stitchkit 0.91.2 → 0.93.0

package/dist/tools/cli-format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-format.d.ts","sourceRoot":"","sources":["../../src/tools/cli-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGzD,sDAAsD;AACtD,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAWhC,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,WAAW,GAChB,MAAM,CAgBR"}
+{"version":3,"file":"cli-format.d.ts","sourceRoot":"","sources":["../../src/tools/cli-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGzD,sDAAsD;AACtD,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAWhC,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,CAAC;CACzB;AAED;;;;GAIG;AACH;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,WAAW,GAAG,MAAM,CAY/E;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,WAAW,GAChB,MAAM,CAeR"}

package/dist/tools/cli-invoke.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Running one already-parsed operation, in this process.
+ *
+ * The most common way an agent drives a CLI is not one command — it is a
+ * stream: a JSON line per operation, an answer per line. The framework owned
+ * the parsing, the routing, the JSON mode, the exit codes and the error shape,
+ * and handed out no way to say "run this parsed call and give me its result".
+ * So a consumer's stream loop spawned the binary again per line: three
+ * conversions of the same data (arguments back into `--flag value` strings,
+ * nested objects through `JSON.stringify` into an argv slot, the result parsed
+ * back out of stdout text) plus a process start each time — measured at 0.15 s,
+ * which is thirty seconds for a two-hundred-line manifest before any work
+ * happens. The ban on nesting one stream inside another existed for the same
+ * reason and disappears with it.
+ *
+ * `createCliInvoker` compiles the managed surface once and executes against it.
+ * `createCli` is built on this same function, so the stream and the command
+ * line cannot answer differently: one surface, one runner, one exit table.
+ *
+ * Native commands (`config.commands`) are in it when, and only when, they
+ * declare `output`. The two halves of a native definition are not the same kind
+ * of thing: one returns a validated value the frame prints, the other prints
+ * itself and returns `void`. Only the second cannot be run where there is no
+ * stdout, and excluding both because of it cost a consumer a working `describe`
+ * line for no reason the type could not already tell apart.
+ *
+ * `present` is not called on this path: it is stdout formatting, and there is
+ * no stdout. `exitCode` is, through the same function the command line uses, so
+ * a script branching on the code cannot see the two paths disagree. Anything
+ * the handler does write is captured and returned on the result rather than
+ * leaking into a caller's stream of answers.
+ */
+import type { ZodObject, z } from 'zod';
+import type { ServiceDef, StitchLogger } from '../server/types.js';
+import { type CliCommandDefinition } from './cli-command.js';
+import { type ExitCodeMap } from './cli-format.js';
+import { type CliCommandPresentation, type CliPresentationPolicyConfig } from './cli-policy.js';
+import { type ErrorHintFn, type ToolCallHooks, type ToolLifecycle, type ToolResult } from './execute.js';
+import { type MountableTool } from './mount.js';
+import type { RuntimeToolDefinition } from './runtime-tool.js';
+export type CliSurfaceSource<TAuth, TValue> = readonly TValue[] | ((auth: Awaited<TAuth> | undefined) => readonly TValue[]);
+/**
+ * What an invocation needs to exist: the surface, the identity behind it and
+ * the policies every call runs under. Everything about a terminal — argv,
+ * writers, `--wait`, downloads — belongs to `CliConfig`, which extends this.
+ */
+export interface CliInvokerConfig<TAuth = unknown, TContext extends Record<string, unknown> = Record<string, unknown>, TGlobals extends ZodObject = ZodObject> extends CliPresentationPolicyConfig {
+    /** Program name — used in diagnostics. */
+    name: string;
+    /** Contract services exposed as commands — may depend on the resolved identity. */
+    services?: CliSurfaceSource<TAuth, ServiceDef>;
+    /** Pathless managed operations. CLI exposure always requires `transports: ['CLI']`. */
+    runtimeTools?: CliSurfaceSource<TAuth, RuntimeToolDefinition>;
+    /** CLI-only executable commands, dispatched before the managed surface. */
+    commands?: readonly CliCommandDefinition[];
+    auth?: TAuth | Promise<TAuth>;
+    resolveAuth?: (globals: z.output<TGlobals>) => TAuth | Promise<TAuth>;
+    globalOptions?: TGlobals;
+    context?: (auth: Awaited<TAuth> | undefined, globals: z.output<TGlobals>) => TContext;
+    signal?: AbortSignal;
+    hooks?: ToolCallHooks;
+    lifecycle?: ToolLifecycle;
+    logger?: StitchLogger;
+    coerceJsonArgs?: boolean;
+    errorHint?: ErrorHintFn;
+    exitCodes?: ExitCodeMap;
+    passthrough?: Record<string, string>;
+}
+/** What one parsed invocation produced — never printed, never exited on. */
+export interface CliInvocationResult {
+    ok: boolean;
+    /** The exit code the printed path would give this same result. */
