@hawkeyexl/manni 4.1.0 → 4.3.0

package/dist/chunk-MOQXWXSG.js

@@ -0,0 +1,1941 @@
+#!/usr/bin/env node
+import {
+  DocmetaError,
+  FAMILY_CONFIG_NAMES,
+  META_CONTEXT,
+  __default4 as __default,
+  assertKnownProvider,
+  decryptValue,
+  encryptValue,
+  escapePointerSegment,
+  extractFrontmatter,
+  extractorByName,
+  extractorForExtension,
+  findConfigFileSync,
+  isEncryptedValue,
+  keyHome,
+  lazyKey,
+  loadExternalMetadata,
+  loadMetaSection,
+  marksValidator,
+  memberOf,
+  mergeWithMarks,
+  metaProvenanceEntries,
+  pageMarks,
+  pageSchemaSet,
+  readConfigFileSync,
+  rebaseConfigSchemaRefs,
+  schemaTrustRoot,
+  supportedExtensions,
+  withValueAt
+} from "./chunk-DP2ZA3WH.js";
+import {
+  TracevalsError,
+  configDir
+} from "./chunk-3R23C5DT.js";
+import {
+  errorMessage
+} from "./chunk-IOYXPBCL.js";
+
+// src/meta/core/reencrypt.ts
+import { extname } from "node:path";
+var CITATIONS_KEY = "citations";
+var NOT_OURS = "does not decrypt under the current key";
+var READ_ONLY = "this format cannot be written";
+function reencryptMetadata(page, opts) {
+  const extractor = page.format !== void 0 ? extractorByName(page.format) : extractorForExtension(extname(page.file));
+  if (!extractor) {
+    throw new DocmetaError(
+      page.format !== void 0 ? `Unknown format "${page.format}" for "${page.file}".` : `Unsupported file type "${extname(page.file)}" for "${page.file}". Supported: ${supportedExtensions().join(", ")}.`
+    );
+  }
+  return reencryptWith(extractor, page, opts);
+}
+function tokensIn(data) {
+  const found = [];
+  const walk = (node, pointer, top) => {
+    if (isEncryptedValue(node)) {
+      found.push({ pointer, top, token: node });
+      return;
+    }
+    if (Array.isArray(node)) {
+      node.forEach((item, i) => {
+        walk(item, `${pointer}/${String(i)}`, top);
+      });
+      return;
+    }
+    if (typeof node === "object" && node !== null && !(node instanceof Date)) {
+      for (const [k, v] of Object.entries(node)) {
+        walk(v, `${pointer}/${escapePointerSegment(k)}`, top);
+      }
+    }
+  };
+  for (const [key, value] of Object.entries(data)) {
+    if (key === CITATIONS_KEY) continue;
+    walk(value, `/${escapePointerSegment(key)}`, key);
+  }
+  return found;
+}
+function reencryptData(data, opts) {
+  const writable = opts.writable ?? true;
+  const rewritten = [];
+  const skipped = [];
+  const found = tokensIn(data);
+  for (const { pointer, token } of found) {
+    const opened = decryptValue(token, opts.fromKey, META_CONTEXT);
+    if (opened.ok) {
+      if (!writable) {
+        skipped.push({ pointer, message: READ_ONLY });
+        continue;
+      }
+      rewritten.push({
+        pointer,
+        from: token,
+        to: encryptValue(opened.value, opts.toKey, META_CONTEXT)
+      });
+      continue;
+    }
+    if (decryptValue(token, opts.toKey, META_CONTEXT).ok) continue;
+    skipped.push({ pointer, message: NOT_OURS });
+  }
+  if (rewritten.length === 0) return { data, rewritten, skipped, keys: [] };
+  let next = data;
+  for (const r of rewritten) next = withValueAt(next, r.pointer, r.to);
+  const done = new Set(rewritten.map((r) => r.pointer));
+  const keys = [...new Set(found.filter((f) => done.has(f.pointer)).map((f) => f.top))];
+  return { data: next, rewritten, skipped, keys };
+}
+function reencryptWith(extractor, page, opts) {
+  const read = (content2) => {
+    try {
+      return extractor.extract(content2, page.file).data;
+    } catch (err) {
+      if (err instanceof DocmetaError) throw err;
+      throw new DocmetaError(`${page.file}: ${errorMessage(err)}`);
+    }
+  };
+  const data = read(page.content);
+  const apply = extractor.apply;
+  const plan = reencryptData(data, { ...opts, writable: apply !== void 0 });
+  const { rewritten, skipped } = plan;
+  if (rewritten.length === 0 || apply === void 0) {
+    return { content: page.content, rewritten: [], skipped };
+  }
+  const patch = {};
+  for (const top of plan.keys) patch[top] = plan.data[top];
+  const content = apply(page.content, patch, { filePath: page.file });
+  const reread = tokensIn(read(content));
+  for (const r of rewritten) {
+    if (!reread.some((f) => f.pointer === r.pointer && f.token === r.to)) {
+      throw new DocmetaError(
+        `${page.file}: the ${extractor.name} writer did not keep ${r.pointer}; nothing was re-encrypted.`
+      );
+    }
+  }
+  return { content, rewritten, skipped };
+}
+
+// src/tracevals/calibrate/labels.ts
+import { readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { parse as parseYaml } from "yaml";
+
+// src/tracevals/calibrate/labels-schema.json
+var labels_schema_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "manni:tracevals:calibration-labels",
+  title: "manni tracevals calibration labels",
+  description: "Ground truth for `manni tracevals calibrate`: what a human decided a given eval should have produced on a given trace. A sidecar rather than an eval field, because a label belongs to a corpus and a reviewer, not to the artifact \u2014 and because the eval vocabulary is docmeta's, vendored byte-identical, with `inlineEval` closed to additions (ADR 01010).",
+  type: "object",
+  additionalProperties: false,
+  required: ["version", "labels"],
+  properties: {
+    version: {
+      const: 1,
+      description: "Format version. Pinned so a future shape change is an explicit migration rather than a silently-reinterpreted file."
+    },
+    labels: {
+      type: "array",
+      minItems: 1,
+      description: "One entry per (trace, artifact, eval) you have judged by hand.",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["trace", "artifact", "eval", "expected"],
+        properties: {
+          trace: {
+            type: "string",
+            minLength: 1,
+            description: "Path to the trace file, resolved against this file's own directory \u2014 not the working directory."
+          },
+          artifact: {
+            type: "string",
+            minLength: 1,
+            description: "Artifact name as the report shows it: a skill name, a subagent_type, or a project-rules filename such as CLAUDE.md."
+          },
+          type: {
+            enum: ["skill", "agent", "project-rules", "slash-command"],
+            description: "Optional disambiguator, needed when one name resolves to two kinds of artifact \u2014 a skill and an agent, or a skill and the slash command that types it. Every `ArtifactType` the resolver can produce belongs here: a label whose type this rejects has no way to name the artifact it means."
+          },
+          eval: {
+            type: "string",
+            minLength: 1,
+            description: "The eval's id. Shorthand entries with no declared id get a positional one (eval-1, eval-2, ...), so labelling those is only as stable as the order they are written in."
+          },
+          expected: {
+            enum: ["pass", "fail", "needs-review"],
+            description: "What you decided. `needs-review` means you found it genuinely ambiguous and want the tool to defer too."
+          },
+          note: {
+            type: "string",
+            description: "Why you decided that. Carried into the disagreement report, where it is the whole reason a disagreement is actionable."
