@oscharko-dev/keiko 0.1.6 → 0.1.7

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/exec.js

@@ -0,0 +1,5 @@
+// Re-export shim: command execution boundary lives in @oscharko-dev/keiko-tools
+// (issue #162, ADR-0019). All existing import sites (`from "../tools/exec.js"`) keep resolving
+// unchanged via this barrel.
+export { nodeHomeProvider, nodeSpawnFn } from "@oscharko-dev/keiko-tools/internal/exec";
+export { runCommand, } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/index.d.ts

@@ -0,0 +1,14 @@
+export type { CommandResult, CommandRule, CommandRunInput, NetworkPolicy, PatchApplyResult, PatchChangeKind, PatchConflict, PatchFileChange, PatchHunk, PatchLimits, PatchRejection, PatchRejectionCode, PatchValidation, SandboxPolicy, ToolHostConfig, ToolHostConfigInput, } from "@oscharko-dev/keiko-tools";
+export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "@oscharko-dev/keiko-tools";
+export { CommandCancelledError, CommandDeniedError, CommandTimeoutError, OutputLimitError, PatchApplyDisabledError, PatchApplyError, PatchValidationError, TOOL_CODES, ToolArgumentError, ToolError, UnknownToolError, type ToolCode, } from "@oscharko-dev/keiko-tools";
+export { buildSandboxEnv, collectSensitiveEnvValues, isCommandAllowed, type CommandDecision, } from "@oscharko-dev/keiko-tools";
+export { nodeWorkspaceWriter } from "@oscharko-dev/keiko-tools/internal/writer";
+export type { WorkspaceWriter } from "@oscharko-dev/keiko-tools";
+export { nodeSpawnFn } from "@oscharko-dev/keiko-tools/internal/exec";
+export { runCommand, type RunCommandDeps, type RunCommandInput, type ExecutableResolver, type ExecutableResolverDeps, type SpawnFn, type SpawnOptions, } from "@oscharko-dev/keiko-tools";
+export { applyPatch, renderDryRun, validatePatch, type ApplyDeps, type ValidateDeps, } from "@oscharko-dev/keiko-tools";
+export { normalizeUnifiedDiffHunks } from "@oscharko-dev/keiko-tools";
+export { parseUnifiedDiff, type ParsedPatch } from "@oscharko-dev/keiko-tools";
+export { TOOL_DEFINITIONS } from "@oscharko-dev/keiko-tools";
+export { WorkspaceToolHost } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/tools/index.ts"],"names":[],"mappings":"AAWA,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,cAAc,EACd,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,iBAAiB,EACjB,SAAS,EACT,gBAAgB,EAChB,KAAK,QAAQ,GACd,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAChF,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAEtE,OAAO,EACL,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,UAAU,EACV,YAAY,EACZ,aAAa,EACb,KAAK,SAAS,EACd,KAAK,YAAY,GAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/index.js

@@ -0,0 +1,21 @@
+// Re-export shim: the safe tool-execution layer lives in @oscharko-dev/keiko-tools
+// (issue #162, ADR-0019). All existing import sites (`from "../tools/index.js"`) keep
+// resolving unchanged via this barrel.
+//
+// Explicitly enumerated to match the PRE-MOVE surface of `src/tools/index.ts`. Browser CDP
+// symbols (CdpClient, validators, BrowserToolError, BrowserSessionManager, etc.) are
+// deliberately ABSENT from this barrel — they were only ever accessible via
+// `src/tools/browser/index.ts` before the extraction, and the legacy shim there preserves
+// that surface. Mirrors the workspace shim asymmetry pattern (`nodeWorkspaceFs` not exposed
+// on the legacy workspace barrel) so a future SDK-leak test can pin this invariant.
+export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "@oscharko-dev/keiko-tools";
+export { CommandCancelledError, CommandDeniedError, CommandTimeoutError, OutputLimitError, PatchApplyDisabledError, PatchApplyError, PatchValidationError, TOOL_CODES, ToolArgumentError, ToolError, UnknownToolError, } from "@oscharko-dev/keiko-tools";
+export { buildSandboxEnv, collectSensitiveEnvValues, isCommandAllowed, } from "@oscharko-dev/keiko-tools";
+export { nodeWorkspaceWriter } from "@oscharko-dev/keiko-tools/internal/writer";
+export { nodeSpawnFn } from "@oscharko-dev/keiko-tools/internal/exec";
+export { runCommand, } from "@oscharko-dev/keiko-tools";
+export { applyPatch, renderDryRun, validatePatch, } from "@oscharko-dev/keiko-tools";
+export { normalizeUnifiedDiffHunks } from "@oscharko-dev/keiko-tools";
+export { parseUnifiedDiff } from "@oscharko-dev/keiko-tools";
+export { TOOL_DEFINITIONS } from "@oscharko-dev/keiko-tools";
+export { WorkspaceToolHost } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch-content.d.ts