+    exitCode: number;
+    /** The validated handler output, on success. */
+    data?: unknown;
+    /** The refusal, in the shape the CLI prints on failure. */
+    error?: {
+        code: string;
+        message: string;
+        details?: unknown;
+        hint?: string;
+        retryable?: boolean;
+    };
+    /**
+     * What a native handler wrote, when it wrote anything.
+     *
+     * A command that declares `output` is not supposed to write — the frame
+     * prints for it — but it holds the writers and may log. In process there is
+     * nowhere for that text to go: printing it would interleave with a caller's
+     * own output and corrupt a stream of JSON lines, and dropping it would lose a
+     * diagnostic silently. So it comes back here, and the caller decides.
+     */
+    written?: {
+        stdout?: string;
+        stderr?: string;
+    };
+}
+/** One resolved managed command. */
+export interface CliInvokerCommand {
+    name: string;
+    description: string;
+}
+/** The compiled surface: what can be run, and how to run it. */
+export interface CliInvoker {
+    /** Every managed command, in surface order. */
+    readonly commands: readonly CliInvokerCommand[];
+    /**
+     * Run one parsed call. Never writes, never exits. An unknown command is a
+     * `NOT_FOUND` result rather than a throw, because a stream must answer the
+     * line that was wrong and keep reading the ones that follow.
+     */
+    invoke(command: string, args: Record<string, unknown>): Promise<CliInvocationResult>;
+}
+/**
+ * Shape a `ToolResult` into an invocation result — the same error body the CLI
+ * prints, and the same exit code, produced without printing either.
+ */
+export declare function cliInvocationResult(result: ToolResult, toolName: string, config: {
+    errorHint?: ErrorHintFn;
+    exitCodes?: ExitCodeMap;
+}): CliInvocationResult;
+/**
+ * Compile the managed surface and return a dispatcher over it.
+ *
+ * Identity resolves once, not per call: a stream of two hundred operations must
+ * not resolve auth two hundred times, and a CLI invocation speaks as one
+ * identity by construction.
+ */
+export declare function createCliInvoker<TAuth = unknown, TContext extends Record<string, unknown> = Record<string, unknown>, TGlobals extends ZodObject = ZodObject>(config: CliInvokerConfig<TAuth, TContext, TGlobals>, globals?: Record<string, unknown>): Promise<CliInvoker>;
+/**
+ * Walk the declared surface into executable tools and their presentation.
+ *
+ * Shared with `createCli`, which starts from its native commands rather than an
+ * empty map — the uniqueness and shape checks have to see both halves, or a
+ * managed command could silently shadow a native one.
+ */
+export declare function buildCliSurface<TAuth, TContext extends Record<string, unknown>, TGlobals extends ZodObject>(config: CliInvokerConfig<TAuth, TContext, TGlobals>, auth: Awaited<TAuth> | undefined, nativeHelp: Map<string, CliCommandPresentation>, applicationGlobalNames: ReadonlySet<string>, assertShape?: (name: string, descriptor: CliCommandPresentation, exists: boolean, passthroughField: string | undefined, globalNames: ReadonlySet<string>) => void): {
+    tools: Map<string, MountableTool>;
+    help: Map<string, CliCommandPresentation>;
+};
+/** How a managed tool presents itself — the same shape a native command builds. */
+export declare function managedCliDescriptor(tool: MountableTool): Omit<CliCommandPresentation, 'aliases' | 'positionals'>;
+//# sourceMappingURL=cli-invoke.d.ts.map

package/dist/tools/cli-invoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-invoke.d.ts","sourceRoot":"","sources":["../../src/tools/cli-invoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EACL,KAAK,oBAAoB,EAI1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EACjC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,UAAU,EAGhB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAG5D,MAAM,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,gBAAgB,CAC/B,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,CACtC,SAAQ,2BAA2B;IACnC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IACtF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAiBD,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2DAA2D;IAC3D,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;IACF;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,SAAS,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,WAAW,CAAA;CAAE,GAC3D,mBAAmB,CAkBrB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,EAEtC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,UAAU,CAAC,CA6DrB;AAgED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACnD,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAChC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAC/C,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,EAC3C,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,OAAO,EACf,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,KAC7B,IAAI,GACR;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;CAAE,CA8BlF;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,GAClB,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,aAAa,CAAC,CAMzD"}

