@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/config/dispatch-thresholds-runtime.mjs

@@ -0,0 +1,38 @@
+/** Shared runtime resolver for config consumers and direct preflight tools. */
+export const DEFAULT_DISPATCH_HOST_THRESHOLDS = Object.freeze({
+  min_avail_mem_gb: 8,
+  max_load_ratio: 1.0,
+  max_mem_psi_avg10: 30,
+  max_mem_psi_avg60: 10,
+  // 08 brief/evidence retention: stop new admissions when less than 2 GiB free remains.
+  min_free_disk_gb: 2,
+});
+
+/**
+ * Configured layers can only tighten one another and the conservative defaults;
+ * minimums take MAX and maximums take MIN across build, admission and task.
+ * Validate each layer before merging so an invalid value cannot be hidden.
+ */
+export function resolveDispatchHostThresholds(buildDispatch, admissionHostResources, overlay) {
+  const configured = { ...DEFAULT_DISPATCH_HOST_THRESHOLDS };
+  const keys = [...Object.keys(DEFAULT_DISPATCH_HOST_THRESHOLDS), 'max_workers'];
+  for (const layer of [buildDispatch, admissionHostResources, overlay]) {
+    if (layer === undefined) continue;
+    if (layer === null || typeof layer !== 'object' || Array.isArray(layer)) {
+      throw new Error('OG_CONFIG_REFERENCE dispatch thresholds: must be an object');
+    }
+    for (const key of keys) {
+      const value = layer[key];
+      if (value === undefined) continue;
+      if (!Number.isFinite(value) || value < 0) {
+        throw new Error(`OG_CONFIG_REFERENCE dispatch threshold ${key}: must be a non-negative number`);
+      }
+      if (key === 'max_workers' && (!Number.isInteger(value) || value < 1)) {
+        throw new Error('OG_CONFIG_REFERENCE dispatch threshold max_workers: must be an integer >= 1 when set');
+      }
+      configured[key] = configured[key] === undefined ? value
+        : key.startsWith('min_') ? Math.max(configured[key], value) : Math.min(configured[key], value);
+    }
+  }
+  return { ...DEFAULT_DISPATCH_HOST_THRESHOLDS, ...configured };
+}

package/dist/src/config/gitignore.js

@@ -8,9 +8,11 @@
  * @module src/config/gitignore
  */
 import * as fs from 'fs/promises';
+import { existsSync, realpathSync } from 'fs';
 import * as path from 'path';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
+import { boundedSpawnSync } from '../process/bounded-child-process.mjs';
 const execFileAsync = promisify(execFile);
 const GITIGNORE_PROBE_BASENAME = '.aiwg-ignore-probe';
 // ===========================
@@ -205,4 +207,52 @@ export async function appendGitignore(projectRoot, patterns) {
         created: !fileExists && toAdd.length > 0,
     };
 }
+/**
+ * Drop files git ignores (#2555).
+ *
+ * Shared by lint and artifact discovery. `git check-ignore` is asked once for
+ * the whole set so the semantics are git's own (negations, nested
+ * `.gitignore`, `core.excludesFile`) rather than a re-implementation. Outside a
+ * repository, or without git, every file is kept. NUL delimiters preserve
+ * whitespace and quoting in filenames.
+ */
+export function dropGitignored(targetDir, files) {
+    if (files.length === 0)
+        return files;
+    try {
+        // Avoid starting Git for synthetic/source trees outside a repository. Resolve
+        // symlinked working directories just as Git does, and probe on every call so
+        // initializing a repository between scans takes effect immediately. Explicit
+        // Git environment and bare repositories still use Git's own discovery.
+        if (!process.env.GIT_DIR && !process.env.GIT_WORK_TREE && !process.env.GIT_COMMON_DIR) {
+            let directory = realpathSync(targetDir);
+            for (;;) {
+                if (existsSync(path.join(directory, '.git')) ||
+                    (existsSync(path.join(directory, 'HEAD')) &&
+                        (existsSync(path.join(directory, 'objects')) || existsSync(path.join(directory, 'commondir')))))
+                    break;
+                const parent = path.dirname(directory);
+                if (parent === directory)
+                    return files;
+                directory = parent;
+            }
+        }
+        const result = boundedSpawnSync('git', ['check-ignore', '-z', '--stdin'], 'quick', {
+            cwd: targetDir,
+            input: `${files.join('\0')}\0`,
+            encoding: 'utf8',
+        });
+        // 0 = some paths ignored, 1 = none ignored, anything else = not a repo or
+        // git unavailable, in which case nothing is filtered.
+        if (result.error || (result.status !== 0 && result.status !== 1))
+            return files;
+        const ignored = new Set((result.stdout ?? '').split('\0').filter(Boolean));
+        if (ignored.size === 0)
+            return files;
+        return files.filter((file) => !ignored.has(file));
+    }
+    catch {
+        return files;
+    }
+}
 //# sourceMappingURL=gitignore.js.map

