available in this CLI release. Use "managed".'
+    );
+  }
+  if (target.name === "self-hosted" && !target.appApiUrl?.trim()) {
+    throw new Error(
+      "A self-hosted deployment needs an app API URL. Pass --app-api-url, or set COPILOTKIT_APP_API_URL."
+    );
+  }
+  deploymentTarget = target;
+}
+function resetDeploymentTarget() {
+  deploymentTarget = null;
+}
+function getDeploymentTarget() {
+  if (deploymentTarget !== null) {
+    return deploymentTarget;
+  }
+  const named = process.env["COPILOTKIT_DEPLOYMENT"]?.trim();
+  if (named === void 0 || named === "") {
+    deploymentTarget = { name: "managed" };
+    return deploymentTarget;
+  }
+  if (named !== "managed" && named !== "self-hosted") {
+    throw new Error(
+      `Unknown deployment "${named}". Use "managed" or "self-hosted".`
+    );
+  }
+  const appApiUrl = process.env["COPILOTKIT_APP_API_URL"]?.trim();
+  const resolved = {
+    name: named,
+    ...appApiUrl ? { appApiUrl } : {}
+  };
+  setDeploymentTarget(resolved);
+  return resolved;
+}
 function getOpsApiUrl() {
   return opsApiUrlOverride ?? "https://api.operations.copilotkit.ai";
 }
@@ -72,7 +305,7 @@ function setOpsApiUrl(url4) {
   opsApiUrlOverride = url4;
 }
 function getAppApiUrl() {
-  return appApiUrlOverride ?? (true ? "https://api.intelligence.copilotkit.ai" : getHostedRuntimeUrl());
+  return appApiUrlOverride ?? getDeploymentTarget().appApiUrl ?? (true ? "https://api.intelligence.copilotkit.ai" : getHostedRuntimeUrl());
 }
 function setAppApiUrl(url4) {
   appApiUrlOverride = url4;
@@ -109,14 +342,14 @@ function getTelemetryEndpointUrl() {
 }
 function getBuildInfo() {
   return {
-    version: true ? "4.12.0" : "dev",
-    buildNumber: true ? "35617651318" : "dev",
-    commitSha: true ? "894cde3a9735b1605afef07a1250bef02a123ca4" : "dev",
+    version: true ? "4.13.1" : "dev",
+    buildNumber: true ? "35769780196" : "dev",
+    commitSha: true ? "a629bd48ce4223ba2ea4fc1fb488973f8915807e" : "dev",
     copilotKitCommit: getTemplateRef()
   };
 }
 function getTemplateRef() {
-  return true ? "0048ba241fdf14a9036cdad11a4f31aa021a9c8d" : "main";
+  return true ? "f8047217b909a3e18404034f31f47157c4312241" : "main";
 }
 function getC15tBackendUrl() {
   return true ? "https://calm-hazelnut-joy-copilotkit.inth.app" : "";
@@ -136,15 +369,17 @@ function getPrivacyPolicyUrl() {
 function getPrivacyPolicyVersion() {
   return PRIVACY_POLICY_VERSION;
 }
-var opsApiUrlOverride, opsFrontendUrlOverride, appApiUrlOverride, teamsIngressBaseUrlOverride, slackIngressBaseUrlOverride, PRIVACY_POLICY_URL, PRIVACY_POLICY_VERSION;
+var opsApiUrlOverride, opsFrontendUrlOverride, appApiUrlOverride, teamsIngressBaseUrlOverride, slackIngressBaseUrlOverride, deploymentTarget, PRIVACY_POLICY_URL, PRIVACY_POLICY_VERSION;
 var init_config = __esm({
   "apps/cli/src/config.ts"() {
     "use strict";
+    init_feature_flags();
     opsApiUrlOverride = null;
     opsFrontendUrlOverride = null;
     appApiUrlOverride = null;
     teamsIngressBaseUrlOverride = null;
     slackIngressBaseUrlOverride = null;
+    deploymentTarget = null;
     PRIVACY_POLICY_URL = "https://www.copilotkit.ai/privacy-policy";
     PRIVACY_POLICY_VERSION = "2026-06-04";
   }
@@ -5656,24 +5891,24 @@ var require_fast_uri = __commonJS({
     function normalize2(uri2, options) {
       if (typeof uri2 === "string") {
         uri2 = /** @type {T} */
-        serialize3(parse13(uri2, options), options);
+        serialize3(parse14(uri2, options), options);
       } else if (typeof uri2 === "object") {
         uri2 = /** @type {T} */
-        parse13(serialize3(uri2, options), options);
+        parse14(serialize3(uri2, options), options);
       }
       return uri2;
     }
     function resolve9(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse13(baseURI, schemelessOptions), parse13(relativeURI, schemelessOptions), schemelessOptions, true);
+      const resolved = resolveComponent(parse14(baseURI, schemelessOptions), parse14(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize3(resolved, schemelessOptions);
     }
     function resolveComponent(base, relative7, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
-        base = parse13(serialize3(base, options), options);
-        relative7 = parse13(serialize3(relative7, options), options);
+        base = parse14(serialize3(base, options), options);
+        relative7 = parse14(serialize3(relative7, options), options);
       }
       options = options || {};
       if (!options.tolerant && relative7.scheme) {
@@ -5725,13 +5960,13 @@ var require_fast_uri = __commonJS({
     function equal(uriA, uriB, options) {
       if (typeof uriA === "string") {
         uriA = unescape(uriA);
-        uriA = serialize3(normalizeComponentEncoding(parse13(uriA, options), true), { ...options, skipEscape: true });
+        uriA = serialize3(normalizeComponentEncoding(parse14(uriA, options), true), { ...options, skipEscape: true });
       } else if (typeof uriA === "object") {
         uriA = serialize3(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
       }
       if (typeof uriB === "string") {
         uriB = unescape(uriB);
-        uriB = serialize3(normalizeComponentEncoding(parse13(uriB, options), true), { ...options, skipEscape: true });
+        uriB = serialize3(normalizeComponentEncoding(parse14(uriB, options), true), { ...options, skipEscape: true });
       } else if (typeof uriB === "object") {
         uriB = serialize3(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
       }
@@ -5801,7 +6036,7 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-    function parse13(uri2, opts) {
+    function parse14(uri2, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
         scheme: void 0,
@@ -5895,7 +6130,7 @@ var require_fast_uri = __commonJS({
       resolveComponent,
       equal,
       serialize: serialize3,
-      parse: parse13
+      parse: parse14
     };
     module2.exports = fastUri;
     module2.exports.default = fastUri;
@@ -10285,7 +10520,7 @@ var require_parse = __commonJS({
   "node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/parse.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var parse13 = (version6, options, throwErrors = false) => {
+    var parse14 = (version6, options, throwErrors = false) => {
       if (version6 instanceof SemVer) {
         return version6;
       }
@@ -10298,7 +10533,7 @@ var require_parse = __commonJS({
         throw er;
       }
     };
-    module2.exports = parse13;
+    module2.exports = parse14;
   }
 });
 
@@ -10306,9 +10541,9 @@ var require_parse = __commonJS({
 var require_valid = __commonJS({
   "node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/valid.js"(exports2, module2) {
     "use strict";
-    var parse13 = require_parse();
+    var parse14 = require_parse();
     var valid = (version6, options) => {
-      const v = parse13(version6, options);
+      const v = parse14(version6, options);
       return v ? v.version : null;
     };
     module2.exports = valid;
@@ -10319,9 +10554,9 @@ var require_valid = __commonJS({
 var require_clean = __commonJS({
   "node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/clean.js"(exports2, module2) {
     "use strict";
-    var parse13 = require_parse();
+    var parse14 = require_parse();
     var clean = (version6, options) => {
-      const s2 = parse13(version6.trim().replace(/^[=v]+/, ""), options);
+      const s2 = parse14(version6.trim().replace(/^[=v]+/, ""), options);
       return s2 ? s2.version : null;
     };
     module2.exports = clean;
@@ -10356,10 +10591,10 @@ var require_inc = __commonJS({
 var require_diff = __commonJS({
   "node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/diff.js"(exports2, module2) {
     "use strict";
-    var parse13 = require_parse();
+    var parse14 = require_parse();
     var diff2 = (version1, version22) => {
-      const v13 = parse13(version1, null, true);
-      const v2 = parse13(version22, null, true);
+      const v13 = parse14(version1, null, true);
+      const v2 = parse14(version22, null, true);
       const comparison = v13.compare(v2);
       if (comparison === 0) {
         return null;
@@ -10430,9 +10665,9 @@ var require_patch = __commonJS({
 var require_prerelease = __commonJS({
   "node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/prerelease.js"(exports2, module2) {
     "use strict";
-    var parse13 = require_parse();
+    var parse14 = require_parse();
     var prerelease = (version6, options) => {
-      const parsed = parse13(version6, options);
+      const parsed = parse14(version6, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module2.exports = prerelease;
@@ -10618,7 +10853,7 @@ var require_coerce = __commonJS({
   "node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/coerce.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var parse13 = require_parse();
+    var parse14 = require_parse();
     var { safeRe: re3, t: t3 } = require_re();
     var coerce = (version6, options) => {
       if (version6 instanceof SemVer) {
@@ -10653,7 +10888,7 @@ var require_coerce = __commonJS({
       const patch = match2[4] || "0";
       const prerelease = options.includePrerelease && match2[5] ? `-${match2[5]}` : "";
       const build = options.includePrerelease && match2[6] ? `+${match2[6]}` : "";
-      return parse13(`${major3}.${minor}.${patch}${prerelease}${build}`, options);
+      return parse14(`${major3}.${minor}.${patch}${prerelease}${build}`, options);
     };
     module2.exports = coerce;
   }
@@ -11669,7 +11904,7 @@ var require_semver2 = __commonJS({
     var constants3 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
-    var parse13 = require_parse();
+    var parse14 = require_parse();
     var valid = require_valid();
     var clean = require_clean();
     var inc = require_inc();
@@ -11707,7 +11942,7 @@ var require_semver2 = __commonJS({
     var simplifyRange = require_simplify();
     var subset = require_subset();
     module2.exports = {
-      parse: parse13,
+      parse: parse14,
       valid,
       clean,
       inc,
@@ -26858,6 +27093,66 @@ var init_zod = __esm({
   }
 });
 
+// libs/ops-contracts/src/billing.ts
+var billingProviderSchema, billingContextResponseSchema, paidSelfServicePlanCodeSchema, createCheckoutSessionRequestSchema, createCheckoutSessionResponseSchema, expireCheckoutSessionResponseSchema, checkoutReturnResponseSchema, createPortalSessionRequestSchema, createPortalSessionResponseSchema;
+var init_billing = __esm({
+  "libs/ops-contracts/src/billing.ts"() {
+    "use strict";
+    init_zod();
+    billingProviderSchema = external_exports.enum(["clerk", "stripe"]);
+    billingContextResponseSchema = external_exports.object({
+      billingProvider: billingProviderSchema
+    }).strict();
+    paidSelfServicePlanCodeSchema = external_exports.enum([
+      "pro",
+      "team",
+      "team_self_hosted"
+    ]);
+    createCheckoutSessionRequestSchema = external_exports.object({
+      planCode: paidSelfServicePlanCodeSchema,
+      // Omission preserves the prebuilt checkout for older deployed frontends.
+      uiMode: external_exports.literal("elements").optional(),
+      // An old request must never expire a checkout it has not observed.
+      replacesCheckoutSessionId: external_exports.string().min(1).max(255).startsWith("cs_").optional()
+    }).strict();
+    createCheckoutSessionResponseSchema = external_exports.union([
+      external_exports.object({
+        clientSecret: external_exports.string().min(1),
+        sessionId: external_exports.string().min(1).max(255).startsWith("cs_").optional(),
+        // Present only when resuming an Elements checkout from an earlier attempt.
+        checkoutAttemptId: external_exports.string().uuid().optional()
+      }).strict(),
+      external_exports.object({
+        state: external_exports.literal("confirmation_required"),
+        sessionId: external_exports.string().min(1),
+        checkoutAttemptId: external_exports.string().uuid().optional()
+      }).strict(),
+      external_exports.object({
+        state: external_exports.literal("recovery_required"),
+        sessionId: external_exports.string().min(1).max(255).startsWith("cs_"),
+        planCode: paidSelfServicePlanCodeSchema
+      }).strict()
+    ]);
+    expireCheckoutSessionResponseSchema = external_exports.object({ state: external_exports.literal("expired") }).strict();
+    checkoutReturnResponseSchema = external_exports.discriminatedUnion("state", [
+      external_exports.object({
+        state: external_exports.literal("paid"),
+        planCode: paidSelfServicePlanCodeSchema,
+        quantity: external_exports.number().int().positive()
+      }).strict(),
+      external_exports.object({ state: external_exports.literal("processing") }).strict(),
+      external_exports.object({ state: external_exports.literal("expired") }).strict()
+    ]);
+    createPortalSessionRequestSchema = external_exports.object({}).strict();
+    createPortalSessionResponseSchema = external_exports.object({
+      portalUrl: external_exports.string().url().refine((value) => {
+        const url4 = new URL(value);
+        return url4.origin === "https://billing.stripe.com" && !url4.username && !url4.password;
+      }, "Expected a Stripe Customer Portal URL.")
+    }).strict();
+  }
+});
+
 // libs/license-catalog/src/index.ts
 function isFeatureId(feature) {
   return FEATURE_IDS.includes(feature);
@@ -26866,7 +27161,7 @@ function getFeatureDefinition(feature) {
   return isFeatureId(feature) ? LICENSED_FEATURES[feature] : null;
 }
 var PLAN_CODES, FEATURE_IDS, LICENSED_FEATURES, BASE_FEATURES, LICENSE_CATALOG;
-var init_src = __esm({
+var init_src2 = __esm({
   "libs/license-catalog/src/index.ts"() {
     "use strict";
     PLAN_CODES = [
@@ -27349,7 +27644,10 @@ __export(src_exports, {
   adminEnterpriseSubscriptionListResponseSchema: () => adminEnterpriseSubscriptionListResponseSchema,
   adminEnterpriseSubscriptionResponseSchema: () => adminEnterpriseSubscriptionResponseSchema,
   adminEnterpriseSubscriptionSchema: () => adminEnterpriseSubscriptionSchema,
+  billingContextResponseSchema: () => billingContextResponseSchema,
+  billingProviderSchema: () => billingProviderSchema,
   catalogFeatureMapSchema: () => catalogFeatureMapSchema,
+  checkoutReturnResponseSchema: () => checkoutReturnResponseSchema,
   cliProductCredentialActorSchema: () => cliProductCredentialActorSchema,
   cliProductCredentialCapabilitySchema: () => cliProductCredentialCapabilitySchema,
   cliProductCredentialExchangeResponseSchema: () => cliProductCredentialExchangeResponseSchema,
@@ -27360,8 +27658,12 @@ __export(src_exports, {
   cliTelemetryIdentityResponseSchema: () => cliTelemetryIdentityResponseSchema,
   cliTelemetryProjectIdSchema: () => cliTelemetryProjectIdSchema,
   createAdminEnterpriseSubscriptionRequestSchema: () => createAdminEnterpriseSubscriptionRequestSchema,
+  createCheckoutSessionRequestSchema: () => createCheckoutSessionRequestSchema,
+  createCheckoutSessionResponseSchema: () => createCheckoutSessionResponseSchema,
   createHostedApiKeyRequestSchema: () => createHostedApiKeyRequestSchema,
   createHostedProjectRequestSchema: () => createHostedProjectRequestSchema,
+  createPortalSessionRequestSchema: () => createPortalSessionRequestSchema,
+  createPortalSessionResponseSchema: () => createPortalSessionResponseSchema,
   currentEntitlementResponseSchema: () => currentEntitlementResponseSchema,
   currentWaitlistResponseSchema: () => currentWaitlistResponseSchema,
   customerEffectiveEntitlementSchema: () => customerEffectiveEntitlementSchema,
@@ -27373,6 +27675,7 @@ __export(src_exports, {
   entitlementGrantedEventSchema: () => entitlementGrantedEventSchema,
   entitlementSourceSchema: () => entitlementSourceSchema,
   entitlementStateSchema: () => entitlementStateSchema,
+  expireCheckoutSessionResponseSchema: () => expireCheckoutSessionResponseSchema,
   featureValueSchema: () => featureValueSchema,
   hostedProjectApiKeyDeleteResponseSchema: () => hostedProjectApiKeyDeleteResponseSchema,
   hostedProjectApiKeyListItemSchema: () => hostedProjectApiKeyListItemSchema,
@@ -27413,6 +27716,7 @@ __export(src_exports, {
   organizationPlanSelectionGateSchema: () => organizationPlanSelectionGateSchema,
   organizationPlanSelectionRequestSchema: () => organizationPlanSelectionRequestSchema,
   organizationPlanSelectionResponseSchema: () => organizationPlanSelectionResponseSchema,
+  paidSelfServicePlanCodeSchema: () => paidSelfServicePlanCodeSchema,
   parseAdminEnterpriseSubscriptionDetailResponse: () => parseAdminEnterpriseSubscriptionDetailResponse,
   parseAdminEnterpriseSubscriptionListResponse: () => parseAdminEnterpriseSubscriptionListResponse,
   parseAdminEnterpriseSubscriptionResponse: () => parseAdminEnterpriseSubscriptionResponse,
@@ -27515,11 +27819,12 @@ function parseManagedFeatureAvailability(input) {
   return managedFeatureAvailabilitySchema.parse(input);
 }
 var ENTITLEMENT_SOURCES, ENTITLEMENT_STATES, ENTERPRISE_SUBSCRIPTION_STATUSES, WAITLIST_OFFER_CODES, featureValueSchema, catalogFeatureMapSchema, enterpriseFeaturesSchema, adminClerkOrganizationSchema, enterpriseSubscriptionStatusSchema, planCodeSchema, organizationPlanSelectionGateCompletionReasonSchema, organizationPlanSelectionGateSchema, organizationPlanSelectionGateResponseSchema, organizationPlanSelectionGateRequestSchema, organizationPlanSelectionRequestSchema, organizationPlanSelectionResponseSchema, entitlementSourceSchema, entitlementStateSchema, waitlistOfferCodeSchema, joinWaitlistRequestSchema, waitlistEntrySchema, currentWaitlistResponseSchema, joinWaitlistResponseSchema, adminEnterpriseSubscriptionSchema, customerEffectiveEntitlementSchema, adminEffectiveEntitlementSchema, currentEntitlementResponseSchema, inspectorEntitlementProjectionVariants, inspectorEntitlementProjectionSchema, inspectorEntitlementProjectionTransportSchema, organizationEntitlementResponseSchema, customerEffectiveEntitlementTransportSchema, organizationEntitlementResponseTransportSchema, CLI_PRODUCT_CREDENTIAL_CAPABILITIES, APP_PROJECT_ID_MAX, CLI_TELEMETRY_BINDING_ID_MAX_LENGTH, cliTelemetryProjectIdSchema, cliTelemetryIdentityRequestSchema, cliTelemetryIdentityResponseSchema, cliProductCredentialCapabilitySchema, cliProductCredentialActorSchema, cliProductCredentialSchema, cliProductCredentialPayloadSchema, cliProductCredentialTokenPayloadSchema, cliProductCredentialExchangeResponseSchema, ACCOUNT_PROFILE_EMAIL_MAX_LENGTH, ACCOUNT_PROFILE_DISPLAY_NAME_MAX_LENGTH, ACCOUNT_PROFILE_AVATAR_URL_MAX_LENGTH, managedIntelligenceDestinationAppSchema, absoluteUrlSchema, managedHandoffTimestampSchema, emailValidationSchema, optionalAccountProfileEmailSchema, optionalAccountProfileDisplayNameSchema, optionalAccountProfileAvatarUrlSchema, nullableAccountProfileEmailSchema, nullableAccountProfileDisplayNameSchema, nullableAccountProfileAvatarUrlSchema, accountProfileSchema, managedClerkOrganizationSchema, managedHandoffActorSchema, managedIntelligenceSessionSchema, managedIntelligenceHandoffIssueRequestSchema, managedIntelligenceHandoffIssueResponseSchema, managedIntelligenceHandoffExchangeRequestSchema, managedIntelligenceHandoffExchangeResponseSchema, managedIntelligenceHandoffExchangeResponseTransportSchema, intelligenceAuthSessionResponseSchema, adminEnterpriseSubscriptionListResponseSchema, adminEnterpriseSubscriptionResponseSchema, adminEnterpriseSubscriptionDetailResponseSchema, createAdminEnterpriseSubscriptionRequestSchema, updateAdminEnterpriseSubscriptionRequestSchema, entitlementGrantedEventSchema, MANAGED_FEATURE_DISABLED_REASONS, managedFeatureDisabledReasonSchema, managedFeatureAvailabilitySchema, MANAGED_FEATURE_AVAILABLE, MANAGED_FEATURE_DISABLED_BY_FEATURE_FLAG, MANAGED_FEATURE_DISABLED_BY_ENTITLEMENT;
-var init_src2 = __esm({
+var init_src3 = __esm({
   "libs/ops-contracts/src/index.ts"() {
     "use strict";
     init_zod();
-    init_src();
+    init_billing();
+    init_src2();
     init_hosted_project();
     init_managed_navigation();
     ENTITLEMENT_SOURCES = [
@@ -27778,7 +28083,8 @@ var init_src2 = __esm({
       token: true
     });
     cliProductCredentialTokenPayloadSchema = cliProductCredentialPayloadSchema.extend({
-      organizationName: external_exports.string().trim().min(1).optional()
+      organizationName: external_exports.string().trim().min(1).optional(),
+      organizationSlug: external_exports.string().trim().min(1).optional()
     }).strict();
     cliProductCredentialExchangeResponseSchema = external_exports.object({
       productCredential: cliProductCredentialSchema
@@ -27956,7 +28262,7 @@ var init_config_service = __esm({
   "apps/cli/src/services/config.service.ts"() {
     "use strict";
     init_source();
-    init_src2();
+    init_src3();
     opsContractsRuntime = src_exports;
     opsContracts = opsContractsRuntime.default ?? opsContractsRuntime;
     ({ cliProductCredentialSchema: cliProductCredentialSchema2 } = opsContracts);
@@ -28186,7 +28492,20 @@ var init_project_config = __esm({
     projectConfigSchema = external_exports.object({
       projectId: external_exports.string().min(1),
       projectSlug: external_exports.string().min(1),
-      clerkOrgId: external_exports.string().min(1),
+      /**
+       * Clerk organization the selection was made under.
+       *
+       * Absent on a self-hosted deployment, which has no Clerk organization at
+       * all. Demanding it made `.copilotkit/project.json` unparseable there, and
+       * the symptom surfaced a long way from the cause: `verify` reported the
+       * file "exists but could not be read" and failed `project_selected` on a
+       * correctly wired project, because resolution never reached the contents
+       * (PE-95).
+       *
+       * Optional, not loose. An empty string is still rejected: absent means
+       * self-hosted, blank means something wrote a bug.
+       */
+      clerkOrgId: external_exports.string().min(1).optional(),
       telemetryBindingId: external_exports.string().trim().min(1).optional(),
       /**
        * Absolute URL of this project's CopilotKit runtime, when the project pins
@@ -28217,6 +28536,9 @@ function normalizeCodingAgent(_value) {
   const normalized = _value?.trim().toLowerCase() ?? "";
   return CODING_AGENT_PATTERN.test(normalized) ? normalized : "unknown";
 }
+function codingAgentProperty(value) {
+  return value === void 0 || value.trim() === "" ? {} : { coding_agent: normalizeCodingAgent(value) };
+}
 function resolveOnboardingRepositoryRoot(cwd2) {
   const canonicalCwd = canonicalizeDir(cwd2);
   return findRepositoryRoot(canonicalCwd) ?? canonicalCwd;
@@ -28242,15 +28564,24 @@ function readBoundRun(store, root2) {
     ...intent === void 0 ? {} : { intent }
   };
 }
-function resolveAnchoredRoot(dependencies) {
+function continuesAnchoredRun(store, root2, bound, lookup) {
+  if (lookup.runId !== void 0 && lookup.runId !== bound.runId)
+    return false;
+  const stored = readStoredRoute(store, stateKey("route", root2));
+  return !(stored?.runId === bound.runId && stored.ended === true);
+}
+function resolveAnchoredRoot(dependencies, lookup = {}) {
   const start = resolveOnboardingRepositoryRoot(dependencies.cwd);
   const home = canonicalizeDir(homedir3());
   const filesystemRoot = parse5(start).root;
   let candidate = start;
   while (true) {
     const bound = readBoundRun(dependencies.store, candidate);
-    if (bound.state === "live" && bound.anchored)
-      return candidate;
+    if (bound.state === "live" && bound.anchored) {
+      if (candidate === start)
+        return candidate;
+      return continuesAnchoredRun(dependencies.store, candidate, bound, lookup) ? candidate : start;
+    }
     const parent = dirname3(candidate);
     if (candidate === filesystemRoot || parent === candidate || parent === home || parent === filesystemRoot) {
       return start;
@@ -28402,9 +28733,15 @@ function startOnboardingRun(dependencies, requestedRunId, requestedIntent) {
   if (requestedIntent !== void 0 && !ONBOARDING_INTENT_PATTERN.test(requestedIntent)) {
     throw new Error("Requested onboarding intent is invalid");
   }
-  const root2 = resolveAnchoredRoot(dependencies);
-  const bound = readBoundRun(dependencies.store, root2);
   const validRequestedRun = requestedRunId !== void 0 && RUN_ID_PATTERN.test(requestedRunId) ? requestedRunId : void 0;
+  const project = resolveOnboardingRepositoryRoot(dependencies.cwd);
+  const anchored = resolveAnchoredRoot(dependencies, {
+    ...validRequestedRun === void 0 ? {} : { runId: validRequestedRun }
+  });
+  const anchoredBinding = readBoundRun(dependencies.store, anchored);
+  const continuesAnchor = anchoredBinding.state === "live" && (validRequestedRun === void 0 ? anchoredBinding.intent === requestedIntent : validRequestedRun === anchoredBinding.runId);
+  const root2 = anchored === project || continuesAnchor ? anchored : project;
+  const bound = root2 === anchored ? anchoredBinding : readBoundRun(dependencies.store, root2);
   const continuesBoundRun = bound.state === "live" && bound.intent === requestedIntent;
   const runId = validRequestedRun ?? (continuesBoundRun ? bound.runId : mintRunId(dependencies));
   dependencies.store.set(stateKey("run", root2), {
@@ -34524,7 +34861,7 @@ function synthesiseLegacyState(input) {
   };
 }
 var consentCategories, consentCategorySchema, consentStatusSchema, consentSourceSchema, decisionsSchema, consentStateSchema;
-var init_src3 = __esm({
+var init_src4 = __esm({
   "libs/consent-contracts/src/index.ts"() {
     "use strict";
     init_zod();
@@ -34703,7 +35040,7 @@ var CATEGORY_MAP;
 var init_c15t_consent_provider = __esm({
   "apps/cli/src/services/consent/c15t-consent-provider.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_dist5();
     init_cli_logs();
     init_c15t_subject_id();
@@ -38583,7 +38920,7 @@ var init_wrapAssembly = __esm({
 
