eve 0.67.1 → 0.67.2

package/dist/src/runtime/connections/mcp-tracing.js

@@ -1 +1 @@
-import{isObject}from"#shared/guards.js";import{replaceBaggageMember}from"#protocol/baggage.js";import{SpanKind,context,createContextKey,propagation,trace}from"#compiled/@opentelemetry/api/index.js";import{truncateTelemetryText}from"#tracing/telemetry-budget.js";import{contentAttribute}from"#tracing/agent-otel-content.js";import{recordAgentSpanError}from"#tracing/agent-span-error.js";import{agentToolContentPolicy,agentToolSpanContext,annotateAgentToolSpan,recordAgentToolSpanError,withAgentToolSpanContext}from"#tracing/agent-tool-span-context.js";const MAX_MCP_TRACE_REQUEST_BYTES=1048576,MAX_MCP_TRACE_CONTEXT_BYTES=8192,utf8Encoder=new TextEncoder,EVE_TRACE_BAGGAGE_KEYS=[`eve.audience`,`eve.conversation.id`,`eve.parent_session`],traceContextSetter={set(e,t,n){e[t]=n}},MCP_METHOD_NAME_CONTEXT_KEY=createContextKey(`eve.mcp.method-name`);function createMcpTraceFetch(e){let t=e.fetcher??((e,t)=>globalThis.fetch(e,t)),n=e.getActiveContext??(()=>context.active()),r=e.injectContext??injectOpenTelemetryTraceContext;return async(i,a)=>{let o=readJsonRpcRequest(a?.body);if(o===void 0)return await t(i,a);let s=n(),c=injectMcpTraceContext(o,s,r),l=o.method===`tools/call`||mcpMethodName(s)===o.method;l&&annotateAgentToolSpan(mcpRequestAttributes({connectionName:e.connectionName,message:o,params:isObject(o.params)?o.params:{},protocolVersion:headerValue(a?.headers,`mcp-protocol-version`)??e.getProtocolVersion()}),s);let u=await t(i,c===void 0?a:{...a,body:JSON.stringify(c)});if(l){let e=u.headers.get(`mcp-session-id`);e!==null&&annotateAgentToolSpan({"mcp.session.id":truncateTelemetryText(e,512)},s)}return u}}function injectMcpTraceContext(e,t,n=injectOpenTelemetryTraceContext){if(!withinTraceRequestLimit(JSON.stringify(e))||e.params!==void 0&&!isObject(e.params))return;let r={};if(n(t,r),!withinTraceContextLimit(r))return;stripEveTraceBaggage(r);let i=isObject(e.params)?e.params:{},a=isObject(i._meta)?i._meta:{};return{...e,params:{...i,_meta:{...a,...r}}}}async function withMcpToolsListSpan(e){let t=context.active(),n=mcpRequestAttributes({connectionName:e.connectionName,method:`tools/list`,protocolVersion:e.protocolVersion}),r=trace.getTracer(`eve.mcp`).startSpan(`tools/list`,{attributes:n,kind:SpanKind.CLIENT},t),i=withMcpMethodName(withAgentToolSpanContext(trace.setSpan(t,r),{...agentToolContentPolicy(t),recordError:(e,t)=>recordAgentSpanError(r,e,t),setAttributes:e=>setSpanAttributes(r,e)}),`tools/list`);try{return await context.with(i,async()=>{try{return await e.execute()}catch(e){let t=jsonRpcErrorCode(e);throw t!==void 0&&annotateAgentToolSpan({"rpc.response.status_code":t},i),recordAgentToolSpanError(e,errorType(e,t),i),e}})}finally{r.end()}}async function withMcpToolCallSpan(e){let t=context.active(),n=agentToolSpanContext(t),r=agentToolContentPolicy(t);if(n?.setAttributes!==void 0)return annotateAgentToolSpan(mcpToolCallAttributes(e),t),await runMcpToolCall(e,t,void 0,r);let i=trace.getTracer(`eve.mcp`).startSpan(`tools/call ${truncateTelemetryText(e.toolName,128)}`,{attributes:mcpToolCallAttributes(e),kind:SpanKind.CLIENT},t),a=withMcpMethodName(withAgentToolSpanContext(trace.setSpan(t,i),{...r,recordError:(e,t)=>recordAgentSpanError(i,e,t),setAttributes:e=>setSpanAttributes(i,e)}),`tools/call`);try{return await context.with(a,()=>runMcpToolCall(e,a,i,r))}finally{i.end()}}function runMcpToolCall(e,t,n,r){if(n!==void 0&&r.recordInputs){let t=contentAttribute(e.arguments);t!==void 0&&n.setAttribute(`gen_ai.tool.call.arguments`,t)}return e.execute().then(e=>{if(isToolErrorResult(e)&&recordAgentToolSpanError(void 0,`tool_error`,t),n!==void 0&&r.recordOutputs){let t=contentAttribute(e);t!==void 0&&n.setAttribute(`gen_ai.tool.call.result`,t)}return e}).catch(e=>{let r=jsonRpcErrorCode(e);throw r!==void 0&&annotateAgentToolSpan({"rpc.response.status_code":r},t),n!==void 0&&recordAgentToolSpanError(e,errorType(e,r),t),e})}function mcpToolCallAttributes(e){return mcpRequestAttributes({connectionName:e.connectionName,method:`tools/call`,protocolVersion:e.protocolVersion,toolName:e.toolName})}function mcpRequestAttributes(e){let t=e.method??e.message?.method,n=e.params??(isObject(e.message?.params)?e.message.params:{}),r={"eve.connection.name":e.connectionName,"mcp.method.name":t??`unknown`,"network.protocol.name":`http`,"network.transport":`tcp`},i=e.toolName??(typeof n.name==`string`?n.name:void 0);t===`tools/call`&&(r[`gen_ai.operation.name`]=`execute_tool`,i!==void 0&&(r[`gen_ai.tool.name`]=i));let a=e.message?.id;(typeof a==`number`||typeof a==`string`)&&(r[`jsonrpc.request.id`]=String(a));let o=n._meta,s=e.protocolVersion??(isObject(o)&&typeof o[`io.modelcontextprotocol/protocolVersion`]==`string`?o[`io.modelcontextprotocol/protocolVersion`]:void 0);return s!==void 0&&(r[`mcp.protocol.version`]=s),r}function injectOpenTelemetryTraceContext(e,t){propagation.inject(e,t,traceContextSetter)}function stripEveTraceBaggage(e){let t=e.baggage;if(t!==void 0){for(let e of EVE_TRACE_BAGGAGE_KEYS)t=replaceBaggageMember(t,e,void 0);t===void 0?delete e.baggage:e.baggage=t}}function readJsonRpcRequest(e){if(typeof e==`string`&&withinTraceRequestLimit(e))try{let t=JSON.parse(e);return isObject(t)&&typeof t.method==`string`?t:void 0}catch{return}}function withinTraceRequestLimit(e){return e.length<=MAX_MCP_TRACE_REQUEST_BYTES&&utf8Encoder.encode(e).byteLength<=MAX_MCP_TRACE_REQUEST_BYTES}function withinTraceContextLimit(e){let t=0;for(let[n,r]of Object.entries(e))if(n.length+r.length>MAX_MCP_TRACE_CONTEXT_BYTES||(t+=utf8Encoder.encode(n).byteLength+utf8Encoder.encode(r).byteLength+2,t>MAX_MCP_TRACE_CONTEXT_BYTES))return!1;return t>0}function headerValue(e,t){if(e!==void 0)try{return new Headers(e).get(t)??void 0}catch{return}}function isToolErrorResult(e){return isObject(e)&&e.isError===!0}function jsonRpcErrorCode(e){if(!isObject(e))return;let t=e.code;return typeof t==`number`||typeof t==`string`?String(t):void 0}function errorType(e,t){return t===void 0?e instanceof Error?e.name||`Error`:void 0:t}function setSpanAttributes(e,t){for(let[n,r]of Object.entries(t))r!==void 0&&e.setAttribute(n,r)}function withMcpMethodName(e,t){return e.setValue(MCP_METHOD_NAME_CONTEXT_KEY,t)}function mcpMethodName(e){let t=e.getValue(MCP_METHOD_NAME_CONTEXT_KEY);return typeof t==`string`?t:void 0}export{createMcpTraceFetch,injectMcpTraceContext,withMcpToolCallSpan,withMcpToolsListSpan};
+import{isObject}from"#shared/guards.js";import{replaceBaggageMember}from"#protocol/baggage.js";import{SpanKind,context,createContextKey,propagation,trace}from"#compiled/@opentelemetry/api/index.js";import{truncateTelemetryText}from"#tracing/telemetry-budget.js";import{contentAttribute}from"#tracing/agent-otel-content.js";import{recordAgentSpanError}from"#tracing/agent-span-error.js";import{agentToolContentPolicy,agentToolSpanContext,annotateAgentToolSpan,recordAgentToolSpanError,withAgentToolSpanContext}from"#tracing/agent-tool-span-context.js";const MAX_MCP_TRACE_REQUEST_BYTES=1048576,MAX_MCP_TRACE_CONTEXT_BYTES=8192,utf8Encoder=new TextEncoder,EVE_TRACE_BAGGAGE_KEYS=[`eve.audience`,`eve.conversation.id`,`eve.parent_session`],traceContextSetter={set(e,t,n){e[t]=n}},MCP_METHOD_NAME_CONTEXT_KEY=createContextKey(`eve.mcp.method-name`);function createMcpTraceFetch(e){let t=e.fetcher??((e,t)=>globalThis.fetch(e,t)),n=e.getActiveContext??(()=>context.active()),r=e.injectContext??injectOpenTelemetryTraceContext;return async(i,a)=>{let o=readJsonRpcRequest(a?.body);if(o===void 0)return await t(i,a);let s=n(),c=injectMcpTraceContext(o,s,r),l=o.method===`tools/call`||mcpMethodName(s)===o.method;l&&annotateAgentToolSpan(mcpRequestAttributes({connectionName:e.connectionName,message:o,params:isObject(o.params)?o.params:{},protocolVersion:headerValue(a?.headers,`mcp-protocol-version`)??e.getProtocolVersion()}),s);let u=await t(i,c===void 0?a:{...a,body:JSON.stringify(c)});if(l){let e=u.headers.get(`mcp-session-id`);e!==null&&annotateAgentToolSpan({"mcp.session.id":truncateTelemetryText(e,512)},s)}return u}}function injectMcpTraceContext(e,t,n=injectOpenTelemetryTraceContext){if(!withinTraceRequestLimit(JSON.stringify(e))||e.params!==void 0&&!isObject(e.params))return;let r={};if(n(t,r),!withinTraceContextLimit(r))return;stripEveTraceBaggage(r);let i=isObject(e.params)?e.params:{},a=isObject(i._meta)?i._meta:{};return{...e,params:{...i,_meta:{...a,...r}}}}async function withMcpToolsListSpan(e){let t=context.active(),n=mcpRequestAttributes({connectionName:e.connectionName,method:`tools/list`,protocolVersion:e.protocolVersion}),r=trace.getTracer(`eve.mcp`).startSpan(`tools/list`,{attributes:n,kind:SpanKind.CLIENT},t),i=withMcpMethodName(withAgentToolSpanContext(trace.setSpan(t,r),{...agentToolContentPolicy(t),recordError:(e,t)=>recordAgentSpanError(r,e,t),setAttributes:e=>setSpanAttributes(r,e)}),`tools/list`);try{return await context.with(i,async()=>{try{return await e.execute()}catch(e){let t=jsonRpcErrorCode(e);throw t!==void 0&&annotateAgentToolSpan({"rpc.response.status_code":t},i),recordAgentToolSpanError(e,errorType(e,t),i),e}})}finally{r.end()}}async function withMcpToolCallSpan(e){let t=context.active(),n=agentToolSpanContext(t),r=agentToolContentPolicy(t);if(n?.setAttributes!==void 0)return annotateAgentToolSpan(mcpToolCallAttributes(e),t),await runMcpToolCall(e,t,void 0,r);let i=trace.getTracer(`eve.mcp`).startSpan(`tools/call ${truncateTelemetryText(e.toolName,128)}`,{attributes:mcpToolCallAttributes(e),kind:SpanKind.CLIENT},t),a=withMcpMethodName(withAgentToolSpanContext(trace.setSpan(t,i),{...r,recordError:(e,t)=>recordAgentSpanError(i,e,t),setAttributes:e=>setSpanAttributes(i,e)}),`tools/call`);try{return await context.with(a,()=>runMcpToolCall(e,a,i,r))}finally{i.end()}}function runMcpToolCall(e,t,n,r){if(n!==void 0&&r.recordInputs){let t=contentAttribute(e.arguments);t!==void 0&&n.setAttribute(`gen_ai.tool.call.arguments`,t)}return e.execute().then(e=>{if(isToolErrorResult(e)&&recordAgentToolSpanError(void 0,`tool_error`,t),n!==void 0&&r.recordOutputs){let t=contentAttribute(e);t!==void 0&&n.setAttribute(`gen_ai.tool.call.result`,t)}return e}).catch(e=>{let r=jsonRpcErrorCode(e);throw r!==void 0&&annotateAgentToolSpan({"rpc.response.status_code":r},t),n!==void 0&&recordAgentToolSpanError(e,errorType(e,r),t),e})}function mcpToolCallAttributes(e){return mcpRequestAttributes({connectionName:e.connectionName,method:`tools/call`,protocolVersion:e.protocolVersion,toolName:e.toolName})}function mcpRequestAttributes(e){let t=e.method??e.message?.method,n=e.params??(isObject(e.message?.params)?e.message.params:{}),r={"eve.connection.name":e.connectionName,"mcp.method.name":t??`unknown`,"network.protocol.name":`http`,"network.transport":`tcp`},i=e.toolName??(typeof n.name==`string`?n.name:void 0);t===`tools/call`&&(r[`gen_ai.operation.name`]=`execute_tool`,i!==void 0&&(r[`gen_ai.tool.name`]=i));let a=e.message?.id;(typeof a==`number`||typeof a==`string`)&&(r[`jsonrpc.request.id`]=String(a));let o=n._meta,s=e.protocolVersion??(isObject(o)&&typeof o[`io.modelcontextprotocol/protocolVersion`]==`string`?o[`io.modelcontextprotocol/protocolVersion`]:void 0);return s!==void 0&&(r[`mcp.protocol.version`]=s),r}function injectOpenTelemetryTraceContext(e,t){propagation.inject(e,t,traceContextSetter)}function stripEveTraceBaggage(e){let t=e.baggage;if(t!==void 0){for(let e of EVE_TRACE_BAGGAGE_KEYS)t=replaceBaggageMember(t,e,void 0);t===void 0?delete e.baggage:e.baggage=t}}function readJsonRpcRequest(e){if(typeof e==`string`&&withinTraceRequestLimit(e))try{let t=JSON.parse(e);return isObject(t)&&typeof t.method==`string`?t:void 0}catch{return}}function withinTraceRequestLimit(e){return e.length<=MAX_MCP_TRACE_REQUEST_BYTES&&utf8Encoder.encode(e).byteLength<=MAX_MCP_TRACE_REQUEST_BYTES}function withinTraceContextLimit(e){let t=0;for(let[n,r]of Object.entries(e))if(n.length+r.length>MAX_MCP_TRACE_CONTEXT_BYTES||(t+=utf8Encoder.encode(n).byteLength+utf8Encoder.encode(r).byteLength+2,t>MAX_MCP_TRACE_CONTEXT_BYTES))return!1;return t>0}function headerValue(e,t){if(e!==void 0)try{return new Headers(e).get(t)??void 0}catch{return}}function isToolErrorResult(e){return isObject(e)&&e.isError===!0}function jsonRpcErrorCode(e){if(!isObject(e))return;let t=e.code;return typeof t==`number`||typeof t==`string`?String(t):void 0}function errorType(e,t){return t===void 0?e instanceof Error?e.name||`Error`:void 0:t}function setSpanAttributes(e,t){for(let[n,r]of Object.entries(t))r!==void 0&&e.setAttribute(n,r)}function withMcpMethodName(e,t){return e.setValue(MCP_METHOD_NAME_CONTEXT_KEY,t)}function mcpMethodName(e){let t=e.getValue(MCP_METHOD_NAME_CONTEXT_KEY);return typeof t==`string`?t:void 0}export{createMcpTraceFetch,withMcpToolCallSpan,withMcpToolsListSpan};

