@poetic-ai/poetic 1.42.0

package/dist/chunk-KZ5CJVBP.js

@@ -0,0 +1,1813 @@
+import {
+  atomicWriteText
+} from "./chunk-A3YGID55.js";
+import {
+  PROJECT_LANGUAGES,
+  detectProjectCapabilities,
+  isIgnoredProjectPath
+} from "./chunk-FHOWVDF5.js";
+import {
+  findPoeticPackageRoot
+} from "./chunk-GSGD5E4C.js";
+
+// src/core/knowledge/detect.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync } from "fs";
+import path4 from "path";
+
+// src/core/stack/vocabulary.ts
+var STACK_DIMENSIONS = ["lang", "sdk", "fw", "domain", "tool"];
+var DECLARABLE_LANGUAGES = PROJECT_LANGUAGES.filter(
+  (language) => language !== "docs" && language !== "unknown"
+);
+var DECLARABLE_LANGUAGE_SET = new Set(DECLARABLE_LANGUAGES);
+var JS_FRAMEWORK_DEPENDENCIES = {
+  react: "react",
+  "react-dom": "react",
+  next: "nextjs",
+  vue: "vue",
+  nuxt: "nuxt",
+  "@angular/core": "angular",
+  svelte: "svelte",
+  "@sveltejs/kit": "sveltekit",
+  astro: "astro",
+  express: "express",
+  fastify: "fastify",
+  "@nestjs/core": "nestjs",
+  "react-native": "react-native",
+  electron: "electron"
+};
+var TOKEN_SHAPE_PATTERN = /^[a-z][a-z0-9.+-]{0,39}$/;
+var SDK_TARGET_PATTERN = /^[a-z][a-z0-9]*-\d+(?:\.\d+)*$/;
+function normalizeSdkToken(token) {
+  const dashIndex = token.search(/-\d/);
+  if (dashIndex <= 0) return token;
+  const platform = token.slice(0, dashIndex);
+  let version = token.slice(dashIndex + 1);
+  while (version.endsWith(".0")) version = version.slice(0, -2);
+  return `${platform}-${version}`;
+}
+var CLASSIFICATION_HINTS = {
+  terraform: "tool",
+  dbt: "tool",
+  docker: "tool",
+  kubernetes: "tool",
+  ansible: "tool",
+  pulumi: "tool",
+  bazel: "tool",
+  cmake: "tool",
+  gradle: "tool",
+  maven: "tool",
+  aws: "domain",
+  gcp: "domain",
+  azure: "domain",
+  snowflake: "domain",
+  databricks: "domain",
+  // arduino/latex are ecosystems/toolchains for classification purposes:
+  // `lang`/`sdk` hints are FORBIDDEN here because those dimensions carry
+  // extra validation (canonical ProjectLanguage / <platform>-<version>) that
+  // a hint must never bypass — enforced again in classifyStackToken.
+  arduino: "tool",
+  latex: "tool",
+  openapi: "domain",
+  graphql: "domain"
+};
+var TOOL_MARKERS = {
+  terraform: ["*.tf"],
+  dbt: ["dbt_project.yml", "dbt_project.yaml"],
+  docker: [
+    "Dockerfile",
+    "docker-compose.yml",
+    "docker-compose.yaml",
+    "compose.yml",
+    "compose.yaml"
+  ],
+  kubernetes: ["kustomization.yml", "kustomization.yaml"],
+  ansible: ["ansible.cfg"],
+  pulumi: ["Pulumi.yaml", "Pulumi.yml"],
+  bazel: ["WORKSPACE", "MODULE.bazel"],
+  cmake: ["CMakeLists.txt"],
+  gradle: ["build.gradle", "build.gradle.kts"],
+  maven: ["pom.xml"],
+  arduino: ["*.ino"],
+  latex: ["*.tex"]
+};
+var DIMENSION_SET = new Set(STACK_DIMENSIONS);
+function classifyStackToken(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  if (!trimmed) return { ok: false, error: "Empty stack token." };
+  const colonIndex = trimmed.indexOf(":");
+  if (colonIndex > 0) {
+    const dim = trimmed.slice(0, colonIndex);
+    const token = trimmed.slice(colonIndex + 1);
+    if (!DIMENSION_SET.has(dim)) {
+      return {
+        ok: false,
+        error: `Unknown dimension prefix "${dim}:" in "${raw}". Valid prefixes: ${STACK_DIMENSIONS.map((d) => `${d}:`).join(" ")}`
+      };
+    }
+    if (!TOKEN_SHAPE_PATTERN.test(token)) {
+      return {
+        ok: false,
+        error: `Invalid token "${token}" in "${raw}": tokens are lowercase words of letters/digits/./+/- (max 40 chars).`
+      };
+    }
+    const dimension = dim;
+    if (dimension === "lang" && !DECLARABLE_LANGUAGE_SET.has(token)) {
+      return {
+        ok: false,
+        error: `"${token}" is not a known project language. Known: ${DECLARABLE_LANGUAGES.join(", ")}. For frameworks/tools/domains use fw:/tool:/domain: prefixes.`
+      };
+    }
+    if (dimension === "sdk" && !SDK_TARGET_PATTERN.test(token)) {
+      return {
+        ok: false,
+        error: `sdk: tokens must be <platform>-<version> (e.g. macos-26, ios-17, k8s-1.31); got "${token}".`
+      };
+    }
+    const normalized = dimension === "sdk" ? normalizeSdkToken(token) : token;
+    return { ok: true, token: { token: normalized, dimension, explicit: true } };
+  }
+  if (!TOKEN_SHAPE_PATTERN.test(trimmed)) {
+    return {
+      ok: false,
+      error: `Unrecognized stack token: "${raw}". Tokens are lowercase words of letters/digits/./+/- (max 40 chars), optionally prefixed with ${STACK_DIMENSIONS.map((d) => `${d}:`).join("/")}.`
+    };
+  }
+  if (DECLARABLE_LANGUAGE_SET.has(trimmed)) {
+    return { ok: true, token: { token: trimmed, dimension: "lang", explicit: false } };
+  }
+  if (SDK_TARGET_PATTERN.test(trimmed)) {
+    return {
+      ok: true,
+      token: { token: normalizeSdkToken(trimmed), dimension: "sdk", explicit: false }
+    };
+  }
+  const hinted = Object.hasOwn(CLASSIFICATION_HINTS, trimmed) ? CLASSIFICATION_HINTS[trimmed] : void 0;
+  if (hinted && hinted !== "lang" && hinted !== "sdk") {
+    return { ok: true, token: { token: trimmed, dimension: hinted, explicit: false } };
+  }
+  return { ok: true, token: { token: trimmed, dimension: "fw", explicit: false } };
+}
+function hasStrongAnchor(tokens) {
+  return tokens.some((t) => t.dimension === "lang" || t.dimension === "sdk" || t.explicit === true);
+}
+var DETECTABLE_FRAMEWORKS = /* @__PURE__ */ new Set([
+  ...Object.values(JS_FRAMEWORK_DEPENDENCIES),
+  "swiftui",
+  "uikit",
+  "appkit",
+  "vapor"
+]);
+var DETECTABLE_SDK_PLATFORMS = /* @__PURE__ */ new Set([
+  "ios",
+  "macos",
+  "watchos",
+  "tvos",
+  "visionos"
+]);
+function isGatingToken(token) {
+  switch (token.dimension) {
+    case "lang":
+      return true;
+    case "sdk":
+      return DETECTABLE_SDK_PLATFORMS.has(sdkPlatform(token.token));
+    case "fw":
+      return DETECTABLE_FRAMEWORKS.has(token.token);
+    case "tool":
+      return Object.hasOwn(TOOL_MARKERS, token.token);
+    case "domain":
+      return false;
+  }
+}
+function sdkPlatform(token) {
+  const dashIndex = token.search(/-\d/);
+  return dashIndex > 0 ? token.slice(0, dashIndex) : token;
+}
+function sdkVersion(token) {
+  const dashIndex = token.search(/-\d/);
+  return dashIndex > 0 ? token.slice(dashIndex + 1) : "";
+}
+
+// src/core/knowledge/manifest.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import path2 from "path";
+import { z as z2 } from "zod";
+
+// src/core/knowledge/types.ts
+import { readFileSync } from "fs";
+import path from "path";
+import { z } from "zod";
+var KitItemKind = z.enum(["mcp", "skill", "instructions", "docs"]);
+var KitItemTrust = z.enum(["official", "community", "third-party"]);
+var KitItemSchema = z.object({
+  /** Stable identifier, unique within one offer/manifest (e.g. `docs:developer.apple.com/swiftui`). */
+  id: z.string().min(1),
+  kind: KitItemKind,
+  /** Canonical source URL for the resource. */
+  sourceUrl: z.string().url(),
+  trust: KitItemTrust,
+  /** One-line human description shown in the consolidated offer checklist. */
+  description: z.string().min(1),
+  /**
+   * Exact command (or short instruction) the USER can run to install/connect
+   * the resource. Poetic NEVER executes this itself — third-party MCP servers
+   * in particular are never auto-installed (spec guardrail).
