@nebutra/agent-runtime 0.2.0 → 0.2.1

package/src/pulsar.ts

@@ -0,0 +1,322 @@
+import { type ApprovalGate, type ModelInvoker, runTurn } from "./loop";
+import type { ThreadEvent, ThreadItem, TurnConfig } from "./model";
+import { isTurnTerminal } from "./model";
+import type { ApprovalPolicy } from "./policy";
+import { DEFAULT_APPROVAL_POLICY } from "./policy";
+import type { RolloutLine, RolloutStore } from "./rollout";
+import { replay } from "./rollout";
+import { RuntimeToolRegistry } from "./tools";
+
+type EventLogKind = "llm_call" | "tool_call" | "sub_agent_call" | "content_write";
+
+export interface PulsarEventInput {
+  readonly traceId: string;
+  readonly kind: EventLogKind;
+  readonly affected: readonly string[];
+  readonly parent: string | null;
+  readonly snapshot?: Record<string, string>;
+}
+
+export interface PulsarBranchRecord {
+  readonly name: string;
+  readonly from: string;
+  readonly at: string;
+}
+
+export interface PulsarEventLogPort {
+  commit(event: PulsarEventInput): Promise<string>;
+  branchFrom(id: string, name: string): Promise<PulsarBranchRecord>;
+}
+
+export interface StartThreadOptions {
+  readonly threadId?: string;
+  readonly maxSteps?: number;
+}
+
+export interface PulsarDeps {
+  readonly tenantId: string;
+  readonly config: TurnConfig;
+  readonly model: ModelInvoker;
+  readonly tools: RuntimeToolRegistry;
+  readonly store: RolloutStore;
+  readonly approvalGate: ApprovalGate;
+  readonly approvalPolicy: ApprovalPolicy;
+  readonly eventLog?: PulsarEventLogPort;
+}
+
+function newId(prefix: string): string {
+  return `${prefix}_${globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`}`;
+}
+
+function requireNonEmpty(value: string, label: string): string {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    throw new Error(`${label} is required. Suggestion: pass a non-empty ${label}.`);
+  }
+  return trimmed;
+}
+
+function recordedEvents(lines: readonly RolloutLine[]): ThreadEvent[] {
+  return lines.flatMap((line) => (line.type === "event" ? [line.event] : []));
+}
+
+function mapItemToEvent(item: ThreadItem): PulsarEventInput["kind"] {
+  switch (item.type) {
+    case "agent_message":
+    case "reasoning":
+      return "llm_call";
+    case "file_change":
+      return "content_write";
+    case "command_execution":
+    case "mcp_tool_call":
+      return "tool_call";
+    case "error":
+    case "todo_list":
+    case "web_search":
+      return "tool_call";
+  }
+}
+
+function affectedPaths(item: ThreadItem): readonly string[] {
+  return item.type === "file_change" ? item.changes.map((change) => change.path) : [];
+}
+
+export class PulsarThread {
+  readonly id: string;
+  readonly playId: string;
+  readonly tenantId: string;
+  readonly #deps: PulsarDeps;
+  readonly #input: string;
+  readonly #maxSteps: number | undefined;
+  readonly #mode: "start" | "resume";
+  #events: ThreadEvent[] | undefined;
+
+  constructor(input: {
+    readonly id: string;
+    readonly playId: string;
+    readonly tenantId: string;
+    readonly deps: PulsarDeps;
+    readonly mode: "start" | "resume";
+    readonly userInput: string;
+    readonly maxSteps?: number;
+  }) {
+    this.id = input.id;
+    this.playId = input.playId;
+    this.tenantId = input.tenantId;
+    this.#deps = input.deps;
+    this.#input = input.userInput;
+    this.#mode = input.mode;
+    this.#maxSteps = input.maxSteps;
+  }
+
+  async *subscribe(): AsyncGenerator<ThreadEvent> {
+    if (this.#events) {
+      for (const event of this.#events) yield event;
+      return;
+    }
+
+    const events: ThreadEvent[] = [];
+    const emit = async (event: ThreadEvent): Promise<ThreadEvent> => {
+      events.push(event);
+      if (event.type === "item.completed") {
+        await this.#mirrorItem(event.item);
+      }
+      return event;
+    };
+
+    if (this.#mode === "resume") {
+      const lines = await this.#deps.store.read(this.tenantId, this.id);
+      const projection = replay(lines);
+      const recorded = recordedEvents(lines);
+      const last = recorded.at(-1);
+      if (projection && last && isTurnTerminal(last)) {
+        this.#events = recorded;
+        for (const event of recorded) yield event;
+        return;
+      }
+    }
+
+    yield await emit({ type: "thread.started", threadId: this.id });
+    await this.#deps.store.append({
+      tenantId: this.tenantId,
+      threadId: this.id,
+      type: "event",
+      event: { type: "thread.started", threadId: this.id },
+      at: new Date().toISOString(),
+    });
+
+    const stream = runTurn(this.#input, {
+      tenantId: this.tenantId,
+      threadId: this.id,
+      config: this.#deps.config,
+      approvalPolicy: this.#deps.approvalPolicy,
+      model: this.#deps.model,
+      tools: this.#deps.tools,
+      store: this.#deps.store,
+      approvalGate: this.#deps.approvalGate,
+      ruleEvaluator: () => "allow",
+      ...(this.#maxSteps !== undefined ? { maxSteps: this.#maxSteps } : {}),
+    });
+
+    for await (const event of stream) {
+      yield await emit(event);
+    }
+    this.#events = events;
+  }
+
+  async #mirrorItem(item: ThreadItem): Promise<void> {
+    const eventLog = this.#deps.eventLog;
+    if (!eventLog) return;
+    const parent = Pulsar.itemCommitIds.get(`${this.id}::__last`) ?? null;
+    const commitId = await eventLog.commit({
+      traceId: this.id,
+      kind: mapItemToEvent(item),
+      affected: affectedPaths(item),
+      parent,
+    });
+    Pulsar.itemCommitIds.set(`${this.id}:${item.id}`, commitId);
+    Pulsar.itemCommitIds.set(`${this.id}::__last`, commitId);
+  }
+}
+
+export class PulsarBuilder {
+  #tenantId?: string;
+  #config?: TurnConfig;
+  #model?: ModelInvoker;
+  #tools: RuntimeToolRegistry = new RuntimeToolRegistry();
+  #store?: RolloutStore;
+  #approvalGate?: ApprovalGate;
+  #approvalPolicy: ApprovalPolicy = DEFAULT_APPROVAL_POLICY;
+  #eventLog?: PulsarEventLogPort;
+
+  withTenant(tenantId: string): this {
+    this.#tenantId = requireNonEmpty(tenantId, "tenantId");
+    return this;
+  }
+
+  withConfig(config: TurnConfig): this {
+    this.#config = config;
+    return this;
+  }
+
+  withModel(model: ModelInvoker): this {
+    this.#model = model;
+    return this;
+  }
+
+  withTools(tools: RuntimeToolRegistry): this {
+    this.#tools = tools;
+    return this;
+  }
+
+  withRolloutStore(store: RolloutStore): this {
+    this.#store = store;
+    return this;
+  }
+
+  withApprovalGate(approvalGate: ApprovalGate): this {
+    this.#approvalGate = approvalGate;
+    return this;
+  }
+
+  withApprovalPolicy(policy: ApprovalPolicy): this {
+    this.#approvalPolicy = policy;
+    return this;
+  }
+
+  withEventLog(eventLog: PulsarEventLogPort): this {
+    this.#eventLog = eventLog;
+    return this;
+  }
+
+  build(): Pulsar {
+    if (!this.#tenantId) throw new Error("tenantId is required. Suggestion: call withTenant().");
+    if (!this.#config) throw new Error("config is required. Suggestion: call withConfig().");
+    if (!this.#model) throw new Error("model is required. Suggestion: call withModel().");
+    if (!this.#store) {
+      throw new Error("rollout store is required. Suggestion: call withRolloutStore().");
+    }
+    if (!this.#approvalGate) {
+      throw new Error("approval gate is required. Suggestion: call withApprovalGate().");
+    }
+    const deps: PulsarDeps = {
+      tenantId: this.#tenantId,
+      config: this.#config,
+      model: this.#model,
+      tools: this.#tools,
+      store: this.#store,
+      approvalGate: this.#approvalGate,
+      approvalPolicy: this.#approvalPolicy,
+      ...(this.#eventLog !== undefined ? { eventLog: this.#eventLog } : {}),
+    };
+    return new Pulsar(deps);
+  }
+}
+
+export class Pulsar {
+  static readonly itemCommitIds = new Map<string, string>();
+  readonly #deps: PulsarDeps;
+
+  constructor(deps: PulsarDeps) {
+    this.#deps = deps;
+  }
+
+  static builder(): PulsarBuilder {
+    return new PulsarBuilder();
+  }
+
+  async startPlay(
+    playId: string,
+    input: string,
+    options: StartThreadOptions = {},
+  ): Promise<PulsarThread> {
+    const threadId = options.threadId ?? newId("thread");
+    await this.#deps.store.append({
+      tenantId: this.#deps.tenantId,
+      threadId,
+      type: "session_meta",
+      config: this.#deps.config,
+      at: new Date().toISOString(),
+    });
+    return new PulsarThread({
+      id: threadId,
+      playId: requireNonEmpty(playId, "playId"),
+      tenantId: this.#deps.tenantId,
+      deps: this.#deps,
+      mode: "start",
+      userInput: input,
+      ...(options.maxSteps !== undefined ? { maxSteps: options.maxSteps } : {}),
+    });
+  }
+
+  async resume(threadId: string): Promise<PulsarThread> {
+    return new PulsarThread({
+      id: requireNonEmpty(threadId, "threadId"),
+      playId: "resume",
+      tenantId: this.#deps.tenantId,
+      deps: this.#deps,
+      mode: "resume",
+      userInput: "",
+    });
+  }
+
+  async branchFromItem(
+    threadId: string,
+    itemId: string,
+    name: string,
+  ): Promise<PulsarBranchRecord> {
+    const eventLog = this.#deps.eventLog;
+    if (!eventLog) {
+      throw new Error("event-log is required. Suggestion: call withEventLog() before branching.");
+    }
+    const commitId = Pulsar.itemCommitIds.get(
+      `${requireNonEmpty(threadId, "threadId")}:${requireNonEmpty(itemId, "itemId")}`,
+    );
+    if (!commitId) {
+      throw new Error(
+        "item has no event-log commit. Suggestion: subscribe to the thread before branching.",
+      );
+    }
+    return eventLog.branchFrom(commitId, requireNonEmpty(name, "branch name"));
+  }
+}