package/dist/src/runtime/connections/openapi-client.d.ts

@@ -11,7 +11,7 @@ interface OpenApiToolCache {
  * tool result so it can react to the status and body of any response,
  * including non-2xx responses.
  */
-export interface OpenApiToolResult {
+interface OpenApiToolResult {
     readonly status: number;
     readonly statusText: string;
     readonly body: unknown;

package/dist/src/runtime/connections/scoped-authorization.d.ts

@@ -90,15 +90,6 @@ export declare function evictScopedToken(input: ScopedAuthorization): Promise<vo
  * callback arrived for the scope.
  */
 export declare function completeScopedAuthorization(input: ScopedAuthorization): Promise<boolean>;
-/**
- * Starts an interactive authorization for one scope and returns the
- * {@link AuthorizationSignal} a tool returns to park the turn.
- *
- * Returns `undefined` when the strategy is not interactive or no
- * callback URL can be minted (for example outside a deployment), so
- * callers can fall through to rethrowing the original `Required` error.
- */
-export declare function startScopedAuthorization(input: ScopedAuthorization): Promise<AuthorizationSignal | undefined>;
 /** Normalizes callback URLs for providers with localhost requirements. */
 export declare function resolveAuthorizationCallbackUrl(input: {
     readonly authorization: Readonly<AuthorizationDefinition>;

package/dist/src/runtime/connections/scoped-authorization.js

@@ -1 +1 @@
-import{contextStorage,loadContext}from"#context/container.js";import{consumeAuthorizationResult,createAuthorizationAttempt,requestAuthorization}from"#harness/authorization.js";import{ConnectionAuthorizationFailedError,ConnectionAuthorizationRequiredError,isConnectionAuthorizationRequiredError}from"#connections/errors.js";import{supportsInteractiveAuthorization}from"#shared/connection-types.js";import{isAsyncIterable}from"#shared/async-iterable.js";import{evictCachedToken,readCachedToken,writeCachedToken}from"#runtime/connections/authorization-tokens.js";import{principalKey,resolveConnectionPrincipal,resolveConnectionPrincipalFromAuth}from"#runtime/connections/principal.js";const LOCAL_HTTP_VERCEL_CONNECT_HOSTNAMES=new Set([`127.0.0.1`,`[::1]`]);function createAuthorizationExecution(e={}){let t=new Set;async function complete(n){let r=n.instanceId??n.scope;!t.has(r)&&await(e.completeAuthorization??completeScopedAuthorization)(n)&&t.add(r)}function requireAuth(e,n){throw new ScopedAuthorizationRequiredError(e,t.has(e.instanceId??e.scope),n)}return{complete,async getToken(e){await complete(e);try{return await resolveScopedToken(e)}catch(t){if(!isConnectionAuthorizationRequiredError(t))throw t;return requireAuth(e,t)}},requireAuth,async handleError(e,n){return n!==void 0&&isConnectionAuthorizationRequiredError(e)?await handleAuthorizationError(new ScopedAuthorizationRequiredError(n,t.has(n.instanceId??n.scope),e),{evictToken:!1}):await handleAuthorizationError(e)},run:executeWithAuthorization}}var ScopedAuthorizationRequiredError=class extends Error{scoped;justAuthorized;constructor(e,t,n){super(`Authorization required.`,{cause:n}),this.name=`ScopedAuthorizationRequiredError`,this.scoped=e,this.justAuthorized=t}};function isScopedAuthorizationRequiredError(e){return e instanceof Error&&e.name===`ScopedAuthorizationRequiredError`}async function handleAuthorizationError(e,t={evictToken:!0}){if(!isScopedAuthorizationRequiredError(e))throw e;let{scoped:n}=e;if(e.justAuthorized)throw new ConnectionAuthorizationFailedError(n.scope,{message:`Authorization for "${n.scope}" failed: the service rejected the token immediately after authorization.`,reason:`token_rejected_after_authorization`,retryable:!1});t.evictToken&&await evictScopedToken(n);let r=await startScopedAuthorization(n);if(r!==void 0)return r;throw supportsInteractiveAuthorization(n.authorization)?new ConnectionAuthorizationFailedError(n.scope,{message:`Authorization for "${n.scope}" requires sign-in, but no authorization callback URL could be minted for this run (missing session context).`,reason:`authorization_callback_unavailable`,retryable:!1}):e.cause??new ConnectionAuthorizationRequiredError(n.scope)}function executeWithAuthorization(e){try{let t=e();return isAsyncIterable(t)?handleIterable(t):Promise.resolve(t).catch(handleAuthorizationError)}catch(e){return handleAuthorizationError(e)}}async function*handleIterable(e){try{for await(let t of e)yield t}catch(e){yield await handleAuthorizationError(e)}}async function resolveScopedToken(e){let{scope:t,authorization:n,connection:r}=e,i=e.instanceId??t,a=contextStorage.getStore(),o=resolveScopedPrincipal(e,a);if(a===void 0)return await n.getToken({connection:r,principal:o});let s=principalKey(o),c=readCachedToken(a,i,s);if(c!==void 0)return c;let l=await n.getToken({connection:r,principal:o});return writeCachedToken(a,i,s,l),l}async function evictScopedToken(e){let{scope:t,authorization:n,connection:r}=e,i=e.instanceId??t,a=contextStorage.getStore();if(a===void 0)return;let o;try{o=resolveScopedPrincipal(e,a),evictCachedToken(a,i,principalKey(o))}catch{return}try{await n.evict?.({connection:r,principal:o})}catch{}}async function completeScopedAuthorization(e){let{scope:t,authorization:n,connection:r}=e;if(!supportsInteractiveAuthorization(n))return!1;let i=consumeAuthorizationResult(t,e.instanceId);if(i===void 0)return!1;let a=n,o=loadContext(),s=i.principal??resolveScopedPrincipal(e,o),c=await a.completeAuthorization({callbackUrl:i.hookUrl,connection:r,principal:s,resume:i.resume,callback:i.callback});return writeCachedToken(o,e.instanceId??t,principalKey(s),c),!0}async function startScopedAuthorization(e){let{scope:t,authorization:n,connection:r}=e;if(!supportsInteractiveAuthorization(n))return;let i=createAuthorizationAttempt(t);if(i===void 0)return;let a=n,o=resolveScopedPrincipal(e),s=resolveAuthorizationCallbackUrl({authorization:n,callbackUrl:i.hookUrl}),{challenge:c,resume:l}=await a.startAuthorization({callbackUrl:s,connection:r,principal:o});return requestAuthorization([{attemptId:i.attemptId,challenge:stampChallengeDisplayName(c,n),hookUrl:s,instanceId:e.instanceId,name:t,principal:o,resume:l}])}function resolveScopedPrincipal(e,t){return e.boundResponder===void 0?resolveConnectionPrincipal(e.scope,e.authorization,t):resolveConnectionPrincipalFromAuth(e.scope,e.authorization,e.boundResponder,t)}function resolveAuthorizationCallbackUrl(e){if(e.authorization.vercelConnect===void 0)return e.callbackUrl;let t;try{t=new URL(e.callbackUrl)}catch{return e.callbackUrl}return t.protocol!==`http:`||!LOCAL_HTTP_VERCEL_CONNECT_HOSTNAMES.has(t.hostname)?e.callbackUrl:(t.hostname=`localhost`,t.toString())}function stampChallengeDisplayName(e,t){let n=t.displayName??e.displayName;return n===e.displayName?e:{...e,displayName:n}}export{completeScopedAuthorization,createAuthorizationExecution,evictScopedToken,handleAuthorizationError,resolveAuthorizationCallbackUrl,resolveScopedToken,stampChallengeDisplayName,startScopedAuthorization};
+import{contextStorage,loadContext}from"#context/container.js";import{consumeAuthorizationResult,createAuthorizationAttempt,requestAuthorization}from"#harness/authorization.js";import{ConnectionAuthorizationFailedError,ConnectionAuthorizationRequiredError,isConnectionAuthorizationRequiredError}from"#connections/errors.js";import{supportsInteractiveAuthorization}from"#shared/connection-types.js";import{isAsyncIterable}from"#shared/async-iterable.js";import{evictCachedToken,readCachedToken,writeCachedToken}from"#runtime/connections/authorization-tokens.js";import{principalKey,resolveConnectionPrincipal,resolveConnectionPrincipalFromAuth}from"#runtime/connections/principal.js";const LOCAL_HTTP_VERCEL_CONNECT_HOSTNAMES=new Set([`127.0.0.1`,`[::1]`]);function createAuthorizationExecution(e={}){let t=new Set;async function complete(n){let r=n.instanceId??n.scope;!t.has(r)&&await(e.completeAuthorization??completeScopedAuthorization)(n)&&t.add(r)}function requireAuth(e,n){throw new ScopedAuthorizationRequiredError(e,t.has(e.instanceId??e.scope),n)}return{complete,async getToken(e){await complete(e);try{return await resolveScopedToken(e)}catch(t){if(!isConnectionAuthorizationRequiredError(t))throw t;return requireAuth(e,t)}},requireAuth,async handleError(e,n){return n!==void 0&&isConnectionAuthorizationRequiredError(e)?await handleAuthorizationError(new ScopedAuthorizationRequiredError(n,t.has(n.instanceId??n.scope),e),{evictToken:!1}):await handleAuthorizationError(e)},run:executeWithAuthorization}}var ScopedAuthorizationRequiredError=class extends Error{scoped;justAuthorized;constructor(e,t,n){super(`Authorization required.`,{cause:n}),this.name=`ScopedAuthorizationRequiredError`,this.scoped=e,this.justAuthorized=t}};function isScopedAuthorizationRequiredError(e){return e instanceof Error&&e.name===`ScopedAuthorizationRequiredError`}async function handleAuthorizationError(e,t={evictToken:!0}){if(!isScopedAuthorizationRequiredError(e))throw e;let{scoped:n}=e;if(e.justAuthorized)throw new ConnectionAuthorizationFailedError(n.scope,{message:`Authorization for "${n.scope}" failed: the service rejected the token immediately after authorization.`,reason:`token_rejected_after_authorization`,retryable:!1});t.evictToken&&await evictScopedToken(n);let r=await startScopedAuthorization(n);if(r!==void 0)return r;throw supportsInteractiveAuthorization(n.authorization)?new ConnectionAuthorizationFailedError(n.scope,{message:`Authorization for "${n.scope}" requires sign-in, but no authorization callback URL could be minted for this run (missing session context).`,reason:`authorization_callback_unavailable`,retryable:!1}):e.cause??new ConnectionAuthorizationRequiredError(n.scope)}function executeWithAuthorization(e){try{let t=e();return isAsyncIterable(t)?handleIterable(t):Promise.resolve(t).catch(handleAuthorizationError)}catch(e){return handleAuthorizationError(e)}}async function*handleIterable(e){try{for await(let t of e)yield t}catch(e){yield await handleAuthorizationError(e)}}async function resolveScopedToken(e){let{scope:t,authorization:n,connection:r}=e,i=e.instanceId??t,a=contextStorage.getStore(),o=resolveScopedPrincipal(e,a);if(a===void 0)return await n.getToken({connection:r,principal:o});let s=principalKey(o),c=readCachedToken(a,i,s);if(c!==void 0)return c;let l=await n.getToken({connection:r,principal:o});return writeCachedToken(a,i,s,l),l}async function evictScopedToken(e){let{scope:t,authorization:n,connection:r}=e,i=e.instanceId??t,a=contextStorage.getStore();if(a===void 0)return;let o;try{o=resolveScopedPrincipal(e,a),evictCachedToken(a,i,principalKey(o))}catch{return}try{await n.evict?.({connection:r,principal:o})}catch{}}async function completeScopedAuthorization(e){let{scope:t,authorization:n,connection:r}=e;if(!supportsInteractiveAuthorization(n))return!1;let i=consumeAuthorizationResult(t,e.instanceId);if(i===void 0)return!1;let a=n,o=loadContext(),s=i.principal??resolveScopedPrincipal(e,o),c=await a.completeAuthorization({callbackUrl:i.hookUrl,connection:r,principal:s,resume:i.resume,callback:i.callback});return writeCachedToken(o,e.instanceId??t,principalKey(s),c),!0}async function startScopedAuthorization(e){let{scope:t,authorization:n,connection:r}=e;if(!supportsInteractiveAuthorization(n))return;let i=createAuthorizationAttempt(t);if(i===void 0)return;let a=n,o=resolveScopedPrincipal(e),s=resolveAuthorizationCallbackUrl({authorization:n,callbackUrl:i.hookUrl}),{challenge:c,resume:l}=await a.startAuthorization({callbackUrl:s,connection:r,principal:o});return requestAuthorization([{attemptId:i.attemptId,challenge:stampChallengeDisplayName(c,n),hookUrl:s,instanceId:e.instanceId,name:t,principal:o,resume:l}])}function resolveScopedPrincipal(e,t){return e.boundResponder===void 0?resolveConnectionPrincipal(e.scope,e.authorization,t):resolveConnectionPrincipalFromAuth(e.scope,e.authorization,e.boundResponder,t)}function resolveAuthorizationCallbackUrl(e){if(e.authorization.vercelConnect===void 0)return e.callbackUrl;let t;try{t=new URL(e.callbackUrl)}catch{return e.callbackUrl}return t.protocol!==`http:`||!LOCAL_HTTP_VERCEL_CONNECT_HOSTNAMES.has(t.hostname)?e.callbackUrl:(t.hostname=`localhost`,t.toString())}function stampChallengeDisplayName(e,t){let n=t.displayName??e.displayName;return n===e.displayName?e:{...e,displayName:n}}export{completeScopedAuthorization,createAuthorizationExecution,evictScopedToken,handleAuthorizationError,resolveAuthorizationCallbackUrl,resolveScopedToken,stampChallengeDisplayName};