@@ -0,0 +1,2 @@
+export { computeFileContent, type ApplyOutcome, type HunkConflict, } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=patch-content.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch-content.d.ts","sourceRoot":"","sources":["../../../../../src/tools/patch-content.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch-content.js

@@ -0,0 +1,4 @@
+// Re-export shim: patch-content helpers live in @oscharko-dev/keiko-tools (issue #162, ADR-0019).
+// All existing import sites (`from "../tools/patch-content.js"`) keep resolving unchanged via this
+// barrel.
+export { computeFileContent, } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch-normalize.d.ts

@@ -0,0 +1,2 @@
+export { normalizeUnifiedDiffHunks } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=patch-normalize.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch-normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch-normalize.d.ts","sourceRoot":"","sources":["../../../../../src/tools/patch-normalize.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch-normalize.js

@@ -0,0 +1,4 @@
+// Re-export shim: unified-diff normalization lives in @oscharko-dev/keiko-tools (issue #162,
+// ADR-0019). All existing import sites (`from "../tools/patch-normalize.js"`) keep resolving
+// unchanged via this barrel.
+export { normalizeUnifiedDiffHunks } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch-parse.d.ts

@@ -0,0 +1,2 @@
+export { parseUnifiedDiff, PatchParseError, type ParsedPatch } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=patch-parse.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch-parse.d.ts","sourceRoot":"","sources":["../../../../../src/tools/patch-parse.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch-parse.js

@@ -0,0 +1,4 @@
+// Re-export shim: the unified-diff parser lives in @oscharko-dev/keiko-tools (issue #162,
+// ADR-0019). All existing import sites (`from "../tools/patch-parse.js"`) keep resolving
+// unchanged via this barrel.
+export { parseUnifiedDiff, PatchParseError } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch.d.ts

@@ -0,0 +1,2 @@
+export { applyPatch, renderDryRun, validatePatch, type ApplyDeps, type ValidateDeps, } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=patch.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch.d.ts","sourceRoot":"","sources":["../../../../../src/tools/patch.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,YAAY,EACZ,aAAa,EACb,KAAK,SAAS,EACd,KAAK,YAAY,GAClB,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/patch.js

@@ -0,0 +1,3 @@
+// Re-export shim: the patch workflow lives in @oscharko-dev/keiko-tools (issue #162, ADR-0019).
+// All existing import sites (`from "../tools/patch.js"`) keep resolving unchanged via this barrel.
+export { applyPatch, renderDryRun, validatePatch, } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/registry.d.ts

@@ -0,0 +1,2 @@
+export { WorkspaceToolHost } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=registry.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../../src/tools/registry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/registry.js

@@ -0,0 +1,4 @@
+// Re-export shim: the WorkspaceToolHost (ToolPort implementation) lives in
+// @oscharko-dev/keiko-tools (issue #162, ADR-0019). All existing import sites
+// (`from "../tools/registry.js"`) keep resolving unchanged via this barrel.
+export { WorkspaceToolHost } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/sandbox.d.ts

@@ -0,0 +1,2 @@
+export { buildSandboxEnv, collectSensitiveEnvValues, isCommandAllowed, type CommandDecision, } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=sandbox.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../../../src/tools/sandbox.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/sandbox.js

@@ -0,0 +1,4 @@
+// Re-export shim: sandbox env + command-allowlist decisions live in @oscharko-dev/keiko-tools
+// (issue #162, ADR-0019). All existing import sites (`from "../tools/sandbox.js"`) keep resolving
+// unchanged via this barrel.
+export { buildSandboxEnv, collectSensitiveEnvValues, isCommandAllowed, } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/schemas.d.ts

