@alisio/core 0.1.0-alpha.10

package/dist/resources/skills.d.ts

@@ -0,0 +1,82 @@
+export interface Skill {
+    /** Backward-compatible load id. */
+    name: string;
+    /** Stable catalog id; plugin skills are namespaced by their registering plugin. */
+    id: string;
+    effectiveId: string;
+    displayId: string;
+    description: string;
+    directory: string;
+    file: string;
+    scope: SkillScope;
+    source: string;
+    owner?: {
+        id: string;
+        name: string;
+    };
+    manageable: boolean;
+    locked: boolean;
+    enabled: boolean;
+    effective: boolean;
+    shadowedBy?: string;
+    approximateTokens: number;
+}
+export type SkillCatalogEntry = Omit<Skill, "directory" | "file">;
+export type SkillScope = "project" | "config" | "user" | "plugin";
+export interface SkillRoot {
+    dir: string;
+    scope: SkillScope;
+    source?: string;
+    owner?: {
+        id: string;
+        name: string;
+    };
+}
+/**
+ * Discovery roots in precedence order (first wins): project `.agents/skills`, `.alisio/skills`
+ * and `.claude/skills` (compat) from cwd up to the workspace root (trusted projects only), then
+ * explicitly configured paths, then `~/.agents/skills` and `<config home>/skills`, then plugins.
+ */
+export declare function skillRoots(options: {
+    workspace: string;
+    cwd: string;
+    home: string;
+    configHome: string;
+    trusted: boolean;
+    configSkills?: string[];
+    pluginRoots?: Array<string | {
+        dir: string;
+        plugin: string;
+        name?: string;
+    }>;
+}): SkillRoot[];
+export declare class Skills {
+    items: Map<string, Skill>;
+    /** Every valid discovered skill, including lower-precedence shadowed entries. */
+    entries: Skill[];
+    diagnostics: string[];
+    private effective;
+    private overrides;
+    private seen;
+    private scanned;
+    private maxDepth;
+    private maxDirs;
+    constructor(options?: {
+        maxDepth?: number;
+        maxDirs?: number;
+        overrides?: Record<string, {
+            enabled: boolean;
+        }>;
+    });
+    /** Roots in precedence order; plain strings are treated as user-level roots. */
+    discover(roots: Array<string | SkillRoot>): Promise<void>;
+    private walk;
+    private parse;
+    catalog(): string;
+    /** Safe catalog metadata: no absolute paths and no skill body text. */
+    catalogEntries(): SkillCatalogEntry[];
+    setEnabled(id: string, enabled: boolean): Skill;
+    private refreshEnabledItems;
+    load(name: string): Promise<string>;
+    resource(name: string, path: string): Promise<string>;
+}