+          }
+        }
+      }
+    }
+  }
+};
+
+// src/tracevals/calibrate/labels.ts
+var labelsSchema = labels_schema_default;
+var DEFAULT_LABELS_FILE = "tracevals/labels.yaml";
+var ajv = new Ajv2020({ allErrors: true });
+var validate = ajv.compile(labelsSchema);
+var labelKey = (traceFile, artifact, evalName, type) => `${traceFile}\0${type ?? ""}\0${artifact}\0${evalName}`;
+function parseLabels(text, file) {
+  let raw;
+  try {
+    raw = parseYaml(text);
+  } catch (err) {
+    throw new TracevalsError(
+      `could not parse ${file}: ${errorMessage(err)}`
+    );
+  }
+  if (raw === null || raw === void 0) {
+    throw new TracevalsError(`invalid labels file ${file}: it is empty`);
+  }
+  if (!validate(raw)) {
+    const detail = (validate.errors ?? []).map((e) => `${e.instancePath || "/"} ${e.message ?? "invalid"}`).join("; ");
+    const empty2 = (validate.errors ?? []).some(
+      (e) => e.instancePath === "/labels" && e.keyword === "minItems"
+    );
+    throw new TracevalsError(
+      empty2 ? `invalid labels file ${file}: it must carry at least one label \u2014 an empty one measures nothing` : `invalid labels file ${file}: ${detail}`
+    );
+  }
+  const base = dirname(resolve(file));
+  const labels = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of raw.labels) {
+    const traceFile = resolve(base, entry.trace);
+    const type = entry.type;
+    const key = labelKey(
+      traceFile,
+      entry.artifact,
+      entry.eval,
+      type
+    );
+    if (seen.has(key)) {
+      throw new TracevalsError(
+        `invalid labels file ${file}: duplicate label for ${entry.artifact ?? "?"} \u203A ${entry.eval ?? "?"} on ${entry.trace ?? "?"}`
+      );
+    }
+    seen.add(key);
+    labels.push({
+      trace: entry.trace,
+      traceFile,
+      artifact: entry.artifact,
+      ...type !== void 0 ? { type } : {},
+      eval: entry.eval,
+      expected: entry.expected,
+      ...entry.note !== void 0 ? { note: entry.note } : {}
+    });
+  }
+  return labels;
+}
+async function loadLabels(file) {
+  let text;
+  try {
+    text = await readFile(file, "utf-8");
+  } catch (err) {
+    throw new TracevalsError(
+      `could not read labels file ${file}: ${errorMessage(err)}`
+    );
+  }
+  return parseLabels(text, file);
+}
+
+// src/tracevals/core/config.ts
+import { Ajv2020 as Ajv20202 } from "ajv/dist/2020.js";
+
+// src/tracevals/core/config-schema.json
+var config_schema_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "manni:tracevals:config",
+  title: "tracevals section of manni.config.yaml",
+  description: "Settings for manni tracevals, held under the `tracevals` key of the config file shared by the manni family of tools. Sibling keys belong to other tools and are not validated here.",
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    provider: {
+      type: "string",
+      minLength: 1,
+      description: "Which provider judges: auto, anthropic, openai, claude-cli, or llama-cpp. Overrides the family's top-level `providers.provider` for tracevals only. Connection settings \u2014 an endpoint, an API key's environment variable, the Claude CLI command \u2014 live in that top-level `providers:` map, never here."
+    },
+    model: {
+      type: "string",
+      minLength: 1,
+      description: "The model within `provider`, which must be named at this level. Unset, the inference library's default for the winning provider is used; manni pins no model id of its own."
+    },
+    judge: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        ensembleRuns: { type: "integer", minimum: 1 },
+        temperature: { type: "number", minimum: 0, maximum: 2 },
+        zones: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            autoPass: { type: "number", minimum: 0, maximum: 1 },
+            autoFail: { type: "number", minimum: 0, maximum: 1 }
+          }
+        },
+        cacheDir: { type: "string" },
+        maxTurns: { type: "integer", minimum: 1, description: "Stop after this many ensemble runs. A cached ensemble spends none. Unset means unbounded; the remaining evals report `skipped` with the reason `turn budget` rather than aborting the run." },
+        redact: {
+          type: "array",
+          description: "Extra regular expressions scrubbed from the session digest before it is sent to a judge provider. Applied on top of the built-in secret shapes, never instead of them; each source is compiled with the `g` flag, and a match is replaced with `[redacted]`. Pattern matching is best-effort \u2014 --deterministic-only is the only setting that guarantees nothing leaves the machine.",
+          items: { type: "string", minLength: 1 }
+        }
+      }
+    },
+    execution: {
+      type: "object",
+      additionalProperties: false,
+      description: "Operator grant for executing content-authored code.",
+      properties: {
+        allow: {
+          type: "array",
+          items: { enum: ["frontmatter-commands"] },
+          default: ["frontmatter-commands"],
+          description: "Which content-authored code a run may execute. Absent, every grant holds; list fewer to narrow it, or write [] to run none. frontmatter-commands lets `command` evals declared in an artifact's front matter run; without it they report `skipped` with a reason, never `pass`."
+        }
+      }
+    },
+    render: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        maxBlockChars: { type: "integer", minimum: 100 },
+        maxTotalChars: {
+          type: "integer",
+          minimum: 1e3,
+          description: "Upper bound on the rendered digest, in characters. The timeline always keeps at least 200 characters, so a very long header can push the digest past this bound by up to 200."
+        }
+      }
+    },
+    history: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        file: { type: "string" }
+      }
+    },
+    capture: {
+      type: "object",
+      additionalProperties: false,
+      description: "Session manifests \u2014 sha256 of every instruction artifact plus the git SHA, recorded at session start by `manni tracevals capture` and read back by `run` to make staleness exact instead of an mtime guess. See ADR 01024.",
+      properties: {
+        dir: {
+          type: "string",
+          minLength: 1,
+          description: "Directory manifests are written to and looked for, resolved against the project root. `run` also accepts one placed beside the trace as `<trace>.manifest.json`, and --manifest names one outright."
+        }
+      }
+    },
+    fill: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        confidenceThreshold: { type: "number", minimum: 0, maximum: 1 },
+        maxEvalsPerArtifact: { type: "integer", minimum: 1 },
+        temperature: { type: "number", minimum: 0, maximum: 2 },
+        cacheDir: { type: "string" },
+        maxTurns: { type: "integer", minimum: 1, description: "Stop after this many inference calls, one per artifact filled. A cached artifact spends none. Unset means unbounded." }
+      }
+    },
+    calibrate: {
+      type: "object",
+      additionalProperties: false,
+      description: "Settings for `manni tracevals calibrate` \u2014 measuring the tool's verdicts against a human's answers. See ADR 01022.",
+      properties: {
+        labels: {
+          type: "string",
+          minLength: 1,
+          description: "Default labels sidecar, resolved against this config file's directory. Overridden by --labels."
+        },
+        maxFalsePass: {
+          type: "integer",
+          minimum: 0,
+          description: "Fail the calibration run (exit 1) above this many false passes \u2014 labelled fail, judged pass. Unset by default: a calibration run is a measurement, not a gate."
+        },
+        maxFalseFail: {
+          type: "integer",
+          minimum: 0,
+          description: "Fail the calibration run above this many false fails \u2014 labelled pass, judged fail."
+        },
+        maxReview: {
+          type: "integer",
+          minimum: 0,
+          description: "Fail the calibration run above this many needs-review outcomes across the whole corpus."
+        },
+        sweep: {
+          type: "object",
+          additionalProperties: false,
+          description: "Values --sweep tries on each axis, one axis at a time with the others held at their configured value. The corpus is judged once at the largest ensembleRuns here and every cell is re-scored from those cached runs, so the grid costs nothing beyond that one run.",
+          properties: {
+            ensembleRuns: {
+              type: "array",
+              minItems: 1,
+              items: { type: "integer", minimum: 1 }
+            },
+            autoPass: {
+              type: "array",
+              minItems: 1,
+              items: { type: "number", minimum: 0, maximum: 1 }
+            },
+            autoFail: {
+              type: "array",
+              minItems: 1,
+              items: { type: "number", minimum: 0, maximum: 1 }
+            }
+          }
+        }
+      }
+    },
+    failOnReview: { type: "boolean" },
+    plugins: {
+      type: "array",
+      description: "Modules imported before evals are planned, so one calling registerGrader() can add a grader kind the built-ins do not cover. A relative or absolute path resolves against this file's directory, not the working directory; a bare package name resolves the way an import from this file's directory would. Load order is significant: a later entry wins a colliding kind.",
+      items: { type: "string", minLength: 1 }
+    },
+    reportUnusedArtifacts: {
+      type: "boolean",
+      description: "List every skill and agent the session was offered and never used, rather than only counting them. Off by default: a real roster runs to hundreds of skills."
+    }
+  }
+};
+
+// src/tracevals/judge/redact.ts
+var SECRET_NAME = "(?:(?:[A-Za-z0-9]+[_\\-.])*(?:api[_\\-.]?key|access[_\\-.]?key|secret[_\\-.]?key|auth[_\\-.]?token|access[_\\-.]?token|refresh[_\\-.]?token|client[_\\-.]?secret|session[_\\-.]?token|key|token|secret|password|passwd|passphrase|credentials?|authorization)|AWS_[A-Za-z0-9_]+)";
+var REDACTION_PATTERNS = [
+  {
+    label: "private-key",
+    pattern: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,
+    replacement: "[redacted:private-key]"
+  },
+  {
+    // `sk-`, `sk-ant-…`, `pk-`, `rk-`: the OpenAI/Anthropic/Stripe family.
+    label: "api-key",
+    pattern: /\b[sprk]k-(?:[A-Za-z0-9]+-)*[A-Za-z0-9_-]{16,}/g,
+    replacement: "[redacted:api-key]"
+  },
+  {
+    label: "aws-access-key-id",
+    pattern: /\b(?:AKIA|ASIA|AROA|AIDA)[0-9A-Z]{16}\b/g,
+    replacement: "[redacted:aws-access-key-id]"
+  },
+  {
+    label: "github-token",
+    pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g,
+    replacement: "[redacted:github-token]"
+  },
+  {
+    label: "slack-token",
+    pattern: /\bxox[abeoprs]-[A-Za-z0-9-]{10,}/g,
+    replacement: "[redacted:slack-token]"
+  },
+  {
+    label: "google-api-key",
+    pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    replacement: "[redacted:google-api-key]"
+  },
+  {
+    label: "jwt",
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+    replacement: "[redacted:jwt]"
+  },
+  {
+    // `Authorization: Bearer …`, `Basic …`, `Token …`. The scheme is kept so
+    // the judge can still see that authentication happened.