@@ -0,0 +1,2 @@
+export { TOOL_DEFINITIONS } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=schemas.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../../src/tools/schemas.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/schemas.js

@@ -0,0 +1,4 @@
+// Re-export shim: the model-facing tool-definitions table lives in @oscharko-dev/keiko-tools
+// (issue #162, ADR-0019). All existing import sites (`from "../tools/schemas.js"`) keep resolving
+// unchanged via this barrel.
+export { TOOL_DEFINITIONS } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/terminal-policy.d.ts

@@ -0,0 +1,2 @@
+export { TERMINAL_COMMAND_RULES, TERMINAL_NO_FLAGS, isTerminalCommandAllowed, type TerminalCommandDecision, } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=terminal-policy.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/terminal-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-policy.d.ts","sourceRoot":"","sources":["../../../../../src/tools/terminal-policy.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/terminal-policy.js

@@ -0,0 +1,4 @@
+// Re-export shim: the terminal-policy command-allowlist gate lives in
+// @oscharko-dev/keiko-tools (issue #162, ADR-0019). All existing import sites
+// (`from "../tools/terminal-policy.js"`) keep resolving unchanged via this barrel.
+export { TERMINAL_COMMAND_RULES, TERMINAL_NO_FLAGS, isTerminalCommandAllowed, } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/types.d.ts

@@ -0,0 +1,3 @@
+export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "@oscharko-dev/keiko-tools";
+export type { CommandResult, CommandRule, CommandRunInput, NetworkPolicy, PatchApplyResult, PatchChangeKind, PatchConflict, PatchFileChange, PatchHunk, PatchLimits, PatchRejection, PatchRejectionCode, PatchValidation, SandboxPolicy, ToolHostConfig, ToolHostConfigInput, } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=types.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/tools/types.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,cAAc,EACd,mBAAmB,GACpB,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/types.js

@@ -0,0 +1,4 @@
+// Re-export shim: tool contract types + frozen defaults + resolveToolHostConfig live in
+// @oscharko-dev/keiko-tools (issue #162, ADR-0019). All existing import sites
+// (`from "../tools/types.js"`) keep resolving unchanged via this barrel.
+export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "@oscharko-dev/keiko-tools";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/writer.d.ts

@@ -0,0 +1,3 @@
+export { nodeWorkspaceWriter } from "@oscharko-dev/keiko-tools/internal/writer";
+export type { WorkspaceWriter } from "@oscharko-dev/keiko-tools";
+//# sourceMappingURL=writer.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../../../src/tools/writer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAChF,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/tools/writer.js

@@ -0,0 +1,4 @@
+// Re-export shim: the WorkspaceWriter port + nodeWorkspaceWriter adapter live in
+// @oscharko-dev/keiko-tools (issue #162, ADR-0019). All existing import sites
+// (`from "../tools/writer.js"`) keep resolving unchanged via this barrel.
+export { nodeWorkspaceWriter } from "@oscharko-dev/keiko-tools/internal/writer";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/ui/index.d.ts