package/dist/tools/cli-manifest.d.ts

@@ -56,6 +56,11 @@ export declare const CliBuildManifestSchema: z.ZodObject<{
         size: z.ZodInt;
         sha256: z.ZodString;
     }, z.core.$strip>>;
+    signature: z.ZodOptional<z.ZodObject<{
+        algorithm: z.ZodLiteral<"ed25519">;
+        keyId: z.ZodString;
+        signature: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type CliBuildManifest = z.infer<typeof CliBuildManifestSchema>;
 /** The stamp a build carries inside itself, so the tool can say what it is. */
@@ -71,13 +76,5 @@ export declare function formatCliBuildStamp(stamp: CliBuildStamp, name?: string)
 export declare function currentCliBuildTarget(): CliBuildTarget;
 /** The asset for one target, or `undefined` when this build was not published. */
 export declare function selectCliBuildAsset(manifest: CliBuildManifest, target?: CliBuildTarget): CliBuildAsset | undefined;
-/**
- * Refuse republishing a version from a different commit.
- *
- * A version is a promise about contents. Publishing `1.4.2` twice from two trees
- * means everyone who already installed `1.4.2` is told they are current and
- * never receives the fix — and nothing about their machine looks wrong. The
- * check is one comparison and belongs in the publisher, before the upload.
- */
-export declare function assertCliPublishable(previous: CliBuildManifest | undefined, next: CliBuildManifest): void;
+export declare function assertCliPublishable(previous: CliBuildManifest | readonly CliBuildManifest[] | undefined, next: CliBuildManifest): void;
 //# sourceMappingURL=cli-manifest.d.ts.map

package/dist/tools/cli-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-manifest.d.ts","sourceRoot":"","sources":["../../src/tools/cli-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBAMjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,IAAI,cAAc,CAEtD;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,GAAE,cAAwC,GAC/C,aAAa,GAAG,SAAS,CAI3B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,IAAI,EAAE,gBAAgB,GACrB,IAAI,CAQN"}
+{"version":3,"file":"cli-manifest.d.ts","sourceRoot":"","sources":["../../src/tools/cli-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,kFAAkF;AAClF,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;iBAejC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,IAAI,cAAc,CAEtD;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,GAAE,cAAwC,GAC/C,aAAa,GAAG,SAAS,CAI3B;AAgBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,gBAAgB,EAAE,GAAG,SAAS,EACpE,IAAI,EAAE,gBAAgB,GACrB,IAAI,CAkBN"}