+    //
+    // Deliberately *not* case-insensitive as a whole: `basic` and `token` are
+    // ordinary English words, and `/i` would redact "basic configuration" as an
+    // auth header. `bearer` is not, so it gets both spellings.
+    label: "auth-token",
+    pattern: /\b([Bb]earer|Basic|Token)\s+[A-Za-z0-9\-._~+/]{12,}={0,2}/g,
+    replacement: "$1 [redacted:auth-token]"
+  },
+  {
+    // JSON member — the shape a tool input renders as.
+    label: "secret-member",
+    pattern: new RegExp(`("${SECRET_NAME}"\\s*:\\s*)"[^"]*"`, "gi"),
+    replacement: '$1"[redacted:secret-value]"'
+  },
+  {
+    // Shell / `.env` assignment. The variable name is kept: knowing that a
+    // secret was set, and which one, is often the adherence question.
+    label: "secret-assignment",
+    pattern: new RegExp(
+      `\\b(${SECRET_NAME})(\\s*=\\s*)(?:"[^"\\n]*"|'[^'\\n]*'|[^\\s"'\\n]+)`,
+      "gi"
+    ),
+    replacement: "$1$2[redacted:secret-value]"
+  }
+];
+var CUSTOM_PLACEHOLDER = "[redacted]";
+function makeRedactor(extra = []) {
+  const custom = compileRedactPatterns(extra).map(
+    (pattern) => [pattern, CUSTOM_PLACEHOLDER]
+  );
+  const all = [
+    ...REDACTION_PATTERNS.map(
+      ({ pattern, replacement }) => [pattern, replacement]
+    ),
+    ...custom
+  ];
+  return (text) => {
+    let out = text;
+    for (const [pattern, replacement] of all) {
+      out = out.replace(pattern, replacement);
+    }
+    return out;
+  };
+}
+function compileRedactPatterns(sources) {
+  return sources.map((source) => {
+    try {
+      return new RegExp(source, "g");
+    } catch (err) {
+      throw new TracevalsError(
+        `invalid config: judge.redact pattern ${JSON.stringify(source)} is not a valid regular expression: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  });
+}
+
+// src/tracevals/capture/types.ts
+var MANIFEST_VERSION = 1;
+var DEFAULT_CAPTURE_DIR = ".manni/tracevals/sessions";
+
+// src/shared/execution.ts
+var EXECUTION_GRANTS = [
+  "frontmatter-commands"
+];
+function isExecutionGrant(value) {
+  return EXECUTION_GRANTS.includes(value);
+}
+function unknownGrantsMessage(unknown) {
+  return `unknown execution grant${unknown.length > 1 ? "s" : ""} ${unknown.map((u) => `"${u}"`).join(", ")}; expected one of ${EXECUTION_GRANTS.join(" | ")}`;
+}
+function allowExecutionMessage(value) {
+  return `--allow-execution must be one of ${EXECUTION_GRANTS.join(" | ")}, got "${value}"`;
+}
+var NOT_GRANTED_REASON = "frontmatter commands not granted (execution.allow: [frontmatter-commands])";
+function grantsFor(configured, flags = {}) {
+  if (flags.execution === false) return /* @__PURE__ */ new Set();
+  const named = flags.allowExecution;
+  return new Set(
+    named === void 0 ? configured : configured.filter((g) => named.includes(g))
+  );
+}
+function configuredGrants(section) {
+  if (!section || typeof section !== "object") return [];
+  const execution = section.execution;
+  if (!execution || typeof execution !== "object") return [];
+  const allow = execution.allow;
+  return Array.isArray(allow) ? allow.filter((g) => typeof g === "string") : [];
+}
+
+// src/tracevals/core/config.ts
+var configSchema = config_schema_default;
+var DEFAULT_CONFIG_FILENAME = FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml";
+var CONFIG_SECTION_KEY = "tracevals";
+var CONFIG_SECTION_KEY_PATH = `/${CONFIG_SECTION_KEY}`;
+var CONFIG_FILE = {
+  section: CONFIG_SECTION_KEY,
+  legacyNames: [],
+  toError: (message) => new TracevalsError(message)
+};
+var ajv2 = new Ajv20202({ allErrors: true, verbose: true });
+var validate2 = ajv2.compile(configSchema);
+function camelCaseHint(key, parentSchema) {
+  const camel = key.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
+  if (camel === key || parentSchema === null || typeof parentSchema !== "object") {
+    return "";
+  }
+  const properties = parentSchema.properties;
+  return properties !== null && typeof properties === "object" && Object.hasOwn(properties, camel) ? `; did you mean "${camel}"?` : "";
+}
+function movedProviderHint(instancePath, keyword) {
+  return instancePath === "/provider" && keyword === "type" ? `; "provider" is now a provider name; per-provider settings moved to the top-level providers: map` : "";
+}
+function parseConfig2(raw, file = {}) {
+  const source = file.source ?? DEFAULT_CONFIG_FILENAME;
+  const unknownGrants = configuredGrants(raw).filter((g) => !isExecutionGrant(g));
+  if (unknownGrants.length > 0) {
+    throw new TracevalsError(`${source}: ${unknownGrantsMessage(unknownGrants)}`);
+  }
+  if (!validate2(raw)) {
+    const detail = (validate2.errors ?? []).map((e) => {
+      const extra = e.keyword === "additionalProperties" ? e.params.additionalProperty : void 0;
+      return extra !== void 0 ? `unknown key "${extra}"${camelCaseHint(extra, e.parentSchema)}` : `${CONFIG_SECTION_KEY_PATH}${e.instancePath} ${e.message ?? "is invalid"}` + movedProviderHint(e.instancePath, e.keyword);
+    }).join("; ");
+    throw new TracevalsError(`${source}: ${detail}`);
+  }
+  const r = raw;
+  const provider = r.provider ?? null;
+  if (provider !== null) {
+    assertKnownProvider(provider, (message) => new TracevalsError(message));
+  }
+  const config = {
+    provider,
+    model: r.model ?? null,
+    providers: file.providers ?? {},
+    configSource: source,
+    judge: {
+      ensembleRuns: r.judge?.ensembleRuns ?? 3,
+      temperature: r.judge?.temperature ?? 0,
+      zones: {
+        autoPass: r.judge?.zones?.autoPass ?? 0.8,
+        autoFail: r.judge?.zones?.autoFail ?? 0.8
+      },
+      cacheDir: r.judge?.cacheDir ?? ".manni/tracevals/cache",
+      // `null`, not a number: unbounded is a state, and any number here would
+      // be a ceiling nobody asked for.
+      maxTurns: r.judge?.maxTurns ?? null,
+      // Always a list: the render site concatenates nothing onto it, but a
+      // hole here would be a special case in every consumer.
+      redact: [...r.judge?.redact ?? []]
+    },
+    render: {
+      maxBlockChars: r.render?.maxBlockChars ?? 2e3,
+      maxTotalChars: r.render?.maxTotalChars ?? 15e4
+    },
+    execution: { allow: [...r.execution?.allow ?? EXECUTION_GRANTS] },
+    history: {
+      file: r.history?.file ?? ".manni/tracevals/history.jsonl"
+    },
+    capture: {
+      // Beside the judge cache, under the state directory that already travels
+      // with the project — which is what puts a manifest next to its trace in
+      // the CI patterns the docs describe.
+      dir: r.capture?.dir ?? DEFAULT_CAPTURE_DIR
+    },
+    fill: {
+      // 0.7 matches the manuscript's calibration bar for judged agreement.
+      confidenceThreshold: r.fill?.confidenceThreshold ?? 0.7,
+      maxEvalsPerArtifact: r.fill?.maxEvalsPerArtifact ?? 8,
+      temperature: r.fill?.temperature ?? 0,
+      // Separate from the judge cache: different key scheme and value shape.
+      cacheDir: r.fill?.cacheDir ?? ".manni/tracevals/cache/fill",
+      maxTurns: r.fill?.maxTurns ?? null
+    },
+    calibrate: {
+      labels: r.calibrate?.labels ?? DEFAULT_LABELS_FILE,
+      sweep: {
+        // Spans the range rather than filling it: the first sweep judges the
+        // corpus at the largest value here, so a wide grid is the one part of
+        // calibration that does cost money.
