@nebutra/agent-runtime 0.2.0 → 0.2.2

package/.turbo/turbo-test.log

@@ -1,44 +0,0 @@
-
-> @nebutra/agent-runtime@0.2.0 test /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/ai/agent-runtime
-> vitest run
-
-
- RUN  v4.1.4 /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/ai/agent-runtime
-
- ✓ src/code-review.test.ts (43 tests) 183ms
- ✓ src/context-compaction.test.ts (38 tests) 154ms
- ✓ src/channel-gateway.test.ts (32 tests) 172ms
- ✓ src/permission-ruleset.test.ts (41 tests) 70ms
- ✓ src/fuzzy-match.test.ts (36 tests) 77ms
- ✓ src/inbound-admission.test.ts (45 tests) 61ms
- ✓ src/session-share.test.ts (29 tests) 101ms
- ✓ src/artifact-stream.test.ts (27 tests) 120ms
- ✓ src/skills.test.ts (16 tests) 96ms
- ✓ src/command-suggestions.test.ts (25 tests) 69ms
- ✓ src/commit-message.test.ts (29 tests) 98ms
- ✓ src/subagents.test.ts (20 tests) 82ms
- ✓ src/hook-pipeline.test.ts (18 tests) 165ms
- ✓ src/memory-provider.test.ts (18 tests) 100ms
- ✓ src/adapters/dispatcher-sse.test.ts (11 tests) 194ms
- ✓ src/project-repo.test.ts (13 tests) 35ms
- ✓ src/dispatcher.test.ts (16 tests) 190ms
- ✓ src/commands.test.ts (16 tests) 52ms
- ✓ src/workbench.test.ts (19 tests) 42ms
- ✓ src/rollout-store-persistent.test.ts (12 tests) 41ms
- ✓ src/adapters/mcp-catalog.test.ts (9 tests) 48ms
- ✓ src/edit-planner.test.ts (21 tests) 33ms
- ✓ src/durable-turn.test.ts (5 tests) 31ms
- ✓ src/deployment-status.test.ts (20 tests) 73ms
- ✓ src/skill-distillation.test.ts (18 tests) 108ms
- ✓ src/design-context.test.ts (17 tests) 47ms
- ✓ src/agent-runtime.test.ts (15 tests) 112ms
- ✓ src/mcp-bridge.test.ts (7 tests) 41ms
- ✓ src/definitions.test.ts (6 tests) 18ms
- ✓ src/adapters/prisma-rollout.test.ts (6 tests) 21ms
- ✓ src/loop.test.ts (4 tests) 21ms
-
- Test Files  31 passed (31)
-      Tests  632 passed (632)
-   Start at  16:51:20
-   Duration  9.97s (transform 4.25s, setup 0ms, import 10.84s, tests 2.65s, environment 12ms)
-

package/.turbo/turbo-typecheck.log

@@ -1,4 +0,0 @@
-
-> @nebutra/agent-runtime@0.2.0 typecheck /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/ai/agent-runtime
-> tsc --noEmit
-

package/CHANGELOG.md

@@ -1,253 +0,0 @@
-# @nebutra/agent-runtime
-
-## 0.2.0
-
-### Minor Changes
-
-- [`fab751f`](https://github.com/Nebutra/Nebutra-Sailor/commit/fab751f39639251bfa006b1bfbcd8cd62f94626a) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - New adapter subpaths inside `@nebutra/agent-runtime`: concrete reusable port
-  adapters for the runtime package.
-
-  - `mcp-catalog`: adapts `@nebutra/mcp` `serverRegistry`/`mcpClient` into the
-    `McpServerCatalogPort` / `McpClientLike` ports — plan-gated, tenant
-    fail-closed, schema-less MCP tools still yield usable definitions,
-    composes with `activateMcpTools`.
-  - `dispatcher-sse`: runtime-agnostic transport for `ProtocolDispatcher` using
-    only Web-standard `Request`/`Response` — JSON-RPC handler (never throws),
-    incremental `text/event-stream` SSE with error-frame + `AbortSignal`
-    cancellation, listener→async-iterable notification bridge.
-
-  Dependency-injected (no hidden globals), tenant fail-closed, zero framework
-  lock-in. The durable rollout-store backend adapter is intentionally not
-  included (a correct system-of-record needs a fail-loud datastore; pending a
-  governance decision — documented in the README).
-
-- [`4865ac9`](https://github.com/Nebutra/Nebutra-Sailor/commit/4865ac9bff6dd83635bc33e4aeb348b087dee7c7) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Absorb the IDE-coding-agent delta (over the already-absorbed CLI core).
-
-  - `code-review`: a pure unified-diff parser, branch-base resolution, a
-    confidence-banded review prompt (CRITICAL ≥95% / WARNING ≥85% /
-    SUGGESTION ≥75% / below → omit) with an untrusted-content injection guard
-    over diff + commit messages, an advisory/no-edit invariant, a fail-closed
-    finding parser (`ReviewParseError` rather than a fabricated empty result),
-    and a deterministic post-review mode handoff.
-  - `context-compaction`: in-session, mid-turn context-overflow recovery — a
-    1.3× token-correction estimator, a 60%-floored budget, greedy whole-message
-    packing with an oversized-message clipped-transcript fallback,
-    bounded-concurrency chunk summarization with a preserve-rubric prompt, a
-    recursive binary reduce capped at an output token limit, and a fail-closed
-    `"compact"` retry sentinel (never silently drops context).
-  - `commit-message` (WRAP): a Conventional-Commits prompt + git-context shape +
-    "regenerate materially different" negative constraint + fence/quote
-    stripping + bounded retry over the existing injected small-model seam.
-
-  Tenant-scoped / fail-closed where stateful; pure where stateless; the only
-  impurity is an injected model/summarize port. 632 package tests.
-
-- [`67f9cd0`](https://github.com/Nebutra/Nebutra-Sailor/commit/67f9cd02c0ee908f0579efadc4292d535a758c16) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Durable rollout-store backend (the agent-runtime system-of-record).
-
-  - New Prisma model `AgentRolloutLine` → table `agent_rollout_lines`, additive
-    migration `20260519000000_add_agent_rollout_store` (one CREATE TABLE).
-  - `createPrismaRolloutPersistence` in `@nebutra/agent-runtime-adapters`:
-    fail-loud `RolloutPersistencePort` over a minimal injected
-    `PrismaRolloutDelegate` (no generated-client / `@nebutra/db` dependency;
-    per-tenant resolver for RLS). 6 TDD tests.
-  - Gateway route store is env-gated: `AGENT_ROLLOUT_DURABLE=1` selects the
-    durable Postgres store, default stays in-memory. Activation is a standard
-    migrate+generate deploy step (ADR 2026-05-19), not faked durability.
-
-- [`bb1b126`](https://github.com/Nebutra/Nebutra-Sailor/commit/bb1b126e82379d88da10f43a86d9d07bccc3a224) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Absorb the git-backed-project delta (over the already-absorbed core).
-
-  - `project-repo`: durable project = git repo. Metadata + per-conversation
-    jsonl logs persisted as committed files (one commit per turn); history /
-    restore by commit SHA (commit graph IS the history — distinct from
-    workbench's in-memory snapshot ring); injected `GitHostPort` (no git
-    vendor lock-in); tenant ownership gate (`ownsRepo`, default-deny).
-  - `deployment-status`: commit-keyed lifecycle (`idle|deploying|live|
-failed`), latest-status + timeline-from-commits derivations, explicit
-    `advanceState` machine; preview domain from an injected suffix (no
-    hardcoded host).
-
-  Tenant-scoped & fail-closed; pure data/logic; git + deploy hosts injected.
-  Resolved a `CommitRef` barrel collision (deployment-status structural type
-  renamed `DeploymentCommitRef`). 252 package tests.
-
-- [`da6bfea`](https://github.com/Nebutra/Nebutra-Sailor/commit/da6bfeaf6c323a9aecefdd65c481a9852aee25b9) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Add `@nebutra/agent-runtime`: a multi-tenant agent-runtime grammar.
-
-  - New package re-expresses a coding-agent runtime _design_ in Sailor grammar —
-    thread/turn/item model + event lifecycle, two-axis approval/capability
-    policy, uniform tool/MCP abstraction, event-sourced rollout with compaction,
-    and an external-sandbox delegation seam.
-  - Every serialization scope, store key, and dispatch is tenant-scoped;
-    cross-tenant requests can never share a serial lane.
-  - No infra change and no in-process untrusted-code execution: the default
-    executor fails closed; real execution is delegated behind `ExternalSandbox`.
-  - Adds an off-by-default `agent-runtime-demo` feature flag gating a demo route
-    in `apps/web`.