package/dist/src/runtime/hooks/registry.d.ts

@@ -22,13 +22,6 @@ export interface RuntimeHookRegistry {
     readonly streamEventsByType: ReadonlyMap<string, readonly RuntimeStreamEventHookEntry[]>;
     readonly streamEventsWildcard: readonly RuntimeStreamEventHookEntry[];
 }
-/**
- * Returns an empty registry. Used by tests that build a runtime bundle
- * stub without authored hooks — production registries are constructed
- * via {@link createRuntimeHookRegistry} from the resolved authored
- * graph.
- */
-export declare function createEmptyHookRegistry(): RuntimeHookRegistry;
 /**
  * Builds the per-node runtime hook registry from an ordered list of
  * resolved hook definitions.

package/dist/src/runtime/hooks/registry.js

@@ -1 +1 @@
-function createEmptyHookRegistry(){return{streamEventsByType:new Map,streamEventsWildcard:[]}}function createRuntimeHookRegistry(e){let t=new Map,n=[];for(let r of e)for(let[e,i]of Object.entries(r.events)){let a={slug:r.slug,handler:i,eventType:e};if(e===`*`)n.push(a);else{let n=t.get(e)??[];n.push(a),t.set(e,n)}}return{streamEventsByType:t,streamEventsWildcard:n}}export{createEmptyHookRegistry,createRuntimeHookRegistry};
+function createRuntimeHookRegistry(e){let t=new Map,n=[];for(let r of e)for(let[e,i]of Object.entries(r.events)){let a={slug:r.slug,handler:i,eventType:e};if(e===`*`)n.push(a);else{let n=t.get(e)??[];n.push(a),t.set(e,n)}}return{streamEventsByType:t,streamEventsWildcard:n}}export{createRuntimeHookRegistry};

package/dist/src/runtime/loaders/artifact-paths.d.ts

@@ -1,7 +1,7 @@
 /**
  * Runtime-owned compiled artifact paths for one application root.
  */
-export interface RuntimeCompilerArtifactPaths {
+interface RuntimeCompilerArtifactPaths {
     readonly appRoot: string;
     readonly compiledManifestPath: string;
     readonly compileDirectoryPath: string;
@@ -17,3 +17,4 @@ export interface RuntimeCompilerArtifactPaths {
  * depending on Node path helpers.
  */
 export declare function resolveRuntimeCompilerArtifactPaths(appRoot: string): RuntimeCompilerArtifactPaths;
+export {};

package/dist/src/runtime/loaders/bundled-artifacts.d.ts

@@ -35,5 +35,4 @@ export declare function withBundledCompiledArtifacts<T>(input: WithBundledCompil
  * Reads the bundled compiled-artifact snapshot for the active runtime
  * session, or `null` if none has been installed.
  */
-export declare function updateBundledSandboxPreparedArtifacts(sandboxPreparedArtifacts: SandboxPreparedArtifactsManifest): boolean;
 export declare function readBundledCompiledArtifacts(): BundledCompiledArtifacts | null;

package/dist/src/runtime/loaders/bundled-artifacts.js

@@ -1 +1 @@
-import{createRuntimeSession,getActiveRuntimeSession,setRuntimeSessionCompiledArtifacts,withRuntimeSession}from"#runtime/sessions/runtime-session.js";function installBundledCompiledArtifacts(e){setRuntimeSessionCompiledArtifacts(getActiveRuntimeSession(),{manifest:e.manifest,metadata:e.metadata,moduleMap:e.moduleMap,sandboxPreparedArtifacts:e.sandboxPreparedArtifacts})}async function withBundledCompiledArtifacts(e,t){let n=createRuntimeSession(e.sessionId??`bundled-compiled-artifacts`);return await withRuntimeSession(n,async()=>(installBundledCompiledArtifacts(e),await t()))}function updateBundledSandboxPreparedArtifacts(e){let t=getActiveRuntimeSession(),n=t.compiledArtifacts;return n!==null&&(setRuntimeSessionCompiledArtifacts(t,{...n,sandboxPreparedArtifacts:e}),!0)}function readBundledCompiledArtifacts(){return getActiveRuntimeSession().compiledArtifacts}export{installBundledCompiledArtifacts,readBundledCompiledArtifacts,updateBundledSandboxPreparedArtifacts,withBundledCompiledArtifacts};
+import{createRuntimeSession,getActiveRuntimeSession,setRuntimeSessionCompiledArtifacts,withRuntimeSession}from"#runtime/sessions/runtime-session.js";function installBundledCompiledArtifacts(e){setRuntimeSessionCompiledArtifacts(getActiveRuntimeSession(),{manifest:e.manifest,metadata:e.metadata,moduleMap:e.moduleMap,sandboxPreparedArtifacts:e.sandboxPreparedArtifacts})}async function withBundledCompiledArtifacts(e,t){let n=createRuntimeSession(e.sessionId??`bundled-compiled-artifacts`);return await withRuntimeSession(n,async()=>(installBundledCompiledArtifacts(e),await t()))}function readBundledCompiledArtifacts(){return getActiveRuntimeSession().compiledArtifacts}export{installBundledCompiledArtifacts,readBundledCompiledArtifacts,withBundledCompiledArtifacts};

package/dist/src/runtime/resolve-agent.d.ts

@@ -1,11 +1,10 @@
 import type { CompiledAgentNodeManifest, CompiledAgentResources } from "#compiler/manifest.js";
 import type { CompiledModuleMap } from "#compiler/module-map.js";
-export { ResolveAgentError } from "#runtime/resolve-helpers.js";
 import type { ResolvedAgent } from "#runtime/types.js";
 /**
  * Input for resolving one compiled authored agent into a runtime-owned model.
  */
-export interface ResolveAgentInput {
+interface ResolveAgentInput {
     manifest: CompiledAgentNodeManifest | CompiledAgentResources;
     moduleMap: CompiledModuleMap;
     nodeId?: string;
@@ -14,3 +13,4 @@ export interface ResolveAgentInput {
  * Resolves the core authored agent path from compiled artifacts.
  */
 export declare function resolveAgent(input: ResolveAgentInput): Promise<ResolvedAgent>;
+export {};

