@hexclave/shared-backend 1.0.32 → 1.0.34

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/index.ts"],"mappings":";;;iBA2BgB,YAAA,CAAa,KAAA;AAAA,iBAIb,qBAAA,CAAsB,SAAA;AAAA,iBAkBtB,sBAAA,CAAuB,cAAA;AAAA,iBAMjB,gBAAA,CAAiB,cAAA,WAAyB,OAAA,CAAQ,MAAA;AAAA,iBAIlD,cAAA,CAAe,cAAA,WAAyB,OAAA;EAAU,MAAA,EAAQ,MAAA;EAAQ,cAAA;AAAA;AAAA,iBAkElE,kBAAA,CAAmB,cAAA,UAAwB,YAAA,EAAc,MAAA,GAAS,OAAA;AAAA,iBA2ClE,mBAAA,CAAoB,cAAA,UAAwB,MAAA,EAAQ,MAAA,GAAS,OAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/index.ts"],"mappings":";;;iBAkDgB,YAAA,CAAa,KAAA;AAAA,iBAIb,qBAAA,CAAsB,SAAA;AAAA,iBAkBtB,sBAAA,CAAuB,cAAA;AAAA,iBAMjB,gBAAA,CAAiB,cAAA,WAAyB,OAAA,CAAQ,MAAA;AAAA,iBAIlD,cAAA,CAAe,cAAA,WAAyB,OAAA;EAAU,MAAA,EAAQ,MAAA;EAAQ,cAAA;AAAA;AAAA,iBAkElE,kBAAA,CAAmB,cAAA,UAAwB,YAAA,EAAc,MAAA,GAAS,OAAA;AAAA,iBA+ElE,mBAAA,CAAoB,cAAA,UAAwB,MAAA,EAAQ,MAAA,GAAS,OAAA"}

package/dist/esm/index.js

@@ -12,6 +12,23 @@ import { ClaudeAgentFailureError, ClaudeAgentTimeoutError, getToolWriteTargetPat
 const jiti = createJiti(import.meta.url, { moduleCache: false });
 const LOG_PREFIX = "[Stack config updater]";
 const DEFAULT_AGENT_TIMEOUT_MS = 12e4;
+const CONFIG_UPDATE_LOG_PATH_LIMIT = 40;
+function formatConfigUpdaterErrorForLog(error) {
+	if (error instanceof Error) return {
+		errorName: error.name,
+		errorMessage: error.message,
+		errorStack: error.stack
+	};
+	return { errorMessage: String(error) };
+}
+function configUpdatePathDetailsForLog(changes) {
+	const paths = changes.map(({ path: configPath }) => configPath).sort();
+	return {
+		configUpdatePathCount: paths.length,
+		configUpdatePaths: paths.slice(0, CONFIG_UPDATE_LOG_PATH_LIMIT),
+		configUpdatePathsTruncated: paths.length > CONFIG_UPDATE_LOG_PATH_LIMIT
+	};
+}
 function isConfigModule(value) {
 	return value !== null && typeof value === "object";
 }
@@ -81,16 +98,35 @@ function renderConfigObjectToFile(configFilePath, config) {
 	writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));
 }
 async function updateConfigObject(configFilePath, configUpdate) {
+	const startedAtMs = performance.now();
 	ensureConfigFileExists(configFilePath);
-	if (flattenConfigUpdate(configUpdate).length === 0) return;
+	const changes = flattenConfigUpdate(configUpdate);
+	if (changes.length === 0) {
+		console.log(`${LOG_PREFIX} Skipping config update because it contains no changes`, { configFilePath });
+		return;
+	}
+	const updateLogDetails = {
+		configFilePath,
+		...configUpdatePathDetailsForLog(changes)
+	};
+	console.log(`${LOG_PREFIX} Starting config file update`, updateLogDetails);
 	const content = readFileSync(configFilePath, "utf-8");
 	const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);
 	if (staticConfig != null && isValidConfig(staticConfig)) {
+		console.log(`${LOG_PREFIX} Applying config update with static config rewrite`, updateLogDetails);
 		const merged = override(staticConfig, configUpdate);
 		if (!isValidConfig(merged)) throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);
 		renderConfigObjectToFile(configFilePath, merged);
+		console.log(`${LOG_PREFIX} Finished config update with static config rewrite`, {
+			...updateLogDetails,
+			elapsedMs: Math.round(performance.now() - startedAtMs)
+		});
 		return;
 	}
+	console.log(`${LOG_PREFIX} Applying config update with agent-assisted rewrite`, {
+		...updateLogDetails,
+		configDirectory: path.dirname(configFilePath)
+	});
 	const baselineConfig = await tryReadConfigForValidation(configFilePath);
 	const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);
 	try {
@@ -101,16 +137,31 @@ async function updateConfigObject(configFilePath, configUpdate) {
 		});
 		await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);
 	} catch (error) {
+		console.warn(`${LOG_PREFIX} Config update failed; restoring files from snapshots`, {
+			...updateLogDetails,
+			snapshotCount: snapshots.length,
+			elapsedMs: Math.round(performance.now() - startedAtMs),
+			...formatConfigUpdaterErrorForLog(error)
+		});
 		try {
 			restoreConfigFiles(snapshots);
+			console.warn(`${LOG_PREFIX} Restored files after failed config update`, {
+				...updateLogDetails,
+				snapshotCount: snapshots.length
+			});
 		} catch (restoreError) {
 			console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {
 				configFilePath,
-				restoreError: restoreError instanceof Error ? restoreError.message : String(restoreError)
+				...formatConfigUpdaterErrorForLog(restoreError)
 			});
 		}
 		throw error;
 	}
+	console.log(`${LOG_PREFIX} Finished config update with agent-assisted rewrite`, {
+		...updateLogDetails,
+		elapsedMs: Math.round(performance.now() - startedAtMs),
+		snapshotCount: snapshots.length
+	});
 }
 async function replaceConfigObject(configFilePath, config) {
 	renderConfigObjectToFile(configFilePath, config);
@@ -118,6 +169,11 @@ async function replaceConfigObject(configFilePath, config) {
 async function runConfigUpdateAgent(options) {
 	const timeoutMs = parseAgentTimeoutMs();
 	const deniedOutOfBoundsWrites = /* @__PURE__ */ new Set();
+	const startedAtMs = performance.now();
+	console.log(`${LOG_PREFIX} Starting config update agent`, {
+		cwd: options.cwd,
+		timeoutMs
+	});
 	try {
 		await runHeadlessClaudeAgent({
 			prompt: options.prompt,
@@ -150,11 +206,46 @@ async function runConfigUpdateAgent(options) {
 			}
 		});
 	} catch (error) {
-		if (error instanceof ClaudeAgentTimeoutError) throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);
-		if (error instanceof ClaudeAgentFailureError) throw new Error(`${error.message} It was unable to apply the config changes to the file.`);
+		if (error instanceof ClaudeAgentTimeoutError) {
+			console.warn(`${LOG_PREFIX} Config update agent timed out`, {
+				cwd: options.cwd,
+				timeoutMs,
+				elapsedMs: Math.round(performance.now() - startedAtMs),
+				...formatConfigUpdaterErrorForLog(error)
+			});
+			throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);
+		}
+		if (error instanceof ClaudeAgentFailureError) {
+			console.warn(`${LOG_PREFIX} Config update agent failed`, {
+				cwd: options.cwd,
+				timeoutMs,
+				elapsedMs: Math.round(performance.now() - startedAtMs),
+				...formatConfigUpdaterErrorForLog(error)
+			});
+			throw new Error(`${error.message} It was unable to apply the config changes to the file.`);
+		}
+		console.warn(`${LOG_PREFIX} Config update agent failed unexpectedly`, {
+			cwd: options.cwd,
+			timeoutMs,
+			elapsedMs: Math.round(performance.now() - startedAtMs),
+			...formatConfigUpdaterErrorForLog(error)
+		});
 		throw error;
 	}
-	if (deniedOutOfBoundsWrites.size > 0) throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(", ")}. The config was not updated.`);
+	console.log(`${LOG_PREFIX} Finished config update agent`, {
+		cwd: options.cwd,
+		timeoutMs,
+		elapsedMs: Math.round(performance.now() - startedAtMs),
+		deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size
+	});
+	if (deniedOutOfBoundsWrites.size > 0) {
+		console.warn(`${LOG_PREFIX} Config update agent attempted out-of-bounds writes`, {
+			cwd: options.cwd,
+			deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,
+			deniedOutOfBoundsWrites: [...deniedOutOfBoundsWrites]
+		});
+		throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(", ")}. The config was not updated.`);
+	}
 }
 function parseAgentTimeoutMs() {
 	const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import { showOnboardingHexclaveConfigValue } from \"@hexclave/shared/dist/config-authoring\";\nimport { detectImportPackageFromDir, parseHexclaveConfigFileContent, renderConfigFileContent } from \"@hexclave/shared/dist/config-rendering\";\nimport type { Config, ConfigValue, NormalizedConfig } from \"@hexclave/shared/dist/config/format\";\nimport { isValidConfig, normalize, override } from \"@hexclave/shared/dist/config/format\";\nimport { captureError } from \"@hexclave/shared/dist/utils/errors\";\nimport { createHash } from \"crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"fs\";\nimport { createJiti } from \"jiti\";\nimport path from \"path\";\nimport { ClaudeAgentFailureError, ClaudeAgentTimeoutError, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent } from \"./config-agent\";\n\nconst jiti = createJiti(import.meta.url, { moduleCache: false });\n\nconst LOG_PREFIX = \"[Stack config updater]\";\nconst DEFAULT_AGENT_TIMEOUT_MS = 120_000;\n\ntype ConfigModule = {\n  config?: unknown,\n};\n\ntype ConfigFileSnapshot = { path: string, content: string | null };\ntype ConfigChange = { path: string, value: ConfigValue };\n\nfunction isConfigModule(value: unknown): value is ConfigModule {\n  return value !== null && typeof value === \"object\";\n}\n\nexport function sha256String(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nexport function resolveConfigFilePath(inputPath: string): string {\n  const resolved = path.resolve(inputPath);\n  const looksLikeConfigFile = /\\.(ts|js|mjs|cjs)$/i.test(resolved);\n  if (looksLikeConfigFile) {\n    return resolved;\n  }\n  // Prefer hexclave.config.ts, fall back to stack.config.ts, default to the new name.\n  const hexclaveCandidate = path.join(resolved, \"hexclave.config.ts\");\n  const legacyCandidate = path.join(resolved, \"stack.config.ts\");\n  if (existsSync(hexclaveCandidate)) {\n    return hexclaveCandidate;\n  }\n  if (existsSync(legacyCandidate)) {\n    return legacyCandidate;\n  }\n  return hexclaveCandidate;\n}\n\nexport function ensureConfigFileExists(configFilePath: string): void {\n  if (existsSync(configFilePath)) return;\n  mkdirSync(path.dirname(configFilePath), { recursive: true });\n  renderConfigObjectToFile(configFilePath, {});\n}\n\nexport async function readConfigObject(configFilePath: string): Promise<Config> {\n  return (await readConfigFile(configFilePath)).config;\n}\n\nexport async function readConfigFile(configFilePath: string): Promise<{ config: Config, showOnboarding: boolean }> {\n  ensureConfigFileExists(configFilePath);\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (content.trim() === \"\") {\n    return {\n      config: {},\n      showOnboarding: false,\n    };\n  }\n\n  let configModule: unknown;\n  try {\n    configModule = await jiti.import<unknown>(configFilePath);\n  } catch (error) {\n    // Capture the raw jiti/framework error for diagnostics, but don't attach it as `cause` on the thrown error:\n    // dashboard error formatting renders causes recursively, which would leak framework internals into the\n    // user-facing message we're deliberately replacing.\n    captureError(\"shared-backend/readConfigFile\", error);\n    throw new Error(\n      `Failed to load config file ${configFilePath}.`,\n    );\n  }\n  if (!isConfigModule(configModule)) {\n    throw new Error(`Invalid config in ${configFilePath}. The file must export a plain \\`config\\` object or \"show-onboarding\".`);\n  }\n\n  const config = configModule.config;\n  if (config === showOnboardingHexclaveConfigValue) {\n    return {\n      config: {},\n      showOnboarding: true,\n    };\n  }\n  if (!isValidConfig(config)) {\n    throw new Error(`Invalid config in ${configFilePath}.`);\n  }\n  return {\n    config,\n    showOnboarding: false,\n  };\n}\n\nfunction renderConfigObjectToString(configFilePath: string, config: Config): string {\n  const importPackage = detectImportPackageFromDir(path.dirname(configFilePath));\n  return renderConfigFileContent(config, importPackage);\n}\n\nfunction writeFileAtomic(configFilePath: string, content: string): void {\n  const dir = path.dirname(configFilePath);\n  mkdirSync(dir, { recursive: true });\n  const tempPath = path.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);\n  writeFileSync(tempPath, content, \"utf-8\");\n  try {\n    renameSync(tempPath, configFilePath);\n  } catch (error) {\n    try {\n      rmSync(tempPath);\n    } catch { /* best-effort cleanup */ }\n    throw error;\n  }\n}\n\nfunction renderConfigObjectToFile(configFilePath: string, config: Config): void {\n  writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));\n}\n\nexport async function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void> {\n  ensureConfigFileExists(configFilePath);\n\n  if (flattenConfigUpdate(configUpdate).length === 0) return;\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n\n  // Fast path: if the config is a plain static literal (no imports, no helpers),\n  // apply the update deterministically without invoking the AI agent.\n  const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);\n  if (staticConfig != null && isValidConfig(staticConfig)) {\n    const merged = override(staticConfig, configUpdate);\n    if (!isValidConfig(merged)) {\n      throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);\n    }\n    renderConfigObjectToFile(configFilePath, merged);\n    return;\n  }\n\n  // Agent path: config has custom structure (imports, helpers, external files)\n  // that must be preserved — delegate to the AI agent.\n  const baselineConfig = await tryReadConfigForValidation(configFilePath);\n  const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);\n  try {\n    await runConfigUpdateAgent({\n      prompt: buildConfigUpdatePrompt(path.basename(configFilePath), configUpdate, baselineConfig),\n      cwd: path.dirname(configFilePath),\n      onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen),\n    });\n    await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);\n  } catch (error) {\n    try {\n      restoreConfigFiles(snapshots);\n    } catch (restoreError) {\n      console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {\n        configFilePath,\n        restoreError: restoreError instanceof Error ? restoreError.message : String(restoreError),\n      });\n    }\n    throw error;\n  }\n}\n\nexport async function replaceConfigObject(configFilePath: string, config: Config): Promise<void> {\n  renderConfigObjectToFile(configFilePath, config);\n}\n\nasync function runConfigUpdateAgent(options: {\n  prompt: string,\n  cwd: string,\n  onFileWillChange?: (filePath: string) => void,\n}): Promise<void> {\n  const timeoutMs = parseAgentTimeoutMs();\n  const deniedOutOfBoundsWrites = new Set<string>();\n  try {\n    await runHeadlessClaudeAgent({\n      prompt: options.prompt,\n      cwd: options.cwd,\n      allowedTools: [\"Read\", \"Write\", \"Edit\", \"Glob\", \"Grep\"],\n      strictIsolation: true,\n      timeoutMs,\n      stderr: (data) => { console.warn(`${LOG_PREFIX} [agent] ${data}`); },\n      onPreToolUse: (input) => {\n        const target = getToolWriteTargetPath(input.tool_name, input.tool_input, options.cwd);\n        if (target == null) return { continue: true };\n        if (!isPathInsideDir(options.cwd, target)) {\n          deniedOutOfBoundsWrites.add(target);\n          return {\n            hookSpecificOutput: {\n              hookEventName: \"PreToolUse\",\n              permissionDecision: \"deny\",\n              permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`,\n            },\n          };\n        }\n        options.onFileWillChange?.(target);\n        return { continue: true };\n      },\n    });\n  } catch (error) {\n    if (error instanceof ClaudeAgentTimeoutError) {\n      throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);\n    }\n    if (error instanceof ClaudeAgentFailureError) {\n      throw new Error(`${error.message} It was unable to apply the config changes to the file.