-
-- [`3c5c43e`](https://github.com/Nebutra/Nebutra-Sailor/commit/3c5c43e1c07c03da936d2948408f8abb4b113321) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Absorb the differentiated coding-agent-harness capabilities (the delta over
-  the already-absorbed core).
-
-  - `definitions`: shared layered-tier resolver (precedence + dual
-    availability/enabled gate) + frontmatter parser — backs commands, skills,
-    subagents from one kernel.
-  - `skills`: two-phase progressive disclosure (token-budget listing,
-    first-party never-truncated, path-activation), lazy body expansion,
-    per-skill model/tool override merge.
-  - `hook-pipeline`: 18-event taxonomy, config matcher/`if` resolver,
-    structured decision protocol, multi-transport (function/http/prompt),
-    parallel fan-out with deterministic precedence merge; wraps the bare
-    `ToolHooks` as the in-process transport.
-  - `commands`: unified command=skill model with dual user/model front-doors
-    and a pure arg-substitution + templating expander.
-  - `subagents`: definition resolver (tool allow−deny), fork-vs-spawn
-    context-boundary contract, typed terminal-envelope result contract, and a
-    tenant-scoped Task lifecycle registry.
-
-  All tenant-scoped & fail-closed; pure data/logic (no FS/shell/TUI — those
-  transports deliberately dropped for multi-tenant safety). 135 package tests.
-
-- [`a29b2d9`](https://github.com/Nebutra/Nebutra-Sailor/commit/a29b2d997416edc4e421b31b777724ae70e4da54) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Add the agent loop runner — the turn engine.
-
-  - `runTurn()` drives a turn `loop { model_call → emit items → execute tools
-→ feed results back }` until the model stops requesting tools or a bounded
-    step ceiling is hit. Single-threaded (shared context, no conflicting
-    sub-agent decisions).
-  - The model call is abstracted behind `ModelInvoker`, WRAPping an existing
-    model stack rather than re-porting provider/routing/fallback.
-  - Every terminal item and the turn outcome are appended to the tenant-scoped
-    rollout (resumable by replay); tool calls pass the approval gate
-    (`resolveRuleDecision` + server-initiated `ApprovalGate`); unapproved tools
-    are never dispatched. Internal failures surface as `turn.failed`, never
-    thrown to the caller.
-
-- [`cd34724`](https://github.com/Nebutra/Nebutra-Sailor/commit/cd347242ab6874931a74aa72aa9a0d183f7dd5d3) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Absorb the multi-channel-gateway delta (over the already-absorbed core).
-
-  - `channel-gateway`: channel-agnostic `InboundMessage`/`OutboundMessage`
-    normalization, a `ChannelAdapter` port (parseInbound returns null for
-    non-message events, never throws on junk), tenant-scoped `ChannelRegistry`,
-    and outbound route-back through the originating channel.
-  - `inbound-admission`: deterministic tenant-prefixed `resolveSessionKey`
-    (group/DM/thread bindings, cross-tenant non-colliding), allowlist gating
-    (exact / `*` / `prefix:*`, closed-by-default), mention gating (group
-    requires @mention or reply-to-assistant; DM never), a time-injected
-    `InboundDebouncer`, composed by `admitInbound`.
-
-  Tenant-scoped & fail-closed; pure data/logic; transport + time injected.
-  Only the clean contracts were re-expressed (the messy source impl is not
-  ported). 365 package tests.
-
-- [`447e948`](https://github.com/Nebutra/Nebutra-Sailor/commit/447e948a7153446e7bc3769395c1687c9f27c991) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Close the runtime gap — four capabilities, all tenant-scoped & fail-closed,
-  each behind an injectable port so the package keeps zero datastore/queue
-  dependency ("no infra change" stays honest):
-
-  - **Durable / resumable turn** (`durable-turn.ts`): `createDurableTurn` wraps
-    `runTurn` behind a `DurableTurnQueuePort`; `resume` replays the rollout and
-    re-drives an unfinished turn, idempotent and cross-tenant isolated.
-  - **Protocol dispatcher** (`dispatcher.ts`): transport-agnostic JSON-RPC
-    dispatcher serving the method registry — envelope validation fail-closed,
-    per-`scopeKey` serialization (cross-tenant never shares a lane), errors
-    mapped to JSON-RPC codes, validated notification stream.
-  - **MCP activation** (`mcp-bridge.ts`): `activateMcpTools` adapts tenant/plan
-    -visible MCP-server tools into the uniform `ToolRegistry` via an injectable
-    `McpServerCatalogPort`; duplicate names skipped, empty tenant fails closed.
-  - **Persistent rollout store** (`rollout-store-persistent.ts`):
-    `PersistentRolloutStore` over a `RolloutPersistencePort` (satisfiable by an
-    `@nebutra/audit`/`@nebutra/db` adapter) — monotonic per-(tenant,thread)
-    seq, faithful round-trip, cross-tenant isolation, typed round-trip errors.
-
-- [`b1b9b72`](https://github.com/Nebutra/Nebutra-Sailor/commit/b1b9b7251ef6b1b84e5211dd9b4ae14a1be4b05a) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Absorb the self-improving-loop delta (over the already-absorbed core).
-
-  - `memory-provider`: pluggable cross-session `MemoryProvider` port (full
-    lifecycle: initialize/prefetch/syncTurn/onSessionEnd/onSessionSwitch/
-    onPreCompress/onDelegation/systemPromptBlock) + a `MemoryManager` that
-    degrades safely + memory-context injection defense (recalled text
-    banner-wrapped as reference-not-instructions; a split-safe streaming
-    scrubber strips model-forged memory banners). Vendor backends injected.
-  - `skill-distillation`: the learning loop — eligibility gate (only
-    non-trivial successful trajectories), `distillSkill` (deterministic
-    prompt → injected synthesize → skill record with `allowedTools` clamped
-    to tools the experience actually used = least privilege), `improveSkill`
-    (versioned, tenant-locked), pure `shouldNudgePersist` heuristic.
-
-  Tenant-scoped & fail-closed; pure data/logic; LLM synthesis + memory
-  backends are injected ports. 288 package tests.
-
-- [`5ed8c38`](https://github.com/Nebutra/Nebutra-Sailor/commit/5ed8c38362e86bad51786383b81cc921b11d1b18) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Absorb the coding-agent share/permission delta (over the already-absorbed core).
-
-  - `permission-ruleset`: `Rule{permission,pattern,action:allow|deny|ask}` +
-    `evaluate(...rulesets)` first-match over both dimensions with fail-safe
-    `ask` default, a `wildcardMatch` with the faithful trailing `" *"`-optional
-    rule (no catastrophic backtracking), and a bash-command-prefix/arity
-    extractor (`commandPrefix`/`commandPermissionKey`).
-  - `session-share`: mint a read-only `ShareRecord{id,url,secret}` for a
-    session, revoke it, public secret-gated `verifyViewer` (no tenantId —
-    constant-time compare; documented threat model). Injected id-mint /
-    url-builder / sync-sink / store ports; kill-switch; persist-first
-    best-effort sync.
-
-  Owner plane tenant-scoped & fail-closed; viewer plane secret-gated; pure
-  where stateless; transport/crypto/store injected. 496 package tests.
-
-- [`77c0105`](https://github.com/Nebutra/Nebutra-Sailor/commit/77c0105ce89a4ff0f5e86229cce9c2561c1b1c5f) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Absorb the site-clone / targeted-edit delta (over the already-absorbed core).
-
-  - `design-context`: website → structured generation seed
-    `{content, brand{colors,fonts}, screenshot, title}` — pure normalizer +
-    injected `ScrapeProvider` port (no network/provider lock-in),
-    `toGenerationSeed` bounded deterministic prompt block.
-  - `edit-planner`: pattern-driven `analyzeEditIntent` (7 EditTypes) +
-    `selectFilesForEdit` (primary/context split + deterministic system-prompt
-    builder) + generalised fast-apply (`parseEditBlocks` / `applyEditBlock`
-    with an injected merger). Targeted edit planning vs regenerate-all.
-
-  Tenant-scoped & fail-closed; pure data/logic; scrape + LLM-merge are
-  injected ports. 219 package tests.
-
-- [`1e2d929`](https://github.com/Nebutra/Nebutra-Sailor/commit/1e2d9298f4f093cbe81199e7dcd3991116d01ea2) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Absorb the terminal-suggestion delta (over the already-absorbed core).
-
-  - `fuzzy-match`: smart-case subsequence fuzzy match returning
-    `{score, indices}` (lowercase query ⇒ case-insensitive; any uppercase ⇒
-    case-sensitive), case-insensitive + ignore-spaces variants (indices map to
-    original text), anchored glob-wildcard (`* ? [a-z] \`, no catastrophic
-    backtracking), stable `rankByFuzzy`. Pure, dependency-free.
