0sec-cli 0.24.1 → 0.26.0

package/chunks/{chunk-BMDG6T7D.js → chunk-72PU46MS.js}

@@ -8,7 +8,7 @@ import {
   homeStateDir,
   parseSecurityWorkflowInput,
   runStateDir
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   __export
 } from "./chunk-VCSFCHAJ.js";
@@ -19,6 +19,7 @@ import { BaseSQLiteDatabase } from "drizzle-orm/sqlite-core/db";
 import { SQLiteSyncDialect } from "drizzle-orm/sqlite-core/dialect";
 import { createTableRelationsHelpers, extractTablesRelationalConfig } from "drizzle-orm/relations";
 import { createRequire } from "node:module";
+import { closeSync, openSync } from "node:fs";
 function isBunRuntime() {
   const g = globalThis;
   if (typeof g.Bun !== "undefined")
@@ -91,38 +92,26 @@ var ShimmedDatabase = class {
   constructor(engine) {
     this.engine = engine;
   }
-  prepare(sql) {
-    return new StatementShim(this.engine.prepare(sql));
+  prepare(sql2) {
+    return new StatementShim(this.engine.prepare(sql2));
   }
-  exec(sql) {
-    this.engine.exec(sql);
+  exec(sql2) {
+    this.engine.exec(sql2);
     return this;
   }
-  /**
-   * better-sqlite3 uses `.pragma()` both as a getter and a setter. Our code
-   * only uses it as a setter ("journal_mode = WAL", "foreign_keys = ON"), so
-   * we just `exec()` the pragma and swallow errors — some PRAGMAs (notably
-   * WAL journal mode) are not supported by node-sqlite3-wasm's VFS and error
-   * here, but losing them is acceptable for 0's single-process workload.
+  /** Return PRAGMA rows, or the first row's first value in simple mode.
+   * Setting errors propagate so callers cannot assume a safety setting applied
+   * after SQLite rejected it. SQLite itself ignores unknown PRAGMA names.
    */
-  pragma(query, _opts) {
-    try {
-      this.engine.exec(`PRAGMA ${query}`);
-    } catch {
-    }
-    return void 0;
+  pragma(query, opts) {
+    const rows = this.prepare(`PRAGMA ${query}`).all();
+    return opts?.simple ? rows[0] ? Object.values(rows[0])[0] : void 0 : rows;
   }
-  /**
-   * better-sqlite3's `db.transaction(fn)` returns a callable object with
-   * `.deferred`, `.immediate`, `.exclusive`, and `.default` methods, each
-   * running `fn` inside a BEGIN/COMMIT of the corresponding isolation level.
-   * All three variants are functionally equivalent for 0's single-writer
-   * workload, so we wire them to the same underlying implementation.
-   */
+  /** Synchronous transactions with SQLite's actual lock-acquisition modes. */
   transaction(fn) {
     const engine = this.engine;
-    const runInTx = (...args) => {
-      engine.exec("BEGIN");
+    const wrap = (begin) => (...args) => {
+      engine.exec(begin);
       try {
         const result = fn(...args);
         engine.exec("COMMIT");
@@ -135,11 +124,12 @@ var ShimmedDatabase = class {
         throw err;
       }
     };
+    const runInTx = wrap("BEGIN");
     return Object.assign(runInTx, {
       default: runInTx,
-      deferred: runInTx,
-      immediate: runInTx,
-      exclusive: runInTx
+      deferred: wrap("BEGIN DEFERRED"),
+      immediate: wrap("BEGIN IMMEDIATE"),
+      exclusive: wrap("BEGIN EXCLUSIVE")
     });
   }
   close() {
@@ -157,13 +147,13 @@ function createWasmEngine(path) {
   const { Database: WasmDatabaseCtor } = sqliteWasm;
   const wasm = new WasmDatabaseCtor(path);
   const prepared = /* @__PURE__ */ new Set();
-  const wrapStatement = (sql) => {
-    let initial = wasm.prepare(sql);
+  const wrapStatement = (sql2) => {
+    let initial = wasm.prepare(sql2);
     prepared.add(initial);
     const execute = (operation) => {
       if (!wasm.isOpen)
         throw new Error("Database already closed");
-      const statement = initial ?? wasm.prepare(sql);