+   */
+  installHint: z.string().min(1).optional()
+});
+var cachedPoeticVersion;
+function resolvePoeticVersion() {
+  if (cachedPoeticVersion !== void 0) return cachedPoeticVersion;
+  try {
+    const packageRoot = findPoeticPackageRoot();
+    if (!packageRoot) {
+      cachedPoeticVersion = "0.0.0";
+      return cachedPoeticVersion;
+    }
+    const parsed = JSON.parse(readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+    cachedPoeticVersion = typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : "0.0.0";
+  } catch {
+    cachedPoeticVersion = "0.0.0";
+  }
+  return cachedPoeticVersion;
+}
+
+// src/core/knowledge/manifest.ts
+var KNOWLEDGE_BLOCK_BEGIN = "<!-- poetic-knowledge:begin -->";
+var KNOWLEDGE_BLOCK_END = "<!-- poetic-knowledge:end -->";
+var CONTEXT_DIR = path2.join(".poetic", "context");
+var KNOWLEDGE_DIR = path2.join(CONTEXT_DIR, "knowledge");
+var KNOWLEDGE_MANIFEST_FILENAME = "manifest.json";
+function knowledgeDir(root) {
+  return path2.join(root, KNOWLEDGE_DIR);
+}
+function knowledgeManifestPath(root) {
+  return path2.join(knowledgeDir(root), KNOWLEDGE_MANIFEST_FILENAME);
+}
+var KitItemMode = z2.enum(["online-ref", "local-mirror"]);
+var ManifestItemSchema = z2.object({
+  id: z2.string().min(1),
+  kind: KitItemKind,
+  sourceUrl: z2.string().url(),
+  trust: KitItemTrust,
+  description: z2.string().min(1),
+  installHint: z2.string().min(1).optional(),
+  /** Resource version when known, else the ISO date the item was accepted. */
+  versionOrDate: z2.string().min(1),
+  /** v1 only writes `online-ref`; `local-mirror` is schema-reserved for v1.1. */
+  mode: KitItemMode
+});
+var KnowledgeManifestSchema = z2.object({
+  schemaVersion: z2.literal(1),
+  /** Poetic version that wrote the manifest. */
+  poeticVersion: z2.string().min(1),
+  /** Normalized stack fingerprint at accept time (drift detection input). */
+  stackFingerprint: z2.string().min(1),
+  /** ISO timestamp of the last apply. */
+  updatedAt: z2.string().min(1),
+  items: z2.array(ManifestItemSchema)
+});
+function readKnowledgeManifest(root) {
+  const manifestPath = knowledgeManifestPath(root);
+  if (!existsSync(manifestPath)) return { status: "absent" };
+  let raw;
+  try {
+    raw = readFileSync2(manifestPath, "utf8");
+  } catch (error) {
+    return {
+      status: "invalid",
+      error: `unreadable: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    return {
+      status: "invalid",
+      error: `not valid JSON: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  const result = KnowledgeManifestSchema.safeParse(parsed);
+  if (!result.success) {
+    return { status: "invalid", error: result.error.issues.map((i) => i.message).join("; ") };
+  }
+  return { status: "ok", manifest: result.data };
+}
+async function writeKnowledgeManifest(root, manifest) {
+  const validated = KnowledgeManifestSchema.parse(manifest);
+  const localMirror = validated.items.find((item) => item.mode === "local-mirror");
+  if (localMirror) {
+    throw new Error(
+      `Knowledge manifest item "${localMirror.id}" uses mode "local-mirror", which is not implemented in v1 (online-ref only).`
+    );
+  }
+  await atomicWriteText(knowledgeManifestPath(root), JSON.stringify(validated, null, 2), {
+    ensureDir: true,
+    trailingNewline: true
+  });
+}
+function createManifest(stackFingerprint, items, now = /* @__PURE__ */ new Date()) {
+  return {
+    schemaVersion: 1,
+    poeticVersion: resolvePoeticVersion(),
+    stackFingerprint,
+    updatedAt: now.toISOString(),
+    items
+  };
+}
+
+// src/core/knowledge/service-candidates.ts
+import { readdirSync, readFileSync as readFileSync3 } from "fs";
+import path3 from "path";
+
+// src/core/knowledge/service-candidates-contract.ts
+var CANDIDATE_KEY_SUFFIXES = [
+  "CLIENT_SECRET",
+  "CLIENT_ID",
+  "ACCOUNT_SID",
+  "SECRET_KEY",
+  // AUTH_TOKEN before TOKEN (longest-first): TWILIO_AUTH_TOKEN must extract
+  // `twilio` (matching the curated token), not a bogus `twilio_auth`.
+  "AUTH_TOKEN",
+  "API_KEY",
+  "SECRET",
+  "TOKEN",
+  "DSN"
+];
+var DEMOTED_SOURCE_SUFFIXES = /* @__PURE__ */ new Set([
+  "TOKEN",
+  "AUTH_TOKEN",
+  "SECRET"
+]);
+var STRIPPED_KEY_PREFIXES = [
+  "NEXT_PUBLIC_",
+  "REACT_APP_",
+  "VITE_",
+  "EXPO_PUBLIC_",
+  "NUXT_PUBLIC_"
+];
+var SUPPRESSED_TOKENS = /* @__PURE__ */ new Set([
+  "jwt",
+  "session",
+  "csrf",
+  "cookie",
+  "encryption",
+  "auth",
+  "oauth",
+  "refresh",
+  "bearer",
+  "access",
+  "id",
+  "signing",
+  "admin",
+  "db",
+  "database",
+  "fake",
+  "example",
+  "mock",
+  "dummy",
+  "test",
+  "your",
+  "my",
+  "sample",
+  // App/framework-internal secret owners — APP_SECRET, DJANGO_SECRET_KEY,
+  // NEXTAUTH_SECRET, FLASK_SECRET_KEY, RAILS_SECRET_KEY_BASE etc. are signing
+  // secrets for the app itself, never an external API service.
+  "app",
+  "server",
+  "api",
+  "web",
+  "client",
+  "django",
+  "flask",
+  "rails",
+  "laravel",
+  "express",
+  "nextauth",
+  "next_auth",
+  "devise",
+  "webhook",
+  "deploy",
+  "build",
+  "ci"
+]);
+var SUPPRESSED_TOKEN_PREFIXES = [
+  "fake_",
+  "example_",
+  "mock_",
+  "dummy_",
+  "test_",
+  "your_",
+  "my_",
+  "sample_"
+];
+var LLM_PROVIDER_KEY_NAMES = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "OPENAI_API_KEY",
+  "GEMINI_API_KEY",
+  "GOOGLE_API_KEY",
+  "XAI_API_KEY",
+  "OPENROUTER_API_KEY",
+  "KIRO_API_KEY",
+  "ANTIGRAVITY_API_KEY",
+  "CURSOR_API_KEY",
+  "CODEX_API_KEY",
+  "CODEX_TOKEN",
+  "ZAI_API_KEY",
+  "GITHUB_TOKEN"
+]);
+var ENV_TEMPLATE_BASENAMES = /* @__PURE__ */ new Set([
+  ".env.example",
+  ".env.sample",
+  ".env.template",
+  ".env.dist"
+]);
+var CONFIG_BASENAMES = /* @__PURE__ */ new Set([".mcp.json"]);
+var CONFIG_EXTENSIONS = [".yaml", ".yml", ".toml", ".json"];
+var CANDIDATE_SOURCE_EXTENSIONS = [
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".swift",
+  ".py",
+  ".go",
+  ".rb",
+  ".java",
+  ".kt",
+  ".kts",
+  ".cs",
+  ".php",
+  ".rs",
+  ".c",
+  ".cc",
+  ".cpp",
+  ".h",
+  ".hpp",
+  ".m",
+  ".mm",
+  ".dart",
+  ".scala",
+  ".ps1",
+  ".r",
+  ".sql",
+  ".pl",
+  ".ex",