+        ensembleRuns: [...r.calibrate?.sweep?.ensembleRuns ?? [1, 3, 5]],
+        autoPass: [
+          ...r.calibrate?.sweep?.autoPass ?? [0.5, 0.6, 0.7, 0.8, 0.9, 0.95]
+        ],
+        autoFail: [
+          ...r.calibrate?.sweep?.autoFail ?? [0.5, 0.6, 0.7, 0.8, 0.9, 0.95]
+        ]
+      }
+    },
+    failOnReview: r.failOnReview ?? true,
+    // Always a list, never undefined: the read site concatenates `--require`
+    // onto it, and a hole there would be a special case in every caller.
+    plugins: [...r.plugins ?? []],
+    // An observation, not a gate: listing it is opt-in because a real roster
+    // runs to hundreds of skills (ADR 01016).
+    reportUnusedArtifacts: r.reportUnusedArtifacts ?? false
+  };
+  compileRedactPatterns(config.judge.redact);
+  for (const key of ["maxFalsePass", "maxFalseFail", "maxReview"]) {
+    if (typeof r.calibrate?.[key] === "number") {
+      config.calibrate[key] = r.calibrate[key];
+    }
+  }
+  return config;
+}
+async function discoverConfig(dir = process.cwd(), lookup = {}) {
+  if (lookup.noConfig === true) {
+    return { config: parseConfig2({}), dir, collections: [] };
+  }
+  const file = await Promise.resolve().then(
+    () => lookup.configPath === void 0 ? findConfigFileSync(dir, CONFIG_FILE) : readConfigFileSync(lookup.configPath, dir, CONFIG_FILE)
+  );
+  if (file === null) return { config: parseConfig2({}), dir, collections: [] };
+  return {
+    config: parseConfig2(file.value ?? {}, {
+      source: file.source,
+      ...file.providers !== void 0 ? { providers: file.providers } : {}
+    }),
+    dir: file.dir,
+    collections: file.collections,
+    path: file.path
+  };
+}
+async function loadConfig2(dir = process.cwd(), lookup = {}) {
+  return (await discoverConfig(dir, lookup)).config;
+}
+
+// src/tracevals/capture/manifest.ts
+import { createHash } from "node:crypto";
+import { mkdir, readFile as readFile2, writeFile } from "node:fs/promises";
+import {
+  dirname as dirname2,
+  extname as extname2,
+  isAbsolute,
+  join,
+  relative,
+  resolve as resolve2,
+  sep
+} from "node:path";
+function sha256Hex(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+async function hashFile(path) {
+  try {
+    return sha256Hex(await readFile2(path));
+  } catch {
+    return null;
+  }
+}
+function relPosix(root, path) {
+  const rel = relative(resolve2(root), resolve2(path));
+  if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) return null;
+  return rel.split(sep).join("/");
+}
+function safeSessionId(sessionId) {
+  const cleaned = sessionId.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^\.+/, "");
+  return cleaned.length > 0 ? cleaned.slice(0, 128) : "session";
+}
+function manifestPathFor(dir, sessionId) {
+  return join(dir, `${safeSessionId(sessionId)}.json`);
+}
+function siblingManifestPath(tracePath) {
+  const ext = extname2(tracePath);
+  const stem = ext === "" ? tracePath : tracePath.slice(0, -ext.length);
+  return `${stem}.manifest.json`;
+}
+async function writeManifest(path, manifest) {
+  await mkdir(dirname2(resolve2(path)), { recursive: true });
+  await writeFile(path, `${JSON.stringify(manifest, null, 2)}
+`, "utf-8");
+}
+function isManifestArtifact(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const entry = value;
+  return typeof entry.path === "string" && entry.path.length > 0 && typeof entry.sha256 === "string" && entry.sha256.length > 0 && typeof entry.name === "string" && typeof entry.type === "string" && typeof entry.bytes === "number";
+}
+async function readManifest(path) {
+  let raw;
+  try {
+    raw = await readFile2(path, "utf-8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  const record = parsed;
+  if (typeof record.version !== "number" || record.version > MANIFEST_VERSION) {
+    return null;
+  }
+  if (typeof record.sessionId !== "string") return null;
+  if (typeof record.capturedAt !== "string") return null;
+  if (typeof record.root !== "string") return null;
+  if (!Array.isArray(record.artifacts)) return null;
+  if (!record.artifacts.every(isManifestArtifact)) return null;
+  return parsed;
+}
+async function findManifest(options) {
+  const explicit = options.explicit !== void 0;
+  const candidates = [];
+  if (options.explicit !== void 0) {
+    candidates.push(options.explicit);
+  } else {
+    candidates.push(siblingManifestPath(options.tracePath));
+    if (options.sessionId !== void 0) {
+      candidates.push(
+        manifestPathFor(
+          resolve2(dirname2(options.tracePath), options.captureDir),
+          options.sessionId
+        ),
+        manifestPathFor(
+          resolve2(options.projectDir, options.captureDir),
+          options.sessionId
+        )
+      );
+    }
+  }
+  for (const path of candidates) {
+    const manifest = await readManifest(path);
+    if (manifest === null) continue;
+    const refusal = refuse(manifest, options.sessionId, explicit);
+    if (refusal !== null) {
+      options.onRefused?.(path, refusal);
+      continue;
+    }
+    return { path, manifest };
+  }
+  return null;
+}
+function refuse(manifest, sessionId, explicit) {
+  if (sessionId === void 0) {
+    if (explicit) return null;
+    return `the trace records no session id, so a manifest found by convention cannot be verified as belonging to it (it records "${manifest.sessionId}"). Pass --manifest to use it anyway.`;
+  }
+  if (manifest.sessionId !== sessionId) {
+    return `it was recorded for a different session ("${manifest.sessionId}", not "${sessionId}")`;
+  }
+  return null;
+}
+function checkContent(manifest, actual) {
+  const recorded = new Map(manifest.artifacts.map((a) => [a.path, a.sha256]));
+  const missing = [];
+  let matched = 0;
+  let agreed;
+  for (const [path, digest] of actual) {
+    const expected = recorded.get(path);
+    if (expected === void 0) {
+      missing.push(path);
+      continue;
+    }
+    if (expected !== digest) {
+      return { status: "mismatch", expected, actual: digest };
+    }
+    agreed ??= { expected, actual: digest };
+    matched += 1;
+  }
+  if (matched === 0) {
+    return {
+      status: "skipped",
+      reason: actual.size === 0 ? "no file to compare" : "not recorded in the session manifest"
+    };
+  }
+  if (missing.length > 0) {
+    return {
+      status: "skipped",
+      reason: `not recorded in the session manifest: ${missing.join(", ")}`
+    };
+  }
+  return {
+    status: "match",
+    ...actual.size === 1 && agreed !== void 0 ? agreed : {}
+  };
+}
+
+// src/meta/core/page-view.ts
+async function metaPageView(opts) {
+  const { cwd } = opts;
+  const loaded = opts.noConfig === true ? null : await loadMetaSection(opts.configPath, cwd);
+  const config = loaded ? rebaseConfigSchemaRefs(loaded.config, loaded.dir, cwd) : null;
+  const configDir2 = loaded?.dir ?? cwd;
+  const collections = loaded?.collections ?? [];
+  const validator = marksValidator({
+    config,
+    cwd,
+    ...loaded ? { configDir: loaded.dir } : {}
+  })();
+  const marksOptions = {
+    validator,
+    config,
+    cwd,
+    trustRoot: schemaTrustRoot(cwd, loaded?.dir)
+  };
+  const membersOf = (label) => memberOf(collections, configDir2, cwd, label);
+  const index = await loadExternalMetadata(collections, {
+    configDir: configDir2,
+    base: cwd,
+    offline: config?.offline ?? false,
+    ...opts.pages === void 0 ? {} : { pages: opts.pages }
+  });
+  const joinKey = lazyKey(loaded?.configFile, void 0);
+  const marks = pageMarks(marksOptions);
+  const ctx = {
+    cwd,
+    base: cwd,
+    noConfig: loaded === null,
+    config,
+    ...loaded ? { configDir: loaded.dir, configPath: loaded.path } : {},
+    ...loaded?.configFile !== void 0 ? { configFile: loaded.configFile } : {},
+    collections,
+    declaredCollections: collections,
+    targets: [],
+    validator
+  };
+  return {
+    validator,
+    refsFor: (label, data) => pageSchemaSet(marksOptions, label, data, membersOf(label)),
+    merge: (label, extracted) => mergeWithMarks(label, extracted, index, membersOf(label), cwd, {
+      encryptionKey: joinKey,
+      marks
+    }),
+    home: (label, data, key) => keyHome(ctx, label, data, key)
+  };
+}
+
+// src/meta/core/declared-at.ts
+function declaredAt(label, pointer, metadata) {
+  const at = metadata.locate?.(pointer);