 // node_modules/.pnpm/yoga-layout@3.2.1/node_modules/yoga-layout/dist/src/index.js
 var Yoga, src_default;
-var init_src4 = __esm({
+var init_src5 = __esm({
   async "node_modules/.pnpm/yoga-layout@3.2.1/node_modules/yoga-layout/dist/src/index.js"() {
     "use strict";
     init_yoga_wasm_base64_esm();
@@ -63673,7 +64010,7 @@ var createNode, appendChildNode, insertBeforeNode, removeChildNode, setAttribute
 var init_dom = __esm({
   async "node_modules/.pnpm/ink@6.8.0_@types+react@19.2.14_react-devtools-core@7.0.1_react@19.2.4/node_modules/ink/build/dom.js"() {
     "use strict";
-    await init_src4();
+    await init_src5();
     init_measure_text();
     init_wrap_text();
     init_squash_text_nodes();
@@ -63799,7 +64136,7 @@ var applyPositionStyles, applyMarginStyles, applyPaddingStyles, applyFlexStyles,
 var init_styles = __esm({
   async "node_modules/.pnpm/ink@6.8.0_@types+react@19.2.14_react-devtools-core@7.0.1_react@19.2.4/node_modules/ink/build/styles.js"() {
     "use strict";
-    await init_src4();
+    await init_src5();
     applyPositionStyles = (node, style) => {
       if ("position" in style) {
         node.setPositionType(style.position === "absolute" ? src_default.POSITION_TYPE_ABSOLUTE : src_default.POSITION_TYPE_RELATIVE);
@@ -66101,7 +66438,7 @@ var require_extension = __commonJS({
       else
         dest[name].push(elem);
     }
-    function parse13(header) {
+    function parse14(header) {
       const offers = /* @__PURE__ */ Object.create(null);
       let params = /* @__PURE__ */ Object.create(null);
       let mustUnescape = false;
@@ -66256,7 +66593,7 @@ var require_extension = __commonJS({
         }).join(", ");
       }).join(", ");
     }
-    module2.exports = { format: format3, parse: parse13 };
+    module2.exports = { format: format3, parse: parse14 };
   }
 });
 
@@ -66269,7 +66606,7 @@ var require_websocket = __commonJS({
     var http4 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash8 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash9 } = __require("crypto");
     var { Duplex, Readable: Readable5 } = __require("stream");
     var { URL: URL7 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -66290,7 +66627,7 @@ var require_websocket = __commonJS({
     var {
       EventTarget: { addEventListener, removeEventListener }
     } = require_event_target();
-    var { format: format3, parse: parse13 } = require_extension();
+    var { format: format3, parse: parse14 } = require_extension();
     var { toBuffer } = require_buffer_util();
     var kAborted = Symbol("kAborted");
     var protocolVersions = [8, 13];
@@ -66949,7 +67286,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -66980,7 +67317,7 @@ var require_websocket = __commonJS({
           }
           let extensions;
           try {
-            extensions = parse13(secWebSocketExtensions);
+            extensions = parse14(secWebSocketExtensions);
           } catch (err2) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket, message);
@@ -67286,7 +67623,7 @@ var require_subprotocol = __commonJS({
   "node_modules/.pnpm/ws@8.19.0/node_modules/ws/lib/subprotocol.js"(exports2, module2) {
     "use strict";
     var { tokenChars } = require_validation3();
-    function parse13(header) {
+    function parse14(header) {
       const protocols = /* @__PURE__ */ new Set();
       let start = -1;
       let end = -1;
@@ -67325,7 +67662,7 @@ var require_subprotocol = __commonJS({
       protocols.add(protocol);
       return protocols;
     }
-    module2.exports = { parse: parse13 };
+    module2.exports = { parse: parse14 };
   }
 });
 
@@ -67336,7 +67673,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter4 = __require("events");
     var http4 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash8 } = __require("crypto");
+    var { createHash: createHash9 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -67645,7 +67982,7 @@ var require_websocket_server = __commonJS({
         }
         if (this._state > RUNNING)
           return abortHandshake(socket, 503);
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -84860,7 +85197,7 @@ var init_reconciler = __esm({
     import_react_reconciler = __toESM(require_react_reconciler(), 1);
     import_constants8 = __toESM(require_constants3(), 1);
     Scheduler = __toESM(require_scheduler(), 1);
-    await init_src4();
+    await init_src5();
     import_react = __toESM(require_react(), 1);
     await init_dom();
     await init_styles();
@@ -85164,7 +85501,7 @@ var getMaxWidth, get_max_width_default;
 var init_get_max_width = __esm({
   async "node_modules/.pnpm/ink@6.8.0_@types+react@19.2.14_react-devtools-core@7.0.1_react@19.2.4/node_modules/ink/build/get-max-width.js"() {
     "use strict";
-    await init_src4();
+    await init_src5();
     getMaxWidth = (yogaNode) => {
       return yogaNode.getComputedWidth() - yogaNode.getComputedPadding(src_default.EDGE_LEFT) - yogaNode.getComputedPadding(src_default.EDGE_RIGHT) - yogaNode.getComputedBorder(src_default.EDGE_LEFT) - yogaNode.getComputedBorder(src_default.EDGE_RIGHT);
     };
@@ -85946,7 +86283,7 @@ var init_render_node_to_output = __esm({
     "use strict";
     init_widest_line();
     init_indent_string();
-    await init_src4();
+    await init_src5();
     init_wrap_text();
     await init_get_max_width();
     init_squash_text_nodes();
@@ -88218,7 +88555,7 @@ var init_App = __esm({
 });
 
 // node_modules/.pnpm/ink@6.8.0_@types+react@19.2.14_react-devtools-core@7.0.1_react@19.2.4/node_modules/ink/build/kitty-keyboard.js
-function resolveFlags(flags) {
+function resolveFlags2(flags) {
   let result = 0;
   for (const flag of flags) {
     result |= kittyFlags[flag];
@@ -88263,7 +88600,7 @@ var init_ink = __esm({
     import_signal_exit2 = __toESM(require_signal_exit(), 1);
     init_dist6();
     import_constants9 = __toESM(require_constants3(), 1);
-    await init_src4();
+    await init_src5();
     init_wrap_ansi();
     init_terminal_size();
     init_utils();
@@ -88811,7 +89148,7 @@ var init_ink = __esm({
         stdout.write("\x1B[?u");
       }
       enableKittyProtocol(flags) {
-        this.options.stdout.write(`\x1B[>${resolveFlags(flags)}u`);
+        this.options.stdout.write(`\x1B[>${resolveFlags2(flags)}u`);
         this.kittyProtocolEnabled = true;
       }
     };
@@ -88880,7 +89217,7 @@ var import_constants10;
 var init_render_to_string = __esm({
   async "node_modules/.pnpm/ink@6.8.0_@types+react@19.2.14_react-devtools-core@7.0.1_react@19.2.4/node_modules/ink/build/render-to-string.js"() {
     "use strict";
-    await init_src4();
+    await init_src5();
     import_constants10 = __toESM(require_constants3(), 1);
     await init_reconciler();
     await init_renderer();
@@ -90454,7 +90791,7 @@ var CONSENT_STATE_KEY, LEGACY_OPT_OUT_KEY;
 var init_persistence = __esm({
   "apps/cli/src/services/consent/persistence.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_cli_logs();
     CONSENT_STATE_KEY = "consent.state";
     LEGACY_OPT_OUT_KEY = "telemetry.optOut";
@@ -90519,7 +90856,7 @@ function createCliPromptConsentProvider(deps) {
 var init_cli_prompt_consent_provider = __esm({
   async "apps/cli/src/services/consent/cli-prompt-consent-provider.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     await init_consent_runner();
     init_persistence();
   }
@@ -90558,7 +90895,7 @@ var TRUTHY;
 var init_gate = __esm({
   "apps/cli/src/services/consent/gate.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
   }
 });
@@ -91204,6 +91541,7 @@ __export(telemetry_exports, {
   getTelemetry: () => getTelemetry,
   hasStandaloneTelemetryIdentityConsent: () => hasStandaloneTelemetryIdentityConsent,
   linkConsentSubjectToUser: () => linkConsentSubjectToUser,
+  recordAbandonedInvocation: () => recordAbandonedInvocation,
   recordTelemetryEvent: () => recordTelemetryEvent,
   resolveReturnedOutcome: () => resolveReturnedOutcome,
   submitTelemetryEvent: () => submitTelemetryEvent,
@@ -91321,7 +91659,52 @@ function recordTelemetryEvent(event) {
   });
   if (!gate.send)
     return;
-  getTelemetry().recordEvent(withProjectIdentity(event));
+  for (const paired of pairCommandBookends(event)) {
+    getTelemetry().recordEvent(withProjectIdentity(paired));
+  }
+}
+function isCommandLifecycle(event) {
+  return (event.event === void 0 || event.event === CLI_TELEMETRY_EVENT_NAME) && event.properties.outcome !== void 0;
+}
+function pairCommandBookends(event) {
+  if (!isCommandLifecycle(event))
+    return [event];
+  if (event.properties.outcome === "started") {
+    if (openInvocation !== null || invocationSettled)
+      return [];
+    openInvocation = { properties: event.properties, startedAt: Date.now() };
+    return [event];
+  }
+  if (invocationSettled)
+    return [];
+  invocationSettled = true;
+  if (openInvocation !== null) {
+    openInvocation = null;
+    return [event];
+  }
+  const opening = { ...event.properties };
+  delete opening.outcome;
+  delete opening.error_code;
+  delete opening.duration_ms;
+  return [
+    { ...event, properties: { ...opening, outcome: "started" } },
+    event
+  ];
+}
+function settleOpenInvocation(outcome) {
+  if (openInvocation === null || invocationSettled)
+    return;
+  const { properties, startedAt } = openInvocation;
+  recordTelemetryEvent({
+    properties: {
+      ...properties,
+      outcome,
+      duration_ms: Date.now() - startedAt
+    }
+  });
+}
+function recordAbandonedInvocation() {
+  settleOpenInvocation("abandoned");
 }
 async function submitTelemetryEvent(event) {
   const buildInfo = getBuildInfo();
@@ -91389,6 +91772,7 @@ async function flushTelemetry(timeoutMs = DEFAULT_FLUSH_TIMEOUT_MS) {
   await instance.flush(timeoutMs);
 }
 async function exitWithFlush(code) {
+  settleOpenInvocation(code === 0 ? "succeeded" : "failed");
   await flushTelemetry();
   process.exit(code);
 }
@@ -91519,11 +91903,13 @@ function __resetTelemetryForTests() {
   instance = null;
   consentProviderInstance = null;
   recordedTelemetryIdCache = void 0;
+  openInvocation = null;
+  invocationSettled = false;
 }
 function __setConsentProviderForTests(provider) {
   consentProviderInstance = provider;
 }
-var instance, consentProviderInstance, cliLogTelemetryLogger, recordedTelemetryIdCache;
+var instance, consentProviderInstance, cliLogTelemetryLogger, recordedTelemetryIdCache, openInvocation, invocationSettled;
 var init_telemetry = __esm({
   async "apps/cli/src/services/telemetry/index.ts"() {
     "use strict";
@@ -91552,6 +91938,8 @@ var init_telemetry = __esm({
       warn: (payload) => writeCliLog("info", payload),
       error: (payload) => writeCliLog("error", payload)
     };
+    openInvocation = null;
+    invocationSettled = false;
   }
 });
 