+  ".exs"
+];
+var CANDIDATE_SCAN_EXCLUDED_DIRS = /* @__PURE__ */ new Set([
+  "test",
+  "tests",
+  "__tests__",
+  "spec",
+  "fixture",
+  "fixtures",
+  "mock",
+  "mocks",
+  "example",
+  "examples",
+  "sample",
+  "samples",
+  "vendor",
+  "third_party",
+  "third-party",
+  "docs",
+  "templates",
+  "backups"
+]);
+var API_ISH_SUBDOMAINS = /* @__PURE__ */ new Set(["api", "data"]);
+var MIN_PLAIN_HOST_OCCURRENCES = 3;
+var HOSTNAME_NOISE_PATTERNS = [
+  /(^|\.)example\.(com|org|net)$/i,
+  /^localhost$/i,
+  /^127\.0\.0\.1$/,
+  /(^|\.)local$/i,
+  /^(custom|env|your|foo|bar)\.api\./i,
+  /\.api\.com$/i,
+  /^(github|raw\.githubusercontent|gist\.github)\.com$/i,
+  /^(en\.)?wikipedia\.org$/i,
+  /^json-schema\.org$/i,
+  /^(cdn|fonts|ajax)\./i
+];
+var MAX_CANDIDATE_SCAN_FILES = 5e3;
+var MAX_CANDIDATE_CONTENT_SAMPLES = 120;
+var CANDIDATE_ITEM_ID_PREFIX = "docs:candidate:";
+var CANDIDATE_SEARCH_PRIORITY = [
+  "env-template",
+  "package",
+  "source",
+  "config",
+  "script",
+  "hostname"
+];
+var MAX_UNRESOLVED_LINES = 5;
+function candidateSetSignature(candidates) {
+  return candidates.map((c) => {
+    const evidence = Array.from(new Set(c.evidence.map((ev) => `${ev.class}=${ev.matched}`))).sort().join("+");
+    const safety = isCandidateQuerySafe(c) ? "q1" : "q0";
+    return `${c.token}:${c.confidence}:${evidence}:${safety}`;
+  }).sort().join(",");
+}
+var QUERY_SAFE_EVIDENCE_CLASSES = /* @__PURE__ */ new Set([
+  "env-template",
+  "package",
+  "config"
+]);
+var QUERY_SAFE_TLDS = /* @__PURE__ */ new Set([
+  "com",
+  "org",
+  "net",
+  "io",
+  "dev",
+  "ai",
+  "co",
+  "gov",
+  "edu",
+  "app",
+  "sh",
+  "us",
+  "uk",
+  "de",
+  "fr",
+  "jp",
+  "in",
+  "ca",
+  "au",
+  "nl",
+  "se",
+  "ch",
+  "eu"
+]);
+function isQuerySafeHostname(host) {
+  const labels = host.split(".").filter(Boolean);
+  if (labels.length < 2 || labels.length > 3) return false;
+  if (labels.some((label) => ["corp", "internal", "intranet", "local", "lan"].includes(label))) {
+    return false;
+  }
+  const tld = labels[labels.length - 1];
+  return QUERY_SAFE_TLDS.has(tld);
+}
+function isCandidateQuerySafe(candidate) {
+  return candidate.evidence.some(
+    (ev) => QUERY_SAFE_EVIDENCE_CLASSES.has(ev.class) || ev.class === "hostname" && isQuerySafeHostname(ev.matched.toLowerCase())
+  );
+}
+
+// src/core/knowledge/service-signals.ts
+var SERVICE_SIGNALS = [
+  // Payments
+  {
+    token: "stripe",
+    category: "Payments",
+    envKeys: ["STRIPE_SECRET_KEY"],
+    packages: [
+      "stripe",
+      "@stripe/stripe-js",
+      "stripe-ios",
+      "stripe-python",
+      "stripe-go",
+      "stripe-php"
+    ],
+    hostnames: ["api.stripe.com"],
+    docsUrl: "https://docs.stripe.com/api",
+    docDomain: "stripe.com",
+    description: "Stripe payments API \u2014 official API reference"
+  },
+  {
+    token: "paypal",
+    category: "Payments",
+    envKeys: ["PAYPAL_CLIENT_ID", "PAYPAL_CLIENT_SECRET"],
+    packages: ["@paypal/checkout-server-sdk", "@paypal/paypal-server-sdk"],
+    hostnames: ["api-m.paypal.com"],
+    docsUrl: "https://developer.paypal.com/api/rest/",
+    docDomain: "developer.paypal.com",
+    description: "PayPal REST API \u2014 official developer documentation"
+  },
+  // AI / LLM
+  {
+    token: "openai",
+    category: "AI/LLM",
+    envKeys: ["OPENAI_API_KEY"],
+    // SwiftPM repo slugs: MacPaw/OpenAI => `openai`; openai-swift community slug.
+    packages: ["openai", "openai-swift"],
+    hostnames: ["api.openai.com"],
+    docsUrl: "https://platform.openai.com/docs",
+    docDomain: "platform.openai.com",
+    description: "OpenAI API \u2014 official platform documentation"
+  },
+  {
+    token: "anthropic",
+    category: "AI/LLM",
+    envKeys: ["ANTHROPIC_API_KEY"],
+    // npm `@anthropic-ai/sdk`, PyPI `anthropic`; SwiftPM slugs anthropic-sdk-*.
+    packages: ["@anthropic-ai/sdk", "anthropic", "anthropic-sdk-swift", "swift-anthropic"],
+    hostnames: ["api.anthropic.com"],
+    docsUrl: "https://docs.anthropic.com",
+    docDomain: "anthropic.com",
+    description: "Anthropic Claude API \u2014 official documentation"
+  },
+  // Communications
+  {
+    token: "twilio",
+    category: "Communications",
+    envKeys: ["TWILIO_ACCOUNT_SID", "TWILIO_AUTH_TOKEN"],
+    packages: ["twilio"],
+    hostnames: ["api.twilio.com"],
+    docsUrl: "https://www.twilio.com/docs",
+    docDomain: "twilio.com",
+    description: "Twilio SMS/voice API \u2014 official documentation"
+  },
+  {
+    token: "sendgrid",
+    category: "Email",
+    envKeys: ["SENDGRID_API_KEY"],
+    packages: ["@sendgrid/mail", "@sendgrid/client"],
+    hostnames: ["api.sendgrid.com"],
+    docsUrl: "https://www.twilio.com/docs/sendgrid",
+    docDomain: "twilio.com",
+    description: "Twilio SendGrid email API \u2014 official documentation"
+  },
+  {
+    token: "resend",
+    category: "Email",
+    envKeys: ["RESEND_API_KEY"],
+    packages: ["resend"],
+    hostnames: ["api.resend.com"],
+    docsUrl: "https://resend.com/docs",
+    docDomain: "resend.com",
+    description: "Resend transactional email API \u2014 official documentation"
+  },
+  // Auth
+  {
+    token: "auth0",
+    category: "Authentication",
+    // AUTH0_DOMAIN alone is app-configurable; the secret is the strong signal.
+    envKeys: ["AUTH0_CLIENT_SECRET"],
+    packages: ["auth0", "express-openid-connect", "@auth0/auth0-react", "@auth0/nextjs-auth0"],
+    hostnames: [],
+    docsUrl: "https://auth0.com/docs",
+    docDomain: "auth0.com",
+    description: "Auth0 identity platform \u2014 official documentation"
+  },
+  {
+    token: "clerk",
+    category: "Authentication",
+    envKeys: ["CLERK_SECRET_KEY"],
+    packages: ["@clerk/nextjs", "@clerk/backend", "@clerk/clerk-sdk-node"],
+    hostnames: ["api.clerk.com"],
+    docsUrl: "https://clerk.com/docs",
+    docDomain: "clerk.com",
+    description: "Clerk authentication \u2014 official documentation"
+  },
+  // Backend / data platform
+  {
+    token: "supabase",
+    category: "Backend",
+    // Score on the service-role (secret) key, not the public anon key.