package/dist/src/runtime/resolve-agent.js

@@ -1 +1 @@
-import{resolveConnectionDefinition}from"#runtime/resolve-connection.js";import{ResolveAgentError,createResolvedModuleSourceRef}from"#runtime/resolve-helpers.js";import{resolveChannelDefinition}from"#runtime/resolve-channel.js";import{resolveDynamicConnectionDefinition}from"#runtime/resolve-dynamic-connection.js";import{resolveHookDefinition}from"#runtime/resolve-hook.js";import{resolveSandboxDefinition}from"#runtime/resolve-sandbox.js";import{resolveDynamicInstructionsDefinition}from"#runtime/resolve-dynamic-instructions.js";import{resolveDynamicSkillDefinition}from"#runtime/resolve-dynamic-skill.js";import{resolveDynamicToolDefinition}from"#runtime/resolve-dynamic-tool.js";import{resolveToolDefinition}from"#runtime/resolve-tool.js";import{resolveMemoryDefinition}from"#runtime/resolve-memory.js";async function resolveAgent(e){let t=e.manifest.skills.map(t=>({...t,owner:requireCompiledSourceOwner(e.manifest,t),metadata:t.metadata===void 0?void 0:{...t.metadata}})),n=await Promise.all(e.manifest.channelRoutes.effective.map(t=>resolveChannelDefinition(t,e.moduleMap,e.nodeId))),r=await Promise.all(e.manifest.tools.map(t=>resolveToolDefinition(t,e.moduleMap,e.nodeId,requireBindingOwner(e.manifest,t.sourceId)))),i=await Promise.all(e.manifest.dynamicConnections.map(t=>resolveDynamicConnectionDefinition(t,e.moduleMap,e.nodeId))),a=await Promise.all((e.manifest.dynamicInstructions??[]).map(t=>resolveDynamicInstructionsDefinition(t,e.moduleMap,e.nodeId))),o=await Promise.all((e.manifest.dynamicSkills??[]).map(t=>resolveDynamicSkillDefinition(t,e.moduleMap,e.nodeId))),s=await Promise.all(e.manifest.dynamicTools.map(t=>resolveDynamicToolDefinition(t,e.moduleMap,e.nodeId))),c=await Promise.all(e.manifest.hooks.map(t=>resolveHookDefinition(t,e.moduleMap,e.nodeId))),l=await Promise.all(e.manifest.connections.map(t=>resolveConnectionDefinition(t,e.moduleMap,e.nodeId))),u=await Promise.all(e.manifest.memories.map(t=>resolveMemoryDefinition(t,e.moduleMap,e.nodeId))),d=await resolveSandboxDefinition(e.manifest.sandbox,e.moduleMap,e.nodeId),f=e.manifest.instructions.map(t=>createResolvedInstructionsDefinition(e.manifest,t)),p=e.manifest.workspaceResourceRoot,m={channels:n,connections:l,dynamicConnectionResolvers:i,dynamicInstructionsResolvers:a,dynamicSkillResolvers:o,dynamicToolResolvers:s,hooks:c,instructions:f,metadata:{agentRoot:e.manifest.agentRoot,appRoot:e.manifest.appRoot,diagnosticsSummary:e.manifest.diagnosticsSummary},memories:u,sandbox:d,workspaceResourceRoot:p,skills:t,tools:r,workspaceSpec:{rootEntries:[...p.rootEntries]}};return`config`in e.manifest?{...m,config:createResolvedAgentConfig(e.manifest)}:m}function requireBindingOwner(e,t){let n=e.bindings[t];if(n===void 0)throw Error(`Compiled source "${t}" has no binding.`);return n.owner}function createResolvedInstructionsDefinition(e,t){return{content:t.content,name:t.name,owner:requireCompiledSourceOwner(e,t),logicalPath:t.logicalPath,role:t.role,sourceId:t.sourceId,sourceKind:t.sourceKind}}function requireCompiledSourceOwner(e,t){let n=e.bindings[t.sourceId]?.owner??t.owner;if(n===void 0)throw Error(`Compiled source "${t.sourceId}" has no owner.`);return n}function createResolvedAgentConfig(e){let t={name:e.config.name};if(e.config.defaultTools!==void 0&&(t.defaultTools=e.config.defaultTools),e.config.description!==void 0&&(t.description=e.config.description),e.config.compaction!==void 0){let n={};e.config.compaction.model!==void 0&&(n.model=e.config.compaction.model.source===void 0?{contextWindowTokens:e.config.compaction.model.contextWindowTokens,id:e.config.compaction.model.id,maxOutputTokens:e.config.compaction.model.maxOutputTokens,providerOptions:e.config.compaction.model.providerOptions}:{contextWindowTokens:e.config.compaction.model.contextWindowTokens,id:e.config.compaction.model.id,maxOutputTokens:e.config.compaction.model.maxOutputTokens,providerOptions:e.config.compaction.model.providerOptions,source:{exportName:e.config.compaction.model.source.exportName,sourceKind:`module`,logicalPath:e.config.compaction.model.source.logicalPath,sourceId:e.config.compaction.model.source.sourceId}}),e.config.compaction.thresholdPercent!==void 0&&(n.thresholdPercent=e.config.compaction.thresholdPercent),t.compaction=n}if(e.config.experimental!==void 0&&(t.experimental={workflow:e.config.experimental.workflow===void 0?void 0:{modelCallsPerStep:e.config.experimental.workflow.modelCallsPerStep,retention:e.config.experimental.workflow.retention,world:e.config.experimental.workflow.world}}),e.config.reasoning!==void 0&&(t.reasoning=e.config.reasoning),e.config.source!==void 0&&(t.source=createResolvedModuleSourceRef(e.config.source)),e.config.tool!==void 0&&(t.tool=e.config.tool),e.config.limits!==void 0&&(t.limits={maxInputTokensPerSession:e.config.limits.maxInputTokensPerSession,maxOutputTokensPerSession:e.config.limits.maxOutputTokensPerSession,maxTokenCostUsdPerSession:e.config.limits.maxTokenCostUsdPerSession,sessionTimeoutMs:e.config.limits.sessionTimeoutMs}),e.config.dynamicModel!==void 0)return{...t,dynamicModel:{...createResolvedModuleSourceRef(e.config.dynamicModel),eventNames:[...e.config.dynamicModel.eventNames]}};let n=e.config.model;return{...t,model:n.source===void 0?{id:n.id,contextWindowTokens:n.contextWindowTokens,maxOutputTokens:n.maxOutputTokens,providerOptions:n.providerOptions}:{contextWindowTokens:n.contextWindowTokens,id:n.id,maxOutputTokens:n.maxOutputTokens,providerOptions:n.providerOptions,source:{exportName:n.source.exportName,sourceKind:`module`,logicalPath:n.source.logicalPath,sourceId:n.source.sourceId}}}}export{ResolveAgentError,resolveAgent};
+import{resolveConnectionDefinition}from"#runtime/resolve-connection.js";import{createResolvedModuleSourceRef}from"#runtime/resolve-helpers.js";import{resolveChannelDefinition}from"#runtime/resolve-channel.js";import{resolveDynamicConnectionDefinition}from"#runtime/resolve-dynamic-connection.js";import{resolveHookDefinition}from"#runtime/resolve-hook.js";import{resolveSandboxDefinition}from"#runtime/resolve-sandbox.js";import{resolveDynamicInstructionsDefinition}from"#runtime/resolve-dynamic-instructions.js";import{resolveDynamicSkillDefinition}from"#runtime/resolve-dynamic-skill.js";import{resolveDynamicToolDefinition}from"#runtime/resolve-dynamic-tool.js";import{resolveToolDefinition}from"#runtime/resolve-tool.js";import{resolveMemoryDefinition}from"#runtime/resolve-memory.js";async function resolveAgent(e){let t=e.manifest.skills.map(t=>({...t,owner:requireCompiledSourceOwner(e.manifest,t),metadata:t.metadata===void 0?void 0:{...t.metadata}})),n=await Promise.all(e.manifest.channelRoutes.effective.map(t=>resolveChannelDefinition(t,e.moduleMap,e.nodeId))),r=await Promise.all(e.manifest.tools.map(t=>resolveToolDefinition(t,e.moduleMap,e.nodeId,requireBindingOwner(e.manifest,t.sourceId)))),i=await Promise.all(e.manifest.dynamicConnections.map(t=>resolveDynamicConnectionDefinition(t,e.moduleMap,e.nodeId))),a=await Promise.all((e.manifest.dynamicInstructions??[]).map(t=>resolveDynamicInstructionsDefinition(t,e.moduleMap,e.nodeId))),o=await Promise.all((e.manifest.dynamicSkills??[]).map(t=>resolveDynamicSkillDefinition(t,e.moduleMap,e.nodeId))),s=await Promise.all(e.manifest.dynamicTools.map(t=>resolveDynamicToolDefinition(t,e.moduleMap,e.nodeId))),c=await Promise.all(e.manifest.hooks.map(t=>resolveHookDefinition(t,e.moduleMap,e.nodeId))),l=await Promise.all(e.manifest.connections.map(t=>resolveConnectionDefinition(t,e.moduleMap,e.nodeId))),u=await Promise.all(e.manifest.memories.map(t=>resolveMemoryDefinition(t,e.moduleMap,e.nodeId))),d=await resolveSandboxDefinition(e.manifest.sandbox,e.moduleMap,e.nodeId),f=e.manifest.instructions.map(t=>createResolvedInstructionsDefinition(e.manifest,t)),p=e.manifest.workspaceResourceRoot,m={channels:n,connections:l,dynamicConnectionResolvers:i,dynamicInstructionsResolvers:a,dynamicSkillResolvers:o,dynamicToolResolvers:s,hooks:c,instructions:f,metadata:{agentRoot:e.manifest.agentRoot,appRoot:e.manifest.appRoot,diagnosticsSummary:e.manifest.diagnosticsSummary},memories:u,sandbox:d,workspaceResourceRoot:p,skills:t,tools:r,workspaceSpec:{rootEntries:[...p.rootEntries]}};return`config`in e.manifest?{...m,config:createResolvedAgentConfig(e.manifest)}:m}function requireBindingOwner(e,t){let n=e.bindings[t];if(n===void 0)throw Error(`Compiled source "${t}" has no binding.`);return n.owner}function createResolvedInstructionsDefinition(e,t){return{content:t.content,name:t.name,owner:requireCompiledSourceOwner(e,t),logicalPath:t.logicalPath,role:t.role,sourceId:t.sourceId,sourceKind:t.sourceKind}}function requireCompiledSourceOwner(e,t){let n=e.bindings[t.sourceId]?.owner??t.owner;if(n===void 0)throw Error(`Compiled source "${t.sourceId}" has no owner.`);return n}function createResolvedAgentConfig(e){let t={name:e.config.name};if(e.config.defaultTools!==void 0&&(t.defaultTools=e.config.defaultTools),e.config.description!==void 0&&(t.description=e.config.description),e.config.compaction!==void 0){let n={};e.config.compaction.model!==void 0&&(n.model=e.config.compaction.model.source===void 0?{contextWindowTokens:e.config.compaction.model.contextWindowTokens,id:e.config.compaction.model.id,maxOutputTokens:e.config.compaction.model.maxOutputTokens,providerOptions:e.config.compaction.model.providerOptions}:{contextWindowTokens:e.config.compaction.model.contextWindowTokens,id:e.config.compaction.model.id,maxOutputTokens:e.config.compaction.model.maxOutputTokens,providerOptions:e.config.compaction.model.providerOptions,source:{exportName:e.config.compaction.model.source.exportName,sourceKind:`module`,logicalPath:e.config.compaction.model.source.logicalPath,sourceId:e.config.compaction.model.source.sourceId}}),e.config.compaction.thresholdPercent!==void 0&&(n.thresholdPercent=e.config.compaction.thresholdPercent),t.compaction=n}if(e.config.experimental!==void 0&&(t.experimental={workflow:e.config.experimental.workflow===void 0?void 0:{modelCallsPerStep:e.config.experimental.workflow.modelCallsPerStep,retention:e.config.experimental.workflow.retention,world:e.config.experimental.workflow.world}}),e.config.reasoning!==void 0&&(t.reasoning=e.config.reasoning),e.config.source!==void 0&&(t.source=createResolvedModuleSourceRef(e.config.source)),e.config.tool!==void 0&&(t.tool=e.config.tool),e.config.limits!==void 0&&(t.limits={maxInputTokensPerSession:e.config.limits.maxInputTokensPerSession,maxOutputTokensPerSession:e.config.limits.maxOutputTokensPerSession,maxTokenCostUsdPerSession:e.config.limits.maxTokenCostUsdPerSession,sessionTimeoutMs:e.config.limits.sessionTimeoutMs}),e.config.dynamicModel!==void 0)return{...t,dynamicModel:{...createResolvedModuleSourceRef(e.config.dynamicModel),eventNames:[...e.config.dynamicModel.eventNames]}};let n=e.config.model;return{...t,model:n.source===void 0?{id:n.id,contextWindowTokens:n.contextWindowTokens,maxOutputTokens:n.maxOutputTokens,providerOptions:n.providerOptions}:{contextWindowTokens:n.contextWindowTokens,id:n.id,maxOutputTokens:n.maxOutputTokens,providerOptions:n.providerOptions,source:{exportName:n.source.exportName,sourceKind:`module`,logicalPath:n.source.logicalPath,sourceId:n.source.sourceId}}}}export{resolveAgent};

package/dist/src/runtime/resolve-dynamic-tool.d.ts

@@ -1,12 +1,6 @@
 import type { CompiledDynamicToolDefinition } from "#compiler/manifest.js";
 import type { CompiledModuleMap } from "#compiler/module-map.js";
-import type { ModuleSourceRef } from "#shared/source-ref.js";
 import type { ResolvedDynamicToolResolver } from "#runtime/types.js";
-type DynamicToolResolverSource = Readonly<ModuleSourceRef & {
-    readonly extensionNamespace?: string;
-    readonly slug: string;
-    readonly rebindMissingCallbacks?: boolean;
-}>;
 /**
  * Resolves one compiled dynamic tool entry into a runtime-owned resolver
  * with live event handler functions reattached from the authored module.
@@ -16,13 +10,3 @@ type DynamicToolResolverSource = Readonly<ModuleSourceRef & {
  * the lifecycle point indicated by each event name.
  */
 export declare function resolveDynamicToolDefinition(definition: CompiledDynamicToolDefinition, moduleMap: CompiledModuleMap, nodeId: string | undefined): Promise<ResolvedDynamicToolResolver>;
-/**
- * Resolves a loaded public `defineDynamic()` value into the runtime shape used
- * by the dynamic-tool lifecycle.
- *
- * Authored definitions reach this boundary after module-map loading.
- * Framework-owned definitions are already loaded with eve itself. Both use
- * the same validation, source registration, and resolver construction here.
- */
-export declare function resolveLoadedDynamicToolDefinition(value: unknown, source: DynamicToolResolverSource, eventNames?: readonly string[]): ResolvedDynamicToolResolver;
-export {};