+      const statement = initial ?? wasm.prepare(sql2);
       initial = void 0;
       prepared.add(statement);
       let succeeded = false;
@@ -195,9 +185,9 @@ function createWasmEngine(path) {
     };
   };
   return {
-    prepare: (sql) => wrapStatement(sql),
-    exec: (sql) => {
-      wasm.exec(sql);
+    prepare: (sql2) => wrapStatement(sql2),
+    exec: (sql2) => {
+      wasm.exec(sql2);
     },
     close: () => {
       for (const statement of prepared)
@@ -230,9 +220,9 @@ function createBunEngine(path) {
     values: (bind) => bind === void 0 ? stmt.values() : stmt.values(bind)
   });
   return {
-    prepare: (sql) => wrapStatement(db.prepare(sql)),
-    exec: (sql) => {
-      db.exec(sql);
+    prepare: (sql2) => wrapStatement(db.prepare(sql2)),
+    exec: (sql2) => {
+      db.exec(sql2);
     },
     close: () => db.close(),
     get inTransaction() {
@@ -244,6 +234,14 @@ function createBunEngine(path) {
   };
 }
 function createShimmedDatabase(path) {
+  if (path && path !== ":memory:" && !path.startsWith("file:")) {
+    try {
+      closeSync(openSync(path, "wx", 384));
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+    }
+  }
   const engine = isBunRuntime() ? createBunEngine(path) : createWasmEngine(path);
   return new ShimmedDatabase(engine);
 }
@@ -276,10 +274,10 @@ function ensureDatabaseDirectory(path) {
 }
 
 // packages/db/dist/database.js
-import { asc, eq, desc, and, gt, inArray, or } from "drizzle-orm";
+import { asc, eq, desc, and, gt, inArray, or, sql } from "drizzle-orm";
 import { createHash, randomUUID } from "node:crypto";
 import { join } from "node:path";
-import { closeSync, existsSync as existsSync2, openSync, readSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
+import { closeSync as closeSync2, existsSync as existsSync2, openSync as openSync2, readSync, renameSync, rmSync } from "node:fs";
 
 // packages/db/dist/schema.js
 var schema_exports = {};
@@ -818,17 +816,12 @@ function resetOsecDatabase(dbPath) {
 function repairOsecDatabase(dbPath) {
   const path = resolveOsecDbPath(dbPath);
   ensureDatabaseDirectory(path);
-  clearStaleLockIfAny(path);
   const backupPath = backupCorruptDatabase(path) ?? void 0;
   resetOsecDatabase(path);
   const db = new osecDB(path);
   db.close();
   return { path, backupPath };
 }
-function isRecoverableDatabaseError(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  return /database disk image is malformed|file is not a database|malformed|invalid page number|database main|btree|b-tree|database corrupt/i.test(message);
-}
 function timestampTag() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 }
@@ -858,81 +851,22 @@ function ensureDatabaseHealthy(sqlite) {
     throw new Error(first);
   }
 }
-function migrateWalHeaderIfNeeded(path) {
-  if (!existsSync2(path))
-    return;
-  let size;
-  try {
-    size = statSync(path).size;
-  } catch {
+function assertDatabaseEngineCompatibility(path) {
+  if (isBunRuntime() || path === ":memory:" || !existsSync2(path))
     return;
-  }
-  if (size < 20)
-    return;
-  const header = Buffer.alloc(100);
+  const header = Buffer.alloc(20);
+  const fd = openSync2(path, "r");
+  let bytesRead;
   try {
-    const fd = openSync(path, "r");
-    try {
-      readSync(fd, header, 0, 100, 0);
-    } finally {
-      closeSync(fd);
-    }
-  } catch {
-    return;
+    bytesRead = readSync(fd, header, 0, header.length, 0);
+  } finally {
+    closeSync2(fd);
   }
-  if (header.subarray(0, 15).toString("ascii") !== "SQLite format 3")
+  if (bytesRead < header.length || header.subarray(0, 16).toString("ascii") !== "SQLite format 3\0")
     return;
   if (header[18] !== 2 && header[19] !== 2)
     return;