@@ -0,0 +1,21 @@
+export { createUiServer, DEFAULT_UI_PORT, UI_HOST, type UiServerDeps, } from "@oscharko-dev/keiko-server";
+export { buildCspHeader, extractInlineScriptHashes } from "@oscharko-dev/keiko-server";
+export { loadCspHeader } from "@oscharko-dev/keiko-server";
+export { applySecurityHeaders } from "@oscharko-dev/keiko-server";
+export { isAllowedHost } from "@oscharko-dev/keiko-server";
+export { resolveContainedPath, serveFile } from "@oscharko-dev/keiko-server";
+export { API_ROUTES, isApiPath, matchRoute, errorBody, STREAMING, type ApiError, type HandlerOutcome, type RouteContext, type RouteDefinition, type RouteHandler, type RouteMatch, type RouteResult, } from "@oscharko-dev/keiko-server";
+export { buildUiHandlerDeps, buildRedactor, type UiHandlerDeps, type BuildHandlerDepsOptions, type Redactor, type ModelPortFactory, } from "@oscharko-dev/keiko-server";
+export { createRunRegistry, ActiveRunLimitError, type RunRegistry, type RunRecord, type RunStatus, type AppliableSnapshot, } from "@oscharko-dev/keiko-server";
+export { QueueEventSink, type StreamEvent, type SseWriter } from "@oscharko-dev/keiko-server";
+export { parseRunRequest, type RunRequest, type RunKind } from "@oscharko-dev/keiko-server";
+export { startRun, applyRun, type StartRunResult } from "@oscharko-dev/keiko-server";
+export { handleCreateRun, handleRunEvents, handleCancelRun, handleGetRun, handleApplyRun, } from "@oscharko-dev/keiko-server";
+export { persistWorkflowEvidence, persistExplainEvidence, type EvidencePersistContext, type RunIdentity, } from "@oscharko-dev/keiko-server";
+export { createInMemoryUiStore, createNodeUiStore, isProjectAvailable, resolveUiDbPath, runMigrations, SCHEMA_VERSION, UI_DB_DIRNAME, UI_DB_FILENAME, UiStoreError, validateProjectPath, type Chat, type ChatMessage, type ChatRole, type CreateChatOptions, type NewChatMessage, type Project, type UiStore, type UiStoreErrorCode, type UiStoreFactoryOptions, type UpdateChatPatch, type UpdateProjectPatch, type WorkflowStatus, } from "@oscharko-dev/keiko-server";
+export { handleListProjects, handleCreateProject, handleUpdateProject, handleDeleteProject, handleListChats, handleCreateChat, handleUpdateChat, handleDeleteChat, handleListMessages, handleCreateMessage, } from "@oscharko-dev/keiko-server";
+export { createTerminalExecutionManager, buildTerminalPolicySummary, listDirectories, type TerminalDirectoryListing, type TerminalExecutionInput, type TerminalExecutionManager, type TerminalExecutionResult, type TerminalEventEmitter, type TerminalEventEnvelope, type TerminalEventKind, type TerminalPolicySummary, } from "@oscharko-dev/keiko-server";
+export { TerminalToolError, type TerminalErrorCode } from "@oscharko-dev/keiko-server";
+export { buildTerminalEvidenceEntry, appendTerminalEvidence, type TerminalEvidenceEntry, } from "@oscharko-dev/keiko-server";
+export { listFilesDirectories, readFilesPreview, readFilesTree, type FilesDirectoryEntry, type FilesDirectoryListing, type FilesDirectoryRoot, type FilesEntryKind, type FilesPreviewResponse, type FilesTreeEntry, type FilesTreeResponse, } from "@oscharko-dev/keiko-server";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/index.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,cAAc,EACd,eAAe,EACf,OAAO,EACP,KAAK,YAAY,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,QAAQ,EACb,KAAK,gBAAgB,GACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,eAAe,EACf,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/ui/index.js

@@ -0,0 +1,27 @@
+// Re-export shim: the local UI BFF runtime now lives in @oscharko-dev/keiko-server
+// (issue #166, ADR-0019). Existing consumers (`src/cli/ui.ts`, `src/cli/lifecycle.ts`,
+// in-repo SDK callers, package-surface verification tests) import from the legacy
+// path; this shim preserves those import paths. Explicit-named re-exports (no
+// `export *`) keep the surface auditable — same convention as the harness, workflows,
+// evidence, tools, workspace, and model-gateway shims.
+export { createUiServer, DEFAULT_UI_PORT, UI_HOST, } from "@oscharko-dev/keiko-server";
+export { buildCspHeader, extractInlineScriptHashes } from "@oscharko-dev/keiko-server";
+export { loadCspHeader } from "@oscharko-dev/keiko-server";
+export { applySecurityHeaders } from "@oscharko-dev/keiko-server";
+export { isAllowedHost } from "@oscharko-dev/keiko-server";
+export { resolveContainedPath, serveFile } from "@oscharko-dev/keiko-server";
+export { API_ROUTES, isApiPath, matchRoute, errorBody, STREAMING, } from "@oscharko-dev/keiko-server";
+export { buildUiHandlerDeps, buildRedactor, } from "@oscharko-dev/keiko-server";
+export { createRunRegistry, ActiveRunLimitError, } from "@oscharko-dev/keiko-server";
+export { QueueEventSink } from "@oscharko-dev/keiko-server";
+export { parseRunRequest } from "@oscharko-dev/keiko-server";
+export { startRun, applyRun } from "@oscharko-dev/keiko-server";
+export { handleCreateRun, handleRunEvents, handleCancelRun, handleGetRun, handleApplyRun, } from "@oscharko-dev/keiko-server";
+export { persistWorkflowEvidence, persistExplainEvidence, } from "@oscharko-dev/keiko-server";
+// ADR-0013 — UI-local SQLite persistence: ports, factories, and route handlers.
+export { createInMemoryUiStore, createNodeUiStore, isProjectAvailable, resolveUiDbPath, runMigrations, SCHEMA_VERSION, UI_DB_DIRNAME, UI_DB_FILENAME, UiStoreError, validateProjectPath, } from "@oscharko-dev/keiko-server";
+export { handleListProjects, handleCreateProject, handleUpdateProject, handleDeleteProject, handleListChats, handleCreateChat, handleUpdateChat, handleDeleteChat, handleListMessages, handleCreateMessage, } from "@oscharko-dev/keiko-server";
+export { createTerminalExecutionManager, buildTerminalPolicySummary, listDirectories, } from "@oscharko-dev/keiko-server";
+export { TerminalToolError } from "@oscharko-dev/keiko-server";
+export { buildTerminalEvidenceEntry, appendTerminalEvidence, } from "@oscharko-dev/keiko-server";
+export { listFilesDirectories, readFilesPreview, readFilesTree, } from "@oscharko-dev/keiko-server";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/classify.d.ts