package/dist/src/runtime/resolve-dynamic-tool.js

@@ -1 +1 @@
-import{expectFunction,expectObjectRecord}from"#internal/authored-module.js";import{toErrorMessage}from"#shared/errors.js";import{isDynamicSentinel}from"#dynamic/definition.js";import{registerDefinitionSource,stampDefinitionKey}from"#internal/authored-definition/source-identity.js";import{ResolveAgentError,loadResolvedModuleExport}from"#runtime/resolve-helpers.js";async function resolveDynamicToolDefinition(e,t,n){try{return resolveLoadedDynamicToolDefinition(await loadResolvedModuleExport({definition:e,kindLabel:`dynamic-tool`,moduleMap:t,nodeId:n}),e,e.eventNames)}catch(t){throw t instanceof ResolveAgentError?t:new ResolveAgentError(`Failed to resolve dynamic tool from "${e.logicalPath}": ${toErrorMessage(t)}`,{logicalPath:e.logicalPath,sourceId:e.sourceId})}}function resolveLoadedDynamicToolDefinition(e,t,n){let r=expectDynamicToolValue(e,t);return createResolvedDynamicToolResolver(r,t,n??Object.keys(r.events))}function createResolvedDynamicToolResolver(e,t,n){let r={};for(let i of n)r[i]=expectFunction(e.events[i],describe(t,`to provide a handler for event "${i}"`));let i=`dynamic-tool-source:${t.sourceId}`;return stampDefinitionKey(e,i),registerDefinitionSource(i,{kind:`tool`,logicalPath:t.logicalPath,name:t.slug}),{eventNames:[...n],events:r,exportName:t.exportName,extensionNamespace:t.extensionNamespace,logicalPath:t.logicalPath,rebindMissingCallbacks:t.rebindMissingCallbacks,slug:t.slug,sourceId:t.sourceId,sourceKind:`module`}}function expectDynamicToolValue(e,t){let n=expectObjectRecord(e,describe(t,`to return an object`));if(!isDynamicSentinel(n))throw Error(describe(t,`to be created by defineDynamic()`));return expectObjectRecord(n.events,describe(t,`to provide an events object`)),n}function describe(e,t){return`Expected the dynamic tool export "${e.exportName??`default`}" from "${e.logicalPath}" ${t}.`}export{resolveDynamicToolDefinition,resolveLoadedDynamicToolDefinition};
+import{expectFunction,expectObjectRecord}from"#internal/authored-module.js";import{toErrorMessage}from"#shared/errors.js";import{isDynamicSentinel}from"#dynamic/definition.js";import{registerDefinitionSource,stampDefinitionKey}from"#internal/authored-definition/source-identity.js";import{ResolveAgentError,loadResolvedModuleExport}from"#runtime/resolve-helpers.js";async function resolveDynamicToolDefinition(e,t,n){try{return resolveLoadedDynamicToolDefinition(await loadResolvedModuleExport({definition:e,kindLabel:`dynamic-tool`,moduleMap:t,nodeId:n}),e,e.eventNames)}catch(t){throw t instanceof ResolveAgentError?t:new ResolveAgentError(`Failed to resolve dynamic tool from "${e.logicalPath}": ${toErrorMessage(t)}`,{logicalPath:e.logicalPath,sourceId:e.sourceId})}}function resolveLoadedDynamicToolDefinition(e,t,n){let r=expectDynamicToolValue(e,t);return createResolvedDynamicToolResolver(r,t,n??Object.keys(r.events))}function createResolvedDynamicToolResolver(e,t,n){let r={};for(let i of n)r[i]=expectFunction(e.events[i],describe(t,`to provide a handler for event "${i}"`));let i=`dynamic-tool-source:${t.sourceId}`;return stampDefinitionKey(e,i),registerDefinitionSource(i,{kind:`tool`,logicalPath:t.logicalPath,name:t.slug}),{eventNames:[...n],events:r,exportName:t.exportName,extensionNamespace:t.extensionNamespace,logicalPath:t.logicalPath,rebindMissingCallbacks:t.rebindMissingCallbacks,slug:t.slug,sourceId:t.sourceId,sourceKind:`module`}}function expectDynamicToolValue(e,t){let n=expectObjectRecord(e,describe(t,`to return an object`));if(!isDynamicSentinel(n))throw Error(describe(t,`to be created by defineDynamic()`));return expectObjectRecord(n.events,describe(t,`to provide an events object`)),n}function describe(e,t){return`Expected the dynamic tool export "${e.exportName??`default`}" from "${e.logicalPath}" ${t}.`}export{resolveDynamicToolDefinition};

package/dist/src/runtime/sandbox/prepared-artifacts.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimeCompiledArtifactsSource } from "#runtime/compiled-artifacts-source.js";
-import { type SandboxPreparedArtifactEntry, type SandboxPreparedArtifactsManifest } from "#shared/sandbox-prepared-artifacts.js";
+import { type SandboxPreparedArtifactEntry } from "#shared/sandbox-prepared-artifacts.js";
 import type { SandboxPreparedArtifact } from "#shared/sandbox-provider.js";
 export declare function writeSandboxPreparedArtifactsManifest(input: {
     readonly compileDirectoryPath: string;
@@ -10,4 +10,3 @@ export declare function loadSandboxPreparedArtifact(input: {
     readonly nodeId: string;
     readonly providerName: string;
 }): Promise<SandboxPreparedArtifact | undefined>;
-export declare function loadSandboxPreparedArtifactsManifest(source: RuntimeCompiledArtifactsSource): Promise<SandboxPreparedArtifactsManifest | null>;

package/dist/src/runtime/sandbox/prepared-artifacts.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{readFile,rename,rm,writeFile}from"node:fs/promises";import{createSandboxPreparedArtifactsManifest,sandboxPreparedArtifactsManifestSchema}from"#shared/sandbox-prepared-artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";async function writeSandboxPreparedArtifactsManifest(e){if(e.entries.length===0)return;let t=`${e.compileDirectoryPath}/sandbox-prepared-artifacts.json`,n=null;try{n=sandboxPreparedArtifactsManifestSchema.parse(JSON.parse(await readFile(t,`utf8`)))}catch(e){if(!(e instanceof Error&&`code`in e&&e.code===`ENOENT`))throw e}let r=new Map(n?.entries.map(e=>[e.nodeId,e]));for(let t of e.entries)r.set(t.nodeId,t);let i=`${t}.${randomUUID()}.tmp`;try{await writeFile(i,`${JSON.stringify(createSandboxPreparedArtifactsManifest([...r.values()]),null,2)}\n`),await rename(i,t)}finally{await rm(i,{force:!0})}}async function loadSandboxPreparedArtifact(e){let t=(await loadSandboxPreparedArtifactsManifest(e.compiledArtifactsSource))?.entries.find(t=>t.nodeId===e.nodeId);if(t!==void 0&&t.providerName!==e.providerName)throw Error(`Prepared sandbox artifact for node "${e.nodeId}" belongs to provider "${t.providerName}", not "${e.providerName}".`);return t?.artifact}async function loadSandboxPreparedArtifactsManifest(e){if(e.kind===`bundled`)return readBundledCompiledArtifacts()?.sandboxPreparedArtifacts??null;let t=resolveRuntimeCompilerArtifactPaths(e.appRoot).sandboxPreparedArtifactsPath;try{return sandboxPreparedArtifactsManifestSchema.parse(JSON.parse(await readFile(t,`utf8`)))}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return null;throw e}}export{loadSandboxPreparedArtifact,loadSandboxPreparedArtifactsManifest,writeSandboxPreparedArtifactsManifest};
+import{randomUUID}from"node:crypto";import{readFile,rename,rm,writeFile}from"node:fs/promises";import{createSandboxPreparedArtifactsManifest,sandboxPreparedArtifactsManifestSchema}from"#shared/sandbox-prepared-artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";async function writeSandboxPreparedArtifactsManifest(e){if(e.entries.length===0)return;let t=`${e.compileDirectoryPath}/sandbox-prepared-artifacts.json`,n=null;try{n=sandboxPreparedArtifactsManifestSchema.parse(JSON.parse(await readFile(t,`utf8`)))}catch(e){if(!(e instanceof Error&&`code`in e&&e.code===`ENOENT`))throw e}let r=new Map(n?.entries.map(e=>[e.nodeId,e]));for(let t of e.entries)r.set(t.nodeId,t);let i=`${t}.${randomUUID()}.tmp`;try{await writeFile(i,`${JSON.stringify(createSandboxPreparedArtifactsManifest([...r.values()]),null,2)}\n`),await rename(i,t)}finally{await rm(i,{force:!0})}}async function loadSandboxPreparedArtifact(e){let t=(await loadSandboxPreparedArtifactsManifest(e.compiledArtifactsSource))?.entries.find(t=>t.nodeId===e.nodeId);if(t!==void 0&&t.providerName!==e.providerName)throw Error(`Prepared sandbox artifact for node "${e.nodeId}" belongs to provider "${t.providerName}", not "${e.providerName}".`);return t?.artifact}async function loadSandboxPreparedArtifactsManifest(e){if(e.kind===`bundled`)return readBundledCompiledArtifacts()?.sandboxPreparedArtifacts??null;let t=resolveRuntimeCompilerArtifactPaths(e.appRoot).sandboxPreparedArtifactsPath;try{return sandboxPreparedArtifactsManifestSchema.parse(JSON.parse(await readFile(t,`utf8`)))}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return null;throw e}}export{loadSandboxPreparedArtifact,writeSandboxPreparedArtifactsManifest};

package/dist/src/runtime/schedules/register.d.ts

@@ -1,8 +1,4 @@
 import type { ResolvedScheduleDefinition } from "#runtime/types.js";
-/**
- * Stable Nitro task-name prefix for framework-owned authored schedules.
- */
-export declare const EVE_SCHEDULE_TASK_NAME_PREFIX = "eve.schedule.";
 /**
  * One compiled schedule registration consumed by the Nitro host wiring.
  */

package/dist/src/runtime/schedules/register.js

@@ -1 +1 @@
-const EVE_SCHEDULE_TASK_NAME_PREFIX=`eve.schedule.`;var ScheduleRegistrationError=class extends Error{scheduleId;sourceId;taskName;constructor(e,t={}){super(e),this.name=`ScheduleRegistrationError`,t.scheduleId!==void 0&&(this.scheduleId=t.scheduleId),t.sourceId!==void 0&&(this.sourceId=t.sourceId),t.taskName!==void 0&&(this.taskName=t.taskName)}};function createScheduleRegistrations(e){let t=e.map(e=>({cron:e.cron,description:`Run eve schedule "${e.name}" from "${e.logicalPath}".`,logicalPath:e.logicalPath,scheduleId:e.name,sourceId:e.sourceId,taskName:createScheduleTaskName(e.sourceId)})).sort((e,t)=>e.sourceId.localeCompare(t.sourceId));return assertUniqueScheduleIds(t),t}function assertUniqueScheduleIds(e){let t=new Map;for(let n of e){let e=t.get(n.scheduleId);if(e===void 0){t.set(n.scheduleId,n);continue}throw new ScheduleRegistrationError(`Duplicate authored schedule id "${n.scheduleId}" found in "${e.logicalPath}" and "${n.logicalPath}".`,{scheduleId:n.scheduleId,sourceId:n.sourceId,taskName:n.taskName})}}function createScheduleTaskName(e){return`${EVE_SCHEDULE_TASK_NAME_PREFIX}${Buffer.from(e,`utf8`).toString(`base64url`)}`}export{EVE_SCHEDULE_TASK_NAME_PREFIX,ScheduleRegistrationError,createScheduleRegistrations};
+var ScheduleRegistrationError=class extends Error{scheduleId;sourceId;taskName;constructor(e,t={}){super(e),this.name=`ScheduleRegistrationError`,t.scheduleId!==void 0&&(this.scheduleId=t.scheduleId),t.sourceId!==void 0&&(this.sourceId=t.sourceId),t.taskName!==void 0&&(this.taskName=t.taskName)}};function createScheduleRegistrations(e){let t=e.map(e=>({cron:e.cron,description:`Run eve schedule "${e.name}" from "${e.logicalPath}".`,logicalPath:e.logicalPath,scheduleId:e.name,sourceId:e.sourceId,taskName:createScheduleTaskName(e.sourceId)})).sort((e,t)=>e.sourceId.localeCompare(t.sourceId));return assertUniqueScheduleIds(t),t}function assertUniqueScheduleIds(e){let t=new Map;for(let n of e){let e=t.get(n.scheduleId);if(e===void 0){t.set(n.scheduleId,n);continue}throw new ScheduleRegistrationError(`Duplicate authored schedule id "${n.scheduleId}" found in "${e.logicalPath}" and "${n.logicalPath}".`,{scheduleId:n.scheduleId,sourceId:n.sourceId,taskName:n.taskName})}}function createScheduleTaskName(e){return`eve.schedule.${Buffer.from(e,`utf8`).toString(`base64url`)}`}export{ScheduleRegistrationError,createScheduleRegistrations};

package/dist/src/self-modification/credentials.d.ts

@@ -1,9 +1,6 @@
-import type { GitHubCredentialProvider, GitHubCredentialRequest, ResolvedGitHubCredentials } from "./config.js";
+import type { GitHubCredentialProvider, ResolvedGitHubCredentials } from "./config.js";
 export declare const SELF_MODIFICATION_GITHUB_TOKEN_ENV = "EVE_SELF_MODIFICATION_GITHUB_TOKEN";
 /** Checks PAT availability without returning the credential. */
 export declare function hasGitHubCredential(): boolean;
 /** Constructs the configured provider without resolving a credential. */
 export declare function createGitHubCredentialProvider(credentials: ResolvedGitHubCredentials): GitHubCredentialProvider;
-/** Resolves a PAT GitHub credential without exposing it to authored code. */
-export declare function resolveGitHubCredential(request: GitHubCredentialRequest): Promise<string>;
-export declare const defaultGitHubCredentialProvider: GitHubCredentialProvider;

package/dist/src/self-modification/credentials.js

@@ -1 +1 @@
-const SELF_MODIFICATION_GITHUB_TOKEN_ENV=`EVE_SELF_MODIFICATION_GITHUB_TOKEN`;function hasGitHubCredential(){return(process.env.EVE_SELF_MODIFICATION_GITHUB_TOKEN?.trim().length??0)>0}function createGitHubCredentialProvider(e){return e.kind===`pat`?defaultGitHubCredentialProvider:{async resolve(t){let n=await e.provider.resolve(t);if(typeof n!=`string`||n.trim().length===0)throw Error(`Self-modification credential provider returned an empty GitHub token.`);return n.trim()}}}async function resolveGitHubCredential(e){return defaultGitHubCredentialProvider.resolve(e)}const defaultGitHubCredentialProvider={async resolve(){let e=process.env[SELF_MODIFICATION_GITHUB_TOKEN_ENV];if(e===void 0||e.trim().length===0)throw Error(`Self-modification requires ${SELF_MODIFICATION_GITHUB_TOKEN_ENV} in the deployment environment.`);return e.trim()}};export{SELF_MODIFICATION_GITHUB_TOKEN_ENV,createGitHubCredentialProvider,defaultGitHubCredentialProvider,hasGitHubCredential,resolveGitHubCredential};
+const SELF_MODIFICATION_GITHUB_TOKEN_ENV=`EVE_SELF_MODIFICATION_GITHUB_TOKEN`;function hasGitHubCredential(){return(process.env.EVE_SELF_MODIFICATION_GITHUB_TOKEN?.trim().length??0)>0}function createGitHubCredentialProvider(e){return e.kind===`pat`?defaultGitHubCredentialProvider:{async resolve(t){let n=await e.provider.resolve(t);if(typeof n!=`string`||n.trim().length===0)throw Error(`Self-modification credential provider returned an empty GitHub token.`);return n.trim()}}}const defaultGitHubCredentialProvider={async resolve(){let e=process.env[SELF_MODIFICATION_GITHUB_TOKEN_ENV];if(e===void 0||e.trim().length===0)throw Error(`Self-modification requires ${SELF_MODIFICATION_GITHUB_TOKEN_ENV} in the deployment environment.`);return e.trim()}};export{SELF_MODIFICATION_GITHUB_TOKEN_ENV,createGitHubCredentialProvider,hasGitHubCredential};