`);\n    }\n    throw error;\n  }\n  if (deniedOutOfBoundsWrites.size > 0) {\n    throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(\", \")}. The config was not updated.`);\n  }\n}\n\nfunction parseAgentTimeoutMs(): number {\n  const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;\n  if (raw == null || raw.trim() === \"\") return DEFAULT_AGENT_TIMEOUT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);\n  }\n  return parsed;\n}\n\nfunction captureSnapshotIfAbsent(snapshots: ConfigFileSnapshot[], filePath: string, seen: Set<string>): void {\n  const resolved = path.resolve(filePath);\n  if (seen.has(resolved)) return;\n  seen.add(resolved);\n  snapshots.push({ path: resolved, content: existsSync(resolved) ? readFileSync(resolved, \"utf-8\") : null });\n}\n\nfunction snapshotConfigFiles(configFilePath: string, configContent: string): { snapshots: ConfigFileSnapshot[]; seen: Set<string> } {\n  const dir = path.dirname(configFilePath);\n  const resolvedConfig = path.resolve(configFilePath);\n  const snapshots: ConfigFileSnapshot[] = [{ path: resolvedConfig, content: configContent }];\n  const seen = new Set<string>([resolvedConfig]);\n  for (const specifier of getRelativeImportSpecifiers(configContent)) {\n    const resolved = path.resolve(dir, specifier);\n    if (!isPathInsideDir(dir, resolved)) continue;\n    captureSnapshotIfAbsent(snapshots, resolved, seen);\n  }\n  return { snapshots, seen };\n}\n\nfunction restoreConfigFiles(snapshots: ConfigFileSnapshot[]): void {\n  const failures: string[] = [];\n  for (const { path: filePath, content } of snapshots) {\n    try {\n      if (content === null) {\n        if (existsSync(filePath)) rmSync(filePath);\n      } else {\n        writeFileSync(filePath, content, \"utf-8\");\n      }\n    } catch (error) {\n      failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n  if (failures.length > 0) {\n    throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join(\"; \")}`);\n  }\n}\n\nasync function tryReadConfigForValidation(configFilePath: string): Promise<Config | null> {\n  try {\n    return (await readConfigFile(configFilePath)).config;\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {\n      configFilePath,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return null;\n  }\n}\n\nasync function validateAgentUpdate(configFilePath: string, baselineConfig: Config | null, configUpdate: Config, snapshots: ConfigFileSnapshot[]): Promise<void> {\n  if (baselineConfig != null) {\n    const target = canonicalizeConfig(override(baselineConfig, configUpdate));\n    const result = canonicalizeConfig((await readConfigFile(configFilePath)).config);\n    if (!configsEqual(result, target)) {\n      throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);\n    }\n    return;\n  }\n\n  // Structural-only fallback: when jiti can't evaluate the config (e.g. missing\n  // runtime dependencies in import-with attributes), we can only verify that\n  // (a) something changed on disk and (b) the file still exports `config`.\n  // This cannot catch silently mis-applied values — an accepted tradeoff vs.\n  // blocking updates entirely for configs we can't evaluate.\n  // When nothing changed on disk the update is either already applied or the\n  // agent couldn't figure out what to do. Treat it as a no-op rather than a\n  // hard failure: the structural check below still verifies the file is valid.\n  if (flattenConfigUpdate(configUpdate).length > 0 && !snapshotsChangedOnDisk(snapshots)) {\n    console.warn(`${LOG_PREFIX} Agent did not modify any file for ${configFilePath}; assuming values are already up to date.`);\n  }\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (!configFileExportsConfig(content, configFilePath)) {\n    throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \\`config\\`.`);\n  }\n}\n\nfunction tryParseStaticConfigFileContent(content: string, configFilePath: string): Config | null {\n  try {\n    const parsed = parseHexclaveConfigFileContent(content, configFilePath);\n    return isValidConfig(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction configFileExportsConfig(content: string, configFilePath: string): boolean {\n  try {\n    parseHexclaveConfigFileContent(content, configFilePath);\n    return true;\n  } catch {\n    // Dynamic configs can be valid even when the static parser cannot evaluate\n    // them. For the structural fallback we only need to know that a runtime\n    // config binding still exists after the agent edited the file.\n    return /\\bexport\\s+const\\s+config\\b/.test(content);\n  }\n}\n\nfunction getRelativeImportSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n  const importPattern = /\\bimport\\b(?:[^'\"]*?\\bfrom\\s*)?[\"'](\\.{1,2}\\/[^\"']+)[\"']/g;\n  let match: RegExpExecArray | null;\n  while ((match = importPattern.exec(content)) !== null) {\n    specifiers.push(match[1]);\n  }\n  return specifiers;\n}\n\nfunction snapshotsChangedOnDisk(snapshots: ConfigFileSnapshot[]): boolean {\n  return snapshots.some(({ path: filePath, content }) => {\n    const current = existsSync(filePath) ? readFileSync(filePath, \"utf-8\") : null;\n    return current !== content;\n  });\n}\n\nfunction flattenConfigUpdate(update: Config): ConfigChange[] {\n  const changes: ConfigChange[] = [];\n  const walk = (prefix: string, obj: Config): void => {\n    for (const [key, value] of Object.entries(obj)) {\n      const fullPath = prefix === \"\" ? key : `${prefix}.${key}`;\n      if (value === undefined) continue;\n      if (value !== null && typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length > 0) {\n        walk(fullPath, value);\n      } else {\n        changes.push({ path: fullPath, value });\n      }\n    }\n  };\n  walk(\"\", update);\n  return changes;\n}\n\nfunction buildConfigUpdatePrompt(configFileName: string, configUpdate: Config, baselineConfig: Config | null): string {\n  const changes = flattenConfigUpdate(configUpdate);\n  const changeLines = changes.map(({ path: configPath, value }) => {\n    return `- ${JSON.stringify(configPath)}: set to ${JSON.stringify(value)}`;\n  }).join(\"\\n\");\n  const expectedConfig = baselineConfig == null ? null : canonicalizeConfig(override(baselineConfig, configUpdate));\n  const expectedConfigSection = expectedConfig == null ? \"\" : `\nAfter the edit, evaluating the exported \\`config\\` must produce this exact JSON value:\n\n${JSON.stringify(expectedConfig, null, 2)}\n`;\n\n  return `You are editing a Hexclave / Stack Auth configuration file in place. Apply a set of configuration changes WITHOUT changing how the file is written.\n\nConfig file: ${JSON.stringify(configFileName)} (in the current working directory).\n\nThe file exports a \\`config\\` object (it may be wrapped in a helper such as \\`defineStackConfig(...)\\`). Some config values may be sourced from other files via imports, for example:\n\n    import welcomeEmail from \"./welcome-email.tsx\" with { type: \"text\" };\n    export const config = { emails: { templates: { welcome: welcomeEmail } } };\n\nApply EXACTLY these changes. Paths use dot notation, so \\`a.b.c\\` refers to \\`config.a.b.c\\`:\n\n${changeLines}\n${expectedConfigSection}\n\nRules:\n- Change ONLY the config paths listed above. Leave every other part of the file byte-for-byte unchanged: imports, comments, formatting, helper wrappers, and any config fields not listed.\n- If a listed path's value is currently provided by an imported external file (like the \\`import ... with { type: \"text\" }\\` example above), DO NOT inline the new value into the config file. Instead, overwrite that external file with the new value and keep the import statement intact.\n- If a listed path's value is a plain inline literal, edit it inline.\n- Keep the file valid: it must still export a \\`config\\` that, once evaluated, reflects the new values exactly.\n- Do not run any shell commands and do not create files other than what is required to apply these changes.`;\n}\n\nfunction canonicalizeConfig(config: Config): NormalizedConfig {\n  const droppedKeys: string[] = [];\n  const normalized = normalize(config, {\n    onDotIntoNonObject: \"ignore\",\n    onDotIntoNull: \"empty-object\",\n    droppedKeys,\n  });\n  if (droppedKeys.length > 0) {\n    throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(\", \")}`);\n  }\n  return normalized;\n}\n\nfunction configsEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true;\n  if (a === null || b === null) return a === b;\n  if (Array.isArray(a) || Array.isArray(b)) {\n    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;\n    return a.every((value, index) => configsEqual(value, b[index]));\n  }\n  if (typeof a === \"object\" && typeof b === \"object\") {\n    const aEntries = Object.entries(a);\n    const bMap = new Map(Object.entries(b));\n    if (aEntries.length !== bMap.size) return false;\n    return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,OAAO,WAAW,OAAO,KAAK,KAAK,EAAE,aAAa,OAAO,CAAC;AAEhE,MAAM,aAAa;AACnB,MAAM,2BAA2B;AASjC,SAAS,eAAe,OAAuC;AAC7D,QAAO,UAAU,QAAQ,OAAO,UAAU;;AAG5C,SAAgB,aAAa,OAAuB;AAClD,QAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;AAGzD,SAAgB,sBAAsB,WAA2B;CAC/D,MAAM,WAAW,KAAK,QAAQ,UAAU;AAExC,KAD4B,sBAAsB,KAAK,SAAS,CAE9D,QAAO;CAGT,MAAM,oBAAoB,KAAK,KAAK,UAAU,qBAAqB;CACnE,MAAM,kBAAkB,KAAK,KAAK,UAAU,kBAAkB;AAC9D,KAAI,WAAW,kBAAkB,CAC/B,QAAO;AAET,KAAI,WAAW,gBAAgB,CAC7B,QAAO;AAET,QAAO;;AAGT,SAAgB,uBAAuB,gBAA8B;AACnE,KAAI,WAAW,eAAe,CAAE;AAChC,WAAU,KAAK,QAAQ,eAAe,EAAE,EAAE,WAAW,MAAM,CAAC;AAC5D,0BAAyB,gBAAgB,EAAE,CAAC;;AAG9C,eAAsB,iBAAiB,gBAAyC;AAC9E,SAAQ,MAAM,eAAe,eAAe,EAAE;;AAGhD,eAAsB,eAAe,gBAA8E;AACjH,wBAAuB,eAAe;AAEtC,KADgB,aAAa,gBAAgB,QAAQ,CACzC,MAAM,KAAK,GACrB,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;CAGH,IAAI;AACJ,KAAI;AACF,iBAAe,MAAM,KAAK,OAAgB,eAAe;UAClD,OAAO;AAId,eAAa,iCAAiC,MAAM;AACpD,QAAM,IAAI,MACR,8BAA8B,eAAe,GAC9C;;AAEH,KAAI,CAAC,eAAe,aAAa,CAC/B,OAAM,IAAI,MAAM,qBAAqB,eAAe,wEAAwE;CAG9H,MAAM,SAAS,aAAa;AAC5B,KAAI,WAAW,kCACb,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;AAEH,KAAI,CAAC,cAAc,OAAO,CACxB,OAAM,IAAI,MAAM,qBAAqB,eAAe,GAAG;AAEzD,QAAO;EACL;EACA,gBAAgB;EACjB;;AAGH,SAAS,2BAA2B,gBAAwB,QAAwB;AAElF,QAAO,wBAAwB,QADT,2BAA2B,KAAK,QAAQ,eAAe,CAAC,CACzB;;AAGvD,SAAS,gBAAgB,gBAAwB,SAAuB;CACtE,MAAM,MAAM,KAAK,QAAQ,eAAe;AACxC,WAAU,KAAK,EAAE,WAAW,MAAM,CAAC;CACnC,MAAM,WAAW,KAAK,KAAK,KAAK,iBAAiB,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM;AAC3F,eAAc,UAAU,SAAS,QAAQ;AACzC,KAAI;AACF,aAAW,UAAU,eAAe;UAC7B,OAAO;AACd,MAAI;AACF,UAAO,SAAS;UACV;AACR,QAAM;;;AAIV,SAAS,yBAAyB,gBAAwB,QAAsB;AAC9E,iBAAgB,gBAAgB,2BAA2B,gBAAgB,OAAO,CAAC;;AAGrF,eAAsB,mBAAmB,gBAAwB,cAAqC;AACpG,wBAAuB,eAAe;AAEtC,KAAI,oBAAoB,aAAa,CAAC,WAAW,EAAG;CAEpD,MAAM,UAAU,aAAa,gBAAgB,QAAQ;CAIrD,MAAM,eAAe,gCAAgC,SAAS,eAAe;AAC7E,KAAI,gBAAgB,QAAQ,cAAc,aAAa,EAAE;EACvD,MAAM,SAAS,SAAS,cAAc,aAAa;AACnD,MAAI,CAAC,cAAc,OAAO,CACxB,OAAM,IAAI,MAAM,GAAG,WAAW,qDAAqD,iBAAiB;AAEtG,2BAAyB,gBAAgB,OAAO;AAChD;;CAKF,MAAM,iBAAiB,MAAM,2BAA2B,eAAe;CACvE,MAAM,EAAE,WAAW,SAAS,oBAAoB,gBAAgB,QAAQ;AACxE,KAAI;AACF,QAAM,qBAAqB;GACzB,QAAQ,wBAAwB,KAAK,SAAS,eAAe,EAAE,cAAc,eAAe;GAC5F,KAAK,KAAK,QAAQ,eAAe;GACjC,mBAAmB,aAAa,wBAAwB,WAAW,UAAU,KAAK;GACnF,CAAC;AACF,QAAM,oBAAoB,gBAAgB,gBAAgB,cAAc,UAAU;UAC3E,OAAO;AACd,MAAI;AACF,sBAAmB,UAAU;WACtB,cAAc;AACrB,WAAQ,MAAM,GAAG,WAAW,mEAAmE,eAAe,yDAAyD;IACrK;IACA,cAAc,wBAAwB,QAAQ,aAAa,UAAU,OAAO,aAAa;IAC1F,CAAC;;AAEJ,QAAM;;;AAIV,eAAsB,oBAAoB,gBAAwB,QAA+B;AAC/F,0BAAyB,gBAAgB,OAAO;;AAGlD,eAAe,qBAAqB,SAIlB;CAChB,MAAM,YAAY,qBAAqB;CACvC,MAAM,0CAA0B,IAAI,KAAa;AACjD,KAAI;AACF,QAAM,uBAAuB;GAC3B,QAAQ,QAAQ;GAChB,KAAK,QAAQ;GACb,cAAc;IAAC;IAAQ;IAAS;IAAQ;IAAQ;IAAO;GACvD,iBAAiB;GACjB;GACA,SAAS,SAAS;AAAE,YAAQ,KAAK,GAAG,WAAW,WAAW,OAAO;;GACjE,eAAe,UAAU;IACvB,MAAM,SAAS,uBAAuB,MAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AACrF,QAAI,UAAU,KAAM,QAAO,EAAE,UAAU,MAAM;AAC7C,QAAI,CAAC,gBAAgB,QAAQ,KAAK,OAAO,EAAE;AACzC,6BAAwB,IAAI,OAAO;AACnC,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,oBAAoB;MACpB,0BAA0B,sBAAsB,OAAO;MACxD,EACF;;AAEH,YAAQ,mBAAmB,OAAO;AAClC,WAAO,EAAE,UAAU,MAAM;;GAE5B,CAAC;UACK,OAAO;AACd,MAAI,iBAAiB,wBACnB,OAAM,IAAI,MAAM,uCAAuC,UAAU,4DAA4D;AAE/H,MAAI,iBAAiB,wBACnB,OAAM,IAAI,MAAM,GAAG,MAAM,QAAQ,yDAAyD;AAE5F,QAAM;;AAER,KAAI,wBAAwB,OAAO,EACjC,OAAM,IAAI,MAAM,uCAAuC,wBAAwB,KAAK,+DAA+D,CAAC,GAAG,wBAAwB,CAAC,KAAK,KAAK,CAAC,+BAA+B;;AAI9N,SAAS,sBAA8B;CACrC,MAAM,MAAM,QAAQ,IAAI;AACxB,KAAI,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAI,QAAO;CAC7C,MAAM,SAAS,OAAO,IAAI;AAC1B,KAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACxC,OAAM,IAAI,MAAM,iDAAiD,KAAK,UAAU,IAAI,CAAC,+CAA+C;AAEtI,QAAO;;AAGT,SAAS,wBAAwB,WAAiC,UAAkB,MAAyB;CAC3G,MAAM,WAAW,KAAK,QAAQ,SAAS;AACvC,KAAI,KAAK,IAAI,SAAS,CAAE;AACxB,MAAK,IAAI,SAAS;AAClB,WAAU,KAAK;EAAE,MAAM;EAAU,SAAS,WAAW,SAAS,GAAG,aAAa,UAAU,QAAQ,GAAG;EAAM,CAAC;;AAG5G,SAAS,oBAAoB,gBAAwB,eAA+E;CAClI,MAAM,MAAM,KAAK,QAAQ,eAAe;CACxC,MAAM,iBAAiB,KAAK,QAAQ,eAAe;CACnD,MAAM,YAAkC,CAAC;EAAE,MAAM;EAAgB,SAAS;EAAe,CAAC;CAC1F,MAAM,OAAO,IAAI,IAAY,CAAC,eAAe,CAAC;AAC9C,MAAK,MAAM,aAAa,4BAA4B,cAAc,EAAE;EAClE,MAAM,WAAW,KAAK,QAAQ,KAAK,UAAU;AAC7C,MAAI,CAAC,gBAAgB,KAAK,SAAS,CAAE;AACrC,0BAAwB,WAAW,UAAU,KAAK;;AAEpD,QAAO;EAAE;EAAW;EAAM;;AAG5B,SAAS,mBAAmB,WAAuC;CACjE,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,EAAE,MAAM,UAAU,aAAa,UACxC,KAAI;AACF,MAAI,YAAY,MACd;OAAI,WAAW,SAAS,CAAE,QAAO,SAAS;QAE1C,eAAc,UAAU,SAAS,QAAQ;UAEpC,OAAO;AACd,WAAS,KAAK,GAAG,SAAS,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAAG;;AAG3F,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,MAAM,qBAAqB,SAAS,OAAO,4BAA4B,SAAS,KAAK,KAAK,GAAG;;AAI3G,eAAe,2BAA2B,gBAAgD;AACxF,KAAI;AACF,UAAQ,MAAM,eAAe,eAAe,EAAE;UACvC,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,2FAA2F;GACpH;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC9D,CAAC;AACF,SAAO;;;AAIX,eAAe,oBAAoB,gBAAwB,gBAA+B,cAAsB,WAAgD;AAC9J,KAAI,kBAAkB,MAAM;EAC1B,MAAM,SAAS,mBAAmB,SAAS,gBAAgB,aAAa,CAAC;AAEzE,MAAI,CAAC,aADU,oBAAoB,MAAM,eAAe,eAAe,EAAE,OAAO,EACtD,OAAO,CAC/B,OAAM,IAAI,MAAM,uCAAuC,eAAe,qEAAqE;AAE7I;;AAWF,KAAI,oBAAoB,aAAa,CAAC,SAAS,KAAK,CAAC,uBAAuB,UAAU,CACpF,SAAQ,KAAK,GAAG,WAAW,qCAAqC,eAAe,2CAA2C;AAI5H,KAAI,CAAC,wBADW,aAAa,gBAAgB,QAAQ,EACf,eAAe,CACnD,OAAM,IAAI,MAAM,uCAAuC,eAAe,0DAA0D;;AAIpI,SAAS,gCAAgC,SAAiB,gBAAuC;AAC/F,KAAI;EACF,MAAM,SAAS,+BAA+B,SAAS,eAAe;AACtE,SAAO,cAAc,OAAO,GAAG,SAAS;SAClC;AACN,SAAO;;;AAIX,SAAS,wBAAwB,SAAiB,gBAAiC;AACjF,KAAI;AACF,iCAA+B,SAAS,eAAe;AACvD,SAAO;SACD;AAIN,SAAO,8BAA8B,KAAK,QAAQ;;;AAItD,SAAS,4BAA4B,SAA2B;CAC9D,MAAM,aAAuB,EAAE;CAC/B,MAAM,gBAAgB;CACtB,IAAI;AACJ,SAAQ,QAAQ,cAAc,KAAK,QAAQ,MAAM,KAC/C,YAAW,KAAK,MAAM,GAAG;AAE3B,QAAO;;AAGT,SAAS,uBAAuB,WAA0C;AACxE,QAAO,UAAU,MAAM,EAAE,MAAM,UAAU,cAAc;AAErD,UADgB,WAAW,SAAS,GAAG,aAAa,UAAU,QAAQ,GAAG,UACtD;GACnB;;AAGJ,SAAS,oBAAoB,QAAgC;CAC3D,MAAM,UAA0B,EAAE;CAClC,MAAM,QAAQ,QAAgB,QAAsB;AAClD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;GAC9C,MAAM,WAAW,WAAW,KAAK,MAAM,GAAG,OAAO,GAAG;AACpD,OAAI,UAAU,OAAW;AACzB,OAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EACtG,MAAK,UAAU,MAAM;OAErB,SAAQ,KAAK;IAAE,MAAM;IAAU;IAAO,CAAC;;;AAI7C,MAAK,IAAI,OAAO;AAChB,QAAO;;AAGT,SAAS,wBAAwB,gBAAwB,cAAsB,gBAAuC;CAEpH,MAAM,cADU,oBAAoB,aAAa,CACrB,KAAK,EAAE,MAAM,YAAY,YAAY;AAC/D,SAAO,KAAK,KAAK,UAAU,WAAW,CAAC,WAAW,KAAK,UAAU,MAAM;GACvE,CAAC,KAAK,KAAK;CACb,MAAM,iBAAiB,kBAAkB,OAAO,OAAO,mBAAmB,SAAS,gBAAgB,aAAa,CAAC;CACjH,MAAM,wBAAwB,kBAAkB,OAAO,KAAK;;;EAG5D,KAAK,UAAU,gBAAgB,MAAM,EAAE,CAAC;;AAGxC,QAAO;;eAEM,KAAK,UAAU,eAAe,CAAC;;;;;;;;;EAS5C,YAAY;EACZ,sBAAsB;;;;;;;;;AAUxB,SAAS,mBAAmB,QAAkC;CAC5D,MAAM,cAAwB,EAAE;CAChC,MAAM,aAAa,UAAU,QAAQ;EACnC,oBAAoB;EACpB,eAAe;EACf;EACD,CAAC;AACF,KAAI,YAAY,SAAS,EACvB,OAAM,IAAI,MAAM,kFAAkF,YAAY,KAAK,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG;AAE/J,QAAO;;AAGT,SAAS,aAAa,GAAY,GAAqB;AACrD,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,MAAM,QAAQ,MAAM,KAAM,QAAO,MAAM;AAC3C,KAAI,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,EAAE,EAAE;AACxC,MAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAC5E,SAAO,EAAE,OAAO,OAAO,UAAU,aAAa,OAAO,EAAE,OAAO,CAAC;;AAEjE,KAAI,OAAO,MAAM,YAAY,OAAO,MAAM,UAAU;EAClD,MAAM,WAAW,OAAO,QAAQ,EAAE;EAClC,MAAM,OAAO,IAAI,IAAI,OAAO,QAAQ,EAAE,CAAC;AACvC,MAAI,SAAS,WAAW,KAAK,KAAM,QAAO;AAC1C,SAAO,SAAS,OAAO,CAAC,KAAK,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC;;AAE9F,QAAO"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import { showOnboardingHexclaveConfigValue } from \"@hexclave/shared/dist/config-authoring\";\nimport { detectImportPackageFromDir, parseHexclaveConfigFileContent, renderConfigFileContent } from \"@hexclave/shared/dist/config-rendering\";\nimport type { Config, ConfigValue, NormalizedConfig } from \"@hexclave/shared/dist/config/format\";\nimport { isValidConfig, normalize, override } from \"@hexclave/shared/dist/config/format\";\nimport { captureError } from \"@hexclave/shared/dist/utils/errors\";\nimport { createHash } from \"crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"fs\";\nimport { createJiti } from \"jiti\";\nimport path from \"path\";\nimport { ClaudeAgentFailureError, ClaudeAgentTimeoutError, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent } from \"./config-agent\";\n\nconst jiti = createJiti(import.meta.url, { moduleCache: false });\n\nconst LOG_PREFIX = \"[Stack config updater]\";\nconst DEFAULT_AGENT_TIMEOUT_MS = 120_000;\nconst CONFIG_UPDATE_LOG_PATH_LIMIT = 40;\n\ntype ConfigModule = {\n  config?: unknown,\n};\n\ntype ConfigFileSnapshot = { path: string, content: string | null };\ntype ConfigChange = { path: string, value: ConfigValue };\n\nfunction formatConfigUpdaterErrorForLog(error: unknown): Record<string, unknown> {\n  if (error instanceof Error) {\n    return {\n      errorName: error.name,\n      errorMessage: error.message,\n      errorStack: error.stack,\n    };\n  }\n  return {\n    errorMessage: String(error),\n  };\n}\n\nfunction configUpdatePathDetailsForLog(changes: ConfigChange[]): Record<string, unknown> {\n  const paths = changes.map(({ path: configPath }) => configPath).sort();\n  return {\n    configUpdatePathCount: paths.length,\n    configUpdatePaths: paths.slice(0, CONFIG_UPDATE_LOG_PATH_LIMIT),\n    configUpdatePathsTruncated: paths.length > CONFIG_UPDATE_LOG_PATH_LIMIT,\n  };\n}\n\nfunction isConfigModule(value: unknown): value is ConfigModule {\n  return value !== null && typeof value === \"object\";\n}\n\nexport function sha256String(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nexport function resolveConfigFilePath(inputPath: string): string {\n  const resolved = path.resolve(inputPath);\n  const looksLikeConfigFile = /\\.(ts|js|mjs|cjs)$/i.test(resolved);\n  if (looksLikeConfigFile) {\n    return resolved;\n  }\n  // Prefer hexclave.config.ts, fall back to stack.config.ts, default to the new name.\n  const hexclaveCandidate = path.join(resolved, \"hexclave.config.ts\");\n  const legacyCandidate = path.join(resolved, \"stack.config.ts\");\n  if (existsSync(hexclaveCandidate)) {\n    return hexclaveCandidate;\n  }\n  if (existsSync(legacyCandidate)) {\n    return legacyCandidate;\n  }\n  return hexclaveCandidate;\n}\n\nexport function ensureConfigFileExists(configFilePath: string): void {\n  if (existsSync(configFilePath)) return;\n  mkdirSync(path.dirname(configFilePath), { recursive: true });\n  renderConfigObjectToFile(configFilePath, {});\n}\n\nexport async function readConfigObject(configFilePath: string): Promise<Config> {\n  return (await readConfigFile(configFilePath)).config;\n}\n\nexport async function readConfigFile(configFilePath: string): Promise<{ config: Config, showOnboarding: boolean }> {\n  ensureConfigFileExists(configFilePath);\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (content.trim() === \"\") {\n    return {\n      config: {},\n      showOnboarding: false,\n    };\n  }\n\n  let configModule: unknown;\n  try {\n    configModule = await jiti.import<unknown>(configFilePath);\n  } catch (error) {\n    // Capture the raw jiti/framework error for diagnostics, but don't attach it as `cause` on the thrown error:\n    // dashboard error formatting renders causes recursively, which would leak framework internals into the\n    // user-facing message we're deliberately replacing.\n    captureError(\"shared-backend/readConfigFile\", error);\n    throw new Error(\n      `Failed to load config file ${configFilePath}.`,\n    );\n  }\n  if (!isConfigModule(configModule)) {\n    throw new Error(`Invalid config in ${configFilePath}. The file must export a plain \\`config\\` object or \"show-onboarding\".`);\n  }\n\n  const config = configModule.config;\n  if (config === showOnboardingHexclaveConfigValue) {\n    return {\n      config: {},\n      showOnboarding: true,\n    };\n  }\n  if (!isValidConfig(config)) {\n    throw new Error(`Invalid config in ${configFilePath}.`);\n  }\n  return {\n    config,\n    showOnboarding: false,\n  };\n}\n\nfunction renderConfigObjectToString(configFilePath: string, config: Config): string {\n  const importPackage = detectImportPackageFromDir(path.dirname(configFilePath));\n  return renderConfigFileContent(config, importPackage);\n}\n\nfunction writeFileAtomic(configFilePath: string, content: string): void {\n  const dir = path.dirname(configFilePath);\n  mkdirSync(dir, { recursive: true });\n  const tempPath = path.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);\n  writeFileSync(tempPath, content, \"utf-8\");\n  try {\n    renameSync(tempPath, configFilePath);\n  } catch (error) {\n    try {\n      rmSync(tempPath);\n    } catch { /* best-effort cleanup */ }\n    throw error;\n  }\n}\n\nfunction renderConfigObjectToFile(configFilePath: string, config: Config): void {\n  writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));\n}\n\nexport async function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void> {\n  const startedAtMs = performance.now();\n  ensureConfigFileExists(configFilePath);\n\n  const changes = flattenConfigUpdate(configUpdate);\n  if (changes.length === 0) {\n    console.log(`${LOG_PREFIX} Skipping config update because it contains no changes`, {\n      configFilePath,\n    });\n    return;\n  }\n  const updateLogDetails = {\n    configFilePath,\n    ...configUpdatePathDetailsForLog(changes),\n  };\n  console.log(`${LOG_PREFIX} Starting config file update`, updateLogDetails);\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n\n  // Fast path: if the config is a plain static literal (no imports, no helpers),\n  // apply the update deterministically without invoking the AI agent.\n  const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);\n  if (staticConfig != null && isValidConfig(staticConfig)) {\n    console.log(`${LOG_PREFIX} Applying config update with static config rewrite`, updateLogDetails);\n    const merged = override(staticConfig, configUpdate);\n    if (!isValidConfig(merged)) {\n      throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);\n    }\n    renderConfigObjectToFile(configFilePath, merged);\n    console.log(`${LOG_PREFIX} Finished config update with static config rewrite`, {\n      ...updateLogDetails,\n      elapsedMs: Math.round(performance.now() - startedAtMs),\n    });\n    return;\n  }\n\n  // Agent path: config has custom structure (imports, helpers, external files)\n  // that must be preserved — delegate to the AI agent.\n  console.log(`${LOG_PREFIX} Applying config update with agent-assisted rewrite`, {\n    ...updateLogDetails,\n    configDirectory: path.dirname(configFilePath),\n  });\n  const baselineConfig = await tryReadConfigForValidation(configFilePath);\n  const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);\n  try {\n    await runConfigUpdateAgent({\n      prompt: buildConfigUpdatePrompt(path.basename(configFilePath), configUpdate, baselineConfig),\n      cwd: path.dirname(configFilePath),\n      onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen),\n    });\n    await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Config update failed; restoring files from snapshots`, {\n      ...updateLogDetails,\n      snapshotCount: snapshots.length,\n      elapsedMs: Math.round(performance.now() - startedAtMs),\n      ...formatConfigUpdaterErrorForLog(error),\n    });\n    try {\n      restoreConfigFiles(snapshots);\n      console.warn(`${LOG_PREFIX} Restored files after failed config update`, {\n        ...updateLogDetails,\n        snapshotCount: snapshots.length,\n      });\n    } catch (restoreError) {\n      console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {\n        configFilePath,\n        ...formatConfigUpdaterErrorForLog(restoreError),\n      });\n    }\n    throw error;\n  }\n  console.log(`${LOG_PREFIX} Finished config update with agent-assisted rewrite`, {\n    ...updateLogDetails,\n    elapsedMs: Math.round(performance.now() - startedAtMs),\n    snapshotCount: snapshots.length,\n  });\n}\n\nexport async function replaceConfigObject(configFilePath: string, config: Config): Promise<void> {\n  renderConfigObjectToFile(configFilePath, config);\n}\n\nasync function runConfigUpdateAgent(options: {\n  prompt: string,\n  cwd: string,\n  onFileWillChange?: (filePath: string) => void,\n}): Promise<void> {\n  const timeoutMs = parseAgentTimeoutMs();\n  const deniedOutOfBoundsWrites = new Set<string>();\n  const startedAtMs = performance.now();\n  console.log(`${LOG_PREFIX} Starting config update agent`, {\n    cwd: options.cwd,\n    timeoutMs,\n  });\n  try {\n    await runHeadlessClaudeAgent({\n      prompt: options.prompt,\n      cwd: options.cwd,\n      allowedTools: [\"Read\", \"Write\", \"Edit\", \"Glob\", \"Grep\"],\n      strictIsolation: true,\n      timeoutMs,\n      stderr: (data) => { console.warn(`${LOG_PREFIX} [agent] ${data}`); },\n      onPreToolUse: (input) => {\n        const target = getToolWriteTargetPath(input.tool_name, input.tool_input, options.cwd);\n        if (target == null) return { continue: true };\n        if (!isPathInsideDir(options.cwd, target)) {\n          deniedOutOfBoundsWrites.add(target);\n          return {\n            hookSpecificOutput: {\n              hookEventName: \"PreToolUse\",\n              permissionDecision: \"deny\",\n              permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`,\n            },\n          };\n        }\n        options.onFileWillChange?.(target);\n        return { continue: true };\n      },\n    });\n  } catch (error) {\n    if (error instanceof ClaudeAgentTimeoutError) {\n      console.warn(`${LOG_PREFIX} Config update agent timed out`, {\n        cwd: options.cwd,\n        timeoutMs,\n        elapsedMs: Math.round(performance.now() - startedAtMs),\n        ...formatConfigUpdaterErrorForLog(error),\n      });\n      throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);\n    }\n    if (error instanceof ClaudeAgentFailureError) {\n      console.warn(`${LOG_PREFIX} Config update agent failed`, {\n        cwd: options.cwd,\n        timeoutMs,\n        elapsedMs: Math.round(performance.now() - startedAtMs),\n        ...formatConfigUpdaterErrorForLog(error),\n      });\n      throw new Error(`${error.message} It was unable to apply the config changes to the file.`);\n    }\n    console.warn(`${LOG_PREFIX} Config update agent failed unexpectedly`, {\n      cwd: options.cwd,\n      timeoutMs,\n      elapsedMs: Math.round(performance.now() - startedAtMs),\n      ...formatConfigUpdaterErrorForLog(error),\n    });\n    throw error;\n  }\n  console.log(`${LOG_PREFIX} Finished config update agent`, {\n    cwd: options.cwd,\n    timeoutMs,\n    elapsedMs: Math.round(performance.now() - startedAtMs),\n    deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,\n  });\n  if (deniedOutOfBoundsWrites.size > 0) {\n    console.warn(`${LOG_PREFIX} Config update agent attempted out-of-bounds writes`, {\n      cwd: options.cwd,\n      deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,\n      deniedOutOfBoundsWrites: [...deniedOutOfBoundsWrites],\n    });\n    throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(\", \")}. The config was not updated.`);\n  }\n}\n\nfunction parseAgentTimeoutMs(): number {\n  const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;\n  if (raw == null || raw.trim() === \"\") return DEFAULT_AGENT_TIMEOUT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);\n  }\n  return parsed;\n}\n\nfunction captureSnapshotIfAbsent(snapshots: ConfigFileSnapshot[], filePath: string, seen: Set<string>): void {\n  const resolved = path.resolve(filePath);\n  if (seen.has(resolved)) return;\n  seen.add(resolved);\n  snapshots.push({ path: resolved, content: existsSync(resolved) ? readFileSync(resolved, \"utf-8\") : null });\n}\n\nfunction snapshotConfigFiles(configFilePath: string, configContent: string): { snapshots: ConfigFileSnapshot[]; seen: Set<string> } {\n  const dir = path.dirname(configFilePath);\n  const resolvedConfig = path.resolve(configFilePath);\n  const snapshots: ConfigFileSnapshot[] = [{ path: resolvedConfig, content: configContent }];\n  const seen = new Set<string>([resolvedConfig]);\n  for (const specifier of getRelativeImportSpecifiers(configContent)) {\n    const resolved = path.resolve(dir, specifier);\n    if (!isPathInsideDir(dir, resolved)) continue;\n    captureSnapshotIfAbsent(snapshots, resolved, seen);\n  }\n  return { snapshots, seen };\n}\n\nfunction restoreConfigFiles(snapshots: ConfigFileSnapshot[]): void {\n  const failures: string[] = [];\n  for (const { path: filePath, content } of snapshots) {\n    try {\n      if (content === null) {\n        if (existsSync(filePath)) rmSync(filePath);\n      } else {\n        writeFileSync(filePath, content, \"utf-8\");\n      }\n    } catch (error) {\n      failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n  if (failures.length > 0) {\n    throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join(\"; \")}`);\n  }\n}\n\nasync function tryReadConfigForValidation(configFilePath: string): Promise<Config | null> {\n  try {\n    return (await readConfigFile(configFilePath)).config;\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {\n      configFilePath,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return null;\n  }\n}\n\nasync function validateAgentUpdate(configFilePath: string, baselineConfig: Config | null, configUpdate: Config, snapshots: ConfigFileSnapshot[]): Promise<void> {\n  if (baselineConfig != null) {\n    const target = canonicalizeConfig(override(baselineConfig, configUpdate));\n    const result = canonicalizeConfig((await readConfigFile(configFilePath)).config);\n    if (!configsEqual(result, target)) {\n      throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);\n    }\n    return;\n  }\n\n  // Structural-only fallback: when jiti can't evaluate the config (e.g. missing\n  // runtime dependencies in import-with attributes), we can only verify that\n  // (a) something changed on disk and (b) the file still exports `config`.