@@ -0,0 +1,11 @@
+import type { CommandResult } from "../tools/index.js";
+import type { VerificationStatus } from "./types.js";
+export type AbortReason = "harness" | "memory" | undefined;
+export interface OutcomeInput {
+    readonly skipped: boolean;
+    readonly result: CommandResult | undefined;
+    readonly error: unknown;
+    readonly abortReason: AbortReason;
+}
+export declare function classifyOutcome(input: OutcomeInput): VerificationStatus;
+//# sourceMappingURL=classify.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../../../../src/verification/classify.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKrD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,YAAY;IAE3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;IAE3C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAqCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,kBAAkB,CAavE"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/classify.js

@@ -0,0 +1,53 @@
+// PURE outcome classification (ADR-0007 D1). The single authority mapping a settled runCommand
+// outcome — a resolved CommandResult OR a rejection — plus the orchestrator's abortReason to a
+// VerificationStatus. No IO, no spawn, no clock: the orchestrator owns all effects and calls this
+// once per step. The precedence is fixed and the first match wins; each branch is independently
+// unit-tested so a single-line mutation is caught.
+import { CommandCancelledError, CommandDeniedError, CommandTimeoutError } from "../tools/index.js";
+function classifyError(error, abortReason) {
+    if (error instanceof CommandDeniedError) {
+        return "denied";
+    }
+    if (abortReason === "memory") {
+        return "resource-exceeded";
+    }
+    if (abortReason === "harness") {
+        return "cancelled";
+    }
+    if (error instanceof CommandTimeoutError) {
+        return "timed-out";
+    }
+    if (error instanceof CommandCancelledError) {
+        // D1 branch 6's `memory → resource-exceeded` sub-case is handled earlier by branch 3
+        // (`abortReason === "memory"` returns before we reach here), so a CommandCancelledError that
+        // survives to this point is, by construction, a harness/plain cancellation.
+        return "cancelled";
+    }
+    return "failed";
+}
+function classifyResult(result) {
+    if (result.timedOut) {
+        return "timed-out";
+    }
+    if (result.truncated) {
+        return "resource-exceeded";
+    }
+    if (result.exitCode === 0) {
+        return "passed";
+    }
+    return "failed";
+}
+export function classifyOutcome(input) {
+    if (input.skipped) {
+        return "skipped";
+    }
+    if (input.error !== undefined) {
+        return classifyError(input.error, input.abortReason);
+    }
+    if (input.result !== undefined) {
+        return classifyResult(input.result);
+    }
+    // No result and no error is not a reachable runCommand settle state; treat as failed defensively
+    // at this internal boundary so the function is total over its input type.
+    return "failed";
+}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/detect.d.ts