package/dist/src/self-modification/filesystem.d.ts

@@ -5,4 +5,3 @@ export declare function createSelfModificationFilesystem(input: {
     resolveProjectPath?(path: string): string;
     readonly justBash: typeof import("just-bash");
 }): Promise<IFileSystem>;
-export declare const createLocalSelfModificationFilesystem: typeof createSelfModificationFilesystem;

package/dist/src/self-modification/filesystem.js

@@ -1 +1 @@
-import{mkdir}from"node:fs/promises";import{resolve}from"node:path";import{getLocalDevCapability}from"eve/local-dev";async function createSelfModificationFilesystem(e){let t=getLocalDevCapability();if(t===void 0)throw Error(`Self-modification requires eve dev facilities for the authored source tree and watcher.`);let{MountableFs:n,OverlayFs:r,ReadWriteFs:i}=e.justBash,a=t.appRoot,o=resolve(a,`.eve/traces/v1`),s=resolve(a,`.eve/logs`);return await Promise.all([e.defaultFilesystem.mkdir(`/source`,{recursive:!0}),mkdir(o,{recursive:!0}),mkdir(s,{recursive:!0})]),new n({base:e.defaultFilesystem,mounts:[{filesystem:new i({allowSymlinks:!1,maxFileReadSize:2**53-1,root:resolve(a,`agent`)}),mountPoint:`/source`},{filesystem:new r({mountPoint:`/`,readOnly:!0,root:o}),mountPoint:`/traces`},{filesystem:new r({mountPoint:`/`,readOnly:!0,root:s}),mountPoint:`/logs`},{filesystem:new r({mountPoint:`/`,readOnly:!0,root:resolve(a,`node_modules/eve/docs`)}),mountPoint:`/eve-docs`}]})}const createLocalSelfModificationFilesystem=createSelfModificationFilesystem;export{createLocalSelfModificationFilesystem,createSelfModificationFilesystem};
+import{mkdir}from"node:fs/promises";import{resolve}from"node:path";import{getLocalDevCapability}from"eve/local-dev";async function createSelfModificationFilesystem(e){let t=getLocalDevCapability();if(t===void 0)throw Error(`Self-modification requires eve dev facilities for the authored source tree and watcher.`);let{MountableFs:n,OverlayFs:r,ReadWriteFs:i}=e.justBash,a=t.appRoot,o=resolve(a,`.eve/traces/v1`),s=resolve(a,`.eve/logs`);return await Promise.all([e.defaultFilesystem.mkdir(`/source`,{recursive:!0}),mkdir(o,{recursive:!0}),mkdir(s,{recursive:!0})]),new n({base:e.defaultFilesystem,mounts:[{filesystem:new i({allowSymlinks:!1,maxFileReadSize:2**53-1,root:resolve(a,`agent`)}),mountPoint:`/source`},{filesystem:new r({mountPoint:`/`,readOnly:!0,root:o}),mountPoint:`/traces`},{filesystem:new r({mountPoint:`/`,readOnly:!0,root:s}),mountPoint:`/logs`},{filesystem:new r({mountPoint:`/`,readOnly:!0,root:resolve(a,`node_modules/eve/docs`)}),mountPoint:`/eve-docs`}]})}export{createSelfModificationFilesystem};

package/dist/src/self-modification/git-workspace.d.ts

@@ -5,9 +5,7 @@ type NetworkPolicySandboxSession = SandboxSession & {
 };
 import type { GitHubRepository } from "./config.js";
 export declare const SELF_MODIFICATION_CONFIG_PATH = "agent/extensions/self-modification/extension.ts";
-export declare const WORKSPACE_PATH = "/workspace";
 export declare const REPOSITORY_PATH = "/workspace/repository";
-export declare const BASE_REF = "refs/eve-self-modification/base";
 export interface PreparedSelfModificationWorkspace {
     readonly baseSha: string;
     readonly directory: string;
@@ -31,5 +29,4 @@ export declare function readPreparedSelfModificationWorkspace(input: {
     readonly sandbox: Pick<SandboxSession, "run">;
     readonly targetBranch: string;
 }): Promise<PreparedSelfModificationWorkspace>;
-export declare function verifyApplicationRoot(sandbox: Pick<SandboxSession, "run">, directory: string): Promise<void>;
 export {};

package/dist/src/self-modification/git-workspace.js

@@ -1 +1 @@
-import{assertFullSha,assertGitRef}from"./identifiers.js";import{gitOutput,runGitCommand,withBrokeredGitHubCredential}from"./git.js";import{shellQuote}from"#shared/shell-quote.js";import{gitHubRemoteUrl}from"#shared/git.js";const SELF_MODIFICATION_CONFIG_PATH=`agent/extensions/self-modification/extension.ts`,WORKSPACE_PATH=`/workspace`,REPOSITORY_PATH=`${WORKSPACE_PATH}/repository`,BASE_REF=`refs/eve-self-modification/base`;async function prepareSelfModificationWorkspace(e){assertGitRef(e.targetBranch,`target branch`);let t=gitHubRemoteUrl(e.repository);await withBrokeredGitHubCredential(e.sandbox,e.token,async()=>{await run(e.sandbox,`rm -rf ${quote(REPOSITORY_PATH)} && mkdir -p ${quote(REPOSITORY_PATH)}`),await run(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} init`),await run(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} remote add origin ${quote(t)}`),await run(e.sandbox,`GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_LFS_SKIP_SMUDGE=1 GIT_TERMINAL_PROMPT=0 git -C ${quote(REPOSITORY_PATH)} fetch --no-tags origin ${quote(`refs/heads/${e.targetBranch}`)}`),await run(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} update-ref ${BASE_REF} FETCH_HEAD`),await run(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} checkout --detach ${BASE_REF}`)});let n=await gitOutput(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} rev-parse ${BASE_REF}`);return assertFullSha(n,`target branch revision`),await verifyApplicationRoot(e.sandbox,e.directory),{baseSha:n,directory:e.directory,repository:e.repository,repositoryPath:REPOSITORY_PATH,targetBranch:e.targetBranch}}async function readPreparedSelfModificationWorkspace(e){let t=await gitOutput(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} rev-parse ${BASE_REF}`);return assertFullSha(t,`target branch revision`),await verifyApplicationRoot(e.sandbox,e.directory),{baseSha:t,directory:e.directory,repository:e.repository,repositoryPath:REPOSITORY_PATH,targetBranch:e.targetBranch}}async function verifyApplicationRoot(e,t){let n=t===`.`?REPOSITORY_PATH:`${REPOSITORY_PATH}/${t}`;if((await e.run({command:`test -d ${quote(`${n}/agent`)}`})).exitCode!==0)throw Error(`Self-modification source directory does not contain agent/: ${t}`)}function quote(e){return shellQuote(e)}async function run(e,t){await runGitCommand(e,t)}export{BASE_REF,REPOSITORY_PATH,SELF_MODIFICATION_CONFIG_PATH,WORKSPACE_PATH,prepareSelfModificationWorkspace,readPreparedSelfModificationWorkspace,verifyApplicationRoot};
+import{assertFullSha,assertGitRef}from"./identifiers.js";import{gitOutput,runGitCommand,withBrokeredGitHubCredential}from"./git.js";import{shellQuote}from"#shared/shell-quote.js";import{gitHubRemoteUrl}from"#shared/git.js";const SELF_MODIFICATION_CONFIG_PATH=`agent/extensions/self-modification/extension.ts`,REPOSITORY_PATH=`/workspace/repository`,BASE_REF=`refs/eve-self-modification/base`;async function prepareSelfModificationWorkspace(e){assertGitRef(e.targetBranch,`target branch`);let t=gitHubRemoteUrl(e.repository);await withBrokeredGitHubCredential(e.sandbox,e.token,async()=>{await run(e.sandbox,`rm -rf ${quote(REPOSITORY_PATH)} && mkdir -p ${quote(REPOSITORY_PATH)}`),await run(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} init`),await run(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} remote add origin ${quote(t)}`),await run(e.sandbox,`GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_LFS_SKIP_SMUDGE=1 GIT_TERMINAL_PROMPT=0 git -C ${quote(REPOSITORY_PATH)} fetch --no-tags origin ${quote(`refs/heads/${e.targetBranch}`)}`),await run(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} update-ref ${BASE_REF} FETCH_HEAD`),await run(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} checkout --detach ${BASE_REF}`)});let n=await gitOutput(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} rev-parse ${BASE_REF}`);return assertFullSha(n,`target branch revision`),await verifyApplicationRoot(e.sandbox,e.directory),{baseSha:n,directory:e.directory,repository:e.repository,repositoryPath:REPOSITORY_PATH,targetBranch:e.targetBranch}}async function readPreparedSelfModificationWorkspace(e){let t=await gitOutput(e.sandbox,`git -C ${quote(REPOSITORY_PATH)} rev-parse ${BASE_REF}`);return assertFullSha(t,`target branch revision`),await verifyApplicationRoot(e.sandbox,e.directory),{baseSha:t,directory:e.directory,repository:e.repository,repositoryPath:REPOSITORY_PATH,targetBranch:e.targetBranch}}async function verifyApplicationRoot(e,t){let n=t===`.`?REPOSITORY_PATH:`${REPOSITORY_PATH}/${t}`;if((await e.run({command:`test -d ${quote(`${n}/agent`)}`})).exitCode!==0)throw Error(`Self-modification source directory does not contain agent/: ${t}`)}function quote(e){return shellQuote(e)}async function run(e,t){await runGitCommand(e,t)}export{REPOSITORY_PATH,SELF_MODIFICATION_CONFIG_PATH,prepareSelfModificationWorkspace,readPreparedSelfModificationWorkspace};

package/dist/src/self-modification/github-publisher.d.ts

@@ -12,7 +12,7 @@ export interface PublishedSelfModificationProposal {
     readonly merged: false;
     readonly deployed: false;
 }
-export interface GitHubDraftPublisherInput {
+interface GitHubDraftPublisherInput {
     readonly credentialProvider: GitHubCredentialProvider;
     readonly description: string;
     readonly fetch?: typeof fetch;
@@ -25,3 +25,4 @@ export interface GitHubDraftPublisherInput {
 /** Captures agent-only edits, then publishes one replay-safe draft pull request. */
 export declare function publishGitHubDraftPullRequest(input: GitHubDraftPublisherInput): Promise<PublishedSelfModificationProposal>;
 export declare function selfModificationBranchName(baseSha: string, operationId: string): string;
+export {};

package/dist/src/self-modification/migration.d.ts

@@ -1,4 +1,3 @@
-export declare const LEGACY_SELF_MODIFICATION_ROOT = "agent/subagents/self-modification";
 export interface LegacySelfModificationScaffold {
     readonly root: string;
     readonly paths: readonly string[];

package/dist/src/self-modification/migration.js

@@ -25,4 +25,4 @@ export default defineSelfModificationConfig({
 import config from "../config";
 
