@jini-ai/daemon 0.3.7 → 0.3.8

package/dist/agent-executor.d.ts

@@ -92,7 +92,7 @@
 import { spawn as nodeSpawn, type ChildProcess } from 'node:child_process';
 import type { Principal } from '@jini-ai/core';
 import type { RunAgentPayload, RunErrorPayload } from '@jini-ai/protocol';
-import { applyAgentLaunchEnv, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, prepareAgentLogFile, preparePromptFileForAgent, type AcpMcpServerInput, type AcpPermissionHandler, type AgentLaunchResolution, type PreparedAgentLogFile, type PreparedPromptFile, type PromptAugmenter, type RuntimeAgentDef, type RuntimeBuildOptions, type RuntimeContext, type RuntimeLockHold } from '@jini-ai/agent-runtime';
+import { applyAgentLaunchEnv, ensureAgentCapabilities, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, prepareAgentLogFile, preparePromptFileForAgent, type AcpMcpServerInput, type AcpPermissionHandler, type AgentLaunchResolution, type PreparedAgentLogFile, type PreparedPromptFile, type PromptAugmenter, type RuntimeAgentDef, type RuntimeBuildOptions, type RuntimeContext, type RuntimeLockHold } from '@jini-ai/agent-runtime';
 import { collectProcessTreePids, createCommandInvocation, listProcessSnapshots, stopProcesses, type ProcessSnapshot, type StopProcessesResult } from '@jini-ai/platform';
 import type { RunByteJournal } from './continuation/journal.js';
 import { type ImagePromptDelivery } from './image-prompt-delivery.js';
@@ -336,6 +336,10 @@ export interface AgentExecutorRunInput {
     readonly disallowedTools?: readonly string[];
     /** Same mechanism as {@link disallowedTools}, forwarded to `RuntimeBuildOptions.allowedTools`. */
     readonly allowedTools?: readonly string[];
+    /** Forwarded verbatim to `RuntimeBuildOptions.settingSources` (an empty list = load none of the CLI's settings layers). */
+    readonly settingSources?: readonly string[];
+    /** Forwarded verbatim to `RuntimeBuildOptions.settings` (extra settings JSON or file path for this run). */
+    readonly settings?: string;
 }
 export interface AgentExecutor {
     /**
@@ -884,6 +888,8 @@ export interface CreateAgentExecutorOptions {
     readonly getAgentDef?: typeof getAgentDef;
     /** @default the real `@jini-ai/agent-runtime` launch resolver */
     readonly resolveAgentLaunch?: typeof resolveAgentLaunch;
+    /** @default the real `@jini-ai/agent-runtime` once-per-binary `--help` capability probe */
+    readonly ensureAgentCapabilities?: typeof ensureAgentCapabilities;
     /** @default the real `@jini-ai/agent-runtime` PATH-env composer */
     readonly applyAgentLaunchEnv?: typeof applyAgentLaunchEnv;
     /** @default the real `@jini-ai/platform` cross-platform invocation builder */
@@ -1135,7 +1141,7 @@ export declare function computeChildEnv(spawnEnv: NodeJS.ProcessEnv, mcpBridge:
  */
 export declare function computeRuntimeContext(preparedPromptFile: PreparedPromptFile | null, preparedLogFile: PreparedAgentLogFile | null, mcpBridge: McpBridgeDelivery | null, resumeSessionId?: string | null, newSessionId?: string): RuntimeContext | undefined;
 /** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay/tool-restriction at all (byte-identical to omitting the argument). Pure. */
-export declare function buildAgentBuildArgsOptions(input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode' | 'disallowedTools' | 'allowedTools'>, systemPromptOverlay: string | null | undefined): RuntimeBuildOptions | undefined;
+export declare function buildAgentBuildArgsOptions(input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings'>, systemPromptOverlay: string | null | undefined): RuntimeBuildOptions | undefined;
 /**
  * {@link resolveSystemPromptOverlayDelivery}'s decision, threaded out of that one resolver to every
  * channel that can actually carry the overlay to the CLI.