-  const walPath = `${path}-wal`;
-  const shmPath = `${path}-shm`;
-  let hadWalData = false;
-  try {
-    if (existsSync2(walPath) && statSync(walPath).size > 0)
-      hadWalData = true;
-  } catch {
-  }
-  try {
-    const fd = openSync(path, "r+");
-    try {
-      writeSync(fd, Buffer.from([1, 1]), 0, 2, 18);
-    } finally {
-      closeSync(fd);
-    }
-  } catch (err) {
-    return;
-  }
-  for (const sidecar of [walPath, shmPath]) {
-    if (existsSync2(sidecar)) {
-      try {
-        rmSync(sidecar, { force: true });
-      } catch {
-      }
-    }
-  }
-  if (hadWalData) {
-    console.warn(`[0] Migrated ${path} from WAL mode to rollback mode for WASM engine compatibility. A non-empty WAL sidecar was present and has been removed; any uncommitted transactions from a prior crashed run were discarded.`);
-  }
-}
-function clearStaleLockIfAny(path) {
-  const lockPath = `${path}.lock`;
-  let stat;
-  try {
-    stat = statSync(lockPath);
-  } catch {
-    return;
-  }
-  if (!stat.isDirectory())
-    return;
-  const ageMs = Date.now() - stat.mtimeMs;
-  const STALE_THRESHOLD_MS = 1e4;
-  if (ageMs < STALE_THRESHOLD_MS)
-    return;
-  try {
-    rmSync(lockPath, { recursive: true, force: true });
-    console.warn(`[0] Removed stale database lock at ${lockPath} (age ${Math.floor(ageMs / 1e3)}s \u2014 previous holder likely crashed).`);
-  } catch {
-  }
+  throw new Error(`Cannot open WAL-mode database at ${path} with the Node WASM SQLite engine. The database and WAL/SHM files have been preserved. Stop all database users, back up the database together with its sidecars, then use a native SQLite connection to checkpoint the WAL and set PRAGMA journal_mode=DELETE. Do not delete WAL/SHM files or rewrite the database header. Alternatively, use the Bun native SQLite runtime.`);
 }
 var osecDB = class {
   /** Resolved storage identity for scoped stores sharing this database. */
@@ -950,11 +884,10 @@ var osecDB = class {
       return;
     }
     ensureDatabaseDirectory(path);
-    this.openWithRecovery(path);
+    this.openDatabase(path);
   }
-  openWithRecovery(path) {
-    migrateWalHeaderIfNeeded(path);
-    clearStaleLockIfAny(path);
+  openDatabase(path) {
+    assertDatabaseEngineCompatibility(path);
     try {
       this.initializeDatabase(path);
     } catch (error) {
@@ -962,11 +895,7 @@ var osecDB = class {
         this.sqlite?.close();
       } catch {
       }
-      if (!isRecoverableDatabaseError(error))
-        throw error;
-      const backupPath = backupCorruptDatabase(path);
-      this.initializeDatabase(path);
-      console.warn(backupPath ? `[0] Recovered malformed database at ${path}. Backup saved to ${backupPath}.` : `[0] Recovered malformed database state at ${path} by recreating a fresh database.`);
+      throw error;
     }
   }
   initializeDatabase(path) {
@@ -981,6 +910,7 @@ var osecDB = class {
     })();
   }
   initializeReadOnlyDatabase(path) {
+    assertDatabaseEngineCompatibility(path);
     this.sqlite = createShimmedDatabase(path);
     this.sqlite.pragma("foreign_keys = ON");
     this.db = createDrizzleFromShim(this.sqlite, { schema: schema_exports });
@@ -1793,10 +1723,10 @@ var osecDB = class {
     this.updateFindingTriageByFingerprint(finding.fingerprint, triageStatus, triageNote);
   }
   getLatestFindingByFingerprint(fingerprint) {
-    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp)).get();
+    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp), desc(findings.id)).get();
   }
   getRelatedFindings(fingerprint) {
-    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp)).all();
+    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp), desc(findings.id)).all();