 export default selfModification(config);
-`]};async function detectLegacySelfModificationScaffold(e){let t=join(e,LEGACY_SELF_MODIFICATION_ROOT),n=await listFiles(t);if(!n.includes(`agent.ts`))return;let r=await readText(join(t,`agent.ts`));if(r===void 0||!r.includes(`defineSelfModificationAgent`))return;let i=new Set(LEGACY_FILES),a=JSON.stringify(await Promise.all(n.map(async e=>[e,await readText(join(t,e))]))),o=n.some(e=>!i.has(e))||(await Promise.all(Object.entries(LEGACY_DEFAULTS).map(async([e,n])=>{let r=await readText(join(t,e));return r===void 0||!n.includes(r)}))).some(Boolean)||!r.includes(`from "eve/self-modification/agent"`)||(await readText(join(t,`sandbox.ts`)))?.includes(`from "eve/self-modification/sandbox"`)!==!0;return{root:t,paths:n.map(e=>join(LEGACY_SELF_MODIFICATION_ROOT,e)),customized:o,signature:a}}async function removeLegacySelfModificationScaffold(e,t){let n=await detectLegacySelfModificationScaffold(e);if(n===void 0||n.root!==t.root||n.customized!==t.customized||n.signature!==t.signature)throw Error(`The self-modification scaffold changed while setup was waiting for cleanup approval.`);await rm(t.root,{recursive:!0,force:!0})}async function listFiles(e){try{return(await readdir(e,{recursive:!0,withFileTypes:!0})).filter(e=>e.isFile()).map(t=>relative(e,join(t.parentPath,t.name)).replaceAll(`\\`,`/`)).sort()}catch(e){if(e.code===`ENOENT`)return[];throw e}}async function readText(e){try{return await readFile(e,`utf8`)}catch(e){if(e.code===`ENOENT`)return;throw e}}export{LEGACY_SELF_MODIFICATION_ROOT,detectLegacySelfModificationScaffold,removeLegacySelfModificationScaffold};
+`]};async function detectLegacySelfModificationScaffold(e){let t=join(e,LEGACY_SELF_MODIFICATION_ROOT),n=await listFiles(t);if(!n.includes(`agent.ts`))return;let r=await readText(join(t,`agent.ts`));if(r===void 0||!r.includes(`defineSelfModificationAgent`))return;let i=new Set(LEGACY_FILES),a=JSON.stringify(await Promise.all(n.map(async e=>[e,await readText(join(t,e))]))),o=n.some(e=>!i.has(e))||(await Promise.all(Object.entries(LEGACY_DEFAULTS).map(async([e,n])=>{let r=await readText(join(t,e));return r===void 0||!n.includes(r)}))).some(Boolean)||!r.includes(`from "eve/self-modification/agent"`)||(await readText(join(t,`sandbox.ts`)))?.includes(`from "eve/self-modification/sandbox"`)!==!0;return{root:t,paths:n.map(e=>join(LEGACY_SELF_MODIFICATION_ROOT,e)),customized:o,signature:a}}async function removeLegacySelfModificationScaffold(e,t){let n=await detectLegacySelfModificationScaffold(e);if(n===void 0||n.root!==t.root||n.customized!==t.customized||n.signature!==t.signature)throw Error(`The self-modification scaffold changed while setup was waiting for cleanup approval.`);await rm(t.root,{recursive:!0,force:!0})}async function listFiles(e){try{return(await readdir(e,{recursive:!0,withFileTypes:!0})).filter(e=>e.isFile()).map(t=>relative(e,join(t.parentPath,t.name)).replaceAll(`\\`,`/`)).sort()}catch(e){if(e.code===`ENOENT`)return[];throw e}}async function readText(e){try{return await readFile(e,`utf8`)}catch(e){if(e.code===`ENOENT`)return;throw e}}export{detectLegacySelfModificationScaffold,removeLegacySelfModificationScaffold};

package/dist/src/self-modification/mode.d.ts

@@ -1,4 +1,5 @@
 import type { ResolvedSelfModificationConfig } from "./config.js";
-export type SelfModificationMode = "local" | "disabled" | "deployed";
+type SelfModificationMode = "local" | "disabled" | "deployed";
 /** Resolves the mutually exclusive local or deployed editing mode. */
 export declare function resolveSelfModificationMode(config: ResolvedSelfModificationConfig): SelfModificationMode;
+export {};

package/dist/src/self-modification/proposal.d.ts

@@ -1,7 +1,5 @@
 import type { SandboxSession } from "eve/sandbox";
 import type { PreparedSelfModificationWorkspace } from "./git-workspace.js";
-export declare const MAX_PROPOSAL_CHANGED_BYTES = 1000000;
-export declare const MAX_PROPOSAL_CHANGED_FILES = 100;
 export interface ProposalChange {
     readonly bytes: number;
     readonly kind: "add" | "delete" | "modify";

package/dist/src/self-modification/proposal.js

@@ -1,2 +1,2 @@
-import{assertFullSha}from"./identifiers.js";import{gitOutput,runGitCommand}from"./git.js";import{createHash}from"node:crypto";import{shellQuote}from"#shared/shell-quote.js";const MAX_PROPOSAL_CHANGED_BYTES=1e6,MAX_PROPOSAL_CHANGED_FILES=100;async function captureSelfModificationProposal(e){let t=quote(e.workspace.repositoryPath);assertFullSha(e.workspace.baseSha,`proposal base revision`),await runGitCommand(e.sandbox,`git -C ${t} add -A -- .`);let n=await gitOutput(e.sandbox,`git -C ${t} write-tree`),r=await gitOutput(e.sandbox,`git -C ${t} rev-parse ${quote(`${e.workspace.baseSha}^{tree}`)}`);assertFullSha(n,`proposal tree`),assertFullSha(r,`proposal base tree`);let i=parseRawDiff(await gitOutput(e.sandbox,`git -C ${t} diff-tree -r --no-commit-id --raw -z --no-renames ${quote(e.workspace.baseSha)} ${quote(n)}`,!1));if(i.length===0)throw Error(`Self-modification proposal contains no changes.`);if(i.length>100)throw Error(`Self-modification proposal changes ${i.length} files; limit is 100.`);let a=await selfModificationMountPaths({directory:e.workspace.directory,repositoryPath:e.workspace.repositoryPath,sandbox:e.sandbox,tree:e.workspace.baseSha}),o=await selfModificationMountPaths({directory:e.workspace.directory,repositoryPath:e.workspace.repositoryPath,sandbox:e.sandbox,tree:n}),s=[...new Set([...a,...o])],c=[],l=0;for(let t of i){let n=t.status===`D`?null:proposalMode(t.newMode,t.path),r=t.status===`D`?null:t.newObjectId;assertAllowedChange({mode:n,objectId:r,path:t.path},e.workspace.directory,s);let i=r===null?0:await blobSize(e.sandbox,e.workspace.repositoryPath,r);if(l+=i,l>1e6)throw Error(`Self-modification proposal changes more than ${MAX_PROPOSAL_CHANGED_BYTES} bytes.`);c.push({bytes:i,kind:t.status===`A`?`add`:t.status===`D`?`delete`:`modify`,mode:n,objectId:r,path:t.path})}return{baseSha:e.workspace.baseSha,baseTreeSha:r,changedBytes:l,changes:c,proposedTreeSha:n}}async function readProposalBlob(e){if(e.change.objectId===null)throw Error(`Cannot read a deleted proposal blob.`);let t=await gitOutput(e.sandbox,`git -C ${quote(e.workspace.repositoryPath)} cat-file blob ${quote(e.change.objectId)} | base64 | tr -d '\\n'`),n=Buffer.from(t,`base64`),r=createHash(`sha1`).update(`blob ${n.byteLength}\0`).update(n).digest(`hex`);if(n.byteLength!==e.change.bytes||r!==e.change.objectId.toLowerCase())throw Error(`Self-modification proposal blob changed after validation: ${JSON.stringify(e.change.path)}.`);return t}function parseRawDiff(e){if(e.length===0)return[];let t=e.split(`\0`);if(t.at(-1)===``&&t.pop(),t.length%2!=0)throw Error(`Git returned malformed raw diff output.`);let n=[];for(let e=0;e<t.length;e+=2){let r=t[e],i=t[e+1],a=r===void 0?null:/^:[0-7]{6} ([0-7]{6}) [a-f0-9]{40} ([a-f0-9]{40}) ([ADM])$/u.exec(r);if(a===null||i===void 0||!isSafePath(i))throw Error(`Git returned malformed raw diff output.`);n.push({newMode:a[1],newObjectId:a[2],path:i,status:a[3]})}return n}function assertAllowedChange(e,t,n=[]){let r=e.path,i=t===`.`?``:`${t}/`,a=`${i}agent/`,o=r.split(`/`),s=o.at(-1)??``;if(!isSafePath(r)||o.includes(`.git`)||s===`.env`||s===`.envrc`||s.startsWith(`.env.`)||o.some(e=>[`node_modules`,`dist`,`build`,`.next`,`.output`,`.turbo`,`.vercel`,`coverage`,`out`].includes(e))||r.startsWith(`.github/workflows/`)||r.startsWith(`${a}subagents/self-modification/`)||r.startsWith(`${a}extensions/self-modification/`)||r===`${i}agent/extensions/self-modification.ts`||n.some(e=>r===e||r.startsWith(`${e}/`))||r===`${i}agent/extensions/selfmod.ts`||r===`${i}agent/self-modification.config.ts`)throw Error(`Self-modification proposal changes a protected path: ${JSON.stringify(r)}.`)}async function selfModificationMountPaths(e){let t=`${e.directory===`.`?``:`${e.directory}/`}agent/extensions`,n=await gitOutput(e.sandbox,`git -C ${quote(e.repositoryPath)} grep -l -z -F -- "eve/self-modification" ${quote(e.tree)} -- ${quote(t)}`,!1).catch(e=>{if(e instanceof Error&&e.message.includes(`failed with exit 1:`))return``;throw e});return[...new Set(n.split(`\0`).filter(Boolean).flatMap(e=>{let n=e.slice(e.indexOf(`:`)+1);if(!n.startsWith(`${t}/`))return[];let r=n.slice(t.length+1);return r.endsWith(`/extension.ts`)?[`${t}/${r.slice(0,-13)}`]:r.includes(`/`)?[`${t}/${r.split(`/`)[0]}`]:[n]}))]}function isSafePath(e){return e.length>0&&!e.startsWith(`/`)&&!e.includes(`\\`)&&!e.includes(`
-`)&&!e.includes(`\r`)&&!e.split(`/`).some(e=>e===``||e===`.`||e===`..`)}function proposalMode(e,t){if(e===`100644`||e===`100755`)return e;throw Error(`Self-modification proposal uses unsafe Git mode ${e}: ${JSON.stringify(t)}.`)}async function blobSize(e,t,n){assertFullSha(n,`proposal blob`);let r=await gitOutput(e,`git -C ${quote(t)} cat-file -s ${quote(n)}`);if(!/^\d+$/u.test(r)||!Number.isSafeInteger(Number(r)))throw Error(`Git returned an invalid blob size.`);return Number(r)}function quote(e){return shellQuote(e)}export{MAX_PROPOSAL_CHANGED_BYTES,MAX_PROPOSAL_CHANGED_FILES,assertAllowedChange,captureSelfModificationProposal,parseRawDiff,readProposalBlob};
+import{assertFullSha}from"./identifiers.js";import{gitOutput,runGitCommand}from"./git.js";import{createHash}from"node:crypto";import{shellQuote}from"#shared/shell-quote.js";const MAX_PROPOSAL_CHANGED_BYTES=1e6;async function captureSelfModificationProposal(e){let t=quote(e.workspace.repositoryPath);assertFullSha(e.workspace.baseSha,`proposal base revision`),await runGitCommand(e.sandbox,`git -C ${t} add -A -- .`);let n=await gitOutput(e.sandbox,`git -C ${t} write-tree`),r=await gitOutput(e.sandbox,`git -C ${t} rev-parse ${quote(`${e.workspace.baseSha}^{tree}`)}`);assertFullSha(n,`proposal tree`),assertFullSha(r,`proposal base tree`);let i=parseRawDiff(await gitOutput(e.sandbox,`git -C ${t} diff-tree -r --no-commit-id --raw -z --no-renames ${quote(e.workspace.baseSha)} ${quote(n)}`,!1));if(i.length===0)throw Error(`Self-modification proposal contains no changes.`);if(i.length>100)throw Error(`Self-modification proposal changes ${i.length} files; limit is 100.`);let a=await selfModificationMountPaths({directory:e.workspace.directory,repositoryPath:e.workspace.repositoryPath,sandbox:e.sandbox,tree:e.workspace.baseSha}),o=await selfModificationMountPaths({directory:e.workspace.directory,repositoryPath:e.workspace.repositoryPath,sandbox:e.sandbox,tree:n}),s=[...new Set([...a,...o])],c=[],l=0;for(let t of i){let n=t.status===`D`?null:proposalMode(t.newMode,t.path),r=t.status===`D`?null:t.newObjectId;assertAllowedChange({mode:n,objectId:r,path:t.path},e.workspace.directory,s);let i=r===null?0:await blobSize(e.sandbox,e.workspace.repositoryPath,r);if(l+=i,l>MAX_PROPOSAL_CHANGED_BYTES)throw Error(`Self-modification proposal changes more than ${MAX_PROPOSAL_CHANGED_BYTES} bytes.`);c.push({bytes:i,kind:t.status===`A`?`add`:t.status===`D`?`delete`:`modify`,mode:n,objectId:r,path:t.path})}return{baseSha:e.workspace.baseSha,baseTreeSha:r,changedBytes:l,changes:c,proposedTreeSha:n}}async function readProposalBlob(e){if(e.change.objectId===null)throw Error(`Cannot read a deleted proposal blob.`);let t=await gitOutput(e.sandbox,`git -C ${quote(e.workspace.repositoryPath)} cat-file blob ${quote(e.change.objectId)} | base64 | tr -d '\\n'`),n=Buffer.from(t,`base64`),r=createHash(`sha1`).update(`blob ${n.byteLength}\0`).update(n).digest(`hex`);if(n.byteLength!==e.change.bytes||r!==e.change.objectId.toLowerCase())throw Error(`Self-modification proposal blob changed after validation: ${JSON.stringify(e.change.path)}.`);return t}function parseRawDiff(e){if(e.length===0)return[];let t=e.split(`\0`);if(t.at(-1)===``&&t.pop(),t.length%2!=0)throw Error(`Git returned malformed raw diff output.`);let n=[];for(let e=0;e<t.length;e+=2){let r=t[e],i=t[e+1],a=r===void 0?null:/^:[0-7]{6} ([0-7]{6}) [a-f0-9]{40} ([a-f0-9]{40}) ([ADM])$/u.exec(r);if(a===null||i===void 0||!isSafePath(i))throw Error(`Git returned malformed raw diff output.`);n.push({newMode:a[1],newObjectId:a[2],path:i,status:a[3]})}return n}function assertAllowedChange(e,t,n=[]){let r=e.path,i=t===`.`?``:`${t}/`,a=`${i}agent/`,o=r.split(`/`),s=o.at(-1)??``;if(!isSafePath(r)||o.includes(`.git`)||s===`.env`||s===`.envrc`||s.startsWith(`.env.`)||o.some(e=>[`node_modules`,`dist`,`build`,`.next`,`.output`,`.turbo`,`.vercel`,`coverage`,`out`].includes(e))||r.startsWith(`.github/workflows/`)||r.startsWith(`${a}subagents/self-modification/`)||r.startsWith(`${a}extensions/self-modification/`)||r===`${i}agent/extensions/self-modification.ts`||n.some(e=>r===e||r.startsWith(`${e}/`))||r===`${i}agent/extensions/selfmod.ts`||r===`${i}agent/self-modification.config.ts`)throw Error(`Self-modification proposal changes a protected path: ${JSON.stringify(r)}.`)}async function selfModificationMountPaths(e){let t=`${e.directory===`.`?``:`${e.directory}/`}agent/extensions`,n=await gitOutput(e.sandbox,`git -C ${quote(e.repositoryPath)} grep -l -z -F -- "eve/self-modification" ${quote(e.tree)} -- ${quote(t)}`,!1).catch(e=>{if(e instanceof Error&&e.message.includes(`failed with exit 1:`))return``;throw e});return[...new Set(n.split(`\0`).filter(Boolean).flatMap(e=>{let n=e.slice(e.indexOf(`:`)+1);if(!n.startsWith(`${t}/`))return[];let r=n.slice(t.length+1);return r.endsWith(`/extension.ts`)?[`${t}/${r.slice(0,-13)}`]:r.includes(`/`)?[`${t}/${r.split(`/`)[0]}`]:[n]}))]}function isSafePath(e){return e.length>0&&!e.startsWith(`/`)&&!e.includes(`\\`)&&!e.includes(`
+`)&&!e.includes(`\r`)&&!e.split(`/`).some(e=>e===``||e===`.`||e===`..`)}function proposalMode(e,t){if(e===`100644`||e===`100755`)return e;throw Error(`Self-modification proposal uses unsafe Git mode ${e}: ${JSON.stringify(t)}.`)}async function blobSize(e,t,n){assertFullSha(n,`proposal blob`);let r=await gitOutput(e,`git -C ${quote(t)} cat-file -s ${quote(n)}`);if(!/^\d+$/u.test(r)||!Number.isSafeInteger(Number(r)))throw Error(`Git returned an invalid blob size.`);return Number(r)}function quote(e){return shellQuote(e)}export{assertAllowedChange,captureSelfModificationProposal,parseRawDiff,readProposalBlob};