package/dist/src/config/index-graph-overrides.js

@@ -0,0 +1,36 @@
+export const OVERRIDABLE_INDEX_GRAPHS = ['project', 'codebase'];
+/** Shared by config validation and graph loading, including non-CLI callers. */
+export function validateIndexGraphOverrides(overrides) {
+    if (overrides === undefined)
+        return [];
+    if (typeof overrides !== 'object' || overrides === null || Array.isArray(overrides)) {
+        return ['index.graphOverrides: must be an object mapping supported built-in graph names to overrides'];
+    }
+    const errors = [];
+    for (const [name, raw] of Object.entries(overrides)) {
+        const where = `index.graphOverrides.${name}`;
+        if (!OVERRIDABLE_INDEX_GRAPHS.includes(name)) {
+            errors.push(`${where}: unsupported built-in graph override (supported: ${OVERRIDABLE_INDEX_GRAPHS.join(', ')})`);
+            continue;
+        }
+        if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+            errors.push(`${where}: must be an object`);
+            continue;
+        }
+        const override = raw;
+        for (const field of Object.keys(override)) {
+            if (field !== 'scanDirs' && field !== 'extensions') {
+                errors.push(`${where}.${field}: unknown field (supported: scanDirs, extensions)`);
+            }
+        }
+        for (const field of ['scanDirs', 'extensions']) {
+            const value = override[field];
+            if (value !== undefined && (!Array.isArray(value) || value.length === 0 ||
+                !value.every(item => typeof item === 'string' && item.trim().length > 0))) {
+                errors.push(`${where}.${field}: must be a non-empty array of strings`);
+            }
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=index-graph-overrides.js.map

package/dist/src/config/project-artifacts-health.d.mts

@@ -0,0 +1,37 @@
+export type ProjectArtifactHealthClassification =
+  | 'local'
+  | 'healthy-split-root'
+  | 'degraded-offline'
+  | 'legacy-missing-control-plane'
+  | 'duplicated-identical'
+  | 'duplicated-divergent';
+
+export interface ProjectControlFileHealth {
+  file: string;
+  local: boolean;
+  external: boolean;
+  identical: boolean | null;
+}
+
+export interface ProjectArtifactHealth {
+  classification: ProjectArtifactHealthClassification;
+  severity: 'ok' | 'warning' | 'error';
+  external_configured: boolean;
+  source: { kind: string; key?: string; path?: string };
+  local_control_root: string;
+  artifact_root: string;
+  external_reachable: boolean;
+  control_files: ProjectControlFileHealth[];
+  missing_local_control_files: string[];
+  divergent_control_files: string[];
+  duplicated_local_corpus_files: string[];
+  divergent_local_corpus_files: string[];
+  repairable: boolean;
+  action: string | null;
+}
+
+export const PROJECT_CONTROL_PLANE_FILES: readonly string[];
+export function auditProjectArtifactHealth(
+  projectDir: string,
+  env?: Record<string, string | undefined>,
+): ProjectArtifactHealth;