-  - `command-suggestions`: `classifyMatch` with deterministic
-    exact > prefix > fuzzy score banding, `rankSuggestions` (history-boost +
-    shorter-text + stable tie-breaks), `dedupeByText` (history-wins,
-    case-insensitive), tenant-scoped `SuggestionHistoryStore` (recency ring,
-    cross-tenant isolation). Fuzzy matcher injected.
-
-  Tenant-scoped & fail-closed where stateful; pure data/logic. The source's
-  generated `command-signatures-v2` JS bundle was deliberately not ported.
-  426 package tests.
-
-- [`509338e`](https://github.com/Nebutra/Nebutra-Sailor/commit/509338ee5ffc537c108f06cd1fc24a811a5e05b8) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Concrete Track-B coupling for the agent-runtime external-sandbox seam.
-
-  - Add `createHttpSandbox(baseUrl)`: an `ExternalSandbox` that delegates
-    execution over HTTP to the decoupled Rust isolator
-    (`backends/rust/sandbox`, `POST /api/v1/sandbox/exec`).
-  - Non-2xx isolator responses (e.g. a fail-closed 403 refusal) surface as
-    `SandboxDelegationError` and are never coerced into a fabricated result.
-  - The Rust isolator now mirrors the `SandboxExecRequest` /
-    `SandboxExecResult` / `CapabilityPolicy` wire shapes and is fail-closed
-    until a real isolation backend (Wasmtime/Firecracker) is wired.
-
-- [`efe764d`](https://github.com/Nebutra/Nebutra-Sailor/commit/efe764d60085352eae304dc37dc22fda8920e587) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - Absorb the web-app-builder delta (the differentiated capabilities over the
-  already-absorbed harness core).
-
-  - `artifact-stream`: streaming artifact/action protocol — a chunk-fed
-    incremental parser for an `<artifact>` of ordered
-    `<action type=file|shell|start|build|data>` blocks (split-tag safe, no
-    duplicate emit), plus an action runner with a
-    `pending→running→complete|aborted|failed` state-machine, submission-order
-    queue, halt-on-failure, and execution delegated through injected ports
-    (no in-process exec / host FS). Distinct from tool-calling.
-  - `workbench`: tenant-scoped project-state model — immutable FileMap with
-    auto-derived folders, apply-file-mutation, snapshot/restore with
-    deep-copy isolation, bounded snapshot history, project diff; behind a
-    `ProjectPersistencePort` (in-memory ref impl mirroring the rollout-store
-    seam).
-
-  All tenant-scoped & fail-closed, pure data/logic. 181 package tests.
-
-### Patch Changes
-
-- Updated dependencies [[`5d3d7e6`](https://github.com/Nebutra/Nebutra-Sailor/commit/5d3d7e6c59cae5aa242bb988b75a9888cfd0db39)]:
-  - @nebutra/mcp@0.1.1

package/dist/chunk-BJBBR3QA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/loop.ts"],"sourcesContent":["/**\n * Agent loop runner (WRAP — the turn engine).\n *\n * Faithful re-expression of the upstream loop: a turn is\n * `loop { model_call → emit items → execute tools → feed results back }`\n * until the model stops requesting tools or a bounded step ceiling is hit.\n * Single-threaded (Cognition teaching: shared context, no conflicting\n * sub-agent decisions). Every item is appended to the tenant-scoped rollout\n * as it reaches a terminal state, so the turn is resumable by replay.\n *\n * The model call is abstracted behind {@link ModelInvoker} so this WRAPs an\n * existing model stack (e.g. `@nebutra/agents`) rather than re-porting\n * provider/routing/fallback. No untrusted code runs here — command items are\n * dispatched through the tool registry / external-sandbox seam.\n */\n\nimport type { AgentMessageItem, ThreadEvent, ThreadItem, TurnConfig, TurnUsage } from \"./model\";\nimport {\n  type ApprovalPolicy,\n  DENIED,\n  isApproval,\n  type ReviewDecision,\n  type RuleDecision,\n  resolveRuleDecision,\n} from \"./policy\";\nimport type { ServerRequest } from \"./protocol\";\nimport { type RolloutLine, type RolloutStore, sanitizeForPersist } from \"./rollout\";\nimport type { ToolDispatchContext, ToolRegistry } from \"./tools\";\n\n/** A single thing the model emitted in one round. */\nexport type ModelEmission =\n  | { readonly kind: \"text\"; readonly text: string }\n  | {\n      readonly kind: \"tool_call\";\n      readonly id: string;\n      readonly name: string;\n      readonly args: unknown;\n    };\n\nexport interface ModelRoundResult {\n  readonly emissions: readonly ModelEmission[];\n  readonly usage?: Partial<TurnUsage>;\n}\n\nexport interface ModelRoundRequest {\n  readonly config: TurnConfig;\n  /** Running transcript: user input, agent text, and tool results. */\n  readonly history: readonly { readonly role: string; readonly content: string }[];\n  readonly toolNames: readonly string[];\n}\n\n/** Abstracts the model stack — implement over `@nebutra/agents`, etc. */\nexport interface ModelInvoker {\n  invoke(request: ModelRoundRequest): Promise<ModelRoundResult>;\n}\n\n/** Server-initiated approval transport (see {@link ServerRequest}). */\nexport interface ApprovalGate {\n  request(serverRequest: ServerRequest): Promise<ReviewDecision>;\n}\n\n/** Classifies a tool call into a static rule decision before approval. */\nexport type RuleEvaluator = (toolName: string, args: unknown) => RuleDecision;\n\nexport interface RunTurnDeps {\n  readonly tenantId: string;\n  readonly threadId: string;\n  readonly config: TurnConfig;\n  readonly approvalPolicy: ApprovalPolicy;\n  readonly model: ModelInvoker;\n  readonly tools: ToolRegistry;\n  readonly store: RolloutStore;\n  readonly approvalGate: ApprovalGate;\n  /** Defaults to: everything requires a prompt (safe). */\n  readonly ruleEvaluator?: RuleEvaluator;\n  /** Bounded steps (parity with upstream step ceiling). Default 20. */\n  readonly maxSteps?: number;\n}\n\nconst DEFAULT_MAX_STEPS = 20;\nconst requirePrompt: RuleEvaluator = () => \"prompt\";\n\nfunction newId(prefix: string): string {\n  return `${prefix}_${globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`}`;\n}\n\n/**\n * Drive one turn to completion. Yields the {@link ThreadEvent} stream and\n * appends each terminal item + the turn outcome to the rollout store.\n * Never throws to the caller — failures surface as a `turn.failed` event.\n */\nexport async function* runTurn(userInput: string, deps: RunTurnDeps): AsyncGenerator<ThreadEvent> {\n  const at = () => new Date().toISOString();\n  const ruleEvaluator = deps.ruleEvaluator ?? requirePrompt;\n  const maxSteps = deps.maxSteps ?? DEFAULT_MAX_STEPS;\n  const ctx: ToolDispatchContext = { tenantId: deps.tenantId, threadId: deps.threadId };\n\n  const append = async (line: RolloutLine): Promise<void> => deps.store.append(line);\n  const event = async (e: ThreadEvent): Promise<ThreadEvent> => {\n    await append({\n      tenantId: deps.tenantId,\n      threadId: deps.threadId,\n      type: \"event\",\n      event:\n        e.type === \"item.completed\"\n          ? { type: \"item.completed\", item: sanitizeForPersist(e.item) }\n          : e,\n      at: at(),\n    });\n    return e;\n  };\n\n  yield await event({ type: \"turn.started\" });\n\n  const history: { role: string; content: string }[] = [{ role: \"user\", content: userInput }];\n  let usage: TurnUsage = {\n    inputTokens: 0,\n    cachedInputTokens: 0,\n    outputTokens: 0,\n    reasoningOutputTokens: 0,\n  };\n\n  try {\n    for (let step = 0; step < maxSteps; step++) {\n      const round = await deps.model.invoke({\n        config: deps.config,\n        history,\n        toolNames: deps.tools.list().map((t) => t.definition.name),\n      });\n      if (round.usage) {\n        const u = round.usage;\n        usage = {\n          inputTokens: usage.inputTokens + (u.inputTokens ?? 