+  if (at !== void 0) {
+    return { file: at.file, ...at.line === void 0 ? {} : { line: at.line } };
+  }
+  if (!metadata.extracted.present) return { file: label };
+  const line = metadata.extracted.lineFor(pointer);
+  return { file: label, ...line === void 0 ? {} : { line } };
+}
+
+// src/tracevals/trace/availability.ts
+function newAvailability() {
+  return { recorded: false, skills: [], agents: [], tools: [], mcpServers: [] };
+}
+function availableAt(entries, index) {
+  return entries.filter(
+    (e) => e.offeredAt <= index && (e.withdrawnAt === void 0 || index < e.withdrawnAt)
+  );
+}
+function offeredNames(entries) {
+  return new Set(entries.map((e) => e.name));
+}
+function joinDescriptions(content, names) {
+  const byName = new Map(
+    names.map((name) => [name, void 0])
+  );
+  let current;
+  for (const raw of content.split("\n")) {
+    const line = raw.trimEnd();
+    if (line.startsWith("- ")) {
+      const body = line.slice(2);
+      let best;
+      for (const name of names) {
+        if (body !== name && !body.startsWith(`${name}:`)) continue;
+        if (best === void 0 || name.length > best.length) best = name;
+      }
+      current = best;
+      if (best === void 0) continue;
+      const rest = body.slice(best.length).replace(/^:\s*/, "").trim();
+      byName.set(best, rest.length > 0 ? rest : void 0);
+      continue;
+    }
+    if (current === void 0) continue;
+    const continued = line.trim();
+    if (continued.length === 0) continue;
+    const previous = byName.get(current);
+    byName.set(current, previous ? `${previous}
+${continued}` : continued);
+  }
+  return byName;
+}
+function describedLines(names, lines) {
+  const byName = /* @__PURE__ */ new Map();
+  names.forEach((name, i) => {
+    const line = lines[i];
+    if (typeof line !== "string") {
+      byName.set(name, void 0);
+      return;
+    }
+    const body = line.startsWith("- ") ? line.slice(2) : line;
+    const rest = body.startsWith(`${name}:`) ? body.slice(name.length + 1).trim() : body === name ? "" : body.trim();
+    byName.set(name, rest.length > 0 ? rest : void 0);
+  });
+  return byName;
+}
+var asStrings = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+function newReplay() {
+  return {
+    roster: newAvailability(),
+    open: /* @__PURE__ */ new Map([
+      ["skill", /* @__PURE__ */ new Map()],
+      ["agent", /* @__PURE__ */ new Map()],
+      ["tool", /* @__PURE__ */ new Map()],
+      ["mcp-server", /* @__PURE__ */ new Map()]
+    ])
+  };
+}
+function listFor(roster, kind) {
+  if (kind === "skill") return roster.skills;
+  if (kind === "agent") return roster.agents;
+  if (kind === "tool") return roster.tools;
+  return roster.mcpServers;
+}
+function offer(replay, kind, name, index, description, status) {
+  const open = replay.open.get(kind);
+  const existing = open.get(name);
+  if (existing !== void 0) {
+    if (existing.description === void 0 && description !== void 0) {
+      existing.description = description;
+    }
+    if (status !== void 0) existing.status = status;
+    return;
+  }
+  const entry = { kind, name, offeredAt: index };
+  if (description !== void 0) entry.description = description;
+  if (status !== void 0) entry.status = status;
+  open.set(name, entry);
+  listFor(replay.roster, kind).push(entry);
+}
+function withdraw(replay, kind, name, index) {
+  const open = replay.open.get(kind);
+  const entry = open.get(name);
+  if (entry === void 0) return;
+  entry.withdrawnAt = index;
+  open.delete(name);
+}
+function openNames(replay, kind) {
+  return [...replay.open.get(kind).keys()];
+}
+function applyAvailabilityRecord(replay, attachment, index) {
+  if (typeof attachment !== "object" || attachment === null) return false;
+  const record = attachment;
+  const type = record.type;
+  if (type === "skill_listing") {
+    const names = asStrings(record.names);
+    const content = typeof record.content === "string" ? record.content : "";
+    if (record.isInitial === true) {
+      for (const name of openNames(replay, "skill")) {
+        if (!names.includes(name)) withdraw(replay, "skill", name, index);
+      }
+    }
+    const described = joinDescriptions(content, names);
+    for (const name of names) {
+      offer(replay, "skill", name, index, described.get(name));
+    }
+    return true;
+  }
+  if (type === "agent_listing_delta") {
+    const added = asStrings(record.addedTypes);
+    const lines = asStrings(record.addedLines);
+    if (record.isInitial === true) {
+      for (const name of openNames(replay, "agent")) {
+        if (!added.includes(name)) withdraw(replay, "agent", name, index);
+      }
+    }
+    const described = describedLines(added, lines);
+    for (const name of added) {
+      offer(replay, "agent", name, index, described.get(name));
+    }
+    for (const name of asStrings(record.removedTypes)) {
+      withdraw(replay, "agent", name, index);
+    }
+    return true;
+  }
+  if (type === "deferred_tools_delta") {
+    for (const name of asStrings(record.removedNames)) {
+      withdraw(replay, "tool", name, index);
+    }
+    for (const name of [
+      ...asStrings(record.addedNames),
+      ...asStrings(record.readdedNames)
+    ]) {
+      offer(replay, "tool", name, index);
+    }
+    const servers = [
+      ...asStrings(record.pendingMcpServers).map(
+        (n) => [n, "pending"]
+      ),
+      ...asStrings(record.needsAuthMcpServers).map(
+        (n) => [n, "needs-auth"]
+      ),
+      ...asStrings(record.failedMcpServers).map(
+        (n) => [n, "failed"]
+      )
+    ];
+    for (const [name, status] of servers) {
+      offer(replay, "mcp-server", name, index, void 0, status);
+    }
+    return true;
+  }
+  return false;
+}
+function remapAvailability(roster, at) {
+  const shift = (entries) => entries.map((entry) => ({
+    ...entry,
+    offeredAt: at(entry.offeredAt),
+    ...entry.withdrawnAt !== void 0 ? { withdrawnAt: at(entry.withdrawnAt) } : {}
+  }));
+  return {
+    recorded: roster.recorded,
+    skills: shift(roster.skills),
+    agents: shift(roster.agents),
+    tools: shift(roster.tools),
+    mcpServers: shift(roster.mcpServers)
+  };
+}
+function foldBranchAvailability(roster, branch, branchId, spawnIndex) {
+  if (!branch.recorded) return;
+  roster.recorded = true;
+  const merge = (into, from) => {
+    const known = offeredNames(into);
+    for (const entry of from) {
+      if (known.has(entry.name)) continue;
+      known.add(entry.name);
+      into.push({
+        ...entry,
+        offeredAt: spawnIndex,
+        branchId,
+        ...entry.withdrawnAt !== void 0 ? { withdrawnAt: void 0 } : {}
+      });
+    }
+  };
+  merge(roster.skills, branch.skills);
+  merge(roster.agents, branch.agents);
+  merge(roster.tools, branch.tools);
+  merge(roster.mcpServers, branch.mcpServers);
+}
+
+// src/tracevals/artifacts/availability.ts
+var empty = () => ({ offered: 0, used: 0, unused: 0 });
+var UNROSTERED = /* @__PURE__ */ new Set([
+  "project-rules",
+  "slash-command"
+]);
+function coverAvailability(trace, coverage, options = {}) {
+  const roster = trace.availability;
+  if (!roster.recorded) {
+    return {
+      report: { recorded: false, skills: empty(), agents: empty(), listed: false },
+      coverage: coverage.map(
+        (entry) => UNROSTERED.has(entry.kind) ? entry : { ...entry, availability: "unknown" }
+      )
+    };
+  }
+  const offeredSkills = offeredNames(roster.skills);
+  const offeredAgents = offeredNames(roster.agents);
+  const offeredFor = (kind) => kind === "skill" ? offeredSkills : offeredAgents;
+  const usedSkills = /* @__PURE__ */ new Set();
+  const usedAgents = /* @__PURE__ */ new Set();
+  const annotated = coverage.map((entry) => {
+    if (UNROSTERED.has(entry.kind)) return entry;
+    const offered = offeredFor(entry.kind).has(entry.ref);
+    if (offered) {
+      (entry.kind === "skill" ? usedSkills : usedAgents).add(entry.ref);
+    }
+    return {
+      ...entry,
+      availability: offered ? "offered-and-used" : "not-offered"
+    };
+  });
+  const listUnused = options.listUnused === true;
+  const unusedRows = [];
+  const collect = (kind, used) => {
+    let unused = 0;
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of kind === "skill" ? roster.skills : roster.agents) {