package/dist/src/config/project-artifacts-health.mjs

@@ -10,6 +10,7 @@ import { join, relative, resolve, sep } from 'node:path';
 import {
   DEFAULT_PROJECT_AIWG_DIR,
   PROJECT_AIWG_LOCATION_FILE,
+  isProjectArtifactRootExternal,
   readProjectArtifactLocation,
   resolveProjectAiwgDir,
 } from './project-artifacts-runtime.mjs';
@@ -57,8 +58,16 @@ export function auditProjectArtifactHealth(projectDir, env = process.env) {
   const localRoot = join(root, DEFAULT_PROJECT_AIWG_DIR);
   const artifactRoot = resolveProjectAiwgDir(root, env);
   const source = configuredSource(root, env);
-  const externalConfigured = resolve(localRoot) !== resolve(artifactRoot);
-  const externalReachable = existsSync(artifactRoot) && statSync(artifactRoot).isDirectory();
+  // Cheap, read-only check for whether an external root is configured at all
+  // — reused so repair's early refusal (src/artifacts/repair.ts) and this
+  // audit agree on the same definition of "local mode" (#274).
+  const externalConfigured = isProjectArtifactRootExternal(root, env);
+  // In local mode (no external root configured) artifactRoot === localRoot:
+  // there is nothing external to reach or compare against. Skip the
+  // reachability stat and the full-corpus listing/byte-compare entirely —
+  // previously this read and byte-compared every local payload file with
+  // itself on every `aiwg status`/`doctor`/`repair` call (#274).
+  const externalReachable = externalConfigured && existsSync(artifactRoot) && statSync(artifactRoot).isDirectory();
 
   const controls = PROJECT_CONTROL_PLANE_FILES.map((file) => {
     const localPath = join(localRoot, file);
@@ -69,7 +78,9 @@ export function auditProjectArtifactHealth(projectDir, env = process.env) {
   });
   const missingLocal = controls.filter((item) => !item.local).map((item) => item.file);
   const divergentControl = controls.filter((item) => item.identical === false).map((item) => item.file);
-  const localPayload = listFiles(localRoot).filter((file) => !PROJECT_CONTROL_PLANE_FILES.includes(file));
+  const localPayload = externalConfigured
+    ? listFiles(localRoot).filter((file) => !PROJECT_CONTROL_PLANE_FILES.includes(file))
+    : [];
   const divergentPayload = externalReachable
     ? localPayload.filter((file) => !sameFile(join(localRoot, file), join(artifactRoot, file)))
     : [];

package/dist/src/config/project-artifacts-runtime.d.mts

@@ -0,0 +1,16 @@
+export const DEFAULT_PROJECT_AIWG_DIR: '.aiwg';
+export const AIWG_ARTIFACTS_PATH_ENV: 'AIWG_ARTIFACTS_PATH';
+export const PROJECT_AIWG_LOCATION_FILE: '.aiwg-location';
+
+export type ProjectArtifactEnv = Record<string, string | undefined>;
+
+export function expandProjectArtifactPath(pathValue: string, projectDir: string): string;
+export function parseProjectArtifactLocation(contents: string): string | null;
+export function readProjectArtifactLocation(projectDir: string): string | null;
+export function resolveProjectAiwgDir(projectDir: string, env?: ProjectArtifactEnv): string;
+export function isProjectArtifactRootExternal(projectDir: string, env?: ProjectArtifactEnv): boolean;
+export function resolveProjectAiwgDirForWrite(projectDir: string, env?: ProjectArtifactEnv): string;
+export function resolveProjectControlDir(projectDir: string): string;
+export function projectAiwgPath(projectDir: string, ...segments: string[]): string;
+export function projectAiwgWritePath(projectDir: string, ...segments: string[]): string;
+export function projectControlPath(projectDir: string, ...segments: string[]): string;