package/dist/tools/cli-signature.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Who built the binary — which the asset digest cannot answer.
+ *
+ * The digest proves the bytes that arrived are the bytes the manifest named. It
+ * proves nothing about who named them: the manifest and the assets come from
+ * one origin, and whoever can replace one can replace the other. Authorship
+ * needs a key the build carries and the server never holds.
+ *
+ * So the signature covers the manifest's identity AND every asset's digest —
+ * `{name, version, commit, builtAt, assets[]}` — and the chain closes on the
+ * file that will execute rather than on the document describing it. Signing the
+ * document alone would leave an attacker free to swap an asset URL's contents
+ * and keep a valid signature over an unchanged document.
+ *
+ * Ed25519 over `node:crypto`; no dependency is added for this.
+ */
+import { z } from 'zod';
+import type { CliBuildManifest } from './cli-manifest.js';
+/** The detached signature a published manifest carries beside its own fields. */
+export declare const CliBuildSignatureSchema: z.ZodObject<{
+    algorithm: z.ZodLiteral<"ed25519">;
+    keyId: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strip>;
+export type CliBuildSignature = z.infer<typeof CliBuildSignatureSchema>;
+/**
+ * What a verification concluded. Five answers, and `unenforced` is the one that
+ * earns its keep: a build with no pinned key must keep updating, and the fact
+ * that nothing was checked has to be VISIBLE rather than assumed. A silent
+ * "fine" from a check that never ran is the failure mode this whole file exists
+ * to remove.
+ */
+export type CliSignatureVerdict = 'valid' | 'unenforced' | 'missing' | 'unknown-key' | 'invalid';
+/** The keys a build trusts, by id. A build with none enforces nothing. */
+export interface CliTrustRoot {
+    /**
+     * `keyId` → public key, as SPKI PEM or base64 of the raw 32-byte Ed25519 key.
+     * Compiled into the binary: a trust root fetched at runtime from the same
+     * origin as the manifest proves nothing.
+     */
+    keys: Readonly<Record<string, string>>;
+}
+/**
+ * The exact bytes a signature covers.
+ *
+ * Canonical JSON, so two producers that agree on the content agree on the
+ * bytes — key order and whitespace are not allowed to decide whether a
+ * signature verifies. Every asset contributes its target, its compression, its
+ * size and its digest; `url` does not, because where a file is served from is
+ * the publisher's business and moving it must not invalidate the proof of what
+ * it contains. Everything that decides what happens to the bytes BEFORE the
+ * digest can be checked is signed; only the address is free.
+ */
+export declare function cliManifestSigningPayload(manifest: CliBuildManifest): string;
+/**
+ * A private key as it comes out of a file or a secret store: PEM text, or DER
+ * bytes.
+ *
+ * Deliberately not `KeyObject`. That type belongs to `node:crypto`, and naming
+ * it in a published signature puts `import("node:crypto")` into the declaration
+ * files of a package whose browser-safe entries a consumer resolves without
+ * Node types at all — the whole surface stops typechecking for them over a
+ * function they never call.
+ */
+export type CliSigningKey = string | Uint8Array;
+/** Sign a manifest — for the publisher, which is the only side that holds a key. */
+export declare function signCliManifest(manifest: CliBuildManifest, options: {
+    keyId: string;
+    privateKey: CliSigningKey;
+}): CliBuildSignature;
+/**
+ * Verify a manifest against the build's own trust root.
+ *
+ * Never throws: a verdict is the answer, including for a malformed key or a
+ * signature that is not base64 at all. A caller deciding whether to download
+ * something wants a decision, not an exception to translate into one.
+ */
+export declare function verifyCliManifest(manifest: CliBuildManifest, signature: CliBuildSignature | undefined, trust?: CliTrustRoot): CliSignatureVerdict;
+/** Whether a verdict permits installing the build it describes. */
+export declare function cliSignatureAccepted(verdict: CliSignatureVerdict): boolean;
+//# sourceMappingURL=cli-signature.d.ts.map

package/dist/tools/cli-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-signature.d.ts","sourceRoot":"","sources":["../../src/tools/cli-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB;;;;iBAMlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,YAAY,GACZ,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAkB5E;AAgBD;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,CAAC;AAEhD,oFAAoF;AACpF,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,aAAa,CAAA;CAAE,GACpD,iBAAiB,CAenB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,iBAAiB,GAAG,SAAS,EACxC,KAAK,CAAC,EAAE,YAAY,GACnB,mBAAmB,CAiBrB;AAED,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAE1E"}