+    envKeys: ["SUPABASE_SERVICE_ROLE_KEY"],
+    packages: ["@supabase/supabase-js"],
+    hostnames: [],
+    docsUrl: "https://supabase.com/docs",
+    docDomain: "supabase.com",
+    description: "Supabase backend platform \u2014 official documentation"
+  },
+  // Fintech
+  {
+    token: "plaid",
+    category: "Fintech",
+    envKeys: ["PLAID_CLIENT_ID", "PLAID_SECRET"],
+    packages: ["plaid"],
+    hostnames: ["api.plaid.com", "sandbox.plaid.com", "production.plaid.com"],
+    docsUrl: "https://plaid.com/docs",
+    docDomain: "plaid.com",
+    description: "Plaid financial data API \u2014 official documentation"
+  },
+  // Datastores
+  {
+    token: "mongodb",
+    category: "Datastore",
+    envKeys: ["MONGODB_URI", "MONGO_URL"],
+    packages: ["mongodb", "mongoose"],
+    hostnames: [],
+    docsUrl: "https://www.mongodb.com/docs/drivers/",
+    docDomain: "mongodb.com",
+    description: "MongoDB drivers \u2014 official documentation"
+  },
+  {
+    token: "redis",
+    category: "Datastore",
+    envKeys: ["REDIS_URL"],
+    packages: ["redis", "ioredis"],
+    hostnames: [],
+    docsUrl: "https://redis.io/docs/latest/develop/",
+    docDomain: "redis.io",
+    description: "Redis \u2014 official developer documentation"
+  },
+  // Search
+  {
+    token: "algolia",
+    category: "Search",
+    envKeys: ["ALGOLIA_ADMIN_API_KEY", "ALGOLIA_API_KEY"],
+    packages: ["algoliasearch"],
+    hostnames: [],
+    docsUrl: "https://www.algolia.com/doc/",
+    docDomain: "algolia.com",
+    description: "Algolia search API \u2014 official documentation"
+  }
+];
+var SERVICE_DOC_DOMAINS = Array.from(
+  new Set(SERVICE_SIGNALS.map((s) => s.docDomain))
+);
+function serviceSignalForToken(token) {
+  return SERVICE_SIGNALS.find((s) => s.token === token);
+}
+
+// src/core/knowledge/service-candidates.ts
+var MAX_CANDIDATE_CONTENT_BYTES = 64 * 1024;
+var SUFFIXES_LONGEST_FIRST = [...CANDIDATE_KEY_SUFFIXES].sort(
+  (a, b) => b.length - a.length
+);
+var GENERIC_TLDS = /* @__PURE__ */ new Set(["com", "net", "org", "io"]);
+var CURATED_TOKENS = new Set(SERVICE_SIGNALS.map((s) => s.token));
+var CURATED_ENV_KEY_TO_TOKEN = new Map(
+  SERVICE_SIGNALS.flatMap((s) => s.envKeys.map((key) => [key, s.token]))
+);
+function readTextSafe(filePath, maxBytes = MAX_CANDIDATE_CONTENT_BYTES) {
+  try {
+    return readFileSync3(filePath, "utf8").slice(0, maxBytes);
+  } catch {
+    return "";
+  }
+}
+function readJsonSafe(filePath) {
+  try {
+    const parsed = JSON.parse(readFileSync3(filePath, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+var TEST_FILE_BASENAME = /(\.test\.|\.spec\.|_test\.|^test_|^conftest\.py$|Tests?\.swift$|Spec\.swift$)/;
+function classifySurface(basename) {
+  if (ENV_TEMPLATE_BASENAMES.has(basename)) return "env-template";
+  if (TEST_FILE_BASENAME.test(basename)) return null;
+  if (basename.endsWith(".sh")) return "script";
+  if (CONFIG_BASENAMES.has(basename)) return "config";
+  const ext = path3.extname(basename).toLowerCase();
+  if (CONFIG_EXTENSIONS.includes(ext)) return "config";
+  if (CANDIDATE_SOURCE_EXTENSIONS.includes(ext)) return "source";
+  return null;
+}
+function hasExcludedSegment(relativePath) {
+  return relativePath.split(path3.sep).some((segment) => CANDIDATE_SCAN_EXCLUDED_DIRS.has(segment.toLowerCase()));
+}
+function collectClassifiedFiles(root) {
+  const collected = [];
+  const stack = [""];
+  let visited = 0;
+  while (stack.length > 0 && visited < MAX_CANDIDATE_SCAN_FILES) {
+    const relativeDirectory = stack.pop() ?? "";
+    let entries;
+    try {
+      entries = readdirSync(path3.join(root, relativeDirectory), { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const relativePath = path3.join(relativeDirectory, entry.name);
+      if (isIgnoredProjectPath(relativePath)) continue;
+      if (entry.isDirectory()) {
+        if (CANDIDATE_SCAN_EXCLUDED_DIRS.has(entry.name.toLowerCase())) continue;
+        stack.push(relativePath);
+      } else if (entry.isFile()) {
+        visited += 1;
+        if (hasExcludedSegment(relativePath)) continue;
+        const surface = classifySurface(entry.name);
+        if (surface && collected.length < MAX_CANDIDATE_CONTENT_SAMPLES) {
+          collected.push({ relativePath, surface });
+        }
+      }
+      if (visited >= MAX_CANDIDATE_SCAN_FILES) break;
+    }
+  }
+  return collected;
+}
+function stripKeyPrefix(upperKey) {
+  for (const prefix of STRIPPED_KEY_PREFIXES) {
+    if (upperKey.startsWith(prefix)) return upperKey.slice(prefix.length);
+  }
+  return upperKey;
+}
+function extractToken(upperKey) {
+  const name = stripKeyPrefix(upperKey);
+  for (const suffix of SUFFIXES_LONGEST_FIRST) {
+    if (name === suffix) return null;
+    if (name.endsWith(`_${suffix}`)) {
+      const remainder = name.slice(0, name.length - suffix.length - 1);
+      if (!remainder) return null;
+      return { token: remainder.toLowerCase(), suffix };
+    }
+  }
+  return null;
+}
+function envTemplateKeyNames(content) {
+  const keys = [];
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const withoutExport = trimmed.replace(/^export\s+/, "");
+    const eq = withoutExport.indexOf("=");
+    const key = (eq >= 0 ? withoutExport.slice(0, eq) : withoutExport).trim();
+    if (/^[A-Z][A-Z0-9_]*$/.test(key)) keys.push(key);
+  }
+  return keys;
+}
+function uppercaseKeyIdentifiers(content) {
+  return content.match(/\b[A-Z][A-Z0-9_]*\b/g) ?? [];
+}
+function configKeyIdentifiers(content) {
+  const keys = [];
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("//")) continue;
+    const lhs = trimmed.match(/^["']?([A-Za-z][A-Za-z0-9_]*)["']?\s*[:=]/);
+    if (lhs?.[1]) keys.push(lhs[1]);
+    for (const jsonKey of trimmed.matchAll(/"([A-Za-z][A-Za-z0-9_]*)"\s*:/g)) {
+      if (jsonKey[1]) keys.push(jsonKey[1]);
+    }
+    for (const ref of trimmed.matchAll(/\$\{([A-Z][A-Z0-9_]*)\}/g)) {
+      if (ref[1]) keys.push(ref[1]);
+    }
+  }
+  return keys;
+}
+function extractHostnames(content) {
+  const hosts = [];
+  for (const match of content.toLowerCase().matchAll(/\bhttps?:\/\/([a-z0-9.-]+)/g)) {
+    const host = match[1];
+    if (host) hosts.push(host);
+  }
+  return hosts;
+}
+function isNoiseHost(host) {
+  return HOSTNAME_NOISE_PATTERNS.some((pattern) => pattern.test(host));
+}
+function stripHostPrefix(host) {
+  return host.replace(/^(?:api|data|www)\./, "");
+}
+function hostSlug(host) {
+  const labels = stripHostPrefix(host).split(".").filter(Boolean);
+  if (labels.length >= 2) {
+    const last = labels[labels.length - 1];
+    if (last && GENERIC_TLDS.has(last)) labels.pop();
+  }
+  return labels.join("-").toLowerCase();
+}
+function hostPrimaryLabel(host) {
+  return (stripHostPrefix(host).split(".")[0] ?? "").toLowerCase();
+}
+function collectDependencyNames(root) {
+  const names = /* @__PURE__ */ new Set();
+  const pkg = readJsonSafe(path3.join(root, "package.json"));
+  if (pkg) {
+    for (const bucket of [
+      "dependencies",
+      "devDependencies",
+      "peerDependencies",
+      "optionalDependencies"
+    ]) {
+      const deps = pkg[bucket];
+      if (deps && typeof deps === "object" && !Array.isArray(deps)) {
+        for (const name of Object.keys(deps)) {
+          const lower = name.toLowerCase();
+          names.add(lower);
+          const scoped = lower.match(/^@([^/]+)\//);
+          if (scoped?.[1]) names.add(scoped[1]);
+        }
+      }
+    }
+  }
+  const packageSwift = readTextSafe(path3.join(root, "Package.swift"), 32e3);
+  for (const match of packageSwift.matchAll(/\.package\([^)]*url:\s*"([^"]+)"/g)) {