package/dist/resources/skills.js

@@ -0,0 +1,214 @@
+import { readdir, realpath } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { parse } from "yaml";
+import { z } from "zod";
+import { exists, fileSize, readText } from "../runtime/fs.js";
+import { safePath } from "../runtime/paths.js";
+/** Agent Skills name rule: 1-64 lowercase letters/digits, single hyphens, no edge hyphens. */
+const metadata = z.object({
+    name: z
+        .string()
+        .max(64)
+        .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "name must be lowercase letters, digits and single hyphens"),
+    description: z.string().min(1).max(1024),
+});
+/**
+ * Discovery roots in precedence order (first wins): project `.agents/skills`, `.alisio/skills`
+ * and `.claude/skills` (compat) from cwd up to the workspace root (trusted projects only), then
+ * explicitly configured paths, then `~/.agents/skills` and `<config home>/skills`, then plugins.
+ */
+export function skillRoots(options) {
+    const roots = [];
+    if (options.trusted) {
+        let dir = options.cwd;
+        while (true) {
+            for (const convention of [".agents", ".alisio", ".claude"])
+                roots.push({ dir: join(dir, convention, "skills"), scope: "project" });
+            if (dir === options.workspace || dirname(dir) === dir)
+                break;
+            dir = dirname(dir);
+        }
+    }
+    for (const dir of options.configSkills ?? [])
+        roots.push({ dir, scope: "config", source: "configured" });
+    roots.push({ dir: join(options.home, ".agents", "skills"), scope: "user", source: "user" }, { dir: join(options.configHome, "skills"), scope: "user", source: "user" });
+    for (const value of options.pluginRoots ?? []) {
+        if (typeof value === "string")
+            roots.push({ dir: value, scope: "plugin", source: "plugin" });
+        else
+            roots.push({
+                dir: value.dir,
+                scope: "plugin",
+                source: "plugin",
+                owner: { id: value.plugin, name: value.name ?? value.plugin },
+            });
+    }
+    return roots;
+}
+export class Skills {
+    items = new Map();
+    /** Every valid discovered skill, including lower-precedence shadowed entries. */
+    entries = [];
+    diagnostics = [];
+    effective = new Map();
+    overrides;
+    seen = new Set();
+    scanned = 0;
+    maxDepth;
+    maxDirs;
+    constructor(options = {}) {
+        this.maxDepth = options.maxDepth ?? 5;
+        this.maxDirs = options.maxDirs ?? 2000;
+        this.overrides = { ...(options.overrides ?? {}) };
+    }
+    /** Roots in precedence order; plain strings are treated as user-level roots. */
+    async discover(roots) {
+        this.items.clear();
+        this.entries = [];
+        this.effective.clear();
+        this.diagnostics = [];
+        this.seen.clear();
+        this.scanned = 0;
+        for (const root of roots) {
+            const entry = typeof root === "string" ? { dir: root, scope: "user" } : root;
+            await this.walk(entry.dir, 0, entry);
+        }
+        this.refreshEnabledItems();
+    }
+    async walk(path, depth, root) {
+        if (depth > this.maxDepth)
+            return;
+        if (this.scanned >= this.maxDirs) {
+            if (this.scanned === this.maxDirs) {
+                this.diagnostics.push(`Skill scan limit of ${this.maxDirs} directories reached; stopped at ${path}`);
+                this.scanned++;
+            }
+            return;
+        }
+        let canonical;
+        try {
+            canonical = await realpath(path);
+        }
+        catch (e) {
+            if (["ENOENT", "ENOTDIR"].includes(e.code ?? ""))
+                return;
+            throw e;
+        }
+        if (this.seen.has(canonical))
+            return;
+        this.seen.add(canonical);
+        this.scanned++;
+        const file = join(canonical, "SKILL.md");
+        if (await exists(file)) {
+            try {
+                await safePath(canonical, file);
+                const data = await this.parse(file);
+                if (data.name !== basename(canonical))
+                    this.diagnostics.push(`Skill ${data.name} lives in directory "${basename(canonical)}" (spec expects the same name); loaded anyway: ${file}`);
+                const existing = this.effective.get(data.name);
+                const displayId = root.owner ? `${root.owner.id}:${data.name}` : data.name;
+                const duplicate = this.entries.filter((entry) => entry.displayId === displayId).length;
+                const id = duplicate ? `${displayId}#shadow-${duplicate}` : displayId;