\n  // This cannot catch silently mis-applied values — an accepted tradeoff vs.\n  // blocking updates entirely for configs we can't evaluate.\n  // When nothing changed on disk the update is either already applied or the\n  // agent couldn't figure out what to do. Treat it as a no-op rather than a\n  // hard failure: the structural check below still verifies the file is valid.\n  if (flattenConfigUpdate(configUpdate).length > 0 && !snapshotsChangedOnDisk(snapshots)) {\n    console.warn(`${LOG_PREFIX} Agent did not modify any file for ${configFilePath}; assuming values are already up to date.`);\n  }\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (!configFileExportsConfig(content, configFilePath)) {\n    throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \\`config\\`.`);\n  }\n}\n\nfunction tryParseStaticConfigFileContent(content: string, configFilePath: string): Config | null {\n  try {\n    const parsed = parseHexclaveConfigFileContent(content, configFilePath);\n    return isValidConfig(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction configFileExportsConfig(content: string, configFilePath: string): boolean {\n  try {\n    parseHexclaveConfigFileContent(content, configFilePath);\n    return true;\n  } catch {\n    // Dynamic configs can be valid even when the static parser cannot evaluate\n    // them. For the structural fallback we only need to know that a runtime\n    // config binding still exists after the agent edited the file.\n    return /\\bexport\\s+const\\s+config\\b/.test(content);\n  }\n}\n\nfunction getRelativeImportSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n  const importPattern = /\\bimport\\b(?:[^'\"]*?\\bfrom\\s*)?[\"'](\\.{1,2}\\/[^\"']+)[\"']/g;\n  let match: RegExpExecArray | null;\n  while ((match = importPattern.exec(content)) !== null) {\n    specifiers.push(match[1]);\n  }\n  return specifiers;\n}\n\nfunction snapshotsChangedOnDisk(snapshots: ConfigFileSnapshot[]): boolean {\n  return snapshots.some(({ path: filePath, content }) => {\n    const current = existsSync(filePath) ? readFileSync(filePath, \"utf-8\") : null;\n    return current !== content;\n  });\n}\n\nfunction flattenConfigUpdate(update: Config): ConfigChange[] {\n  const changes: ConfigChange[] = [];\n  const walk = (prefix: string, obj: Config): void => {\n    for (const [key, value] of Object.entries(obj)) {\n      const fullPath = prefix === \"\" ? key : `${prefix}.${key}`;\n      if (value === undefined) continue;\n      if (value !== null && typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length > 0) {\n        walk(fullPath, value);\n      } else {\n        changes.push({ path: fullPath, value });\n      }\n    }\n  };\n  walk(\"\", update);\n  return changes;\n}\n\nfunction buildConfigUpdatePrompt(configFileName: string, configUpdate: Config, baselineConfig: Config | null): string {\n  const changes = flattenConfigUpdate(configUpdate);\n  const changeLines = changes.map(({ path: configPath, value }) => {\n    return `- ${JSON.stringify(configPath)}: set to ${JSON.stringify(value)}`;\n  }).join(\"\\n\");\n  const expectedConfig = baselineConfig == null ? null : canonicalizeConfig(override(baselineConfig, configUpdate));\n  const expectedConfigSection = expectedConfig == null ? \"\" : `\nAfter the edit, evaluating the exported \\`config\\` must produce this exact JSON value:\n\n${JSON.stringify(expectedConfig, null, 2)}\n`;\n\n  return `You are editing a Hexclave / Stack Auth configuration file in place. Apply a set of configuration changes WITHOUT changing how the file is written.\n\nConfig file: ${JSON.stringify(configFileName)} (in the current working directory).\n\nThe file exports a \\`config\\` object (it may be wrapped in a helper such as \\`defineStackConfig(...)\\`). Some config values may be sourced from other files via imports, for example:\n\n    import welcomeEmail from \"./welcome-email.tsx\" with { type: \"text\" };\n    export const config = { emails: { templates: { welcome: welcomeEmail } } };\n\nApply EXACTLY these changes. Paths use dot notation, so \\`a.b.c\\` refers to \\`config.a.b.c\\`:\n\n${changeLines}\n${expectedConfigSection}\n\nRules:\n- Change ONLY the config paths listed above. Leave every other part of the file byte-for-byte unchanged: imports, comments, formatting, helper wrappers, and any config fields not listed.\n- If a listed path's value is currently provided by an imported external file (like the \\`import ... with { type: \"text\" }\\` example above), DO NOT inline the new value into the config file. Instead, overwrite that external file with the new value and keep the import statement intact.\n- If a listed path's value is a plain inline literal, edit it inline.\n- Keep the file valid: it must still export a \\`config\\` that, once evaluated, reflects the new values exactly.\n- Do not run any shell commands and do not create files other than what is required to apply these changes.`;\n}\n\nfunction canonicalizeConfig(config: Config): NormalizedConfig {\n  const droppedKeys: string[] = [];\n  const normalized = normalize(config, {\n    onDotIntoNonObject: \"ignore\",\n    onDotIntoNull: \"empty-object\",\n    droppedKeys,\n  });\n  if (droppedKeys.length > 0) {\n    throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(\", \")}`);\n  }\n  return normalized;\n}\n\nfunction configsEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true;\n  if (a === null || b === null) return a === b;\n  if (Array.isArray(a) || Array.isArray(b)) {\n    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;\n    return a.every((value, index) => configsEqual(value, b[index]));\n  }\n  if (typeof a === \"object\" && typeof b === \"object\") {\n    const aEntries = Object.entries(a);\n    const bMap = new Map(Object.entries(b));\n    if (aEntries.length !== bMap.size) return false;\n    return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,OAAO,WAAW,OAAO,KAAK,KAAK,EAAE,aAAa,OAAO,CAAC;AAEhE,MAAM,aAAa;AACnB,MAAM,2BAA2B;AACjC,MAAM,+BAA+B;AASrC,SAAS,+BAA+B,OAAyC;AAC/E,KAAI,iBAAiB,MACnB,QAAO;EACL,WAAW,MAAM;EACjB,cAAc,MAAM;EACpB,YAAY,MAAM;EACnB;AAEH,QAAO,EACL,cAAc,OAAO,MAAM,EAC5B;;AAGH,SAAS,8BAA8B,SAAkD;CACvF,MAAM,QAAQ,QAAQ,KAAK,EAAE,MAAM,iBAAiB,WAAW,CAAC,MAAM;AACtE,QAAO;EACL,uBAAuB,MAAM;EAC7B,mBAAmB,MAAM,MAAM,GAAG,6BAA6B;EAC/D,4BAA4B,MAAM,SAAS;EAC5C;;AAGH,SAAS,eAAe,OAAuC;AAC7D,QAAO,UAAU,QAAQ,OAAO,UAAU;;AAG5C,SAAgB,aAAa,OAAuB;AAClD,QAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;AAGzD,SAAgB,sBAAsB,WAA2B;CAC/D,MAAM,WAAW,KAAK,QAAQ,UAAU;AAExC,KAD4B,sBAAsB,KAAK,SAAS,CAE9D,QAAO;CAGT,MAAM,oBAAoB,KAAK,KAAK,UAAU,qBAAqB;CACnE,MAAM,kBAAkB,KAAK,KAAK,UAAU,kBAAkB;AAC9D,KAAI,WAAW,kBAAkB,CAC/B,QAAO;AAET,KAAI,WAAW,gBAAgB,CAC7B,QAAO;AAET,QAAO;;AAGT,SAAgB,uBAAuB,gBAA8B;AACnE,KAAI,WAAW,eAAe,CAAE;AAChC,WAAU,KAAK,QAAQ,eAAe,EAAE,EAAE,WAAW,MAAM,CAAC;AAC5D,0BAAyB,gBAAgB,EAAE,CAAC;;AAG9C,eAAsB,iBAAiB,gBAAyC;AAC9E,SAAQ,MAAM,eAAe,eAAe,EAAE;;AAGhD,eAAsB,eAAe,gBAA8E;AACjH,wBAAuB,eAAe;AAEtC,KADgB,aAAa,gBAAgB,QAAQ,CACzC,MAAM,KAAK,GACrB,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;CAGH,IAAI;AACJ,KAAI;AACF,iBAAe,MAAM,KAAK,OAAgB,eAAe;UAClD,OAAO;AAId,eAAa,iCAAiC,MAAM;AACpD,QAAM,IAAI,MACR,8BAA8B,eAAe,GAC9C;;AAEH,KAAI,CAAC,eAAe,aAAa,CAC/B,OAAM,IAAI,MAAM,qBAAqB,eAAe,wEAAwE;CAG9H,MAAM,SAAS,aAAa;AAC5B,KAAI,WAAW,kCACb,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;AAEH,KAAI,CAAC,cAAc,OAAO,CACxB,OAAM,IAAI,MAAM,qBAAqB,eAAe,GAAG;AAEzD,QAAO;EACL;EACA,gBAAgB;EACjB;;AAGH,SAAS,2BAA2B,gBAAwB,QAAwB;AAElF,QAAO,wBAAwB,QADT,2BAA2B,KAAK,QAAQ,eAAe,CAAC,CACzB;;AAGvD,SAAS,gBAAgB,gBAAwB,SAAuB;CACtE,MAAM,MAAM,KAAK,QAAQ,eAAe;AACxC,WAAU,KAAK,EAAE,WAAW,MAAM,CAAC;CACnC,MAAM,WAAW,KAAK,KAAK,KAAK,iBAAiB,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM;AAC3F,eAAc,UAAU,SAAS,QAAQ;AACzC,KAAI;AACF,aAAW,UAAU,eAAe;UAC7B,OAAO;AACd,MAAI;AACF,UAAO,SAAS;UACV;AACR,QAAM;;;AAIV,SAAS,yBAAyB,gBAAwB,QAAsB;AAC9E,iBAAgB,gBAAgB,2BAA2B,gBAAgB,OAAO,CAAC;;AAGrF,eAAsB,mBAAmB,gBAAwB,cAAqC;CACpG,MAAM,cAAc,YAAY,KAAK;AACrC,wBAAuB,eAAe;CAEtC,MAAM,UAAU,oBAAoB,aAAa;AACjD,KAAI,QAAQ,WAAW,GAAG;AACxB,UAAQ,IAAI,GAAG,WAAW,yDAAyD,EACjF,gBACD,CAAC;AACF;;CAEF,MAAM,mBAAmB;EACvB;EACA,GAAG,8BAA8B,QAAQ;EAC1C;AACD,SAAQ,IAAI,GAAG,WAAW,+BAA+B,iBAAiB;CAE1E,MAAM,UAAU,aAAa,gBAAgB,QAAQ;CAIrD,MAAM,eAAe,gCAAgC,SAAS,eAAe;AAC7E,KAAI,gBAAgB,QAAQ,cAAc,aAAa,EAAE;AACvD,UAAQ,IAAI,GAAG,WAAW,qDAAqD,iBAAiB;EAChG,MAAM,SAAS,SAAS,cAAc,aAAa;AACnD,MAAI,CAAC,cAAc,OAAO,CACxB,OAAM,IAAI,MAAM,GAAG,WAAW,qDAAqD,iBAAiB;AAEtG,2BAAyB,gBAAgB,OAAO;AAChD,UAAQ,IAAI,GAAG,WAAW,qDAAqD;GAC7E,GAAG;GACH,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;GACvD,CAAC;AACF;;AAKF,SAAQ,IAAI,GAAG,WAAW,sDAAsD;EAC9E,GAAG;EACH,iBAAiB,KAAK,QAAQ,eAAe;EAC9C,CAAC;CACF,MAAM,iBAAiB,MAAM,2BAA2B,eAAe;CACvE,MAAM,EAAE,WAAW,SAAS,oBAAoB,gBAAgB,QAAQ;AACxE,KAAI;AACF,QAAM,qBAAqB;GACzB,QAAQ,wBAAwB,KAAK,SAAS,eAAe,EAAE,cAAc,eAAe;GAC5F,KAAK,KAAK,QAAQ,eAAe;GACjC,mBAAmB,aAAa,wBAAwB,WAAW,UAAU,KAAK;GACnF,CAAC;AACF,QAAM,oBAAoB,gBAAgB,gBAAgB,cAAc,UAAU;UAC3E,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,wDAAwD;GACjF,GAAG;GACH,eAAe,UAAU;GACzB,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;GACtD,GAAG,+BAA+B,MAAM;GACzC,CAAC;AACF,MAAI;AACF,sBAAmB,UAAU;AAC7B,WAAQ,KAAK,GAAG,WAAW,6CAA6C;IACtE,GAAG;IACH,eAAe,UAAU;IAC1B,CAAC;WACK,cAAc;AACrB,WAAQ,MAAM,GAAG,WAAW,mEAAmE,eAAe,yDAAyD;IACrK;IACA,GAAG,+BAA+B,aAAa;IAChD,CAAC;;AAEJ,QAAM;;AAER,SAAQ,IAAI,GAAG,WAAW,sDAAsD;EAC9E,GAAG;EACH,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;EACtD,eAAe,UAAU;EAC1B,CAAC;;AAGJ,eAAsB,oBAAoB,gBAAwB,QAA+B;AAC/F,0BAAyB,gBAAgB,OAAO;;AAGlD,eAAe,qBAAqB,SAIlB;CAChB,MAAM,YAAY,qBAAqB;CACvC,MAAM,0CAA0B,IAAI,KAAa;CACjD,MAAM,cAAc,YAAY,KAAK;AACrC,SAAQ,IAAI,GAAG,WAAW,gCAAgC;EACxD,KAAK,QAAQ;EACb;EACD,CAAC;AACF,KAAI;AACF,QAAM,uBAAuB;GAC3B,QAAQ,QAAQ;GAChB,KAAK,QAAQ;GACb,cAAc;IAAC;IAAQ;IAAS;IAAQ;IAAQ;IAAO;GACvD,iBAAiB;GACjB;GACA,SAAS,SAAS;AAAE,YAAQ,KAAK,GAAG,WAAW,WAAW,OAAO;;GACjE,eAAe,UAAU;IACvB,MAAM,SAAS,uBAAuB,MAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AACrF,QAAI,UAAU,KAAM,QAAO,EAAE,UAAU,MAAM;AAC7C,QAAI,CAAC,gBAAgB,QAAQ,KAAK,OAAO,EAAE;AACzC,6BAAwB,IAAI,OAAO;AACnC,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,oBAAoB;MACpB,0BAA0B,sBAAsB,OAAO;MACxD,EACF;;AAEH,YAAQ,mBAAmB,OAAO;AAClC,WAAO,EAAE,UAAU,MAAM;;GAE5B,CAAC;UACK,OAAO;AACd,MAAI,iBAAiB,yBAAyB;AAC5C,WAAQ,KAAK,GAAG,WAAW,iCAAiC;IAC1D,KAAK,QAAQ;IACb;IACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;IACtD,GAAG,+BAA+B,MAAM;IACzC,CAAC;AACF,SAAM,IAAI,MAAM,uCAAuC,UAAU,4DAA4D;;AAE/H,MAAI,iBAAiB,yBAAyB;AAC5C,WAAQ,KAAK,GAAG,WAAW,8BAA8B;IACvD,KAAK,QAAQ;IACb;IACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;IACtD,GAAG,+BAA+B,MAAM;IACzC,CAAC;AACF,SAAM,IAAI,MAAM,GAAG,MAAM,QAAQ,yDAAyD;;AAE5F,UAAQ,KAAK,GAAG,WAAW,2CAA2C;GACpE,KAAK,QAAQ;GACb;GACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;GACtD,GAAG,+BAA+B,MAAM;GACzC,CAAC;AACF,QAAM;;AAER,SAAQ,IAAI,GAAG,WAAW,gCAAgC;EACxD,KAAK,QAAQ;EACb;EACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;EACtD,6BAA6B,wBAAwB;EACtD,CAAC;AACF,KAAI,wBAAwB,OAAO,GAAG;AACpC,UAAQ,KAAK,GAAG,WAAW,sDAAsD;GAC/E,KAAK,QAAQ;GACb,6BAA6B,wBAAwB;GACrD,yBAAyB,CAAC,GAAG,wBAAwB;GACtD,CAAC;AACF,QAAM,IAAI,MAAM,uCAAuC,wBAAwB,KAAK,+DAA+D,CAAC,GAAG,wBAAwB,CAAC,KAAK,KAAK,CAAC,+BAA+B;;;AAI9N,SAAS,sBAA8B;CACrC,MAAM,MAAM,QAAQ,IAAI;AACxB,KAAI,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAI,QAAO;CAC7C,MAAM,SAAS,OAAO,IAAI;AAC1B,KAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACxC,OAAM,IAAI,MAAM,iDAAiD,KAAK,UAAU,IAAI,CAAC,+CAA+C;AAEtI,QAAO;;AAGT,SAAS,wBAAwB,WAAiC,UAAkB,MAAyB;CAC3G,MAAM,WAAW,KAAK,QAAQ,SAAS;AACvC,KAAI,KAAK,IAAI,SAAS,CAAE;AACxB,MAAK,IAAI,SAAS;AAClB,WAAU,KAAK;EAAE,MAAM;EAAU,SAAS,WAAW,SAAS,GAAG,aAAa,UAAU,QAAQ,GAAG;EAAM,CAAC;;AAG5G,SAAS,oBAAoB,gBAAwB,eAA+E;CAClI,MAAM,MAAM,KAAK,QAAQ,eAAe;CACxC,MAAM,iBAAiB,KAAK,QAAQ,eAAe;CACnD,MAAM,YAAkC,CAAC;EAAE,MAAM;EAAgB,SAAS;EAAe,CAAC;CAC1F,MAAM,OAAO,IAAI,IAAY,CAAC,eAAe,CAAC;AAC9C,MAAK,MAAM,aAAa,4BAA4B,cAAc,EAAE;EAClE,MAAM,WAAW,KAAK,QAAQ,KAAK,UAAU;AAC7C,MAAI,CAAC,gBAAgB,KAAK,SAAS,CAAE;AACrC,0BAAwB,WAAW,UAAU,KAAK;;AAEpD,QAAO;EAAE;EAAW;EAAM;;AAG5B,SAAS,mBAAmB,WAAuC;CACjE,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,EAAE,MAAM,UAAU,aAAa,UACxC,KAAI;AACF,MAAI,YAAY,MACd;OAAI,WAAW,SAAS,CAAE,QAAO,SAAS;QAE1C,eAAc,UAAU,SAAS,QAAQ;UAEpC,OAAO;AACd,WAAS,KAAK,GAAG,SAAS,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAAG;;AAG3F,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,MAAM,qBAAqB,SAAS,OAAO,4BAA4B,SAAS,KAAK,KAAK,GAAG;;AAI3G,eAAe,2BAA2B,gBAAgD;AACxF,KAAI;AACF,UAAQ,MAAM,eAAe,eAAe,EAAE;UACvC,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,2FAA2F;GACpH;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC9D,CAAC;AACF,SAAO;;;AAIX,eAAe,oBAAoB,gBAAwB,gBAA+B,cAAsB,WAAgD;AAC9J,KAAI,kBAAkB,MAAM;EAC1B,MAAM,SAAS,mBAAmB,SAAS,gBAAgB,aAAa,CAAC;AAEzE,MAAI,CAAC,aADU,oBAAoB,MAAM,eAAe,eAAe,EAAE,OAAO,EACtD,OAAO,CAC/B,OAAM,IAAI,MAAM,uCAAuC,eAAe,qEAAqE;AAE7I;;AAWF,KAAI,oBAAoB,aAAa,CAAC,SAAS,KAAK,CAAC,uBAAuB,UAAU,CACpF,SAAQ,KAAK,GAAG,WAAW,qCAAqC,eAAe,2CAA2C;AAI5H,KAAI,CAAC,wBADW,aAAa,gBAAgB,QAAQ,EACf,eAAe,CACnD,OAAM,IAAI,MAAM,uCAAuC,eAAe,0DAA0D;;AAIpI,SAAS,gCAAgC,SAAiB,gBAAuC;AAC/F,KAAI;EACF,MAAM,SAAS,+BAA+B,SAAS,eAAe;AACtE,SAAO,cAAc,OAAO,GAAG,SAAS;SAClC;AACN,SAAO;;;AAIX,SAAS,wBAAwB,SAAiB,gBAAiC;AACjF,KAAI;AACF,iCAA+B,SAAS,eAAe;AACvD,SAAO;SACD;AAIN,SAAO,8BAA8B,KAAK,QAAQ;;;AAItD,SAAS,4BAA4B,SAA2B;CAC9D,MAAM,aAAuB,EAAE;CAC/B,MAAM,gBAAgB;CACtB,IAAI;AACJ,SAAQ,QAAQ,cAAc,KAAK,QAAQ,MAAM,KAC/C,YAAW,KAAK,MAAM,GAAG;AAE3B,QAAO;;AAGT,SAAS,uBAAuB,WAA0C;AACxE,QAAO,UAAU,MAAM,EAAE,MAAM,UAAU,cAAc;AAErD,UADgB,WAAW,SAAS,GAAG,aAAa,UAAU,QAAQ,GAAG,UACtD;GACnB;;AAGJ,SAAS,oBAAoB,QAAgC;CAC3D,MAAM,UAA0B,EAAE;CAClC,MAAM,QAAQ,QAAgB,QAAsB;AAClD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;GAC9C,MAAM,WAAW,WAAW,KAAK,MAAM,GAAG,OAAO,GAAG;AACpD,OAAI,UAAU,OAAW;AACzB,OAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EACtG,MAAK,UAAU,MAAM;OAErB,SAAQ,KAAK;IAAE,MAAM;IAAU;IAAO,CAAC;;;AAI7C,MAAK,IAAI,OAAO;AAChB,QAAO;;AAGT,SAAS,wBAAwB,gBAAwB,cAAsB,gBAAuC;CAEpH,MAAM,cADU,oBAAoB,aAAa,CACrB,KAAK,EAAE,MAAM,YAAY,YAAY;AAC/D,SAAO,KAAK,KAAK,UAAU,WAAW,CAAC,WAAW,KAAK,UAAU,MAAM;GACvE,CAAC,KAAK,KAAK;CACb,MAAM,iBAAiB,kBAAkB,OAAO,OAAO,mBAAmB,SAAS,gBAAgB,aAAa,CAAC;CACjH,MAAM,wBAAwB,kBAAkB,OAAO,KAAK;;;EAG5D,KAAK,UAAU,gBAAgB,MAAM,EAAE,CAAC;;AAGxC,QAAO;;eAEM,KAAK,UAAU,eAAe,CAAC;;;;;;;;;EAS5C,YAAY;EACZ,sBAAsB;;;;;;;;;AAUxB,SAAS,mBAAmB,QAAkC;CAC5D,MAAM,cAAwB,EAAE;CAChC,MAAM,aAAa,UAAU,QAAQ;EACnC,oBAAoB;EACpB,eAAe;EACf;EACD,CAAC;AACF,KAAI,YAAY,SAAS,EACvB,OAAM,IAAI,MAAM,kFAAkF,YAAY,KAAK,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG;AAE/J,QAAO;;AAGT,SAAS,aAAa,GAAY,GAAqB;AACrD,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,MAAM,QAAQ,MAAM,KAAM,QAAO,MAAM;AAC3C,KAAI,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,EAAE,EAAE;AACxC,MAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAC5E,SAAO,EAAE,OAAO,OAAO,UAAU,aAAa,OAAO,EAAE,OAAO,CAAC;;AAEjE,KAAI,OAAO,MAAM,YAAY,OAAO,MAAM,UAAU;EAClD,MAAM,WAAW,OAAO,QAAQ,EAAE;EAClC,MAAM,OAAO,IAAI,IAAI,OAAO,QAAQ,EAAE,CAAC;AACvC,MAAI,SAAS,WAAW,KAAK,KAAM,QAAO;AAC1C,SAAO,SAAS,OAAO,CAAC,KAAK,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC;;AAE9F,QAAO"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;iBA2BgB,YAAA,CAAa,KAAA;AAAA,iBAIb,qBAAA,CAAsB,SAAA;AAAA,iBAkBtB,sBAAA,CAAuB,cAAA;AAAA,iBAMjB,gBAAA,CAAiB,cAAA,WAAyB,OAAA,CAAQ,MAAA;AAAA,iBAIlD,cAAA,CAAe,cAAA,WAAyB,OAAA;EAAU,MAAA,EAAQ,MAAA;EAAQ,cAAA;AAAA;AAAA,iBAkElE,kBAAA,CAAmB,cAAA,UAAwB,YAAA,EAAc,MAAA,GAAS,OAAA;AAAA,iBA2ClE,mBAAA,CAAoB,cAAA,UAAwB,MAAA,EAAQ,MAAA,GAAS,OAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;iBAkDgB,YAAA,CAAa,KAAA;AAAA,iBAIb,qBAAA,CAAsB,SAAA;AAAA,iBAkBtB,sBAAA,CAAuB,cAAA;AAAA,iBAMjB,gBAAA,CAAiB,cAAA,WAAyB,OAAA,CAAQ,MAAA;AAAA,iBAIlD,cAAA,CAAe,cAAA,WAAyB,OAAA;EAAU,MAAA,EAAQ,MAAA;EAAQ,cAAA;AAAA;AAAA,iBAkElE,kBAAA,CAAmB,cAAA,UAAwB,YAAA,EAAc,MAAA,GAAS,OAAA;AAAA,iBA+ElE,mBAAA,CAAoB,cAAA,UAAwB,MAAA,EAAQ,MAAA,GAAS,OAAA"}