   }
   // ── Status Pipeline: discovered → verified → confirmed → scored → reported → fixed ──
   transitionFindingStatus(findingId, newStatus) {
@@ -1901,6 +1831,14 @@ var osecDB = class {
       conditions.push(eq(pipelineEvents.eventType, opts.eventType));
     return this.db.select().from(pipelineEvents).where(and(...conditions)).orderBy(pipelineEvents.timestamp).all();
   }
+  /** Bounded retained receipts for explicit verification lifecycle recovery. */
+  getRecentScanEvents(scanId, eventType, limit2 = 100, tools) {
+    if (!Number.isSafeInteger(limit2) || limit2 < 1 || limit2 > 500)
+      throw new Error("invalid scan event limit");
+    if (tools && (!tools.length || tools.length > 10 || tools.some((tool) => !/^[a-z_]{1,64}$/.test(tool))))
+      throw new Error("invalid receipt tools");
+    return this.db.select().from(pipelineEvents).where(and(eq(pipelineEvents.scanId, scanId), eq(pipelineEvents.eventType, eventType), tools ? inArray(sql`CASE WHEN json_valid(${pipelineEvents.payload}) THEN json_extract(${pipelineEvents.payload}, '$.tool') ELSE '' END`, tools) : void 0)).orderBy(desc(pipelineEvents.timestamp), desc(pipelineEvents.id)).limit(limit2).all();
+  }
   listRecentEvents(limit2 = 50) {
     return this.db.select({
       id: pipelineEvents.id,
@@ -2906,6 +2844,7 @@ function initializeLearningTables(db) {
     CREATE TABLE IF NOT EXISTS learning_active(project_id TEXT NOT NULL,kind TEXT NOT NULL,target_id TEXT NOT NULL,candidate_id TEXT NOT NULL,PRIMARY KEY(project_id,kind,target_id));
     CREATE TABLE IF NOT EXISTS learning_work(id TEXT PRIMARY KEY,event_id TEXT NOT NULL,kind TEXT NOT NULL,status TEXT NOT NULL,attempts INTEGER NOT NULL DEFAULT 0,available_at INTEGER NOT NULL,lease_until INTEGER,claim_token TEXT,owner TEXT,UNIQUE(event_id,kind));
     CREATE INDEX IF NOT EXISTS learning_events_project ON learning_events(project_id,updated_at);
+    CREATE INDEX IF NOT EXISTS learning_knowledge_project_id ON learning_knowledge(project_id,id);
     CREATE INDEX IF NOT EXISTS learning_work_ready ON learning_work(status,available_at,lease_until);`);
 }
 function appendLearningEvent(db, input) {
@@ -2993,9 +2932,91 @@ var LearningStore = class {
   listKnowledge(options) {
     return this.#list("learning_knowledge", options);
   }
+  /** Stable keyset pages for source freshness checks, unaffected by status updates. */
+  listCurrentSourceKnowledgePage(projectId, afterId, pageSize = 200) {
+    bounded(projectId, "project ID");
+    if (afterId !== void 0)
+      bounded(afterId, "knowledge cursor");
+    return this.#db.prepare("SELECT body FROM learning_knowledge WHERE project_id=? AND id>? AND json_extract(body,'$.status')='current' AND json_array_length(body,'$.sourceLinks')>0 ORDER BY id LIMIT ?").all(projectId, afterId ?? "", limit(pageSize)).map((row) => JSON.parse(row.body));
+  }
   getKnowledge(id) {
     return read(this.#db, "learning_knowledge", id);
   }
+  /** Export is explicit and fails rather than silently truncating a large memory library. */
+  exportKnowledge(projectId) {
+    if (projectId !== void 0)
+      bounded(projectId, "project ID");
+    const entries = this.#db.prepare("SELECT body FROM learning_knowledge WHERE (? IS NULL OR project_id=?) ORDER BY updated_at DESC,id LIMIT 201").all(projectId ?? null, projectId ?? null).map((row) => JSON.parse(row.body));
+    if (entries.length > 200)
+      fail("More than 200 lessons. Export one project at a time.", 413);
+    return entries;
+  }
+  #importIdentity(input) {
+    return createHash2("sha256").update(JSON.stringify({ projectId: input.projectId, summary: input.summary, sourceLinks: [...input.sourceLinks].sort((a, b) => a.path.localeCompare(b.path) || a.hash.localeCompare(b.hash)) })).digest("hex");