0),\n          cachedInputTokens: usage.cachedInputTokens + (u.cachedInputTokens ?? 0),\n          outputTokens: usage.outputTokens + (u.outputTokens ?? 0),\n          reasoningOutputTokens: usage.reasoningOutputTokens + (u.reasoningOutputTokens ?? 0),\n        };\n      }\n\n      const toolCalls = round.emissions.filter(\n        (e): e is Extract<ModelEmission, { kind: \"tool_call\" }> => e.kind === \"tool_call\",\n      );\n\n      for (const e of round.emissions) {\n        if (e.kind !== \"text\") continue;\n        const item: AgentMessageItem = { id: newId(\"msg\"), type: \"agent_message\", text: e.text };\n        history.push({ role: \"assistant\", content: e.text });\n        yield await event({ type: \"item.completed\", item });\n      }\n\n      if (toolCalls.length === 0) break; // model is done\n\n      for (const call of toolCalls) {\n        const decision = await gateToolCall(call.name, call.args, deps, ruleEvaluator);\n        if (!isApproval(decision)) {\n          const failed: ThreadItem = {\n            id: call.id,\n            type: \"error\",\n            message: `tool '${call.name}' not approved (${decision.kind})`,\n          };\n          history.push({ role: \"tool\", content: `DENIED: ${call.name}` });\n          yield await event({ type: \"item.completed\", item: failed });\n          continue;\n        }\n        try {\n          const output = await deps.tools.dispatch(call.name, call.args, ctx);\n          const item: ThreadItem = {\n            id: call.id,\n            type: \"mcp_tool_call\",\n            server: \"native\",\n            tool: call.name,\n            arguments: call.args,\n            result: { content: output },\n            status: \"completed\",\n          };\n          history.push({ role: \"tool\", content: JSON.stringify(output) });\n          yield await event({ type: \"item.completed\", item });\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err);\n          history.push({ role: \"tool\", content: `ERROR: ${message}` });\n          yield await event({\n            type: \"item.completed\",\n            item: { id: call.id, type: \"error\", message },\n          });\n        }\n      }\n    }\n\n    yield await event({ type: \"turn.completed\", usage });\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err);\n    yield await event({ type: \"turn.failed\", error: { message } });\n  }\n}\n\n/** Resolve a tool call's approval, raising a server-initiated request if asked. */\nasync function gateToolCall(\n  name: string,\n  args: unknown,\n  deps: RunTurnDeps,\n  ruleEvaluator: RuleEvaluator,\n): Promise<ReviewDecision> {\n  const outcome = resolveRuleDecision(ruleEvaluator(name, args), deps.approvalPolicy);\n  if (outcome === \"auto_allow\") return { kind: \"approved\" };\n  if (outcome === \"auto_reject\") return DENIED;\n  return deps.approvalGate.request({\n    type: \"permissions.request_approval\",\n    requestId: newId(\"appr\"),\n    summary: `tool '${name}'`,\n  });\n}\n"],"mappings":";;;;;;;;;;AA+EA,IAAM,oBAAoB;AAC1B,IAAM,gBAA+B,MAAM;AAE3C,SAAS,MAAM,QAAwB;AACrC,SAAO,GAAG,MAAM,IAAI,WAAW,QAAQ,aAAa,KAAK,GAAG,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE;AAC3F;AAOA,gBAAuB,QAAQ,WAAmB,MAAgD;AAChG,QAAM,KAAK,OAAM,oBAAI,KAAK,GAAE,YAAY;AACxC,QAAM,gBAAgB,KAAK,iBAAiB;AAC5C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,MAA2B,EAAE,UAAU,KAAK,UAAU,UAAU,KAAK,SAAS;AAEpF,QAAM,SAAS,OAAO,SAAqC,KAAK,MAAM,OAAO,IAAI;AACjF,QAAM,QAAQ,OAAO,MAAyC;AAC5D,UAAM,OAAO;AAAA,MACX,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,MAAM;AAAA,MACN,OACE,EAAE,SAAS,mBACP,EAAE,MAAM,kBAAkB,MAAM,mBAAmB,EAAE,IAAI,EAAE,IAC3D;AAAA,MACN,IAAI,GAAG;AAAA,IACT,CAAC;AACD,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,EAAE,MAAM,eAAe,CAAC;AAE1C,QAAM,UAA+C,CAAC,EAAE,MAAM,QAAQ,SAAS,UAAU,CAAC;AAC1F,MAAI,QAAmB;AAAA,IACrB,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,uBAAuB;AAAA,EACzB;AAEA,MAAI;AACF,aAAS,OAAO,GAAG,OAAO,UAAU,QAAQ;AAC1C,YAAM,QAAQ,MAAM,KAAK,MAAM,OAAO;AAAA,QACpC,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,WAAW,KAAK,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI;AAAA,MAC3D,CAAC;AACD,UAAI,MAAM,OAAO;AACf,cAAM,IAAI,MAAM;AAChB,gBAAQ;AAAA,UACN,aAAa,MAAM,eAAe,EAAE,eAAe;AAAA,UACnD,mBAAmB,MAAM,qBAAqB,EAAE,qBAAqB;AAAA,UACrE,cAAc,MAAM,gBAAgB,EAAE,gBAAgB;AAAA,UACtD,uBAAuB,MAAM,yBAAyB,EAAE,yBAAyB;AAAA,QACnF;AAAA,MACF;AAEA,YAAM,YAAY,MAAM,UAAU;AAAA,QAChC,CAAC,MAA0D,EAAE,SAAS;AAAA,MACxE;AAEA,iBAAW,KAAK,MAAM,WAAW;AAC/B,YAAI,EAAE,SAAS,OAAQ;AACvB,cAAM,OAAyB,EAAE,IAAI,MAAM,KAAK,GAAG,MAAM,iBAAiB,MAAM,EAAE,KAAK;AACvF,gBAAQ,KAAK,EAAE,MAAM,aAAa,SAAS,EAAE,KAAK,CAAC;AACnD,cAAM,MAAM,MAAM,EAAE,MAAM,kBAAkB,KAAK,CAAC;AAAA,MACpD;AAEA,UAAI,UAAU,WAAW,EAAG;AAE5B,iBAAW,QAAQ,WAAW;AAC5B,cAAM,WAAW,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM,MAAM,aAAa;AAC7E,YAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,gBAAM,SAAqB;AAAA,YACzB,IAAI,KAAK;AAAA,YACT,MAAM;AAAA,YACN,SAAS,SAAS,KAAK,IAAI,mBAAmB,SAAS,IAAI;AAAA,UAC7D;AACA,kBAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,WAAW,KAAK,IAAI,GAAG,CAAC;AAC9D,gBAAM,MAAM,MAAM,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAC1D;AAAA,QACF;AACA,YAAI;AACF,gBAAM,SAAS,MAAM,KAAK,MAAM,SAAS,KAAK,MAAM,KAAK,MAAM,GAAG;AAClE,gBAAM,OAAmB;AAAA,YACvB,IAAI,KAAK;AAAA,YACT,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,MAAM,KAAK;AAAA,YACX,WAAW,KAAK;AAAA,YAChB,QAAQ,EAAE,SAAS,OAAO;AAAA,YAC1B,QAAQ;AAAA,UACV;AACA,kBAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,KAAK,UAAU,MAAM,EAAE,CAAC;AAC9D,gBAAM,MAAM,MAAM,EAAE,MAAM,kBAAkB,KAAK,CAAC;AAAA,QACpD,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,kBAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,UAAU,OAAO,GAAG,CAAC;AAC3D,gBAAM,MAAM,MAAM;AAAA,YAChB,MAAM;AAAA,YACN,MAAM,EAAE,IAAI,KAAK,IAAI,MAAM,SAAS,QAAQ;AAAA,UAC9C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,EAAE,MAAM,kBAAkB,MAAM,CAAC;AAAA,EACrD,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,MAAM,MAAM,EAAE,MAAM,eAAe,OAAO,EAAE,QAAQ,EAAE,CAAC;AAAA,EAC/D;AACF;AAGA,eAAe,aACb,MACA,MACA,MACA,eACyB;AACzB,QAAM,UAAU,oBAAoB,cAAc,MAAM,IAAI,GAAG,KAAK,cAAc;AAClF,MAAI,YAAY,aAAc,QAAO,EAAE,MAAM,WAAW;AACxD,MAAI,YAAY,cAAe,QAAO;AACtC,SAAO,KAAK,aAAa,QAAQ;AAAA,IAC/B,MAAM;AAAA,IACN,WAAW,MAAM,MAAM;AAAA,IACvB,SAAS,SAAS,IAAI;AAAA,EACxB,CAAC;AACH;","names":[]}