+                const size = (await fileSize(file)) ?? 0;
+                const item = {
+                    ...data,
+                    id,
+                    effectiveId: existing?.effectiveId ?? id,
+                    displayId,
+                    directory: canonical,
+                    file,
+                    scope: root.scope,
+                    source: root.source ?? root.scope,
+                    ...(root.owner ? { owner: root.owner } : {}),
+                    manageable: root.scope !== "plugin",
+                    locked: root.scope === "plugin",
+                    enabled: root.scope === "plugin" ? true : this.overrides[id]?.enabled !== false,
+                    effective: !existing,
+                    ...(existing ? { shadowedBy: existing.displayId } : {}),
+                    approximateTokens: Math.max(1, Math.ceil(size / 4)),
+                };
+                this.entries.push(item);
+                if (existing)
+                    this.diagnostics.push(`Skill ${data.name} from ${file} (${root.scope}) is shadowed: ${existing.file} (${existing.scope}) overrides it`);
+                else
+                    this.effective.set(data.name, item);
+            }
+            catch (e) {
+                this.diagnostics.push(`${file}: ${e instanceof Error ? e.message : String(e)}`);
+            }
+            return;
+        }
+        let entries;
+        try {
+            entries = await readdir(canonical, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name)))
+            if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules")
+                await this.walk(join(canonical, entry.name), depth + 1, root);
+    }
+    async parse(file) {
+        if (((await fileSize(file)) ?? 0) > 64_000)
+            throw new Error("Skill exceeds 64 KB");
+        const text = await readText(file);
+        const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+        if (!match?.[1])
+            throw new Error("Missing YAML frontmatter");
+        return metadata.parse(parse(match[1], { maxAliasCount: 20 }));
+    }
+    catalog() {
+        const entries = [...this.items.values()].map((s) => ({
+            name: s.name,
+            description: s.description,
+        }));
+        const text = JSON.stringify(entries);
+        if (text.length > 24_000)
+            return "Large skill catalog. Use skill_search to find skills, then skill_load.";
+        return `Available skills (load instructions with skill_load):\n${text}`;
+    }
+    /** Safe catalog metadata: no absolute paths and no skill body text. */
+    catalogEntries() {
+        return this.entries.map(({ directory: _directory, file: _file, ...skill }) => ({
+            ...skill,
+            ...(skill.owner ? { owner: { ...skill.owner } } : {}),
+        }));
+    }
+    setEnabled(id, enabled) {
+        const skill = this.entries.find((entry) => entry.id === id && entry.effective);
+        if (!skill)
+            throw new Error(`Unknown effective skill: ${id}`);
+        if (!skill.manageable || skill.locked)
+            throw new Error("This skill is locked by its plugin; use /plugins to manage the owner");
+        skill.enabled = enabled;
+        this.overrides[id] = { enabled };
+        this.refreshEnabledItems();
+        return { ...skill };
+    }
+    refreshEnabledItems() {
+        this.items.clear();
+        for (const skill of this.effective.values())
+            if (skill.enabled)
+                this.items.set(skill.name, skill);
+    }
+    async load(name) {
+        const effective = this.effective.get(name) ?? this.entries.find((entry) => entry.id === name);
+        if (effective?.effective && !effective.enabled)
+            throw new Error(`Skill "${effective.displayId}" is disabled. Re-enable it with /skills.`);
+        const skill = this.items.get(name) ?? [...this.items.values()].find((entry) => entry.id === name);
+        if (!skill)
+            throw new Error(`Unknown skill: ${name}`);
+        await this.parse(skill.file);
+        return `Skill root: ${skill.directory}\nUse skill_resource to read supporting files.\n${await readText(skill.file)}`;
+    }
+    async resource(name, path) {
+        const skill = this.items.get(name);
+        if (!skill)
+            throw new Error("Unknown skill");
+        const file = await safePath(skill.directory, path);
+        if (((await fileSize(file)) ?? 0) > 32_000)
+            throw new Error("Resource exceeds 32 KB; split it into smaller files");
+        return readText(file);
+    }
+}