+  }
+  #existingImport(input) {
+    const identity = this.#importIdentity(input);
+    const entries = this.#db.prepare("SELECT body FROM learning_knowledge WHERE project_id=? AND json_extract(body,'$.summary')=?").all(input.projectId, input.summary);
+    return entries.some((row) => this.#importIdentity(JSON.parse(row.body)) === identity);
+  }
+  previewKnowledgeImport(inputs, exportedAt) {
+    if (!Array.isArray(inputs) || inputs.length > 200)
+      fail("At most 200 lessons can be imported.");
+    if (!Number.isFinite(Date.parse(exportedAt)))
+      fail("Invalid export timestamp.");
+    const seen = /* @__PURE__ */ new Set();
+    return inputs.map((input) => {
+      bounded(input.id, "original lesson ID");
+      bounded(input.projectId, "project ID");
+      bounded(input.summary, "knowledge summary", 4e3);
+      sources(input.sourceLinks);
+      if (!Number.isFinite(Date.parse(input.createdAt)))
+        fail("Invalid lesson timestamp.");
+      for (const link of input.sourceLinks)
+        if (isAbsolute2(link.path) || /^[A-Za-z]:[\\/]|^\\\\/.test(link.path) || /(?:^|[\\/])\.\.(?:[\\/]|$)/.test(link.path) || !/^sha256:[a-f0-9]{64}$/i.test(link.hash))
+          fail("Imported source links must use relative paths and SHA-256 hashes.");
+      if (!Array.isArray(input.provenance) || input.provenance.length > 64)
+        fail("Invalid lesson provenance.");
+      for (const evidence of input.provenance) {
+        bounded(evidence.id, "original evidence ID");
+        bounded(evidence.kind, "evidence kind");
+        if (!Number.isFinite(Date.parse(evidence.createdAt)))
+          fail("Invalid evidence timestamp.");
+      }
+      const identity = this.#importIdentity(input);
+      const duplicate = seen.has(identity) || this.#existingImport(input);
+      seen.add(identity);
+      return duplicate;
+    });
+  }
+  /** Imported prose is retained for inspection only, never admitted as current source evidence. */
+  importKnowledge(inputs, exportedAt) {
+    return this.#db.transaction(() => {
+      const duplicates = this.previewKnowledgeImport(inputs, exportedAt);
+      let imported = 0;
+      inputs.forEach((input, index2) => {
+        if (duplicates[index2])
+          return;
+        const fingerprint = this.#importIdentity(input);
+        const event = appendLearningEvent(this.#db, { idempotencyKey: `memory-import:${fingerprint}`, projectId: input.projectId, kind: "memory-import", outcome: "retained-disabled", evidenceStrength: "hypothesis", summary: "Imported lesson retained as disabled; original provenance is untrusted data.", sourceLinks: input.sourceLinks });
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const entry = {
+          id: `knowledge:import:${fingerprint}`,
+          projectId: input.projectId,
+          summary: input.summary,
+          sourceLinks: input.sourceLinks,
+          evidenceEventIds: [event.id],
+          status: "disabled",
+          createdAt: now,
+          updatedAt: now,
+          importedFrom: { id: input.id, projectId: input.projectId, createdAt: input.createdAt, exportedAt, evidence: input.provenance }
+        };
+        write(this.#db, "learning_knowledge", entry);
+        imported++;
+      });
+      return { imported, duplicates: duplicates.filter(Boolean).length, disabled: true };
+    })();
+  }
   #checkEvidence(projectId, ids) {
     refs(ids, "evidence event IDs");
     if (!ids.length)
@@ -3006,21 +3027,45 @@ var LearningStore = class {
         fail("Evidence must belong to the same project.");
     }
   }
+  #knowledgeIdentity(input) {