+      if (seen.has(entry.name)) continue;
+      seen.add(entry.name);
+      if (used.has(entry.name)) continue;
+      unused += 1;
+      if (!listUnused) continue;
+      unusedRows.push({
+        ref: entry.name,
+        kind,
+        resolved: false,
+        tried: [],
+        note: entry.description === void 0 ? "offered, never used" : `offered, never used \u2014 ${firstLine(entry.description)}`,
+        availability: "offered-not-used"
+      });
+    }
+    return unused;
+  };
+  const skillsUnused = collect("skill", usedSkills);
+  const agentsUnused = collect("agent", usedAgents);
+  return {
+    report: {
+      recorded: true,
+      skills: {
+        offered: offeredSkills.size,
+        used: usedSkills.size,
+        unused: skillsUnused
+      },
+      agents: {
+        offered: offeredAgents.size,
+        used: usedAgents.size,
+        unused: agentsUnused
+      },
+      listed: listUnused
+    },
+    coverage: [...annotated, ...unusedRows]
+  };
+}
+function firstLine(description) {
+  const line = description.split("\n")[0] ?? "";
+  return line.length > 160 ? `${line.slice(0, 157)}...` : line;
+}
+
+// src/tracevals/artifacts/fs.ts
+import { access, readdir, readFile as readFile3, stat } from "node:fs/promises";
+import { dirname as dirname3, join as join2, resolve as resolve3, sep as sep2 } from "node:path";
+function segments(path) {
+  return path.split(sep2).join("/").split("/");
+}
+var PRUNED_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "coverage",
+  ".manni",
+  ".tmp",
+  ".next",
+  ".venv"
+]);
+async function findGitRoot(start) {
+  let current = resolve3(start);
+  for (let depth = 0; depth < 64; depth += 1) {
+    try {
+      await access(join2(current, ".git"));
+      return current;
+    } catch {
+    }
+    const parent = dirname3(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+  return null;
+}
+async function safeRead(path) {
+  try {
+    return await readFile3(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+async function safeMtime(path) {
+  try {
+    const info = await stat(path);
+    return info.mtime.toISOString();
+  } catch {
+    return null;
+  }
+}
+async function findInTree(root, match) {
+  let entries;
+  try {
+    entries = await readdir(root, { withFileTypes: true, recursive: true });
+  } catch {
+    return null;
+  }
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const full = join2(entry.parentPath, entry.name);
+    if (match(full)) return full;
+  }
+  return null;
+}
+async function listInTree(root, match, options = {}) {
+  const prune = options.prune ?? PRUNED_DIRS;
+  const maxDepth = options.maxDepth ?? 24;
+  const found = [];
+  async function walk(dir, depth) {
+    if (depth > maxDepth) return;
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = join2(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (prune.has(entry.name)) continue;
+        await walk(full, depth + 1);
+      } else if (entry.isFile() && match(full)) {
+        found.push(full);
+      }
+    }
+  }
+  await walk(resolve3(root), 0);
+  return found.sort();
+}
+
+// src/tracevals/artifacts/resolve.ts
+import { basename, dirname as dirname4, join as join3, resolve as resolve4 } from "node:path";
+var PROJECT_RULES_FILENAMES = [
+  "CLAUDE.md",
+  "AGENTS.md",
+  "GEMINI.md"
+];
+var BUILTIN_AGENTS = /* @__PURE__ */ new Set([
+  "general-purpose",
+  "claude",
+  "Explore",
+  "Plan",
+  "statusline-setup",
+  "fork"
+]);
+async function resolveArtifacts(trace, options = {}) {
+  const projectDir = resolve4(options.projectDir ?? trace.cwd);
+  const userDir = configDir(options.env);
+  const projectRoot = resolve4(
+    options.projectRoot ?? await findGitRoot(projectDir) ?? projectDir
+  );
+  const artifacts = [];
+  const coverage = [];
+  const warnings = [];
+  const seenPaths = /* @__PURE__ */ new Set();
+  const seenRefs = /* @__PURE__ */ new Set();
+  const add = (artifact) => {
+    if (seenPaths.has(artifact.path)) return;
+    seenPaths.add(artifact.path);
+    artifacts.push(artifact);
+  };
+  const addSkill = (name, artifact, tried) => {
+    const refKey = `skill:${name}`;
+    if (seenRefs.has(refKey)) return;
+    seenRefs.add(refKey);
+    add(artifact);
+    coverage.push({
+      ref: name,
+      kind: "skill",
+      resolved: true,
+      path: artifact.path,
+      tried
+    });
+  };
+  for (const invocation of trace.skillInvocations) {
+    if (invocation.via === "command-injection") {
+      const refKey2 = `command:${invocation.name}`;
+      if (seenRefs.has(refKey2)) continue;
+      seenRefs.add(refKey2);
+      const command = await resolveSlashCommand(
+        invocation.name,
+        projectDir,
+        userDir
+      );
+      if (command.artifact) {
+        add(command.artifact);
+        coverage.push({
+          ref: invocation.name,
+          kind: "slash-command",
+          resolved: true,
+          path: command.artifact.path,
+          tried: command.tried
+        });
+        continue;
+      }
+      const skill = await resolveSkill(invocation.name, projectDir, userDir);
+      if (skill.artifact) {
+        addSkill(invocation.name, skill.artifact, skill.tried);
+        continue;
+      }
+      coverage.push({
+        ref: invocation.name,
+        kind: "slash-command",
+        resolved: false,
+        tried: [...command.tried, ...skill.tried],
+        note: "built-in slash command, or not installed here (no definition file)"
+      });
+      continue;
+    }
+    const refKey = `skill:${invocation.name}`;
+    if (seenRefs.has(refKey)) continue;
+    const { artifact, tried } = await resolveSkill(
+      invocation.name,
+      projectDir,
+      userDir
+    );
+    if (artifact) {
+      addSkill(invocation.name, artifact, tried);
+    } else {
+      seenRefs.add(refKey);
+      coverage.push({ ref: invocation.name, kind: "skill", resolved: false, tried });
+      warnings.push(
+        `skill "${invocation.name}" was invoked but no SKILL.md was found (${tried.length} location(s) tried)`
+      );
+    }
+  }
+  for (const spawn of trace.agentSpawns) {
+    const refKey = `agent:${spawn.subagentType}`;
+    if (seenRefs.has(refKey)) continue;
+    seenRefs.add(refKey);
+    if (BUILTIN_AGENTS.has(spawn.subagentType)) {
+      coverage.push({
+        ref: spawn.subagentType,
+        kind: "agent",
+        resolved: false,
+        tried: [],
+        note: "built-in agent (no definition file)"
+      });
+      continue;
+    }
+    const { artifact, tried } = await resolveAgent(
+      spawn.subagentType,
+      projectDir,
+      userDir
+    );
+    if (artifact) {
+      add(artifact);
+      coverage.push({
+        ref: spawn.subagentType,
+        kind: "agent",
+        resolved: true,
+        path: artifact.path,
+        tried
+      });
+    } else {
+      coverage.push({
+        ref: spawn.subagentType,
+        kind: "agent",
+        resolved: false,
+        tried
+      });
+      warnings.push(
+        `agent "${spawn.subagentType}" was spawned but no definition file was found (${tried.length} location(s) tried)`
+      );
+    }
+  }
+  const rules = await resolveProjectRules(projectDir, projectRoot);
+  for (const rule of rules.artifacts) add(rule);
+  const rulesEntry = {
+    ref: "project rules",
+    kind: "project-rules",
+    resolved: rules.artifacts.length > 0,
+    tried: rules.tried,
+    ...rules.artifacts.length === 0 ? { note: "no CLAUDE.md or AGENTS.md found" } : {}
+  };
+  coverage.push(rulesEntry);
+  await annotateStaleness(
+    trace,
+    coverage,
+    /* @__PURE__ */ new Map([[rulesEntry, rules.artifacts.map((a) => a.path)]]),
+    warnings,
+    projectRoot,
+    projectDir,
+    options.manifest
+  );
+  const availability = coverAvailability(trace, coverage, {
+    ...options.reportUnusedArtifacts !== void 0 ? { listUnused: options.reportUnusedArtifacts } : {}
+  });
+  return {
+    artifacts,
+    coverage: availability.coverage,
+    availability: availability.report,
+    warnings
+  };
+}
+async function annotateStaleness(trace, coverage, extraPaths, warnings, projectRoot, projectDir, manifest) {
+  const endedAt = trace.endedAt !== void 0 ? Date.parse(trace.endedAt) : Number.NaN;
+  const haveEnd = Number.isFinite(endedAt);
+  if (!haveEnd && manifest === void 0) return;