package/dist/src/config/user-config-dir.d.mts

@@ -0,0 +1,9 @@
+export interface UserConfigDirOptions {
+  configDir?: string;
+  env?: Record<string, string | undefined>;
+  homeDir?: string;
+  exists?: (path: string) => boolean;
+}
+
+export function resolveUserConfigDir(options?: UserConfigDirOptions): string;
+export function userConfigFile(name: string, options?: UserConfigDirOptions): string;

package/dist/src/config/user-config.js

@@ -24,6 +24,7 @@ import { resolveUserConfigDir } from './user-config-dir.mjs';
  */
 export const KNOWN_CONFIG_FILES = [
     { filename: 'config.yaml', description: 'Global AIWG user preferences' },
+    { filename: 'aiwg.config', description: 'Operator rule pins and capability groups' },
     { filename: 'models.json', description: 'Model tier and provider overrides' },
     { filename: 'ops.json', description: 'Ops workspace registry' },
     { filename: 'mcp-servers.json', description: 'MCP server registry (single source of truth)' },
@@ -122,7 +123,7 @@ export class UserConfig {
             try {
                 await access(filePath);
                 const content = await readFile(filePath, 'utf-8');
-                if (spec.filename.endsWith('.json')) {
+                if (spec.filename.endsWith('.json') || spec.filename === 'aiwg.config') {
                     result[spec.filename] = JSON.parse(content);
                 }
                 else {
@@ -245,10 +246,8 @@ export class UserConfig {
         if (this.configCache) {
             return this.configCache;
         }
-        const configPath = resolve(this.configDir, 'config.yaml');
-        try {
-            const content = await readFile(configPath, 'utf-8');
-            const parsed = parseYamlSimple(content);
+        const parsed = await this.readConfig();
+        if (parsed) {
             this.configCache = {
                 ...DEFAULT_USER_CONFIG,
                 ...parsed,
@@ -259,7 +258,7 @@ export class UserConfig {
             };
             return this.configCache;
         }
-        catch {
+        else {
             // File doesn't exist — return defaults (don't create file yet)
             this.configCache = {
                 ...DEFAULT_USER_CONFIG,
@@ -271,10 +270,24 @@ export class UserConfig {
             return this.configCache;
         }
     }
+    async readConfig() {
+        const configPath = resolve(this.configDir, 'config.yaml');
+        try {
+            const content = await readFile(configPath, 'utf-8');
+            return parseYamlSimple(content);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw new Error(`Failed to load ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     /**
      * Save config.yaml
      */
     async saveConfig(config) {
+        // Recheck the existing file even when defaults or cached values are being saved.
+        await this.readConfig();
         await this.ensureDir();
         const configPath = resolve(this.configDir, 'config.yaml');
         const yaml = serializeYamlSimple(config);
@@ -304,11 +317,15 @@ export function parseYamlSimple(content) {
             continue;
         const key = match[1].trim();
         const rawValue = match[2].trim();
+        // Config keys have no legitimate use for prototype-related names at any level.
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            throw new Error('Unsafe config key: prototype-related names are not allowed');
+        }
         if (indent === 0) {
             if (rawValue === '' || rawValue === undefined) {
                 // Section header
                 currentSection = key;
-                if (!(key in result)) {
+                if (!Object.hasOwn(result, key)) {
                     result[key] = {};
                 }
             }
@@ -375,7 +392,7 @@ function getNestedValue(obj, path) {
     const parts = path.split('.');
     let current = obj;
     for (const part of parts) {
-        if (current === null || current === undefined || typeof current !== 'object') {
+        if (current === null || current === undefined || typeof current !== 'object' || !Object.hasOwn(current, part)) {
             return undefined;
         }
         current = current[part];
@@ -384,15 +401,25 @@ function getNestedValue(obj, path) {
 }
 function setNestedValue(obj, path, value) {
     const parts = path.split('.');
+    // Reject the entire path before mutating config; key uses below also guard each segment.
+    if (parts.some(part => part === '__proto__' || part === 'constructor' || part === 'prototype')) {
+        throw new Error('Unsafe config key path: prototype-related segments are not allowed');
+    }
     let current = obj;
-    for (let i = 0; i < parts.length - 1; i++) {
+    for (let i = 0; i < parts.length; i++) {
         const part = parts[i];
-        if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
+        if (part === '__proto__' || part === 'constructor' || part === 'prototype') {
+            throw new Error('Unsafe config key path: prototype-related segments are not allowed');
+        }
+        if (i === parts.length - 1) {
+            current[part] = value;
+            return;
+        }
+        if (!Object.hasOwn(current, part) || typeof current[part] !== 'object' || current[part] === null) {
             current[part] = {};
         }
         current = current[part];
     }
-    current[parts[parts.length - 1]] = value;
 }
 function parseValue(value) {
     if (value === 'true')