+    return `knowledge:${createHash2("sha256").update(JSON.stringify({ projectId: input.projectId, summary: input.summary, sourceLinks: [...input.sourceLinks].sort((a, b) => a.path.localeCompare(b.path)), evidenceEventIds: [...input.evidenceEventIds].sort() })).digest("hex")}`;
+  }
+  /** Exact prior admission status, independent of library ordering or pagination. */
+  findSourceKnowledge(projectId, summary, sourceLinks, eventKey) {
+    const disabled = this.findDisabledSourceKnowledge(projectId, summary, sourceLinks);
+    if (disabled)
+      return disabled;
+    const row = this.#db.prepare("SELECT body FROM learning_events WHERE idempotency_key=? AND project_id=?").all(eventKey, projectId)[0];
+    if (!row)
+      return null;
+    const event = JSON.parse(row.body);
+    if (event.kind !== "source-context")
+      return null;
+    return this.getKnowledge(this.#knowledgeIdentity({ projectId, summary, sourceLinks, evidenceEventIds: [event.id] }));
+  }
+  /** Match operator-disabled source lessons independently of library pagination. */
+  findDisabledSourceKnowledge(projectId, summary, sourceLinks) {
+    const fingerprint = (links) => JSON.stringify([...links].sort((a, b) => a.path.localeCompare(b.path) || a.hash.localeCompare(b.hash)));
+    const matching = this.#db.prepare("SELECT body FROM learning_knowledge WHERE project_id=? AND json_extract(body,'$.summary')=? AND json_extract(body,'$.status')='disabled'").all(projectId, summary);
+    const requested = fingerprint(sourceLinks);
+    for (const row of matching) {
+      const prior = JSON.parse(row.body);
+      if (fingerprint(prior.sourceLinks) === requested)
+        return prior;
+    }
+    return null;
+  }
   putKnowledge(input) {
     bounded(input.projectId, "project ID");
     bounded(input.summary, "knowledge summary", 4e3);
     sources(input.sourceLinks);
     this.#checkEvidence(input.projectId, input.evidenceEventIds);
     if (input.sourceLinks.length) {
-      const fingerprint = (links) => JSON.stringify([...links].sort((a, b) => a.path.localeCompare(b.path) || a.hash.localeCompare(b.hash)));
-      const matching = this.#db.prepare("SELECT body FROM learning_knowledge WHERE project_id=? AND json_extract(body,'$.summary')=? AND json_extract(body,'$.status')='disabled'").all(input.projectId, input.summary);
-      for (const row of matching) {
-        const prior = JSON.parse(row.body);
-        if (fingerprint(prior.sourceLinks) === fingerprint(input.sourceLinks))
-          return prior;
-      }
+      const disabled = this.findDisabledSourceKnowledge(input.projectId, input.summary, input.sourceLinks);
+      if (disabled)
+        return disabled;
     }
-    const identity = `knowledge:${createHash2("sha256").update(JSON.stringify({ projectId: input.projectId, summary: input.summary, sourceLinks: [...input.sourceLinks].sort((a, b) => a.path.localeCompare(b.path)), evidenceEventIds: [...input.evidenceEventIds].sort() })).digest("hex")}`;
+    const identity = this.#knowledgeIdentity(input);
     const existing = this.getKnowledge(identity);
     if (existing)
       return existing;

package/chunks/{chunk-KCA35IL3.js → chunk-7PUJI64A.js}

@@ -2,7 +2,14 @@
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
-  EventSourceParserStream,
+  EventSourceParserStream
+} from "./chunk-ABKUI3QB.js";
+import {
+  require_auth_errors,
+  require_token_error,
+  require_token_util
+} from "./chunk-TRH2PJSN.js";
+import {
   _enum,
   any,
   array,
@@ -17,12 +24,7 @@ import {
   toJSONSchema,
   union,
   unknown
-} from "./chunk-NJLKFC66.js";
-import {
-  require_auth_errors,
-  require_token_error,
-  require_token_util
-} from "./chunk-TRH2PJSN.js";
+} from "./chunk-36J5ZLFE.js";
 import {