package/dist/tools/cli-stream.d.ts

@@ -0,0 +1,93 @@
+/**
+ * One operation per line, and a batch that can be resumed.
+ *
+ * Every agent-facing CLI grows the same two commands, and the mechanics contain
+ * nothing about any product: read a line, run the operation, answer with the
+ * same id, do not let one bad line stop the stream — and for a batch, do not
+ * run again what already ran.
+ *
+ * They are factories rather than framework-owned command names. Reserving
+ * `jsonl` and `batch` would take two names out of a namespace that belongs to
+ * the consumer: an application that already has a `batch` command would either
+ * fail at startup or find its own command silently shadowed. So the consumer
+ * mounts these under whatever it calls them, exactly like its own commands.
+ */
+import { z } from 'zod';
+import type { CliInvocationResult, CliInvoker } from './cli-invoke.js';
+/** One line's answer: the id it came with, plus what running it produced. */
+export interface CliStreamAnswer extends CliInvocationResult {
+    /** Correlation id, echoed from the line. */
+    id: string;
+    /** Present when this answer was replayed from a checkpoint rather than run. */
+    replayed?: true;
+}
+export interface CliStreamCommandConfig {
+    /** Command name — the consumer's namespace, not the framework's. */
+    name?: string;
+    description?: string;
+    /** The compiled surface to run against. */
+    invoker: CliInvoker | (() => Promise<CliInvoker>);
+    /**
+     * Where the lines come from. Default: `process.stdin`, **as they arrive**.
+     *
+     * This is the difference between a pipe and a conversation. The framework's
+     * ordinary stdin routing accumulates the whole stream and hands the command a
+     * string, which is right for `--prompt "$(cat file)"` and fatally wrong here:
+     * an agent that writes one line and waits for its answer would wait for its
+     * own EOF, which never comes. So the stream owns its input and answers each
+     * line as it is read.
+     */
+    readLines?: () => AsyncIterable<string>;
+}
+/**
+ * Lines from a byte stream, delivered as they arrive.
+ *
+ * Split on `\n` with a trailing `\r` dropped, so a producer on Windows is not a
+ * silent parse failure on every line. A final line with no newline is delivered
+ * at end of stream rather than discarded.
+ */
+export declare function readStdinLines(source?: AsyncIterable<Uint8Array | string>): AsyncIterable<string>;
+/**
+ * Run each line as it arrives, answering before reading the next.
+ *
+ * Sequential on purpose: the answers carry ids, so a consumer could correlate
+ * out-of-order ones — but a stream that runs ahead of its answers removes the
+ * one form of backpressure an agent has, which is not answering yet.
+ */
+export declare function runCliStream(invoker: CliInvoker, lines: AsyncIterable<string>, onAnswer: (answer: CliStreamAnswer) => void, hooks?: CliStreamHooks): Promise<void>;
+/** What a caller decides per line, without owning the loop that reads them. */
+export interface CliStreamHooks {
+    /** Answer this line without running it — a replay, or a refusal. */
+    before?: (id: string, line: {
+        command: string;
+        args: Record<string, unknown>;
+    }) => CliStreamAnswer | undefined;
+    /** Observe what running it produced, before the answer is written. */
+    after?: (id: string, line: {
+        command: string;
+        args: Record<string, unknown>;
+    }, outcome: CliInvocationResult) => void;
+}
+/**
+ * A stream command the consumer mounts under its own name.
+ *
+ * Answers go to stdout one JSON object per line; nothing else does, so a script
+ * can read stdout as data while diagnostics stay on stderr.
+ */
+export declare function defineCliStreamCommand(config: CliStreamCommandConfig): import("./cli-command.js").CliCommandDefinitionWithoutOutput<z.ZodObject<{}, z.core.$strip>>;
+export interface CliBatchCommandConfig extends CliStreamCommandConfig {
+    /** Where the checkpoint lives. Relative paths resolve against the process cwd. */
+    checkpointPath?: string;
+}
+/**
+ * A resumable batch.
+ *
+ * The checkpoint records, per line id, the digest of the line that produced the
+ * recorded answer. A re-run replays what already ran; a line whose CONTENT
+ * changed under the same id is refused rather than quietly re-run or quietly
+ * replayed, because both of those answer a question nobody asked.
+ */
+export declare function defineCliBatchCommand(config: CliBatchCommandConfig): import("./cli-command.js").CliCommandDefinitionWithoutOutput<z.ZodObject<{
+    checkpoint: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+//# sourceMappingURL=cli-stream.d.ts.map

package/dist/tools/cli-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-stream.d.ts","sourceRoot":"","sources":["../../src/tools/cli-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEpE,6EAA6E;AAC7E,MAAM,WAAW,eAAgB,SAAQ,mBAAmB;IAC1D,4CAA4C;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB;AASD,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,OAAO,EAAE,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAuB,cAAc,CACnC,MAAM,GAAE,aAAa,CAAC,UAAU,GAAG,MAAM,CAAiB,GACzD,aAAa,CAAC,MAAM,CAAC,CAcvB;AAqCD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAC5B,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,EAC3C,KAAK,GAAE,cAAmB,GACzB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,MAAM,CAAC,EAAE,CACP,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KACrD,eAAe,GAAG,SAAS,CAAC;IACjC,sEAAsE;IACtE,KAAK,CAAC,EAAE,CACN,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,EACxD,OAAO,EAAE,mBAAmB,KACzB,IAAI,CAAC;CACX;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,6FAcpE;AAED,MAAM,WAAW,qBAAsB,SAAQ,sBAAsB;IACnE,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB;;mBA+DlE"}