package/dist/agent-executor.js

@@ -94,7 +94,7 @@ import { promises as fsPromises } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { redactSecrets } from '@jini-ai/core';
-import { agentCapabilities, applyAgentLaunchEnv, createClaudeStreamHandler, createCopilotStreamHandler, createJsonEventStreamHandler, createQoderStreamHandler, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
+import { agentCapabilities, applyAgentLaunchEnv, createClaudeStreamHandler, createCopilotStreamHandler, createJsonEventStreamHandler, createQoderStreamHandler, ensureAgentCapabilities, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
 import { collectProcessTreePids, createCommandInvocation, listProcessSnapshots, stopProcesses, } from '@jini-ai/platform';
 import { classifyRunCloseStatus } from './close-status.js';
 import { resolveContinuationTransport } from './continuation/continuation-transport.js';
@@ -1983,6 +1983,7 @@ function resolveAgentRuntimeDeps(options) {
     return {
         getAgentDef: options.getAgentDef ?? getAgentDef,
         resolveAgentLaunch: options.resolveAgentLaunch ?? resolveAgentLaunch,
+        ensureAgentCapabilities: options.ensureAgentCapabilities ?? ensureAgentCapabilities,
         applyAgentLaunchEnv: options.applyAgentLaunchEnv ?? applyAgentLaunchEnv,
         attachAcpSession: options.attachAcpSession ?? attachAcpSession,
         attachPiRpcSession: options.attachPiRpcSession ?? attachPiRpcSession,
@@ -2189,22 +2190,17 @@ function computeSystemPromptOverlay(promptAugmenter, agentId, runtimeContext) {
 /** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay/tool-restriction at all (byte-identical to omitting the argument). Pure. */
 export function buildAgentBuildArgsOptions(input, systemPromptOverlay) {
     const hasOverlay = systemPromptOverlay !== undefined && systemPromptOverlay !== null;
-    if (input.model === undefined
-        && input.reasoning === undefined
-        && input.permissionMode === undefined
-        && input.disallowedTools === undefined
-        && input.allowedTools === undefined
-        && !hasOverlay) {
-        return undefined;
-    }
-    return {
+    const options = {
         ...(input.model !== undefined ? { model: input.model } : {}),
         ...(input.reasoning !== undefined ? { reasoning: input.reasoning } : {}),
         ...(input.permissionMode !== undefined ? { permissionMode: input.permissionMode } : {}),
         ...(input.disallowedTools !== undefined ? { disallowedTools: input.disallowedTools } : {}),
         ...(input.allowedTools !== undefined ? { allowedTools: input.allowedTools } : {}),
+        ...(input.settingSources !== undefined ? { settingSources: input.settingSources } : {}),
+        ...(input.settings !== undefined ? { settings: input.settings } : {}),
         ...(hasOverlay ? { systemPromptOverlay } : {}),
     };
+    return Object.keys(options).length === 0 ? undefined : options;
 }
 /**
  * **The single dispatch point from a computed system-prompt overlay to its delivery mechanism** —
@@ -2581,7 +2577,7 @@ export async function runPiRpcDispatch(input, deps) {
 }
 export function createAgentExecutor(options) {
     const lifecycle = options.lifecycle;
-    const { getAgentDef: getAgentDefFn, resolveAgentLaunch: resolveAgentLaunchFn, applyAgentLaunchEnv: applyAgentLaunchEnvFn, attachAcpSession: attachAcpSessionFn, attachPiRpcSession: attachPiRpcSessionFn, preparePromptFileForAgent: preparePromptFileForAgentFn, prepareAgentLogFile: prepareAgentLogFileFn, } = resolveAgentRuntimeDeps(options);
+    const { getAgentDef: getAgentDefFn, resolveAgentLaunch: resolveAgentLaunchFn, ensureAgentCapabilities: ensureAgentCapabilitiesFn, applyAgentLaunchEnv: applyAgentLaunchEnvFn, attachAcpSession: attachAcpSessionFn, attachPiRpcSession: attachPiRpcSessionFn, preparePromptFileForAgent: preparePromptFileForAgentFn, prepareAgentLogFile: prepareAgentLogFileFn, } = resolveAgentRuntimeDeps(options);
     const { createCommandInvocation: createCommandInvocationFn, spawn: spawnFn, listProcessSnapshots: listProcessSnapshotsFn, collectProcessTreePids: collectProcessTreePidsFn, stopProcesses: stopProcessesFn, } = resolveProcessDeps(options);
     const { onCleanupFailure: onCleanupFailureFn, bufferedStdoutMaxBytes } = resolveMiscExecutorDeps(options);
     const journal = options.journal;
@@ -2604,6 +2600,13 @@ export function createAgentExecutor(options) {
      * @overallScore 100/100
      */
     async function failBeforeSpawn(runId, code, message) {
+        // The reason goes on the run's own stream before `end`, not only into the thrown error: the
+        // thrown error reaches the server log, while a chat client sees only this stream. Without it
+        // the user got a bare "Run failed". Best-effort: a stream that will not take the event must not
+        // stop the run from finishing.
+        await lifecycle
+            .emit(runId, { event: 'error', data: { message: `The assistant could not start: ${message.replace(/^AgentExecutor:\s*/, '')}` } })
+            .catch(() => undefined);
         await lifecycle.finish({ runId, status: 'failed', code: null, signal: null, resumable: false });
         throw new AgentExecutorError(code, message);
     }
@@ -2660,9 +2663,17 @@ export function createAgentExecutor(options) {
             prompt: imageDelivery.prompt,
             resumeSessionId: preStagingRuntimeContext?.resumeSessionId,
         });
-        const resolvedEnv = resolveRunEnv(input, process.env);
+        // The def's own declared env (e.g. claude's `ENABLE_TOOL_SEARCH=false`) is a default the run's
+        // env can override. Detection already spawns with it (`detection.ts`); without this the run
+        // spawn silently dropped it. Declared by the def itself, so it never widens SEC-001's allowlist.
+        const resolvedEnv = { ...(def.env ?? {}), ...resolveRunEnv(input, process.env) };
         const launch = await resolveLaunch({ runId: input.runId, def, resolvedEnv }, { resolveAgentLaunch: resolveAgentLaunchFn, failBeforeSpawn });
         const spawnEnv = applyAgentLaunchEnvFn({ ...resolvedEnv }, launch);
+        // Fill the def's `--help` capability gate before `buildArgs` reads it. Without this, only a
+        // host that happened to call `detectAgents` in THIS process ever had the gate filled, so e.g.
+        // `claude` never got `--include-partial-messages` (no streamed text). Probes once per binary;
+        // never rejects (a failed probe keeps the safe no-optional-flags baseline).
+        await ensureAgentCapabilitiesFn(def, launch.launchPath, spawnEnv);
         // Stage a promptViaFile def's (grok-build) prompt to a temp file before buildArgs runs — its
         // buildArgs throws without runtimeContext.promptFilePath. A no-op (returns null) for every
         // def without promptViaFile: true (preparePromptFileForAgent's own guard).