package/dist/index.js

@@ -15,6 +15,23 @@ let __config_agent_js = require("./config-agent.js");
 const jiti$1 = (0, jiti.createJiti)(require("url").pathToFileURL(__filename).href, { moduleCache: false });
 const LOG_PREFIX = "[Stack config updater]";
 const DEFAULT_AGENT_TIMEOUT_MS = 12e4;
+const CONFIG_UPDATE_LOG_PATH_LIMIT = 40;
+function formatConfigUpdaterErrorForLog(error) {
+	if (error instanceof Error) return {
+		errorName: error.name,
+		errorMessage: error.message,
+		errorStack: error.stack
+	};
+	return { errorMessage: String(error) };
+}
+function configUpdatePathDetailsForLog(changes) {
+	const paths = changes.map(({ path: configPath }) => configPath).sort();
+	return {
+		configUpdatePathCount: paths.length,
+		configUpdatePaths: paths.slice(0, CONFIG_UPDATE_LOG_PATH_LIMIT),
+		configUpdatePathsTruncated: paths.length > CONFIG_UPDATE_LOG_PATH_LIMIT
+	};
+}
 function isConfigModule(value) {
 	return value !== null && typeof value === "object";
 }
@@ -84,16 +101,35 @@ function renderConfigObjectToFile(configFilePath, config) {
 	writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));
 }
 async function updateConfigObject(configFilePath, configUpdate) {
+	const startedAtMs = performance.now();
 	ensureConfigFileExists(configFilePath);
-	if (flattenConfigUpdate(configUpdate).length === 0) return;
+	const changes = flattenConfigUpdate(configUpdate);
+	if (changes.length === 0) {
+		console.log(`${LOG_PREFIX} Skipping config update because it contains no changes`, { configFilePath });
+		return;
+	}
+	const updateLogDetails = {
+		configFilePath,
+		...configUpdatePathDetailsForLog(changes)
+	};
+	console.log(`${LOG_PREFIX} Starting config file update`, updateLogDetails);
 	const content = (0, fs.readFileSync)(configFilePath, "utf-8");
 	const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);
 	if (staticConfig != null && (0, _hexclave_shared_dist_config_format.isValidConfig)(staticConfig)) {
+		console.log(`${LOG_PREFIX} Applying config update with static config rewrite`, updateLogDetails);
 		const merged = (0, _hexclave_shared_dist_config_format.override)(staticConfig, configUpdate);
 		if (!(0, _hexclave_shared_dist_config_format.isValidConfig)(merged)) throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);
 		renderConfigObjectToFile(configFilePath, merged);
+		console.log(`${LOG_PREFIX} Finished config update with static config rewrite`, {
+			...updateLogDetails,
+			elapsedMs: Math.round(performance.now() - startedAtMs)
+		});
 		return;
 	}
+	console.log(`${LOG_PREFIX} Applying config update with agent-assisted rewrite`, {
+		...updateLogDetails,
+		configDirectory: path.default.dirname(configFilePath)
+	});
 	const baselineConfig = await tryReadConfigForValidation(configFilePath);
 	const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);
 	try {
@@ -104,16 +140,31 @@ async function updateConfigObject(configFilePath, configUpdate) {
 		});
 		await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);
 	} catch (error) {
+		console.warn(`${LOG_PREFIX} Config update failed; restoring files from snapshots`, {
+			...updateLogDetails,
+			snapshotCount: snapshots.length,
+			elapsedMs: Math.round(performance.now() - startedAtMs),
+			...formatConfigUpdaterErrorForLog(error)
+		});
 		try {
 			restoreConfigFiles(snapshots);
+			console.warn(`${LOG_PREFIX} Restored files after failed config update`, {
+				...updateLogDetails,
+				snapshotCount: snapshots.length
+			});
 		} catch (restoreError) {
 			console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {
 				configFilePath,
-				restoreError: restoreError instanceof Error ? restoreError.message : String(restoreError)
+				...formatConfigUpdaterErrorForLog(restoreError)
 			});
 		}
 		throw error;
 	}
+	console.log(`${LOG_PREFIX} Finished config update with agent-assisted rewrite`, {
+		...updateLogDetails,
+		elapsedMs: Math.round(performance.now() - startedAtMs),
+		snapshotCount: snapshots.length
+	});
 }
 async function replaceConfigObject(configFilePath, config) {
 	renderConfigObjectToFile(configFilePath, config);
@@ -121,6 +172,11 @@ async function replaceConfigObject(configFilePath, config) {
 async function runConfigUpdateAgent(options) {
 	const timeoutMs = parseAgentTimeoutMs();
 	const deniedOutOfBoundsWrites = /* @__PURE__ */ new Set();
+	const startedAtMs = performance.now();
+	console.log(`${LOG_PREFIX} Starting config update agent`, {
+		cwd: options.cwd,
+		timeoutMs
+	});
 	try {
 		await (0, __config_agent_js.runHeadlessClaudeAgent)({
 			prompt: options.prompt,
@@ -153,11 +209,46 @@ async function runConfigUpdateAgent(options) {
 			}
 		});
 	} catch (error) {
-		if (error instanceof __config_agent_js.ClaudeAgentTimeoutError) throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);
-		if (error instanceof __config_agent_js.ClaudeAgentFailureError) throw new Error(`${error.message} It was unable to apply the config changes to the file.`);
+		if (error instanceof __config_agent_js.ClaudeAgentTimeoutError) {
+			console.warn(`${LOG_PREFIX} Config update agent timed out`, {
+				cwd: options.cwd,
+				timeoutMs,
+				elapsedMs: Math.round(performance.now() - startedAtMs),
+				...formatConfigUpdaterErrorForLog(error)
+			});
+			throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);
+		}
+		if (error instanceof __config_agent_js.ClaudeAgentFailureError) {
+			console.warn(`${LOG_PREFIX} Config update agent failed`, {
+				cwd: options.cwd,
+				timeoutMs,
+				elapsedMs: Math.round(performance.now() - startedAtMs),
+				...formatConfigUpdaterErrorForLog(error)
+			});
+			throw new Error(`${error.message} It was unable to apply the config changes to the file.`);
+		}
+		console.warn(`${LOG_PREFIX} Config update agent failed unexpectedly`, {
+			cwd: options.cwd,
+			timeoutMs,
+			elapsedMs: Math.round(performance.now() - startedAtMs),
+			...formatConfigUpdaterErrorForLog(error)
+		});
 		throw error;
 	}
-	if (deniedOutOfBoundsWrites.size > 0) throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(", ")}. The config was not updated.`);
+	console.log(`${LOG_PREFIX} Finished config update agent`, {
+		cwd: options.cwd,
+		timeoutMs,
+		elapsedMs: Math.round(performance.now() - startedAtMs),
+		deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size
+	});
+	if (deniedOutOfBoundsWrites.size > 0) {
+		console.warn(`${LOG_PREFIX} Config update agent attempted out-of-bounds writes`, {
+			cwd: options.cwd,
+			deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,
+			deniedOutOfBoundsWrites: [...deniedOutOfBoundsWrites]
+		});
+		throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(", ")}. The config was not updated.`);
+	}
 }
 function parseAgentTimeoutMs() {
 	const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["jiti","showOnboardingHexclaveConfigValue","ClaudeAgentTimeoutError","ClaudeAgentFailureError"],"sources":["../src/index.ts"],"sourcesContent":["import { showOnboardingHexclaveConfigValue } from \"@hexclave/shared/dist/config-authoring\";\nimport { detectImportPackageFromDir, parseHexclaveConfigFileContent, renderConfigFileContent } from \"@hexclave/shared/dist/config-rendering\";\nimport type { Config, ConfigValue, NormalizedConfig } from \"@hexclave/shared/dist/config/format\";\nimport { isValidConfig, normalize, override } from \"@hexclave/shared/dist/config/format\";\nimport { captureError } from \"@hexclave/shared/dist/utils/errors\";\nimport { createHash } from \"crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"fs\";\nimport { createJiti } from \"jiti\";\nimport path from \"path\";\nimport { ClaudeAgentFailureError, ClaudeAgentTimeoutError, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent } from \"./config-agent\";\n\nconst jiti = createJiti(import.meta.url, { moduleCache: false });\n\nconst LOG_PREFIX = \"[Stack config updater]\";\nconst DEFAULT_AGENT_TIMEOUT_MS = 120_000;\n\ntype ConfigModule = {\n  config?: unknown,\n};\n\ntype ConfigFileSnapshot = { path: string, content: string | null };\ntype ConfigChange = { path: string, value: ConfigValue };\n\nfunction isConfigModule(value: unknown): value is ConfigModule {\n  return value !== null && typeof value === \"object\";\n}\n\nexport function sha256String(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nexport function resolveConfigFilePath(inputPath: string): string {\n  const resolved = path.resolve(inputPath);\n  const looksLikeConfigFile = /\\.(ts|js|mjs|cjs)$/i.test(resolved);\n  if (looksLikeConfigFile) {\n    return resolved;\n  }\n  // Prefer hexclave.config.ts, fall back to stack.config.ts, default to the new name.\n  const hexclaveCandidate = path.join(resolved, \"hexclave.config.ts\");\n  const legacyCandidate = path.join(resolved, \"stack.config.ts\");\n  if (existsSync(hexclaveCandidate)) {\n    return hexclaveCandidate;\n  }\n  if (existsSync(legacyCandidate)) {\n    return legacyCandidate;\n  }\n  return hexclaveCandidate;\n}\n\nexport function ensureConfigFileExists(configFilePath: string): void {\n  if (existsSync(configFilePath)) return;\n  mkdirSync(path.dirname(configFilePath), { recursive: true });\n  renderConfigObjectToFile(configFilePath, {});\n}\n\nexport async function readConfigObject(configFilePath: string): Promise<Config> {\n  return (await readConfigFile(configFilePath)).config;\n}\n\nexport async function readConfigFile(configFilePath: string): Promise<{ config: Config, showOnboarding: boolean }> {\n  ensureConfigFileExists(configFilePath);\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (content.trim() === \"\") {\n    return {\n      config: {},\n      showOnboarding: false,\n    };\n  }\n\n  let configModule: unknown;\n  try {\n    configModule = await jiti.import<unknown>(configFilePath);\n  } catch (error) {\n    // Capture the raw jiti/framework error for diagnostics, but don't attach it as `cause` on the thrown error:\n    // dashboard error formatting renders causes recursively, which would leak framework internals into the\n    // user-facing message we're deliberately replacing.\n    captureError(\"shared-backend/readConfigFile\", error);\n    throw new Error(\n      `Failed to load config file ${configFilePath}.`,\n    );\n  }\n  if (!isConfigModule(configModule)) {\n    throw new Error(`Invalid config in ${configFilePath}. The file must export a plain \\`config\\` object or \"show-onboarding\".`);\n  }\n\n  const config = configModule.config;\n  if (config === showOnboardingHexclaveConfigValue) {\n    return {\n      config: {},\n      showOnboarding: true,\n    };\n  }\n  if (!isValidConfig(config)) {\n    throw new Error(`Invalid config in ${configFilePath}.`);\n  }\n  return {\n    config,\n    showOnboarding: false,\n  };\n}\n\nfunction renderConfigObjectToString(configFilePath: string, config: Config): string {\n  const importPackage = detectImportPackageFromDir(path.dirname(configFilePath));\n  return renderConfigFileContent(config, importPackage);\n}\n\nfunction writeFileAtomic(configFilePath: string, content: string): void {\n  const dir = path.dirname(configFilePath);\n  mkdirSync(dir, { recursive: true });\n  const tempPath = path.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);\n  writeFileSync(tempPath, content, \"utf-8\");\n  try {\n    renameSync(tempPath, configFilePath);\n  } catch (error) {\n    try {\n      rmSync(tempPath);\n    } catch { /* best-effort cleanup */ }\n    throw error;\n  }\n}\n\nfunction renderConfigObjectToFile(configFilePath: string, config: Config): void {\n  writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));\n}\n\nexport async function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void> {\n  ensureConfigFileExists(configFilePath);\n\n  if (flattenConfigUpdate(configUpdate).length === 0) return;\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n\n  // Fast path: if the config is a plain static literal (no imports, no helpers),\n  // apply the update deterministically without invoking the AI agent.\n  const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);\n  if (staticConfig != null && isValidConfig(staticConfig)) {\n    const merged = override(staticConfig, configUpdate);\n    if (!isValidConfig(merged)) {\n      throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);\n    }\n    renderConfigObjectToFile(configFilePath, merged);\n    return;\n  }\n\n  // Agent path: config has custom structure (imports, helpers, external files)\n  // that must be preserved — delegate to the AI agent.\n  const baselineConfig = await tryReadConfigForValidation(configFilePath);\n  const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);\n  try {\n    await runConfigUpdateAgent({\n      prompt: buildConfigUpdatePrompt(path.basename(configFilePath), configUpdate, baselineConfig),\n      cwd: path.dirname(configFilePath),\n      onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen),\n    });\n    await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);\n  } catch (error) {\n    try {\n      restoreConfigFiles(snapshots);\n    } catch (restoreError) {\n      console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {\n        configFilePath,\n        restoreError: restoreError instanceof Error ? restoreError.message : String(restoreError),\n      });\n    }\n    throw error;\n  }\n}\n\nexport async function replaceConfigObject(configFilePath: string, config: Config): Promise<void> {\n  renderConfigObjectToFile(configFilePath, config);\n}\n\nasync function runConfigUpdateAgent(options: {\n  prompt: string,\n  cwd: string,\n  onFileWillChange?: (filePath: string) => void,\n}): Promise<void> {\n  const timeoutMs = parseAgentTimeoutMs();\n  const deniedOutOfBoundsWrites = new Set<string>();\n  try {\n    await runHeadlessClaudeAgent({\n      prompt: options.prompt,\n      cwd: options.cwd,\n      allowedTools: [\"Read\", \"Write\", \"Edit\", \"Glob\", \"Grep\"],\n      strictIsolation: true,\n      timeoutMs,\n      stderr: (data) => { console.warn(`${LOG_PREFIX} [agent] ${data}`); },\n      onPreToolUse: (input) => {\n        const target = getToolWriteTargetPath(input.tool_name, input.tool_input, options.cwd);\n        if (target == null) return { continue: true };\n        if (!isPathInsideDir(options.cwd, target)) {\n          deniedOutOfBoundsWrites.add(target);\n          return {\n            hookSpecificOutput: {\n              hookEventName: \"PreToolUse\",\n              permissionDecision: \"deny\",\n              permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`,\n            },\n          };\n        }\n        options.onFileWillChange?.(target);\n        return { continue: true };\n      },\n    });\n  } catch (error) {\n    if (error instanceof ClaudeAgentTimeoutError) {\n      throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);\n    }\n    if (error instanceof ClaudeAgentFailureError) {\n      throw new Error(`${error.message} It was unable to apply the config changes to the file.