package/dist/chunk-NN7DATXA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/tools.ts"],"sourcesContent":["/**\n * Tool / MCP abstraction (WRAP — capability #9).\n *\n * Faithful re-expression of the upstream uniform tool model: one\n * `ToolDefinition` interface, JSON-schema in/out, a deferred-load flag, and\n * MCP-as-adapter behind the same interface (MCP tools and native tools are\n * indistinguishable at dispatch). Activates `@nebutra/mcp` primitives rather\n * than re-porting them.\n */\n\nimport type { z } from \"zod\";\n\n/** A tool definition — pure data; transport-agnostic. */\nexport interface ToolDefinition<I = unknown, O = unknown> {\n  readonly name: string;\n  readonly description: string;\n  readonly inputSchema: z.ZodType<I>;\n  readonly outputSchema?: z.ZodType<O>;\n  /**\n   * When true, the full schema is withheld until a `tool_search` discovery\n   * step lazily loads it (parity with the upstream deferred-tool pattern).\n   */\n  readonly deferLoading?: boolean;\n}\n\n/** Source provenance — native vs. adapted from an MCP server. */\nexport type ToolOrigin =\n  | { readonly kind: \"native\" }\n  | { readonly kind: \"mcp\"; readonly server: string };\n\nexport interface RegisteredTool {\n  readonly definition: ToolDefinition;\n  readonly origin: ToolOrigin;\n}\n\n/** A tool invocation routed through the registry. */\nexport interface ToolDispatchContext {\n  /** Mandatory tenant scope — every dispatch is tenant-bound. */\n  readonly tenantId: string;\n  readonly threadId: string;\n}\n\nexport type ToolHandler<I = unknown, O = unknown> = (\n  input: I,\n  ctx: ToolDispatchContext,\n) => Promise<O>;\n\n/** Pre/post dispatch hooks (parity with upstream orchestrator hooks). */\nexport interface ToolHooks {\n  readonly preToolUse?: (name: string, input: unknown, ctx: ToolDispatchContext) => Promise<void>;\n  readonly postToolUse?: (name: string, output: unknown, ctx: ToolDispatchContext) => Promise<void>;\n}\n\n/**\n * registry -> router -> orchestrator pipeline. MCP tools register via\n * {@link adaptMcpTool} and are dispatched identically to native tools.\n */\nexport class ToolRegistry {\n  readonly #tools = new Map<string, { reg: RegisteredTool; handler: ToolHandler }>();\n  readonly #hooks: ToolHooks;\n\n  constructor(hooks: ToolHooks = {}) {\n    this.#hooks = hooks;\n  }\n\n  register<I, O>(\n    definition: ToolDefinition<I, O>,\n    handler: ToolHandler<I, O>,\n    origin: ToolOrigin = { kind: \"native\" },\n  ): void {\n    if (this.#tools.has(definition.name)) {\n      throw new Error(`Tool already registered: ${definition.name}`);\n    }\n    this.#tools.set(definition.name, {\n      reg: { definition: definition as ToolDefinition, origin },\n      handler: handler as ToolHandler,\n    });\n  }\n\n  list(): readonly RegisteredTool[] {\n    return [...this.#tools.values()].map((e) => e.reg);\n  }\n\n  async dispatch(name: string, rawInput: unknown, ctx: ToolDispatchContext): Promise<unknown> {\n    const entry = this.#tools.get(name);\n    if (!entry) throw new Error(`Unknown tool: ${name}`);\n    const input = entry.reg.definition.inputSchema.parse(rawInput);\n    await this.#hooks.preToolUse?.(name, input, ctx);\n    const output = await entry.handler(input, ctx);\n    const validated = entry.reg.definition.outputSchema\n      ? entry.reg.definition.outputSchema.parse(output)\n      : output;\n    await this.#hooks.postToolUse?.(name, validated, ctx);\n    return validated;\n  }\n}\n\n/** Minimal shape of an MCP client (satisfied by `@nebutra/mcp`'s `mcpClient`). */\nexport interface McpClientLike {\n  executeTool(\n    name: string,\n    args: unknown,\n    ctx: { requestId: string; tenantId: string },\n  ): Promise<unknown>;\n}\n\n/**\n * Adapt an external MCP tool into the uniform tool model. The resulting\n * handler delegates to the MCP client; callers cannot tell it apart from a\n * native tool.\n */\nexport function adaptMcpTool(\n  server: string,\n  definition: ToolDefinition,\n  client: McpClientLike,\n): { definition: ToolDefinition; handler: ToolHandler; origin: ToolOrigin } {\n  return {\n    definition,\n    origin: { kind: \"mcp\", server },\n    handler: async (input, ctx) =>\n      client.executeTool(definition.name, input, {\n        requestId: globalThis.crypto?.randomUUID?.() ?? `${Date.now()}`,\n        tenantId: ctx.tenantId,\n      }),\n  };\n}\n"],"mappings":";AAyDO,IAAM,eAAN,MAAmB;AAAA,EACf,SAAS,oBAAI,IAA2D;AAAA,EACxE;AAAA,EAET,YAAY,QAAmB,CAAC,GAAG;AACjC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,SACE,YACA,SACA,SAAqB,EAAE,MAAM,SAAS,GAChC;AACN,QAAI,KAAK,OAAO,IAAI,WAAW,IAAI,GAAG;AACpC,YAAM,IAAI,MAAM,4BAA4B,WAAW,IAAI,EAAE;AAAA,IAC/D;AACA,SAAK,OAAO,IAAI,WAAW,MAAM;AAAA,MAC/B,KAAK,EAAE,YAA0C,OAAO;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,OAAkC;AAChC,WAAO,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,EACnD;AAAA,EAEA,MAAM,SAAS,MAAc,UAAmB,KAA4C;AAC1F,UAAM,QAAQ,KAAK,OAAO,IAAI,IAAI;AAClC,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iBAAiB,IAAI,EAAE;AACnD,UAAM,QAAQ,MAAM,IAAI,WAAW,YAAY,MAAM,QAAQ;AAC7D,UAAM,KAAK,OAAO,aAAa,MAAM,OAAO,GAAG;AAC/C,UAAM,SAAS,MAAM,MAAM,QAAQ,OAAO,GAAG;AAC7C,UAAM,YAAY,MAAM,IAAI,WAAW,eACnC,MAAM,IAAI,WAAW,aAAa,MAAM,MAAM,IAC9C;AACJ,UAAM,KAAK,OAAO,cAAc,MAAM,WAAW,GAAG;AACpD,WAAO;AAAA,EACT;AACF;AAgBO,SAAS,aACd,QACA,YACA,QAC0E;AAC1E,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,EAAE,MAAM,OAAO,OAAO;AAAA,IAC9B,SAAS,OAAO,OAAO,QACrB,OAAO,YAAY,WAAW,MAAM,OAAO;AAAA,MACzC,WAAW,WAAW,QAAQ,aAAa,KAAK,GAAG,KAAK,IAAI,CAAC;AAAA,MAC7D,UAAU,IAAI;AAAA,IAChB,CAAC;AAAA,EACL;AACF;","names":[]}

package/dist/chunk-PGGWSUTM.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/mcp-bridge.ts"],"sourcesContent":["/**\n * MCP activation bridge (WRAP — capability #9, activation seam).\n *\n * Concrete bridge that registers external MCP-server tools into the runtime's\n * uniform tool model. It does NOT import `@nebutra/mcp` (WIP / do-not-import):\n * instead it defines minimal injectable ports so callers wire `@nebutra/mcp`\n * (`serverRegistry` + `mcpClient`) without this package taking a hard dep.\n *\n * Tenant-scoped by construction: the catalog port is always queried with the\n * caller's `{ tenantId, plan }`, so a tenant only ever sees its own MCP\n * servers/tools. Fail-closed on missing tenant.\n */\n\nimport { z } from \"zod\";\n\nimport { adaptMcpTool, type McpClientLike, type ToolDefinition, type ToolRegistry } from \"./tools\";\n\n/**\n * Port over an MCP server catalog (satisfied by `@nebutra/mcp`'s\n * `serverRegistry` + plan middleware). Returns only the tools visible to the\n * given tenant/plan — visibility/plan-gating is the port's responsibility.\n */\nexport interface McpServerCatalogPort {\n  listTools(ctx: {\n    tenantId: string;\n    plan?: string;\n  }): Promise<{ server: string; definition: ToolDefinition }[]>;\n}\n\nconst ctxSchema = z.object({\n  tenantId: z.string().trim().min(1, \"tenantId is required (fail-closed)\"),\n  plan: z.string().min(1).optional(),\n});\n\nexport interface ActivateMcpToolsResult {\n  /** Tool names newly registered into the registry, in catalog order. */\n  readonly registered: readonly string[];\n  /** Tool names skipped because the name was already registered. */\n  readonly skipped: readonly string[];\n}\n\n/**\n * List the tenant/plan-visible MCP tools, adapt each via {@link adaptMcpTool},\n * and register them into the {@link ToolRegistry}. A tool whose name is already\n * registered is skipped (reported, never thrown). Empty/blank tenantId fails\n * closed before any catalog call.