package/dist/run-lifecycle.js

@@ -674,7 +674,13 @@ export function createRunLifecycle(input) {
                 throw new Error(`RunLifecycle: cannot emit "${driverInput.event}" on terminal run "${runId}" — drivers must stop emitting once finish() has been called`);
             }
             record.watchdog?.noteActivity();
-            record.slowRunWatchdog?.noteActivity();
+            // The crash watchdog above counts ANY output (the process is alive). The slow-run notice asks
+            // a different question — "has the person seen anything new?" — so only `agent` events count.
+            // A CLI's raw stdout/stderr (e.g. Claude Code's 30 s `tool_progress` heartbeats during a long
+            // tool call) is not rendered, and letting it reset this window meant the notice could never
+            // fire during exactly the long, silent tool calls it exists for.
+            if (driverInput.event === 'agent')
+                record.slowRunWatchdog?.noteActivity();
             return appendEvent(runId, record, driverInput.event, driverInput.data);
         },
         async finish(finishInput) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -38,10 +38,10 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jini-ai/agent-runtime": "0.3.7",
-    "@jini-ai/platform": "0.3.0",
+    "@jini-ai/agent-runtime": "0.3.10",
     "@jini-ai/core": "0.3.1",
-    "@jini-ai/protocol": "0.3.0"
+    "@jini-ai/platform": "0.3.0",
+    "@jini-ai/protocol": "0.3.1"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^2.1.9",

package/dist/artifacts/index.d.ts

@@ -1,14 +0,0 @@
-/**
- * @module artifacts
- *
- * The generic artifact-store kernel port, ported from OD's
- * `apps/daemon/src/artifacts/` (6 files). See `source-map.md` for full
- * per-file provenance and the design decisions behind each generalization.
- */
-export * from './manifest.js';
-export * from './store.js';
-export * from './publication-guard.js';
-export * from './runtime-compat.js';
-export * from './stub-guard.js';
-export * from './text-suppression.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/artifacts/index.js