package/src/skills.ts

@@ -25,6 +25,7 @@
  * — no host filesystem access (resource base is an injected indirection).
  */
 
+import { estimateTokens as estimatePrimitiveTokens } from "@nebutra/ai-primitives";
 import { z } from "zod";
 import {
   type Definition,
@@ -38,9 +39,33 @@ export type SkillRecord = Definition;
 
 /** Tiers treated as first-party (never truncated, never dropped). */
 const FIRST_PARTY_TIERS: ReadonlySet<string> = new Set(["bundled", "builtin"]);
+const REGEX_META_CHARS = new Set([
+  ".",
+  "+",
+  "?",
+  "^",
+  "$",
+  "{",
+  "}",
+  "(",
+  ")",
+  "|",
+  "[",
+  "]",
+  "\\",
+]);
 
 const isFirstParty = (s: SkillRecord): boolean => FIRST_PARTY_TIERS.has(s.sourceTier);
 
+/**
+ * Listing budgets preserve the catalog degradation contract: very tight lower-
+ * tier budgets should still degrade to names-only before dropping. Context
+ * compaction uses the corrected 1.3 estimate; this listing surface deliberately
+ * uses the shared primitive with no correction.
+ */
+const estimateListingTokens = (text: string): number =>
+  estimatePrimitiveTokens(text, { correction: 1 });
+
 // ── Phase 1: listing ─────────────────────────────────────────────────────────
 
 /** One catalog entry — only the cheap, always-in-context surface. */
@@ -66,14 +91,11 @@ const listingOptionsSchema = z.object({
 });
 export type SkillListingOptions = z.input<typeof listingOptionsSchema>;
 
-/** Cheap, deterministic token estimate (≈4 chars/token). */
-const estimateTokens = (text: string): number => Math.ceil(text.length / 4);
-
 /** Minimal glob: `**` = any chars, `*` = any chars except `/`, else exact. */
 function globToRegExp(glob: string): RegExp {
   let out = "^";
   for (let i = 0; i < glob.length; i++) {
-    const c = glob[i]!;
+    const c = glob.charAt(i);
     if (c === "*") {
       if (glob[i + 1] === "*") {
         out += ".*";
@@ -81,7 +103,7 @@ function globToRegExp(glob: string): RegExp {
       } else {
         out += "[^/]*";
       }
-    } else if (".+?^${}()|[]\\".includes(c)) {
+    } else if (REGEX_META_CHARS.has(c)) {
       out += `\\${c}`;
     } else {
       out += c;
@@ -158,7 +180,7 @@ export function buildSkillListing(
         firstParty: true,
       };
       entries.push(entry);
-      used += estimateTokens(renderEntry(entry));
+      used += estimateListingTokens(renderEntry(entry));
       continue;
     }
 
@@ -169,7 +191,7 @@ export function buildSkillListing(
       degraded: false,
       firstParty: false,
     };
-    const fullCost = estimateTokens(renderEntry(full));
+    const fullCost = estimateListingTokens(renderEntry(full));
     if (used + fullCost <= budget) {
       entries.push(full);
       used += fullCost;
@@ -183,7 +205,7 @@ export function buildSkillListing(
       degraded: true,
       firstParty: false,
     };
-    const nameCost = estimateTokens(renderEntry(nameOnly));
+    const nameCost = estimateListingTokens(renderEntry(nameOnly));
     if (used + nameCost <= budget) {
       entries.push(nameOnly);
       used += nameCost;

package/src/tools.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest";
+import { RuntimeToolRegistry, ToolRegistry } from "./tools";
+
+describe("runtime tool registry naming", () => {
+  it("uses RuntimeToolRegistry as the canonical dispatcher name while preserving ToolRegistry compatibility", () => {
+    const runtimeRegistry = new RuntimeToolRegistry();
+    const compatRegistry = new ToolRegistry();
+
+    expect(runtimeRegistry).toBeInstanceOf(RuntimeToolRegistry);
+    expect(compatRegistry).toBeInstanceOf(RuntimeToolRegistry);
+  });
+});

package/src/tools.ts

@@ -52,10 +52,10 @@ export interface ToolHooks {
 }
 
 /**
- * registry -> router -> orchestrator pipeline. MCP tools register via
+ * runtime registry -> router -> orchestrator pipeline. MCP tools register via
  * {@link adaptMcpTool} and are dispatched identically to native tools.
  */
-export class ToolRegistry {
+export class RuntimeToolRegistry {
   readonly #tools = new Map<string, { reg: RegisteredTool; handler: ToolHandler }>();
   readonly #hooks: ToolHooks;
 