@@ -0,0 +1,5 @@
+import type { WorkspaceFs, WorkspaceInfo } from "../workspace/index.js";
+import type { ScriptCatalog, ScriptMapping } from "./types.js";
+export declare function classifyScripts(scripts: Readonly<Record<string, string>>): ScriptMapping;
+export declare function detectScripts(workspace: WorkspaceInfo, fs?: WorkspaceFs): ScriptCatalog;
+//# sourceMappingURL=detect.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../../../../src/verification/detect.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAkE/D,wBAAgB,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,aAAa,CAQxF;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,WAAW,GAAG,aAAa,CAevF"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/detect.js

@@ -0,0 +1,81 @@
+// npm-script detection and kind classification. Reads package.json through the workspace
+// WorkspaceFs boundary (never raw node:fs), mirroring the parseScripts approach in
+// src/tools/registry.ts but adding the kind-mapping layer the plan consumes.
+//
+// All name matching is done with plain substring/equality checks (no regex), so there is no
+// ReDoS surface at all (CodeQL js/polynomial-redos). Script NAMES are matched, never values.
+import { readWorkspaceFile } from "../workspace/index.js";
+// package.json is small; this cap is generous and prevents reading a pathological file.
+const PACKAGE_READ_BYTES = 262_144;
+function parseScripts(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        // A malformed package.json yields no scripts rather than throwing: detection is best-effort
+        // and the plan will mark every kind skipped, which is a visible, testable outcome (D4).
+        return {};
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        return {};
+    }
+    const scripts = parsed.scripts;
+    if (typeof scripts !== "object" || scripts === null) {
+        return {};
+    }
+    const out = {};
+    for (const [name, value] of Object.entries(scripts)) {
+        if (typeof value === "string") {
+            out[name] = value;
+        }
+    }
+    return out;
+}
+// Returns the first script name whose lowercased name satisfies `match`, preferring an exact-name
+// hit over a substring hit so `test` wins over `pretest`/`test:watch` for the test kind.
+function pickScript(names, exact, contains) {
+    for (const name of names) {
+        if (exact.includes(name.toLowerCase())) {
+            return name;
+        }
+    }
+    for (const name of names) {
+        const lower = name.toLowerCase();
+        if (contains.some((needle) => lower.includes(needle)) &&
+            !contains.some((needle) => isLifecycleWrapper(lower, needle))) {
+            return name;
+        }
+    }
+    return undefined;
+}
+function isLifecycleWrapper(lowerName, needle) {
+    return (lowerName === `pre${needle}` ||
+        lowerName === `post${needle}` ||
+        lowerName.startsWith(`pre${needle}:`) ||
+        lowerName.startsWith(`post${needle}:`));
+}
+// Maps script names to verification kinds via conventional heuristics. Exact-name matches win;
+// otherwise a substring of the lowercased name. `typecheck`/`type-check`/`tsc` → typecheck;
+// `lint`/`eslint` → lint; `build` → build; `test` → test.
+export function classifyScripts(scripts) {
+    const names = Object.keys(scripts);
+    return {
+        test: pickScript(names, ["test"], ["test"]),
+        typecheck: pickScript(names, ["typecheck", "type-check", "tsc"], ["typecheck", "type-check"]),
+        lint: pickScript(names, ["lint"], ["lint", "eslint"]),
+        build: pickScript(names, ["build"], ["build"]),
+    };
+}
+export function detectScripts(workspace, fs) {
+    let scripts;
+    try {
+        const content = readWorkspaceFile(workspace, "package.json", { maxBytes: PACKAGE_READ_BYTES }, fs);
+        scripts = parseScripts(content.text);
+    }
+    catch {
+        // No package.json or an unreadable one: no scripts detected. The plan marks kinds skipped (D4).
+        scripts = {};
+    }
+    return { scripts, mapping: classifyScripts(scripts) };
+}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/errors.d.ts

@@ -0,0 +1,3 @@
+export { VERIFICATION_CODES, VerificationError, EmptyPlanError, } from "@oscharko-dev/keiko-security/errors/verification";
+export type { VerificationCode } from "@oscharko-dev/keiko-security/errors/verification";
+//# sourceMappingURL=errors.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../src/verification/errors.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,GACf,MAAM,kDAAkD,CAAC;AAC1D,YAAY,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/errors.js