package/dist/src/config/user-registry.js

@@ -12,7 +12,6 @@
  * --scope user` works from any cwd.
  */
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { userScopeConfigPath } from '../cli/scope-resolver.js';
 /**
@@ -46,28 +45,37 @@ export function emptyUserRegistry() {
     return { version: '1', installed: {} };
 }
 /**
- * Read the per-user registry. Returns an empty registry when the file doesn't
- * exist — that's the normal case before the operator's first `aiwg use --scope
- * user`. On parse failure returns the empty registry and writes a stderr
- * warning (the broken file is preserved so the operator can inspect it).
+ * Read the user registry while preserving whether empty means absent or
+ * unreadable. Callers making adoption/readiness claims must not collapse a
+ * corrupt or inaccessible registry into proof that an addon is missing.
  */
-export async function readUserRegistry() {
-    const path = userRegistryPath();
-    if (!existsSync(path))
-        return emptyUserRegistry();
+export async function inspectUserRegistry() {
+    const registryFile = userRegistryPath();
     try {
-        const raw = await readFile(path, 'utf-8');
+        const raw = await readFile(registryFile, 'utf-8');
         const parsed = JSON.parse(raw);
-        if (!parsed.installed || typeof parsed.installed !== 'object') {
-            return emptyUserRegistry();
+        if (!parsed.installed || typeof parsed.installed !== 'object' || Array.isArray(parsed.installed)) {
+            throw new Error('installed must be an object');
         }
-        return { version: '1', installed: parsed.installed };
+        return { registry: { version: '1', installed: parsed.installed }, status: 'available' };
     }
     catch (err) {
-        process.stderr.write(`[user-registry] failed to parse ${path}: ${err instanceof Error ? err.message : String(err)} — using empty registry\n`);
-        return emptyUserRegistry();
+        if (err.code === 'ENOENT') {
+            return { registry: emptyUserRegistry(), status: 'absent' };
+        }
+        process.stderr.write(`[user-registry] failed to parse ${registryFile}: ${err instanceof Error ? err.message : String(err)} — using empty registry\n`);
+        return { registry: emptyUserRegistry(), status: 'unreadable' };
     }
 }
+/**
+ * Read the per-user registry. Returns an empty registry when the file doesn't
+ * exist — that's the normal case before the operator's first `aiwg use --scope
+ * user`. On parse failure returns the empty registry and writes a stderr
+ * warning (the broken file is preserved so the operator can inspect it).
+ */
+export async function readUserRegistry() {
+    return (await inspectUserRegistry()).registry;
+}
 /**
  * Persist the user registry. Creates the parent directory if missing.
  */

package/dist/src/config/user-state.js

@@ -0,0 +1,7 @@
+import os from 'node:os';
+import path from 'node:path';
+/** Host-local AIWG state, shared by CLI telemetry and maintenance leases. */
+export function getUserStateDir(env = process.env) {
+    return path.join(env.XDG_STATE_HOME || path.join(env.HOME || os.homedir(), '.local', 'state'), 'aiwg');
+}
+//# sourceMappingURL=user-state.js.map