@@ -91921,6 +92309,30 @@ function createApiClient(baseUrl, token, options = {}) {
       }
       return res.json();
     },
+    /**
+     * Redeems a short sign-in code for a CLI session.
+     *
+     * @param code - The code the browser displayed or the callback delivered.
+     * @param codeVerifier - The PKCE verifier this process generated.
+     * @param telemetryInstallationId - Anonymous installation id to bind, or
+     *   omitted when telemetry is disabled or the CLI is running in CI.
+     * @returns The parsed {@link AuthPayload} containing the CLI session token.
+     */
+    async exchangeAuthorizationCode(code, codeVerifier, telemetryInstallationId) {
+      const res = await fetchWithTimeout(`${baseUrl}/api/cli/auth/session`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          code,
+          codeVerifier,
+          ...telemetryInstallationId === void 0 ? {} : { telemetryInstallationId }
+        })
+      });
+      if (!res.ok) {
+        throw await readApiError(res);
+      }
+      return res.json();
+    },
     async verifySession(telemetryInstallationId) {
       const query = telemetryInstallationId === void 0 ? "" : `?telemetryInstallationId=${encodeURIComponent(telemetryInstallationId)}`;
       const res = await retryTransient(async () => {
@@ -92100,7 +92512,7 @@ var init_api_client = __esm({
   "apps/cli/src/services/api-client.ts"() {
     "use strict";
     init_zod();
-    init_src2();
+    init_src3();
     opsContractsRuntime2 = src_exports;
     opsContracts2 = opsContractsRuntime2.default ?? opsContractsRuntime2;
     ({
@@ -93017,17 +93429,29 @@ var init_open = __esm({
 // apps/cli/src/services/auth.service.ts
 var auth_service_exports = {};
 __export(auth_service_exports, {
+  MANUAL_LOGIN_ONLY_ENV_VAR: () => MANUAL_LOGIN_ONLY_ENV_VAR,
   TERMINAL_SESSION_INVALID_MESSAGE: () => TERMINAL_SESSION_INVALID_MESSAGE,
   clearAuthOnTerminalSessionInvalidation: () => clearAuthOnTerminalSessionInvalidation,
+  createPkcePair: () => createPkcePair,
+  isManualLoginOnlyEnabled: () => isManualLoginOnlyEnabled,
   isTerminalSessionInvalidationError: () => isTerminalSessionInvalidationError,
   login: () => login,
   logout: () => logout,
-  raceForClerkToken: () => raceForClerkToken,
+  raceForAuthCode: () => raceForAuthCode,
   startCallbackServer: () => startCallbackServer,
   verifyAndRefresh: () => verifyAndRefresh
 });
 import * as crypto3 from "crypto";
 import * as http from "http";
+function createPkcePair() {
+  const codeVerifier = crypto3.randomBytes(32).toString("base64url");
+  const codeChallenge = crypto3.createHash("sha256").update(codeVerifier).digest("base64url");
+  return { codeVerifier, codeChallenge };
+}
+function isManualLoginOnlyEnabled() {
+  const value = process.env[MANUAL_LOGIN_ONLY_ENV_VAR]?.trim().toLowerCase();
+  return value === "1" || value === "true";
+}
 function startCallbackServer(expectedState, waitForLoginCompletion = false) {
   const diagnostics = createCliAuthDiagnostics(expectedState);
   diagnostics.logPhase("callback-server.starting", {
@@ -93051,6 +93475,26 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
 <html><head><meta charset="utf-8"><title>Sign-in failed</title>
 <style>body{font-family:-apple-system,system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;color:#111}main{text-align:center;max-width:420px;padding:2rem}h1{font-size:1.25rem;margin:0 0 .5rem;color:#c0392b}p{color:#555;font-size:.95rem;line-height:1.5;margin:0}</style>
 </head><body><main><h1>Sign-in failed</h1><p>${msg}</p></main></body></html>`;
+    const MANUAL_ONLY_HTML = (code) => `<!doctype html>
+<html><head><meta charset="utf-8"><title>Automatic sign-in blocked</title>
+<style>body{font-family:-apple-system,system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;color:#111}main{text-align:center;max-width:640px;padding:2rem}h1{font-size:1.25rem;margin:0 0 .5rem}p{color:#555;font-size:.95rem;line-height:1.5;margin:0 0 1rem}code{display:block;word-break:break-all;text-align:left;background:#f4f4f5;border:1px solid #e4e4e7;border-radius:6px;padding:.75rem;font-size:.8rem}button{margin-top:.75rem;font-size:.9rem;padding:.5rem 1rem;border-radius:6px;border:1px solid #d4d4d8;background:#fff;cursor:pointer}#age{margin-top:.75rem;color:#777;font-size:.85rem}</style>
+</head><body><main><h1>Automatic sign-in blocked</h1>
+<p>This CLI runs with <code style="display:inline;padding:.1rem .3rem">${MANUAL_LOGIN_ONLY_ENV_VAR}</code> set, so it ignored this redirect. Copy the code below and paste it into the CLI prompt.</p>
+<code id="t">${code}</code>
+<button id="c">Copy code</button>
+<p id="age"></p>
+<script>
+const minted = Date.now();
+document.getElementById("c").addEventListener("click", async () => {
+  await navigator.clipboard.writeText(document.getElementById("t").textContent);
+  document.getElementById("c").textContent = "Copied";
+});
+setInterval(() => {
+  document.getElementById("age").textContent =
+    "On this page for " + Math.round((Date.now() - minted) / 1000) + "s.";
+}, 1000);
+</script>
+</main></body></html>`;
     const sendCompletion = (res, success3) => new Promise((resolve9) => {
       if (res.destroyed) {
         resolve9();
@@ -93113,12 +93557,14 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
         rejectResult(reason);
       };
       const state = url4.searchParams.get("state");
+      const code = url4.searchParams.get("code");
       const clerkToken = url4.searchParams.get("clerkToken");
       const hostedSnapshot = parseHostedCliAuthDiagnosticSnapshot(
         url4.searchParams.get("cliAuthDiag")
       );
       diagnostics.logPhase("callback-server.callback-received", {
         callback: summarizeCallbackUrl(`http://127.0.0.1${url4.pathname}`),
+        hasCode: Boolean(code),
         hasClerkToken: Boolean(clerkToken),
         receivedState: summarizeState(state)
       });
@@ -93142,10 +93588,10 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
         rejectOnce(new Error("State mismatch in callback"));
         return;
       }
-      if (!clerkToken) {
+      if (!code && !clerkToken) {
         diagnostics.logError(
-          "callback-server.missing-clerk-token",
-          new Error("Missing clerkToken in callback"),
+          "callback-server.missing-code",
+          new Error("Missing code in callback"),
           {
             receivedState: summarizeState(state)
           }
@@ -93154,8 +93600,20 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
           "Content-Type": "text/html; charset=utf-8",
           Connection: "close"
         });
-        res.end(ERROR_HTML("Missing Clerk token. Please retry from the CLI."));
-        rejectOnce(new Error("Missing clerkToken in callback"));
+        res.end(ERROR_HTML("Missing sign-in code. Please retry from the CLI."));
+        rejectOnce(new Error("Missing code in callback"));
+        return;
+      }
+      if (isManualLoginOnlyEnabled() && code) {
+        res.writeHead(200, {
+          "Content-Type": "text/html; charset=utf-8",
+          Connection: "close"
+        });
+        res.end(MANUAL_ONLY_HTML(code));
+        diagnostics.logPhase("callback-server.callback-ignored", {
+          reason: "manual-login-only",
+          receivedState: summarizeState(state)
+        });
         return;
       }
       if (waitForLoginCompletion) {
@@ -93179,9 +93637,10 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
         res.end(SUCCESS_HTML);
       }
       diagnostics.logPhase("callback-server.callback-accepted", {
-        receivedState: summarizeState(state)
+        receivedState: summarizeState(state),
+        via: code ? "code" : "clerkToken"
       });
-      resolveOnce({ clerkToken });
+      resolveOnce(code ? { code } : { clerkToken });
     });
     server.on("error", (error98) => {
       diagnostics.logError("callback-server.error", error98);
@@ -93204,16 +93663,16 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
     });
   });
 }
-async function raceForClerkToken(resultPromise, manualClerkToken) {
+async function raceForAuthCode(resultPromise, manualClerkToken) {
   const callbackBranch = resultPromise.then((result) => ({
-    clerkToken: result.clerkToken,
+    ...result,
     source: "callback"
   }));
   if (!manualClerkToken) {
     return await callbackBranch;
   }
-  const manualBranch = manualClerkToken.then((clerkToken) => ({
-    clerkToken,
+  const manualBranch = manualClerkToken.then((code) => ({
+    code,
     source: "manual"
   }));
   const swallow = (promise3) => {
@@ -93223,8 +93682,21 @@ async function raceForClerkToken(resultPromise, manualClerkToken) {
   swallow(manualBranch);
   return await Promise.race([callbackBranch, manualBranch]);
 }
+function reportAuthCodeShape(code, source, diagnostics) {
+  diagnostics.logPhase("login.code-shape", {
+    length: code.length,
+    source
+  });
+  if (!isManualLoginOnlyEnabled()) {
+    return;
+  }
+  process.stderr.write(`
+[manual-login-only] Code length ${code.length}.
+`);
+}
 async function login(options = {}) {
   const state = crypto3.randomBytes(16).toString("hex");
+  const { codeVerifier, codeChallenge } = createPkcePair();
   const diagnostics = createCliAuthDiagnostics(state);
   diagnostics.logPhase("login.start", {
     opsApiUrl: getOpsApiUrl(),
@@ -93242,6 +93714,8 @@ async function login(options = {}) {
     const loginParams = new URLSearchParams({
       callback: callbackUrl,
       state,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
       ...isCliAuthDiagnosticsVerboseEnabled() ? { verbose: "1" } : {},
       ...posthogDistinctId !== null ? { posthog_distinct_id: posthogDistinctId } : {}
     });
@@ -93273,13 +93747,14 @@ async function login(options = {}) {
       }
     }
     diagnostics.logPhase("login.waiting-for-callback");
-    const { clerkToken, source } = await raceForClerkToken(
+    const credential = await raceForAuthCode(
       resultPromise,
       options.manualClerkToken
     );
+    const { source } = credential;
     tokenSource = source;
     diagnostics.logPhase("login.callback-complete", {
-      clerkTokenReceived: true,
+      codeReceived: "code" in credential,
       tokenSource: source
     });
     const apiClient = createApiClient(getOpsApiUrl());
@@ -93288,10 +93763,20 @@ async function login(options = {}) {
     let authPayload;
     try {
       diagnostics.logPhase("login.exchange-start");
-      authPayload = await apiClient.exchangeClerkToken(
-        clerkToken,
-        bindDuringExchange
-      );
+      if ("code" in credential) {
+        reportAuthCodeShape(credential.code, source, diagnostics);
+        authPayload = await apiClient.exchangeAuthorizationCode(
+          credential.code,
+          codeVerifier,
+          bindDuringExchange
+        );
+      } else {
+        diagnostics.logPhase("login.exchange-clerk-token-fallback");
+        authPayload = await apiClient.exchangeClerkToken(
+          credential.clerkToken,
+          bindDuringExchange
+        );
+      }
       diagnostics.logPhase("login.exchange-complete", {
         organizationId: authPayload.organization.clerkOrgId,
         userId: authPayload.user.id
@@ -93422,7 +93907,7 @@ async function logout() {
   authStore.clear();
   rotateInstallationId({ configStore });
 }
-var MANUAL_PASTE_SERVER_LINGER_MS, TERMINAL_SESSION_INVALID_MESSAGE;
+var MANUAL_LOGIN_ONLY_ENV_VAR, MANUAL_PASTE_SERVER_LINGER_MS, TERMINAL_SESSION_INVALID_MESSAGE;
 var init_auth_service = __esm({
   async "apps/cli/src/services/auth.service.ts"() {
     "use strict";
@@ -93433,6 +93918,7 @@ var init_auth_service = __esm({
     await init_telemetry();
     init_cli_auth_diagnostics();
     init_config();
+    MANUAL_LOGIN_ONLY_ENV_VAR = "COPILOTKIT_CLI_MANUAL_LOGIN_ONLY";
     MANUAL_PASTE_SERVER_LINGER_MS = 6e3;
     TERMINAL_SESSION_INVALID_MESSAGE = "Existing CLI sessions are invalid after the Clerk cutover. Please log in again.";
   }
@@ -93536,6 +94022,37 @@ var init_build4 = __esm({
   }
 });
 
+// apps/cli/src/services/auth-code-shape.ts
+function normalizeAuthCode(raw2) {
+  return raw2.trim().toUpperCase().replaceAll("-", "").replaceAll(/\s/gu, "").replaceAll(/[IL]/gu, "1").replaceAll("O", "0");
+}
+function inspectAuthCode(value) {
+  const normalized = normalizeAuthCode(value);
+  if (normalized.length === 0) {
+    return { ok: false, reason: "The code is empty." };
+  }
+  if (normalized.includes(".")) {
+    return {
+      ok: false,
+      reason: "That looks like a session token, not a sign-in code. Copy the short code shown on the page."
+    };
+  }
+  if (!CODE_PATTERN.test(normalized)) {
+    return {
+      ok: false,
+      reason: "A sign-in code is eight characters, like WDJB-MJHT. Check the code on the page and enter it again."
+    };
+  }
+  return { ok: true };
+}
+var CODE_PATTERN;
+var init_auth_code_shape = __esm({
+  "apps/cli/src/services/auth-code-shape.ts"() {
+    "use strict";
+    CODE_PATTERN = /^[0-9ABCDEFGHJKMNPQRSTVWXYZ]{8}$/u;
+  }
+});
+
 // apps/cli/src/services/cli-tips.ts
 function rankCliTips(tips = CLI_TIPS) {
   return [...tips].sort((firstTip, secondTip) => {
@@ -94063,7 +94580,16 @@ function BrowserLoginProvider({
     if (trimmed.length === 0) {
       return void 0;
     }
+    const inspection = inspectAuthCode(trimmed);
+    if (!inspection.ok) {
+      setState((previous) => ({
+        ...previous,
+        manualTokenError: inspection.reason
+      }));
+      return void 0;
+    }
     pendingManualTokenRef.current = null;
+    setState((previous) => ({ ...previous, manualTokenError: "" }));
     pendingManualToken.resolve(trimmed);
     return void 0;
   }, []);
@@ -94115,7 +94641,8 @@ function BrowserLoginProvider({
           phase: "finalizing",
           identity,
           errorMessage: "",
-          loginUrl: ""
+          loginUrl: "",
+          manualTokenError: ""
         });
         await new Promise((resolve9) => {
           setTimeout(() => {
@@ -94127,7 +94654,8 @@ function BrowserLoginProvider({
         phase: "success",
         identity,
         errorMessage: "",
-        loginUrl: ""
+        loginUrl: "",
+        manualTokenError: ""
       });
       return result;
     } catch (error98) {
@@ -94140,7 +94668,8 @@ function BrowserLoginProvider({
         phase: "error",
         identity: null,
         errorMessage: concreteError.message,
-        loginUrl: ""
+        loginUrl: "",
+        manualTokenError: ""
       });
       throw concreteError;
     }
@@ -94233,6 +94762,7 @@ function BrowserLoginConfirmation({
           )
         ] })
       ] }) : null,
+      state.manualTokenError !== "" ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(Box_default, { marginTop: 1, children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(Text, { color: "red", children: state.manualTokenError }) }) : null,
       /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(CliTip, {})
     ] });
   }
@@ -94278,6 +94808,7 @@ var init_browser_login = __esm({
     await init_build4();
     await init_auth_service();
     init_cli_auth_diagnostics();
+    init_auth_code_shape();
     await init_cli_tip();
     await init_spinner();
     await init_success_text();
@@ -94289,10 +94820,11 @@ var init_browser_login = __esm({
       phase: "idle",
       identity: null,
       errorMessage: "",
-      loginUrl: ""
+      loginUrl: "",
+      manualTokenError: ""
     };
     BrowserLoginContext = (0, import_react35.createContext)(null);
-    BROWSER_LOGIN_MANUAL_PASTE_LABEL = "If your browser finished sign-in but the CLI didn't notice, paste the code shown in the browser:";
+    BROWSER_LOGIN_MANUAL_PASTE_LABEL = "If your browser finished sign-in but the CLI didn't notice, paste the short code shown there:";
     BROWSER_LOGIN_MANUAL_URL_LABEL = "If the browser didn't open, sign in at:";
   }
 });
@@ -96721,7 +97253,7 @@ var init_learning_skills_api = __esm({
 });
 
 // apps/cli/src/services/learning-skills-download.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import {
   existsSync as existsSync10,
   mkdirSync as mkdirSync5,
@@ -96932,7 +97464,7 @@ function verifyEtag(bytes, etag) {
   if (etag === void 0) {
     return;
   }
-  const expected = `"${createHash2("sha256").update(bytes).digest("hex")}"`;
+  const expected = `"${createHash3("sha256").update(bytes).digest("hex")}"`;
   if (etag !== expected) {
     throw learningSkillsError(
       TELEMETRY_ERROR_CODES.LEARNING_SKILLS_INTEGRITY_FAILED,
@@ -97010,7 +97542,7 @@ async function runSkillsDownload(options) {
       { code: TELEMETRY_ERROR_CODES.PREREQUISITE_MISSING }
     );
   }
-  if (project.clerkOrgId !== auth2.clerkOrgId) {
+  if (project.clerkOrgId !== void 0 && project.clerkOrgId !== auth2.clerkOrgId) {
     throw Object.assign(
       new Error(
         "This directory has a hosted Intelligence project selected for a different organization. Run `copilotkit project select` in this directory, then re-run `copilotkit skills download`."
@@ -97053,6 +97585,68 @@ var init_skills_download = __esm({
   }
 });
 
+// apps/cli/src/services/child-timeout.ts
+function signalChildTree(child, signal, ownsProcessGroup) {
+  const { pid } = child;
+  if (ownsProcessGroup && pid !== void 0) {
+    try {
+      process.kill(-pid, signal);
+      return;
+    } catch {
+    }
+  }
+  try {
+    child.kill(signal);
+  } catch {
+  }
+}
+function armChildTimeout(child, timeoutMs, onTimeout, options = {}) {
+  if (timeoutMs <= 0)
+    return { cancel: () => void 0 };
+  const ownsProcessGroup = options.ownsProcessGroup === true;
+  let closed = false;
+  let graceTimer;
+  const timer = setTimeout(() => {
+    signalChildTree(child, "SIGTERM", ownsProcessGroup);
+    onTimeout();
+    graceTimer = setTimeout(() => {
+      if (!closed)
+        signalChildTree(child, "SIGKILL", ownsProcessGroup);
+    }, TERMINATION_GRACE_MS);
+  }, timeoutMs);
+  const forwarders = (ownsProcessGroup ? FORWARDED_SIGNALS : []).flatMap((signal) => {
+    if (process.listenerCount(signal) === 0)
+      return [];
+    const forward = () => {
+      signalChildTree(child, signal, ownsProcessGroup);
+    };
+    process.once(signal, forward);
+    return [{ signal, forward }];
+  });
+  const cancel = () => {
+    clearTimeout(timer);
+    if (graceTimer !== void 0)
+      clearTimeout(graceTimer);
+    for (const { signal, forward } of forwarders) {
+      process.off(signal, forward);
+    }
+  };
+  child.once("close", () => {
+    closed = true;
+    cancel();
+  });
+  return { cancel };
+}
+var TERMINATION_GRACE_MS, OWN_PROCESS_GROUP, FORWARDED_SIGNALS;
+var init_child_timeout = __esm({
+  "apps/cli/src/services/child-timeout.ts"() {
+    "use strict";
+    TERMINATION_GRACE_MS = 5e3;
+    OWN_PROCESS_GROUP = { detached: true };
+    FORWARDED_SIGNALS = ["SIGINT", "SIGTERM"];
+  }
+});
+
 // apps/cli/src/services/skills-install.ts
 import { spawn } from "node:child_process";
 import {
@@ -97158,6 +97752,65 @@ function removePartialFailureMonitor(monitor) {
   } catch {
   }
 }
+function createSkillsInstallRunner(timeoutMs = SKILLS_INSTALL_TIMEOUT_MS) {
+  return (command2, args, outputMode) => new Promise((resolve9, reject) => {
+    let capture = {
+      output: "",
+      reportedPartialFailure: false
+    };
+    const monitor = outputMode === "monitor" ? createPartialFailureMonitor() : null;
+    const ownsProcessGroup = outputMode === "capture";
+    const child = spawn(command2, [...args], {
+      stdio: outputMode === "capture" ? ["ignore", "pipe", "pipe"] : "inherit",
+      ...ownsProcessGroup ? OWN_PROCESS_GROUP : {},
+      env: monitor === null ? void 0 : {
+        ...process.env,
+        NODE_OPTIONS: monitor.nodeOptions,
+        [PARTIAL_FAILURE_FILE_ENV]: monitor.markerPath
+      },
+      // `npx` is a `.cmd` shim on Windows and is only resolvable through a shell
+      // there; POSIX can exec it directly. Selection tokens are validated against
+      // SELECTION_TOKEN before reaching here, so there is no injection surface.
+      shell: process.platform === "win32"
+    });
+    if (outputMode === "capture") {
+      child.stdout?.on("data", (chunk) => {
+        capture = appendSkillsInstallOutput(capture, chunk);
+      });
+      child.stderr?.on("data", (chunk) => {
+        capture = appendSkillsInstallOutput(capture, chunk);
+      });
+    }
+    let timedOut = false;
+    const timeout = armChildTimeout(
+      child,
+      timeoutMs,
+      () => {
+        timedOut = true;
+      },
+      { ownsProcessGroup }
+    );
+    child.on("error", (error98) => {
+      timeout.cancel();
+      removePartialFailureMonitor(monitor);
+      reject(error98);
+    });
+    child.on("close", (code) => {
+      timeout.cancel();
+      const reportedPartialFailure = capture.reportedPartialFailure || monitor !== null && existsSync11(monitor.markerPath);
+      removePartialFailureMonitor(monitor);
+      if (timedOut) {
+        reject(
+          new Error(
+            `The skills installer stopped responding after ${timeoutMs} ms and was stopped. Check the network and the npm registry configuration, then run \`${command2} ${args.join(" ")}\` by hand.`
+          )
+        );
+        return;
+      }
+      resolve9({ exitCode: code ?? 1, ...capture, reportedPartialFailure });
+    });
+  });
+}
 async function installCopilotKitSkills(options = {}, deps = {}) {
   const run = deps.run ?? defaultRunner;
   const args = buildSkillsInstallArgs(options);
@@ -97183,10 +97836,11 @@ Retry with \`${SKILLS_INSTALL_COMMAND} ${retryArgs}\`.`
     );
   }
 }
-var SKILLS_INSTALL_COMMAND, SKILLS_INSTALL_PACKAGE, SKILLS_SOURCE, ALL_SELECTION, DEFAULT_ONBOARD_AGENTS, SELECTION_TOKEN, MAX_CAPTURED_OUTPUT_CHARACTERS, PARTIAL_FAILURE_PATTERN, PARTIAL_FAILURE_FILE_ENV, PARTIAL_FAILURE_MONITOR_SOURCE, defaultRunner;
+var SKILLS_INSTALL_COMMAND, SKILLS_INSTALL_PACKAGE, SKILLS_SOURCE, ALL_SELECTION, DEFAULT_ONBOARD_AGENTS, SELECTION_TOKEN, MAX_CAPTURED_OUTPUT_CHARACTERS, SKILLS_INSTALL_TIMEOUT_MS, PARTIAL_FAILURE_PATTERN, PARTIAL_FAILURE_FILE_ENV, PARTIAL_FAILURE_MONITOR_SOURCE, defaultRunner;
 var init_skills_install = __esm({
   "apps/cli/src/services/skills-install.ts"() {
     "use strict";
+    init_child_timeout();
     init_event_properties();
     SKILLS_INSTALL_COMMAND = "npx";
     SKILLS_INSTALL_PACKAGE = "skills@1.5.18";
@@ -97195,6 +97849,7 @@ var init_skills_install = __esm({
     DEFAULT_ONBOARD_AGENTS = ["universal", "claude-code"];
     SELECTION_TOKEN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
     MAX_CAPTURED_OUTPUT_CHARACTERS = 16384;
+    SKILLS_INSTALL_TIMEOUT_MS = 5 * 6e4;
     PARTIAL_FAILURE_PATTERN = /\bFailed to install [1-9]\d*\b/;
     PARTIAL_FAILURE_FILE_ENV = "CPKI_SKILLS_PARTIAL_FAILURE_FILE";
     PARTIAL_FAILURE_MONITOR_SOURCE = String.raw`"use strict";
@@ -97228,42 +97883,7 @@ function monitor(stream) {
 monitor(process.stdout);
 monitor(process.stderr);
 `;
-    defaultRunner = (command2, args, outputMode) => new Promise((resolve9, reject) => {
-      let capture = {
-        output: "",
-        reportedPartialFailure: false
-      };
-      const monitor = outputMode === "monitor" ? createPartialFailureMonitor() : null;
-      const child = spawn(command2, [...args], {
-        stdio: outputMode === "capture" ? ["ignore", "pipe", "pipe"] : "inherit",
-        env: monitor === null ? void 0 : {
-          ...process.env,
-          NODE_OPTIONS: monitor.nodeOptions,
-          [PARTIAL_FAILURE_FILE_ENV]: monitor.markerPath
-        },
-        // `npx` is a `.cmd` shim on Windows and is only resolvable through a shell
-        // there; POSIX can exec it directly. Selection tokens are validated against
-        // SELECTION_TOKEN before reaching here, so there is no injection surface.
-        shell: process.platform === "win32"
-      });
-      if (outputMode === "capture") {
-        child.stdout?.on("data", (chunk) => {
-          capture = appendSkillsInstallOutput(capture, chunk);
-        });
-        child.stderr?.on("data", (chunk) => {
-          capture = appendSkillsInstallOutput(capture, chunk);
-        });
-      }
-      child.on("error", (error98) => {
-        removePartialFailureMonitor(monitor);
-        reject(error98);
-      });
-      child.on("close", (code) => {
-        const reportedPartialFailure = capture.reportedPartialFailure || monitor !== null && existsSync11(monitor.markerPath);
-        removePartialFailureMonitor(monitor);
-        resolve9({ exitCode: code ?? 1, ...capture, reportedPartialFailure });
-      });
-    });
+    defaultRunner = createSkillsInstallRunner();
   }
 });
 