@@ -95,6 +95,9 @@ export class ToolRegistry {
   }
 }
 
+/** @deprecated Use RuntimeToolRegistry for new code. */
+export { RuntimeToolRegistry as ToolRegistry };
+
 /** Minimal shape of an MCP client (satisfied by `@nebutra/mcp`'s `mcpClient`). */
 export interface McpClientLike {
   executeTool(

package/tsup.config.ts

@@ -8,6 +8,7 @@ export default defineConfig({
     "adapters/mcp-catalog": "src/adapters/mcp-catalog.ts",
     "adapters/prisma-rollout": "src/adapters/prisma-rollout.ts",
     commands: "src/commands.ts",
+    cli: "src/cli.ts",
     definitions: "src/definitions.ts",
     dispatcher: "src/dispatcher.ts",
     "durable-turn": "src/durable-turn.ts",
@@ -15,8 +16,10 @@ export default defineConfig({
     loop: "src/loop.ts",
     "mcp-bridge": "src/mcp-bridge.ts",
     model: "src/model.ts",
+    orchestration: "src/orchestration.ts",
     policy: "src/policy.ts",
     protocol: "src/protocol.ts",
+    pulsar: "src/pulsar.ts",
     rollout: "src/rollout.ts",
     "rollout-store-persistent": "src/rollout-store-persistent.ts",
     sandbox: "src/sandbox.ts",
@@ -29,5 +32,5 @@ export default defineConfig({
   clean: true,
   sourcemap: true,
   target: "es2022",
-  external: ["@nebutra/mcp"],
+  external: ["@nebutra/execution-policy", "@nebutra/mcp"],
 });