package/dist/src/decision/adapters/jev.js

@@ -2,7 +2,6 @@ import { DecisionValidationError, validateDecisionValue, validateDistribution }
 import { canonicalJson } from '../../security/artifact-trust.js';
 import { partitionProjectedState } from '../projection.js';
 import { isTraceparent } from '../telemetry/context.js';
-import { runInNewContext } from 'node:vm';
 import { lookup } from 'node:dns/promises';
 import { isIP } from 'node:net';
 import { request as httpsRequest } from 'node:https';
@@ -12,7 +11,7 @@ export const JEV_ENDPOINT = 'https://api.typesafe.ai/v1/systemone';
 const MAX_HEADER_BYTES = 32 * 1024;
 const MAX_BODY_BYTES = 1024 * 1024;
 const MAX_REQUEST_ID_LENGTH = 128;
-const MAX_PARSE_MS = 50;
+const MAX_PARSE_DEPTH = 64;
 /** Safe resolver taxonomy; messages are intentionally discarded at this boundary. */
 export class JevCredentialError extends Error {
     category;
@@ -45,6 +44,7 @@ export class JevDecisionAdapter {
         this.region = options.region?.trim() ? options.region : null;
         this.observeResponseBody = options.observeResponseBody;
     }
+    /** Used only for non-2xx error bodies, where there is no separate successful parse to stay consistent with. */
     observeResponse(body) {
         if (!this.observeResponseBody)
             return;
@@ -61,6 +61,30 @@ export class JevDecisionAdapter {
         this.observeResponseBody(body, { actualModel: typeof parsed.model === 'string' && parsed.model ? parsed.model : null,
             usage });
     }
+    /**
+     * Derives the observer's model/usage from a value `parseBoundedJson` has already produced (or `undefined`
+     * on a failed parse) -- never from a second, independent parse of the same bytes. `parseBoundedJson` runs
+     * inside a bounded-time VM context (`MAX_PARSE_MS`); calling it twice on identical bytes let one call
+     * succeed while the other spuriously hit that wall-clock bound under host contention, so the reported
+     * metadata could disagree with the actual parsed answer even though both described one response.
+     */
+    observationMetadataOf(parsed) {
+        let record = {};
+        try {
+            record = asRecord(parsed);
+        }
+        catch { /* A non-object (or absent) top-level value has no model; usage stays unknown. */ }
+        let usage = emptyUsage();
+        try {
+            usage = normalizeUsage(record.usage);
+        }
+        catch { /* Missing usage is unknown, including on auth errors. */ }
+        return { actualModel: typeof record.model === 'string' && record.model ? record.model : null, usage };
+    }
+    /** Observes exactly once, from the single parse attempt `parsed` already represents (successful or not). */
+    observeParsed(body, parsed) {
+        this.observeResponseBody?.(body, this.observationMetadataOf(parsed));
+    }
     async capabilities() {
         return {
             answerKinds: ['choice', 'ordinal-score', 'truth-probability'],
@@ -191,9 +215,7 @@ export class JevDecisionAdapter {
                     try {
                         parsedError = parseBoundedJson(errorBody);
                     }
-                    catch (error) {
-                        if (error && typeof error === 'object' && 'code' in error && error.code === 'ERR_SCRIPT_EXECUTION_TIMEOUT')
-                            throw error;
+                    catch {
                         parsedError = null;
                     }
                     if (parsedError && typeof parsedError === 'object' && !Array.isArray(parsedError)) {
@@ -217,8 +239,15 @@ export class JevDecisionAdapter {
         let parsed;
         try {
             const encoded = await readBoundedBody(response, signal);
-            this.observeResponse(encoded);
-            parsed = parseBoundedJson(encoded);
+            // One parse attempt; the observer reads its outcome (success or failure) before answer validation,
+            // so an invalid answer still gets model/usage checked, and a parse failure is reported as unknown
+            // to both the observer and the main path -- never divergently.
+            try {
+                parsed = parseBoundedJson(encoded);
+            }
+            finally {
+                this.observeParsed(encoded, parsed);
+            }