package/dist/tools/cli-update.d.ts

@@ -1,4 +1,5 @@
 import { type CliBuildAsset, type CliBuildManifest, type CliBuildTarget } from './cli-manifest.js';
+import { type CliSignatureVerdict, type CliTrustRoot } from './cli-signature.js';
 export interface CliUpdateCheckConfig {
     manifestUrl: string;
     currentVersion: string;
@@ -11,6 +12,11 @@ export interface CliUpdateCheckConfig {
     timeoutMs?: number;
     target?: CliBuildTarget;
     allowPrivateHosts?: boolean;
+    /**
+     * Keys this build trusts. With none, nothing is enforced and the verdict says
+     * so out loud (`unenforced`) rather than leaving "checked" to be assumed.
+     */
+    trust?: CliTrustRoot;
 }
 /**
  * Four answers, never three. "Could not ask" is not "up to date": collapsing
@@ -22,11 +28,14 @@ export type CliUpdateCheck = {
 } | {
     status: 'current';
     version: string;
+    signature?: CliSignatureVerdict;
 } | {
     status: 'outdated';
     version: string;
     manifest: CliBuildManifest;
     asset?: CliBuildAsset;
+    /** What the signature check concluded — always present once it ran. */
+    signature?: CliSignatureVerdict;
 } | {
     status: 'unknown';
     reason: string;
@@ -46,11 +55,36 @@ export interface CliUpdateApplyConfig {
     timeoutMs?: number;
     maxBytes?: number;
     allowPrivateHosts?: boolean;
+    /**
+     * The document the asset came from, so authorship can be checked here too.
+     *
+     * `CliBuildAsset` cannot carry the proof: the signature covers the manifest's
+     * identity and every asset's digest together, which is what closes the chain
+     * on the file that executes. Passing both is what lets this refuse **before**
+     * it downloads anything.
+     */
+    manifest?: CliBuildManifest;
+    /** Keys this build trusts. With `manifest`, the pair is checked before the fetch. */
+    trust?: CliTrustRoot;
+    /**
+     * Keep the bytes being replaced, here, so there is something to go back to.
+     *
+     * Written after the new bytes are verified and before the target is replaced:
+     * a backup taken earlier could preserve a binary that was about to be
+     * replaced by a download that then failed its digest, and a backup taken
+     * later has nothing left to copy. The target's own mode is carried over — the
+     * point of a backup is to be runnable.
+     */
+    backupPath?: string;
 }
 export interface AppliedCliUpdate {
     path: string;
     bytes: number;
     sha256: string;
+    /** Where the replaced bytes were kept, when a backup was asked for and there was one. */
+    backupPath?: string;
+    /** Digest of the replaced bytes — what `rollbackCliUpdate` expects to find. */
+    backupSha256?: string;
 }
 /**
  * Download, verify and replace the binary.
@@ -61,4 +95,32 @@ export interface AppliedCliUpdate {
  * a partial write.
  */
 export declare function applyCliUpdate(config: CliUpdateApplyConfig): Promise<AppliedCliUpdate>;
+export interface CliRollbackConfig {
+    /** The file to restore onto; defaults to the running executable. */
+    targetPath?: string;
+    /** The copy kept by a previous `applyCliUpdate({ backupPath })`. */
+    backupPath: string;
+    /**
+     * The digest the backup must have — `backupSha256` from that update.
+     *
+     * Required, not optional. A rollback that installs whatever happens to be at
+     * the backup path is a second install of an unverified binary, and the moment
+     * it is used is the moment nobody is in a position to check.
+     */
+    expectedSha256: string;
+}
+export interface RolledBackCliUpdate {
+    path: string;
+    bytes: number;
+    sha256: string;
+}
+/**
+ * Put the previous build back.
+ *
+ * Rolling back is a property of updating, not of the application: the same
+ * attention to atomicity and file mode the replacement gets, applied in the
+ * other direction. The digest is checked first, so a corrupted or swapped
+ * backup is a refusal rather than an unbootable tool.
+ */
+export declare function rollbackCliUpdate(config: CliRollbackConfig): RolledBackCliUpdate;
 //# sourceMappingURL=cli-update.d.ts.map