package/dist/runtime/fs.d.ts

@@ -0,0 +1,9 @@
+export declare function fileSize(path: string): Promise<number | undefined>;
+export declare const exists: (path: string) => Promise<boolean>;
+/** Reads UTF-8 text, refusing files larger than `maxBytes`. */
+export declare function readText(path: string, maxBytes?: number): Promise<string>;
+export declare function readJson(path: string): Promise<unknown>;
+/** First `bytes` bytes decoded as UTF-8. */
+export declare function readHead(path: string, bytes: number): Promise<string>;
+/** Executable lookup on PATH (PATHEXT on Windows), replacing Bun.which. */
+export declare function which(command: string): Promise<string | undefined>;

package/dist/runtime/fs.js

@@ -0,0 +1,73 @@
+/** Portable file helpers (node:fs) replacing Bun.file/Bun.write. */
+import { constants } from "node:fs";
+import { access, open, readFile, stat } from "node:fs/promises";
+import { delimiter, isAbsolute, join } from "node:path";
+const missing = (e) => ["ENOENT", "ENOTDIR"].includes(e.code ?? "");
+export async function fileSize(path) {
+    try {
+        const s = await stat(path);
+        return s.isFile() ? s.size : undefined;
+    }
+    catch (e) {
+        if (missing(e))
+            return undefined;
+        throw e;
+    }
+}
+export const exists = async (path) => (await fileSize(path)) !== undefined;
+/** Reads UTF-8 text, refusing files larger than `maxBytes`. */
+export async function readText(path, maxBytes = Number.POSITIVE_INFINITY) {
+    const size = await fileSize(path);
+    if (size === undefined)
+        throw Object.assign(new Error(`File not found: ${path}`), { code: "ENOENT" });
+    if (size > maxBytes)
+        throw new Error(`File exceeds ${maxBytes} bytes: ${path}`);
+    return readFile(path, "utf8");
+}
+export async function readJson(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (e) {
+        if (missing(e))
+            return undefined;
+        throw e;
+    }
+}
+/** First `bytes` bytes decoded as UTF-8. */
+export async function readHead(path, bytes) {
+    const handle = await open(path, "r");
+    try {
+        const buffer = Buffer.alloc(bytes);
+        const { bytesRead } = await handle.read(buffer, 0, bytes, 0);
+        return buffer.subarray(0, bytesRead).toString("utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Executable lookup on PATH (PATHEXT on Windows), replacing Bun.which. */
+export async function which(command) {
+    const extensions = process.platform === "win32"
+        ? ["", ...(process.env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";").filter(Boolean)]
+        : [""];
+    const candidates = isAbsolute(command)
+        ? [command]
+        : (process.env.PATH ?? "")
+            .split(delimiter)
+            .filter(Boolean)
+            .map((dir) => join(dir, command));
+    for (const base of candidates)
+        for (const ext of extensions) {
+            const path = `${base}${ext}`;
+            try {
+                await access(path, process.platform === "win32" ? constants.F_OK : constants.X_OK);
+                if ((await fileSize(path)) !== undefined)
+                    return path;
+            }
+            catch {
+                /* keep looking */
+            }
+        }
+    return undefined;
+}

package/dist/runtime/modules.d.ts

@@ -0,0 +1,16 @@
+export declare const PLUGIN_KEYWORD = "alisio-plugin";
+/** Paths start with `.`, are absolute, use `\`, end in a JS/TS extension or contain `/` unscoped. */
+export declare function isPathSpec(spec: string): boolean;
+/** Global package roots: NODE_PATH entries, the prefix of the running Node/npm, and the
+ * Alisio global plugins directory (`<configHome>/plugins`), where `alisio install` puts npm
+ * plugin packages. */
+export declare function defaultGlobalRoots(): string[];
+/**
+ * Returns the file to import (or the directory holding an alisio-plugin.json manifest).
+ * Packages are looked up from `from` upwards, then in global roots, and must declare the
+ * `alisio-plugin` keyword so a typo cannot load an unrelated package.
+ */
+export declare function resolvePluginSpec(spec: string, options: {
+    from: string;
+    globalRoots?: string[];
+}): Promise<string>;

package/dist/runtime/modules.js

@@ -0,0 +1,83 @@
+/** Resolution of explicitly trusted plugins given as a path or an npm package name. */
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { configHome } from "../config.js";
+import { readJson } from "./fs.js";
+export const PLUGIN_KEYWORD = "alisio-plugin";
+/** Paths start with `.`, are absolute, use `\`, end in a JS/TS extension or contain `/` unscoped. */
+export function isPathSpec(spec) {
+    return (spec.startsWith(".") ||
+        isAbsolute(spec) ||
+        /^[A-Za-z]:[\\/]/.test(spec) ||
+        spec.includes("\\") ||
+        /\.(?:[cm]?[jt]s|tsx|jsx)$/.test(spec) ||
+        (!spec.startsWith("@") && spec.includes("/")));
+}
+/** Global package roots: NODE_PATH entries, the prefix of the running Node/npm, and the
+ * Alisio global plugins directory (`<configHome>/plugins`), where `alisio install` puts npm
+ * plugin packages. */
+export function defaultGlobalRoots() {
+    const prefix = process.env.npm_config_prefix ?? process.env.PREFIX ?? dirname(dirname(process.execPath));
+    return [
+        ...(process.env.NODE_PATH ?? "")
+            .split(process.platform === "win32" ? ";" : ":")
+            .filter(Boolean),
+        process.platform === "win32"
+            ? join(prefix, "node_modules")
+            : join(prefix, "lib", "node_modules"),
+        join(configHome(), "plugins"),
+    ];
+}
+function entryOf(manifest) {
+    const exp = manifest.exports;
+    const pick = (value) => {
+        if (typeof value === "string")
+            return value;
+        if (value && typeof value === "object") {
+            const record = value;
+            for (const key of ["import", "node", "default"]) {
+                const found = pick(record[key]);
+                if (found)
+                    return found;
+            }
+        }
+        return undefined;
+    };
+    const root = exp && typeof exp === "object" && !Array.isArray(exp) && "." in exp
+        ? exp["."]
+        : exp;
+    return pick(root) ?? manifest.main ?? "./index.js";
+}
+/**
+ * Returns the file to import (or the directory holding an alisio-plugin.json manifest).
+ * Packages are looked up from `from` upwards, then in global roots, and must declare the
+ * `alisio-plugin` keyword so a typo cannot load an unrelated package.
+ */
+export async function resolvePluginSpec(spec, options) {
+    if (isPathSpec(spec))
+        return resolve(options.from, spec);
+    const searched = [];
+    const candidates = [];
+    for (let dir = resolve(options.from);; dir = dirname(dir)) {
+        candidates.push(join(dir, "node_modules", spec));
+        if (dirname(dir) === dir)
+            break;
+    }
+    for (const rootDir of options.globalRoots ?? defaultGlobalRoots()) {
+        candidates.push(join(rootDir, spec));
+        // `alisio install` writes npm packages under <root>/node_modules/<spec>.
+        candidates.push(join(rootDir, "node_modules", spec));
+    }
+    for (const dir of candidates) {
+        searched.push(dir);
+        const manifest = (await readJson(join(dir, "package.json")));
+        if (!manifest)
+            continue;
+        const keywords = Array.isArray(manifest.keywords) ? manifest.keywords : [];
+        if (!keywords.includes(PLUGIN_KEYWORD))
+            throw new Error(`Package ${spec} is not an Alisio plugin (missing "${PLUGIN_KEYWORD}" keyword)`);
+        if (await readJson(join(dir, "alisio-plugin.json")))
+            return dir;
+        return resolve(dir, entryOf(manifest));
+    }
+    throw new Error(`Plugin package ${spec} not found (searched ${searched.length} locations from ${options.from})`);
+}