             if (request.signal.aborted)
                 return externalInterruption(request, 'terminal-response', metadata);
             if (deadline.aborted)
@@ -334,8 +363,14 @@ export class JevDecisionAdapter {
         }
         try {
             const encoded = await readBoundedBody(response, signal);
-            this.observeResponse(encoded);
-            const parsed = parseBoundedJson(encoded);
+            // One parse attempt; see the single-request `evaluate()` for why observation never re-parses.
+            let parsed;
+            try {
+                parsed = parseBoundedJson(encoded);
+            }
+            finally {
+                this.observeParsed(encoded, parsed);
+            }
             const normalized = normalizeBatchResponse(requests, parsed).map(answer => ({
                 questionId: answer.questionId,
                 observation: { ...answer.observation, ...metadata },
@@ -574,19 +609,21 @@ function safeRequestId(value) {
     return typeof value === 'string' && value.length > 0 && value.length <= MAX_REQUEST_ID_LENGTH
         && /^[\x21-\x7e]+$/.test(value) && !value.includes(',') ? value : null;
 }
-function parseBoundedJson(text) {
-    rejectDuplicateAnswerKeys(text);
-    return structuredClone(runInNewContext('JSON.parse(input)', { input: text }, { timeout: MAX_PARSE_MS }));
-}
-/** Detect duplicate keys in the response's answer map before JSON.parse erases them. */
-function rejectDuplicateAnswerKeys(text) {
-    const marker = /"answers"\s*:\s*\{/g.exec(text);
-    if (!marker)
-        return;
-    let index = marker.index + marker[0].length;
-    let depth = 1;
-    const keys = new Set();
-    while (index < text.length && depth > 0) {
+/** @internal Exported from this module for direct admission and CPU-cost evidence, not the public barrel. */
+export function parseBoundedJson(text) {
+    // Bound work, not elapsed time: a VM timeout includes host scheduling delay.
+    // The stream reader also enforces this bound, before UTF-8 decoding.
+    if (text.length > MAX_BODY_BYTES || Buffer.byteLength(text, 'utf8') > MAX_BODY_BYTES) {
+        throw new DecisionValidationError('Jev response too large');
+    }
+    // Scan iteratively before allocation by JSON.parse. Total key text/count is
+    // bounded by body bytes; no recursive walk or suffix copying is needed.
+    // String/key spans are disjoint; skip the whitespace consumed by lookahead.
+    // Each code unit is visited once. Key slicing/decoding/hashing sum to
+    // O(body bytes), as does native parsing.
+    const containers = [];
+    let index = 0;
+    while (index < text.length) {
         const char = text[index];
         if (char === '"') {
             const start = index++;
@@ -600,20 +637,31 @@ function rejectDuplicateAnswerKeys(text) {
                 else if (next === '"')
                     break;
             }
-            if (depth === 1 && /^\s*:/.test(text.slice(index))) {
+            let next = index;
+            while (next < text.length && /[\x20\t\r\n]/.test(text[next]))
+                next += 1;
+            const keys = containers.at(-1);
+            if (keys && text[next] === ':') {
                 const key = JSON.parse(text.slice(start, index));
                 if (keys.has(key))
-                    throw new DecisionValidationError('duplicate Jev answer key');
+                    throw new DecisionValidationError('duplicate Jev response key');
                 keys.add(key);
             }
+            index = next;
             continue;
         }
-        if (char === '{' || char === '[')
-            depth += 1;
+        if (char === '{' || char === '[') {
+            if (containers.length >= MAX_PARSE_DEPTH)
+                throw new DecisionValidationError('Jev response nesting too deep');
+            containers.push(char === '{' ? new Set() : null);
+        }
         else if (char === '}' || char === ']')
-            depth -= 1;
+            containers.pop();
         index += 1;
     }
+    // Native parsing checks the complete JSON grammar, with no reviver or code
+    // execution. Input bytes and nesting bound its work and allocated graph.
+    return JSON.parse(text);
 }
 function headersWithinLimit(headers) {
     let bytes = 0;