package/dist/chunk-BJBBR3QA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/loop.ts"],"sourcesContent":["/**\n * Agent loop runner (WRAP — the turn engine).\n *\n * Faithful re-expression of the upstream loop: a turn is\n * `loop { model_call → emit items → execute tools → feed results back }`\n * until the model stops requesting tools or a bounded step ceiling is hit.\n * Single-threaded (Cognition teaching: shared context, no conflicting\n * sub-agent decisions). Every item is appended to the tenant-scoped rollout\n * as it reaches a terminal state, so the turn is resumable by replay.\n *\n * The model call is abstracted behind {@link ModelInvoker} so this WRAPs an\n * existing model stack (e.g. `@nebutra/agents`) rather than re-porting\n * provider/routing/fallback. No untrusted code runs here — command items are\n * dispatched through the tool registry / external-sandbox seam.\n */\n\nimport type { AgentMessageItem, ThreadEvent, ThreadItem, TurnConfig, TurnUsage } from \"./model\";\nimport {\n  type ApprovalPolicy,\n  DENIED,\n  isApproval,\n  type ReviewDecision,\n  type RuleDecision,\n  resolveRuleDecision,\n} from \"./policy\";\nimport type { ServerRequest } from \"./protocol\";\nimport { type RolloutLine, type RolloutStore, sanitizeForPersist } from \"./rollout\";\nimport type { ToolDispatchContext, ToolRegistry } from \"./tools\";\n\n/** A single thing the model emitted in one round. */\nexport type ModelEmission =\n  | { readonly kind: \"text\"; readonly text: string }\n  | {\n      readonly kind: \"tool_call\";\n      readonly id: string;\n      readonly name: string;\n      readonly args: unknown;\n    };\n\nexport interface ModelRoundResult {\n  readonly emissions: readonly ModelEmission[];\n  readonly usage?: Partial<TurnUsage>;\n}\n\nexport interface ModelRoundRequest {\n  readonly config: TurnConfig;\n  /** Running transcript: user input, agent text, and tool results. */\n  readonly history: readonly { readonly role: string; readonly content: string }[];\n  readonly toolNames: readonly string[];\n}\n\n/** Abstracts the model stack — implement over `@nebutra/agents`, etc. */\nexport interface ModelInvoker {\n  invoke(request: ModelRoundRequest): Promise<ModelRoundResult>;\n}\n\n/** Server-initiated approval transport (see {@link ServerRequest}). */\nexport interface ApprovalGate {\n  request(serverRequest: ServerRequest): Promise<ReviewDecision>;\n}\n\n/** Classifies a tool call into a static rule decision before approval. */\nexport type RuleEvaluator = (toolName: string, args: unknown) => RuleDecision;\n\nexport interface RunTurnDeps {\n  readonly tenantId: string;\n  readonly threadId: string;\n  readonly config: TurnConfig;\n  readonly approvalPolicy: ApprovalPolicy;\n  readonly model: ModelInvoker;\n  readonly tools: ToolRegistry;\n  readonly store: RolloutStore;\n  readonly approvalGate: ApprovalGate;\n  /** Defaults to: everything requires a prompt (safe). */\n  readonly ruleEvaluator?: RuleEvaluator;\n  /** Bounded steps (parity with upstream step ceiling). Default 20. */\n  readonly maxSteps?: number;\n}\n\nconst DEFAULT_MAX_STEPS = 20;\nconst requirePrompt: RuleEvaluator = () => \"prompt\";\n\nfunction newId(prefix: string): string {\n  return `${prefix}_${globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`}`;\n}\n\n/**\n * Drive one turn to completion. Yields the {@link ThreadEvent} stream and\n * appends each terminal item + the turn outcome to the rollout store.\n * Never throws to the caller — failures surface as a `turn.failed` event.\n */\nexport async function* runTurn(userInput: string, deps: RunTurnDeps): AsyncGenerator<ThreadEvent> {\n  const at = () => new Date().toISOString();\n  const ruleEvaluator = deps.ruleEvaluator ?? requirePrompt;\n  const maxSteps = deps.maxSteps ?? DEFAULT_MAX_STEPS;\n  const ctx: ToolDispatchContext = { tenantId: deps.tenantId, threadId: deps.threadId };\n\n  const append = async (line: RolloutLine): Promise<void> => deps.store.append(line);\n  const event = async (e: ThreadEvent): Promise<ThreadEvent> => {\n    await append({\n      tenantId: deps.tenantId,\n      threadId: deps.threadId,\n      type: \"event\",\n      event:\n        e.type === \"item.completed\"\n          ? { type: \"item.completed\", item: sanitizeForPersist(e.item) }\n          : e,\n      at: at(),\n    });\n    return e;\n  };\n\n  yield await event({ type: \"turn.started\" });\n\n  const history: { role: string; content: string }[] = [{ role: \"user\", content: userInput }];\n  let usage: TurnUsage = {\n    inputTokens: 0,\n    cachedInputTokens: 0,\n    outputTokens: 0,\n    reasoningOutputTokens: 0,\n  };\n\n  try {\n    for (let step = 0; step < maxSteps; step++) {\n      const round = await deps.model.invoke({\n        config: deps.config,\n        history,\n        toolNames: deps.tools.list().map((t) => t.definition.name),\n      });\n      if (round.usage) {\n        const u = round.usage;\n        usage = {\n          inputTokens: usage.inputTokens + (u.inputTokens ?? 0),\n          cachedInputTokens: usage.cachedInputTokens + (u.cachedInputTokens ?? 0),\n          outputTokens: usage.outputTokens + (u.outputTokens ?? 0),\n          reasoningOutputTokens: usage.reasoningOutputTokens + (u.reasoningOutputTokens ?? 0),\n        };\n      }\n\n      const toolCalls = round.emissions.filter(\n        (e): e is Extract<ModelEmission, { kind: \"tool_call\" }> => e.kind === \"tool_call\",\n      );\n\n      for (const e of round.emissions) {\n        if (e.kind !== \"text\") continue;\n        const item: AgentMessageItem = { id: newId(\"msg\"), type: \"agent_message\", text: e.text };\n        history.push({ role: \"assistant\", content: e.text });\n        yield await event({ type: \"item.completed\", item });\n      }\n\n      if (toolCalls.length === 0) break; // model is done\n\n      for (const call of toolCalls) {\n        const decision = await gateToolCall(call.name, call.args, deps, ruleEvaluator);\n        if (!isApproval(decision)) {\n          const failed: ThreadItem = {\n            id: call.id,\n            type: \"error\",\n            message: `tool '${call.name}' not approved (${decision.kind})`,\n          };\n          history.push({ role: \"tool\", content: `DENIED: ${call.name}` });\n          yield await event({ type: \"item.completed\", item: failed });\n          continue;\n        }\n        try {\n          const output = await deps.tools.dispatch(call.name, call.args, ctx);\n          const item: ThreadItem = {\n            id: call.id,\n            type: \"mcp_tool_call\",\n            server: \"native\",\n            tool: call.name,\n            arguments: call.args,\n            result: { content: output },\n            status: \"completed\",\n          };\n          history.push({ role: \"tool\", content: JSON.stringify(output) });\n          yield await event({ type: \"item.completed\", item });\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err);\n          history.push({ role: \"tool\", content: `ERROR: ${message}` });\n          yield await event({\n            type: \"item.completed\",\n            item: { id: call.id, type: \"error\", message },\n          });\n        }\n      }\n    }\n\n    yield await event({ type: \"turn.completed\", usage });\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err);\n    yield await event({ type: \"turn.failed\", error: { message } });\n  }\n}\n\n/** Resolve a tool call's approval, raising a server-initiated request if asked. */\nasync function gateToolCall(\n  name: string,\n  args: unknown,\n  deps: RunTurnDeps,\n  ruleEvaluator: RuleEvaluator,\n): Promise<ReviewDecision> {\n  const outcome = resolveRuleDecision(ruleEvaluator(name, args), deps.approvalPolicy);\n  if (outcome === \"auto_allow\") return { kind: \"approved\" };\n  if (outcome === \"auto_reject\") return DENIED;\n  return deps.approvalGate.request({\n    type: \"permissions.request_approval\",\n    requestId: newId(\"appr\"),\n    summary: `tool '${name}'`,\n  });\n}\n"],"mappings":";;;;;;;;;;AA+EA,IAAM,oBAAoB;AAC1B,IAAM,gBAA+B,MAAM;AAE3C,SAAS,MAAM,QAAwB;AACrC,SAAO,GAAG,MAAM,IAAI,WAAW,QAAQ,aAAa,KAAK,GAAG,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE;AAC3F;AAOA,gBAAuB,QAAQ,WAAmB,MAAgD;AAChG,QAAM,KAAK,OAAM,oBAAI,KAAK,GAAE,YAAY;AACxC,QAAM,gBAAgB,KAAK,iBAAiB;AAC5C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,MAA2B,EAAE,UAAU,KAAK,UAAU,UAAU,KAAK,SAAS;AAEpF,QAAM,SAAS,OAAO,SAAqC,KAAK,MAAM,OAAO,IAAI;AACjF,QAAM,QAAQ,OAAO,MAAyC;AAC5D,UAAM,OAAO;AAAA,MACX,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,MAAM;AAAA,MACN,OACE,EAAE,SAAS,mBACP,EAAE,MAAM,kBAAkB,MAAM,mBAAmB,EAAE,IAAI,EAAE,IAC3D;AAAA,MACN,IAAI,GAAG;AAAA,IACT,CAAC;AACD,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,EAAE,MAAM,eAAe,CAAC;AAE1C,QAAM,UAA+C,CAAC,EAAE,MAAM,QAAQ,SAAS,UAAU,CAAC;AAC1F,MAAI,QAAmB;AAAA,IACrB,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,uBAAuB;AAAA,EACzB;AAEA,MAAI;AACF,aAAS,OAAO,GAAG,OAAO,UAAU,QAAQ;AAC1C,YAAM,QAAQ,MAAM,KAAK,MAAM,OAAO;AAAA,QACpC,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,WAAW,KAAK,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI;AAAA,MAC3D,CAAC;AACD,UAAI,MAAM,OAAO;AACf,cAAM,IAAI,MAAM;AAChB,gBAAQ;AAAA,UACN,aAAa,MAAM,eAAe,EAAE,eAAe;AAAA,UACnD,mBAAmB,MAAM,qBAAqB,EAAE,qBAAqB;AAAA,UACrE,cAAc,MAAM,gBAAgB,EAAE,gBAAgB;AAAA,UACtD,uBAAuB,MAAM,yBAAyB,EAAE,yBAAyB;AAAA,QACnF;AAAA,MACF;AAEA,YAAM,YAAY,MAAM,UAAU;AAAA,QAChC,CAAC,MAA0D,EAAE,SAAS;AAAA,MACxE;AAEA,iBAAW,KAAK,MAAM,WAAW;AAC/B,YAAI,EAAE,SAAS,OAAQ;AACvB,cAAM,OAAyB,EAAE,IAAI,MAAM,KAAK,GAAG,MAAM,iBAAiB,MAAM,EAAE,KAAK;AACvF,gBAAQ,KAAK,EAAE,MAAM,aAAa,SAAS,EAAE,KAAK,CAAC;AACnD,cAAM,MAAM,MAAM,EAAE,MAAM,kBAAkB,KAAK,CAAC;AAAA,MACpD;AAEA,UAAI,UAAU,WAAW,EAAG;AAE5B,iBAAW,QAAQ,WAAW;AAC5B,cAAM,WAAW,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM,MAAM,aAAa;AAC7E,YAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,gBAAM,SAAqB;AAAA,YACzB,IAAI,KAAK;AAAA,YACT,MAAM;AAAA,YACN,SAAS,SAAS,KAAK,IAAI,mBAAmB,SAAS,IAAI;AAAA,UAC7D;AACA,kBAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,WAAW,KAAK,IAAI,GAAG,CAAC;AAC9D,gBAAM,MAAM,MAAM,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAC1D;AAAA,QACF;AACA,YAAI;AACF,gBAAM,SAAS,MAAM,KAAK,MAAM,SAAS,KAAK,MAAM,KAAK,MAAM,GAAG;AAClE,gBAAM,OAAmB;AAAA,YACvB,IAAI,KAAK;AAAA,YACT,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM,KAAK;AAAA,YACX,WAAW,KAAK;AAAA,YAChB,QAAQ,EAAE,SAAS,OAAO;AAAA,YAC1B,QAAQ;AAAA,UACV;AACA,kBAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,KAAK,UAAU,MAAM,EAAE,CAAC;AAC9D,gBAAM,MAAM,MAAM,EAAE,MAAM,kBAAkB,KAAK,CAAC;AAAA,QACpD,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,kBAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,UAAU,OAAO,GAAG,CAAC;AAC3D,gBAAM,MAAM,MAAM;AAAA,YAChB,MAAM;AAAA,YACN,MAAM,EAAE,IAAI,KAAK,IAAI,MAAM,SAAS,QAAQ;AAAA,UAC9C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,EAAE,MAAM,kBAAkB,MAAM,CAAC;AAAA,EACrD,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,MAAM,MAAM,EAAE,MAAM,eAAe,OAAO,EAAE,QAAQ,EAAE,CAAC;AAAA,EAC/D;AACF;AAGA,eAAe,aACb,MACA,MACA,MACA,eACyB;AACzB,QAAM,UAAU,oBAAoB,cAAc,MAAM,IAAI,GAAG,KAAK,cAAc;AAClF,MAAI,YAAY,aAAc,QAAO,EAAE,MAAM,WAAW;AACxD,MAAI,YAAY,cAAe,QAAO;AACtC,SAAO,KAAK,aAAa,QAAQ;AAAA,IAC/B,MAAM;AAAA,IACN,WAAW,MAAM,MAAM;AAAA,IACvB,SAAS,SAAS,IAAI;AAAA,EACxB,CAAC;AACH;","names":[]}