package/dist/tools/cli-update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-update.d.ts","sourceRoot":"","sources":["../../src/tools/cli-update.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EAErB,KAAK,cAAc,EAGpB,MAAM,gBAAgB,CAAC;AASxB,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAAE,GAC1F;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAe1C;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAalF;AAED,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA2C1F;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,aAAa,CAAC;IACrB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmC5F"}
+{"version":3,"file":"cli-update.d.ts","sourceRoot":"","sources":["../../src/tools/cli-update.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EAErB,KAAK,cAAc,EAGpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,YAAY,EAGlB,MAAM,iBAAiB,CAAC;AASzB,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAAE,GACvE;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,uEAAuE;IACvE,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC,GACD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAe1C;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAalF;AAED,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmE1F;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,aAAa,CAAC;IACrB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,qFAAqF;IACrF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqE5F;AAkBD,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,CAchF"}

package/dist/tools/cli.d.ts

@@ -1,23 +1,13 @@
 import type { ZodObject, z } from 'zod';
-import type { ServiceDef, StitchLogger } from '../server/types.js';
-import { type CliCommandDefinition } from './cli-command.js';
 import { type ExitCodeMap } from './cli-format.js';
-import { type CliPresentationPolicyConfig } from './cli-policy.js';
+import { type CliInvocationResult, type CliInvoker, type CliInvokerCommand, type CliInvokerConfig, type CliSurfaceSource, cliInvocationResult, createCliInvoker } from './cli-invoke.js';
 import { type CliWaitConfig } from './cli-wait.js';
 import { type ErrorHintFn, type ToolCallHooks, type ToolLifecycle } from './execute.js';
-import type { RuntimeToolDefinition } from './runtime-tool.js';
-export type CliSurfaceSource<TAuth, TValue> = readonly TValue[] | ((auth: Awaited<TAuth> | undefined) => readonly TValue[]);
-export interface CliConfig<TAuth = unknown, TContext extends Record<string, unknown> = Record<string, unknown>, TGlobals extends ZodObject = ZodObject> extends CliPresentationPolicyConfig {
-    /** Program name — shown in help and unknown-command messages. */
-    name: string;
+export type { CliInvocationResult, CliInvoker, CliInvokerCommand, CliInvokerConfig, CliSurfaceSource, };
+export { cliInvocationResult, createCliInvoker };
+export interface CliConfig<TAuth = unknown, TContext extends Record<string, unknown> = Record<string, unknown>, TGlobals extends ZodObject = ZodObject> extends CliInvokerConfig<TAuth, TContext, TGlobals> {
     /** Program version — printed by `--version`. */
     version: string;
-    /** Contract services exposed as commands — may depend on the resolved identity. */
-    services?: CliSurfaceSource<TAuth, ServiceDef>;
-    /** Pathless managed operations. CLI exposure always requires `transports: ['CLI']`. */
-    runtimeTools?: CliSurfaceSource<TAuth, RuntimeToolDefinition>;
-    /** CLI-only executable commands, dispatched before auth and managed surface factories. */
-    commands?: readonly CliCommandDefinition[];
     /**
      * Identity for the single CLI invocation — resolved ONCE at startup (from an
      * env var / token file), like a stdio MCP server, not per call. A value or a
@@ -56,8 +46,6 @@ export interface CliConfig<TAuth = unknown, TContext extends Record<string, unkn
      * a scoped command bypasses the gate.
      */
     lifecycle?: ToolLifecycle;
-    /** Logger for diagnostics — defaults to stderr-safe `console.error`. */
-    logger?: StitchLogger;
     /** Coerce JSON-stringified arrays/objects in arguments. Default: true. */
     coerceJsonArgs?: boolean;
     /** Global error hint appended to every failed command's error. */

package/dist/tools/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/tools/cli.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAUhE,OAAO,EACL,KAAK,oBAAoB,EAI1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAsB,KAAK,WAAW,EAAc,MAAM,cAAc,CAAC;AAChF,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,YAAY,CAAC;AAC/D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAInB,MAAM,WAAW,CAAC;AAKnB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAI5D,MAAM,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;AAE9D,MAAM,WAAW,SAAS,CACxB,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,CACtC,SAAQ,2BAA2B;IACnC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9D,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IACtF,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;+DAC2D;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtC;AA2ZD,8EAA8E;AAC9E,wBAAsB,SAAS,CAC7B,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,EACtC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAme7D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/tools/cli.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxC,OAAO,EAAsB,KAAK,WAAW,EAAc,MAAM,cAAc,CAAC;AAChF,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,YAAY,CAAC;AAC/D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAInB,MAAM,WAAW,CAAC;AAOnB,YAAY,EACV,mBAAmB,EACnB,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,CAAC;AACF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;AAEjD,MAAM,WAAW,SAAS,CACxB,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,CACtC,SAAQ,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACnD,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IACtF,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;+DAC2D;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtC;AAiZD,8EAA8E;AAC9E,wBAAsB,SAAS,CAC7B,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,EACtC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAid7D"}