package/dist/runtime/paths.d.ts

@@ -0,0 +1,4 @@
+export declare function inside(root: string, path: string): boolean;
+/** Mediated path policy; not an OS sandbox and not race-proof against hostile concurrent processes. */
+export declare function safePath(root: string, path: string): Promise<string>;
+export declare function findWorkspace(cwd: string): Promise<string>;

package/dist/runtime/paths.js

@@ -0,0 +1,42 @@
+import { lstat, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+export function inside(root, path) {
+    const r = relative(root, path);
+    return r === "" || (!r.startsWith(`..${sep}`) && r !== ".." && !isAbsolute(r));
+}
+/** Mediated path policy; not an OS sandbox and not race-proof against hostile concurrent processes. */
+export async function safePath(root, path) {
+    const canonical = await realpath(root), target = resolve(canonical, path);
+    if (!inside(canonical, target))
+        throw new Error("Path outside workspace");
+    let cursor = canonical;
+    for (const part of relative(canonical, target).split(sep).filter(Boolean)) {
+        cursor = resolve(cursor, part);
+        try {
+            const stat = await lstat(cursor);
+            if (stat.isSymbolicLink())
+                throw new Error(`Symlinks are not allowed: ${cursor}`);
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+    }
+    return target;
+}
+export async function findWorkspace(cwd) {
+    let path = await realpath(cwd);
+    while (true) {
+        try {
+            await lstat(resolve(path, ".git"));
+            return path;
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+        if (dirname(path) === path)
+            return realpath(cwd);
+        path = dirname(path);
+    }
+}

package/dist/runtime/process.d.ts

@@ -0,0 +1,25 @@
+export interface ProcessResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    truncated: boolean;
+}
+/**
+ * Detect a spawn failure caused by a missing executable (`ENOENT`), so tools can explain how to
+ * install the dependency instead of surfacing the raw OS error.
+ */
+export declare function isMissingCommand(error: unknown): boolean;
+/** Per-platform install commands for the ripgrep dependency. */
+export declare const RIPGREP_INSTALL_HINT: string;
+/** Human-readable detection status for `alisio doctor`. */
+export declare function ripgrepDiagnostic(found: boolean): string | undefined;
+export declare function runProcess(command: string, args: string[], options: {
+    cwd: string;
+    signal: AbortSignal;
+    timeoutMs?: number;
+    maxBytes?: number;
+    env?: Record<string, string>;
+    onData?: (chunk: string) => void;
+    /** On cancellation: SIGTERM the process group, then SIGKILL after this grace (default 5s). */
+    killGraceMs?: number;
+}): Promise<ProcessResult>;