+    const slug = (match[1] ?? "").replace(/\.git$/, "").split("/").pop();
+    if (slug) names.add(slug.toLowerCase());
+  }
+  const requirements = readTextSafe(path3.join(root, "requirements.txt"), 32e3);
+  for (const line of requirements.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const name = trimmed.split(/[<>=!~;[\s]/)[0];
+    if (name) names.add(name.toLowerCase());
+  }
+  const goMod = readTextSafe(path3.join(root, "go.mod"), 32e3);
+  for (const match of goMod.matchAll(/^\s*(?:require\s+)?([\w.\-/]+\.[\w.\-/]+)\s+v\d/gm)) {
+    const modulePath = (match[1] ?? "").toLowerCase().replace(/\/v\d+$/, "");
+    if (!modulePath) continue;
+    names.add(modulePath);
+    const segment = modulePath.split("/").pop();
+    if (segment) names.add(segment);
+  }
+  const gemfile = readTextSafe(path3.join(root, "Gemfile"), 32e3);
+  for (const match of gemfile.matchAll(/^\s*gem\s+["']([^"']+)["']/gm)) {
+    const name = match[1];
+    if (name) names.add(name.toLowerCase());
+  }
+  const composer = readJsonSafe(path3.join(root, "composer.json"));
+  if (composer) {
+    for (const bucket of ["require", "require-dev"]) {
+      const deps = composer[bucket];
+      if (deps && typeof deps === "object" && !Array.isArray(deps)) {
+        for (const name of Object.keys(deps)) {
+          const key = name.toLowerCase();
+          names.add(key);
+          const segment = key.split("/").pop();
+          if (segment) names.add(segment);
+        }
+      }
+    }
+  }
+  return names;
+}
+function newAccumulator() {
+  return {
+    evidence: /* @__PURE__ */ new Map(),
+    hasEnvTemplate: false,
+    hasCuratedEnvKey: false,
+    hasSourceNonDemoted: false,
+    hasSourceDemoted: false,
+    hasScript: false,
+    hasConfig: false,
+    hasHostname: false,
+    hasApiIshHostname: false,
+    hasRepeatedHostname: false
+  };
+}
+function addEvidence(acc, cls, matched) {
+  const key = `${cls}|${matched}`;
+  if (!acc.evidence.has(key)) acc.evidence.set(key, { class: cls, matched });
+}
+function isSuppressedToken(token) {
+  if (SUPPRESSED_TOKENS.has(token)) return true;
+  return SUPPRESSED_TOKEN_PREFIXES.some(
+    (prefix) => token.startsWith(prefix)
+  );
+}
+function detectServiceCandidates(root) {
+  const accumulators = /* @__PURE__ */ new Map();
+  const getAcc = (token) => {
+    let acc = accumulators.get(token);
+    if (!acc) {
+      acc = newAccumulator();
+      accumulators.set(token, acc);
+    }
+    return acc;
+  };
+  const files = collectClassifiedFiles(root);
+  const hostCounts = /* @__PURE__ */ new Map();
+  for (const { relativePath, surface } of files) {
+    const content = readTextSafe(path3.join(root, relativePath));
+    if (!content) continue;
+    if (surface === "source" || surface === "script") {
+      for (const host of extractHostnames(content)) {
+        hostCounts.set(host, (hostCounts.get(host) ?? 0) + 1);
+      }
+    }
+    let keyNames;
+    if (surface === "env-template") keyNames = envTemplateKeyNames(content);
+    else if (surface === "config") keyNames = configKeyIdentifiers(content);
+    else keyNames = uppercaseKeyIdentifiers(content);
+    for (const rawKey of keyNames) {
+      const upperKey = rawKey.toUpperCase();
+      const extracted = extractToken(upperKey);
+      if (!extracted) continue;
+      const strippedKey = stripKeyPrefix(upperKey);
+      const curatedToken = CURATED_ENV_KEY_TO_TOKEN.get(upperKey) ?? CURATED_ENV_KEY_TO_TOKEN.get(strippedKey);
+      const token = curatedToken ?? extracted.token;
+      const suffix = extracted.suffix;
+      if (isSuppressedToken(token)) continue;
+      if (LLM_PROVIDER_KEY_NAMES.has(upperKey) && surface !== "source" && surface !== "env-template") {
+        continue;
+      }
+      const acc = getAcc(token);
+      const cls = surface;
+      const evidenceText = surface === "source" || surface === "script" ? `*_${suffix} (redacted)` : rawKey;
+      addEvidence(acc, cls, evidenceText);
+      if (surface === "env-template") {
+        acc.hasEnvTemplate = true;
+        if (CURATED_ENV_KEY_TO_TOKEN.has(upperKey)) acc.hasCuratedEnvKey = true;
+      } else if (surface === "script") acc.hasScript = true;
+      else if (surface === "config") acc.hasConfig = true;
+      else if (DEMOTED_SOURCE_SUFFIXES.has(suffix)) acc.hasSourceDemoted = true;
+      else acc.hasSourceNonDemoted = true;
+    }
+  }
+  const squash = (s) => s.replace(/[-_.]/g, "");
+  const existingTokens = Array.from(accumulators.keys());
+  for (const [host, count] of hostCounts) {
+    if (isNoiseHost(host)) continue;
+    const firstLabel = host.split(".")[0] ?? "";
+    const apiIsh = API_ISH_SUBDOMAINS.has(firstLabel);
+    const primary = hostPrimaryLabel(host);
+    const squashedHost = squash(host);
+    const matchingTokens = existingTokens.filter((token) => {
+      const squashedToken = squash(token);
+      return squashedToken.length > 0 && (squashedHost.includes(squashedToken) || primary.length > 0 && squashedToken.includes(squash(primary)));
+    });
+    const containsExistingToken = matchingTokens.length > 0;
+    const repeated = count >= MIN_PLAIN_HOST_OCCURRENCES;
+    const qualifies = apiIsh || repeated || containsExistingToken;
+    if (!qualifies) continue;
+    const attach = (acc) => {
+      addEvidence(acc, "hostname", host);
+      acc.hasHostname = true;
+      if (apiIsh) acc.hasApiIshHostname = true;
+      if (repeated) acc.hasRepeatedHostname = true;
+    };
+    if (matchingTokens.length > 0) {
+      for (const token of matchingTokens) attach(getAcc(token));
+    } else {
+      const token = hostSlug(host);
+      if (!token || isSuppressedToken(token)) continue;
+      attach(getAcc(token));
+    }
+  }
+  const dependencyNames = collectDependencyNames(root);
+  const candidates = [];
+  for (const [token, acc] of accumulators) {
+    if (acc.evidence.size === 0) continue;
+    const hasSourceKey = acc.hasSourceNonDemoted || acc.hasSourceDemoted;
+    const hasManifestDep = dependencyNames.has(token);
+    const curatedWillOffer = acc.hasCuratedEnvKey || hasManifestDep;
+    if (CURATED_TOKENS.has(token) && curatedWillOffer && !hasSourceKey) continue;
+    const confidence = computeConfidence(acc, hasManifestDep) ? "confirmed" : "unconfirmed";
+    if (hasManifestDep) {
+      addEvidence(acc, "package", token);
+    }
+    const evidence = Array.from(acc.evidence.values()).sort(
+      (a, b) => a.class === b.class ? a.matched.localeCompare(b.matched) : a.class.localeCompare(b.class)
+    );
+    candidates.push({ token, confidence, evidence });
+  }
+  return candidates.sort((a, b) => a.token.localeCompare(b.token));
+}
+function computeConfidence(acc, hasManifestDep) {
+  if (acc.hasEnvTemplate || acc.hasSourceNonDemoted || acc.hasApiIshHostname || acc.hasRepeatedHostname) {
+    return true;
+  }
+  const lowClasses = /* @__PURE__ */ new Set();
+  if (acc.hasScript) lowClasses.add("script");
+  if (acc.hasConfig) lowClasses.add("config");
+  if (acc.hasHostname) lowClasses.add("hostname");
+  if (acc.hasSourceDemoted) lowClasses.add("demoted-source");
+  const corroborators = /* @__PURE__ */ new Set();
+  if (acc.hasHostname) corroborators.add("hostname");
+  if (hasManifestDep) corroborators.add("manifest-dep");
+  for (const low of lowClasses) {
+    for (const corroborator of corroborators) {
+      if (corroborator !== low) return true;
+    }
+  }
+  return false;
+}
+
+// src/core/knowledge/detect.ts
+var MAX_SWIFT_CONTENT_SAMPLES = 40;
+var MAX_SAMPLE_BYTES = 16e3;
+var MAX_SERVICE_HOSTNAME_SAMPLES = 60;
+var MAX_SERVICE_SCAN_FILES = 5e3;
+var SERVICE_SOURCE_EXTENSIONS = [