package/dist/chunk-NN7DATXA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/tools.ts"],"sourcesContent":["/**\n * Tool / MCP abstraction (WRAP — capability #9).\n *\n * Faithful re-expression of the upstream uniform tool model: one\n * `ToolDefinition` interface, JSON-schema in/out, a deferred-load flag, and\n * MCP-as-adapter behind the same interface (MCP tools and native tools are\n * indistinguishable at dispatch). Activates `@nebutra/mcp` primitives rather\n * than re-porting them.\n */\n\nimport type { z } from \"zod\";\n\n/** A tool definition — pure data; transport-agnostic. */\nexport interface ToolDefinition<I = unknown, O = unknown> {\n  readonly name: string;\n  readonly description: string;\n  readonly inputSchema: z.ZodType<I>;\n  readonly outputSchema?: z.ZodType<O>;\n  /**\n   * When true, the full schema is withheld until a `tool_search` discovery\n   * step lazily loads it (parity with the upstream deferred-tool pattern).\n   */\n  readonly deferLoading?: boolean;\n}\n\n/** Source provenance — native vs. adapted from an MCP server. */\nexport type ToolOrigin =\n  | { readonly kind: \"native\" }\n  | { readonly kind: \"mcp\"; readonly server: string };\n\nexport interface RegisteredTool {\n  readonly definition: ToolDefinition;\n  readonly origin: ToolOrigin;\n}\n\n/** A tool invocation routed through the registry. */\nexport interface ToolDispatchContext {\n  /** Mandatory tenant scope — every dispatch is tenant-bound. */\n  readonly tenantId: string;\n  readonly threadId: string;\n}\n\nexport type ToolHandler<I = unknown, O = unknown> = (\n  input: I,\n  ctx: ToolDispatchContext,\n) => Promise<O>;\n\n/** Pre/post dispatch hooks (parity with upstream orchestrator hooks). */\nexport interface ToolHooks {\n  readonly preToolUse?: (name: string, input: unknown, ctx: ToolDispatchContext) => Promise<void>;\n  readonly postToolUse?: (name: string, output: unknown, ctx: ToolDispatchContext) => Promise<void>;\n}\n\n/**\n * registry -> router -> orchestrator pipeline. MCP tools register via\n * {@link adaptMcpTool} and are dispatched identically to native tools.\n */\nexport class ToolRegistry {\n  readonly #tools = new Map<string, { reg: RegisteredTool; handler: ToolHandler }>();\n  readonly #hooks: ToolHooks;\n\n  constructor(hooks: ToolHooks = {}) {\n    this.#hooks = hooks;\n  }\n\n  register<I, O>(\n    definition: ToolDefinition<I, O>,\n    handler: ToolHandler<I, O>,\n    origin: ToolOrigin = { kind: \"native\" },\n  ): void {\n    if (this.#tools.has(definition.name)) {\n      throw new Error(`Tool already registered: ${definition.name}`);\n    }\n    this.#tools.set(definition.name, {\n      reg: { definition: definition as ToolDefinition, origin },\n      handler: handler as ToolHandler,\n    });\n  }\n\n  list(): readonly RegisteredTool[] {\n    return [...this.#tools.values()].map((e) => e.reg);\n  }\n\n  async dispatch(name: string, rawInput: unknown, ctx: ToolDispatchContext): Promise<unknown> {\n    const entry = this.#tools.get(name);\n    if (!entry) throw new Error(`Unknown tool: ${name}`);\n    const input = entry.reg.definition.inputSchema.parse(rawInput);\n    await this.#hooks.preToolUse?.(name, input, ctx);\n    const output = await entry.handler(input, ctx);\n    const validated = entry.reg.definition.outputSchema\n      ? entry.reg.definition.outputSchema.parse(output)\n      : output;\n    await this.#hooks.postToolUse?.(name, validated, ctx);\n    return validated;\n  }\n}\n\n/** Minimal shape of an MCP client (satisfied by `@nebutra/mcp`'s `mcpClient`). */\nexport interface McpClientLike {\n  executeTool(\n    name: string,\n    args: unknown,\n    ctx: { requestId: string; tenantId: string },\n  ): Promise<unknown>;\n}\n\n/**\n * Adapt an external MCP tool into the uniform tool model. The resulting\n * handler delegates to the MCP client; callers cannot tell it apart from a\n * native tool.\n */\nexport function adaptMcpTool(\n  server: string,\n  definition: ToolDefinition,\n  client: McpClientLike,\n): { definition: ToolDefinition; handler: ToolHandler; origin: ToolOrigin } {\n  return {\n    definition,\n    origin: { kind: \"mcp\", server },\n    handler: async (input, ctx) =>\n      client.executeTool(definition.name, input, {\n        requestId: globalThis.crypto?.randomUUID?.() ?? `${Date.now()}`,\n        tenantId: ctx.tenantId,\n      }),\n  };\n}\n"],"mappings":";AAyDO,IAAM,eAAN,MAAmB;AAAA,EACf,SAAS,oBAAI,IAA2D;AAAA,EACxE;AAAA,EAET,YAAY,QAAmB,CAAC,GAAG;AACjC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,SACE,YACA,SACA,SAAqB,EAAE,MAAM,SAAS,GAChC;AACN,QAAI,KAAK,OAAO,IAAI,WAAW,IAAI,GAAG;AACpC,YAAM,IAAI,MAAM,4BAA4B,WAAW,IAAI,EAAE;AAAA,IAC/D;AACA,SAAK,OAAO,IAAI,WAAW,MAAM;AAAA,MAC/B,KAAK,EAAE,YAA0C,OAAO;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,OAAkC;AAChC,WAAO,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,EACnD;AAAA,EAEA,MAAM,SAAS,MAAc,UAAmB,KAA4C;AAC1F,UAAM,QAAQ,KAAK,OAAO,IAAI,IAAI;AAClC,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iBAAiB,IAAI,EAAE;AACnD,UAAM,QAAQ,MAAM,IAAI,WAAW,YAAY,MAAM,QAAQ;AAC7D,UAAM,KAAK,OAAO,aAAa,MAAM,OAAO,GAAG;AAC/C,UAAM,SAAS,MAAM,MAAM,QAAQ,OAAO,GAAG;AAC7C,UAAM,YAAY,MAAM,IAAI,WAAW,eACnC,MAAM,IAAI,WAAW,aAAa,MAAM,MAAM,IAC9C;AACJ,UAAM,KAAK,OAAO,cAAc,MAAM,WAAW,GAAG;AACpD,WAAO;AAAA,EACT;AACF;AAgBO,SAAS,aACd,QACA,YACA,QAC0E;AAC1E,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,EAAE,MAAM,OAAO,OAAO;AAAA,IAC9B,SAAS,OAAO,OAAO,QACrB,OAAO,YAAY,WAAW,MAAM,OAAO;AAAA,MACzC,WAAW,WAAW,QAAQ,aAAa,KAAK,GAAG,KAAK,IAAI,CAAC;AAAA,MAC7D,UAAU,IAAI;AAAA,IAChB,CAAC;AAAA,EACL;AACF;","names":[]}