\n */\nexport async function activateMcpTools(\n  registry: ToolRegistry,\n  catalog: McpServerCatalogPort,\n  client: McpClientLike,\n  ctx: { tenantId: string; plan?: string },\n): Promise<ActivateMcpToolsResult> {\n  const scope = ctxSchema.parse(ctx);\n\n  const entries = await catalog.listTools(\n    scope.plan === undefined\n      ? { tenantId: scope.tenantId }\n      : { tenantId: scope.tenantId, plan: scope.plan },\n  );\n\n  const registered: string[] = [];\n  const skipped: string[] = [];\n\n  for (const { server, definition } of entries) {\n    if (registry.list().some((r) => r.definition.name === definition.name)) {\n      skipped.push(definition.name);\n      continue;\n    }\n    const adapted = adaptMcpTool(server, definition, client);\n    registry.register(adapted.definition, adapted.handler, adapted.origin);\n    registered.push(definition.name);\n  }\n\n  return { registered, skipped };\n}\n"],"mappings":";;;;;AAaA,SAAS,SAAS;AAgBlB,IAAM,YAAY,EAAE,OAAO;AAAA,EACzB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,oCAAoC;AAAA,EACvE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACnC,CAAC;AAeD,eAAsB,iBACpB,UACA,SACA,QACA,KACiC;AACjC,QAAM,QAAQ,UAAU,MAAM,GAAG;AAEjC,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,MAAM,SAAS,SACX,EAAE,UAAU,MAAM,SAAS,IAC3B,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,KAAK;AAAA,EACnD;AAEA,QAAM,aAAuB,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAE3B,aAAW,EAAE,QAAQ,WAAW,KAAK,SAAS;AAC5C,QAAI,SAAS,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,SAAS,WAAW,IAAI,GAAG;AACtE,cAAQ,KAAK,WAAW,IAAI;AAC5B;AAAA,IACF;AACA,UAAM,UAAU,aAAa,QAAQ,YAAY,MAAM;AACvD,aAAS,SAAS,QAAQ,YAAY,QAAQ,SAAS,QAAQ,MAAM;AACrE,eAAW,KAAK,WAAW,IAAI;AAAA,EACjC;AAEA,SAAO,EAAE,YAAY,QAAQ;AAC/B;","names":[]}

package/dist/chunk-ZMYX5VBU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/skills.ts"],"sourcesContent":["/**\n * Skills system (WRAP — progressive-disclosure capability).\n *\n * Faithful re-expression of the source harness's two-phase skill model:\n *\n *   Phase 1 — Listing (cheap, always in context): a budget-bounded catalog\n *     exposing only {name, description, whenToUse} per skill. First-party\n *     skills (bundled/builtin tier) are never truncated and never dropped;\n *     lower-tier skills degrade to names-only, then drop, as the context\n *     budget is exhausted. Path-activated skills stay hidden until a touched\n *     file matches one of their globs.\n *\n *   Phase 2 — Invocation (lazy, on demand): expand the chosen skill's body\n *     into turn messages, with arg/var substitution and a merged tool\n *     allowlist contributed to the permission context.\n *\n * A skill IS a `Definition` — the same tenant-scoped layered resolver backs\n * the command registry and the subagent registry (see ./definitions).\n *\n * SECURITY: this re-expression intentionally drops the source's body-side\n * command-substitution (the upstream \"!`…`\" inline-shell facility). Skill\n * bodies are inert text; they NEVER trigger host shell execution here. All\n * entry points require a non-empty `tenantId` and fail closed; cross-tenant\n * inputs are rejected by the underlying `DefinitionResolver`. Pure data/logic\n * — no host filesystem access (resource base is an injected indirection).\n */\n\nimport { z } from \"zod\";\nimport {\n  type Definition,\n  type DefinitionResolver,\n  type ResolveContext,\n  substituteArguments,\n} from \"./definitions\";\n\n/** A skill is just a resolvable `Definition`. */\nexport type SkillRecord = Definition;\n\n/** Tiers treated as first-party (never truncated, never dropped). */\nconst FIRST_PARTY_TIERS: ReadonlySet<string> = new Set([\"bundled\", \"builtin\"]);\n\nconst isFirstParty = (s: SkillRecord): boolean => FIRST_PARTY_TIERS.has(s.sourceTier);\n\n// ── Phase 1: listing ─────────────────────────────────────────────────────────\n\n/** One catalog entry — only the cheap, always-in-context surface. */\nexport interface SkillListingEntry {\n  readonly name: string;\n  readonly description: string;\n  readonly whenToUse?: string | undefined;\n  /** True when this entry was degraded to names-only by the budget. */\n  readonly degraded: boolean;\n  readonly firstParty: boolean;\n}\n\nexport interface SkillListing {\n  readonly entries: readonly SkillListingEntry[];\n  readonly text: string;\n}\n\nconst listingOptionsSchema = z.object({\n  maxListingDescChars: z.number().int().positive().default(250),\n  contextWindowTokens: z.number().int().positive().default(200_000),\n  budgetPercent: z.number().positive().max(1).default(0.01),\n  touchedPaths: z.array(z.string()).default([]),\n});\nexport type SkillListingOptions = z.input<typeof listingOptionsSchema>;\n\n/** Cheap, deterministic token estimate (≈4 chars/token). */\nconst estimateTokens = (text: string): number => Math.ceil(text.length / 4);\n\n/** Minimal glob: `**` = any chars, `*` = any chars except `/`, else exact. */\nfunction globToRegExp(glob: string): RegExp {\n  let out = \"^\";\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i]!;\n    if (c === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        out += \".*\";\n        i++;\n      } else {\n        out += \"[^/]*\";\n      }\n    } else if (\".+?^${}()|[]\\\\\".includes(c)) {\n      out += `\\\\${c}`;\n    } else {\n      out += c;\n    }\n  }\n  return new RegExp(`${out}$`);\n}\n\nconst pathMatches = (globs: readonly string[], touched: readonly string[]): boolean =>\n  globs.some((g) => {\n    const re = globToRegExp(g);\n    return touched.some((p) => re.test(p));\n  });\n\n/** Stable order: first-party first, then by slug — deterministic output. */\nfunction orderSkills(skills: readonly SkillRecord[]): SkillRecord[] {\n  return [...skills].sort((a, b) => {\n    const fa = isFirstParty(a) ? 0 : 1;\n    const fb = isFirstParty(b) ? 0 : 1;\n    if (fa !== fb) return fa - fb;\n    return a.slug.localeCompare(b.slug);\n  });\n}\n\nconst truncate = (s: string, max: number): string => (s.length <= max ? s : s.slice(0, max));\n\nfunction renderEntry(e: SkillListingEntry): string {\n  const head = e.whenToUse ? `- ${e.name} — ${e.whenToUse}` : `- ${e.name}`;\n  return e.description ? `${head}\\n  ${e.description}` : head;\n}\n\n/**\n * Phase 1 — build the always-in-context skill catalog. Pure & deterministic.\n *\n * Budget = `contextWindowTokens * budgetPercent`. First-party skills are\n * emitted in full and do NOT consume budget against being dropped. Each\n * remaining skill is tried at full description; if it would overflow it is\n * degraded to names-only; if even that overflows it is dropped. Skills in\n * `ctx.loadedSlugs` and unactivated path-gated skills are suppressed.