+  const base = manifest === void 0 ? projectRoot : joinBase(manifest, coverage, extraPaths, [
+    projectDir,
+    projectRoot,
+    manifest.root
+  ]);
+  const guessed = [];
+  const changed = [];
+  let joined = false;
+  for (const entry of coverage) {
+    if (!entry.resolved) continue;
+    const paths = extraPaths.get(entry) ?? (entry.path ? [entry.path] : []);
+    if (paths.length === 0) continue;
+    let newest;
+    let outside = false;
+    const digests = /* @__PURE__ */ new Map();
+    for (const path of paths) {
+      const mtime = await safeMtime(path);
+      if (mtime !== null && (newest === void 0 || mtime > newest)) {
+        newest = mtime;
+      }
+      if (manifest === void 0) continue;
+      const rel = relPosix(base, path);
+      if (rel === null) {
+        outside = true;
+        continue;
+      }
+      const digest = await hashFile(path);
+      if (digest !== null) digests.set(rel, digest);
+    }
+    if (newest !== void 0) entry.modifiedAt = newest;
+    const check = manifest === void 0 ? {
+      status: "skipped",
+      reason: "no session manifest for this trace"
+    } : outside && digests.size === 0 ? {
+      status: "skipped",
+      reason: "outside the project root, so no session manifest could record it"
+    } : checkContent(manifest, digests);
+    entry.contentCheck = check;
+    if (check.status !== "skipped") joined = true;
+    if (check.status === "mismatch") {
+      entry.stale = true;
+      changed.push(entry.ref);
+      continue;
+    }
+    if (check.status === "match") {
+      entry.stale = false;
+      continue;
+    }
+    if (!haveEnd || newest === void 0) continue;
+    entry.stale = Date.parse(newest) > endedAt;
+    if (entry.stale) guessed.push(entry.ref);
+  }
+  if (changed.length > 0) {
+    warnings.push(
+      `${changed.length} artifact(s) changed since the session started (${changed.join(", ")}) \u2014 the session manifest recorded a different sha256, so their evals are not the instructions this session followed.`
+    );
+  }
+  if (guessed.length > 0) {
+    warnings.push(
+      `${guessed.length} artifact(s) were modified after the session ended (${guessed.join(", ")}) \u2014 their evals may not be the instructions this session followed. mtime is a heuristic, not content identity.`
+    );
+  }
+  if (manifest !== void 0 && manifest.artifacts.length > 0 && !joined) {
+    warnings.push(
+      `the session manifest matched no artifact in this run \u2014 it recorded ${manifest.artifacts.length} artifact(s) relative to "${manifest.root}", and nothing resolved here lines up with them, so every hash check fell back to the mtime heuristic. Check that --project names the directory the session ran in.`
+    );
+  }
+}
+function joinBase(manifest, coverage, extraPaths, candidates) {
+  const recorded = new Set(manifest.artifacts.map((a) => a.path));
+  const paths = coverage.filter((entry) => entry.resolved).flatMap((entry) => extraPaths.get(entry) ?? (entry.path ? [entry.path] : []));
+  let best = candidates[0];
+  let bestScore = -1;
+  for (const candidate of candidates) {
+    if (typeof candidate !== "string" || candidate.length === 0) continue;
+    let score = 0;
+    for (const path of paths) {
+      let rel;
+      try {
+        rel = relPosix(candidate, path);
+      } catch {
+        continue;
+      }
+      if (rel !== null && recorded.has(rel)) score += 1;
+    }
+    if (score > bestScore) {
+      best = candidate;
+      bestScore = score;
+    }
+  }
+  return best;
+}
+async function resolveSkill(name, projectDir, userDir) {
+  const tried = [];
+  const [pluginName, shortName] = splitPluginRef(name);
+  const candidates = [];
+  if (pluginName === null) {
+    for (const dir of ["skills", join3("src", "skills"), join3(".claude", "skills")]) {
+      candidates.push({
+        path: join3(projectDir, dir, shortName, "SKILL.md"),
+        origin: "project"
+      });
+    }
+    candidates.push({
+      path: join3(userDir, "skills", shortName, "SKILL.md"),
+      origin: "user"
+    });
+  }
+  for (const candidate of candidates) {
+    tried.push(candidate.path);
+    const content = await safeRead(candidate.path);
+    if (content !== null) {
+      return {
+        artifact: {
+          name,
+          type: "skill",
+          path: candidate.path,
+          content,
+          origin: candidate.origin
+        },
+        tried
+      };
+    }
+  }
+  const pluginRoot = join3(userDir, "plugins");
+  tried.push(join3(pluginRoot, "**", "skills", shortName, "SKILL.md"));
+  const found = await findInTree(
+    pluginRoot,
+    (path) => basename(path) === "SKILL.md" && basename(dirname4(path)) === shortName && (pluginName === null || hasPathSegment(path, pluginName))
+  );
+  if (found) {
+    const content = await safeRead(found);
+    if (content !== null) {
+      return {
+        artifact: { name, type: "skill", path: found, content, origin: "plugin" },
+        tried
+      };
+    }
+  }
+  return { artifact: null, tried };
+}
+async function resolveSlashCommand(name, projectDir, userDir) {
+  const tried = [];
+  const [pluginName, shortName] = splitPluginRef(name);
+  const made = (path, content, origin) => ({
+    artifact: { name, type: "slash-command", path, content, origin },
+    tried
+  });
+  if (pluginName === null) {
+    const dirs = [
+      { dir: join3(projectDir, ".claude", "commands"), origin: "project" },
+      { dir: join3(userDir, "commands"), origin: "user" }
+    ];
+    for (const { dir, origin } of dirs) {
+      const path = join3(dir, `${shortName}.md`);
+      tried.push(path);
+      const content = await safeRead(path);
+      if (content !== null) return made(path, content, origin);
+    }
+    for (const { dir, origin } of dirs) {
+      tried.push(join3(dir, "**", `${shortName}.md`));
+      const found2 = await findInTree(
+        dir,
+        (path) => basename(path) === `${shortName}.md`
+      );
+      if (found2 === null) continue;
+      const content = await safeRead(found2);
+      if (content !== null) return made(found2, content, origin);
+    }
+    return { artifact: null, tried };
+  }
+  const pluginRoot = join3(userDir, "plugins");
+  tried.push(join3(pluginRoot, "**", "commands", `${shortName}.md`));
+  const found = await findInTree(
+    pluginRoot,
+    (path) => basename(path) === `${shortName}.md` && segments(path).includes("commands") && hasPathSegment(path, pluginName)
+  );
+  if (found !== null) {
+    const content = await safeRead(found);
+    if (content !== null) return made(found, content, "plugin");
+  }
+  return { artifact: null, tried };
+}
+function splitPluginRef(name) {
+  const at = name.indexOf(":");
+  if (at === -1) return [null, name];
+  return [name.slice(0, at), name.slice(at + 1)];
+}
+function hasPathSegment(path, pluginName) {
+  return segments(path).includes(pluginName);
+}
+async function resolveAgent(subagentType, projectDir, userDir) {
+  const tried = [];
+  const shortName = splitPluginRef(subagentType)[1];
+  const candidates = [
+    { path: join3(projectDir, ".claude", "agents", `${shortName}.md`), origin: "project" },
+    { path: join3(projectDir, "agents", `${shortName}.md`), origin: "project" },
+    { path: join3(userDir, "agents", `${shortName}.md`), origin: "user" }
+  ];
+  for (const candidate of candidates) {
+    tried.push(candidate.path);
+    const content = await safeRead(candidate.path);
+    if (content !== null) {
+      return {
+        artifact: {
+          name: subagentType,
+          type: "agent",
+          path: candidate.path,
+          content,
+          origin: candidate.origin
+        },
+        tried
+      };
+    }
+  }
+  return { artifact: null, tried };
+}
+async function resolveProjectRules(projectDir, projectRoot) {
+  const artifacts = [];
+  const tried = [];
+  const dirs = [];
+  let current = projectDir;
+  for (let depth = 0; depth < 32; depth += 1) {
+    dirs.push(current);
+    if (current === projectRoot) break;
+    const parent = dirname4(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  dirs.push(join3(projectRoot, ".claude"));
+  for (const dir of dirs) {
+    for (const filename of PROJECT_RULES_FILENAMES) {
+      const path = join3(dir, filename);
+      tried.push(path);
+      const content = await safeRead(path);