@@ -1,14 +0,0 @@
-/**
- * @module artifacts
- *
- * The generic artifact-store kernel port, ported from OD's
- * `apps/daemon/src/artifacts/` (6 files). See `source-map.md` for full
- * per-file provenance and the design decisions behind each generalization.
- */
-export * from './manifest.js';
-export * from './store.js';
-export * from './publication-guard.js';
-export * from './runtime-compat.js';
-export * from './stub-guard.js';
-export * from './text-suppression.js';
-//# sourceMappingURL=index.js.map

package/dist/artifacts/manifest.d.ts

@@ -1,90 +0,0 @@
-/**
- * @module artifacts/manifest
- *
- * Generic artifact-manifest validation: bounded-length string checks, path-
- * traversal rejection on `entry`/`primary`/`supportingFiles`, a JSON-size
- * cap on `metadata`, and version/timestamp stamping. Ported from OD's
- * `apps/daemon/src/artifacts/manifest.ts`.
- *
- * De-branded: the origin's `kind`/`renderer` fields were validated against
- * hardcoded `ALLOWED_KINDS`/`ALLOWED_RENDERERS` sets that bake in OD's own
- * artifact taxonomy — including a literal `'design-system'` kind, OD's own
- * product concept, not a generic engine noun. Both sets are now a
- * caller-supplied {@link ArtifactManifestTaxonomy} instead of module
- * constants — a host (like an OD adapter) supplies its own kind/renderer/
- * export vocabulary; the validation *mechanism* (bounded strings, traversal
- * rejection, size caps, version stamping) is what this module owns. `status`
- * (`'streaming' | 'complete' | 'error'`) is kept as a fixed literal union —
- * that's a generic artifact-lifecycle concept, not a product taxonomy.
- */
-export type ArtifactStatus = 'streaming' | 'complete' | 'error';
-/**
- * A host's own artifact-kind/renderer/export vocabulary. The engine treats
- * every value as an opaque string it only bounds-checks and validates
- * membership against — it assigns no meaning to any particular kind name.
- */
-export interface ArtifactManifestTaxonomy {
-    readonly allowedKinds: ReadonlySet<string>;
-    readonly allowedRenderers: ReadonlySet<string>;
-    readonly allowedExports: ReadonlySet<string>;
-}
-/** A taxonomy that accepts nothing — forces a host to supply its own before any manifest can validate. */
-export declare const emptyArtifactManifestTaxonomy: ArtifactManifestTaxonomy;
-export interface ArtifactManifest {
-    readonly version: number;
-    readonly kind: string;
-    readonly title: string;
-    readonly entry: string;
-    readonly renderer: string;
-    readonly status: ArtifactStatus;
-    readonly exports: readonly string[];
-    readonly primary?: string | true;
-    readonly supportingFiles?: readonly string[];
-    readonly createdAt: string;
-    readonly updatedAt: string;
-    /** Generic "what produced or relates to this artifact" reference (OD: a skill id). Opaque to the engine. */
-    readonly sourceContextId?: string;
-    readonly metadata?: Readonly<Record<string, unknown>>;
-}
-type JsonRecord = Record<string, unknown>;
-type ValidationResult = {
-    ok: true;
-    value: ArtifactManifest | null;
-} | {
-    ok: false;
-    error: string;
-};
-export interface ValidateManifestOptions {
-    /** Keep an existing `updatedAt` instead of stamping the current time (used when re-parsing a persisted manifest). */
-    preserveUpdatedAt?: boolean;
-}
-/**
- * Validates a freeform manifest payload against `taxonomy`, returning a
- * sanitized, stamped {@link ArtifactManifest} on success. `manifest == null`
- * is a valid "no manifest supplied" outcome (`{ ok: true, value: null }`) —
- * callers that require a manifest check for `value === null` themselves
- * (see `store.ts`'s `resolveArtifactManifest`).
- */
-export declare function validateArtifactManifestInput(manifest: unknown, entry: unknown, taxonomy: ArtifactManifestTaxonomy, options?: ValidateManifestOptions): ValidationResult;
-/** Normalizes a validated manifest payload into the stamped, canonical {@link ArtifactManifest} shape. */
-export declare function sanitizeManifest(manifest: JsonRecord, entry: string, options?: ValidateManifestOptions): ArtifactManifest;
-/**
- * Re-validates a manifest read back from persistence (e.g. a sidecar file),
- * preserving its original `updatedAt`. Returns `null` on any validation
- * failure or version mismatch/parse error rather than throwing — a corrupt
- * or stale sidecar should degrade to "no manifest", not crash the reader.
- */
-export declare function parsePersistedManifest(raw: string, fallbackEntry: string, taxonomy: ArtifactManifestTaxonomy): ArtifactManifest | null;
-/**
- * Injectable seam for a host's own "what kind of artifact is this path"
- * heuristic (OD: extension-based HTML/deck/markdown/svg inference). The
- * engine has no default beyond "infer nothing" — see
- * {@link noopManifestInferrer} — a host wires in its own file-kind
- * classification (per the task brief: "keep OD's file-kind classification
- * as adapter").
- */
-export type ManifestInferrer = (entry: string) => Partial<ArtifactManifest> | null;
-/** Infers nothing — every create call must supply an explicit manifest. */
-export declare const noopManifestInferrer: ManifestInferrer;
-export {};
-//# sourceMappingURL=manifest.d.ts.map