\n */\nexport function buildSkillListing(\n  resolver: DefinitionResolver<SkillRecord>,\n  ctx: ResolveContext,\n  options: SkillListingOptions = {},\n): SkillListing {\n  if (!ctx.tenantId) throw new Error(\"buildSkillListing: tenantId is required\");\n  const opts = listingOptionsSchema.parse(options);\n\n  const loaded = ctx.loadedSlugs ?? new Set<string>();\n  const visible = resolver\n    .resolve(ctx)\n    .filter((s) => !loaded.has(s.slug))\n    .filter((s) => {\n      const paths = s.frontmatter.paths;\n      return paths.length === 0 || pathMatches(paths, opts.touchedPaths);\n    });\n\n  const budget = Math.max(1, Math.floor(opts.contextWindowTokens * opts.budgetPercent));\n\n  const entries: SkillListingEntry[] = [];\n  let used = 0;\n\n  for (const s of orderSkills(visible)) {\n    const fp = isFirstParty(s);\n    const fm = s.frontmatter;\n    const fullDesc = fp ? fm.description : truncate(fm.description, opts.maxListingDescChars);\n\n    if (fp) {\n      const entry: SkillListingEntry = {\n        name: fm.name,\n        description: fm.description,\n        whenToUse: fm.whenToUse,\n        degraded: false,\n        firstParty: true,\n      };\n      entries.push(entry);\n      used += estimateTokens(renderEntry(entry));\n      continue;\n    }\n\n    const full: SkillListingEntry = {\n      name: fm.name,\n      description: fullDesc,\n      whenToUse: fm.whenToUse,\n      degraded: false,\n      firstParty: false,\n    };\n    const fullCost = estimateTokens(renderEntry(full));\n    if (used + fullCost <= budget) {\n      entries.push(full);\n      used += fullCost;\n      continue;\n    }\n\n    const nameOnly: SkillListingEntry = {\n      name: fm.name,\n      description: \"\",\n      whenToUse: undefined,\n      degraded: true,\n      firstParty: false,\n    };\n    const nameCost = estimateTokens(renderEntry(nameOnly));\n    if (used + nameCost <= budget) {\n      entries.push(nameOnly);\n      used += nameCost;\n    }\n    // else: drop entirely.\n  }\n\n  const text = entries.map(renderEntry).join(\"\\n\");\n  return { entries, text };\n}\n\n// ── Phase 2: invocation ──────────────────────────────────────────────────────\n\nexport interface SkillMessage {\n  readonly role: \"system\" | \"user\";\n  readonly content: string;\n}\n\nexport interface ExpandedSkill {\n  readonly messages: readonly SkillMessage[];\n  readonly allowedTools: readonly string[];\n  readonly modelOverride?: string | undefined;\n  readonly effort?: \"low\" | \"medium\" | \"high\" | undefined;\n  readonly executionMode: \"inline\" | \"fork\";\n}\n\nexport interface ExpandContext {\n  readonly tenantId: string;\n  readonly args: Record<string, string>;\n  readonly vars: Record<string, string>;\n  /** Lazy body fetch — host supplies; called only here, only once. */\n  readonly bodyLoader: (bodyRef: string) => Promise<string>;\n  /** Host-injected resource-base indirection (NO host FS access here). */\n  readonly skillResourceBase: (slug: string) => string;\n}\n\n/**\n * Phase 2 — expand a skill into turn messages. Body is loaded lazily via the\n * injected `bodyLoader` (never during listing). A `Base directory…` line is\n * prepended via the injected `skillResourceBase` indirection. Args + vars are\n * substituted with `substituteArguments`. The skill's `allowedTools` are\n * returned for the caller to merge into the permission context — this never\n * mutates global state and never executes anything from the body.\n */\nexport async function expandSkill(skill: SkillRecord, ctx: ExpandContext): Promise<ExpandedSkill> {\n  if (!ctx.tenantId) throw new Error(\"expandSkill: tenantId is required\");\n  if (skill.tenantId !== ctx.tenantId) {\n    throw new Error(\"expandSkill: cross-tenant skill access rejected\");\n  }\n\n  const rawBody = await ctx.bodyLoader(skill.bodyRef);\n  const body = substituteArguments(rawBody, ctx.args, ctx.vars);\n  const baseLine = `Base directory for this skill: ${ctx.skillResourceBase(skill.slug)}`;\n\n  const messages: readonly SkillMessage[] = [\n    { role: \"system\", content: baseLine },\n    { role: \"user\", content: body },\n  ];\n\n  const allowedTools = [...skill.frontmatter.allowedTools];\n\n  return {\n    messages,\n    allowedTools,\n    modelOverride: skill.frontmatter.model,\n    effort: skill.frontmatter.effort,\n    executionMode: skill.frontmatter.executionMode,\n  };\n}\n"],"mappings":";;;;;AA2BA,SAAS,SAAS;AAYlB,IAAM,oBAAyC,oBAAI,IAAI,CAAC,WAAW,SAAS,CAAC;AAE7E,IAAM,eAAe,CAAC,MAA4B,kBAAkB,IAAI,EAAE,UAAU;AAmBpF,IAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EAC5D,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA,EAChE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,IAAI;AAAA,EACxD,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAID,IAAM,iBAAiB,CAAC,SAAyB,KAAK,KAAK,KAAK,SAAS,CAAC;AAG1E,SAAS,aAAa,MAAsB;AAC1C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,KAAK;AACb,UAAI,KAAK,IAAI,CAAC,MAAM,KAAK;AACvB,eAAO;AACP;AAAA,MACF,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF,WAAW,iBAAiB,SAAS,CAAC,GAAG;AACvC,aAAO,KAAK,CAAC;AAAA,IACf,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,IAAI,OAAO,GAAG,GAAG,GAAG;AAC7B;AAEA,IAAM,cAAc,CAAC,OAA0B,YAC7C,MAAM,KAAK,CAAC,MAAM;AAChB,QAAM,KAAK,aAAa,CAAC;AACzB,SAAO,QAAQ,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;AACvC,CAAC;AAGH,SAAS,YAAY,QAA+C;AAClE,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AAChC,UAAM,KAAK,aAAa,CAAC,IAAI,IAAI;AACjC,UAAM,KAAK,aAAa,CAAC,IAAI,IAAI;AACjC,QAAI,OAAO,GAAI,QAAO,KAAK;AAC3B,WAAO,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EACpC,CAAC;AACH;AAEA,IAAM,WAAW,CAAC,GAAW,QAAyB,EAAE,UAAU,MAAM,IAAI,EAAE,MAAM,GAAG,GAAG;AAE1F,SAAS,YAAY,GAA8B;AACjD,QAAM,OAAO,EAAE,YAAY,KAAK,EAAE,IAAI,WAAM,EAAE,SAAS,KAAK,KAAK,EAAE,IAAI;AACvE,SAAO,EAAE,cAAc,GAAG,IAAI;AAAA,IAAO,EAAE,WAAW,KAAK;AACzD;AAWO,SAAS,kBACd,UACA,KACA,UAA+B,CAAC,GAClB;AACd,MAAI,CAAC,IAAI,SAAU,OAAM,IAAI,MAAM,yCAAyC;AAC5E,QAAM,OAAO,qBAAqB,MAAM,OAAO;AAE/C,QAAM,SAAS,IAAI,eAAe,oBAAI,IAAY;AAClD,QAAM,UAAU,SACb,QAAQ,GAAG,EACX,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,IAAI,CAAC,EACjC,OAAO,CAAC,MAAM;AACb,UAAM,QAAQ,EAAE,YAAY;AAC5B,WAAO,MAAM,WAAW,KAAK,YAAY,OAAO,KAAK,YAAY;AAAA,EACnE,CAAC;AAEH,QAAM,SAAS,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,sBAAsB,KAAK,aAAa,CAAC;AAEpF,QAAM,UAA+B,CAAC;AACtC,MAAI,OAAO;AAEX,aAAW,KAAK,YAAY,OAAO,GAAG;AACpC,UAAM,KAAK,aAAa,CAAC;AACzB,UAAM,KAAK,EAAE;AACb,UAAM,WAAW,KAAK,GAAG,cAAc,SAAS,GAAG,aAAa,KAAK,mBAAmB;AAExF,QAAI,IAAI;AACN,YAAM,QAA2B;AAAA,QAC/B,MAAM,GAAG;AAAA,QACT,aAAa,GAAG;AAAA,QAChB,WAAW,GAAG;AAAA,QACd,UAAU;AAAA,QACV,YAAY;AAAA,MACd;AACA,cAAQ,KAAK,KAAK;AAClB,cAAQ,eAAe,YAAY,KAAK,CAAC;AACzC;AAAA,IACF;AAEA,UAAM,OAA0B;AAAA,MAC9B,MAAM,GAAG;AAAA,MACT,aAAa;AAAA,MACb,WAAW,GAAG;AAAA,MACd,UAAU;AAAA,MACV,YAAY;AAAA,IACd;AACA,UAAM,WAAW,eAAe,YAAY,IAAI,CAAC;AACjD,QAAI,OAAO,YAAY,QAAQ;AAC7B,cAAQ,KAAK,IAAI;AACjB,cAAQ;AACR;AAAA,IACF;AAEA,UAAM,WAA8B;AAAA,MAClC,MAAM,GAAG;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,UAAU;AAAA,MACV,YAAY;AAAA,IACd;AACA,UAAM,WAAW,eAAe,YAAY,QAAQ,CAAC;AACrD,QAAI,OAAO,YAAY,QAAQ;AAC7B,cAAQ,KAAK,QAAQ;AACrB,cAAQ;AAAA,IACV;AAAA,EAEF;AAEA,QAAM,OAAO,QAAQ,IAAI,WAAW,EAAE,KAAK,IAAI;AAC/C,SAAO,EAAE,SAAS,KAAK;AACzB;AAmCA,eAAsB,YAAY,OAAoB,KAA4C;AAChG,MAAI,CAAC,IAAI,SAAU,OAAM,IAAI,MAAM,mCAAmC;AACtE,MAAI,MAAM,aAAa,IAAI,UAAU;AACnC,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AAEA,QAAM,UAAU,MAAM,IAAI,WAAW,MAAM,OAAO;AAClD,QAAM,OAAO,oBAAoB,SAAS,IAAI,MAAM,IAAI,IAAI;AAC5D,QAAM,WAAW,kCAAkC,IAAI,kBAAkB,MAAM,IAAI,CAAC;AAEpF,QAAM,WAAoC;AAAA,IACxC,EAAE,MAAM,UAAU,SAAS,SAAS;AAAA,IACpC,EAAE,MAAM,QAAQ,SAAS,KAAK;AAAA,EAChC;AAEA,QAAM,eAAe,CAAC,GAAG,MAAM,YAAY,YAAY;AAEvD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,eAAe,MAAM,YAAY;AAAA,IACjC,QAAQ,MAAM,YAAY;AAAA,IAC1B,eAAe,MAAM,YAAY;AAAA,EACnC;AACF;","names":[]}

package/src/adapters/dispatcher-sse.test.ts

@@ -1,218 +0,0 @@
-/**
- * Web-standard transport binding tests — no server, no framework.