package/dist/tools/connections/index.js

@@ -1,10 +1,10 @@
 import {
   defineRuntimeTool
-} from "../../index-8z9we758.js";
+} from "../../index-vjpvjqpn.js";
 import {
   declaresDraft07,
   withDefsDialect
-} from "../../index-fenaekmk.js";
+} from "../../index-h9etkkyk.js";
 import"../../index-cby4ar3v.js";
 import {
   AppError

package/dist/tools/execute.d.ts

@@ -184,6 +184,27 @@ export interface ToolArgumentExtension {
  * `AppError` becomes a tool error. Shared by `executeToolMethod` and both
  * transport mounts so every tool error has one shape.
  */
+/** What one tool call's arguments parse to — or why they did not. */
+export type ParsedToolCallArguments = {
+    ok: true;
+    params: unknown;
+    input: unknown;
+} | {
+    ok: false;
+    message: string;
+    thrown?: unknown;
+};
+/**
+ * Split and validate a flat tool-argument object exactly as a call does.
+ *
+ * Exported so the ONE thing that needs the parsed value without running the
+ * call — an elicitation resolver choosing this call's questions — gets the same
+ * value the handler will get, rather than a second parse written beside this
+ * one that drifts on the next coercion change. It is pure: no lifecycle, no
+ * hooks, no audit row, so asking what the arguments mean costs nothing that a
+ * gate would charge for.
+ */
+export declare function parseToolCallArguments(method: ToolOperation, callArgs: Record<string, unknown>, coerceJson: boolean): ParsedToolCallArguments;
 export declare function toolResultFromError(err: unknown): ToolFailure;
 /** Recover the normalized AppError behind one canonical failed tool result. */
 export declare function toolErrorFromResult(result: ToolFailure): AppError;

package/dist/tools/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/tools/execute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EACL,QAAQ,EAGR,KAAK,cAAc,EACnB,KAAK,cAAc,EAEnB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAKrB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAIzD,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEN,KAAK,WAAW,GAAG,OAAO,CAAC,UAAU,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAEtD,MAAM,MAAM,0BAA0B,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAEzE,2FAA2F;AAC3F,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAE5C,YAAY,MAAM,EAAE,0BAA0B,EAI7C;CACF;AAaD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,yBAAyB,CAEpC;AAaD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,0DAA0D;IAC1D,WAAW,CAAC,EAAE,CACZ,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,iBAAiB,KACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,OAAO,EAAE,CACP,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAkB7D;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAgBjE;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,aAAa,EACrB,SAAS,CAAC,EAAE,aAAa,EACzB,UAAU,UAAQ,EAClB,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EACzC,SAAS,CAAC,EAAE,qBAAqB,EACjC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAC7D,OAAO,CAAC,UAAU,CAAC,CA0BrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,IAAI,EAAE;IACJ,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,iBAAiB,CAAC;CAC3B,EACD,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAuBZ"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/tools/execute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EACL,QAAQ,EAGR,KAAK,cAAc,EACnB,KAAK,cAAc,EAEnB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAKrB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAIzD,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEN,KAAK,WAAW,GAAG,OAAO,CAAC,UAAU,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAEtD,MAAM,MAAM,0BAA0B,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAEzE,2FAA2F;AAC3F,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAE5C,YAAY,MAAM,EAAE,0BAA0B,EAI7C;CACF;AAaD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,yBAAyB,CAEpC;AAaD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,0DAA0D;IAC1D,WAAW,CAAC,EAAE,CACZ,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,iBAAiB,KACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,OAAO,EAAE,CACP,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjE;AAED;;;;GAIG;AAEH,qEAAqE;AACrE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAErD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,EAAE,OAAO,GAClB,uBAAuB,CAkDzB;AAKD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAkB7D;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAgBjE;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,aAAa,EACrB,SAAS,CAAC,EAAE,aAAa,EACzB,UAAU,UAAQ,EAClB,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EACzC,SAAS,CAAC,EAAE,qBAAqB,EACjC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAC7D,OAAO,CAAC,UAAU,CAAC,CA0BrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,IAAI,EAAE;IACJ,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,iBAAiB,CAAC;CAC3B,EACD,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAuBZ"}