@@ -0,0 +1,4 @@
+// Re-export shim: the verification error taxonomy now lives in @oscharko-dev/keiko-security
+// (issue #159, ADR-0019). All existing import sites (`from "./errors.js"`) keep resolving
+// unchanged via this barrel.
+export { VERIFICATION_CODES, VerificationError, EmptyPlanError, } from "@oscharko-dev/keiko-security/errors/verification";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/index.d.ts

@@ -0,0 +1,18 @@
+export type { ResourceDimension, ResourceLimitDecision, ScriptCatalog, ScriptMapping, VerificationKind, VerificationPlan, VerificationReport, VerificationResourceLimits, VerificationResult, VerificationStatus, VerificationStep, } from "./types.js";
+export { DEFAULT_VERIFICATION_LIMITS } from "./types.js";
+export { VERIFICATION_CODES, VerificationError, EmptyPlanError } from "./errors.js";
+export type { VerificationCode } from "./errors.js";
+export { classifyScripts, detectScripts } from "./detect.js";
+export { classifyOutcome } from "./classify.js";
+export type { AbortReason, OutcomeInput } from "./classify.js";
+export { buildVerificationPlan, resolveTargetedTests } from "./plan.js";
+export type { PlanOptions } from "./plan.js";
+export { nodeResourceMonitor } from "./monitor.js";
+export type { ResourceMonitor } from "./monitor.js";
+export { buildAppliedLimits } from "./limits.js";
+export type { BreachedDimension } from "./limits.js";
+export { runVerification } from "./orchestrator.js";
+export type { VerificationDeps } from "./orchestrator.js";
+export { buildVerificationSummary, renderMarkdownSummary, summarizeForAudit } from "./summary.js";
+export type { AuditResultEntry, VerificationAuditSummary, VerificationResultSummary, VerificationSummary, } from "./summary.js";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/verification/index.ts"],"names":[],"mappings":"AAKA,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpF,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACxE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAClG,YAAY,EACV,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,cAAc,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/index.js

@@ -0,0 +1,13 @@
+// Public barrel for the verification orchestrator layer (ADR-0007). Verification reuses the #6
+// command boundary unchanged; this layer adds plan construction, per-command resource limits,
+// best-effort memory monitoring, classified+redacted evidence, and audit/CLI/Markdown surfaces.
+// Explicit named re-exports, `type` keyword for type-only, double quotes, `.js`.
+export { DEFAULT_VERIFICATION_LIMITS } from "./types.js";
+export { VERIFICATION_CODES, VerificationError, EmptyPlanError } from "./errors.js";
+export { classifyScripts, detectScripts } from "./detect.js";
+export { classifyOutcome } from "./classify.js";
+export { buildVerificationPlan, resolveTargetedTests } from "./plan.js";
+export { nodeResourceMonitor } from "./monitor.js";
+export { buildAppliedLimits } from "./limits.js";
+export { runVerification } from "./orchestrator.js";
+export { buildVerificationSummary, renderMarkdownSummary, summarizeForAudit } from "./summary.js";

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/limits.d.ts

@@ -0,0 +1,4 @@
+import type { ResourceLimitDecision, VerificationResourceLimits } from "./types.js";
+export type BreachedDimension = "wall-time" | "output-size" | "memory" | undefined;
+export declare function buildAppliedLimits(limits: VerificationResourceLimits, breached: BreachedDimension): readonly ResourceLimitDecision[];
+//# sourceMappingURL=limits.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../../../../src/verification/limits.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAGpF,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;AASnF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,iBAAiB,GAC1B,SAAS,qBAAqB,EAAE,CA8BlC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/limits.js