`);\n    }\n    throw error;\n  }\n  if (deniedOutOfBoundsWrites.size > 0) {\n    throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(\", \")}. The config was not updated.`);\n  }\n}\n\nfunction parseAgentTimeoutMs(): number {\n  const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;\n  if (raw == null || raw.trim() === \"\") return DEFAULT_AGENT_TIMEOUT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);\n  }\n  return parsed;\n}\n\nfunction captureSnapshotIfAbsent(snapshots: ConfigFileSnapshot[], filePath: string, seen: Set<string>): void {\n  const resolved = path.resolve(filePath);\n  if (seen.has(resolved)) return;\n  seen.add(resolved);\n  snapshots.push({ path: resolved, content: existsSync(resolved) ? readFileSync(resolved, \"utf-8\") : null });\n}\n\nfunction snapshotConfigFiles(configFilePath: string, configContent: string): { snapshots: ConfigFileSnapshot[]; seen: Set<string> } {\n  const dir = path.dirname(configFilePath);\n  const resolvedConfig = path.resolve(configFilePath);\n  const snapshots: ConfigFileSnapshot[] = [{ path: resolvedConfig, content: configContent }];\n  const seen = new Set<string>([resolvedConfig]);\n  for (const specifier of getRelativeImportSpecifiers(configContent)) {\n    const resolved = path.resolve(dir, specifier);\n    if (!isPathInsideDir(dir, resolved)) continue;\n    captureSnapshotIfAbsent(snapshots, resolved, seen);\n  }\n  return { snapshots, seen };\n}\n\nfunction restoreConfigFiles(snapshots: ConfigFileSnapshot[]): void {\n  const failures: string[] = [];\n  for (const { path: filePath, content } of snapshots) {\n    try {\n      if (content === null) {\n        if (existsSync(filePath)) rmSync(filePath);\n      } else {\n        writeFileSync(filePath, content, \"utf-8\");\n      }\n    } catch (error) {\n      failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n  if (failures.length > 0) {\n    throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join(\"; \")}`);\n  }\n}\n\nasync function tryReadConfigForValidation(configFilePath: string): Promise<Config | null> {\n  try {\n    return (await readConfigFile(configFilePath)).config;\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {\n      configFilePath,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return null;\n  }\n}\n\nasync function validateAgentUpdate(configFilePath: string, baselineConfig: Config | null, configUpdate: Config, snapshots: ConfigFileSnapshot[]): Promise<void> {\n  if (baselineConfig != null) {\n    const target = canonicalizeConfig(override(baselineConfig, configUpdate));\n    const result = canonicalizeConfig((await readConfigFile(configFilePath)).config);\n    if (!configsEqual(result, target)) {\n      throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);\n    }\n    return;\n  }\n\n  // Structural-only fallback: when jiti can't evaluate the config (e.g. missing\n  // runtime dependencies in import-with attributes), we can only verify that\n  // (a) something changed on disk and (b) the file still exports `config`.\n  // This cannot catch silently mis-applied values — an accepted tradeoff vs.\n  // blocking updates entirely for configs we can't evaluate.\n  // When nothing changed on disk the update is either already applied or the\n  // agent couldn't figure out what to do. Treat it as a no-op rather than a\n  // hard failure: the structural check below still verifies the file is valid.\n  if (flattenConfigUpdate(configUpdate).length > 0 && !snapshotsChangedOnDisk(snapshots)) {\n    console.warn(`${LOG_PREFIX} Agent did not modify any file for ${configFilePath}; assuming values are already up to date.`);\n  }\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (!configFileExportsConfig(content, configFilePath)) {\n    throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \\`config\\`.`);\n  }\n}\n\nfunction tryParseStaticConfigFileContent(content: string, configFilePath: string): Config | null {\n  try {\n    const parsed = parseHexclaveConfigFileContent(content, configFilePath);\n    return isValidConfig(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction configFileExportsConfig(content: string, configFilePath: string): boolean {\n  try {\n    parseHexclaveConfigFileContent(content, configFilePath);\n    return true;\n  } catch {\n    // Dynamic configs can be valid even when the static parser cannot evaluate\n    // them. For the structural fallback we only need to know that a runtime\n    // config binding still exists after the agent edited the file.\n    return /\\bexport\\s+const\\s+config\\b/.test(content);\n  }\n}\n\nfunction getRelativeImportSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n  const importPattern = /\\bimport\\b(?:[^'\"]*?\\bfrom\\s*)?[\"'](\\.{1,2}\\/[^\"']+)[\"']/g;\n  let match: RegExpExecArray | null;\n  while ((match = importPattern.exec(content)) !== null) {\n    specifiers.push(match[1]);\n  }\n  return specifiers;\n}\n\nfunction snapshotsChangedOnDisk(snapshots: ConfigFileSnapshot[]): boolean {\n  return snapshots.some(({ path: filePath, content }) => {\n    const current = existsSync(filePath) ? readFileSync(filePath, \"utf-8\") : null;\n    return current !== content;\n  });\n}\n\nfunction flattenConfigUpdate(update: Config): ConfigChange[] {\n  const changes: ConfigChange[] = [];\n  const walk = (prefix: string, obj: Config): void => {\n    for (const [key, value] of Object.entries(obj)) {\n      const fullPath = prefix === \"\" ? key : `${prefix}.${key}`;\n      if (value === undefined) continue;\n      if (value !== null && typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length > 0) {\n        walk(fullPath, value);\n      } else {\n        changes.push({ path: fullPath, value });\n      }\n    }\n  };\n  walk(\"\", update);\n  return changes;\n}\n\nfunction buildConfigUpdatePrompt(configFileName: string, configUpdate: Config, baselineConfig: Config | null): string {\n  const changes = flattenConfigUpdate(configUpdate);\n  const changeLines = changes.map(({ path: configPath, value }) => {\n    return `- ${JSON.stringify(configPath)}: set to ${JSON.stringify(value)}`;\n  }).join(\"\\n\");\n  const expectedConfig = baselineConfig == null ? null : canonicalizeConfig(override(baselineConfig, configUpdate));\n  const expectedConfigSection = expectedConfig == null ? \"\" : `\nAfter the edit, evaluating the exported \\`config\\` must produce this exact JSON value:\n\n${JSON.stringify(expectedConfig, null, 2)}\n`;\n\n  return `You are editing a Hexclave / Stack Auth configuration file in place. Apply a set of configuration changes WITHOUT changing how the file is written.\n\nConfig file: ${JSON.stringify(configFileName)} (in the current working directory).\n\nThe file exports a \\`config\\` object (it may be wrapped in a helper such as \\`defineStackConfig(...)\\`). Some config values may be sourced from other files via imports, for example:\n\n    import welcomeEmail from \"./welcome-email.tsx\" with { type: \"text\" };\n    export const config = { emails: { templates: { welcome: welcomeEmail } } };\n\nApply EXACTLY these changes. Paths use dot notation, so \\`a.b.c\\` refers to \\`config.a.b.c\\`:\n\n${changeLines}\n${expectedConfigSection}\n\nRules:\n- Change ONLY the config paths listed above. Leave every other part of the file byte-for-byte unchanged: imports, comments, formatting, helper wrappers, and any config fields not listed.\n- If a listed path's value is currently provided by an imported external file (like the \\`import ... with { type: \"text\" }\\` example above), DO NOT inline the new value into the config file. Instead, overwrite that external file with the new value and keep the import statement intact.\n- If a listed path's value is a plain inline literal, edit it inline.\n- Keep the file valid: it must still export a \\`config\\` that, once evaluated, reflects the new values exactly.\n- Do not run any shell commands and do not create files other than what is required to apply these changes.`;\n}\n\nfunction canonicalizeConfig(config: Config): NormalizedConfig {\n  const droppedKeys: string[] = [];\n  const normalized = normalize(config, {\n    onDotIntoNonObject: \"ignore\",\n    onDotIntoNull: \"empty-object\",\n    droppedKeys,\n  });\n  if (droppedKeys.length > 0) {\n    throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(\", \")}`);\n  }\n  return normalized;\n}\n\nfunction configsEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true;\n  if (a === null || b === null) return a === b;\n  if (Array.isArray(a) || Array.isArray(b)) {\n    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;\n    return a.every((value, index) => configsEqual(value, b[index]));\n  }\n  if (typeof a === \"object\" && typeof b === \"object\") {\n    const aEntries = Object.entries(a);\n    const bMap = new Map(Object.entries(b));\n    if (aEntries.length !== bMap.size) return false;\n    return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;AAWA,MAAMA,6EAAmC,EAAE,aAAa,OAAO,CAAC;AAEhE,MAAM,aAAa;AACnB,MAAM,2BAA2B;AASjC,SAAS,eAAe,OAAuC;AAC7D,QAAO,UAAU,QAAQ,OAAO,UAAU;;AAG5C,SAAgB,aAAa,OAAuB;AAClD,+BAAkB,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;AAGzD,SAAgB,sBAAsB,WAA2B;CAC/D,MAAM,WAAW,aAAK,QAAQ,UAAU;AAExC,KAD4B,sBAAsB,KAAK,SAAS,CAE9D,QAAO;CAGT,MAAM,oBAAoB,aAAK,KAAK,UAAU,qBAAqB;CACnE,MAAM,kBAAkB,aAAK,KAAK,UAAU,kBAAkB;AAC9D,wBAAe,kBAAkB,CAC/B,QAAO;AAET,wBAAe,gBAAgB,CAC7B,QAAO;AAET,QAAO;;AAGT,SAAgB,uBAAuB,gBAA8B;AACnE,wBAAe,eAAe,CAAE;AAChC,mBAAU,aAAK,QAAQ,eAAe,EAAE,EAAE,WAAW,MAAM,CAAC;AAC5D,0BAAyB,gBAAgB,EAAE,CAAC;;AAG9C,eAAsB,iBAAiB,gBAAyC;AAC9E,SAAQ,MAAM,eAAe,eAAe,EAAE;;AAGhD,eAAsB,eAAe,gBAA8E;AACjH,wBAAuB,eAAe;AAEtC,0BAD6B,gBAAgB,QAAQ,CACzC,MAAM,KAAK,GACrB,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;CAGH,IAAI;AACJ,KAAI;AACF,iBAAe,MAAMA,OAAK,OAAgB,eAAe;UAClD,OAAO;AAId,uDAAa,iCAAiC,MAAM;AACpD,QAAM,IAAI,MACR,8BAA8B,eAAe,GAC9C;;AAEH,KAAI,CAAC,eAAe,aAAa,CAC/B,OAAM,IAAI,MAAM,qBAAqB,eAAe,wEAAwE;CAG9H,MAAM,SAAS,aAAa;AAC5B,KAAI,WAAWC,yEACb,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;AAEH,KAAI,wDAAe,OAAO,CACxB,OAAM,IAAI,MAAM,qBAAqB,eAAe,GAAG;AAEzD,QAAO;EACL;EACA,gBAAgB;EACjB;;AAGH,SAAS,2BAA2B,gBAAwB,QAAwB;AAElF,4EAA+B,+EADkB,aAAK,QAAQ,eAAe,CAAC,CACzB;;AAGvD,SAAS,gBAAgB,gBAAwB,SAAuB;CACtE,MAAM,MAAM,aAAK,QAAQ,eAAe;AACxC,mBAAU,KAAK,EAAE,WAAW,MAAM,CAAC;CACnC,MAAM,WAAW,aAAK,KAAK,KAAK,iBAAiB,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM;AAC3F,uBAAc,UAAU,SAAS,QAAQ;AACzC,KAAI;AACF,qBAAW,UAAU,eAAe;UAC7B,OAAO;AACd,MAAI;AACF,kBAAO,SAAS;UACV;AACR,QAAM;;;AAIV,SAAS,yBAAyB,gBAAwB,QAAsB;AAC9E,iBAAgB,gBAAgB,2BAA2B,gBAAgB,OAAO,CAAC;;AAGrF,eAAsB,mBAAmB,gBAAwB,cAAqC;AACpG,wBAAuB,eAAe;AAEtC,KAAI,oBAAoB,aAAa,CAAC,WAAW,EAAG;CAEpD,MAAM,+BAAuB,gBAAgB,QAAQ;CAIrD,MAAM,eAAe,gCAAgC,SAAS,eAAe;AAC7E,KAAI,gBAAgB,+DAAsB,aAAa,EAAE;EACvD,MAAM,2DAAkB,cAAc,aAAa;AACnD,MAAI,wDAAe,OAAO,CACxB,OAAM,IAAI,MAAM,GAAG,WAAW,qDAAqD,iBAAiB;AAEtG,2BAAyB,gBAAgB,OAAO;AAChD;;CAKF,MAAM,iBAAiB,MAAM,2BAA2B,eAAe;CACvE,MAAM,EAAE,WAAW,SAAS,oBAAoB,gBAAgB,QAAQ;AACxE,KAAI;AACF,QAAM,qBAAqB;GACzB,QAAQ,wBAAwB,aAAK,SAAS,eAAe,EAAE,cAAc,eAAe;GAC5F,KAAK,aAAK,QAAQ,eAAe;GACjC,mBAAmB,aAAa,wBAAwB,WAAW,UAAU,KAAK;GACnF,CAAC;AACF,QAAM,oBAAoB,gBAAgB,gBAAgB,cAAc,UAAU;UAC3E,OAAO;AACd,MAAI;AACF,sBAAmB,UAAU;WACtB,cAAc;AACrB,WAAQ,MAAM,GAAG,WAAW,mEAAmE,eAAe,yDAAyD;IACrK;IACA,cAAc,wBAAwB,QAAQ,aAAa,UAAU,OAAO,aAAa;IAC1F,CAAC;;AAEJ,QAAM;;;AAIV,eAAsB,oBAAoB,gBAAwB,QAA+B;AAC/F,0BAAyB,gBAAgB,OAAO;;AAGlD,eAAe,qBAAqB,SAIlB;CAChB,MAAM,YAAY,qBAAqB;CACvC,MAAM,0CAA0B,IAAI,KAAa;AACjD,KAAI;AACF,sDAA6B;GAC3B,QAAQ,QAAQ;GAChB,KAAK,QAAQ;GACb,cAAc;IAAC;IAAQ;IAAS;IAAQ;IAAQ;IAAO;GACvD,iBAAiB;GACjB;GACA,SAAS,SAAS;AAAE,YAAQ,KAAK,GAAG,WAAW,WAAW,OAAO;;GACjE,eAAe,UAAU;IACvB,MAAM,uDAAgC,MAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AACrF,QAAI,UAAU,KAAM,QAAO,EAAE,UAAU,MAAM;AAC7C,QAAI,wCAAiB,QAAQ,KAAK,OAAO,EAAE;AACzC,6BAAwB,IAAI,OAAO;AACnC,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,oBAAoB;MACpB,0BAA0B,sBAAsB,OAAO;MACxD,EACF;;AAEH,YAAQ,mBAAmB,OAAO;AAClC,WAAO,EAAE,UAAU,MAAM;;GAE5B,CAAC;UACK,OAAO;AACd,MAAI,iBAAiBC,0CACnB,OAAM,IAAI,MAAM,uCAAuC,UAAU,4DAA4D;AAE/H,MAAI,iBAAiBC,0CACnB,OAAM,IAAI,MAAM,GAAG,MAAM,QAAQ,yDAAyD;AAE5F,QAAM;;AAER,KAAI,wBAAwB,OAAO,EACjC,OAAM,IAAI,MAAM,uCAAuC,wBAAwB,KAAK,+DAA+D,CAAC,GAAG,wBAAwB,CAAC,KAAK,KAAK,CAAC,+BAA+B;;AAI9N,SAAS,sBAA8B;CACrC,MAAM,MAAM,QAAQ,IAAI;AACxB,KAAI,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAI,QAAO;CAC7C,MAAM,SAAS,OAAO,IAAI;AAC1B,KAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACxC,OAAM,IAAI,MAAM,iDAAiD,KAAK,UAAU,IAAI,CAAC,+CAA+C;AAEtI,QAAO;;AAGT,SAAS,wBAAwB,WAAiC,UAAkB,MAAyB;CAC3G,MAAM,WAAW,aAAK,QAAQ,SAAS;AACvC,KAAI,KAAK,IAAI,SAAS,CAAE;AACxB,MAAK,IAAI,SAAS;AAClB,WAAU,KAAK;EAAE,MAAM;EAAU,4BAAoB,SAAS,wBAAgB,UAAU,QAAQ,GAAG;EAAM,CAAC;;AAG5G,SAAS,oBAAoB,gBAAwB,eAA+E;CAClI,MAAM,MAAM,aAAK,QAAQ,eAAe;CACxC,MAAM,iBAAiB,aAAK,QAAQ,eAAe;CACnD,MAAM,YAAkC,CAAC;EAAE,MAAM;EAAgB,SAAS;EAAe,CAAC;CAC1F,MAAM,OAAO,IAAI,IAAY,CAAC,eAAe,CAAC;AAC9C,MAAK,MAAM,aAAa,4BAA4B,cAAc,EAAE;EAClE,MAAM,WAAW,aAAK,QAAQ,KAAK,UAAU;AAC7C,MAAI,wCAAiB,KAAK,SAAS,CAAE;AACrC,0BAAwB,WAAW,UAAU,KAAK;;AAEpD,QAAO;EAAE;EAAW;EAAM;;AAG5B,SAAS,mBAAmB,WAAuC;CACjE,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,EAAE,MAAM,UAAU,aAAa,UACxC,KAAI;AACF,MAAI,YAAY,MACd;0BAAe,SAAS,CAAE,gBAAO,SAAS;QAE1C,uBAAc,UAAU,SAAS,QAAQ;UAEpC,OAAO;AACd,WAAS,KAAK,GAAG,SAAS,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAAG;;AAG3F,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,MAAM,qBAAqB,SAAS,OAAO,4BAA4B,SAAS,KAAK,KAAK,GAAG;;AAI3G,eAAe,2BAA2B,gBAAgD;AACxF,KAAI;AACF,UAAQ,MAAM,eAAe,eAAe,EAAE;UACvC,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,2FAA2F;GACpH;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC9D,CAAC;AACF,SAAO;;;AAIX,eAAe,oBAAoB,gBAAwB,gBAA+B,cAAsB,WAAgD;AAC9J,KAAI,kBAAkB,MAAM;EAC1B,MAAM,SAAS,qEAA4B,gBAAgB,aAAa,CAAC;AAEzE,MAAI,CAAC,aADU,oBAAoB,MAAM,eAAe,eAAe,EAAE,OAAO,EACtD,OAAO,CAC/B,OAAM,IAAI,MAAM,uCAAuC,eAAe,qEAAqE;AAE7I;;AAWF,KAAI,oBAAoB,aAAa,CAAC,SAAS,KAAK,CAAC,uBAAuB,UAAU,CACpF,SAAQ,KAAK,GAAG,WAAW,qCAAqC,eAAe,2CAA2C;AAI5H,KAAI,CAAC,6CADwB,gBAAgB,QAAQ,EACf,eAAe,CACnD,OAAM,IAAI,MAAM,uCAAuC,eAAe,0DAA0D;;AAIpI,SAAS,gCAAgC,SAAiB,gBAAuC;AAC/F,KAAI;EACF,MAAM,oFAAwC,SAAS,eAAe;AACtE,gEAAqB,OAAO,GAAG,SAAS;SAClC;AACN,SAAO;;;AAIX,SAAS,wBAAwB,SAAiB,gBAAiC;AACjF,KAAI;AACF,6EAA+B,SAAS,eAAe;AACvD,SAAO;SACD;AAIN,SAAO,8BAA8B,KAAK,QAAQ;;;AAItD,SAAS,4BAA4B,SAA2B;CAC9D,MAAM,aAAuB,EAAE;CAC/B,MAAM,gBAAgB;CACtB,IAAI;AACJ,SAAQ,QAAQ,cAAc,KAAK,QAAQ,MAAM,KAC/C,YAAW,KAAK,MAAM,GAAG;AAE3B,QAAO;;AAGT,SAAS,uBAAuB,WAA0C;AACxE,QAAO,UAAU,MAAM,EAAE,MAAM,UAAU,cAAc;AAErD,6BAD2B,SAAS,wBAAgB,UAAU,QAAQ,GAAG,UACtD;GACnB;;AAGJ,SAAS,oBAAoB,QAAgC;CAC3D,MAAM,UAA0B,EAAE;CAClC,MAAM,QAAQ,QAAgB,QAAsB;AAClD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;GAC9C,MAAM,WAAW,WAAW,KAAK,MAAM,GAAG,OAAO,GAAG;AACpD,OAAI,UAAU,OAAW;AACzB,OAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EACtG,MAAK,UAAU,MAAM;OAErB,SAAQ,KAAK;IAAE,MAAM;IAAU;IAAO,CAAC;;;AAI7C,MAAK,IAAI,OAAO;AAChB,QAAO;;AAGT,SAAS,wBAAwB,gBAAwB,cAAsB,gBAAuC;CAEpH,MAAM,cADU,oBAAoB,aAAa,CACrB,KAAK,EAAE,MAAM,YAAY,YAAY;AAC/D,SAAO,KAAK,KAAK,UAAU,WAAW,CAAC,WAAW,KAAK,UAAU,MAAM;GACvE,CAAC,KAAK,KAAK;CACb,MAAM,iBAAiB,kBAAkB,OAAO,OAAO,qEAA4B,gBAAgB,aAAa,CAAC;CACjH,MAAM,wBAAwB,kBAAkB,OAAO,KAAK;;;EAG5D,KAAK,UAAU,gBAAgB,MAAM,EAAE,CAAC;;AAGxC,QAAO;;eAEM,KAAK,UAAU,eAAe,CAAC;;;;;;;;;EAS5C,YAAY;EACZ,sBAAsB;;;;;;;;;AAUxB,SAAS,mBAAmB,QAAkC;CAC5D,MAAM,cAAwB,EAAE;CAChC,MAAM,gEAAuB,QAAQ;EACnC,oBAAoB;EACpB,eAAe;EACf;EACD,CAAC;AACF,KAAI,YAAY,SAAS,EACvB,OAAM,IAAI,MAAM,kFAAkF,YAAY,KAAK,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG;AAE/J,QAAO;;AAGT,SAAS,aAAa,GAAY,GAAqB;AACrD,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,MAAM,QAAQ,MAAM,KAAM,QAAO,MAAM;AAC3C,KAAI,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,EAAE,EAAE;AACxC,MAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAC5E,SAAO,EAAE,OAAO,OAAO,UAAU,aAAa,OAAO,EAAE,OAAO,CAAC;;AAEjE,KAAI,OAAO,MAAM,YAAY,OAAO,MAAM,UAAU;EAClD,MAAM,WAAW,OAAO,QAAQ,EAAE;EAClC,MAAM,OAAO,IAAI,IAAI,OAAO,QAAQ,EAAE,CAAC;AACvC,MAAI,SAAS,WAAW,KAAK,KAAM,QAAO;AAC1C,SAAO,SAAS,OAAO,CAAC,KAAK,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC;;AAE9F,QAAO"}