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".swift",
+  ".py",
+  ".go",
+  ".rb",
+  ".java",
+  ".kt",
+  ".cs",
+  ".php",
+  ".rs"
+];
+var SERVICE_SCAN_EXCLUDES = [
+  "test",
+  "tests",
+  "__tests__",
+  "spec",
+  "fixture",
+  "fixtures",
+  "mock",
+  "mocks",
+  "example",
+  "examples",
+  "sample",
+  "samples",
+  "vendor",
+  "third_party",
+  "third-party"
+];
+var MCP_CONFIG_CANDIDATES = [".mcp.json", ".cursor/mcp.json", ".vscode/mcp.json"];
+function readTextSafe2(filePath, maxBytes = MAX_SAMPLE_BYTES) {
+  try {
+    return readFileSync4(filePath, "utf8").slice(0, maxBytes);
+  } catch {
+    return "";
+  }
+}
+function fileSizeBytes(filePath) {
+  try {
+    const stat = statSync(filePath);
+    return stat.isFile() ? stat.size : 0;
+  } catch {
+    return 0;
+  }
+}
+function readJsonSafe2(filePath) {
+  try {
+    const parsed = JSON.parse(readFileSync4(filePath, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function collectFiles(root, predicate, limit) {
+  const matches = [];
+  const stack = [""];
+  while (stack.length > 0 && matches.length < limit) {
+    const relativeDirectory = stack.pop() ?? "";
+    let entries;
+    try {
+      entries = readdirSync2(path4.join(root, relativeDirectory), { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const relativePath = path4.join(relativeDirectory, entry.name);
+      if (isIgnoredProjectPath(relativePath)) continue;
+      if (entry.isDirectory()) {
+        stack.push(relativePath);
+      } else if (entry.isFile() && predicate(relativePath, entry.name)) {
+        matches.push(relativePath);
+        if (matches.length >= limit) break;
+      }
+    }
+  }
+  return matches;
+}
+function detectJsFrameworks(root) {
+  const pkg = readJsonSafe2(path4.join(root, "package.json"));
+  if (!pkg) return [];
+  const dependencyNames = /* @__PURE__ */ new Set();
+  for (const bucket of ["dependencies", "devDependencies", "peerDependencies"]) {
+    const deps = pkg[bucket];
+    if (deps && typeof deps === "object" && !Array.isArray(deps)) {
+      for (const name of Object.keys(deps)) dependencyNames.add(name);
+    }
+  }
+  const frameworks = /* @__PURE__ */ new Set();
+  for (const [dependency, framework] of Object.entries(JS_FRAMEWORK_DEPENDENCIES)) {
+    if (dependencyNames.has(dependency)) frameworks.add(framework);
+  }
+  return Array.from(frameworks);
+}
+function detectSwiftFrameworks(root) {
+  const swiftFiles = collectFiles(
+    root,
+    (_relativePath, basename) => basename.endsWith(".swift"),
+    MAX_SWIFT_CONTENT_SAMPLES
+  );
+  const frameworks = /* @__PURE__ */ new Set();
+  for (const relativePath of swiftFiles) {
+    const content = readTextSafe2(path4.join(root, relativePath));
+    if (/^\s*import\s+SwiftUI\b/m.test(content)) frameworks.add("swiftui");
+    if (/^\s*import\s+UIKit\b/m.test(content)) frameworks.add("uikit");
+    if (/^\s*import\s+AppKit\b/m.test(content)) frameworks.add("appkit");
+    if (/^\s*import\s+Vapor\b/m.test(content)) frameworks.add("vapor");
+    if (frameworks.size >= 4) break;
+  }
+  return Array.from(frameworks);
+}
+function detectSdkTargets(root) {
+  const targets = /* @__PURE__ */ new Set();
+  const packageSwift = readTextSafe2(path4.join(root, "Package.swift"), 32e3);
+  if (packageSwift) {
+    const platformPattern = /\.(iOS|macOS|watchOS|tvOS|visionOS)\s*\(\s*(?:\.v(\d+)(?:_\d+)?|"(\d+)(?:\.\d+)*")\s*\)/g;
+    for (const match of packageSwift.matchAll(platformPattern)) {
+      const platform = (match[1] ?? "").toLowerCase();
+      const version = match[2] ?? match[3];
+      if (platform && version) targets.add(`${platform}-${version}`);
+    }
+  }
+  const pbxprojFiles = collectFiles(
+    root,
+    (relativePath, basename) => basename === "project.pbxproj" && relativePath.includes(".xcodeproj"),
+    3
+  );
+  for (const relativePath of pbxprojFiles) {
+    const content = readTextSafe2(path4.join(root, relativePath), 256e3);
+    const ios = content.match(/IPHONEOS_DEPLOYMENT_TARGET\s*=\s*(\d+)(?:\.\d+)*/);
+    if (ios?.[1]) targets.add(`ios-${ios[1]}`);
+    const macos = content.match(/MACOSX_DEPLOYMENT_TARGET\s*=\s*(\d+)(?:\.\d+)*/);
+    if (macos?.[1]) targets.add(`macos-${macos[1]}`);
+  }
+  return Array.from(targets).sort();
+}
+var MAX_TOOL_SCAN_FILES = 5e3;
+function detectTools(root) {
+  const exactNames = /* @__PURE__ */ new Map();
+  const suffixes = /* @__PURE__ */ new Map();
+  for (const [tool, markers] of Object.entries(TOOL_MARKERS)) {
+    for (const marker of markers) {
+      if (marker.startsWith("*.")) suffixes.set(marker.slice(1), tool);
+      else exactNames.set(marker, tool);
+    }
+  }
+  const found = /* @__PURE__ */ new Set();
+  let visited = 0;
+  collectFiles(
+    root,
+    (_relativePath, basename) => {
+      visited += 1;
+      const exact = exactNames.get(basename);
+      if (exact) found.add(exact);
+      for (const [suffix, tool] of suffixes) {
+        if (basename.endsWith(suffix)) found.add(tool);
+      }
+      return visited >= MAX_TOOL_SCAN_FILES;
+    },
+    1
+  );
+  return Array.from(found).sort();
+}
+function collectDirectDependencyNames(root) {
+  const names = /* @__PURE__ */ new Set();
+  const pkg = readJsonSafe2(path4.join(root, "package.json"));
+  if (pkg) {
+    for (const bucket of [
+      "dependencies",
+      "devDependencies",
+      "peerDependencies",
+      "optionalDependencies"
+    ]) {
+      const deps = pkg[bucket];
+      if (deps && typeof deps === "object" && !Array.isArray(deps)) {
+        for (const name of Object.keys(deps)) names.add(name.toLowerCase());
+      }
+    }
+  }
+  const packageSwift = readTextSafe2(path4.join(root, "Package.swift"), 32e3);
+  for (const match of packageSwift.matchAll(/\.package\([^)]*url:\s*"([^"]+)"/g)) {
+    const url = match[1] ?? "";
+    const slug = url.replace(/\.git$/, "").split("/").pop();
+    if (slug) names.add(slug.toLowerCase());
+  }
+  const requirements = readTextSafe2(path4.join(root, "requirements.txt"), 32e3);
+  for (const line of requirements.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const name = trimmed.split(/[<>=!~;[\s]/)[0];
+    if (name) names.add(name.toLowerCase());
+  }
+  const goMod = readTextSafe2(path4.join(root, "go.mod"), 32e3);
+  for (const match of goMod.matchAll(/^\s*(?:require\s+)?([\w.\-/]+\.[\w.\-/]+)\s+v\d/gm)) {
+    const modulePath = (match[1] ?? "").toLowerCase().replace(/\/v\d+$/, "");
+    if (!modulePath) continue;
+    names.add(modulePath);
+    const segment = modulePath.split("/").pop();
+    if (segment) names.add(segment);
+  }
+  const gemfile = readTextSafe2(path4.join(root, "Gemfile"), 32e3);
+  for (const match of gemfile.matchAll(/^\s*gem\s+["']([^"']+)["']/gm)) {
+    const name = match[1];
+    if (name) names.add(name.toLowerCase());
+  }
+  const composer = readJsonSafe2(path4.join(root, "composer.json"));
+  if (composer) {
+    for (const bucket of ["require", "require-dev"]) {
+      const deps = composer[bucket];
+      if (deps && typeof deps === "object" && !Array.isArray(deps)) {
+        for (const name of Object.keys(deps)) {
+          const key = name.toLowerCase();
+          names.add(key);
+          const segment = key.split("/").pop();
+          if (segment) names.add(segment);
+        }
+      }
+    }
+  }
+  return names;
+}
+function collectEnvKeyNames(root) {
+  const keys = /* @__PURE__ */ new Set();
+  const envCandidates = [
+    ".env",
+    ".env.example",
+    ".env.sample",
+    ".env.template",
+    ".env.local",
+    ".env.development",
+    ".env.production"
+  ];
+  for (const candidate of envCandidates) {