@@ -98791,7 +99411,7 @@ var init_inspector_metadata = __esm({
 });
 
 // libs/app-api-contracts/src/inspector-learning.ts
-var text, idSchema, boundedTextSchema, urlSchema, originSchema, candidateReviewUrlSchema, inspectorLearningRequestV1Schema, inspectorLearningUpstreamRequestV1Schema, evidenceSchema, inspectorLearningInsightSchema, configurationSchema, runSchema, pageSchema, skillSchema, inspectorLearningSnapshotV1Schema;
+var text, idSchema, boundedTextSchema, urlSchema, originSchema, candidateReviewUrlSchema, analysisResultsUrlSchema, inspectorLearningRequestV1Schema, inspectorLearningUpstreamRequestV1Schema, evidenceSchema, inspectorLearningInsightSchema, configurationSchema, runSchema, pageSchema, skillSchema, inspectorLearningSnapshotV1Schema;
 var init_inspector_learning = __esm({
   "libs/app-api-contracts/src/inspector-learning.ts"() {
     "use strict";
@@ -98818,6 +99438,12 @@ var init_inspector_learning = __esm({
       const url4 = new URL(value);
       return /^\/o\/[^/]+\/[^/]+\/learning\/[^/]+\/skills$/u.test(url4.pathname) && url4.search === "" && url4.hash === "";
     }, "Expected a project-scoped Learning Skill-review URL.");
+    analysisResultsUrlSchema = urlSchema.refine((value) => {
+      const url4 = new URL(value);
+      return /^\/o\/[^/]+\/[^/]+\/learning\/[^/]+\/analysis-results$/u.test(
+        url4.pathname
+      ) && url4.search === "" && url4.hash === "";
+    }, "Expected a project-scoped Learning analysis-results URL.");
     inspectorLearningRequestV1Schema = external_exports.object({
       agentId: idSchema.optional(),
       skillsPage: external_exports.number().int().min(1).optional(),
@@ -98914,7 +99540,7 @@ var init_inspector_learning = __esm({
       links: external_exports.object({
         learning: urlSchema,
         candidates: candidateReviewUrlSchema.nullable(),
-        runs: urlSchema.nullable()
+        runs: analysisResultsUrlSchema.nullable()
       }).strict()
     }).strict().superRefine((snapshot, context3) => {
       const origin = new URL(snapshot.webAppOrigin).origin;
@@ -99243,7 +99869,7 @@ var init_usage = __esm({
 });
 
 // libs/app-api-contracts/src/index.ts
-var init_src5 = __esm({
+var init_src6 = __esm({
   "libs/app-api-contracts/src/index.ts"() {
     "use strict";
     init_channels();
@@ -99298,7 +99924,7 @@ var projectIdSchema, candidateIdSchema;
 var init_learning_api_validation = __esm({
   "apps/cli/src/services/learning-api-validation.ts"() {
     "use strict";
-    init_src5();
+    init_src6();
     init_zod();
     init_event_properties();
     projectIdSchema = external_exports.string().regex(/^[1-9]\d*$/u);
@@ -99368,7 +99994,7 @@ var insightsResponseSchema, candidatesResponseSchema, candidateResponseSchema, r
 var init_learning_insights_api = __esm({
   "apps/cli/src/services/learning-insights-api.ts"() {
     "use strict";
-    init_src5();
+    init_src6();
     init_zod();
     init_learning_api_validation();
     init_event_properties();
@@ -99400,7 +100026,7 @@ async function loadLearningCommandContext() {
       TELEMETRY_ERROR_CODES.PREREQUISITE_MISSING
     );
   }
-  if (project.clerkOrgId !== auth2.clerkOrgId) {
+  if (project.clerkOrgId !== void 0 && project.clerkOrgId !== auth2.clerkOrgId) {
     throw tagError(
       new Error(
         "This directory has a hosted Intelligence project selected for a different organization. Run `copilotkit project select` here, then re-run the Learning command."
@@ -99908,7 +100534,7 @@ var containerResponseSchema;
 var init_learning_containers_api = __esm({
   "apps/cli/src/services/learning-containers-api.ts"() {
     "use strict";
-    init_src5();
+    init_src6();
     init_zod();
     init_learning_api_validation();
     init_event_properties();
@@ -100172,7 +100798,7 @@ var import_react41, import_jsx_runtime11;
 var init_learning_container_prompts = __esm({
   async "apps/cli/src/ui/learning-container-prompts.tsx"() {
     "use strict";
-    init_src5();
+    init_src6();
     await init_build2();
     await init_build4();
     import_react41 = __toESM(require_react(), 1);
@@ -100718,7 +101344,7 @@ var import_react42;
 var init_learning_containers = __esm({
   async "apps/cli/src/commands/learning-containers.ts"() {
     "use strict";
-    init_src5();
+    init_src6();
     init_learning_containers_api();
     init_learning_command_context();
     init_learning_default_container();
@@ -100778,7 +101404,7 @@ var init_import_metadata = __esm({
 });
 
 // libs/import-contracts/src/schemas.ts
-var TextContentBlockSchema, ReasoningContentBlockSchema, InlineMediaContentBlockSchema, UnresolvedMediaContentBlockSchema, MediaContentBlockSchema, ToolCallContentBlockSchema, NormalizedContentBlockSchema, NormalizedMessageRoleSchema, NormalizedRunStatusSchema, NormalizedSourceBackendSchema, EndUserPolicySchema, NormalizedMessageSchema, NormalizedRunUsageSchema, NormalizedRunSchema, NormalizedConversationSchema, ImportRequestSchema;
+var TextContentBlockSchema, ReasoningContentBlockSchema, InlineMediaContentBlockSchema, UnresolvedMediaContentBlockSchema, MediaContentBlockSchema, ToolCallContentBlockSchema, NormalizedContentBlockSchema, NormalizedMessageRoleSchema, NormalizedRunStatusSchema, NormalizedSourceBackendSchema, EndUserPolicySchema, NormalizedMessageSchema, NormalizedRunUsageSchema, NormalizedRunSchema, NormalizedPendingInterruptSchema, NormalizedConversationSchema, ImportRequestSchema;
 var init_schemas3 = __esm({
   "libs/import-contracts/src/schemas.ts"() {
     "use strict";
@@ -100840,6 +101466,7 @@ var init_schemas3 = __esm({
       role: NormalizedMessageRoleSchema,
       timestamp: external_exports.string(),
       toolCallId: external_exports.string().optional(),
+      error: external_exports.string().optional(),
       content: external_exports.array(NormalizedContentBlockSchema)
     });
     NormalizedRunUsageSchema = external_exports.object({
@@ -100854,9 +101481,14 @@ var init_schemas3 = __esm({
       finishedAt: external_exports.string().optional(),
       usage: NormalizedRunUsageSchema.optional(),
       finishReason: external_exports.string().optional(),
+      errorMessage: external_exports.string().optional(),
       interruptValue: external_exports.unknown().optional(),
       messages: external_exports.array(NormalizedMessageSchema)
     });
+    NormalizedPendingInterruptSchema = external_exports.object({
+      id: external_exports.string().min(1).optional(),
+      value: external_exports.json()
+    }).loose();
     NormalizedConversationSchema = external_exports.object({
       // Non-empty: `sourceThreadId` is half of the conversation-level dedup key
       // (project_id, import_metadata->>'source', ->>'source_thread_id'); a blank
@@ -100866,6 +101498,8 @@ var init_schemas3 = __esm({
       sourceBackend: NormalizedSourceBackendSchema.optional(),
       endUserId: external_exports.string().nullable(),
       lastActivityAt: external_exports.string().optional(),
+      stateSnapshot: external_exports.json().optional(),
+      pendingInterrupts: external_exports.array(NormalizedPendingInterruptSchema).optional(),
       runs: external_exports.array(NormalizedRunSchema)
     });
     ImportRequestSchema = external_exports.object({
@@ -100878,7 +101512,7 @@ var init_schemas3 = __esm({
 });
 
 // libs/import-contracts/src/index.ts
-var init_src6 = __esm({
+var init_src7 = __esm({
   "libs/import-contracts/src/index.ts"() {
     "use strict";
     init_schemas3();
@@ -101097,8 +101731,9 @@ function projectSelectedCheck(resolution) {
       title: "A hosted project is selected"
     };
   }
+  const organization = resolution.config.clerkOrgId === void 0 ? "" : ` in organization ${resolution.config.clerkOrgId}`;
   return {
-    detail: `Project ${resolution.config.projectSlug} (id ${resolution.config.projectId}) in organization ${resolution.config.clerkOrgId}, recorded in ${resolution.dir}.`,
+    detail: `Project ${resolution.config.projectSlug} (id ${resolution.config.projectId})${organization}, recorded in ${resolution.dir}.`,
     id: "project_selected",
     status: "pass",
     title: "A hosted project is selected"
@@ -101872,7 +102507,7 @@ var IMPORT_PARSE_OPTIONS, DEFAULT_MAX_BYTES, UNRECOVERABLE_VALUES;
 var init_import_config = __esm({
   "apps/cli/src/services/import-config.ts"() {
     "use strict";
-    init_src6();
+    init_src7();
     init_event_properties();
     init_verify_checks();
     IMPORT_PARSE_OPTIONS = {
@@ -102371,7 +103006,7 @@ var MAX_CONVERSATIONS_PER_CHUNK, realSleep, DEFAULT_BACKOFF_SECONDS, MAX_CHUNK_R
 var init_import_runner = __esm({
   "apps/cli/src/services/import-runner.ts"() {
     "use strict";
-    init_src6();
+    init_src7();
     init_import_client();
     MAX_CONVERSATIONS_PER_CHUNK = 500;
     realSleep = (ms) => new Promise((resolve9) => {
@@ -109160,7 +109795,7 @@ var require_ms = __commonJS({
       options = options || {};
       var type2 = typeof val;
       if (type2 === "string" && val.length > 0) {
-        return parse13(val);
+        return parse14(val);
       } else if (type2 === "number" && isFinite(val)) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -109168,7 +109803,7 @@ var require_ms = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse13(str2) {
+    function parse14(str2) {
       str2 = String(str2);
       if (str2.length > 100) {
         return;
@@ -109717,7 +110352,7 @@ var require_fecha_umd = __commonJS({
           return literals.shift();
         });
       };
-      function parse13(dateStr, format4, i18n) {
+      function parse14(dateStr, format4, i18n) {
         if (i18n === void 0) {
           i18n = {};
         }
@@ -109812,7 +110447,7 @@ var require_fecha_umd = __commonJS({
       }
       var fecha = {
         format: format3,
-        parse: parse13,
+        parse: parse14,
         defaultI18n,
         setGlobalDateI18n,
         setGlobalDateMasks
@@ -109820,7 +110455,7 @@ var require_fecha_umd = __commonJS({
       exports3.assign = assign2;
       exports3.default = fecha;
       exports3.format = format3;
-      exports3.parse = parse13;
+      exports3.parse = parse14;
       exports3.defaultI18n = defaultI18n;
       exports3.setGlobalDateI18n = setGlobalDateI18n;
       exports3.setGlobalDateMasks = setGlobalDateMasks;
@@ -128025,7 +128660,7 @@ function fixResponseChunkedTransferBadEnding(request, errorCallback) {
   });
 }
 var supportedSchemas;
-var init_src7 = __esm({
+var init_src8 = __esm({
   "node_modules/.pnpm/node-fetch@3.3.2/node_modules/node-fetch/src/index.js"() {
     "use strict";
     init_dist10();
@@ -128483,7 +129118,7 @@ Content-Type: ${partContentType}\r
       }
       static async #getFetch() {
         const hasWindow = typeof window !== "undefined" && !!window;
-        this.#fetch ||= hasWindow ? window.fetch : (await Promise.resolve().then(() => (init_src7(), src_exports2))).default;
+        this.#fetch ||= hasWindow ? window.fetch : (await Promise.resolve().then(() => (init_src8(), src_exports2))).default;
         return this.#fetch;
       }
       /**
@@ -140475,7 +141110,7 @@ var require_extension2 = __commonJS({
       else
         dest[name].push(elem);
     }
-    function parse13(header) {
+    function parse14(header) {
       const offers = /* @__PURE__ */ Object.create(null);
       let params = /* @__PURE__ */ Object.create(null);
       let mustUnescape = false;
@@ -140630,7 +141265,7 @@ var require_extension2 = __commonJS({
         }).join(", ");
       }).join(", ");
     }
-    module2.exports = { format: format3, parse: parse13 };
+    module2.exports = { format: format3, parse: parse14 };
   }
 });
 
@@ -140643,7 +141278,7 @@ var require_websocket2 = __commonJS({
     var http4 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash8 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash9 } = __require("crypto");
     var { Duplex, Readable: Readable5 } = __require("stream");
     var { URL: URL7 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate2();
@@ -140664,7 +141299,7 @@ var require_websocket2 = __commonJS({
     var {
       EventTarget: { addEventListener, removeEventListener }
     } = require_event_target2();
-    var { format: format3, parse: parse13 } = require_extension2();
+    var { format: format3, parse: parse14 } = require_extension2();
     var { toBuffer } = require_buffer_util2();
     var kAborted = Symbol("kAborted");
     var protocolVersions = [8, 13];
@@ -141331,7 +141966,7 @@ var require_websocket2 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -141362,7 +141997,7 @@ var require_websocket2 = __commonJS({
           }
           let extensions;
           try {
-            extensions = parse13(secWebSocketExtensions);
+            extensions = parse14(secWebSocketExtensions);
           } catch (err2) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket, message);
@@ -141670,7 +142305,7 @@ var require_subprotocol2 = __commonJS({
   "node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/subprotocol.js"(exports2, module2) {
     "use strict";
     var { tokenChars } = require_validation4();
-    function parse13(header) {
+    function parse14(header) {
       const protocols = /* @__PURE__ */ new Set();
       let start = -1;
       let end = -1;
@@ -141709,7 +142344,7 @@ var require_subprotocol2 = __commonJS({
       protocols.add(protocol);
       return protocols;
     }
-    module2.exports = { parse: parse13 };
+    module2.exports = { parse: parse14 };
   }
 });
 