package/dist/src/self-modification/setup.js

@@ -1,4 +1,4 @@
-import{SELF_MODIFICATION_CONFIG_PATH}from"./git-workspace.js";import{createHash}from"node:crypto";import{mkdir,readFile,writeFile}from"node:fs/promises";import{join,relative}from"node:path";import{discoverAgent}from"#discover/discover-agent.js";import{execFile}from"node:child_process";import{promisify}from"node:util";import{stripLogicalPathExtension}from"#discover/filesystem.js";import{captureVercel,runVercelCaptureStdout}from"#setup/primitives/run-vercel.js";const runFile=promisify(execFile),defaultDependencies={captureVercel,runVercelCaptureStdout};function connectorName(e,t){return`selfmod-${e}-${t}`.toLowerCase().replaceAll(/[^a-z0-9-]/gu,`-`)}function renderSelfModificationConfig(e){if(e===void 0)return`import selfModification from "eve/self-modification";
+import{SELF_MODIFICATION_CONFIG_PATH}from"./git-workspace.js";import{createHash}from"node:crypto";import{mkdir,readFile,writeFile}from"node:fs/promises";import{join,relative}from"node:path";import{execFile}from"node:child_process";import{promisify}from"node:util";import{stripLogicalPathExtension}from"#discover/filesystem.js";import{captureVercel,runVercelCaptureStdout}from"#setup/primitives/run-vercel.js";import{discoverAgent}from"#discover/discover-agent.js";const runFile=promisify(execFile),defaultDependencies={captureVercel,runVercelCaptureStdout};function connectorName(e,t){return`selfmod-${e}-${t}`.toLowerCase().replaceAll(/[^a-z0-9-]/gu,`-`)}function renderSelfModificationConfig(e){if(e===void 0)return`import selfModification from "eve/self-modification";
 
 export default selfModification({
   // model: "provider/model",

package/dist/src/services/dev-client/agent-info-probe.d.ts

@@ -1,5 +1,5 @@
 import { type AgentInfoResult, type Client } from "#client/index.js";
-export type AgentInfoProbeResult = {
+type AgentInfoProbeResult = {
     readonly kind: "ready";
     readonly info: AgentInfoResult;
 } | {
@@ -15,3 +15,4 @@ export declare function probeAgentInfo(input: {
     readonly client: Pick<Client, "info">;
     readonly timeoutMs?: number;
 }): Promise<AgentInfoProbeResult>;
+export {};

package/dist/src/services/dev-client/request-headers.d.ts

@@ -4,7 +4,7 @@ declare const VercelOidcClaimsSchema: z.ZodObject<{
     project_id: z.ZodString;
 }, z.core.$strip>;
 /** Vercel owner and project expected to have minted an OIDC token. */
-export interface DevelopmentOidcTarget {
+interface DevelopmentOidcTarget {
     readonly ownerId: string;
     readonly projectId: string;
     /** Ignore an ambient token and ask Vercel for this exact project. */

package/dist/src/setup/ai-gateway-api-key.d.ts

@@ -2,7 +2,7 @@ import { appendEnv } from "./append-env.js";
 export declare const AI_GATEWAY_API_KEY_ENV_VAR = "AI_GATEWAY_API_KEY";
 export declare const AI_GATEWAY_API_KEY_ENV_FILE = ".env.local";
 /** The location written by eve when a user supplies an AI Gateway API key. */
-export interface AiGatewayApiKeyLocation {
+interface AiGatewayApiKeyLocation {
     envKey: typeof AI_GATEWAY_API_KEY_ENV_VAR;
     envFile: typeof AI_GATEWAY_API_KEY_ENV_FILE;
     envPath: string;
@@ -13,3 +13,4 @@ export declare function writeAiGatewayApiKey(input: {
     apiKey: string;
     appendEnv?: typeof appendEnv;
 }): Promise<AiGatewayApiKeyLocation>;
+export {};

package/dist/src/setup/append-env.d.ts

@@ -1,8 +1,8 @@
-export interface AppendEnvOptions {
+interface AppendEnvOptions {
     /** Replace existing keys. Default: false (existing keys are preserved). */
     force?: boolean;
 }
-export interface AppendEnvResult {
+interface AppendEnvResult {
     /** Keys that were inserted or replaced. */
     written: string[];
     /** Keys that already existed and were preserved (only when `force` is false). */
@@ -19,3 +19,4 @@ export interface AppendEnvResult {
  * accurately ("already had X — kept your value").
  */
 export declare function appendEnv(envPath: string, values: Record<string, string>, options?: AppendEnvOptions): Promise<AppendEnvResult>;
+export {};

package/dist/src/setup/ask.d.ts

@@ -156,7 +156,7 @@ export interface Asker {
     askMany<T>(question: MultiSelectQuestion<T>): Promise<T[]>;
 }
 /** A ladder rung: wraps an asker and resolves (or rewrites) some questions. */
-export type AskerDecorator = (inner: Asker) => Asker;
+type AskerDecorator = (inner: Asker) => Asker;
 /** How a question got its value, so nothing is silently assumed. */
 export type ResolutionSource = "answer" | "detected" | "assumed" | "asked" | "skipped";
 /** One announced question outcome. */
@@ -166,7 +166,7 @@ export interface Resolution {
     source: ResolutionSource;
 }
 /** Every resolution is announced with its source: nothing is silently assumed. */
-export interface AskerEvents {
+interface AskerEvents {
     onResolved?: (resolution: Resolution) => void;
 }
 /**
@@ -195,7 +195,7 @@ export declare function withAnswers(answers: Record<string, unknown>, events?: A
  */
 export declare function withRequired(keys: readonly string[]): AskerDecorator;
 /** The two detected/recommended rungs of the ladder. */
-export type AnswerPolicy = "confirm-detected" | "assume";
+type AnswerPolicy = "confirm-detected" | "assume";
 /**
  * The detected/recommended rungs. "confirm-detected" turns a detected value
  * into a one-keystroke confirm (synthesized as an internal question through

package/dist/src/setup/boxes/apply-ai-gateway-credential.d.ts

@@ -10,7 +10,7 @@ export interface ApplyAiGatewayCredentialDeps {
     runVercelEnvPull: typeof runVercelEnvPull;
     detectAiGatewayResolution: typeof detectAiGatewayResolution;
 }
-export interface ApplyAiGatewayCredentialOptions {
+interface ApplyAiGatewayCredentialOptions {
     /** Reports credential progress and warnings. The box never prompts through it. */
     prompter: Prompter;
     deps?: ApplyAiGatewayCredentialDeps;
@@ -26,3 +26,4 @@ export interface ApplyAiGatewayCredentialOptions {
  * scaffolded provider block.
  */
 export declare function applyAiGatewayCredential(options: ApplyAiGatewayCredentialOptions): SetupBox<SetupState, null, ResolvedAiGatewayCredentials>;
+export {};

package/dist/src/setup/boxes/deploy-project.d.ts

@@ -14,7 +14,7 @@ export interface DeployProjectDeps {
     detectDeployment: typeof detectDeployment;
     syncHostFrameworkPreset: typeof syncHostFrameworkPreset;
 }
-export interface DeployProjectOptions {
+interface DeployProjectOptions {
     /** Deploy progress and command output stream through this log (rail styling preserved). */
     prompter: {
         log: ChannelSetupLog;
@@ -41,11 +41,11 @@ export interface DeployProjectOptions {
  * commands inside `perform`; it is fixed at composition time (the box prompts
  * for nothing) and passed straight through {@link DeployProjectOptions.headless}.
  */
-export interface DeployProjectInput {
+interface DeployProjectInput {
     headless: boolean;
 }
 /** The deploy facts `apply` records: the (re)deployed project and the cleared flags. */
-export interface DeployProjectPayload {
+interface DeployProjectPayload {
     project: ProjectResolution;
     deploymentPending: boolean;
     deploymentDependenciesInstalled: boolean;
@@ -70,3 +70,4 @@ export interface DeployProjectPayload {
  * gets the reconcile without composing a separate box.
  */
 export declare function deployProject(options: DeployProjectOptions): SetupBox<SetupState, DeployProjectInput, DeployProjectPayload>;
+export {};

package/dist/src/setup/boxes/link-project.d.ts

@@ -9,7 +9,7 @@ export interface LinkProjectDeps {
     detectProjectResolution: typeof detectProjectResolution;
     unresolvedProject: typeof unresolvedProject;
 }
-export interface LinkProjectOptions {
+interface LinkProjectOptions {
     /** Streams link progress and, in interactive runs, may confirm ambiguous framework detection. */
     prompter: Prompter;
     /** Headless runs must not ask follow-up questions after the plan is fixed. */
@@ -31,3 +31,4 @@ export interface LinkProjectOptions {
  * in `state.project`.
  */
 export declare function linkVercelProject(options: LinkProjectOptions): SetupBox<SetupState, null, ProjectResolution>;
+export {};

package/dist/src/setup/boxes/resolve-provisioning.d.ts

@@ -50,7 +50,7 @@ export interface ResolveProvisioningOptions {
     deps?: ResolveProvisioningDeps;
 }
 /** Both provisioning plans plus the model wiring they imply. Input and payload. */
-export interface ResolvedProvisioning {
+interface ResolvedProvisioning {
     vercelProject: ResolvedVercelProject;
     aiGateway: ResolvedAiGateway;
     modelWiring: WiringMode;
@@ -71,3 +71,4 @@ export interface ResolvedProvisioning {
  * `perform` passes the plan through untouched so `apply` can record it.
  */
 export declare function resolveProvisioning(options: ResolveProvisioningOptions): SetupBox<SetupState, ResolvedProvisioning, ResolvedProvisioning>;
+export {};

package/dist/src/setup/boxes/select-model.d.ts

@@ -3,7 +3,6 @@ import type { SelectOption } from "../ask.js";
 export type { GatewayCatalogModel } from "#shared/gateway-model-catalog.js";
 /** Fetches the raw AI Gateway catalog. */
 export declare function fetchGatewayCatalog(signal?: AbortSignal): Promise<GatewayCatalogModel[]>;
-export { parseGatewayModelCatalog as parseGatewayCatalog } from "#shared/gateway-model-catalog.js";
 /**
  * Builds picker options from a fetched catalog, keeping the default model and
  * filtering the rest to language models with the `web-search` tag. The curated