+    const content = readTextSafe2(path4.join(root, candidate), 32e3);
+    if (!content) continue;
+    for (const line of content.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const withoutExport = trimmed.replace(/^export\s+/, "");
+      const eq = withoutExport.indexOf("=");
+      const key = (eq >= 0 ? withoutExport.slice(0, eq) : withoutExport).trim();
+      if (/^[A-Z][A-Z0-9_]*$/.test(key)) keys.add(key);
+    }
+  }
+  return keys;
+}
+function isExcludedServicePath(relativePath) {
+  const segments = relativePath.toLowerCase().split(path4.sep);
+  return segments.some((segment) => SERVICE_SCAN_EXCLUDES.includes(segment));
+}
+function detectServices(root) {
+  const dependencyNames = collectDirectDependencyNames(root);
+  const envKeyNames = collectEnvKeyNames(root);
+  const anyHostnames = SERVICE_SIGNALS.some((s) => s.hostnames.length > 0);
+  const sourceHostnames = anyHostnames ? collectServiceHostnames(root) : /* @__PURE__ */ new Set();
+  const detected = [];
+  for (const signal of SERVICE_SIGNALS) {
+    const evidence = [];
+    if (signal.envKeys.some((key) => envKeyNames.has(key))) evidence.push("env-key");
+    if (signal.packages.some((pkg) => dependencyNames.has(pkg.toLowerCase()))) {
+      evidence.push("package");
+    }
+    if (signal.hostnames.some((host) => sourceHostnames.has(host.toLowerCase()))) {
+      evidence.push("hostname");
+    }
+    if (evidence.length === 0) continue;
+    const strong = evidence.includes("env-key") || evidence.includes("package");
+    const confidence = strong ? evidence.length >= 2 ? "high" : "medium" : "low";
+    detected.push({ token: signal.token, confidence, evidence });
+  }
+  return detected.sort((a, b) => a.token.localeCompare(b.token));
+}
+function collectServiceHostnames(root) {
+  const wanted = /* @__PURE__ */ new Set();
+  for (const signal of SERVICE_SIGNALS) {
+    for (const host of signal.hostnames) wanted.add(host.toLowerCase());
+  }
+  const found = /* @__PURE__ */ new Set();
+  if (wanted.size === 0) return found;
+  let visited = 0;
+  const sourceFiles = collectFiles(
+    root,
+    (relativePath, basename) => {
+      if (visited >= MAX_SERVICE_SCAN_FILES) return true;
+      visited += 1;
+      return !isExcludedServicePath(relativePath) && SERVICE_SOURCE_EXTENSIONS.some((ext) => basename.endsWith(ext));
+    },
+    MAX_SERVICE_HOSTNAME_SAMPLES
+  );
+  for (const relativePath of sourceFiles) {
+    const content = readTextSafe2(path4.join(root, relativePath)).toLowerCase();
+    if (!content) continue;
+    for (const host of wanted) {
+      if (!found.has(host) && content.includes(host)) found.add(host);
+    }
+    if (found.size === wanted.size) break;
+  }
+  return found;
+}
+function auditAgentConfig(root) {
+  const agentsPath = path4.join(root, "AGENTS.md");
+  const agentsPresent = existsSync2(agentsPath);
+  const agentsContent = agentsPresent ? readTextSafe2(agentsPath, 512e3) : "";
+  const claudePath = path4.join(root, "CLAUDE.md");
+  return {
+    agentsMd: {
+      present: agentsPresent,
+      sizeBytes: agentsPresent ? fileSizeBytes(agentsPath) : 0,
+      hasKnowledgeBlock: agentsContent.includes(KNOWLEDGE_BLOCK_BEGIN)
+    },
+    claudeMd: {
+      present: existsSync2(claudePath),
+      sizeBytes: existsSync2(claudePath) ? fileSizeBytes(claudePath) : 0
+    },
+    mcpConfigs: MCP_CONFIG_CANDIDATES.filter((candidate) => existsSync2(path4.join(root, candidate))),
+    knowledgeManifest: { present: existsSync2(knowledgeManifestPath(root)) }
+  };
+}
+function computeStackFingerprint(detection) {
+  const payload = {
+    languages: [...detection.languages].sort(),
+    frameworks: [...detection.frameworks].sort(),
+    sdkTargets: [...detection.sdkTargets].sort()
+  };
+  if (detection.tools && detection.tools.length > 0) payload.tools = [...detection.tools].sort();
+  if (detection.domains && detection.domains.length > 0)
+    payload.domains = [...detection.domains].sort();
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+}
+function detectStack(cwd, options = {}) {
+  const root = path4.resolve(cwd);
+  const capabilities = options.capabilities ?? detectProjectCapabilities(root);
+  const frameworks = /* @__PURE__ */ new Set();
+  if (capabilities.languages.includes("swift")) {
+    for (const framework of detectSwiftFrameworks(root)) frameworks.add(framework);
+  }
+  if (capabilities.languages.includes("node")) {
+    for (const framework of detectJsFrameworks(root)) frameworks.add(framework);
+  }
+  const sdkTargets = capabilities.languages.includes("swift") ? detectSdkTargets(root) : [];
+  const tools = detectTools(root);
+  const partial = {
+    languages: capabilities.languages,
+    frameworks: Array.from(frameworks).sort(),
+    sdkTargets,
+    tools
+  };
+  const detectedServices = detectServices(root);
+  const serviceCandidates = detectServiceCandidates(root);
+  return {
+    root,
+    ...partial,
+    ...detectedServices.length > 0 ? { detectedServices } : {},
+    ...serviceCandidates.length > 0 ? { serviceCandidates } : {},
+    agentConfig: auditAgentConfig(root),
+    fingerprint: computeStackFingerprint(partial)
+  };
+}
+
+// src/core/knowledge/intent.ts
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync5, unlinkSync, writeFileSync } from "fs";
+import path5 from "path";
+import { z as z3 } from "zod";
+var IntentDimensionStatus = z3.enum(["active", "satisfied", "conflict", "retired"]);
+var IntentDimensionSchema = z3.object({
+  token: z3.string().min(1),
+  dimension: z3.enum(STACK_DIMENSIONS),
+  status: IntentDimensionStatus,
+  statusChangedAt: z3.string().min(1),
+  /** Present only in `conflict` status. */
+  conflict: z3.object({
+    detectedToken: z3.string().min(1),
+    acknowledged: z3.boolean()
+  }).optional()
+});
+var StackIntentContractSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  /** Verbatim user spec (provenance for notices and doctor). */
+  spec: z3.string().min(1),
+  declaredAt: z3.string().min(1),
+  /** Optional free-text rationale (`--reason`). */
+  rationale: z3.string().optional(),
+  /** Derived, stored for greppability: retired | conflict | active. */
+  status: z3.enum(["active", "conflict", "retired"]),
+  dimensions: z3.array(IntentDimensionSchema),
+  retiredAt: z3.string().nullable()
+});
+function stackIntentPath(cwd) {
+  return path5.join(cwd, ".poetic", "context", "knowledge", "stack-intent.json");
+}
+function legacyDeclaredStackPath(cwd) {
+  return path5.join(cwd, ".poetic", "state", "declared-stack.json");
+}
+function parseIntentSpec(spec) {
+  const rawTokens = spec.split(/[,\s]+/).map((token) => token.trim()).filter((token) => token.length > 0);
+  if (rawTokens.length === 0) {
+    return {
+      ok: false,
+      error: "Empty --stack spec. Example: --stack swift,swiftui,macos-26 or --stack tool:terraform,domain:aws"
+    };
+  }
+  const byKey = /* @__PURE__ */ new Map();
+  for (const raw of rawTokens) {
+    const result = classifyStackToken(raw);
+    if (!result.ok) return { ok: false, error: result.error };
+    const key = `${result.token.dimension}:${result.token.token}`;
+    const existing = byKey.get(key);
+    if (!existing || result.token.explicit && !existing.explicit) {
+      byKey.set(key, result.token);
+    }
+  }
+  const tokens = Array.from(byKey.values());
+  if (!hasStrongAnchor(tokens)) {
+    return {
+      ok: false,
+      error: "--stack needs at least one strong anchor: a known language (swift, python, ...), a versioned platform (macos-26, k8s-1.31), or an explicitly prefixed token (tool:terraform, domain:aws, fw:htmx)."