package/dist/artifacts/manifest.js

@@ -1,229 +0,0 @@
-/**
- * @module artifacts/manifest
- *
- * Generic artifact-manifest validation: bounded-length string checks, path-
- * traversal rejection on `entry`/`primary`/`supportingFiles`, a JSON-size
- * cap on `metadata`, and version/timestamp stamping. Ported from OD's
- * `apps/daemon/src/artifacts/manifest.ts`.
- *
- * De-branded: the origin's `kind`/`renderer` fields were validated against
- * hardcoded `ALLOWED_KINDS`/`ALLOWED_RENDERERS` sets that bake in OD's own
- * artifact taxonomy — including a literal `'design-system'` kind, OD's own
- * product concept, not a generic engine noun. Both sets are now a
- * caller-supplied {@link ArtifactManifestTaxonomy} instead of module
- * constants — a host (like an OD adapter) supplies its own kind/renderer/
- * export vocabulary; the validation *mechanism* (bounded strings, traversal
- * rejection, size caps, version stamping) is what this module owns. `status`
- * (`'streaming' | 'complete' | 'error'`) is kept as a fixed literal union —
- * that's a generic artifact-lifecycle concept, not a product taxonomy.
- */
-const MANIFEST_VERSION = 1;
-const MAX_TITLE_LENGTH = 200;
-const MAX_SOURCE_CONTEXT_ID_LENGTH = 128;
-const MAX_SUPPORTING_FILE_LENGTH = 260;
-const MAX_SUPPORTING_FILES = 128;
-const MAX_METADATA_BYTES = 16 * 1024;
-const ALLOWED_STATUS = new Set(['streaming', 'complete', 'error']);
-/** A taxonomy that accepts nothing — forces a host to supply its own before any manifest can validate. */
-export const emptyArtifactManifestTaxonomy = {
-    allowedKinds: new Set(),
-    allowedRenderers: new Set(),
-    allowedExports: new Set(),
-};
-function isPlainObject(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const proto = Object.getPrototypeOf(value);
-    return proto === Object.prototype || proto === null;
-}
-function validateBoundedString(value, field, maxLen, { allowEmpty = false } = {}) {
-    if (typeof value !== 'string')
-        return `${field} must be a string`;
-    if (!allowEmpty && value.length === 0)
-        return `${field} is required`;
-    if (value.length > maxLen)
-        return `${field} exceeds max length (${maxLen})`;
-    return null;
-}
-function validateSupportingPath(value) {
-    if (typeof value !== 'string')
-        return 'supportingFiles entries must be strings';
-    if (value.length === 0)
-        return 'supportingFiles entries cannot be empty';
-    if (value.length > MAX_SUPPORTING_FILE_LENGTH) {
-        return `supportingFiles entries exceed max length (${MAX_SUPPORTING_FILE_LENGTH})`;
-    }
-    if (/^[A-Za-z]:/.test(value) || value.startsWith('/')) {
-        return 'supportingFiles cannot contain absolute paths';
-    }
-    if (value.includes('\u0000'))
-        return 'supportingFiles cannot contain null bytes';
-    const normalized = value.replace(/\\/g, '/');
-    if (normalized.includes('..'))
-        return 'supportingFiles cannot contain traversal segments';
-    const parts = normalized.split('/').filter(Boolean);
-    if (parts.length === 0 || parts.some((p) => p === '.' || p === '..')) {
-        return 'supportingFiles cannot contain traversal segments';
-    }
-    return null;
-}
-/**
- * Validates a freeform manifest payload against `taxonomy`, returning a
- * sanitized, stamped {@link ArtifactManifest} on success. `manifest == null`
- * is a valid "no manifest supplied" outcome (`{ ok: true, value: null }`) —
- * callers that require a manifest check for `value === null` themselves
- * (see `store.ts`'s `resolveArtifactManifest`).
- */
-export function validateArtifactManifestInput(manifest, entry, taxonomy, options = {}) {
-    if (manifest == null)
-        return { ok: true, value: null };
-    if (!isPlainObject(manifest)) {
-        return { ok: false, error: 'artifactManifest must be an object' };
-    }
-    const kindErr = validateBoundedString(manifest.kind, 'artifactManifest.kind', 64);
-    if (kindErr)
-        return { ok: false, error: kindErr };
-    // Cast, not a runtime guard: validateBoundedString's first check is
-    // `typeof value !== 'string'`, which already returned above for any
-    // non-string `kind` — this only narrows the type for `taxonomy.allowedKinds.has`.
-    if (!taxonomy.allowedKinds.has(manifest.kind)) {
-        return { ok: false, error: 'artifactManifest.kind is not allowed' };
-    }
-    const rendererErr = validateBoundedString(manifest.renderer, 'artifactManifest.renderer', 64);
-    if (rendererErr)
-        return { ok: false, error: rendererErr };
-    // Same reasoning as `kind` above.
-    if (!taxonomy.allowedRenderers.has(manifest.renderer)) {
-        return { ok: false, error: 'artifactManifest.renderer is not allowed' };
-    }
-    if (!Array.isArray(manifest.exports) || manifest.exports.length === 0) {
-        return { ok: false, error: 'artifactManifest.exports must be a non-empty array' };
-    }
-    for (const exp of manifest.exports) {
-        if (typeof exp !== 'string') {
-            return { ok: false, error: 'artifactManifest.exports must contain strings' };
-        }
-        if (!taxonomy.allowedExports.has(exp)) {
-            return { ok: false, error: `artifactManifest.exports contains unsupported value: ${exp}` };
-        }
-    }
-    if (manifest.status !== undefined) {
-        if (typeof manifest.status !== 'string') {
-            return { ok: false, error: 'artifactManifest.status must be a string' };