@@ -141720,7 +142355,7 @@ var require_websocket_server2 = __commonJS({
     var EventEmitter4 = __require("events");
     var http4 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash8 } = __require("crypto");
+    var { createHash: createHash9 } = __require("crypto");
     var extension2 = require_extension2();
     var PerMessageDeflate2 = require_permessage_deflate2();
     var subprotocol2 = require_subprotocol2();
@@ -142035,7 +142670,7 @@ var require_websocket_server2 = __commonJS({
         }
         if (this._state > RUNNING)
           return abortHandshake(socket, 503);
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -186947,7 +187582,7 @@ var init_apigee_llm = __esm({
 // node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/models/registry.js
 import { createRequire as topLevelCreateRequire40 } from "module";
 var require41, LRUCache, _LLMRegistry, LLMRegistry;
-var init_registry = __esm({
+var init_registry2 = __esm({
   "node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/models/registry.js"() {
     "use strict";
     init_logger();
@@ -189372,7 +190007,7 @@ var init_llm_agent = __esm({
     init_function_tool();
     init_event();
     init_base_llm();
-    init_registry();
+    init_registry2();
     init_base_tool();
     init_logger();
     init_context3();
@@ -191409,7 +192044,7 @@ var require_bytes = __commonJS({
     "use strict";
     module2.exports = bytes;
     module2.exports.format = format3;
-    module2.exports.parse = parse13;
+    module2.exports.parse = parse14;
     var formatThousandsRegExp = /\B(?=(\d{3})+(?!\d))/g;
     var formatDecimalsRegExp = /(?:\.0*|(\.[^0]+)0+)$/;
     var map4 = {
@@ -191423,7 +192058,7 @@ var require_bytes = __commonJS({
     var parseRegExp = /^((-|\+)?(\d+(?:\.\d+)?)) *(kb|mb|gb|tb|pb)$/i;
     function bytes(value, options) {
       if (typeof value === "string") {
-        return parse13(value);
+        return parse14(value);
       }
       if (typeof value === "number") {
         return format3(value, options);
@@ -191467,7 +192102,7 @@ var require_bytes = __commonJS({
       }
       return str2 + unitSeparator + unit;
     }
-    function parse13(val) {
+    function parse14(val) {
       if (typeof val === "number" && !isNaN(val)) {
         return val;
       }
@@ -191503,7 +192138,7 @@ var require_content_type = __commonJS({
     var QUOTE_REGEXP = /([\\"])/g;
     var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
     exports2.format = format3;
-    exports2.parse = parse13;
+    exports2.parse = parse14;
     function format3(obj) {
       if (!obj || typeof obj !== "object") {
         throw new TypeError("argument obj is required");
@@ -191527,7 +192162,7 @@ var require_content_type = __commonJS({
       }
       return string7;
     }
-    function parse13(string7) {
+    function parse14(string7) {
       if (!string7) {
         throw new TypeError("argument string is required");
       }
@@ -191948,7 +192583,7 @@ var require_ms3 = __commonJS({
       options = options || {};
       var type2 = typeof val;
       if (type2 === "string" && val.length > 0) {
-        return parse13(val);
+        return parse14(val);
       } else if (type2 === "number" && isNaN(val) === false) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -191956,7 +192591,7 @@ var require_ms3 = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse13(str2) {
+    function parse14(str2) {
       str2 = String(str2);
       if (str2.length > 100) {
         return;
@@ -196321,7 +196956,7 @@ var require_read = __commonJS({
     var unpipe = require_unpipe();
     var zlib3 = __require("zlib");
     module2.exports = read;
-    function read(req, res, next, parse13, debug, options) {
+    function read(req, res, next, parse14, debug, options) {
       var length;
       var opts = options;
       var stream;
@@ -196380,7 +197015,7 @@ var require_read = __commonJS({
         try {
           debug("parse body");
           str2 = typeof body !== "string" && encoding !== null ? iconv.decode(body, encoding) : body;
-          req.body = parse13(str2);
+          req.body = parse14(str2);
         } catch (err2) {
           next(createError(400, err2, {
             body: str2,
@@ -196449,7 +197084,7 @@ var require_media_typer = __commonJS({
     var typeNameRegExp = /^[A-Za-z0-9][A-Za-z0-9!#$&^_-]{0,126}$/;
     var typeRegExp = /^ *([A-Za-z0-9][A-Za-z0-9!#$&^_-]{0,126})\/([A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}) *$/;
     exports2.format = format3;
-    exports2.parse = parse13;
+    exports2.parse = parse14;
     function format3(obj) {
       if (!obj || typeof obj !== "object") {
         throw new TypeError("argument obj is required");
@@ -196484,7 +197119,7 @@ var require_media_typer = __commonJS({
       }
       return string7;
     }
-    function parse13(string7) {
+    function parse14(string7) {
       if (!string7) {
         throw new TypeError("argument string is required");
       }
@@ -205316,7 +205951,7 @@ var require_json2 = __commonJS({
         throw new TypeError("option verify must be function");
       }
       var shouldParse = typeof type2 !== "function" ? typeChecker(type2) : type2;
-      function parse13(body) {
+      function parse14(body) {
         if (body.length === 0) {
           return {};
         }
@@ -205364,7 +205999,7 @@ var require_json2 = __commonJS({
           }));
           return;
         }
-        read(req, res, next, parse13, debug, {
+        read(req, res, next, parse14, debug, {
           encoding: charset,
           inflate,
           limit,
@@ -205443,7 +206078,7 @@ var require_raw = __commonJS({
         throw new TypeError("option verify must be function");
       }
       var shouldParse = typeof type2 !== "function" ? typeChecker(type2) : type2;
-      function parse13(buf) {
+      function parse14(buf) {
         return buf;
       }
       return function rawParser(req, res, next) {
@@ -205464,7 +206099,7 @@ var require_raw = __commonJS({
           next();
           return;
         }
-        read(req, res, next, parse13, debug, {
+        read(req, res, next, parse14, debug, {
           encoding: null,
           inflate,
           limit,
@@ -205501,7 +206136,7 @@ var require_text = __commonJS({
         throw new TypeError("option verify must be function");
       }
       var shouldParse = typeof type2 !== "function" ? typeChecker(type2) : type2;
-      function parse13(buf) {
+      function parse14(buf) {
         return buf;
       }
       return function textParser(req, res, next) {
@@ -205523,7 +206158,7 @@ var require_text = __commonJS({
           return;
         }
         var charset = getCharset(req) || defaultCharset;
-        read(req, res, next, parse13, debug, {
+        read(req, res, next, parse14, debug, {
           encoding: charset,
           inflate,
           limit,
@@ -208047,11 +208682,11 @@ var require_lib2 = __commonJS({
   "node_modules/.pnpm/qs@6.14.2/node_modules/qs/lib/index.js"(exports2, module2) {
     "use strict";
     var stringify4 = require_stringify2();
-    var parse13 = require_parse3();
+    var parse14 = require_parse3();
     var formats = require_formats2();
     module2.exports = {
       formats,
-      parse: parse13,
+      parse: parse14,
       stringify: stringify4
     };
   }
@@ -208085,7 +208720,7 @@ var require_urlencoded = __commonJS({
       }
       var queryparse = extended ? extendedparser(opts) : simpleparser(opts);
       var shouldParse = typeof type2 !== "function" ? typeChecker(type2) : type2;
-      function parse13(body) {
+      function parse14(body) {
         return body.length ? queryparse(body) : {};
       }
       return function urlencodedParser(req, res, next) {
@@ -208115,7 +208750,7 @@ var require_urlencoded = __commonJS({
           }));
           return;
         }
-        read(req, res, next, parse13, debug, {
+        read(req, res, next, parse14, debug, {
           debug,
           encoding: charset,
           inflate,
@@ -208127,7 +208762,7 @@ var require_urlencoded = __commonJS({
     function extendedparser(options) {
       var parameterLimit = options.parameterLimit !== void 0 ? options.parameterLimit : 1e3;
       var depth = options.depth !== void 0 ? options.depth : 32;
-      var parse13 = parser("qs");
+      var parse14 = parser("qs");
       if (isNaN(parameterLimit) || parameterLimit < 1) {
         throw new TypeError("option parameterLimit must be a positive number");
       }
@@ -208148,7 +208783,7 @@ var require_urlencoded = __commonJS({
         var arrayLimit = Math.max(100, paramCount);
         debug("parse extended urlencoding");
         try {
-          return parse13(body, {
+          return parse14(body, {
             allowPrototypes: true,
             arrayLimit,
             depth,
@@ -208203,7 +208838,7 @@ var require_urlencoded = __commonJS({
     }
     function simpleparser(options) {
       var parameterLimit = options.parameterLimit !== void 0 ? options.parameterLimit : 1e3;
-      var parse13 = parser("querystring");
+      var parse14 = parser("querystring");
       if (isNaN(parameterLimit) || parameterLimit < 1) {
         throw new TypeError("option parameterLimit must be a positive number");
       }
@@ -208219,7 +208854,7 @@ var require_urlencoded = __commonJS({
           });
         }
         debug("parse urlencoding");
-        return parse13(body, void 0, void 0, { maxKeys: parameterLimit });
+        return parse14(body, void 0, void 0, { maxKeys: parameterLimit });
       };
     }
     function typeChecker(type2) {
@@ -208402,7 +209037,7 @@ var require_parseurl = __commonJS({
   "node_modules/.pnpm/parseurl@1.3.3/node_modules/parseurl/index.js"(exports2, module2) {
     "use strict";
     var url4 = __require("url");
-    var parse13 = url4.parse;
+    var parse14 = url4.parse;
     var Url = url4.Url;
     module2.exports = parseurl;
     module2.exports.original = originalurl;
@@ -208434,7 +209069,7 @@ var require_parseurl = __commonJS({
     }
     function fastparse(str2) {
       if (typeof str2 !== "string" || str2.charCodeAt(0) !== 47) {
-        return parse13(str2);
+        return parse14(str2);
       }
       var pathname = str2;
       var query = null;
@@ -208456,7 +209091,7 @@ var require_parseurl = __commonJS({
           case 35:
           case 160:
           case 65279:
-            return parse13(str2);
+            return parse14(str2);
         }
       }
       var url5 = Url !== void 0 ? new Url() : {};
@@ -209479,7 +210114,7 @@ var require_view = __commonJS({
     var debug = require_src6()("express:view");
     var path47 = __require("path");
     var fs39 = __require("fs");
-    var dirname16 = path47.dirname;
+    var dirname17 = path47.dirname;
     var basename7 = path47.basename;
     var extname4 = path47.extname;
     var join37 = path47.join;
@@ -209518,7 +210153,7 @@ var require_view = __commonJS({
       for (var i2 = 0; i2 < roots.length && !path48; i2++) {
         var root2 = roots[i2];
         var loc = resolve9(root2, name);
-        var dir = dirname16(loc);
+        var dir = dirname17(loc);
         var file3 = basename7(loc);
         path48 = this.resolve(dir, file3);
       }
@@ -209557,7 +210192,7 @@ var require_content_disposition = __commonJS({
   "node_modules/.pnpm/content-disposition@0.5.4/node_modules/content-disposition/index.js"(exports2, module2) {
     "use strict";
     module2.exports = contentDisposition;
-    module2.exports.parse = parse13;
+    module2.exports.parse = parse14;
     var basename7 = __require("path").basename;
     var Buffer8 = require_safe_buffer().Buffer;
     var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g;
@@ -209648,7 +210283,7 @@ var require_content_disposition = __commonJS({
     function getlatin1(val) {
       return String(val).replace(NON_LATIN1_REGEXP, "?");
     }
-    function parse13(string7) {
+    function parse14(string7) {
       if (!string7 || typeof string7 !== "string") {
         throw new TypeError("argument string is required");
       }
@@ -210536,7 +211171,7 @@ var require_forwarded = __commonJS({
       if (!req) {
         throw new TypeError("argument req is required");
       }
-      var proxyAddrs = parse13(req.headers["x-forwarded-for"] || "");
+      var proxyAddrs = parse14(req.headers["x-forwarded-for"] || "");
       var socketAddr = getSocketAddr(req);
       var addrs = [socketAddr].concat(proxyAddrs);
       return addrs;
@@ -210544,7 +211179,7 @@ var require_forwarded = __commonJS({
     function getSocketAddr(req) {
       return req.socket ? req.socket.remoteAddress : req.connection.remoteAddress;
     }
-    function parse13(header) {
+    function parse14(header) {
       var end = header.length;
       var list = [];
       var start = header.length;
@@ -212373,7 +213008,7 @@ var require_request = __commonJS({
     var http4 = __require("http");
     var fresh = require_fresh();
     var parseRange = require_range_parser();
-    var parse13 = require_parseurl();
+    var parse14 = require_parseurl();
     var proxyaddr = require_proxy_addr();
     var req = Object.create(http4.IncomingMessage.prototype);
     module2.exports = req;
@@ -212483,7 +213118,7 @@ var require_request = __commonJS({
       return subdomains2.slice(offset);
     });
     defineGetter(req, "path", function path47() {
-      return parse13(this).pathname;
+      return parse14(this).pathname;
     });
     defineGetter(req, "hostname", function hostname5() {
       var trust = this.app.get("trust proxy fn");
@@ -212563,7 +213198,7 @@ var require_cookie_signature = __commonJS({
 var require_cookie = __commonJS({
   "node_modules/.pnpm/cookie@0.7.2/node_modules/cookie/index.js"(exports2) {
     "use strict";
-    exports2.parse = parse13;
+    exports2.parse = parse14;
     exports2.serialize = serialize3;
     var __toString = Object.prototype.toString;
     var __hasOwnProperty = Object.prototype.hasOwnProperty;
@@ -212571,7 +213206,7 @@ var require_cookie = __commonJS({
     var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u005D-\u007E]*\1$/;
     var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
     var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
-    function parse13(str2, opt) {
+    function parse14(str2, opt) {
       if (typeof str2 !== "string") {
         throw new TypeError("argument str must be a string");
       }
@@ -212744,7 +213379,7 @@ var require_vary = __commonJS({
       if (!field) {
         throw new TypeError("field argument is required");
       }
-      var fields = !Array.isArray(field) ? parse13(String(field)) : field;
+      var fields = !Array.isArray(field) ? parse14(String(field)) : field;
       for (var j = 0; j < fields.length; j++) {
         if (!FIELD_NAME_REGEXP.test(fields[j])) {
           throw new TypeError("field argument contains an invalid header name");
@@ -212754,7 +213389,7 @@ var require_vary = __commonJS({
         return header;
       }
       var val = header;
-      var vals = parse13(header.toLowerCase());
+      var vals = parse14(header.toLowerCase());
       if (fields.indexOf("*") !== -1 || vals.indexOf("*") !== -1) {
         return "*";
       }
@@ -212767,7 +213402,7 @@ var require_vary = __commonJS({
       }
       return val;
     }
-    function parse13(header) {
+    function parse14(header) {
       var end = 0;
       var list = [];
       var start = 0;
@@ -233269,7 +233904,7 @@ var init_crc32c = __esm({
 });
 
 // node_modules/.pnpm/@google-cloud+storage@7.21.0_encoding@0.1.13/node_modules/@google-cloud/storage/build/esm/src/hash-stream-validator.js
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { Transform as Transform3 } from "stream";
 var __classPrivateFieldSet2, __classPrivateFieldGet2, _HashStreamValidator_crc32cHash, _HashStreamValidator_md5Hash, _HashStreamValidator_md5Digest, HashStreamValidator;
 var init_hash_stream_validator = __esm({
@@ -233314,7 +233949,7 @@ var init_hash_stream_validator = __esm({
           }
         }
         if (this.md5Enabled) {
-          __classPrivateFieldSet2(this, _HashStreamValidator_md5Hash, createHash3("md5"), "f");
+          __classPrivateFieldSet2(this, _HashStreamValidator_md5Hash, createHash4("md5"), "f");
         }
       }
       /**
@@ -233382,7 +234017,7 @@ var init_hash_stream_validator = __esm({
 });
 
 // node_modules/.pnpm/@google-cloud+storage@7.21.0_encoding@0.1.13/node_modules/@google-cloud/storage/build/esm/src/resumable-upload.js
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { Readable as Readable2, Writable } from "stream";
 import * as crypto10 from "crypto";
 function upload(cfg) {
@@ -233514,13 +234149,13 @@ var init_resumable_upload = __esm({
             const base64Key = Buffer.from(cfg.key).toString("base64");
             this.encryption = {
               key: base64Key,
-              hash: createHash4("sha256").update(cfg.key).digest("base64")
+              hash: createHash5("sha256").update(cfg.key).digest("base64")
             };
           } else {
             const base64Key = cfg.key.toString("base64");
             this.encryption = {
               key: base64Key,
-              hash: createHash4("sha256").update(cfg.key).digest("base64")
+              hash: createHash5("sha256").update(cfg.key).digest("base64")
             };
           }
         }
@@ -242751,7 +243386,7 @@ var init_transfer_manager = __esm({
 });
 
 // node_modules/.pnpm/@google-cloud+storage@7.21.0_encoding@0.1.13/node_modules/@google-cloud/storage/build/esm/src/index.js
-var init_src8 = __esm({
+var init_src9 = __esm({
   "node_modules/.pnpm/@google-cloud+storage@7.21.0_encoding@0.1.13/node_modules/@google-cloud/storage/build/esm/src/index.js"() {
     "use strict";
     init_nodejs_common();
@@ -242774,7 +243409,7 @@ var require83;
 var init_gcs_artifact_service = __esm({
   "node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/artifacts/gcs_artifact_service.js"() {
     "use strict";
-    init_src8();
+    init_src9();
     init_node3();
     init_logger();
     require83 = topLevelCreateRequire82(import.meta.url);
@@ -242794,7 +243429,7 @@ var init_in_memory_artifact_service = __esm({
 // node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/artifacts/registry.js
 import { createRequire as topLevelCreateRequire84 } from "module";
 var require85;
-var init_registry2 = __esm({
+var init_registry3 = __esm({
   "node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/artifacts/registry.js"() {
     "use strict";
     init_file_artifact_service();
@@ -265194,7 +265829,7 @@ var init_common = __esm({
     init_apigee_llm();
     init_base_llm();
     init_google_llm();
-    init_registry();
+    init_registry2();
     init_routed_llm();
     init_base_plugin();
     init_logging_plugin();
@@ -266964,7 +267599,7 @@ var require_parse4 = __commonJS({
       CHAR_NO_BREAK_SPACE,
       CHAR_ZERO_WIDTH_NOBREAK_SPACE
     } = require_constants8();
-    var parse13 = (input, options = {}) => {
+    var parse14 = (input, options = {}) => {
       if (typeof input !== "string") {
         throw new TypeError("Expected a string");
       }
@@ -267168,7 +267803,7 @@ var require_parse4 = __commonJS({
       push2({ type: "eos" });
       return ast;
     };
-    module2.exports = parse13;
+    module2.exports = parse14;
   }
 });
 
@@ -267179,7 +267814,7 @@ var require_braces = __commonJS({
     var stringify4 = require_stringify3();
     var compile = require_compile2();
     var expand = require_expand();
-    var parse13 = require_parse4();
+    var parse14 = require_parse4();
     var braces = (input, options = {}) => {
       let output = [];
       if (Array.isArray(input)) {
@@ -267199,7 +267834,7 @@ var require_braces = __commonJS({
       }
       return output;
     };
-    braces.parse = (input, options = {}) => parse13(input, options);
+    braces.parse = (input, options = {}) => parse14(input, options);
     braces.stringify = (input, options = {}) => {
       if (typeof input === "string") {
         return stringify4(braces.parse(input, options), options);
@@ -267857,7 +268492,7 @@ var require_parse5 = __commonJS({
     var syntaxError = (type2, char) => {
       return `Missing ${type2}: "${char}" - use "\\\\${char}" to match literal characters`;
     };
-    var parse13 = (input, options) => {
+    var parse14 = (input, options) => {
       if (typeof input !== "string") {
         throw new TypeError("Expected a string");
       }
@@ -268007,7 +268642,7 @@ var require_parse5 = __commonJS({
             output = token.close = `)$))${extglobStar}`;
           }
           if (token.inner.includes("*") && (rest = remaining()) && /^\.[^\\/.]+$/.test(rest)) {
-            const expression = parse13(rest, { ...options, fastpaths: false }).output;
+            const expression = parse14(rest, { ...options, fastpaths: false }).output;
             output = token.close = `)${expression})${extglobStar})`;
           }
           if (token.prev.type === "bos") {
@@ -268536,7 +269171,7 @@ var require_parse5 = __commonJS({
       }
       return state;
     };
-    parse13.fastpaths = (input, options) => {
+    parse14.fastpaths = (input, options) => {
       const opts = { ...options };
       const max2 = typeof opts.maxLength === "number" ? Math.min(MAX_LENGTH, opts.maxLength) : MAX_LENGTH;
       const len = input.length;
@@ -268605,7 +269240,7 @@ var require_parse5 = __commonJS({
       }
       return source;
     };
-    module2.exports = parse13;
+    module2.exports = parse14;
   }
 });
 
@@ -268615,7 +269250,7 @@ var require_picomatch = __commonJS({
     "use strict";
     var path47 = __require("path");
     var scan = require_scan();
-    var parse13 = require_parse5();
+    var parse14 = require_parse5();
     var utils = require_utils7();
     var constants3 = require_constants9();
     var isObject7 = (val) => val && typeof val === "object" && !Array.isArray(val);
@@ -268705,7 +269340,7 @@ var require_picomatch = __commonJS({
     picomatch.parse = (pattern, options) => {
       if (Array.isArray(pattern))
         return pattern.map((p2) => picomatch.parse(p2, options));
-      return parse13(pattern, { ...options, fastpaths: false });
+      return parse14(pattern, { ...options, fastpaths: false });
     };
     picomatch.scan = (input, options) => scan(input, options);
     picomatch.compileRe = (state, options, returnOutput = false, returnState = false) => {
@@ -268731,10 +269366,10 @@ var require_picomatch = __commonJS({
       }
       let parsed = { negated: false, fastpaths: true };
       if (options.fastpaths !== false && (input[0] === "." || input[0] === "*")) {
-        parsed.output = parse13.fastpaths(input, options);
+        parsed.output = parse14.fastpaths(input, options);
       }
       if (!parsed.output) {
-        parsed = parse13(input, options);
+        parsed = parse14(input, options);
       }
       return picomatch.compileRe(parsed, options, returnOutput, returnState);
     };
@@ -274362,7 +274997,7 @@ var require_esprima = __commonJS({
             var jsx_parser_1 = __webpack_require__(3);
             var parser_1 = __webpack_require__(8);
             var tokenizer_1 = __webpack_require__(15);
-            function parse13(code, options, delegate) {
+            function parse14(code, options, delegate) {
               var commentHandler = null;
               var proxyDelegate = function(node, metadata) {
                 if (delegate) {
@@ -274407,17 +275042,17 @@ var require_esprima = __commonJS({
               }
               return ast;
             }
-            exports3.parse = parse13;
+            exports3.parse = parse14;
             function parseModule(code, options, delegate) {
               var parsingOptions = options || {};
               parsingOptions.sourceType = "module";
-              return parse13(code, parsingOptions, delegate);
+              return parse14(code, parsingOptions, delegate);
             }
             exports3.parseModule = parseModule;
             function parseScript(code, options, delegate) {
               var parsingOptions = options || {};
               parsingOptions.sourceType = "script";
-              return parse13(code, parsingOptions, delegate);
+              return parse14(code, parsingOptions, delegate);
             }
             exports3.parseScript = parseScript;
             function tokenize2(code, options, delegate) {
@@ -286258,7 +286893,7 @@ var require_main = __commonJS({
       return supportsAnsi() ? `\x1B[2m${text2}\x1B[0m` : text2;
     }
     var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
-    function parse13(src) {
+    function parse14(src) {
       const obj = {};
       let lines = src.toString();
       lines = lines.replace(/\r\n?/mg, "\n");
@@ -286530,7 +287165,7 @@ var require_main = __commonJS({
       _parseVault,
       config: config3,
       decrypt,
-      parse: parse13,
+      parse: parse14,
       populate
     };
     module2.exports.configDotenv = DotenvModule.configDotenv;
@@ -302405,7 +303040,7 @@ var init_vertex_ai_session_service = __esm({
 // node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/sessions/registry.js
 import { createRequire as topLevelCreateRequire150 } from "module";
 var require151;
-var init_registry3 = __esm({
+var init_registry4 = __esm({
   "node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/sessions/registry.js"() {
     "use strict";
     init_database_session_service();
@@ -304375,7 +305010,7 @@ var require_parse6 = __commonJS({
       }
       return parsed;
     }
-    function parse13(command2, args, options) {
+    function parse14(command2, args, options) {
       if (args && !Array.isArray(args)) {
         options = args;
         args = null;
@@ -304394,7 +305029,7 @@ var require_parse6 = __commonJS({
       };
       return options.shell ? parsed : parseNonShell(parsed);
     }
-    module2.exports = parse13;
+    module2.exports = parse14;
   }
 });
 