- *
- * Every test constructs a `new Request(...)` and inspects a `Response` via
- * Web-standard APIs only (`response.text()`, `response.body!.getReader()`).
- */
-
-import { describe, expect, it } from "vitest";
-import { ProtocolDispatcher } from "../dispatcher";
-import type { ThreadEvent } from "../model";
-import { createRpcHandler, sseResponse, subscribeNotifications } from "./dispatcher-sse.js";
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-/** A dispatcher with one echo handler bound to a real registered method. */
-function freshDispatcher(): ProtocolDispatcher {
-  const d = new ProtocolDispatcher();
-  // `thread/start` is in the method registry; echo its params back.
-  d.register("thread/start", async (params) => ({ echoed: params }));
-  return d;
-}
-
-function jsonRequest(body: unknown): Request {
-  return new Request("https://edge.test/rpc", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: typeof body === "string" ? body : JSON.stringify(body),
-  });
-}
-
-/** Drain an SSE Response body into its raw decoded text. */
-async function drainSse(res: Response): Promise<string> {
-  if (!res.body) throw new Error("SSE response body is missing");
-  const reader = res.body.getReader();
-  const decoder = new TextDecoder();
-  let out = "";
-  for (;;) {
-    const { value, done } = await reader.read();
-    if (done) break;
-    out += decoder.decode(value, { stream: true });
-  }
-  out += decoder.decode();
-  return out;
-}
-
-async function* eventsOf(...events: ThreadEvent[]): AsyncIterable<ThreadEvent> {
-  for (const e of events) yield e;
-}
-
-// ── createRpcHandler ─────────────────────────────────────────────────────────
-
-describe("createRpcHandler", () => {
-  it("returns a JSON-RPC success envelope (200, application/json) on happy path", async () => {
-    const handler = createRpcHandler(freshDispatcher());
-    const res = await handler(
-      jsonRequest({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "thread/start",
-        tenantId: "org_123",
-        params: { hello: "world" },
-      }),
-    );
-
-    expect(res.status).toBe(200);
-    expect(res.headers.get("content-type")).toContain("application/json");
-    const body = await res.json();
-    expect(body).toEqual({
-      jsonrpc: "2.0",
-      id: 1,
-      result: { echoed: { hello: "world" } },
-    });
-  });
-
-  it("returns a well-formed JSON-RPC parse error (400) on malformed JSON — never throws", async () => {
-    const handler = createRpcHandler(freshDispatcher());
-    const res = await handler(jsonRequest("{ not valid json"));
-
-    expect(res.status).toBe(400);
-    expect(res.headers.get("content-type")).toContain("application/json");
-    const body = await res.json();
-    expect(body.jsonrpc).toBe("2.0");
-    expect(body.id).toBeNull();
-    expect(body.error.code).toBe(-32700);
-    expect(typeof body.error.message).toBe("string");
-  });
-
-  it("fails closed on a missing-tenant envelope (200 JSON-RPC business error)", async () => {
-    const handler = createRpcHandler(freshDispatcher());
-    const res = await handler(
-      jsonRequest({ jsonrpc: "2.0", id: 7, method: "thread/start", params: {} }),
-    );
-
-    // Envelope was parseable JSON → 200, but dispatch fails closed.
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.jsonrpc).toBe("2.0");
-    expect(body.error).toBeDefined();
-    expect(body.error.code).toBe(-32600);
-  });
-
-  it("returns method-not-found JSON-RPC error for an unknown method", async () => {
-    const handler = createRpcHandler(freshDispatcher());
-    const res = await handler(
-      jsonRequest({ jsonrpc: "2.0", id: 9, method: "totally/unknown", tenantId: "org_1" }),
-    );
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.error.code).toBe(-32601);
-  });
-});
-
-// ── sseResponse ──────────────────────────────────────────────────────────────
-
-describe("sseResponse", () => {
-  it("sets text/event-stream + no-cache headers", () => {
-    const res = sseResponse(eventsOf({ type: "turn.started" }));
-    expect(res.status).toBe(200);
-    expect(res.headers.get("content-type")).toContain("text/event-stream");
-    expect(res.headers.get("cache-control")).toContain("no-cache");
-  });
-
-  it("streams multiple events in order with correct SSE framing", async () => {
-    const stream = eventsOf(
-      { type: "thread.started", threadId: "t1" },
-      { type: "turn.started" },
-      {
-        type: "turn.completed",
-        usage: { inputTokens: 1, cachedInputTokens: 0, outputTokens: 2, reasoningOutputTokens: 0 },
-      },
-    );
-    const text = await drainSse(sseResponse(stream));
-
-    const frames = text.split("\n\n").filter(Boolean);
-    expect(frames).toHaveLength(3);
-    expect(frames[0]).toBe(
-      `event: thread.started\ndata: ${JSON.stringify({ type: "thread.started", threadId: "t1" })}`,
-    );
-    expect(frames[1]).toBe(
-      `event: turn.started\ndata: ${JSON.stringify({ type: "turn.started" })}`,
-    );
-    expect((frames[2] ?? "").startsWith("event: turn.completed\n")).toBe(true);
-  });
-
-  it("surfaces a mid-stream iterable error as a final `event: error` frame then closes", async () => {
-    async function* boom(): AsyncIterable<ThreadEvent> {
-      yield { type: "turn.started" };
-      throw new Error("upstream exploded");
-    }
-    const text = await drainSse(sseResponse(boom()));
-    const frames = text.split("\n\n").filter(Boolean);
-
-    expect(frames[0]).toBe(
-      `event: turn.started\ndata: ${JSON.stringify({ type: "turn.started" })}`,
-    );
-    const last = frames.at(-1) ?? "";
-    expect(last.startsWith("event: error\n")).toBe(true);
-    expect(last).toContain("upstream exploded");
-  });
-
-  it("cancels promptly when the provided AbortSignal aborts", async () => {
-    const ac = new AbortController();
-    let produced = 0;
-    async function* infinite(): AsyncIterable<ThreadEvent> {
-      for (;;) {
-        produced += 1;
-        yield { type: "turn.started" };
-        if (produced === 2) ac.abort();
-        await new Promise((r) => setTimeout(r, 1));
-      }
-    }
-    const res = sseResponse(infinite(), { signal: ac.signal });
-    const text = await drainSse(res);
-    // Stream terminated; did not run forever.
-    expect(text.length).toBeGreaterThan(0);
-    expect(produced).toBeLessThan(50);
-  });
-
-  it("does not throw when aborted before the first read", async () => {
-    const ac = new AbortController();
-    ac.abort();
-    const res = sseResponse(eventsOf({ type: "turn.started" }), { signal: ac.signal });
-    const text = await drainSse(res);
-    expect(typeof text).toBe("string");
-  });
-});
-
-// ── subscribeNotifications ───────────────────────────────────────────────────
-
-describe("subscribeNotifications", () => {
-  it("bridges dispatcher notifications into an async iterable", async () => {
-    const d = new ProtocolDispatcher();
-    const iter = subscribeNotifications(d, ["turn/started", "turn/completed"]);
-    const reader = iter[Symbol.asyncIterator]();
-
-    queueMicrotask(() => {
-      d.emitNotification("turn/started", { a: 1 });
-      d.emitNotification("turn/completed", { b: 2 });
-    });
-
-    const first = await reader.next();
-    const second = await reader.next();
-    expect(first.value).toEqual({ name: "turn/started", payload: { a: 1 } });
-    expect(second.value).toEqual({ name: "turn/completed", payload: { b: 2 } });
-
-    await reader.return?.();
-  });
-
-  it("stops yielding after return() unsubscribes", async () => {
-    const d = new ProtocolDispatcher();
-    const iter = subscribeNotifications(d, ["turn/started"]);
-    const reader = iter[Symbol.asyncIterator]();
-    const done = await reader.return?.();
-    expect(done?.done).toBe(true);
-    // Emitting after teardown must not throw or buffer indefinitely.
-    expect(() => d.emitNotification("turn/started", {})).not.toThrow();
-  });
-});