-        }
-        if (!ALLOWED_STATUS.has(manifest.status)) {
-            return { ok: false, error: 'artifactManifest.status is not allowed' };
-        }
-    }
-    if (manifest.primary !== undefined) {
-        if (manifest.primary !== true) {
-            const primaryErr = validateSupportingPath(manifest.primary);
-            if (primaryErr)
-                return { ok: false, error: `artifactManifest.primary ${primaryErr}` };
-        }
-    }
-    if (manifest.supportingFiles !== undefined) {
-        if (!Array.isArray(manifest.supportingFiles)) {
-            return { ok: false, error: 'artifactManifest.supportingFiles must be an array' };
-        }
-        if (manifest.supportingFiles.length > MAX_SUPPORTING_FILES) {
-            return {
-                ok: false,
-                error: `artifactManifest.supportingFiles exceeds max items (${MAX_SUPPORTING_FILES})`,
-            };
-        }
-        for (const rel of manifest.supportingFiles) {
-            const relErr = validateSupportingPath(rel);
-            if (relErr)
-                return { ok: false, error: relErr };
-        }
-    }
-    if (manifest.title !== undefined) {
-        const titleErr = validateBoundedString(manifest.title, 'artifactManifest.title', MAX_TITLE_LENGTH, {
-            allowEmpty: false,
-        });
-        if (titleErr)
-            return { ok: false, error: titleErr };
-    }
-    if (manifest.sourceContextId !== undefined) {
-        const sourceErr = validateBoundedString(manifest.sourceContextId, 'artifactManifest.sourceContextId', MAX_SOURCE_CONTEXT_ID_LENGTH, { allowEmpty: true });
-        if (sourceErr)
-            return { ok: false, error: sourceErr };
-    }
-    if (manifest.metadata !== undefined) {
-        if (!isPlainObject(manifest.metadata)) {
-            return { ok: false, error: 'artifactManifest.metadata must be a plain object' };
-        }
-        // JSON.stringify always returns a string (never undefined) when called
-        // directly on a plain object — undefined-return only happens when the
-        // top-level argument itself is a function/symbol/undefined, which
-        // isPlainObject above already rejected.
-        const serialized = JSON.stringify(manifest.metadata);
-        if (Buffer.byteLength(serialized, 'utf8') > MAX_METADATA_BYTES) {
-            return {
-                ok: false,
-                error: `artifactManifest.metadata exceeds max size (${MAX_METADATA_BYTES} bytes)`,
-            };
-        }
-    }
-    const manifestEntry = typeof manifest.entry === 'string' && manifest.entry.trim() ? manifest.entry.trim() : entry;
-    const entryErr = validateSupportingPath(manifestEntry);
-    if (entryErr) {
-        return { ok: false, error: `artifactManifest.entry ${entryErr}` };
-    }
-    const safeEntry = manifestEntry.replace(/\\/g, '/');
-    return { ok: true, value: sanitizeManifest(manifest, safeEntry, options) };
-}
-/** Normalizes a validated manifest payload into the stamped, canonical {@link ArtifactManifest} shape. */
-export function sanitizeManifest(manifest, entry, options = {}) {
-    const now = new Date().toISOString();
-    const supportingFiles = Array.isArray(manifest.supportingFiles)
-        ? manifest.supportingFiles.map((x) => String(x).replace(/\\/g, '/'))
-        : undefined;
-    const primary = manifest.primary === true
-        ? true
-        : typeof manifest.primary === 'string'
-            ? manifest.primary.replace(/\\/g, '/')
-            : undefined;
-    return {
-        version: MANIFEST_VERSION,
-        kind: manifest.kind,
-        title: manifest.title || entry,
-        entry,
-        renderer: manifest.renderer,
-        status: typeof manifest.status === 'string' && ALLOWED_STATUS.has(manifest.status)
-            ? manifest.status
-            : 'complete',
-        exports: manifest.exports,
-        ...(primary !== undefined ? { primary } : {}),
-        ...(supportingFiles !== undefined ? { supportingFiles } : {}),
-        createdAt: typeof manifest.createdAt === 'string' ? manifest.createdAt : now,
-        updatedAt: options.preserveUpdatedAt && typeof manifest.updatedAt === 'string'
-            ? manifest.updatedAt
-            : now,
-        ...(manifest.sourceContextId !== undefined ? { sourceContextId: manifest.sourceContextId } : {}),
-        ...(manifest.metadata !== undefined ? { metadata: manifest.metadata } : {}),
-    };
-}
-/**
- * Re-validates a manifest read back from persistence (e.g. a sidecar file),
- * preserving its original `updatedAt`. Returns `null` on any validation
- * failure or version mismatch/parse error rather than throwing — a corrupt
- * or stale sidecar should degrade to "no manifest", not crash the reader.
- */
-export function parsePersistedManifest(raw, fallbackEntry, taxonomy) {
-    try {
-        const parsed = JSON.parse(raw);
-        if (!isPlainObject(parsed) || parsed.version !== MANIFEST_VERSION)
-            return null;
-        const entry = typeof parsed.entry === 'string' && parsed.entry ? parsed.entry : fallbackEntry;
-        const result = validateArtifactManifestInput(parsed, entry, taxonomy, { preserveUpdatedAt: true });
-        return result.ok ? result.value : null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Infers nothing — every create call must supply an explicit manifest. */
-export const noopManifestInferrer = () => null;
-//# sourceMappingURL=manifest.js.map