+      if (content !== null) {
+        artifacts.push({
+          name: filename,
+          type: "project-rules",
+          path,
+          content,
+          origin: "project"
+        });
+      }
+    }
+  }
+  return { artifacts, tried };
+}
+
+// src/tracevals/evals/schema.ts
+import { Ajv2020 as Ajv20203 } from "ajv/dist/2020.js";
+var artifactEvalsSchema = __default;
+var ARTIFACT_EVALS_SCHEMA_ID = __default.$id;
+var ajv3 = new Ajv20203({ allErrors: true, allowUnionTypes: true });
+ajv3.addKeyword({ keyword: "x-manni-location" });
+var validateArtifact = ajv3.compile(artifactEvalsSchema);
+function subjectOf(e) {
+  switch (e.keyword) {
+    case "required":
+      return e.params.missingProperty;
+    case "additionalProperties":
+      return e.params.additionalProperty;
+    case "format":
+      return e.params.format;
+    case "type":
+      return e.params.type;
+    default:
+      return void 0;
+  }
+}
+function artifactEvalsErrors(data, lineFor) {
+  if (validateArtifact(data)) return [];
+  const errors = [];
+  for (const raw of validateArtifact.errors ?? []) {
+    errors.push(toFieldError(raw, lineFor));
+  }
+  return errors;
+}
+function toFieldError(e, lineFor) {
+  const subject = subjectOf(e);
+  const message = subject !== void 0 && (e.keyword === "required" || e.keyword === "additionalProperties") ? `${e.message ?? "is invalid"} ("${subject}")` : e.message ?? "is invalid";
+  const line = lineFor(e.instancePath);
+  return {
+    schema: ARTIFACT_EVALS_SCHEMA_ID,
+    instancePath: e.instancePath,
+    message,
+    keyword: e.keyword,
+    ...subject !== void 0 ? { subject } : {},
+    ...line !== void 0 ? { line } : {}
+  };
+}
+
+// src/tracevals/evals/extract.ts
+var CLAIMED_KEYS = ["evals", "eval-skip", "meta-provenance"];
+var PREFIX_EXCEPTION = "eval-skip";
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function extractEvals(artifact, supplied) {
+  const extracted = supplied ?? extractFrontmatter(artifact.content, "markdown");
+  const metadata = extracted.data.metadata;
+  const bag = isPlainObject(metadata) ? metadata : void 0;
+  const declared = bag !== void 0 && bag.evals !== void 0;
+  if (!extracted.present && metadata === void 0) {
+    return { evals: [], errors: [], declared: false, skip: false, proposedBy: /* @__PURE__ */ new Map() };
+  }
+  const typoErrors = reservedPrefixErrors(bag, extracted.lineFor);
+  if (typoErrors.length > 0) {
+    return { evals: [], errors: typoErrors, declared, skip: false, proposedBy: /* @__PURE__ */ new Map() };
+  }
+  const wellFormed = metadata === void 0 || bag !== void 0;
+  const claimsNothing = bag === void 0 || !CLAIMED_KEYS.some((key) => bag[key] !== void 0);
+  if (wellFormed && claimsNothing) {
+    return {
+      evals: [],
+      errors: [],
+      declared: false,
+      skip: false,
+      proposedBy: /* @__PURE__ */ new Map()
+    };
+  }
+  const errors = artifactEvalsErrors(extracted.data, extracted.lineFor);
+  if (errors.length > 0) {
+    return { evals: [], errors, declared, skip: false, proposedBy: /* @__PURE__ */ new Map() };
+  }
+  const valid = bag ?? {};
+  const skip = valid["eval-skip"] === true;
+  return {
+    evals: normalizeBlock(valid.evals),
+    errors: [],
+    declared,
+    skip,
+    proposedBy: readProvenance(valid["meta-provenance"])
+  };
+}
+function readProvenance(raw) {
+  const out = /* @__PURE__ */ new Map();
+  for (const entry of metaProvenanceEntries(raw)) {
+    const by = entry["generated-by"];
+    for (const id of entry.evals) {
+      const list = out.get(id) ?? [];
+      if (!list.includes(by)) list.push(by);
+      out.set(id, list);
+    }
+  }
+  return out;
+}
+function reservedPrefixErrors(bag, lineFor) {
+  if (bag === void 0) return [];
+  const errors = [];
+  for (const key of Object.keys(bag)) {
+    if (!/^eval-/i.test(key) || key === PREFIX_EXCEPTION) continue;
+    const line = lineFor(`/metadata/${key}`);
+    errors.push({
+      schema: ARTIFACT_EVALS_SCHEMA_ID,
+      instancePath: `/metadata/${key}`,
+      message: `unrecognized "eval-" key; the only one this vocabulary claims under that prefix is ${PREFIX_EXCEPTION} (its other members are ${CLAIMED_KEYS.filter((k) => k !== PREFIX_EXCEPTION).join(" and ")})`,
+      keyword: "additionalProperties",
+      subject: key,
+      ...line !== void 0 ? { line } : {}
+    });
+  }
+  return errors;
+}
+function normalizeBlock(raw) {
+  if (typeof raw === "string") return [normalizeEntry(raw, 0)];
+  if (!Array.isArray(raw)) return [];
+  return raw.map((entry, index) => normalizeEntry(entry, index));
+}
+function normalizeEntry(raw, index) {
+  if (typeof raw === "string") {
+    return {
+      id: `eval-${index + 1}`,
+      assertion: raw,
+      type: "regression",
+      grader: "ai",
+      severity: "error"
+    };
+  }
+  const obj = raw;
+  const entry = {
+    id: obj.id,
+    // Optional since artifact-evals proposal.2: a `tool-usage` criterion says
+    // everything in `options`, and demanding a sentence no grader reads was
+    // the one place this vocabulary disagreed with the page side. The schema
+    // still requires it for `ai`, `human`, and a bare entry (which defaults to
+    // `ai`), so anything that actually needs an assertion still has one.
+    ...typeof obj.assertion === "string" ? { assertion: obj.assertion } : {},
+    type: obj.type ?? "regression",
+    grader: typeof obj.grader === "string" ? obj.grader : "ai",
+    severity: obj.severity ?? "error"
+  };
+  if (typeof obj.provider === "string") entry.provider = obj.provider;
+  if (typeof obj.model === "string") entry.model = obj.model;
+  if (typeof obj.runs === "number") entry.runs = obj.runs;
+  if (typeof obj.weight === "number") entry.weight = obj.weight;
+  if (typeof obj.target === "string" || obj.target && typeof obj.target === "object") {
+    entry.target = obj.target;
+  }
+  if (obj.options && typeof obj.options === "object") {
+    entry.options = obj.options;
+  }
+  if (typeof obj.evidence === "string") entry.evidence = obj.evidence;
+  if (obj.examples && typeof obj.examples === "object") {
+    entry.examples = normalizeExamples(obj.examples);
+  }
+  if (obj.skip === true) entry.skip = true;
+  if (obj["severity-map"] && typeof obj["severity-map"] === "object") {
+    entry.severityMap = obj["severity-map"];
+  }
+  if (Array.isArray(obj.command)) entry.command = obj.command;
+  if (Array.isArray(obj["success-exit-codes"])) {
+    entry.successExitCodes = obj["success-exit-codes"];
+  }
+  if (typeof obj["timeout-ms"] === "number") {
+    entry.timeoutMs = obj["timeout-ms"];
+  }
+  if (typeof obj["generated-assertion-hash"] === "string") {
+    entry.generatedAssertionHash = obj["generated-assertion-hash"];
+  }
+  return entry;
+}
+function normalizeExamples(raw) {
+  const out = {};
+  const pass = anchorList(raw.pass);
+  const fail = anchorList(raw.fail);
+  if (pass) out.pass = pass;
+  if (fail) out.fail = fail;
+  return out;
+}
+function anchorList(raw) {
+  if (typeof raw === "string") return [raw];
+  if (Array.isArray(raw)) return raw.filter((e) => typeof e === "string");
+  return void 0;
+}
+
+export {
+  reencryptMetadata,
+  reencryptData,
+  metaPageView,
+  declaredAt,
+  EXECUTION_GRANTS,
+  isExecutionGrant,
+  unknownGrantsMessage,
+  allowExecutionMessage,
+  NOT_GRANTED_REASON,
+  grantsFor,
+  configuredGrants,
+  REDACTION_PATTERNS,
+  CUSTOM_PLACEHOLDER,
+  makeRedactor,
+  compileRedactPatterns,
+  MANIFEST_VERSION,
+  DEFAULT_CAPTURE_DIR,
+  DEFAULT_LABELS_FILE,
+  labelKey,
+  parseLabels,
+  loadLabels,
+  DEFAULT_CONFIG_FILENAME,
+  CONFIG_SECTION_KEY,
+  parseConfig2 as parseConfig,
+  discoverConfig,
+  loadConfig2 as loadConfig,
+  newAvailability,
+  availableAt,
+  offeredNames,
+  joinDescriptions,
+  newReplay,
+  applyAvailabilityRecord,
+  remapAvailability,
+  foldBranchAvailability,
+  coverAvailability,
+  segments,
+  PRUNED_DIRS,
+  findGitRoot,
+  safeRead,
+  safeMtime,
+  findInTree,
+  listInTree,
+  sha256Hex,
+  hashFile,
+  relPosix,
+  safeSessionId,
+  manifestPathFor,
+  siblingManifestPath,
+  writeManifest,
+  readManifest,
+  findManifest,
+  checkContent,
+  PROJECT_RULES_FILENAMES,
+  resolveArtifacts,
+  ARTIFACT_EVALS_SCHEMA_ID,
+  extractEvals
+};
+//# sourceMappingURL=chunk-MOQXWXSG.js.map