package/dist/chunk-PGGWSUTM.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/mcp-bridge.ts"],"sourcesContent":["/**\n * MCP activation bridge (WRAP — capability #9, activation seam).\n *\n * Concrete bridge that registers external MCP-server tools into the runtime's\n * uniform tool model. It does NOT import `@nebutra/mcp` (WIP / do-not-import):\n * instead it defines minimal injectable ports so callers wire `@nebutra/mcp`\n * (`serverRegistry` + `mcpClient`) without this package taking a hard dep.\n *\n * Tenant-scoped by construction: the catalog port is always queried with the\n * caller's `{ tenantId, plan }`, so a tenant only ever sees its own MCP\n * servers/tools. Fail-closed on missing tenant.\n */\n\nimport { z } from \"zod\";\n\nimport { adaptMcpTool, type McpClientLike, type ToolDefinition, type ToolRegistry } from \"./tools\";\n\n/**\n * Port over an MCP server catalog (satisfied by `@nebutra/mcp`'s\n * `serverRegistry` + plan middleware). Returns only the tools visible to the\n * given tenant/plan — visibility/plan-gating is the port's responsibility.\n */\nexport interface McpServerCatalogPort {\n  listTools(ctx: {\n    tenantId: string;\n    plan?: string;\n  }): Promise<{ server: string; definition: ToolDefinition }[]>;\n}\n\nconst ctxSchema = z.object({\n  tenantId: z.string().trim().min(1, \"tenantId is required (fail-closed)\"),\n  plan: z.string().min(1).optional(),\n});\n\nexport interface ActivateMcpToolsResult {\n  /** Tool names newly registered into the registry, in catalog order. */\n  readonly registered: readonly string[];\n  /** Tool names skipped because the name was already registered. */\n  readonly skipped: readonly string[];\n}\n\n/**\n * List the tenant/plan-visible MCP tools, adapt each via {@link adaptMcpTool},\n * and register them into the {@link ToolRegistry}. A tool whose name is already\n * registered is skipped (reported, never thrown). Empty/blank tenantId fails\n * closed before any catalog call.\n */\nexport async function activateMcpTools(\n  registry: ToolRegistry,\n  catalog: McpServerCatalogPort,\n  client: McpClientLike,\n  ctx: { tenantId: string; plan?: string },\n): Promise<ActivateMcpToolsResult> {\n  const scope = ctxSchema.parse(ctx);\n\n  const entries = await catalog.listTools(\n    scope.plan === undefined\n      ? { tenantId: scope.tenantId }\n      : { tenantId: scope.tenantId, plan: scope.plan },\n  );\n\n  const registered: string[] = [];\n  const skipped: string[] = [];\n\n  for (const { server, definition } of entries) {\n    if (registry.list().some((r) => r.definition.name === definition.name)) {\n      skipped.push(definition.name);\n      continue;\n    }\n    const adapted = adaptMcpTool(server, definition, client);\n    registry.register(adapted.definition, adapted.handler, adapted.origin);\n    registered.push(definition.name);\n  }\n\n  return { registered, skipped };\n}\n"],"mappings":";;;;;AAaA,SAAS,SAAS;AAgBlB,IAAM,YAAY,EAAE,OAAO;AAAA,EACzB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,oCAAoC;AAAA,EACvE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACnC,CAAC;AAeD,eAAsB,iBACpB,UACA,SACA,QACA,KACiC;AACjC,QAAM,QAAQ,UAAU,MAAM,GAAG;AAEjC,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,MAAM,SAAS,SACX,EAAE,UAAU,MAAM,SAAS,IAC3B,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,KAAK;AAAA,EACnD;AAEA,QAAM,aAAuB,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAE3B,aAAW,EAAE,QAAQ,WAAW,KAAK,SAAS;AAC5C,QAAI,SAAS,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,SAAS,WAAW,IAAI,GAAG;AACtE,cAAQ,KAAK,WAAW,IAAI;AAC5B;AAAA,IACF;AACA,UAAM,UAAU,aAAa,QAAQ,YAAY,MAAM;AACvD,aAAS,SAAS,QAAQ,YAAY,QAAQ,SAAS,QAAQ,MAAM;AACrE,eAAW,KAAK,WAAW,IAAI;AAAA,EACjC;AAEA,SAAO,EAAE,YAAY,QAAQ;AAC/B;","names":[]}