package/dist/artifacts/publication-guard.d.ts

@@ -1,28 +0,0 @@
-export declare const ARTIFACT_PUBLICATION_BLOCKED_CODE: "ARTIFACT_PUBLICATION_BLOCKED";
-export interface PublicationGuardConfig {
-    /** Artifact kinds this guard scans. A kind not in this set is never blocked, whatever its content. */
-    readonly guardedKinds: ReadonlySet<string>;
-    /** Substrings that mark an artifact as containing an unresolved placeholder. Matching is case-sensitive. */
-    readonly blockedPlaceholders: readonly string[];
-}
-/** A guard that blocks nothing — no guarded kinds, no placeholder markers configured. */
-export declare const emptyPublicationGuardConfig: PublicationGuardConfig;
-export declare class ArtifactPublicationBlockedError extends Error {
-    readonly code: "ARTIFACT_PUBLICATION_BLOCKED";
-    readonly placeholders: readonly string[];
-    constructor(placeholders: readonly string[]);
-}
-export declare function isPublicationGuardedKind(kind: unknown, config: PublicationGuardConfig): boolean;
-/** Returns every configured placeholder marker found in `value`'s stringified content, in declaration order. */
-export declare function findBlockedPlaceholders(value: unknown, config: PublicationGuardConfig): string[];
-export declare function shouldBlockPublication(value: unknown, config: PublicationGuardConfig): boolean;
-export declare function buildArtifactPublicationBlockedMessage(placeholders: readonly string[]): string;
-/**
- * Throws {@link ArtifactPublicationBlockedError} when `value` (for a
- * `kind` in `config.guardedKinds`) contains any of `config.blockedPlaceholders`.
- * No-ops for a kind outside `config.guardedKinds` — a guard scoped to
- * user-facing rendered documents shouldn't reject content in other kinds
- * where the same substrings could be legitimate.
- */
-export declare function assertArtifactPublicationAllowed(kind: unknown, value: unknown, config: PublicationGuardConfig): void;
-//# sourceMappingURL=publication-guard.d.ts.map