@@ -0,0 +1,40 @@
+// Builds the four-dimension appliedLimits record for a step (ADR-0007 D2), with HONEST `enforced`
+// flags: wall-time and output-size are enforced by #6; memory is enforced only on Linux with a
+// ceiling set; network is documented-not-OS-enforced in Wave 1. `breached` is set only on the
+// single dimension that actually fired for the step. Pure — no IO.
+const NETWORK_NOTE = "documented; OS-level isolation deferred to container wave (ADR-0006)";
+const MEMORY_OFF_NOTE = "best-effort; Linux /proc sampler only — not enforced on this run";
+function memoryEnforced(limits) {
+    return process.platform === "linux" && limits.maxMemoryBytes !== undefined;
+}
+export function buildAppliedLimits(limits, breached) {
+    const memEnforced = memoryEnforced(limits);
+    return [
+        {
+            dimension: "wall-time",
+            limit: limits.wallTimeMs,
+            enforced: true,
+            breached: breached === "wall-time" ? true : undefined,
+        },
+        {
+            dimension: "output-size",
+            limit: limits.maxOutputBytes,
+            enforced: true,
+            breached: breached === "output-size" ? true : undefined,
+        },
+        {
+            dimension: "memory",
+            limit: limits.maxMemoryBytes ?? 0,
+            enforced: memEnforced,
+            note: memEnforced ? undefined : MEMORY_OFF_NOTE,
+            breached: breached === "memory" ? true : undefined,
+        },
+        {
+            dimension: "network",
+            limit: limits.network,
+            enforced: false,
+            note: NETWORK_NOTE,
+            breached: undefined,
+        },
+    ];
+}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/monitor.d.ts

@@ -0,0 +1,5 @@
+export interface ResourceMonitor {
+    readonly watch: (pid: number | undefined, maxBytes: number | undefined, onBreach: () => void) => () => void;
+}
+export declare const nodeResourceMonitor: ResourceMonitor;
+//# sourceMappingURL=monitor.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor.d.ts","sourceRoot":"","sources":["../../../../../src/verification/monitor.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,KAAK,EAAE,CACd,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,IAAI,KACjB,MAAM,IAAI,CAAC;CACjB;AAiCD,eAAO,MAAM,mBAAmB,EAAE,eAkBjC,CAAC"}

package/node_modules/@oscharko-dev/keiko-cli/dist/src/verification/monitor.js

@@ -0,0 +1,58 @@
+// The ResourceMonitor seam and its Node adapter (ADR-0007 D3). The orchestrator wraps the injected
+// SpawnFn and calls watch(pid, maxBytes, onBreach) on the spawned child; the returned function
+// clears the interval. This is the swap point the container wave replaces with a cgroup sampler.
+//
+// nodeResourceMonitor reads /proc/<pid>/status VmRSS — a SYSTEM path, not workspace content — so
+// it uses raw node:fs (read-only, bounded, no secrets), NOT WorkspaceFs. VmRSS is reported by the
+// kernel directly in kB, making it page-size-independent (correct on aarch64 with 16/64 KiB pages).
+// On non-Linux, or when maxBytes is undefined, watch is a documented no-op and the memory dimension
+// is recorded enforced:false.
+import { readFileSync } from "node:fs";
+const SAMPLE_INTERVAL_MS = 250;
+const NO_OP = () => {
+    // Documented no-op: nothing to unwatch when monitoring is disabled or unavailable.
+};
+// Reads resident-set bytes from /proc/<pid>/status (VmRSS line). The kernel reports VmRSS
+// directly in kB, so the result is page-size-independent. Returns undefined when the file is
+// gone (process exited), when VmRSS is absent (zombie), or on any parse failure — so a transient
+// read race or zombie process is never treated as a breach.
+function readRssBytes(pid) {
+    let raw;
+    try {
+        raw = readFileSync(`/proc/${String(pid)}/status`, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    for (const line of raw.split("\n")) {
+        if (line.startsWith("VmRSS:")) {
+            const parts = line.split(/\s+/);
+            // Expected format: "VmRSS:    1234 kB"  → parts = ["VmRSS:", "1234", "kB"]
+            const kb = Number.parseInt(parts[1] ?? "", 10);
+            if (!Number.isFinite(kb)) {
+                return undefined;
+            }
+            return kb * 1_024;
+        }
+    }
+    return undefined;
+}
+export const nodeResourceMonitor = {
+    watch: (pid, maxBytes, onBreach) => {
+        if (process.platform !== "linux" || maxBytes === undefined || pid === undefined) {
+            return NO_OP;
+        }
+        let fired = false;
+        const timer = setInterval(() => {
+            const rss = readRssBytes(pid);
+            if (rss !== undefined && rss > maxBytes && !fired) {
+                fired = true;
+                onBreach();
+            }
+        }, SAMPLE_INTERVAL_MS);
+        timer.unref();
+        return () => {
+            clearInterval(timer);
+        };
+    },
+};