+{"version":3,"file":"index.js","names":["jiti","showOnboardingHexclaveConfigValue","ClaudeAgentTimeoutError","ClaudeAgentFailureError"],"sources":["../src/index.ts"],"sourcesContent":["import { showOnboardingHexclaveConfigValue } from \"@hexclave/shared/dist/config-authoring\";\nimport { detectImportPackageFromDir, parseHexclaveConfigFileContent, renderConfigFileContent } from \"@hexclave/shared/dist/config-rendering\";\nimport type { Config, ConfigValue, NormalizedConfig } from \"@hexclave/shared/dist/config/format\";\nimport { isValidConfig, normalize, override } from \"@hexclave/shared/dist/config/format\";\nimport { captureError } from \"@hexclave/shared/dist/utils/errors\";\nimport { createHash } from \"crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"fs\";\nimport { createJiti } from \"jiti\";\nimport path from \"path\";\nimport { ClaudeAgentFailureError, ClaudeAgentTimeoutError, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent } from \"./config-agent\";\n\nconst jiti = createJiti(import.meta.url, { moduleCache: false });\n\nconst LOG_PREFIX = \"[Stack config updater]\";\nconst DEFAULT_AGENT_TIMEOUT_MS = 120_000;\nconst CONFIG_UPDATE_LOG_PATH_LIMIT = 40;\n\ntype ConfigModule = {\n  config?: unknown,\n};\n\ntype ConfigFileSnapshot = { path: string, content: string | null };\ntype ConfigChange = { path: string, value: ConfigValue };\n\nfunction formatConfigUpdaterErrorForLog(error: unknown): Record<string, unknown> {\n  if (error instanceof Error) {\n    return {\n      errorName: error.name,\n      errorMessage: error.message,\n      errorStack: error.stack,\n    };\n  }\n  return {\n    errorMessage: String(error),\n  };\n}\n\nfunction configUpdatePathDetailsForLog(changes: ConfigChange[]): Record<string, unknown> {\n  const paths = changes.map(({ path: configPath }) => configPath).sort();\n  return {\n    configUpdatePathCount: paths.length,\n    configUpdatePaths: paths.slice(0, CONFIG_UPDATE_LOG_PATH_LIMIT),\n    configUpdatePathsTruncated: paths.length > CONFIG_UPDATE_LOG_PATH_LIMIT,\n  };\n}\n\nfunction isConfigModule(value: unknown): value is ConfigModule {\n  return value !== null && typeof value === \"object\";\n}\n\nexport function sha256String(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nexport function resolveConfigFilePath(inputPath: string): string {\n  const resolved = path.resolve(inputPath);\n  const looksLikeConfigFile = /\\.(ts|js|mjs|cjs)$/i.test(resolved);\n  if (looksLikeConfigFile) {\n    return resolved;\n  }\n  // Prefer hexclave.config.ts, fall back to stack.config.ts, default to the new name.\n  const hexclaveCandidate = path.join(resolved, \"hexclave.config.ts\");\n  const legacyCandidate = path.join(resolved, \"stack.config.ts\");\n  if (existsSync(hexclaveCandidate)) {\n    return hexclaveCandidate;\n  }\n  if (existsSync(legacyCandidate)) {\n    return legacyCandidate;\n  }\n  return hexclaveCandidate;\n}\n\nexport function ensureConfigFileExists(configFilePath: string): void {\n  if (existsSync(configFilePath)) return;\n  mkdirSync(path.dirname(configFilePath), { recursive: true });\n  renderConfigObjectToFile(configFilePath, {});\n}\n\nexport async function readConfigObject(configFilePath: string): Promise<Config> {\n  return (await readConfigFile(configFilePath)).config;\n}\n\nexport async function readConfigFile(configFilePath: string): Promise<{ config: Config, showOnboarding: boolean }> {\n  ensureConfigFileExists(configFilePath);\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (content.trim() === \"\") {\n    return {\n      config: {},\n      showOnboarding: false,\n    };\n  }\n\n  let configModule: unknown;\n  try {\n    configModule = await jiti.import<unknown>(configFilePath);\n  } catch (error) {\n    // Capture the raw jiti/framework error for diagnostics, but don't attach it as `cause` on the thrown error:\n    // dashboard error formatting renders causes recursively, which would leak framework internals into the\n    // user-facing message we're deliberately replacing.\n    captureError(\"shared-backend/readConfigFile\", error);\n    throw new Error(\n      `Failed to load config file ${configFilePath}.`,\n    );\n  }\n  if (!isConfigModule(configModule)) {\n    throw new Error(`Invalid config in ${configFilePath}. The file must export a plain \\`config\\` object or \"show-onboarding\".`);\n  }\n\n  const config = configModule.config;\n  if (config === showOnboardingHexclaveConfigValue) {\n    return {\n      config: {},\n      showOnboarding: true,\n    };\n  }\n  if (!isValidConfig(config)) {\n    throw new Error(`Invalid config in ${configFilePath}.`);\n  }\n  return {\n    config,\n    showOnboarding: false,\n  };\n}\n\nfunction renderConfigObjectToString(configFilePath: string, config: Config): string {\n  const importPackage = detectImportPackageFromDir(path.dirname(configFilePath));\n  return renderConfigFileContent(config, importPackage);\n}\n\nfunction writeFileAtomic(configFilePath: string, content: string): void {\n  const dir = path.dirname(configFilePath);\n  mkdirSync(dir, { recursive: true });\n  const tempPath = path.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);\n  writeFileSync(tempPath, content, \"utf-8\");\n  try {\n    renameSync(tempPath, configFilePath);\n  } catch (error) {\n    try {\n      rmSync(tempPath);\n    } catch { /* best-effort cleanup */ }\n    throw error;\n  }\n}\n\nfunction renderConfigObjectToFile(configFilePath: string, config: Config): void {\n  writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));\n}\n\nexport async function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void> {\n  const startedAtMs = performance.now();\n  ensureConfigFileExists(configFilePath);\n\n  const changes = flattenConfigUpdate(configUpdate);\n  if (changes.length === 0) {\n    console.log(`${LOG_PREFIX} Skipping config update because it contains no changes`, {\n      configFilePath,\n    });\n    return;\n  }\n  const updateLogDetails = {\n    configFilePath,\n    ...configUpdatePathDetailsForLog(changes),\n  };\n  console.log(`${LOG_PREFIX} Starting config file update`, updateLogDetails);\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n\n  // Fast path: if the config is a plain static literal (no imports, no helpers),\n  // apply the update deterministically without invoking the AI agent.\n  const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);\n  if (staticConfig != null && isValidConfig(staticConfig)) {\n    console.log(`${LOG_PREFIX} Applying config update with static config rewrite`, updateLogDetails);\n    const merged = override(staticConfig, configUpdate);\n    if (!isValidConfig(merged)) {\n      throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);\n    }\n    renderConfigObjectToFile(configFilePath, merged);\n    console.log(`${LOG_PREFIX} Finished config update with static config rewrite`, {\n      ...updateLogDetails,\n      elapsedMs: Math.round(performance.now() - startedAtMs),\n    });\n    return;\n  }\n\n  // Agent path: config has custom structure (imports, helpers, external files)\n  // that must be preserved — delegate to the AI agent.\n  console.log(`${LOG_PREFIX} Applying config update with agent-assisted rewrite`, {\n    ...updateLogDetails,\n    configDirectory: path.dirname(configFilePath),\n  });\n  const baselineConfig = await tryReadConfigForValidation(configFilePath);\n  const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);\n  try {\n    await runConfigUpdateAgent({\n      prompt: buildConfigUpdatePrompt(path.basename(configFilePath), configUpdate, baselineConfig),\n      cwd: path.dirname(configFilePath),\n      onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen),\n    });\n    await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Config update failed; restoring files from snapshots`, {\n      ...updateLogDetails,\n      snapshotCount: snapshots.length,\n      elapsedMs: Math.round(performance.now() - startedAtMs),\n      ...formatConfigUpdaterErrorForLog(error),\n    });\n    try {\n      restoreConfigFiles(snapshots);\n      console.warn(`${LOG_PREFIX} Restored files after failed config update`, {\n        ...updateLogDetails,\n        snapshotCount: snapshots.length,\n      });\n    } catch (restoreError) {\n      console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {\n        configFilePath,\n        ...formatConfigUpdaterErrorForLog(restoreError),\n      });\n    }\n    throw error;\n  }\n  console.log(`${LOG_PREFIX} Finished config update with agent-assisted rewrite`, {\n    ...updateLogDetails,\n    elapsedMs: Math.round(performance.now() - startedAtMs),\n    snapshotCount: snapshots.length,\n  });\n}\n\nexport async function replaceConfigObject(configFilePath: string, config: Config): Promise<void> {\n  renderConfigObjectToFile(configFilePath, config);\n}\n\nasync function runConfigUpdateAgent(options: {\n  prompt: string,\n  cwd: string,\n  onFileWillChange?: (filePath: string) => void,\n}): Promise<void> {\n  const timeoutMs = parseAgentTimeoutMs();\n  const deniedOutOfBoundsWrites = new Set<string>();\n  const startedAtMs = performance.now();\n  console.log(`${LOG_PREFIX} Starting config update agent`, {\n    cwd: options.cwd,\n    timeoutMs,\n  });\n  try {\n    await runHeadlessClaudeAgent({\n      prompt: options.prompt,\n      cwd: options.cwd,\n      allowedTools: [\"Read\", \"Write\", \"Edit\", \"Glob\", \"Grep\"],\n      strictIsolation: true,\n      timeoutMs,\n      stderr: (data) => { console.warn(`${LOG_PREFIX} [agent] ${data}`); },\n      onPreToolUse: (input) => {\n        const target = getToolWriteTargetPath(input.tool_name, input.tool_input, options.cwd);\n        if (target == null) return { continue: true };\n        if (!isPathInsideDir(options.cwd, target)) {\n          deniedOutOfBoundsWrites.add(target);\n          return {\n            hookSpecificOutput: {\n              hookEventName: \"PreToolUse\",\n              permissionDecision: \"deny\",\n              permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`,\n            },\n          };\n        }\n        options.onFileWillChange?.(target);\n        return { continue: true };\n      },\n    });\n  } catch (error) {\n    if (error instanceof ClaudeAgentTimeoutError) {\n      console.warn(`${LOG_PREFIX} Config update agent timed out`, {\n        cwd: options.cwd,\n        timeoutMs,\n        elapsedMs: Math.round(performance.now() - startedAtMs),\n        ...formatConfigUpdaterErrorForLog(error),\n      });\n      throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);\n    }\n    if (error instanceof ClaudeAgentFailureError) {\n      console.warn(`${LOG_PREFIX} Config update agent failed`, {\n        cwd: options.cwd,\n        timeoutMs,\n        elapsedMs: Math.round(performance.now() - startedAtMs),\n        ...formatConfigUpdaterErrorForLog(error),\n      });\n      throw new Error(`${error.message} It was unable to apply the config changes to the file.`);\n    }\n    console.warn(`${LOG_PREFIX} Config update agent failed unexpectedly`, {\n      cwd: options.cwd,\n      timeoutMs,\n      elapsedMs: Math.round(performance.now() - startedAtMs),\n      ...formatConfigUpdaterErrorForLog(error),\n    });\n    throw error;\n  }\n  console.log(`${LOG_PREFIX} Finished config update agent`, {\n    cwd: options.cwd,\n    timeoutMs,\n    elapsedMs: Math.round(performance.now() - startedAtMs),\n    deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,\n  });\n  if (deniedOutOfBoundsWrites.size > 0) {\n    console.warn(`${LOG_PREFIX} Config update agent attempted out-of-bounds writes`, {\n      cwd: options.cwd,\n      deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,\n      deniedOutOfBoundsWrites: [...deniedOutOfBoundsWrites],\n    });\n    throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(\", \")}. The config was not updated.`);\n  }\n}\n\nfunction parseAgentTimeoutMs(): number {\n  const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;\n  if (raw == null || raw.trim() === \"\") return DEFAULT_AGENT_TIMEOUT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);\n  }\n  return parsed;\n}\n\nfunction captureSnapshotIfAbsent(snapshots: ConfigFileSnapshot[], filePath: string, seen: Set<string>): void {\n  const resolved = path.resolve(filePath);\n  if (seen.has(resolved)) return;\n  seen.add(resolved);\n  snapshots.push({ path: resolved, content: existsSync(resolved) ? readFileSync(resolved, \"utf-8\") : null });\n}\n\nfunction snapshotConfigFiles(configFilePath: string, configContent: string): { snapshots: ConfigFileSnapshot[]; seen: Set<string> } {\n  const dir = path.dirname(configFilePath);\n  const resolvedConfig = path.resolve(configFilePath);\n  const snapshots: ConfigFileSnapshot[] = [{ path: resolvedConfig, content: configContent }];\n  const seen = new Set<string>([resolvedConfig]);\n  for (const specifier of getRelativeImportSpecifiers(configContent)) {\n    const resolved = path.resolve(dir, specifier);\n    if (!isPathInsideDir(dir, resolved)) continue;\n    captureSnapshotIfAbsent(snapshots, resolved, seen);\n  }\n  return { snapshots, seen };\n}\n\nfunction restoreConfigFiles(snapshots: ConfigFileSnapshot[]): void {\n  const failures: string[] = [];\n  for (const { path: filePath, content } of snapshots) {\n    try {\n      if (content === null) {\n        if (existsSync(filePath)) rmSync(filePath);\n      } else {\n        writeFileSync(filePath, content, \"utf-8\");\n      }\n    } catch (error) {\n      failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n  if (failures.length > 0) {\n    throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join(\"; \")}`);\n  }\n}\n\nasync function tryReadConfigForValidation(configFilePath: string): Promise<Config | null> {\n  try {\n    return (await readConfigFile(configFilePath)).config;\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {\n      configFilePath,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return null;\n  }\n}\n\nasync function validateAgentUpdate(configFilePath: string, baselineConfig: Config | null, configUpdate: Config, snapshots: ConfigFileSnapshot[]): Promise<void> {\n  if (baselineConfig != null) {\n    const target = canonicalizeConfig(override(baselineConfig, configUpdate));\n    const result = canonicalizeConfig((await readConfigFile(configFilePath)).config);\n    if (!configsEqual(result, target)) {\n      throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);\n    }\n    return;\n  }\n\n  // Structural-only fallback: when jiti can't evaluate the config (e.g. missing\n  // runtime dependencies in import-with attributes), we can only verify that\n  // (a) something changed on disk and (b) the file still exports `config`.