package/dist/artifacts/publication-guard.js

@@ -1,77 +0,0 @@
-/**
- * @module artifacts/publication-guard
- *
- * A pre-publish content guard: blocks an artifact write when its body
- * contains a caller-declared "unresolved placeholder" marker, scoped to a
- * caller-declared set of guarded kinds. Ported from OD's
- * `apps/daemon/src/artifacts/publication-guard.ts`.
- *
- * De-branded: the origin hardcoded `UNRESOLVED_ARTIFACT_PLACEHOLDERS` — five
- * literal strings ("Name to confirm", "$X.XM", ...) lifted from one specific
- * bundled example template's pitch-deck fill-in-the-blank convention — and
- * `PUBLICATION_GUARDED_ARTIFACT_KINDS = {'html', 'deck'}`. Both are entirely
- * OD's own content, not a generic engine mechanism, so this module now takes
- * a caller-supplied {@link PublicationGuardConfig} (empty by default — a
- * guard that never blocks anything until a host configures it) instead of
- * baking in that one template's marker strings. The guard *mechanism*
- * (scan a guarded-kind body for any configured marker, throw before
- * publish) is what this module owns.
- */
-import { Buffer } from 'node:buffer';
-export const ARTIFACT_PUBLICATION_BLOCKED_CODE = 'ARTIFACT_PUBLICATION_BLOCKED';
-/** A guard that blocks nothing — no guarded kinds, no placeholder markers configured. */
-export const emptyPublicationGuardConfig = {
-    guardedKinds: new Set(),
-    blockedPlaceholders: [],
-};
-export class ArtifactPublicationBlockedError extends Error {
-    code = ARTIFACT_PUBLICATION_BLOCKED_CODE;
-    placeholders;
-    constructor(placeholders) {
-        super(buildArtifactPublicationBlockedMessage(placeholders));
-        this.name = 'ArtifactPublicationBlockedError';
-        this.placeholders = [...placeholders];
-    }
-}
-export function isPublicationGuardedKind(kind, config) {
-    return typeof kind === 'string' && config.guardedKinds.has(kind);
-}
-function stringifyArtifactContent(value) {
-    if (typeof value === 'string')
-        return value;
-    if (Buffer.isBuffer(value))
-        return value.toString('utf8');
-    if (value instanceof Uint8Array)
-        return Buffer.from(value).toString('utf8');
-    return '';
-}
-/** Returns every configured placeholder marker found in `value`'s stringified content, in declaration order. */
-export function findBlockedPlaceholders(value, config) {
-    const text = stringifyArtifactContent(value);
-    if (!text)
-        return [];
-    return config.blockedPlaceholders.filter((placeholder) => text.includes(placeholder));
-}
-export function shouldBlockPublication(value, config) {
-    return findBlockedPlaceholders(value, config).length > 0;
-}
-export function buildArtifactPublicationBlockedMessage(placeholders) {
-    const list = placeholders.length > 0 ? placeholders.join(', ') : 'unknown placeholders';
-    return `Artifact still contains unresolved placeholders: ${list}. Resolve them before publishing.`;
-}
-/**
- * Throws {@link ArtifactPublicationBlockedError} when `value` (for a
- * `kind` in `config.guardedKinds`) contains any of `config.blockedPlaceholders`.
- * No-ops for a kind outside `config.guardedKinds` — a guard scoped to
- * user-facing rendered documents shouldn't reject content in other kinds
- * where the same substrings could be legitimate.
- */
-export function assertArtifactPublicationAllowed(kind, value, config) {
-    if (!isPublicationGuardedKind(kind, config))
-        return;
-    const placeholders = findBlockedPlaceholders(value, config);
-    if (placeholders.length > 0) {
-        throw new ArtifactPublicationBlockedError(placeholders);
-    }
-}
-//# sourceMappingURL=publication-guard.js.map