+    };
+  }
+  return { ok: true, tokens };
+}
+function deriveContractStatus(dimensions) {
+  if (dimensions.every((d) => d.status === "retired")) {
+    return "retired";
+  }
+  if (dimensions.some((d) => d.status === "conflict" && d.conflict?.acknowledged !== true)) {
+    return "conflict";
+  }
+  return "active";
+}
+function createIntentContract(spec, tokens, options = {}) {
+  const nowIso = (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+  const dimensions = tokens.map((token) => ({
+    token: token.token,
+    dimension: token.dimension,
+    status: "active",
+    statusChangedAt: nowIso
+  }));
+  return {
+    schemaVersion: 1,
+    spec,
+    declaredAt: nowIso,
+    ...options.rationale ? { rationale: options.rationale } : {},
+    status: deriveContractStatus(dimensions),
+    dimensions,
+    retiredAt: null
+  };
+}
+function readIntentContract(cwd) {
+  const filePath = stackIntentPath(cwd);
+  if (!existsSync3(filePath)) return { status: "absent" };
+  try {
+    const parsed = StackIntentContractSchema.safeParse(JSON.parse(readFileSync5(filePath, "utf8")));
+    if (!parsed.success) {
+      return { status: "invalid", error: parsed.error.issues[0]?.message ?? "schema mismatch" };
+    }
+    return { status: "ok", contract: parsed.data };
+  } catch (error) {
+    return { status: "invalid", error: error instanceof Error ? error.message : String(error) };
+  }
+}
+function writeIntentContract(cwd, contract) {
+  const filePath = stackIntentPath(cwd);
+  mkdirSync(path5.dirname(filePath), { recursive: true });
+  writeFileSync(filePath, `${JSON.stringify(contract, null, 2)}
+`, "utf8");
+}
+function removeIntentContract(cwd) {
+  try {
+    unlinkSync(stackIntentPath(cwd));
+  } catch {
+  }
+}
+var LegacyDeclaredSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  spec: z3.string().min(1),
+  declaredAt: z3.string().min(1),
+  languages: z3.array(z3.string()),
+  frameworks: z3.array(z3.string()),
+  sdkTargets: z3.array(z3.string())
+});
+function migrateLegacyDeclaration(cwd, options = {}) {
+  const legacyPath = legacyDeclaredStackPath(cwd);
+  if (!existsSync3(legacyPath)) return void 0;
+  const existing = readIntentContract(cwd);
+  if (existing.status !== "absent") {
+    if (existing.status === "ok") {
+      try {
+        unlinkSync(legacyPath);
+      } catch {
+      }
+    }
+    return void 0;
+  }
+  let legacy;
+  try {
+    const parsed = LegacyDeclaredSchema.safeParse(JSON.parse(readFileSync5(legacyPath, "utf8")));
+    if (!parsed.success) return void 0;
+    legacy = parsed.data;
+  } catch {
+    return void 0;
+  }
+  const rawTokens = [...legacy.languages, ...legacy.sdkTargets, ...legacy.frameworks];
+  const tokens = [];
+  for (const raw of rawTokens) {
+    const result = classifyStackToken(raw);
+    if (result.ok) tokens.push(result.token);
+  }
+  if (tokens.length === 0) return void 0;
+  const contract = createIntentContract(legacy.spec, tokens, { now: options.now });
+  const migrated = { ...contract, declaredAt: legacy.declaredAt };
+  writeIntentContract(cwd, migrated);
+  try {
+    unlinkSync(legacyPath);
+  } catch {
+  }
+  return migrated;
+}
+function resolveIntent(detection, contract, options = {}) {
+  const nowIso = (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+  const detectedLanguages = new Set(detection.languages);
+  const detectedFrameworks = new Set(detection.frameworks);
+  const detectedSdk = new Set(detection.sdkTargets);
+  const detectedTools = new Set(detection.tools ?? []);
+  const detectedDomains = new Set(detection.domains ?? []);
+  const detectedSdkByPlatform = /* @__PURE__ */ new Map();
+  for (const target of detection.sdkTargets) {
+    detectedSdkByPlatform.set(sdkPlatform(target), target);
+  }
+  const languages = new Set(detection.languages);
+  const frameworks = new Set(detection.frameworks);
+  const sdkTargets = new Set(detection.sdkTargets);
+  const tools = new Set(detection.tools ?? []);
+  const domains = new Set(detection.domains ?? []);
+  const acknowledgedSdkPairs = [...detection.acknowledgedSdkPairs ?? []];
+  const conflicts = [];
+  let contractChanged = false;
+  let declaredRealLanguage = false;
+  const dimensions = contract.dimensions.map((dim) => {
+    if (dim.status === "retired") return dim;
+    const setStatus = (status, conflict) => {
+      const unchanged = dim.status === status && dim.conflict?.detectedToken === conflict?.detectedToken && dim.conflict?.acknowledged === conflict?.acknowledged;
+      if (unchanged) return dim;
+      contractChanged = true;
+      return {
+        ...dim,
+        status,
+        statusChangedAt: nowIso,
+        ...conflict ? { conflict } : { conflict: void 0 }
+      };
+    };
+    switch (dim.dimension) {
+      case "lang": {
+        declaredRealLanguage = true;
+        if (detectedLanguages.has(dim.token)) {
+          return setStatus("satisfied");
+        }
+        languages.add(dim.token);
+        return setStatus("active");
+      }
+      case "fw": {
+        if (detectedFrameworks.has(dim.token)) return setStatus("satisfied");
+        frameworks.add(dim.token);
+        return setStatus("active");
+      }
+      case "tool": {
+        if (detectedTools.has(dim.token)) return setStatus("satisfied");
+        tools.add(dim.token);
+        return setStatus("active");
+      }
+      case "domain": {
+        if (detectedDomains.has(dim.token)) return setStatus("satisfied");
+        domains.add(dim.token);
+        return setStatus("active");
+      }
+      case "sdk": {
+        if (detectedSdk.has(dim.token)) return setStatus("satisfied");
+        const platform = sdkPlatform(dim.token);
+        const detectedSame = detectedSdkByPlatform.get(platform);
+        if (!detectedSame) {
+          sdkTargets.add(dim.token);
+          return setStatus("active");
+        }
+        const acknowledged = dim.conflict?.acknowledged === true && dim.conflict.detectedToken === detectedSame;
+        if (acknowledged) {
+          sdkTargets.add(dim.token);
+          acknowledgedSdkPairs.push({
+            platform,
+            sdkVersion: sdkVersion(dim.token),
+            deploymentVersion: sdkVersion(detectedSame)
+          });
+          return setStatus("conflict", { detectedToken: detectedSame, acknowledged: true });
+        }
+        const next = setStatus("conflict", { detectedToken: detectedSame, acknowledged: false });
+        conflicts.push({ dimension: next, detectedToken: detectedSame });
+        return next;
+      }
+      default: {
+        const exhaustive = dim.dimension;
+        return exhaustive;
+      }
+    }
+  });
+  if (declaredRealLanguage) {
+    languages.delete("docs");
+    languages.delete("unknown");
+    if (languages.size === 0) {
+      for (const dim of dimensions) {
+        if (dim.dimension === "lang") {
+          languages.add(dim.token);
+        }
+      }
+    }
+  }
+  const partial = {
+    languages: Array.from(languages).sort(),
+    frameworks: Array.from(frameworks).sort(),
+    sdkTargets: Array.from(sdkTargets).sort(),
+    tools: Array.from(tools).sort(),
+    domains: Array.from(domains).sort()
+  };
+  const updatedContract = {
+    ...contract,
+    status: deriveContractStatus(dimensions),
+    dimensions
+  };
+  if (updatedContract.status !== contract.status) contractChanged = true;
+  const effective = {
+    ...detection,
+    ...partial,
+    ...acknowledgedSdkPairs.length > 0 ? { acknowledgedSdkPairs } : {},
+    fingerprint: computeStackFingerprint(partial)
+  };
+  const dimensionDone = (d) => d.status === "satisfied" || d.status === "retired" || d.status === "conflict" && d.conflict?.acknowledged === true;
+  const allCovered = dimensions.every(dimensionDone);
+  const allSatisfied = allCovered || dimensions.every(
+    (d) => dimensionDone(d) || !isGatingToken({ token: d.token, dimension: d.dimension, explicit: true })
+  );
+  return {
+    effective,
+    contract: updatedContract,
+    contractChanged,
+    conflicts,
+    allSatisfied,
+    allCovered
+  };
+}
+function retireContract(contract, options = {}) {
+  const nowIso = (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+  return {
+    ...contract,
+    status: "retired",
+    retiredAt: nowIso,
+    dimensions: contract.dimensions.map(
+      (dim) => dim.status === "retired" ? dim : { ...dim, status: "retired", statusChangedAt: nowIso }
+    )
+  };
+}
+function acknowledgeConflicts(contract, options = {}) {
+  const nowIso = (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+  const dimensions = contract.dimensions.map((dim) => {
+    if (dim.status !== "conflict" || dim.conflict?.acknowledged === true) return dim;
+    return {
+      ...dim,
+      statusChangedAt: nowIso,
+      conflict: {
+        ...dim.conflict,
+        acknowledged: true
+      }
+    };
+  });
+  return { ...contract, status: deriveContractStatus(dimensions), dimensions };
+}
+function acceptDetectedReality(contract, options = {}) {
+  const nowIso = (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+  const dimensions = contract.dimensions.map((dim) => {
+    if (dim.status !== "conflict") return dim;
+    return { ...dim, status: "retired", statusChangedAt: nowIso, conflict: void 0 };
+  });
+  return { ...contract, status: deriveContractStatus(dimensions), dimensions };
+}
+function describeDimension(dim) {
+  const base = `${dim.token.padEnd(12)} ${dim.dimension.padEnd(6)} ${dim.status}`;
+  if (dim.status === "conflict" && dim.conflict) {
+    const ack = dim.conflict.acknowledged ? " (acknowledged)" : "";
+    return `${base}${ack} \u2014 detected ${dim.conflict.detectedToken}`;
+  }
+  if (dim.status === "active") return `${base} (not yet in code)`;
+  return base;
+}
+
+export {
+  KitItemSchema,
+  resolvePoeticVersion,
+  KNOWLEDGE_BLOCK_BEGIN,
+  KNOWLEDGE_BLOCK_END,
+  CONTEXT_DIR,
+  knowledgeManifestPath,
+  readKnowledgeManifest,
+  writeKnowledgeManifest,
+  createManifest,
+  CANDIDATE_ITEM_ID_PREFIX,
+  CANDIDATE_SEARCH_PRIORITY,
+  MAX_UNRESOLVED_LINES,
+  candidateSetSignature,
+  QUERY_SAFE_EVIDENCE_CLASSES,
+  isQuerySafeHostname,
+  isCandidateQuerySafe,
+  SERVICE_DOC_DOMAINS,
+  serviceSignalForToken,
+  detectStack,
+  stackIntentPath,
+  legacyDeclaredStackPath,
+  parseIntentSpec,
+  createIntentContract,
+  readIntentContract,
+  writeIntentContract,
+  removeIntentContract,
+  migrateLegacyDeclaration,
+  resolveIntent,
+  retireContract,
+  acknowledgeConflicts,
+  acceptDetectedReality,
+  describeDimension
+};
+//# sourceMappingURL=chunk-KZ5CJVBP.js.map