@@ -304453,16 +305088,16 @@ var require_cross_spawn = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/index.js"(exports2, module2) {
     "use strict";
     var cp = __require("child_process");
-    var parse13 = require_parse6();
+    var parse14 = require_parse6();
     var enoent = require_enoent();
     function spawn6(command2, args, options) {
-      const parsed = parse13(command2, args, options);
+      const parsed = parse14(command2, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
       return spawned;
     }
     function spawnSync2(command2, args, options) {
-      const parsed = parse13(command2, args, options);
+      const parsed = parse14(command2, args, options);
       const result = cp.spawnSync(parsed.command, parsed.args, parsed.options);
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
@@ -304470,7 +305105,7 @@ var require_cross_spawn = __commonJS({
     module2.exports = spawn6;
     module2.exports.spawn = spawn6;
     module2.exports.sync = spawnSync2;
-    module2.exports._parse = parse13;
+    module2.exports._parse = parse14;
     module2.exports._enoent = enoent;
   }
 });
@@ -311307,11 +311942,11 @@ var require_lib8 = __commonJS({
   "node_modules/.pnpm/qs@6.15.3/node_modules/qs/lib/index.js"(exports2, module2) {
     "use strict";
     var stringify4 = require_stringify4();
-    var parse13 = require_parse7();
+    var parse14 = require_parse7();
     var formats = require_formats3();
     module2.exports = {
       formats,
-      parse: parse13,
+      parse: parse14,
       stringify: stringify4
     };
   }
@@ -326336,7 +326971,7 @@ var require_root = __commonJS({
     var OneOf = require_oneof();
     var util3 = require_util11();
     var Type4;
-    var parse13;
+    var parse14;
     var common3;
     function Root(options) {
       Namespace.call(this, "", options);
@@ -326396,8 +327031,8 @@ var require_root = __commonJS({
           if (!util3.isString(source))
             self2.setOptions(source.options).addJSON(source.nested);
           else {
-            parse13.filename = filename2;
-            var parsed = parse13(source, self2, options), resolved2, i3 = 0;
+            parse14.filename = filename2;
+            var parsed = parse14(source, self2, options), resolved2, i3 = 0;
             if (parsed.imports) {
               for (; i3 < parsed.imports.length; ++i3)
                 if (resolved2 = getBundledFileName(parsed.imports[i3]) || self2.resolvePath(filename2, parsed.imports[i3]))
@@ -326569,7 +327204,7 @@ var require_root = __commonJS({
     };
     Root._configure = function(Type_, parse_, common_) {
       Type4 = Type_;
-      parse13 = parse_;
+      parse14 = parse_;
       common3 = common_;
     };
   }
@@ -327834,9 +328469,9 @@ var require_tokenize = __commonJS({
 var require_parse8 = __commonJS({
   "node_modules/.pnpm/protobufjs@7.5.4/node_modules/protobufjs/src/parse.js"(exports2, module2) {
     "use strict";
-    module2.exports = parse13;
-    parse13.filename = null;
-    parse13.defaults = { keepCase: false };
+    module2.exports = parse14;
+    parse14.filename = null;
+    parse14.defaults = { keepCase: false };
     var tokenize2 = require_tokenize();
     var Root = require_root();
     var Type4 = require_type2();
@@ -327858,13 +328493,13 @@ var require_parse8 = __commonJS({
     var numberRe = /^(?![eE])[0-9]*(?:\.[0-9]*)?(?:[eE][+-]?[0-9]+)?$/;
     var nameRe = /^[a-zA-Z_][a-zA-Z_0-9]*$/;
     var typeRefRe = /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)(?:\.[a-zA-Z_][a-zA-Z_0-9]*)*$/;
-    function parse13(source, root2, options) {
+    function parse14(source, root2, options) {
       if (!(root2 instanceof Root)) {
         options = root2;
         root2 = new Root();
       }
       if (!options)
-        options = parse13.defaults;
+        options = parse14.defaults;
       var preferTrailingComment = options.preferTrailingComment || false;
       var tn = tokenize2(source, options.alternateCommentMode || false), next = tn.next, push2 = tn.push, peek = tn.peek, skip = tn.skip, cmnt = tn.cmnt;
       var head = true, pkg, imports, weakImports, edition = "proto2";
@@ -327885,9 +328520,9 @@ var require_parse8 = __commonJS({
         });
       }
       function illegal(token2, name, insideTryCatch) {
-        var filename = parse13.filename;
+        var filename = parse14.filename;
         if (!insideTryCatch)
-          parse13.filename = null;
+          parse14.filename = null;
         return Error("illegal " + (name || "token") + " '" + token2 + "' (" + (filename ? filename + ", " : "") + "line " + tn.line + ")");
       }
       function readString() {
@@ -328085,7 +328720,7 @@ var require_parse8 = __commonJS({
           if (typeof obj.comment !== "string") {
             obj.comment = cmnt();
           }
-          obj.filename = parse13.filename;
+          obj.filename = parse14.filename;
         }
         if (skip("{", true)) {
           var token2;
@@ -328202,7 +328837,7 @@ var require_parse8 = __commonJS({
         var type2 = new Type4(name);
         type2.group = true;
         var field = new Field(fieldName, id, name, rule);
-        field.filename = parse13.filename;
+        field.filename = parse14.filename;
         ifBlock(type2, function parseGroup_block(token2) {
           switch (token2) {
             case "option":
@@ -328538,7 +329173,7 @@ var require_parse8 = __commonJS({
         }
       }
       resolveFileFeatures();
-      parse13.filename = null;
+      parse14.filename = null;
       return {
         "package": pkg,
         "imports": imports,
@@ -350245,13 +350880,13 @@ var init_esm6 = __esm({
     init_invocation_context();
     init_file_artifact_service();
     init_gcs_artifact_service();
-    init_registry2();
+    init_registry3();
     init_agent_engine_sandbox_code_executor();
     init_code_execution_utils();
     init_unsafe_local_code_executor();
     init_common();
     init_database_session_service();
-    init_registry3();
+    init_registry4();
     init_vertex_ai_session_service();
     init_loader();
     init_run_skill_inline_script_tool();
@@ -350977,7 +351612,7 @@ __export(src_exports3, {
   normalizeAdkSession: () => normalizeAdkSession,
   resolveAdkConfigFromEnv: () => resolveAdkConfigFromEnv
 });
-var init_src9 = __esm({
+var init_src10 = __esm({
   "libs/import-adk/src/index.ts"() {
     "use strict";
     init_extract();
@@ -359643,7 +360278,7 @@ var require_parse9 = __commonJS({
   "node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/parse.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver3();
-    var parse13 = (version6, options, throwErrors = false) => {
+    var parse14 = (version6, options, throwErrors = false) => {
       if (version6 instanceof SemVer) {
         return version6;
       }
@@ -359656,7 +360291,7 @@ var require_parse9 = __commonJS({
         throw er;
       }
     };
-    module2.exports = parse13;
+    module2.exports = parse14;
   }
 });
 
@@ -359664,9 +360299,9 @@ var require_parse9 = __commonJS({
 var require_valid3 = __commonJS({
   "node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/valid.js"(exports2, module2) {
     "use strict";
-    var parse13 = require_parse9();
+    var parse14 = require_parse9();
     var valid = (version6, options) => {
-      const v = parse13(version6, options);
+      const v = parse14(version6, options);
       return v ? v.version : null;
     };
     module2.exports = valid;
@@ -359677,9 +360312,9 @@ var require_valid3 = __commonJS({
 var require_clean2 = __commonJS({
   "node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/clean.js"(exports2, module2) {
     "use strict";
-    var parse13 = require_parse9();
+    var parse14 = require_parse9();
     var clean = (version6, options) => {
-      const s2 = parse13(version6.trim().replace(/^[=v]+/, ""), options);
+      const s2 = parse14(version6.trim().replace(/^[=v]+/, ""), options);
       return s2 ? s2.version : null;
     };
     module2.exports = clean;
@@ -359714,10 +360349,10 @@ var require_inc2 = __commonJS({
 var require_diff2 = __commonJS({
   "node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/diff.js"(exports2, module2) {
     "use strict";
-    var parse13 = require_parse9();
+    var parse14 = require_parse9();
     var diff2 = (version1, version22) => {
-      const v13 = parse13(version1, null, true);
-      const v2 = parse13(version22, null, true);
+      const v13 = parse14(version1, null, true);
+      const v2 = parse14(version22, null, true);
       const comparison = v13.compare(v2);
       if (comparison === 0) {
         return null;
@@ -359788,9 +360423,9 @@ var require_patch2 = __commonJS({
 var require_prerelease2 = __commonJS({
   "node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/prerelease.js"(exports2, module2) {
     "use strict";
-    var parse13 = require_parse9();
+    var parse14 = require_parse9();
     var prerelease = (version6, options) => {
-      const parsed = parse13(version6, options);
+      const parsed = parse14(version6, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module2.exports = prerelease;
@@ -359976,7 +360611,7 @@ var require_coerce2 = __commonJS({
   "node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/coerce.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver3();
-    var parse13 = require_parse9();
+    var parse14 = require_parse9();
     var { safeRe: re3, t: t3 } = require_re2();
     var coerce = (version6, options) => {
       if (version6 instanceof SemVer) {
@@ -360011,7 +360646,7 @@ var require_coerce2 = __commonJS({
       const patch = match2[4] || "0";
       const prerelease = options.includePrerelease && match2[5] ? `-${match2[5]}` : "";
       const build = options.includePrerelease && match2[6] ? `+${match2[6]}` : "";
-      return parse13(`${major3}.${minor}.${patch}${prerelease}${build}`, options);
+      return parse14(`${major3}.${minor}.${patch}${prerelease}${build}`, options);
     };
     module2.exports = coerce;
   }
@@ -360021,7 +360656,7 @@ var require_coerce2 = __commonJS({
 var require_truncate = __commonJS({
   "node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/truncate.js"(exports2, module2) {
     "use strict";
-    var parse13 = require_parse9();
+    var parse14 = require_parse9();
     var constants3 = require_constants14();
     var SemVer = require_semver3();
     var truncate2 = (version6, truncation, options) => {
@@ -360033,7 +360668,7 @@ var require_truncate = __commonJS({
     };
     var cloneInputVersion = (version6, options) => {
       const versionStringToParse = version6 instanceof SemVer ? version6.version : version6;
-      return parse13(versionStringToParse, options);
+      return parse14(versionStringToParse, options);
     };
     var doTruncation = (version6, truncation) => {
       if (isPrerelease(truncation)) {
@@ -361076,7 +361711,7 @@ var require_semver4 = __commonJS({
     var constants3 = require_constants14();
     var SemVer = require_semver3();
     var identifiers = require_identifiers2();
-    var parse13 = require_parse9();
+    var parse14 = require_parse9();
     var valid = require_valid3();
     var clean = require_clean2();
     var inc = require_inc2();
@@ -361115,7 +361750,7 @@ var require_semver4 = __commonJS({
     var simplifyRange = require_simplify2();
     var subset = require_subset2();
     module2.exports = {
-      parse: parse13,
+      parse: parse14,
       valid,
       clean,
       inc,
@@ -376392,7 +377027,9 @@ var init_messages6 = __esm({
           content.push(reasoning);
         }
       }
-      content.push(...contentBlocksFrom(message.content));
+      content.push(
+        ...contentBlocksFrom(message.content)
+      );
       if (type2 === "ai") {
         content.push(...toolCallBlocksFrom(message));
       }
@@ -376405,6 +377042,8 @@ var init_messages6 = __esm({
         content
       };
       if (type2 === "tool") {
+        if ("status" in message && message.status === "error")
+          normalized.error = "error";
         const toolCallId = message.tool_call_id;
         if (typeof toolCallId === "string" && toolCallId !== "") {
           return { ...normalized, toolCallId };
@@ -376541,6 +377180,135 @@ var init_state2 = __esm({
   }
 });
 
+// libs/import-langgraph/src/state-snapshot.ts
+var defaultWarn2, assistantSchema, createAssistantSchemaCache, hasRecoverableState, readAssistantSchemas, readStateSnapshot;
+var init_state_snapshot = __esm({
+  "libs/import-langgraph/src/state-snapshot.ts"() {
+    "use strict";
+    init_zod();
+    defaultWarn2 = (warning) => {
+      console.warn("[import-langgraph] schema lookup fallback", warning);
+    };
+    assistantSchema = external_exports.object({
+      output_schema: external_exports.object({
+        properties: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+      }).loose().nullish()
+    }).loose();
+    createAssistantSchemaCache = () => /* @__PURE__ */ new Map();
+    hasRecoverableState = (values) => {
+      if (values === void 0 || values === null)
+        return false;
+      if (typeof values !== "object")
+        return true;
+      return Object.keys(values).length > 0;
+    };
+    readAssistantSchemas = async (assistants, assistantId, cache3, onLookupFailure) => {
+      if (cache3.has(assistantId))
+        return cache3.get(assistantId);
+      try {
+        const schemas = await assistants.getSchemas(assistantId);
+        cache3.set(assistantId, schemas);
+        return schemas;
+      } catch {
+        onLookupFailure();
+        return { output_schema: { properties: { messages: {}, tools: {} } } };
+      }
+    };
+    readStateSnapshot = async (client2, thread, checkpoints, assistantId, cache3, onWarn = defaultWarn2) => {
+      const values = checkpoints[0]?.values !== void 0 ? checkpoints[0].values : thread.values;
+      if (!hasRecoverableState(values))
+        return void 0;
+      const assistants = client2.assistants;
+      if (assistants === void 0)
+        return values;
+      const schemas = await readAssistantSchemas(
+        assistants,
+        assistantId,
+        cache3,
+        () => onWarn({
+          reason: "schema_lookup_fallback",
+          sourceThreadId: thread.thread_id,
+          assistantId,
+          detail: "State limited to messages and tools. After fixing schema access, re-import with --replace to recover graph-defined state."
+        })
+      );
+      if (schemas === void 0)
+        return values;
+      const schema2 = assistantSchema.safeParse(schemas);
+      const properties = schema2.success ? schema2.data.output_schema?.properties : void 0;
+      if (properties === void 0 || Object.keys(properties).length === 0 || typeof values !== "object" || values === null || Array.isArray(values)) {
+        return values;
+      }
+      const keys2 = /* @__PURE__ */ new Set(["messages", "tools", ...Object.keys(properties)]);
+      const projected = Object.fromEntries(
+        Object.entries(values).filter(([key]) => keys2.has(key))
+      );
+      return hasRecoverableState(projected) ? projected : void 0;
+    };
+  }
+});
+
+// libs/import-langgraph/src/interrupts.ts
+var headInterruptsSchema, readHeadInterrupts, readPendingInterrupts;
+var init_interrupts2 = __esm({
+  "libs/import-langgraph/src/interrupts.ts"() {
+    "use strict";
+    init_src7();
+    init_zod();
+    headInterruptsSchema = external_exports.object({ interrupts: external_exports.array(external_exports.unknown()).optional() }).loose();
+    readHeadInterrupts = (head) => {
+      const parsed = headInterruptsSchema.safeParse(head);
+      return parsed.success ? parsed.data.interrupts ?? [] : [];
+    };
+    readPendingInterrupts = (head, thread) => {
+      const fromTasks = (head?.tasks ?? []).flatMap(
+        (task) => task.interrupts ?? []
+      );
+      const fromHead = head === void 0 ? [] : readHeadInterrupts(head);
+      const fromThread = external_exports.record(external_exports.string(), external_exports.array(external_exports.unknown())).safeParse(thread?.interrupts);
+      const raw2 = fromTasks.length > 0 ? fromTasks : fromHead.length > 0 ? fromHead : fromThread.success ? Object.values(fromThread.data).flat() : [];
+      const seen = /* @__PURE__ */ new Set();
+      const result = [];
+      for (const candidate of raw2) {
+        const parsed = NormalizedPendingInterruptSchema.safeParse(candidate);
+        if (!parsed.success)
+          continue;
+        const interrupt = parsed.data;
+        if (interrupt.id !== void 0) {
+          if (seen.has(interrupt.id))
+            continue;
+          seen.add(interrupt.id);
+        }
+        result.push(interrupt);
+      }
+      return result;
+    };
+  }
+});
+
+// libs/import-langgraph/src/errors.ts
+var readTaskError, readRunErrors;
+var init_errors10 = __esm({
+  "libs/import-langgraph/src/errors.ts"() {
+    "use strict";
+    readTaskError = (checkpoint) => {
+      const errors = (checkpoint?.tasks ?? []).flatMap(
+        (task) => typeof task.error === "string" && task.error.trim() !== "" ? [task.error] : []
+      );
+      return errors.length > 0 ? [...new Set(errors)].join("\n") : void 0;
+    };
+    readRunErrors = (checkpoints) => {
+      const errors = /* @__PURE__ */ new Map();
+      for (const checkpoint of checkpoints) {
+        const runId = checkpoint.metadata?.["run_id"];
+        if (typeof runId === "string" && !errors.has(runId))
+          errors.set(runId, readTaskError(checkpoint));
+      }
+      return errors;
+    };
+  }
+});
+
 // libs/import-langgraph/src/user-source.ts
 var LANGGRAPH_AUTH_USER_ID_KEY, parseUserSource, readStringField, readValuesStringField, resolveEndUserId;
 var init_user_source = __esm({
@@ -376635,9 +377403,16 @@ async function* streamLangGraph(config3) {
   const client2 = await resolveClient(config3);
   const userSource = parseUserSource(config3.userSource);
   const pageSize = config3.pageSize ?? DEFAULT_THREAD_PAGE_SIZE;
+  const schemaCache = createAssistantSchemaCache();
   for await (const thread of enumerateThreads(client2, pageSize)) {
     try {
-      yield await extractThread(client2, thread, userSource);
+      yield await extractThread(
+        client2,
+        thread,
+        userSource,
+        schemaCache,
+        config3.onWarn
+      );
     } catch (error98) {
       yield {
         kind: "failed",
@@ -376654,16 +377429,19 @@ var DEFAULT_THREAD_PAGE_SIZE, FULL_HISTORY_LIMIT, synthesizeSingleRun, errorMess
 var init_extract2 = __esm({
   "libs/import-langgraph/src/extract.ts"() {
     "use strict";
-    init_src6();
+    init_src7();
     init_client7();
     init_graph_id();
     init_runs2();
     init_state2();
+    init_state_snapshot();
+    init_interrupts2();
+    init_errors10();
     init_user_source();
     DEFAULT_THREAD_PAGE_SIZE = 50;
     FULL_HISTORY_LIMIT = 1e3;
-    synthesizeSingleRun = (threadId, messages, activityAt) => {
-      if (messages.length === 0) {
+    synthesizeSingleRun = (threadId, messages, activityAt, hasState = false) => {
+      if (messages.length === 0 && !hasState) {
         return null;
       }
       return {
@@ -376695,7 +377473,7 @@ var init_extract2 = __esm({
       const head = await client2.threads.getState(threadId);
       return [head];
     };
-    extractThread = async (client2, thread, userSource) => {
+    extractThread = async (client2, thread, userSource, schemaCache, onWarn) => {
       const threadId = thread.thread_id;
       const checkpoints = await readCheckpoints(client2, threadId);
       const graphResolution = resolveGraphId(thread, checkpoints);
@@ -376713,9 +377491,27 @@ var init_extract2 = __esm({
       }
       const messages = readMessages(thread, checkpoints);
       const lastActivityAt = readLastActivityAt(thread, checkpoints);
-      const rawRuns = await client2.runs.list(threadId, { limit: FULL_HISTORY_LIMIT });
+      const rawRuns = await client2.runs.list(threadId, {
+        limit: FULL_HISTORY_LIMIT
+      });
       const sortedRuns = sortRunsChronologically(rawRuns);
-      const synthetic = synthesizeSingleRun(threadId, messages, lastActivityAt);
+      const runErrors = readRunErrors(checkpoints);
+      const headError = readTaskError(checkpoints[0]);
+      const pendingInterrupts = readPendingInterrupts(checkpoints[0], thread);
+      const stateSnapshot = await readStateSnapshot(
+        client2,
+        thread,
+        checkpoints,
+        sortedRuns.at(-1)?.assistant_id ?? graphResolution.graphId,
+        schemaCache,
+        onWarn
+      );
+      const synthetic = synthesizeSingleRun(
+        threadId,
+        messages,
+        lastActivityAt,
+        stateSnapshot !== void 0 || pendingInterrupts.length > 0 || headError !== void 0
+      );
       const runs = sortedRuns.length === 0 && synthetic !== null ? [synthetic] : sortedRuns;
       const spans = partitionMessagesByRun(messages, runs);
       const normalizedRuns = [];
@@ -376723,7 +377519,13 @@ var init_extract2 = __esm({
       for (const span of spans) {
         const slice = messages.slice(cursor, cursor + span.messageCount);
         cursor += span.messageCount;
-        normalizedRuns.push(normalizeRun(span, slice));
+        const normalized = normalizeRun(span, slice);
+        const recordedError = sortedRuns.length === 0 ? headError : runErrors.get(normalized.sourceRunId);
+        if (sortedRuns.length === 0 && recordedError !== void 0)
+          normalized.status = "error";
+        if (normalized.status === "error" && recordedError !== void 0)
+          normalized.errorMessage = recordedError;
+        normalizedRuns.push(normalized);
       }
       const endUserId = resolveEndUserId(userSource, thread, checkpoints);
       const conversation = {
@@ -376732,6 +377534,8 @@ var init_extract2 = __esm({
         sourceBackend: "server",
         endUserId,
         ...lastActivityAt !== void 0 ? { lastActivityAt } : {},
+        ...stateSnapshot !== void 0 ? { stateSnapshot } : {},
+        ...pendingInterrupts.length > 0 ? { pendingInterrupts } : {},
         runs: normalizedRuns
       };
       return {
@@ -376778,7 +377582,7 @@ __export(src_exports4, {
   sumUsage: () => sumUsage,
   usageFromMessage: () => usageFromMessage
 });
-var init_src10 = __esm({
+var init_src11 = __esm({
   "libs/import-langgraph/src/index.ts"() {
     "use strict";
     init_extract2();
@@ -376883,7 +377687,7 @@ async function enumerateSource(config3) {
     return fixture;
   }
   if (config3.source === "adk") {
-    const { extractAdk: extractAdk2 } = await Promise.resolve().then(() => (init_src9(), src_exports3));
+    const { extractAdk: extractAdk2 } = await Promise.resolve().then(() => (init_src10(), src_exports3));
     const adkEnv = {
       ...process.env,
       ...config3.adkSourceBackend !== void 0 ? { ADK_SOURCE_BACKEND: config3.adkSourceBackend } : {},
@@ -376915,7 +377719,7 @@ async function enumerateSource(config3) {
       TELEMETRY_ERROR_CODES.PREREQUISITE_MISSING
     );
   }
-  const { streamLangGraph: streamLangGraph2 } = await Promise.resolve().then(() => (init_src10(), src_exports4));
+  const { streamLangGraph: streamLangGraph2 } = await Promise.resolve().then(() => (init_src11(), src_exports4));
   const conversations = [];
   const skipped = [];
   const failures = [];
@@ -377372,7 +378176,7 @@ ${formatStaleBuildNote()}`);
 var init_telemetry2 = __esm({
   "apps/cli/src/commands/telemetry.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_config();
     init_unknown_input();
   }
@@ -378901,6 +379705,14 @@ function declareChannel(config3, channel2) {
     )
   };
 }
+function renameChannelDisplayName(config3, channel2) {
+  return {
+    ...config3,
+    channels: config3.channels.map(
+      (declared) => declared.name === channel2.name ? { ...declared, displayName: channel2.displayName } : declared
+    )
+  };
+}
 function requiredCredentialEnvNames(config3, channelName, adapter2) {
   const declared = config3.channels.find(
     (channel2) => channel2.name === channelName
@@ -379045,7 +379857,7 @@ function createSlackIngressUrl(input) {
   return new URL(input.path, ingressBaseUrl).toString();
 }
 function createSlackAppDisplayName(channelDisplayName) {
-  return [...channelDisplayName].slice(0, 35).join("");
+  return [...channelDisplayName.trim()].slice(0, SLACK_APP_NAME_MAX_LENGTH).join("");
 }
 function normalizeSlackIdentity(value) {
   return value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 80).replace(/-+$/gu, "");
@@ -379058,6 +379870,33 @@ function createSlackBotDisplayName(channelDisplayName, fallbackName = DEFAULT_SL
   const safeFallback = normalizeSlackIdentity(fallbackName);
   return safeFallback && !RESERVED_SLACK_IDENTITIES.has(safeFallback) ? safeFallback : DEFAULT_SLACK_IDENTITY;
 }
+function suggestSlackDisplayName(channelName) {
+  const words = channelName.normalize("NFKD").toLowerCase().split(/[^a-z0-9]+/u).filter((word) => word.length > 0).map((word) => `${word.slice(0, 1).toUpperCase()}${word.slice(1)}`);
+  const suggestion = [...words.join(" ")].slice(0, SLACK_APP_NAME_MAX_LENGTH).join("").trim();
+  return suggestion.length > 0 ? suggestion : DEFAULT_SLACK_APP_NAME;
+}
+function validateSlackDisplayName(input) {
+  const appName = input.channelDisplayName.trim();
+  const suggestion = suggestSlackDisplayName(input.channelName);
+  if (appName.length === 0) {
+    return {
+      message: `A Slack app needs a name: Slack rejects a manifest whose display_information.name is empty. Pass --display-name, for example "${suggestion}".`,
+      status: "invalid",
+      suggestion,
+      violation: "empty"
+    };
+  }
+  const length = [...appName].length;
+  if (length > SLACK_APP_NAME_MAX_LENGTH) {
+    return {
+      message: `A Slack app name may be at most ${SLACK_APP_NAME_MAX_LENGTH} characters, and "${appName}" is ${length}. Pass a shorter --display-name, for example "${suggestion}".`,
+      status: "invalid",
+      suggestion,
+      violation: "too_long"
+    };
+  }
+  return { status: "ok" };
+}
 function createSlackInviteCommand(channelDisplayName, fallbackName) {
   return `/invite @${createSlackBotDisplayName(
     channelDisplayName,
@@ -379116,12 +379955,13 @@ function createSlackManifestInstallUrl(manifest) {
   url4.searchParams.set("manifest_yaml", manifest);
   return url4.toString();
 }
-var SLACK_EVENTS_INGRESS_PATH, SLACK_INTERACTIVITY_INGRESS_PATH, DEFAULT_SLACK_IDENTITY, RESERVED_SLACK_IDENTITIES, REQUIRED_SLACK_BOT_SCOPES, REQUIRED_SLACK_BOT_SCOPE_COUNT, SLACK_PREINSTALL_GRANTED_SCOPES, SLACK_PREINSTALL_SCOPE_COUNT;
+var SLACK_EVENTS_INGRESS_PATH, SLACK_INTERACTIVITY_INGRESS_PATH, SLACK_APP_NAME_MAX_LENGTH, DEFAULT_SLACK_IDENTITY, RESERVED_SLACK_IDENTITIES, DEFAULT_SLACK_APP_NAME, REQUIRED_SLACK_BOT_SCOPES, REQUIRED_SLACK_BOT_SCOPE_COUNT, SLACK_PREINSTALL_GRANTED_SCOPES, SLACK_PREINSTALL_SCOPE_COUNT;
 var init_slack = __esm({
   "libs/channels-setup/src/slack.ts"() {
     "use strict";
     SLACK_EVENTS_INGRESS_PATH = "/api/channels/adapters/slack/events";
     SLACK_INTERACTIVITY_INGRESS_PATH = "/api/channels/adapters/slack/interactivity";
+    SLACK_APP_NAME_MAX_LENGTH = 35;
     DEFAULT_SLACK_IDENTITY = "intelligence-agent";
     RESERVED_SLACK_IDENTITIES = /* @__PURE__ */ new Set([
       "channel",
@@ -379129,6 +379969,7 @@ var init_slack = __esm({
       "here",
       "slackbot"
     ]);
+    DEFAULT_SLACK_APP_NAME = "Intelligence Agent";
     REQUIRED_SLACK_BOT_SCOPES = Object.freeze([
       "app_mentions:read",
       "assistant:write",
@@ -380649,7 +381490,7 @@ var init_teams_setup_gates = __esm({
 });
 