\n  // This cannot catch silently mis-applied values — an accepted tradeoff vs.\n  // blocking updates entirely for configs we can't evaluate.\n  // When nothing changed on disk the update is either already applied or the\n  // agent couldn't figure out what to do. Treat it as a no-op rather than a\n  // hard failure: the structural check below still verifies the file is valid.\n  if (flattenConfigUpdate(configUpdate).length > 0 && !snapshotsChangedOnDisk(snapshots)) {\n    console.warn(`${LOG_PREFIX} Agent did not modify any file for ${configFilePath}; assuming values are already up to date.`);\n  }\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (!configFileExportsConfig(content, configFilePath)) {\n    throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \\`config\\`.`);\n  }\n}\n\nfunction tryParseStaticConfigFileContent(content: string, configFilePath: string): Config | null {\n  try {\n    const parsed = parseHexclaveConfigFileContent(content, configFilePath);\n    return isValidConfig(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction configFileExportsConfig(content: string, configFilePath: string): boolean {\n  try {\n    parseHexclaveConfigFileContent(content, configFilePath);\n    return true;\n  } catch {\n    // Dynamic configs can be valid even when the static parser cannot evaluate\n    // them. For the structural fallback we only need to know that a runtime\n    // config binding still exists after the agent edited the file.\n    return /\\bexport\\s+const\\s+config\\b/.test(content);\n  }\n}\n\nfunction getRelativeImportSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n  const importPattern = /\\bimport\\b(?:[^'\"]*?\\bfrom\\s*)?[\"'](\\.{1,2}\\/[^\"']+)[\"']/g;\n  let match: RegExpExecArray | null;\n  while ((match = importPattern.exec(content)) !== null) {\n    specifiers.push(match[1]);\n  }\n  return specifiers;\n}\n\nfunction snapshotsChangedOnDisk(snapshots: ConfigFileSnapshot[]): boolean {\n  return snapshots.some(({ path: filePath, content }) => {\n    const current = existsSync(filePath) ? readFileSync(filePath, \"utf-8\") : null;\n    return current !== content;\n  });\n}\n\nfunction flattenConfigUpdate(update: Config): ConfigChange[] {\n  const changes: ConfigChange[] = [];\n  const walk = (prefix: string, obj: Config): void => {\n    for (const [key, value] of Object.entries(obj)) {\n      const fullPath = prefix === \"\" ? key : `${prefix}.${key}`;\n      if (value === undefined) continue;\n      if (value !== null && typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length > 0) {\n        walk(fullPath, value);\n      } else {\n        changes.push({ path: fullPath, value });\n      }\n    }\n  };\n  walk(\"\", update);\n  return changes;\n}\n\nfunction buildConfigUpdatePrompt(configFileName: string, configUpdate: Config, baselineConfig: Config | null): string {\n  const changes = flattenConfigUpdate(configUpdate);\n  const changeLines = changes.map(({ path: configPath, value }) => {\n    return `- ${JSON.stringify(configPath)}: set to ${JSON.stringify(value)}`;\n  }).join(\"\\n\");\n  const expectedConfig = baselineConfig == null ? null : canonicalizeConfig(override(baselineConfig, configUpdate));\n  const expectedConfigSection = expectedConfig == null ? \"\" : `\nAfter the edit, evaluating the exported \\`config\\` must produce this exact JSON value:\n\n${JSON.stringify(expectedConfig, null, 2)}\n`;\n\n  return `You are editing a Hexclave / Stack Auth configuration file in place. Apply a set of configuration changes WITHOUT changing how the file is written.\n\nConfig file: ${JSON.stringify(configFileName)} (in the current working directory).\n\nThe file exports a \\`config\\` object (it may be wrapped in a helper such as \\`defineStackConfig(...)\\`). Some config values may be sourced from other files via imports, for example:\n\n    import welcomeEmail from \"./welcome-email.tsx\" with { type: \"text\" };\n    export const config = { emails: { templates: { welcome: welcomeEmail } } };\n\nApply EXACTLY these changes. Paths use dot notation, so \\`a.b.c\\` refers to \\`config.a.b.c\\`:\n\n${changeLines}\n${expectedConfigSection}\n\nRules:\n- Change ONLY the config paths listed above. Leave every other part of the file byte-for-byte unchanged: imports, comments, formatting, helper wrappers, and any config fields not listed.\n- If a listed path's value is currently provided by an imported external file (like the \\`import ... with { type: \"text\" }\\` example above), DO NOT inline the new value into the config file. Instead, overwrite that external file with the new value and keep the import statement intact.\n- If a listed path's value is a plain inline literal, edit it inline.\n- Keep the file valid: it must still export a \\`config\\` that, once evaluated, reflects the new values exactly.\n- Do not run any shell commands and do not create files other than what is required to apply these changes.`;\n}\n\nfunction canonicalizeConfig(config: Config): NormalizedConfig {\n  const droppedKeys: string[] = [];\n  const normalized = normalize(config, {\n    onDotIntoNonObject: \"ignore\",\n    onDotIntoNull: \"empty-object\",\n    droppedKeys,\n  });\n  if (droppedKeys.length > 0) {\n    throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(\", \")}`);\n  }\n  return normalized;\n}\n\nfunction configsEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true;\n  if (a === null || b === null) return a === b;\n  if (Array.isArray(a) || Array.isArray(b)) {\n    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;\n    return a.every((value, index) => configsEqual(value, b[index]));\n  }\n  if (typeof a === \"object\" && typeof b === \"object\") {\n    const aEntries = Object.entries(a);\n    const bMap = new Map(Object.entries(b));\n    if (aEntries.length !== bMap.size) return false;\n    return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;AAWA,MAAMA,6EAAmC,EAAE,aAAa,OAAO,CAAC;AAEhE,MAAM,aAAa;AACnB,MAAM,2BAA2B;AACjC,MAAM,+BAA+B;AASrC,SAAS,+BAA+B,OAAyC;AAC/E,KAAI,iBAAiB,MACnB,QAAO;EACL,WAAW,MAAM;EACjB,cAAc,MAAM;EACpB,YAAY,MAAM;EACnB;AAEH,QAAO,EACL,cAAc,OAAO,MAAM,EAC5B;;AAGH,SAAS,8BAA8B,SAAkD;CACvF,MAAM,QAAQ,QAAQ,KAAK,EAAE,MAAM,iBAAiB,WAAW,CAAC,MAAM;AACtE,QAAO;EACL,uBAAuB,MAAM;EAC7B,mBAAmB,MAAM,MAAM,GAAG,6BAA6B;EAC/D,4BAA4B,MAAM,SAAS;EAC5C;;AAGH,SAAS,eAAe,OAAuC;AAC7D,QAAO,UAAU,QAAQ,OAAO,UAAU;;AAG5C,SAAgB,aAAa,OAAuB;AAClD,+BAAkB,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;AAGzD,SAAgB,sBAAsB,WAA2B;CAC/D,MAAM,WAAW,aAAK,QAAQ,UAAU;AAExC,KAD4B,sBAAsB,KAAK,SAAS,CAE9D,QAAO;CAGT,MAAM,oBAAoB,aAAK,KAAK,UAAU,qBAAqB;CACnE,MAAM,kBAAkB,aAAK,KAAK,UAAU,kBAAkB;AAC9D,wBAAe,kBAAkB,CAC/B,QAAO;AAET,wBAAe,gBAAgB,CAC7B,QAAO;AAET,QAAO;;AAGT,SAAgB,uBAAuB,gBAA8B;AACnE,wBAAe,eAAe,CAAE;AAChC,mBAAU,aAAK,QAAQ,eAAe,EAAE,EAAE,WAAW,MAAM,CAAC;AAC5D,0BAAyB,gBAAgB,EAAE,CAAC;;AAG9C,eAAsB,iBAAiB,gBAAyC;AAC9E,SAAQ,MAAM,eAAe,eAAe,EAAE;;AAGhD,eAAsB,eAAe,gBAA8E;AACjH,wBAAuB,eAAe;AAEtC,0BAD6B,gBAAgB,QAAQ,CACzC,MAAM,KAAK,GACrB,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;CAGH,IAAI;AACJ,KAAI;AACF,iBAAe,MAAMA,OAAK,OAAgB,eAAe;UAClD,OAAO;AAId,uDAAa,iCAAiC,MAAM;AACpD,QAAM,IAAI,MACR,8BAA8B,eAAe,GAC9C;;AAEH,KAAI,CAAC,eAAe,aAAa,CAC/B,OAAM,IAAI,MAAM,qBAAqB,eAAe,wEAAwE;CAG9H,MAAM,SAAS,aAAa;AAC5B,KAAI,WAAWC,yEACb,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;AAEH,KAAI,wDAAe,OAAO,CACxB,OAAM,IAAI,MAAM,qBAAqB,eAAe,GAAG;AAEzD,QAAO;EACL;EACA,gBAAgB;EACjB;;AAGH,SAAS,2BAA2B,gBAAwB,QAAwB;AAElF,4EAA+B,+EADkB,aAAK,QAAQ,eAAe,CAAC,CACzB;;AAGvD,SAAS,gBAAgB,gBAAwB,SAAuB;CACtE,MAAM,MAAM,aAAK,QAAQ,eAAe;AACxC,mBAAU,KAAK,EAAE,WAAW,MAAM,CAAC;CACnC,MAAM,WAAW,aAAK,KAAK,KAAK,iBAAiB,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM;AAC3F,uBAAc,UAAU,SAAS,QAAQ;AACzC,KAAI;AACF,qBAAW,UAAU,eAAe;UAC7B,OAAO;AACd,MAAI;AACF,kBAAO,SAAS;UACV;AACR,QAAM;;;AAIV,SAAS,yBAAyB,gBAAwB,QAAsB;AAC9E,iBAAgB,gBAAgB,2BAA2B,gBAAgB,OAAO,CAAC;;AAGrF,eAAsB,mBAAmB,gBAAwB,cAAqC;CACpG,MAAM,cAAc,YAAY,KAAK;AACrC,wBAAuB,eAAe;CAEtC,MAAM,UAAU,oBAAoB,aAAa;AACjD,KAAI,QAAQ,WAAW,GAAG;AACxB,UAAQ,IAAI,GAAG,WAAW,yDAAyD,EACjF,gBACD,CAAC;AACF;;CAEF,MAAM,mBAAmB;EACvB;EACA,GAAG,8BAA8B,QAAQ;EAC1C;AACD,SAAQ,IAAI,GAAG,WAAW,+BAA+B,iBAAiB;CAE1E,MAAM,+BAAuB,gBAAgB,QAAQ;CAIrD,MAAM,eAAe,gCAAgC,SAAS,eAAe;AAC7E,KAAI,gBAAgB,+DAAsB,aAAa,EAAE;AACvD,UAAQ,IAAI,GAAG,WAAW,qDAAqD,iBAAiB;EAChG,MAAM,2DAAkB,cAAc,aAAa;AACnD,MAAI,wDAAe,OAAO,CACxB,OAAM,IAAI,MAAM,GAAG,WAAW,qDAAqD,iBAAiB;AAEtG,2BAAyB,gBAAgB,OAAO;AAChD,UAAQ,IAAI,GAAG,WAAW,qDAAqD;GAC7E,GAAG;GACH,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;GACvD,CAAC;AACF;;AAKF,SAAQ,IAAI,GAAG,WAAW,sDAAsD;EAC9E,GAAG;EACH,iBAAiB,aAAK,QAAQ,eAAe;EAC9C,CAAC;CACF,MAAM,iBAAiB,MAAM,2BAA2B,eAAe;CACvE,MAAM,EAAE,WAAW,SAAS,oBAAoB,gBAAgB,QAAQ;AACxE,KAAI;AACF,QAAM,qBAAqB;GACzB,QAAQ,wBAAwB,aAAK,SAAS,eAAe,EAAE,cAAc,eAAe;GAC5F,KAAK,aAAK,QAAQ,eAAe;GACjC,mBAAmB,aAAa,wBAAwB,WAAW,UAAU,KAAK;GACnF,CAAC;AACF,QAAM,oBAAoB,gBAAgB,gBAAgB,cAAc,UAAU;UAC3E,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,wDAAwD;GACjF,GAAG;GACH,eAAe,UAAU;GACzB,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;GACtD,GAAG,+BAA+B,MAAM;GACzC,CAAC;AACF,MAAI;AACF,sBAAmB,UAAU;AAC7B,WAAQ,KAAK,GAAG,WAAW,6CAA6C;IACtE,GAAG;IACH,eAAe,UAAU;IAC1B,CAAC;WACK,cAAc;AACrB,WAAQ,MAAM,GAAG,WAAW,mEAAmE,eAAe,yDAAyD;IACrK;IACA,GAAG,+BAA+B,aAAa;IAChD,CAAC;;AAEJ,QAAM;;AAER,SAAQ,IAAI,GAAG,WAAW,sDAAsD;EAC9E,GAAG;EACH,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;EACtD,eAAe,UAAU;EAC1B,CAAC;;AAGJ,eAAsB,oBAAoB,gBAAwB,QAA+B;AAC/F,0BAAyB,gBAAgB,OAAO;;AAGlD,eAAe,qBAAqB,SAIlB;CAChB,MAAM,YAAY,qBAAqB;CACvC,MAAM,0CAA0B,IAAI,KAAa;CACjD,MAAM,cAAc,YAAY,KAAK;AACrC,SAAQ,IAAI,GAAG,WAAW,gCAAgC;EACxD,KAAK,QAAQ;EACb;EACD,CAAC;AACF,KAAI;AACF,sDAA6B;GAC3B,QAAQ,QAAQ;GAChB,KAAK,QAAQ;GACb,cAAc;IAAC;IAAQ;IAAS;IAAQ;IAAQ;IAAO;GACvD,iBAAiB;GACjB;GACA,SAAS,SAAS;AAAE,YAAQ,KAAK,GAAG,WAAW,WAAW,OAAO;;GACjE,eAAe,UAAU;IACvB,MAAM,uDAAgC,MAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AACrF,QAAI,UAAU,KAAM,QAAO,EAAE,UAAU,MAAM;AAC7C,QAAI,wCAAiB,QAAQ,KAAK,OAAO,EAAE;AACzC,6BAAwB,IAAI,OAAO;AACnC,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,oBAAoB;MACpB,0BAA0B,sBAAsB,OAAO;MACxD,EACF;;AAEH,YAAQ,mBAAmB,OAAO;AAClC,WAAO,EAAE,UAAU,MAAM;;GAE5B,CAAC;UACK,OAAO;AACd,MAAI,iBAAiBC,2CAAyB;AAC5C,WAAQ,KAAK,GAAG,WAAW,iCAAiC;IAC1D,KAAK,QAAQ;IACb;IACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;IACtD,GAAG,+BAA+B,MAAM;IACzC,CAAC;AACF,SAAM,IAAI,MAAM,uCAAuC,UAAU,4DAA4D;;AAE/H,MAAI,iBAAiBC,2CAAyB;AAC5C,WAAQ,KAAK,GAAG,WAAW,8BAA8B;IACvD,KAAK,QAAQ;IACb;IACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;IACtD,GAAG,+BAA+B,MAAM;IACzC,CAAC;AACF,SAAM,IAAI,MAAM,GAAG,MAAM,QAAQ,yDAAyD;;AAE5F,UAAQ,KAAK,GAAG,WAAW,2CAA2C;GACpE,KAAK,QAAQ;GACb;GACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;GACtD,GAAG,+BAA+B,MAAM;GACzC,CAAC;AACF,QAAM;;AAER,SAAQ,IAAI,GAAG,WAAW,gCAAgC;EACxD,KAAK,QAAQ;EACb;EACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;EACtD,6BAA6B,wBAAwB;EACtD,CAAC;AACF,KAAI,wBAAwB,OAAO,GAAG;AACpC,UAAQ,KAAK,GAAG,WAAW,sDAAsD;GAC/E,KAAK,QAAQ;GACb,6BAA6B,wBAAwB;GACrD,yBAAyB,CAAC,GAAG,wBAAwB;GACtD,CAAC;AACF,QAAM,IAAI,MAAM,uCAAuC,wBAAwB,KAAK,+DAA+D,CAAC,GAAG,wBAAwB,CAAC,KAAK,KAAK,CAAC,+BAA+B;;;AAI9N,SAAS,sBAA8B;CACrC,MAAM,MAAM,QAAQ,IAAI;AACxB,KAAI,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAI,QAAO;CAC7C,MAAM,SAAS,OAAO,IAAI;AAC1B,KAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACxC,OAAM,IAAI,MAAM,iDAAiD,KAAK,UAAU,IAAI,CAAC,+CAA+C;AAEtI,QAAO;;AAGT,SAAS,wBAAwB,WAAiC,UAAkB,MAAyB;CAC3G,MAAM,WAAW,aAAK,QAAQ,SAAS;AACvC,KAAI,KAAK,IAAI,SAAS,CAAE;AACxB,MAAK,IAAI,SAAS;AAClB,WAAU,KAAK;EAAE,MAAM;EAAU,4BAAoB,SAAS,wBAAgB,UAAU,QAAQ,GAAG;EAAM,CAAC;;AAG5G,SAAS,oBAAoB,gBAAwB,eAA+E;CAClI,MAAM,MAAM,aAAK,QAAQ,eAAe;CACxC,MAAM,iBAAiB,aAAK,QAAQ,eAAe;CACnD,MAAM,YAAkC,CAAC;EAAE,MAAM;EAAgB,SAAS;EAAe,CAAC;CAC1F,MAAM,OAAO,IAAI,IAAY,CAAC,eAAe,CAAC;AAC9C,MAAK,MAAM,aAAa,4BAA4B,cAAc,EAAE;EAClE,MAAM,WAAW,aAAK,QAAQ,KAAK,UAAU;AAC7C,MAAI,wCAAiB,KAAK,SAAS,CAAE;AACrC,0BAAwB,WAAW,UAAU,KAAK;;AAEpD,QAAO;EAAE;EAAW;EAAM;;AAG5B,SAAS,mBAAmB,WAAuC;CACjE,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,EAAE,MAAM,UAAU,aAAa,UACxC,KAAI;AACF,MAAI,YAAY,MACd;0BAAe,SAAS,CAAE,gBAAO,SAAS;QAE1C,uBAAc,UAAU,SAAS,QAAQ;UAEpC,OAAO;AACd,WAAS,KAAK,GAAG,SAAS,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAAG;;AAG3F,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,MAAM,qBAAqB,SAAS,OAAO,4BAA4B,SAAS,KAAK,KAAK,GAAG;;AAI3G,eAAe,2BAA2B,gBAAgD;AACxF,KAAI;AACF,UAAQ,MAAM,eAAe,eAAe,EAAE;UACvC,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,2FAA2F;GACpH;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC9D,CAAC;AACF,SAAO;;;AAIX,eAAe,oBAAoB,gBAAwB,gBAA+B,cAAsB,WAAgD;AAC9J,KAAI,kBAAkB,MAAM;EAC1B,MAAM,SAAS,qEAA4B,gBAAgB,aAAa,CAAC;AAEzE,MAAI,CAAC,aADU,oBAAoB,MAAM,eAAe,eAAe,EAAE,OAAO,EACtD,OAAO,CAC/B,OAAM,IAAI,MAAM,uCAAuC,eAAe,qEAAqE;AAE7I;;AAWF,KAAI,oBAAoB,aAAa,CAAC,SAAS,KAAK,CAAC,uBAAuB,UAAU,CACpF,SAAQ,KAAK,GAAG,WAAW,qCAAqC,eAAe,2CAA2C;AAI5H,KAAI,CAAC,6CADwB,gBAAgB,QAAQ,EACf,eAAe,CACnD,OAAM,IAAI,MAAM,uCAAuC,eAAe,0DAA0D;;AAIpI,SAAS,gCAAgC,SAAiB,gBAAuC;AAC/F,KAAI;EACF,MAAM,oFAAwC,SAAS,eAAe;AACtE,gEAAqB,OAAO,GAAG,SAAS;SAClC;AACN,SAAO;;;AAIX,SAAS,wBAAwB,SAAiB,gBAAiC;AACjF,KAAI;AACF,6EAA+B,SAAS,eAAe;AACvD,SAAO;SACD;AAIN,SAAO,8BAA8B,KAAK,QAAQ;;;AAItD,SAAS,4BAA4B,SAA2B;CAC9D,MAAM,aAAuB,EAAE;CAC/B,MAAM,gBAAgB;CACtB,IAAI;AACJ,SAAQ,QAAQ,cAAc,KAAK,QAAQ,MAAM,KAC/C,YAAW,KAAK,MAAM,GAAG;AAE3B,QAAO;;AAGT,SAAS,uBAAuB,WAA0C;AACxE,QAAO,UAAU,MAAM,EAAE,MAAM,UAAU,cAAc;AAErD,6BAD2B,SAAS,wBAAgB,UAAU,QAAQ,GAAG,UACtD;GACnB;;AAGJ,SAAS,oBAAoB,QAAgC;CAC3D,MAAM,UAA0B,EAAE;CAClC,MAAM,QAAQ,QAAgB,QAAsB;AAClD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;GAC9C,MAAM,WAAW,WAAW,KAAK,MAAM,GAAG,OAAO,GAAG;AACpD,OAAI,UAAU,OAAW;AACzB,OAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EACtG,MAAK,UAAU,MAAM;OAErB,SAAQ,KAAK;IAAE,MAAM;IAAU;IAAO,CAAC;;;AAI7C,MAAK,IAAI,OAAO;AAChB,QAAO;;AAGT,SAAS,wBAAwB,gBAAwB,cAAsB,gBAAuC;CAEpH,MAAM,cADU,oBAAoB,aAAa,CACrB,KAAK,EAAE,MAAM,YAAY,YAAY;AAC/D,SAAO,KAAK,KAAK,UAAU,WAAW,CAAC,WAAW,KAAK,UAAU,MAAM;GACvE,CAAC,KAAK,KAAK;CACb,MAAM,iBAAiB,kBAAkB,OAAO,OAAO,qEAA4B,gBAAgB,aAAa,CAAC;CACjH,MAAM,wBAAwB,kBAAkB,OAAO,KAAK;;;EAG5D,KAAK,UAAU,gBAAgB,MAAM,EAAE,CAAC;;AAGxC,QAAO;;eAEM,KAAK,UAAU,eAAe,CAAC;;;;;;;;;EAS5C,YAAY;EACZ,sBAAsB;;;;;;;;;AAUxB,SAAS,mBAAmB,QAAkC;CAC5D,MAAM,cAAwB,EAAE;CAChC,MAAM,gEAAuB,QAAQ;EACnC,oBAAoB;EACpB,eAAe;EACf;EACD,CAAC;AACF,KAAI,YAAY,SAAS,EACvB,OAAM,IAAI,MAAM,kFAAkF,YAAY,KAAK,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG;AAE/J,QAAO;;AAGT,SAAS,aAAa,GAAY,GAAqB;AACrD,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,MAAM,QAAQ,MAAM,KAAM,QAAO,MAAM;AAC3C,KAAI,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,EAAE,EAAE;AACxC,MAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAC5E,SAAO,EAAE,OAAO,OAAO,UAAU,aAAa,OAAO,EAAE,OAAO,CAAC;;AAEjE,KAAI,OAAO,MAAM,YAAY,OAAO,MAAM,UAAU;EAClD,MAAM,WAAW,OAAO,QAAQ,EAAE;EAClC,MAAM,OAAO,IAAI,IAAI,OAAO,QAAQ,EAAE,CAAC;AACvC,MAAI,SAAS,WAAW,KAAK,KAAM,QAAO;AAC1C,SAAO,SAAS,OAAO,CAAC,KAAK,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC;;AAE9F,QAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hexclave/shared-backend",
-  "version": "1.0.32",
+  "version": "1.0.34",
   "repository": "https://github.com/hexclave/hexclave",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -29,7 +29,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.73",
     "jiti": "^2.4.2",
-    "@hexclave/shared": "1.0.32"
+    "@hexclave/shared": "1.0.34"
   },
   "devDependencies": {
     "@types/node": "20.17.6",