package/dist/chunk-ZMYX5VBU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/skills.ts"],"sourcesContent":["/**\n * Skills system (WRAP — progressive-disclosure capability).\n *\n * Faithful re-expression of the source harness's two-phase skill model:\n *\n *   Phase 1 — Listing (cheap, always in context): a budget-bounded catalog\n *     exposing only {name, description, whenToUse} per skill. First-party\n *     skills (bundled/builtin tier) are never truncated and never dropped;\n *     lower-tier skills degrade to names-only, then drop, as the context\n *     budget is exhausted. Path-activated skills stay hidden until a touched\n *     file matches one of their globs.\n *\n *   Phase 2 — Invocation (lazy, on demand): expand the chosen skill's body\n *     into turn messages, with arg/var substitution and a merged tool\n *     allowlist contributed to the permission context.\n *\n * A skill IS a `Definition` — the same tenant-scoped layered resolver backs\n * the command registry and the subagent registry (see ./definitions).\n *\n * SECURITY: this re-expression intentionally drops the source's body-side\n * command-substitution (the upstream \"!`…`\" inline-shell facility). Skill\n * bodies are inert text; they NEVER trigger host shell execution here. All\n * entry points require a non-empty `tenantId` and fail closed; cross-tenant\n * inputs are rejected by the underlying `DefinitionResolver`. Pure data/logic\n * — no host filesystem access (resource base is an injected indirection).\n */\n\nimport { z } from \"zod\";\nimport {\n  type Definition,\n  type DefinitionResolver,\n  type ResolveContext,\n  substituteArguments,\n} from \"./definitions\";\n\n/** A skill is just a resolvable `Definition`. */\nexport type SkillRecord = Definition;\n\n/** Tiers treated as first-party (never truncated, never dropped). */\nconst FIRST_PARTY_TIERS: ReadonlySet<string> = new Set([\"bundled\", \"builtin\"]);\n\nconst isFirstParty = (s: SkillRecord): boolean => FIRST_PARTY_TIERS.has(s.sourceTier);\n\n// ── Phase 1: listing ─────────────────────────────────────────────────────────\n\n/** One catalog entry — only the cheap, always-in-context surface. */\nexport interface SkillListingEntry {\n  readonly name: string;\n  readonly description: string;\n  readonly whenToUse?: string | undefined;\n  /** True when this entry was degraded to names-only by the budget. */\n  readonly degraded: boolean;\n  readonly firstParty: boolean;\n}\n\nexport interface SkillListing {\n  readonly entries: readonly SkillListingEntry[];\n  readonly text: string;\n}\n\nconst listingOptionsSchema = z.object({\n  maxListingDescChars: z.number().int().positive().default(250),\n  contextWindowTokens: z.number().int().positive().default(200_000),\n  budgetPercent: z.number().positive().max(1).default(0.01),\n  touchedPaths: z.array(z.string()).default([]),\n});\nexport type SkillListingOptions = z.input<typeof listingOptionsSchema>;\n\n/** Cheap, deterministic token estimate (≈4 chars/token). */\nconst estimateTokens = (text: string): number => Math.ceil(text.length / 4);\n\n/** Minimal glob: `**` = any chars, `*` = any chars except `/`, else exact. */\nfunction globToRegExp(glob: string): RegExp {\n  let out = \"^\";\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i]!;\n    if (c === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        out += \".*\";\n        i++;\n      } else {\n        out += \"[^/]*\";\n      }\n    } else if (\".+?^${}()|[]\\\\\".includes(c)) {\n      out += `\\\\${c}`;\n    } else {\n      out += c;\n    }\n  }\n  return new RegExp(`${out}$`);\n}\n\nconst pathMatches = (globs: readonly string[], touched: readonly string[]): boolean =>\n  globs.some((g) => {\n    const re = globToRegExp(g);\n    return touched.some((p) => re.test(p));\n  });\n\n/** Stable order: first-party first, then by slug — deterministic output. */\nfunction orderSkills(skills: readonly SkillRecord[]): SkillRecord[] {\n  return [...skills].sort((a, b) => {\n    const fa = isFirstParty(a) ? 0 : 1;\n    const fb = isFirstParty(b) ? 0 : 1;\n    if (fa !== fb) return fa - fb;\n    return a.slug.localeCompare(b.slug);\n  });\n}\n\nconst truncate = (s: string, max: number): string => (s.length <= max ? s : s.slice(0, max));\n\nfunction renderEntry(e: SkillListingEntry): string {\n  const head = e.whenToUse ? `- ${e.name} — ${e.whenToUse}` : `- ${e.name}`;\n  return e.description ? `${head}\\n  ${e.description}` : head;\n}\n\n/**\n * Phase 1 — build the always-in-context skill catalog. Pure & deterministic.\n *\n * Budget = `contextWindowTokens * budgetPercent`. First-party skills are\n * emitted in full and do NOT consume budget against being dropped. Each\n * remaining skill is tried at full description; if it would overflow it is\n * degraded to names-only; if even that overflows it is dropped. Skills in\n * `ctx.loadedSlugs` and unactivated path-gated skills are suppressed.\n */\nexport function buildSkillListing(\n  resolver: DefinitionResolver<SkillRecord>,\n  ctx: ResolveContext,\n  options: SkillListingOptions = {},\n): SkillListing {\n  if (!ctx.tenantId) throw new Error(\"buildSkillListing: tenantId is required\");\n  const opts = listingOptionsSchema.parse(options);\n\n  const loaded = ctx.loadedSlugs ?? new Set<string>();\n  const visible = resolver\n    .resolve(ctx)\n    .filter((s) => !loaded.has(s.slug))\n    .filter((s) => {\n      const paths = s.frontmatter.paths;\n      return paths.length === 0 || pathMatches(paths, opts.touchedPaths);\n    });\n\n  const budget = Math.max(1, Math.floor(opts.contextWindowTokens * opts.budgetPercent));\n\n  const entries: SkillListingEntry[] = [];\n  let used = 0;\n\n  for (const s of orderSkills(visible)) {\n    const fp = isFirstParty(s);\n    const fm = s.frontmatter;\n    const fullDesc = fp ? fm.description : truncate(fm.description, opts.maxListingDescChars);\n\n    if (fp) {\n      const entry: SkillListingEntry = {\n        name: fm.name,\n        description: fm.description,\n        whenToUse: fm.whenToUse,\n        degraded: false,\n        firstParty: true,\n      };\n      entries.push(entry);\n      used += estimateTokens(renderEntry(entry));\n      continue;\n    }\n\n    const full: SkillListingEntry = {\n      name: fm.name,\n      description: fullDesc,\n      whenToUse: fm.whenToUse,\n      degraded: false,\n      firstParty: false,\n    };\n    const fullCost = estimateTokens(renderEntry(full));\n    if (used + fullCost <= budget) {\n      entries.push(full);\n      used += fullCost;\n      continue;\n    }\n\n    const nameOnly: SkillListingEntry = {\n      name: fm.name,\n      description: \"\",\n      whenToUse: undefined,\n      degraded: true,\n      firstParty: false,\n    };\n    const nameCost = estimateTokens(renderEntry(nameOnly));\n    if (used + nameCost <= budget) {\n      entries.push(nameOnly);\n      used += nameCost;\n    }\n    // else: drop entirely.