package/dist/runtime/process.js

@@ -0,0 +1,122 @@
+import { spawn, spawnSync } from "node:child_process";
+/**
+ * Detect a spawn failure caused by a missing executable (`ENOENT`), so tools can explain how to
+ * install the dependency instead of surfacing the raw OS error.
+ */
+export function isMissingCommand(error) {
+    return (!!error &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+/** Per-platform install commands for the ripgrep dependency. */
+export const RIPGREP_INSTALL_HINT = "Install ripgrep (rg): `sudo apt install ripgrep` (Debian/Ubuntu), " +
+    "`brew install ripgrep` (macOS), `winget install BurntSushi.ripgrep.MSVC` or " +
+    "`scoop install ripgrep` (Windows). It powers the search_text and list_files tools.";
+/** Human-readable detection status for `alisio doctor`. */
+export function ripgrepDiagnostic(found) {
+    return found ? undefined : RIPGREP_INSTALL_HINT;
+}
+export async function runProcess(command, args, options) {
+    options.signal.throwIfAborted();
+    const signal = AbortSignal.any([
+        options.signal,
+        AbortSignal.timeout(options.timeoutMs ?? 30_000),
+    ]);
+    const child = spawn(command, args, {
+        cwd: options.cwd,
+        env: options.env ??
+            Object.fromEntries(["PATH", "HOME", "USERPROFILE", "TMPDIR", "TEMP", "SystemRoot", "COMSPEC", "LANG"].flatMap((k) => (process.env[k] ? [[k, process.env[k]]] : []))),
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: process.platform !== "win32",
+        windowsHide: true,
+    });
+    const exited = new Promise((resolveExit, reject) => {
+        child.once("error", reject);
+        child.once("close", (code, sig) => resolveExit(code ?? (sig ? 128 : 1)));
+    });
+    let finished = false;
+    exited.then(() => {
+        finished = true;
+    }, () => {
+        finished = true;
+    });
+    let graceTimer;
+    /** Graceful stop for cancellations: SIGTERM the group, SIGKILL if still alive after the grace. */
+    const terminate = () => {
+        if (finished || child.pid === undefined)
+            return;
+        if (process.platform === "win32")
+            return kill();
+        try {
+            process.kill(-child.pid, "SIGTERM");
+        }
+        catch {
+            return kill();
+        }
+        graceTimer = setTimeout(kill, options.killGraceMs ?? 5_000);
+    };
+    const kill = () => {
+        if (finished || child.pid === undefined)
+            return;
+        try {
+            if (process.platform !== "win32")
+                process.kill(-child.pid, "SIGKILL");
+            else {
+                spawnSync("taskkill", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore" });
+                child.kill();
+            }
+        }
+        catch {
+            child.kill("SIGKILL");
+        }
+    };
+    signal.addEventListener("abort", terminate, { once: true });
+    if (signal.aborted)
+        terminate();
+    let size = 0, truncated = false;
+    const max = options.maxBytes ?? 32_000;
+    const consume = (stream) => new Promise((resolveText, reject) => {
+        const decoder = new TextDecoder();
+        let text = "", done = false;
+        const finish = () => {
+            if (done)
+                return;
+            done = true;
+            text += decoder.decode();
+            resolveText(text);
+        };
+        stream.on("data", (value) => {
+            if (done)
+                return;
+            const remaining = Math.max(0, max - size), slice = value.subarray(0, remaining);
+            size += slice.byteLength;
+            const chunk = decoder.decode(slice, { stream: true });
+            text += chunk;
+            if (chunk)
+                options.onData?.(chunk);
+            if (value.byteLength > remaining) {
+                truncated = true;
+                kill();
+                finish();
+            }
+        });
+        stream.once("end", finish);
+        stream.once("close", finish);
+        stream.once("error", reject);
+    });
+    try {
+        const [stdout, stderr, exitCode] = await Promise.all([
+            consume(child.stdout),
+            consume(child.stderr),
+            exited,
+        ]);
+        signal.throwIfAborted();
+        return { stdout, stderr, exitCode, truncated };
+    }
+    finally {
+        signal.removeEventListener("abort", terminate);
+        clearTimeout(graceTimer);
+        kill();
+    }
+}

package/dist/runtime/sqlite.d.ts

@@ -0,0 +1,3 @@
+import type { SqlDatabase } from "@alisio/sdk";
+export declare function isSqliteExperimentalWarning(message: string, type?: string): boolean;
+export declare function openDatabase(path: string): SqlDatabase;