   __commonJS,
   __toESM
@@ -588,7 +590,7 @@ function isJSONObject(value) {
 var WORKFLOW_SERIALIZE = /* @__PURE__ */ Symbol.for("workflow-serialize");
 var WORKFLOW_DESERIALIZE = /* @__PURE__ */ Symbol.for("workflow-deserialize");
 
-// node_modules/.pnpm/@ai-sdk+provider-utils@5.0.45_zod@3.25.76/node_modules/@ai-sdk/provider-utils/dist/index.js
+// node_modules/.pnpm/@ai-sdk+provider-utils@5.0.45_zod@4.6.6/node_modules/@ai-sdk/provider-utils/dist/index.js
 function asArray(value) {
   return value === void 0 ? [] : Array.isArray(value) ? value : [value];
 }
@@ -3868,7 +3870,7 @@ function getToolCaller(tool2) {
   return tool2 == null ? void 0 : tool2.experimental_toolCaller;
 }
 
-// node_modules/.pnpm/@ai-sdk+gateway@4.0.87_zod@3.25.76/node_modules/@ai-sdk/gateway/dist/index.js
+// node_modules/.pnpm/@ai-sdk+gateway@4.0.87_zod@4.6.6/node_modules/@ai-sdk/gateway/dist/index.js
 var import_oidc = __toESM(require_dist(), 1);
 var import_oidc2 = __toESM(require_dist(), 1);
 var GATEWAY_REALTIME_SUBPROTOCOL = "ai-gateway-realtime.v1";

package/chunks/chunk-A7G6S5RA.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  expandHomePath,
+  isExistingLocalTargetPath,
+  isExplicitLocalTargetPath
+} from "./chunk-R7VWEY45.js";
+
+// packages/cli/src/engagement-plan.ts
+var PACKAGE_PREFIXES = {
+  "npm:": { ecosystem: "npm", targetType: "npm-package" },
+  "pypi:": { ecosystem: "pypi", targetType: "pypi-package" },
+  "cargo:": { ecosystem: "cargo", targetType: "cargo-package" },
+  "oci:": { ecosystem: "oci", targetType: "oci-image" }
+};
+function resolveEngagement(rawTarget) {
+  const raw = rawTarget.trim();
+  if (raw.length === 0) return { ok: false, message: "Enter a URL, source path, git URL, or ecosystem-prefixed package." };
+  for (const [prefix, packagePlan] of Object.entries(PACKAGE_PREFIXES)) {
+    if (!raw.startsWith(prefix)) continue;
+    const target = raw.slice(prefix.length).trim();
+    if (target.length === 0) return { ok: false, message: `${prefix} requires a package name.` };
+    return {
+      ok: true,
+      plan: {
+        kind: "package",
+        target,
+        targetType: packagePlan.targetType,
+        ecosystem: packagePlan.ecosystem,
+        label: `${packagePlan.ecosystem} package ${target}`
+      }
+    };
+  }
+  if (raw.startsWith("source:")) {
+    const target = raw.slice("source:".length).trim();
+    if (target.length === 0) return { ok: false, message: "source: requires a local path or git URL." };
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target: expandHomePath(target),
+        targetType: "source-code",
+        label: `source review ${target}`
+      }
+    };
+  }
+  if (raw.startsWith("git@") || raw.startsWith("git://") || raw.endsWith(".git") || raw.startsWith("https://github.com/")) {
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target: raw,
+        targetType: "source-code",
+        label: `source review ${raw}`
+      }
+    };
+  }
+  if (raw.startsWith("mcp://") || raw.startsWith("http://") || raw.startsWith("https://")) {
+    return {
+      ok: true,
+      plan: {
+        kind: "web",
+        target: raw,
+        targetType: "url",
+        label: `web target ${raw}`
+      }
+    };
+  }
+  if (isExplicitLocalTargetPath(raw) || isExistingLocalTargetPath(raw)) {
+    const target = expandHomePath(raw);
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target,
+        targetType: "source-code",
+        label: `source review ${target}`
+      }
+    };
+  }
+  return {
+    ok: false,
+    message: "Ambiguous target. Use https://\u2026, ./path, source:\u2026, npm:\u2026, pypi:\u2026, cargo:\u2026, or oci:\u2026."
+  };
+}
+
+export {
+  resolveEngagement
+};