 // libs/channels-setup/src/index.ts
-var init_src11 = __esm({
+var init_src12 = __esm({
   "libs/channels-setup/src/index.ts"() {
     "use strict";
     init_channels_config();
@@ -380829,7 +381670,7 @@ var SOURCE_EXTENSIONS, SKIPPED_DIRECTORIES2, MAX_FILES, MAX_FILE_BYTES, RUNTIME_
 var init_channel_code_half = __esm({
   "apps/cli/src/services/channel-code-half.ts"() {
     "use strict";
-    init_src11();
+    init_src12();
     SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
       ".cjs",
       ".cts",
@@ -380897,9 +381738,26 @@ function delay2(ms) {
     setTimeout(resolve9, ms);
   });
 }
-function runInstallOnce(cwd2, command2) {
+function formatTimeoutTail(command2, timeoutMs) {
+  return `\`${command2}\` stopped responding after ${timeoutMs} ms and was stopped. Check the network and the npm registry configuration, then run it by hand.`;
+}
+function runInstallOnce(cwd2, command2, timeoutMs) {
   return new Promise((resolve9) => {
-    const child = spawn4(command2, { cwd: cwd2, shell: true, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn4(command2, {
+      cwd: cwd2,
+      shell: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      ...OWN_PROCESS_GROUP
+    });
+    let timedOut = false;
+    const timeout = armChildTimeout(
+      child,
+      timeoutMs,
+      () => {
+        timedOut = true;
+      },
+      { ownsProcessGroup: true }
+    );
     const stdoutDecoder = new StringDecoder("utf8");
     const stderrDecoder = new StringDecoder("utf8");
     let stdout = "";
@@ -380917,22 +381775,26 @@ function runInstallOnce(cwd2, command2) {
       }
     });
     child.once("error", (error98) => {
+      timeout.cancel();
       resolve9({
         ok: false,
         code: null,
         stdoutTail: "",
         stderrTail: "",
-        spawnError: error98.message
+        spawnError: error98.message,
+        timedOut
       });
     });
     child.once("close", (code) => {
+      timeout.cancel();
       stdout += stdoutDecoder.end();
       stderr += stderrDecoder.end();
       resolve9({
         ok: code === 0,
         code,
         stdoutTail: stdout.slice(-STDOUT_TAIL_LIMIT).trim(),
-        stderrTail: stderr.slice(-STDERR_TAIL_LIMIT).trim()
+        stderrTail: stderr.slice(-STDERR_TAIL_LIMIT).trim(),
+        timedOut
       });
     });
   });
@@ -380941,14 +381803,15 @@ async function installDependencies({
   cwd: cwd2,
   command: command2,
   log,
-  retryDelayMs = DEFAULT_RETRY_DELAY_MS
+  retryDelayMs = DEFAULT_RETRY_DELAY_MS,
+  timeoutMs = DEFAULT_INSTALL_TIMEOUT_MS
 }) {
   let lastAttempt;
   for (let attempt = 1; attempt <= INSTALL_MAX_ATTEMPTS; attempt += 1) {
     if (attempt > 1 && retryDelayMs > 0) {
       await delay2(retryDelayMs);
     }
-    lastAttempt = await runInstallOnce(cwd2, command2);
+    lastAttempt = await runInstallOnce(cwd2, command2, timeoutMs);
     if (lastAttempt.ok) {
       if (attempt > 1) {
         log?.("info", {
@@ -380960,6 +381823,18 @@ async function installDependencies({
       }
       return { ok: true };
     }
+    if (lastAttempt.timedOut) {
+      log?.("error", {
+        event: "install_timed_out",
+        command: command2,
+        cwd: cwd2,
+        attempt,
+        timeoutMs,
+        stdoutTail: lastAttempt.stdoutTail,
+        stderrTail: lastAttempt.stderrTail
+      });
+      return { ok: false, stderrTail: formatTimeoutTail(command2, timeoutMs) };
+    }
     log?.("error", {
       event: "install_failed",
       command: command2,
@@ -380977,14 +381852,16 @@ async function installDependencies({
     stderrTail: lastAttempt?.spawnError ?? lastAttempt?.stderrTail ?? "install failed"
   };
 }
-var STDERR_TAIL_LIMIT, STDOUT_TAIL_LIMIT, INSTALL_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS;
+var STDERR_TAIL_LIMIT, STDOUT_TAIL_LIMIT, INSTALL_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_INSTALL_TIMEOUT_MS;
 var init_install_dependencies = __esm({
   "apps/cli/src/services/install-dependencies.ts"() {
     "use strict";
+    init_child_timeout();
     STDERR_TAIL_LIMIT = 2e3;
     STDOUT_TAIL_LIMIT = 4e3;
     INSTALL_MAX_ATTEMPTS = 2;
     DEFAULT_RETRY_DELAY_MS = 1e3;
+    DEFAULT_INSTALL_TIMEOUT_MS = 10 * 6e4;
   }
 });
 
@@ -382102,7 +382979,7 @@ function writeChannelsConfigFile(dir, config3) {
 var init_channels_config_file = __esm({
   "apps/cli/src/services/channels-config-file.ts"() {
     "use strict";
-    init_src11();
+    init_src12();
     init_fs_env_util();
   }
 });
@@ -382182,7 +383059,35 @@ var init_channels_state = __esm({
 });
 
 // apps/cli/src/services/channels-flow.ts
+function slackDisplayNameRefusal(adapter2, channelName, displayName) {
+  if (adapter2 !== "slack") {
+    return void 0;
+  }
+  const validated = validateSlackDisplayName({
+    channelDisplayName: displayName,
+    channelName
+  });
+  if (validated.status === "ok") {
+    return void 0;
+  }
+  return {
+    code: CHANNELS_FLOW_CODES.slackDisplayNameInvalid,
+    message: validated.message,
+    status: "failed"
+  };
+}
 function resolveIdentity(input) {
+  const resolved = resolveChannelIdentity(input);
+  if (resolved.status === "failed") {
+    return resolved;
+  }
+  return slackDisplayNameRefusal(
+    input.adapter,
+    resolved.name,
+    resolved.displayName
+  ) ?? resolved;
+}
+function resolveChannelIdentity(input) {
   if (input.channelName !== void 0) {
     const validated = validateChannelName(input.channelName);
     if (validated.status === "invalid") {
@@ -382263,6 +383168,22 @@ async function runChannelsAdd(input, deps) {
     );
     const wasDeclared = alreadyDeclared?.providers[adapter2] !== void 0;
     const effectiveDisplayName = input.displayName ?? alreadyDeclared?.displayName ?? displayName;
+    const declaredRefusal = slackDisplayNameRefusal(
+      adapter2,
+      name,
+      effectiveDisplayName
+    );
+    if (declaredRefusal !== void 0) {
+      return failedEnvelope({
+        channels: [],
+        command: command2,
+        diagnostics,
+        error: {
+          code: declaredRefusal.code,
+          message: declaredRefusal.message
+        }
+      });
+    }
     let config3 = configRead.config;
     if (!wasDeclared) {
       config3 = declareChannel(config3, {
@@ -382272,6 +383193,13 @@ async function runChannelsAdd(input, deps) {
       });
       deps.writeConfig(config3);
     }
+    if (input.displayName !== void 0 && alreadyDeclared !== void 0 && alreadyDeclared.displayName !== input.displayName) {
+      config3 = renameChannelDisplayName(config3, {
+        displayName: input.displayName,
+        name
+      });
+      deps.writeConfig(config3);
+    }
     const declaredEnv = adapter2 === "slack" ? defaultCredentialEnvNames(name, "slack") : defaultCredentialEnvNames(name, "teams");
     const declared = config3.channels.find((channel2) => channel2.name === name);
     const providerEnv = declared?.providers[adapter2]?.env ?? declaredEnv;
@@ -382540,7 +383468,7 @@ var CHANNELS_FLOW_CODES, MAX_RECONCILE_STEPS;
 var init_channels_flow = __esm({
   "apps/cli/src/services/channels-flow.ts"() {
     "use strict";
-    init_src11();
+    init_src12();
     init_api_client();
     init_channel_credentials();
     init_channels_state();
@@ -382549,6 +383477,7 @@ var init_channels_flow = __esm({
       nameMissing: "CLI_CHANNELS_NAME_MISSING",
       nameUndecidable: "CLI_CHANNELS_NAME_UNDECIDABLE",
       notDeclared: "CLI_CHANNELS_NOT_DECLARED",
+      slackDisplayNameInvalid: "CLI_CHANNELS_SLACK_DISPLAY_NAME_INVALID",
       stalled: "CLI_CHANNELS_RECONCILE_STALLED"
     });
     MAX_RECONCILE_STEPS = 8;
@@ -382740,7 +383669,7 @@ function removeEmptyPlaceholders(input) {
 var init_init_channel_setup = __esm({
   "apps/cli/src/services/init-channel-setup.ts"() {
     "use strict";
-    init_src11();
+    init_src12();
     init_config();
     init_api_client();
     init_channel_artifacts();
@@ -384468,7 +385397,7 @@ var init_init = __esm({
     await init_channel_offer();
     await init_hosted_project_select();
     init_project_config();
-    init_src11();
+    init_src12();
     init_intelligence_readme();
     import_jsx_runtime23 = __toESM(require_jsx_runtime(), 1);
     PROJECT_CREATION_AUTH_HANDOFF = {
@@ -385081,6 +386010,8 @@ var init_onboarding_checkpoint = __esm({
   "apps/cli/src/services/onboarding-checkpoint.ts"() {
     "use strict";
     CHECKPOINT_PHASES = [
+      "research-dispatched",
+      "surface-probed",
       "research-returned",
       "starter-cloned",
       "plan-written",
@@ -385104,6 +386035,17 @@ function resolveAgentFrameworkAlias(value) {
     return void 0;
   return ONBOARDING_AGENT_FRAMEWORK_ALIASES[value] ?? value;
 }
+function terminalReasonForRoute(route) {
+  for (let index2 = route.length - 1; index2 >= 0; index2 -= 1) {
+    const node = route[index2];
+    if (node === void 0)
+      continue;
+    if (Object.prototype.hasOwnProperty.call(TERMINAL_NODES, node))
+      continue;
+    return STAGE_BY_NODE[node] ?? STAGE_BY_DIRECTORY[node.split("/")[0] ?? ""] ?? "other";
+  }
+  return void 0;
+}
 function unprovenBaselineRefusal(startingState, route, proof) {
   if (startingState !== "both-oss" && startingState !== "both-copilotkit-unproved") {
     return void 0;
@@ -385150,7 +386092,7 @@ function requireOnboardingChoice(flag, value, choices) {
   }
   return selected;
 }
-var ONBOARDING_STARTING_STATES, ONBOARDING_AGENT_FRAMEWORKS, ONBOARDING_AGENT_FRAMEWORK_ALIASES, ONBOARDING_FRONTENDS, ONBOARDING_PROOF_STEPS, ONBOARDING_PROOF_OUTCOMES, ABSENCE_STATES, OSS_BASELINE_NODE, TERMINAL_NODES, REPOSITORY_RESEARCH_NODE;
+var ONBOARDING_STARTING_STATES, ONBOARDING_AGENT_FRAMEWORKS, ONBOARDING_AGENT_FRAMEWORK_ALIASES, ONBOARDING_FRONTENDS, ONBOARDING_PROOF_STEPS, ONBOARDING_PROOF_OUTCOMES, ABSENCE_STATES, OSS_BASELINE_NODE, TERMINAL_NODES, STAGE_BY_DIRECTORY, STAGE_BY_NODE, REPOSITORY_RESEARCH_NODE;
 var init_onboarding_classification = __esm({
   "apps/cli/src/services/onboarding-classification.ts"() {
     "use strict";
@@ -385227,6 +386169,25 @@ var init_onboarding_classification = __esm({
       "stopped/run-failed": "run-failed",
       "unsupported/no-validated-path": "unsupported"
     };
+    STAGE_BY_DIRECTORY = {
+      authenticate: "authentication",
+      conversion: "plan",
+      credentials: "credentials",
+      feature: "feature",
+      framework: "journey",
+      frontend: "journey",
+      implementation: "implementation",
+      proof: "validation",
+      research: "research",
+      starter: "journey"
+    };
+    STAGE_BY_NODE = {
+      "subagent/create-plan": "plan",
+      "subagent/implement-and-validate": "implementation",
+      "subagent/inspect-repository": "research",
+      "subagent/prove-oss-baseline": "validation",
+      "subagent/prove-round-trip": "validation"
+    };
     REPOSITORY_RESEARCH_NODE = "subagent/inspect-repository";
   }
 });
@@ -385334,9 +386295,17 @@ var init_onboarding_resume = __esm({
 
 // apps/cli/src/services/onboarding-protected-paths.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { existsSync as existsSync21, readFileSync as readFileSync22, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
-import { isAbsolute, join as join28, relative as relative3, resolve as resolve7, sep as sep3 } from "node:path";
+import {
+  dirname as dirname13,
+  isAbsolute,
+  join as join28,
+  parse as parse13,
+  relative as relative3,
+  resolve as resolve7,
+  sep as sep3
+} from "node:path";
 function deriveProjectFiles(root2) {
   const found = [];
   const pending = [root2];
@@ -385446,6 +386415,9 @@ function readManifest(dependencies) {
     return "malformed";
   if (typeof stored.capturedAt !== "string")
     return "malformed";
+  if (stored.capturedTree !== void 0 && typeof stored.capturedTree !== "string") {
+    return "malformed";
+  }
   if (stored.implementationStartedAt !== void 0 && typeof stored.implementationStartedAt !== "string") {
     return "malformed";
   }
@@ -385456,6 +386428,9 @@ function readManifest(dependencies) {
   );
   return wellFormed ? stored : "malformed";
 }
+function capturedTreeMark(stored) {
+  return stored?.capturedTree === void 0 ? {} : { capturedTree: stored.capturedTree };
+}
 function startedMark(stored) {
   return stored?.implementationStartedAt === void 0 ? {} : { implementationStartedAt: stored.implementationStartedAt };
 }
@@ -385465,7 +386440,7 @@ function digestOf(root2, relativePath) {
     if (!existsSync21(absolute))
       return {};
     return {
-      digest: createHash7("sha256").update(readFileSync22(absolute)).digest("hex")
+      digest: createHash8("sha256").update(readFileSync22(absolute)).digest("hex")
     };
   } catch {
     return "unreadable";
@@ -385546,8 +386521,34 @@ function captureEntry(root2, relativePath, derived) {
     ...envKeys === void 0 ? {} : { envKeys }
   };
 }
+function isProjectBoundary(directory) {
+  return PROJECT_BOUNDARY_MARKERS.some(
+    (marker) => existsSync21(join28(directory, marker))
+  );
+}
+function crossesProjectBoundary(start, root2) {
+  let candidate = start;
+  const filesystemRoot = parse13(candidate).root;
+  while (candidate !== root2) {
+    if (isProjectBoundary(candidate))
+      return true;
+    if (candidate === filesystemRoot)
+      break;
+    const parent = dirname13(candidate);
+    if (parent === candidate)
+      break;
+    candidate = parent;
+  }
+  return false;
+}
 function captureProtectedPaths(dependencies, input) {
   const root2 = resolveAnchoredRoot(dependencies);
+  if (crossesProjectBoundary(
+    resolveOnboardingRepositoryRoot(dependencies.cwd),
+    root2
+  )) {
+    return { status: "blocked", reason: "root-outside-project", detail: root2 };
+  }
   const stored = readManifest(dependencies);
   const ownBaseline = stored !== void 0 && stored !== "malformed" && stored.runId === input.runId ? stored : void 0;
   const derive = ownBaseline === void 0;
@@ -385605,6 +386606,10 @@ function captureProtectedPaths(dependencies, input) {
   dependencies.store.set(protectedBaselineKey(dependencies), {
     runId: input.runId,
     capturedAt: ownBaseline?.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    // Read once, with the timestamp, and kept for the life of the baseline: a
+    // capture that extends its own baseline must keep describing the tree the
+    // run started from, not the one it has since built.
+    ...ownBaseline === void 0 ? treeMarkOf(root2) : capturedTreeMark(ownBaseline),
     ...startedMark(ownBaseline),
     entries
   });
@@ -385740,6 +386745,7 @@ function rebaselineProtectedPaths(dependencies, input) {
   dependencies.store.set(protectedBaselineKey(dependencies), {
     runId: stored.runId,
     capturedAt: stored.capturedAt,
+    ...capturedTreeMark(stored),
     ...startedMark(stored),
     entries: byPath(entries)
   });
@@ -385861,6 +386867,7 @@ function acceptProtectedPathDrift(dependencies, input) {
   dependencies.store.set(protectedBaselineKey(dependencies), {
     runId: stored.runId,
     capturedAt: stored.capturedAt,
+    ...capturedTreeMark(stored),
     ...startedMark(stored),
     entries: byPath(entries)
   });
@@ -385974,6 +386981,7 @@ function acceptCredentialPlacement(dependencies, input) {
   dependencies.store.set(protectedBaselineKey(dependencies), {
     runId: stored.runId,
     capturedAt: stored.capturedAt,
+    ...capturedTreeMark(stored),
     ...startedMark(stored),
     entries: byPath(entries)
   });
@@ -386005,6 +387013,7 @@ function markImplementationStarted(dependencies, input) {
   dependencies.store.set(protectedBaselineKey(dependencies), {
     runId: stored.runId,
     capturedAt: stored.capturedAt,
+    ...capturedTreeMark(stored),
     implementationStartedAt: startedAt,
     entries: stored.entries
   });
@@ -386125,6 +387134,7 @@ function authorizeProtectedPathChange(dependencies, input) {
   dependencies.store.set(protectedBaselineKey(dependencies), {
     runId: stored.runId,
     capturedAt: stored.capturedAt,
+    ...capturedTreeMark(stored),
     ...startedMark(stored),
     entries: byPath(entries)
   });
@@ -386134,7 +387144,105 @@ function authorizeProtectedPathChange(dependencies, input) {
     authorized: byPath(authorized)
   };
 }
-var SKIPPED_DIRECTORIES3, GRAPH_OWNED_SUFFIXES;
+function currentRepositoryTree(root2) {
+  try {
+    return execFileSync5("git", ["rev-parse", "HEAD^{tree}"], {
+      cwd: root2,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return void 0;
+  }
+}
+function treeMarkOf(root2) {
+  const tree = currentRepositoryTree(root2);
+  return tree === void 0 ? {} : { capturedTree: tree };
+}
+function commitsAfterCapture(root2, capturedAt, capturedTree) {
+  if (capturedTree !== void 0) {
+    const now = currentRepositoryTree(root2);
+    if (now !== void 0 && now === capturedTree)
+      return "none";
+  }
+  const since = capturedAt.replace(/\.\d+Z$/, "Z");
+  let output;
+  try {
+    output = execFileSync5(
+      "git",
+      ["log", `--since=${since}`, "--name-only", "--format=%H"],
+      { cwd: root2, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
+    );
+  } catch {
+    return "failed";
+  }
+  const lines = output.split("\n").filter((line) => line.length > 0);
+  if (lines.length === 0)
+    return "none";
+  return lines.filter((line) => !/^[0-9a-f]{40}$/.test(line));
+}
+function readProjectChanges(dependencies, input) {
+  const root2 = resolveAnchoredRoot(dependencies);
+  const stored = readManifest(dependencies);
+  if (stored === void 0) {
+    return { status: "blocked", reason: "no-baseline", detail: input.runId };
+  }
+  if (stored === "malformed") {
+    return {
+      status: "blocked",
+      reason: "unreadable-baseline",
+      detail: input.runId
+    };
+  }
+  if (stored.runId !== input.runId) {
+    return { status: "blocked", reason: "run-mismatch", detail: stored.runId };
+  }
+  const derived = deriveChangedPaths(root2);
+  if (derived === "failed") {
+    return { status: "blocked", reason: "git-failed", detail: root2 };
+  }
+  const current = derived === "no-repository" ? deriveProjectFiles(root2) : derived;
+  const baseline = new Map(
+    stored.entries.map((entry) => [entry.path, entry.digest])
+  );
+  const changed = [];
+  for (const relativePath of new Set(current)) {
+    if (isGraphOwned(relativePath))
+      continue;
+    const read = digestOf(root2, relativePath);
+    if (read === "unreadable") {
+      changed.push(relativePath);
+      continue;
+    }
+    const held = baseline.has(relativePath);
+    if (!held || baseline.get(relativePath) !== read.digest) {
+      changed.push(relativePath);
+    }
+  }
+  const ordered = [...changed].sort(
+    (left, right) => left < right ? -1 : left > right ? 1 : 0
+  );
+  if (ordered.length > 0 || derived === "no-repository") {
+    return { status: "passed", runId: input.runId, changed: ordered };
+  }
+  const committed = commitsAfterCapture(
+    root2,
+    stored.capturedAt,
+    stored.capturedTree
+  );
+  if (committed === "failed" || committed === "none") {
+    return { status: "passed", runId: input.runId, changed: ordered };
+  }
+  return {
+    status: "passed",
+    runId: input.runId,
+    changed: [...new Set(committed)].sort(
+      (left, right) => left < right ? -1 : left > right ? 1 : 0
+    ),
+    committedAfterCapture: true
+  };
+}
+var SKIPPED_DIRECTORIES3, GRAPH_OWNED_SUFFIXES, PROJECT_BOUNDARY_MARKERS;
 var init_onboarding_protected_paths = __esm({
   "apps/cli/src/services/onboarding-protected-paths.ts"() {
     "use strict";
@@ -386152,6 +387260,12 @@ var init_onboarding_protected_paths = __esm({
       "__pycache__"
     ]);
     GRAPH_OWNED_SUFFIXES = [".env", ".copilotkit/project.json"];
+    PROJECT_BOUNDARY_MARKERS = [
+      ".git",
+      "package.json",
+      "pyproject.toml",
+      ".copilotkit"
+    ];
   }
 });
 