\n  }\n\n  const text = entries.map(renderEntry).join(\"\\n\");\n  return { entries, text };\n}\n\n// ── Phase 2: invocation ──────────────────────────────────────────────────────\n\nexport interface SkillMessage {\n  readonly role: \"system\" | \"user\";\n  readonly content: string;\n}\n\nexport interface ExpandedSkill {\n  readonly messages: readonly SkillMessage[];\n  readonly allowedTools: readonly string[];\n  readonly modelOverride?: string | undefined;\n  readonly effort?: \"low\" | \"medium\" | \"high\" | undefined;\n  readonly executionMode: \"inline\" | \"fork\";\n}\n\nexport interface ExpandContext {\n  readonly tenantId: string;\n  readonly args: Record<string, string>;\n  readonly vars: Record<string, string>;\n  /** Lazy body fetch — host supplies; called only here, only once. */\n  readonly bodyLoader: (bodyRef: string) => Promise<string>;\n  /** Host-injected resource-base indirection (NO host FS access here). */\n  readonly skillResourceBase: (slug: string) => string;\n}\n\n/**\n * Phase 2 — expand a skill into turn messages. Body is loaded lazily via the\n * injected `bodyLoader` (never during listing). A `Base directory…` line is\n * prepended via the injected `skillResourceBase` indirection. Args + vars are\n * substituted with `substituteArguments`. The skill's `allowedTools` are\n * returned for the caller to merge into the permission context — this never\n * mutates global state and never executes anything from the body.\n */\nexport async function expandSkill(skill: SkillRecord, ctx: ExpandContext): Promise<ExpandedSkill> {\n  if (!ctx.tenantId) throw new Error(\"expandSkill: tenantId is required\");\n  if (skill.tenantId !== ctx.tenantId) {\n    throw new Error(\"expandSkill: cross-tenant skill access rejected\");\n  }\n\n  const rawBody = await ctx.bodyLoader(skill.bodyRef);\n  const body = substituteArguments(rawBody, ctx.args, ctx.vars);\n  const baseLine = `Base directory for this skill: ${ctx.skillResourceBase(skill.slug)}`;\n\n  const messages: readonly SkillMessage[] = [\n    { role: \"system\", content: baseLine },\n    { role: \"user\", content: body },\n  ];\n\n  const allowedTools = [...skill.frontmatter.allowedTools];\n\n  return {\n    messages,\n    allowedTools,\n    modelOverride: skill.frontmatter.model,\n    effort: skill.frontmatter.effort,\n    executionMode: skill.frontmatter.executionMode,\n  };\n}\n"],"mappings":";;;;;AA2BA,SAAS,SAAS;AAYlB,IAAM,oBAAyC,oBAAI,IAAI,CAAC,WAAW,SAAS,CAAC;AAE7E,IAAM,eAAe,CAAC,MAA4B,kBAAkB,IAAI,EAAE,UAAU;AAmBpF,IAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EAC5D,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA,EAChE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,IAAI;AAAA,EACxD,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAID,IAAM,iBAAiB,CAAC,SAAyB,KAAK,KAAK,KAAK,SAAS,CAAC;AAG1E,SAAS,aAAa,MAAsB;AAC1C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,KAAK;AACb,UAAI,KAAK,IAAI,CAAC,MAAM,KAAK;AACvB,eAAO;AACP;AAAA,MACF,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF,WAAW,iBAAiB,SAAS,CAAC,GAAG;AACvC,aAAO,KAAK,CAAC;AAAA,IACf,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,IAAI,OAAO,GAAG,GAAG,GAAG;AAC7B;AAEA,IAAM,cAAc,CAAC,OAA0B,YAC7C,MAAM,KAAK,CAAC,MAAM;AAChB,QAAM,KAAK,aAAa,CAAC;AACzB,SAAO,QAAQ,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;AACvC,CAAC;AAGH,SAAS,YAAY,QAA+C;AAClE,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AAChC,UAAM,KAAK,aAAa,CAAC,IAAI,IAAI;AACjC,UAAM,KAAK,aAAa,CAAC,IAAI,IAAI;AACjC,QAAI,OAAO,GAAI,QAAO,KAAK;AAC3B,WAAO,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EACpC,CAAC;AACH;AAEA,IAAM,WAAW,CAAC,GAAW,QAAyB,EAAE,UAAU,MAAM,IAAI,EAAE,MAAM,GAAG,GAAG;AAE1F,SAAS,YAAY,GAA8B;AACjD,QAAM,OAAO,EAAE,YAAY,KAAK,EAAE,IAAI,WAAM,EAAE,SAAS,KAAK,KAAK,EAAE,IAAI;AACvE,SAAO,EAAE,cAAc,GAAG,IAAI;AAAA,IAAO,EAAE,WAAW,KAAK;AACzD;AAWO,SAAS,kBACd,UACA,KACA,UAA+B,CAAC,GAClB;AACd,MAAI,CAAC,IAAI,SAAU,OAAM,IAAI,MAAM,yCAAyC;AAC5E,QAAM,OAAO,qBAAqB,MAAM,OAAO;AAE/C,QAAM,SAAS,IAAI,eAAe,oBAAI,IAAY;AAClD,QAAM,UAAU,SACb,QAAQ,GAAG,EACX,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,IAAI,CAAC,EACjC,OAAO,CAAC,MAAM;AACb,UAAM,QAAQ,EAAE,YAAY;AAC5B,WAAO,MAAM,WAAW,KAAK,YAAY,OAAO,KAAK,YAAY;AAAA,EACnE,CAAC;AAEH,QAAM,SAAS,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,sBAAsB,KAAK,aAAa,CAAC;AAEpF,QAAM,UAA+B,CAAC;AACtC,MAAI,OAAO;AAEX,aAAW,KAAK,YAAY,OAAO,GAAG;AACpC,UAAM,KAAK,aAAa,CAAC;AACzB,UAAM,KAAK,EAAE;AACb,UAAM,WAAW,KAAK,GAAG,cAAc,SAAS,GAAG,aAAa,KAAK,mBAAmB;AAExF,QAAI,IAAI;AACN,YAAM,QAA2B;AAAA,QAC/B,MAAM,GAAG;AAAA,QACT,aAAa,GAAG;AAAA,QAChB,WAAW,GAAG;AAAA,QACd,UAAU;AAAA,QACV,YAAY;AAAA,MACd;AACA,cAAQ,KAAK,KAAK;AAClB,cAAQ,eAAe,YAAY,KAAK,CAAC;AACzC;AAAA,IACF;AAEA,UAAM,OAA0B;AAAA,MAC9B,MAAM,GAAG;AAAA,MACT,aAAa;AAAA,MACb,WAAW,GAAG;AAAA,MACd,UAAU;AAAA,MACV,YAAY;AAAA,IACd;AACA,UAAM,WAAW,eAAe,YAAY,IAAI,CAAC;AACjD,QAAI,OAAO,YAAY,QAAQ;AAC7B,cAAQ,KAAK,IAAI;AACjB,cAAQ;AACR;AAAA,IACF;AAEA,UAAM,WAA8B;AAAA,MAClC,MAAM,GAAG;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,UAAU;AAAA,MACV,YAAY;AAAA,IACd;AACA,UAAM,WAAW,eAAe,YAAY,QAAQ,CAAC;AACrD,QAAI,OAAO,YAAY,QAAQ;AAC7B,cAAQ,KAAK,QAAQ;AACrB,cAAQ;AAAA,IACV;AAAA,EAEF;AAEA,QAAM,OAAO,QAAQ,IAAI,WAAW,EAAE,KAAK,IAAI;AAC/C,SAAO,EAAE,SAAS,KAAK;AACzB;AAmCA,eAAsB,YAAY,OAAoB,KAA4C;AAChG,MAAI,CAAC,IAAI,SAAU,OAAM,IAAI,MAAM,mCAAmC;AACtE,MAAI,MAAM,aAAa,IAAI,UAAU;AACnC,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AAEA,QAAM,UAAU,MAAM,IAAI,WAAW,MAAM,OAAO;AAClD,QAAM,OAAO,oBAAoB,SAAS,IAAI,MAAM,IAAI,IAAI;AAC5D,QAAM,WAAW,kCAAkC,IAAI,kBAAkB,MAAM,IAAI,CAAC;AAEpF,QAAM,WAAoC;AAAA,IACxC,EAAE,MAAM,UAAU,SAAS,SAAS;AAAA,IACpC,EAAE,MAAM,QAAQ,SAAS,KAAK;AAAA,EAChC;AAEA,QAAM,eAAe,CAAC,GAAG,MAAM,YAAY,YAAY;AAEvD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,eAAe,MAAM,YAAY;AAAA,IACjC,QAAQ,MAAM,YAAY;AAAA,IAC1B,eAAe,MAAM,YAAY;AAAA,EACnC;AACF;","names":[]}