@@ -386583,6 +387697,9 @@ var init_resolved_dependencies = __esm({
 
 // apps/cli/src/services/onboarding-inspection.ts
 import * as path39 from "node:path";
+function requiredProjectFields(deployment) {
+  return deployment === "managed" ? ["projectId", "projectSlug", "clerkOrgId"] : ["projectId", "projectSlug"];
+}
 function relativize(root2, target) {
   const relative7 = path39.relative(root2, target);
   return relative7 === "" ? "." : relative7;
@@ -386608,12 +387725,13 @@ function packageManagerFor(appDir, root2) {
     candidate = parent;
   }
 }
-function inspectProject(cwd2, root2) {
+function inspectProject(cwd2, root2, deployment) {
+  const required3 = requiredProjectFields(deployment);
   const resolution = resolveProjectConfig(cwd2);
   if (resolution.kind === "absent") {
     return {
       configPath: null,
-      missingFields: [...REQUIRED_PROJECT_FIELDS],
+      missingFields: [...required3],
       presentFields: [],
       status: "absent"
     };
@@ -386625,18 +387743,18 @@ function inspectProject(cwd2, root2) {
   if (resolution.kind === "unreadable") {
     return {
       configPath,
-      missingFields: [...REQUIRED_PROJECT_FIELDS],
+      missingFields: [...required3],
       presentFields: [],
       status: "unreadable"
     };
   }
   const held = resolution.config;
-  const present2 = REQUIRED_PROJECT_FIELDS.filter(
+  const present2 = required3.filter(
     (field) => typeof held[field] === "string" && held[field] !== ""
   );
   return {
     configPath,
-    missingFields: REQUIRED_PROJECT_FIELDS.filter(
+    missingFields: required3.filter(
       (field) => !present2.includes(field)
     ),
     presentFields: present2,
@@ -386698,12 +387816,11 @@ function buildInspectionPacket(inputs) {
     command: "onboard inspect",
     dependencies: readResolvedDependencies(apps2),
     detection: detectStack(root2),
-    project: inspectProject(cwd2, root2),
+    project: inspectProject(cwd2, root2, inputs.deployment),
     projectRoot: root2,
     schemaVersion: 1
   };
 }
-var REQUIRED_PROJECT_FIELDS;
 var init_onboarding_inspection = __esm({
   "apps/cli/src/services/onboarding-inspection.ts"() {
     "use strict";
@@ -386717,11 +387834,6 @@ var init_onboarding_inspection = __esm({
     init_resolved_dependencies();
     init_runtime_url();
     init_verify_probes();
-    REQUIRED_PROJECT_FIELDS = [
-      "projectId",
-      "projectSlug",
-      "clerkOrgId"
-    ];
   }
 });
 
@@ -387001,7 +388113,11 @@ async function runOnboard(argv, dependencies) {
         resolveAppDirectories(cwd2, findRepositoryRoot(cwd2) ?? cwd2).apps
       );
     },
-    readInspection: () => buildInspectionPacket({ cwd: process.cwd(), env: process.env }),
+    readInspection: () => buildInspectionPacket({
+      cwd: process.cwd(),
+      deployment: getDeploymentTarget().name,
+      env: process.env
+    }),
     readEnvStaleness: () => buildEnvStalenessPacket({
       cwd: process.cwd(),
       now: Date.now(),
@@ -387068,7 +388184,7 @@ async function runOnboard(argv, dependencies) {
         ...onboardingIntentProperties(deps),
         onboarding_run_id: runId2,
         cli_version: deps.cliVersion,
-        coding_agent: normalizeCodingAgent(parsed.codingAgent)
+        ...codingAgentProperty(parsed.codingAgent)
       }
     });
     deps.stdout.write(`Coding agent recorded for run ${runId2}.
@@ -387143,6 +388259,21 @@ async function runOnboard(argv, dependencies) {
     const check4 = parseSurfaceCheck(blocked2.rest);
     if (check4 === void 0)
       throw new Error(SURFACE_CHECK_USAGE);
+    const unchanged = unchangedProjectRefusal(deps, runId);
+    if (unchanged !== void 0) {
+      recordBestEffort(deps, {
+        event: "cli.onboarding.complete_refused",
+        properties: {
+          command: "onboard",
+          ...onboardingIntentProperties(deps),
+          onboarding_run_id: runId,
+          cli_version: deps.cliVersion,
+          refusal_code: "no-changes-in-project"
+        }
+      });
+      deps.stdout.write(unchanged);
+      return;
+    }
     const accepted = readAcceptedDriftBestEffort(deps, runId);
     const authorized = readAuthorizationsBestEffort(deps, runId);
     const removed = readRemovedPathsBestEffort(deps, runId);
@@ -387476,6 +388607,12 @@ Onboarding protects the developer\u2019s own tree and captures nothing beyond it
       "git-failed": `\`git status\` failed in ${result.detail}, so the protected set could not be
 derived. Nothing was captured: an empty baseline would read as "nothing here
 needs protecting", which is the opposite of what just happened.
+`,
+      "root-outside-project": `This run is anchored at ${result.detail}, above the project this command
+ran in. Nothing was captured: a baseline derived up there reads every file
+below it, including projects this run has no business in.
+Run \`copilotkit onboard start --run <id>\` here to give this project a run of
+its own, or run this step from the directory the run started in.
 `
     }[result.reason];
     return `Status: blocked
@@ -388075,10 +389212,11 @@ function reportingRefusal(dependencies, runId, code, extra, read) {
     throw error98;
   }
 }
-function recordTerminalWhenReached(dependencies, runId, promptName) {
+function recordTerminalWhenReached(dependencies, runId, promptName, routeBefore) {
   const terminal = TERMINAL_NODES[promptName];
   if (terminal === void 0)
     return;
+  const reason = terminalReasonForRoute(routeBefore);
   markRunEndedBestEffort(dependencies, runId);
   recordBestEffort(dependencies, {
     event: "cli.onboarding.terminal_reached",
@@ -388088,6 +389226,10 @@ function recordTerminalWhenReached(dependencies, runId, promptName) {
       onboarding_run_id: runId,
       cli_version: dependencies.cliVersion,
       terminal,
+      // Omitted rather than sent as `other` when the route names no earlier
+      // step: a route that could not be read has not said the reason is
+      // unknown, it has said nothing at all.
+      ...reason === void 0 ? {} : { terminal_reason: reason },
       ...detectionProperties(dependencies)
     }
   });
@@ -388506,6 +389648,42 @@ function readAuthorizationsBestEffort(dependencies, runId) {
     return [];
   }
 }
+function unchangedProjectRefusal(dependencies, runId) {
+  let changes;
+  try {
+    changes = readProjectChanges(
+      { cwd: dependencies.cwd, store: dependencies.store },
+      { runId }
+    );
+  } catch {
+    return void 0;
+  }
+  if (changes.status === "blocked")
+    return void 0;
+  if (changes.committedAfterCapture === true)
+    return void 0;
+  if (changes.changed.length > 0)
+    return void 0;
+  return [
+    "Status: blocked",
+    "no-changes-in-project",
+    "This project holds no change since its protected baseline was captured: no",
+    "tracked file was modified, and nothing new was added beyond the files this",
+    "graph writes itself, `.env` and `.copilotkit/project.json`. Ignored files do",
+    "not count as work.",
+    "",
+    "A run that built something and left this tree untouched built it somewhere",
+    "else. The usual cause is an implementation subagent that worked in its own",
+    "git worktree, a branch checkout, or a copy of the project, and reported back",
+    "without bringing the changes here. This is not a preservation failure: no",
+    "protected path was changed, and none had to be.",
+    "",
+    "Bring those changes into this project, then run `onboard audit` and this",
+    "command again. Onboarding is not complete until they are here: the developer",
+    "is left with the project in front of them, not the one the work was done in.",
+    ""
+  ].join("\n");
+}
 function readAcceptedDriftBestEffort(dependencies, runId) {
   try {
     return readAcceptedDrift(
@@ -388528,7 +389706,7 @@ function recordStarted(dependencies, runId, origin, idOrigin, codingAgent) {
       ...onboardingIntentProperties(dependencies),
       onboarding_run_id: runId,
       cli_version: dependencies.cliVersion,
-      coding_agent: normalizeCodingAgent(codingAgent),
+      ...codingAgentProperty(codingAgent),
       started_by: origin,
       run_id_origin: idOrigin
     }
@@ -388568,7 +389746,7 @@ function writePrompt(dependencies, runId, prompt) {
 `);
   }
   recordRouteBestEffort(dependencies, runId, prompt.name);
-  recordTerminalWhenReached(dependencies, runId, prompt.name);
+  recordTerminalWhenReached(dependencies, runId, prompt.name, routeBefore);
   const routeAfter = readRouteBestEffort(dependencies);
   recordBestEffort(dependencies, {
     event: "cli.onboarding.prompt_served",
@@ -389131,7 +390309,7 @@ var init_channels_report = __esm({
   "apps/cli/src/services/channels-report.ts"() {
     "use strict";
     init_channels();
-    init_src11();
+    init_src12();
     init_api_client();
     init_channel_credentials();
     init_channels_state();
@@ -389799,7 +390977,7 @@ var MAX_CAPTURED_OUTPUT_BYTES, MicrosoftTeamsCliError, statusSchema, createdAppS
 var init_microsoft_teams_cli = __esm({
   "apps/cli/src/services/microsoft-teams-cli.ts"() {
     "use strict";
-    init_src11();
+    init_src12();
     init_zod();
     init_channel_credentials();
     MAX_CAPTURED_OUTPUT_BYTES = 1024 * 1024;
@@ -390424,7 +391602,7 @@ var command, microsoftMutationWarning, INGRESS_PROBE_TIMEOUT_MS, CONSENT_PROPAGA
 var init_teams_provision = __esm({
   "apps/cli/src/services/teams-provision.ts"() {
     "use strict";
-    init_src11();
+    init_src12();
     init_api_client();
     init_channel_credentials();
     init_microsoft_teams_cli();
@@ -390519,7 +391697,7 @@ async function runChannelProviders(options) {
 var init_channel_providers = __esm({
   "apps/cli/src/commands/channel-providers.ts"() {
     "use strict";
-    init_src11();
+    init_src12();
     init_channel_provider_catalog();
   }
 });
@@ -391366,7 +392544,7 @@ var init_channels2 = __esm({
   async "apps/cli/src/commands/channels.ts"() {
     "use strict";
     init_channels();
-    init_src11();
+    init_src12();
     init_config();
     init_unknown_input();
     init_agent_prompt();
@@ -391737,6 +392915,42 @@ var init_kite = __esm({
   }
 });
 
+// apps/cli/src/node-version.ts
+var MINIMUM_NODE_VERSION = "20.9.0";
+function readVersionParts(version6) {
+  const match2 = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version6.trim());
+  if (match2 === null)
+    return void 0;
+  return [Number(match2[1]), Number(match2[2]), Number(match2[3])];
+}
+function meetsMinimumNodeVersion(running, minimum = MINIMUM_NODE_VERSION) {
+  const current = readVersionParts(running);
+  const floor = readVersionParts(minimum);
+  if (current === void 0 || floor === void 0)
+    return true;
+  for (let index2 = 0; index2 < current.length; index2 += 1) {
+    if (current[index2] !== floor[index2])
+      return current[index2] > floor[index2];
+  }
+  return true;
+}
+function formatUnsupportedNodeMessage(running, minimum = MINIMUM_NODE_VERSION) {
+  return `copilotkit needs Node.js ${minimum} or later.
+This machine is running Node.js ${running}.
+
+Upgrade Node.js, then run the command again. A version manager installs a
+newer one beside the current one:
+
+  nvm install 22
+`;
+}
+
+// apps/cli/src/node-version-gate.ts
+if (!meetsMinimumNodeVersion(process.versions.node)) {
+  process.stderr.write(formatUnsupportedNodeMessage(process.versions.node));
+  process.exit(1);
+}
+
 // apps/cli/src/index.ts
 init_event_properties();
 init_types();
@@ -392098,11 +393312,18 @@ records their answer with --unplanned, which marks the consent as taken outside
 the plan wherever it is printed. The flag is refused before the plan is
 reported, so it can never stand in for the plan's own approval.
 
+Complete refuses a run whose project holds no change since that baseline was
+captured, and prints Status: blocked with no-changes-in-project. The files
+onboarding writes itself do not count, and neither do ignored files. Work done
+in another worktree, a branch checkout, or a copy of the project leaves the
+developer nothing, so bring the changes into this project, then run audit and
+complete again.
+
 Checkpoint reports progress from inside a step, where the graph would
 otherwise say nothing between one prompt and the next. --phase takes one of:
-research-returned, starter-cloned, plan-written, container-surveyed,
-container-settled, build-validated, journey-attempted, repair-attempted,
-delegation-unavailable. Pass --attempt <1-9>
+research-dispatched, surface-probed, research-returned, starter-cloned,
+plan-written, container-surveyed, container-settled, build-validated,
+journey-attempted, repair-attempted, delegation-unavailable. Pass --attempt <1-9>
 where the step loops, so a repair cycle can be counted.
 A refused checkpoint exits zero and prints the closed set. It is called from
 the middle of the longest step of a run, and a non-zero exit there reads as a
@@ -393041,18 +394262,19 @@ function parseGlobalArgs(argv) {
   const parsed = {
     verbose: false
   };
-  for (const [flag, key] of [
-    ["--app-api-url", "appApiUrl"],
-    ["--ops-api-url", "opsApiUrl"],
-    ["--ops-frontend-url", "opsFrontendUrl"],
-    ["--teams-ingress-url", "teamsIngressUrl"],
-    ["--slack-ingress-url", "slackIngressUrl"]
+  for (const [flag, key, expects] of [
+    ["--app-api-url", "appApiUrl", "a URL argument"],
+    ["--ops-api-url", "opsApiUrl", "a URL argument"],
+    ["--ops-frontend-url", "opsFrontendUrl", "a URL argument"],
+    ["--teams-ingress-url", "teamsIngressUrl", "a URL argument"],
+    ["--slack-ingress-url", "slackIngressUrl", "a URL argument"],
+    ["--deployment", "deployment", '"managed" or "self-hosted"']
   ]) {
     const idx = remaining.indexOf(flag);
     if (idx !== -1) {
       const url4 = remaining[idx + 1];
       if (!url4 || url4.startsWith("-")) {
-        process.stderr.write(`Error: ${flag} requires a URL argument.
+        process.stderr.write(`Error: ${flag} requires ${expects}.
 `);
         process.exit(1);
       }
@@ -393072,10 +394294,26 @@ function parseGlobalArgs(argv) {
     ...parsed.opsApiUrl ? { opsApiUrl: parsed.opsApiUrl } : {},
     ...parsed.opsFrontendUrl ? { opsFrontendUrl: parsed.opsFrontendUrl } : {},
     ...parsed.teamsIngressUrl ? { teamsIngressUrl: parsed.teamsIngressUrl } : {},
-    ...parsed.slackIngressUrl ? { slackIngressUrl: parsed.slackIngressUrl } : {}
+    ...parsed.slackIngressUrl ? { slackIngressUrl: parsed.slackIngressUrl } : {},
+    ...parsed.deployment ? { deployment: parsed.deployment } : {}
   };
 }
 async function applyGlobalArgs(parsed) {
+  if (parsed.deployment) {
+    const { setDeploymentTarget: setDeploymentTarget2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    if (parsed.deployment !== "managed" && parsed.deployment !== "self-hosted") {
+      process.stderr.write(
+        `Error: unknown deployment "${parsed.deployment}". Use "managed" or "self-hosted".
+`
+      );
+      process.exit(1);
+    }
+    const appApiUrl = parsed.appApiUrl ?? process.env["COPILOTKIT_APP_API_URL"]?.trim();
+    setDeploymentTarget2({
+      name: parsed.deployment,
+      ...appApiUrl ? { appApiUrl } : {}
+    });
+  }
   if (parsed.appApiUrl || parsed.opsApiUrl || parsed.opsFrontendUrl || parsed.teamsIngressUrl || parsed.slackIngressUrl) {
     const {
       setAppApiUrl: setAppApiUrl2,
@@ -394588,14 +395826,17 @@ async function main(rawArgv = process.argv.slice(2)) {
   const helpText = helpTopic === null ? null : helpTextForTopic(helpTopic);
   const command2 = argv[0];
   if (helpText !== null) {
+    const helpBase = {
+      command: "help",
+      subcommand: helpTopic ?? "unknown"
+    };
     recordTelemetryEvent({
-      properties: {
-        command: "help",
-        outcome: "started",
-        subcommand: helpTopic ?? "unknown"
-      }
+      properties: { ...helpBase, outcome: "started" }
     });
     process.stdout.write(helpText);
+    recordTelemetryEvent({
+      properties: { ...helpBase, outcome: "succeeded" }
+    });
     return;
   }
   await applyGlobalArgs(globalArgs);
@@ -394651,6 +395892,7 @@ function installSignalHandlers() {
       shuttingDown = true;
       const safety = setTimeout(() => process.exit(130), 2e3);
       safety.unref();
+      recordAbandonedInvocation();
       const reraise = () => {
         process.kill(process.pid, signal);
       };