@skill-harness/adapters 0.16.0 → 0.18.0

package/dist/generated/retention-v2-contract.js

@@ -1,105 +0,0 @@
-// GENERATED by scripts/vendor-execution-retention.mjs from pi-daddy 7c78769c47177b1972b09e1f5c5474ad44cd2cac. Do not hand-edit.
-import { Compile } from "typebox/compile";
-import { parseWorkJson } from "./retention-v2-json.js";
-const string = (maxLength = 512) => ({ type: "string", minLength: 1, maxLength, pattern: "^[^\\u0000-\\u001f\\u007f]+$" });
-const nullable = (schema) => ({ anyOf: [schema, { type: "null" }] });
-const literal = (value) => ({ const: value });
-const closed = (properties) => ({ type: "object", properties, required: Object.keys(properties), additionalProperties: false });
-const hash = { type: "string", pattern: "^[a-f0-9]{64}$" };
-const integer = { type: "integer", minimum: 0, maximum: Number.MAX_SAFE_INTEGER };
-const uuid = { type: "string", pattern: "^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$" };
-export const RETENTION_CONTENT_KINDS = ["stdout", "stderr", "paneSnapshot", "checkReceipt", "result", "session"];
-export const RETENTION_SCHEMA = freeze({
-    $schema: "https://json-schema.org/draft/2020-12/schema",
-    $id: "https://pi-daddy.local/contracts/execution-retention/v2/manifest.schema.json",
-    ...closed({
-        version: literal("2.0"), archiveId: uuid,
-        identity: closed({ executionId: string(), parentExecutionId: nullable(string()), childId: string(), toolCallId: nullable(string()),
-            executor: { enum: ["process", "herdr", "check"] }, taskDigest: nullable(hash), definitionDigest: nullable(hash),
-            configurationDigest: hash, workspaceId: nullable(string()) }),
-        native: closed({ pid: nullable({ type: "integer", minimum: 1, maximum: Number.MAX_SAFE_INTEGER }), paneId: nullable(string(4096)),
-            agentName: nullable(string(4096)), tabId: nullable(string(4096)), sessionId: nullable(uuid), sessionPath: nullable(string(4096)), branchLeafId: nullable(string(128)) }),
-        nativeSession: closed({ source: { enum: [null, "herdr-id", "herdr-path", "pi-session-file", "pi-session-manager"] },
-            status: { enum: ["missing", "verified", "invalid", "changed", "truncated", "unsupported"] },
-            sessionId: nullable(uuid), sessionPath: nullable(string(4096)), parentSessionPath: nullable(string(4096)),
-            branchLeafId: nullable(string(128)), branchState: { enum: ["unknown", "observed"] }, lastPersistedEntryId: nullable(string(128)),
-            sha256: nullable(hash), reason: nullable(string()) }),
-        state: { enum: ["running", "terminal"] },
-        outcome: nullable(closed({ code: nullable({ type: "integer", minimum: -2147483648, maximum: 2147483647 }), signal: nullable(string(64)),
-            timedOut: { type: "boolean" }, aborted: { type: "boolean" }, truncated: { type: "boolean" }, failed: { type: "boolean" } })),
-        content: closed(Object.fromEntries(RETENTION_CONTENT_KINDS.map(kind => [kind, { oneOf: [
-                    closed({ status: literal("missing"), path: literal(null), sha256: literal(null), bytes: literal(null) }),
-                    closed({ status: literal("retained"), path: { type: "string", pattern: `^${kind}-[a-f0-9]{64}\\.bin$` }, sha256: hash,
-                        bytes: { ...integer, maximum: 1024 * 1024 } }),
-                ] }]))),
-        coverage: closed({ complete: literal(false), losses: { type: "array", items: string(), maxItems: 64, uniqueItems: true } }),
-        acceptance: literal("not-assessed"),
-    }),
-    allOf: [
-        { if: { properties: { state: literal("running") } }, then: { properties: { outcome: literal(null) } },
-            else: { properties: { outcome: { type: "object" } } } },
-        { if: { properties: { nativeSession: { properties: { branchState: literal("unknown") } } } },
-            then: { properties: { nativeSession: { properties: { branchLeafId: literal(null) } }, native: { properties: { branchLeafId: literal(null) } } } } },
-    ],
-});
-const validator = Compile(RETENTION_SCHEMA);
-function freeze(value) { if (value && typeof value === "object") {
-    for (const child of Object.values(value))
-        freeze(child);
-    Object.freeze(value);
-} return value; }
-/** Closed, detached versioned wire builder; never authenticates the supplied observation. */
-export function buildExecutionRetentionManifest(value) {
-    // Reject non-JSON objects/accessors instead of invoking serialization hooks while collecting evidence.
-    let nodes = 0;
-    const inspect = (x, depth) => {
-        if (++nodes > 4096 || depth > 16)
-            throw new TypeError("retention manifest exceeds bounds");
-        if (x === null || typeof x === "string" || typeof x === "boolean" || (typeof x === "number" && Number.isSafeInteger(x)))
-            return;
-        if (!x || typeof x !== "object" || (!Array.isArray(x) && Object.getPrototypeOf(x) !== Object.prototype && Object.getPrototypeOf(x) !== null))
-            throw new TypeError("retention manifest must be JSON data");
-        if (Array.isArray(x) && (Object.getPrototypeOf(x) !== Array.prototype || x.length > 256 || Reflect.ownKeys(x).length !== x.length + 1 ||
-            Array.from({ length: x.length }, (_, i) => String(i)).some(key => !Object.hasOwn(x, key))))
-            throw new TypeError("retention arrays must be dense plain JSON arrays");
-        for (const key of Reflect.ownKeys(x)) {
-            if (Array.isArray(x) && key === "length")
-                continue;
-            const d = Object.getOwnPropertyDescriptor(x, key);
-            if (typeof key !== "string" || !d.enumerable || !("value" in d))
-                throw new TypeError("retention manifest must be plain JSON data");
-            inspect(d.value, depth + 1);
-        }
-    };
-    inspect(value, 0);
-    if (!validator.Check(value))
-        throw new TypeError("invalid execution-retention 2.0 manifest");
-    const m = JSON.parse(JSON.stringify(value));
-    if (m.native.sessionId !== m.nativeSession.sessionId || m.native.sessionPath !== m.nativeSession.sessionPath || m.native.branchLeafId !== m.nativeSession.branchLeafId) {
-        throw new TypeError("native session projection mismatch");
-    }
-    for (const kind of RETENTION_CONTENT_KINDS) {
-        const ref = m.content[kind];
-        if (ref.status === "retained" && ref.path !== `${kind}-${ref.sha256}.bin`)
-            throw new TypeError("retention content identity mismatch");
-    }
-    if (m.nativeSession.branchState === "observed" && (m.nativeSession.source !== "pi-session-manager" || m.nativeSession.status !== "verified"))
-        throw new TypeError("unverified active native branch");
-    if (m.nativeSession.status === "verified" && (!m.nativeSession.sessionId || !m.nativeSession.sha256 || m.content.session.sha256 !== m.nativeSession.sha256))
-        throw new TypeError("verified native session requires retained bytes");
-    return freeze(m);
-}
-export function parseExecutionRetentionManifest(text) {
-    if (Buffer.byteLength(text) > 64 * 1024)
-        throw new TypeError("retention manifest exceeds bounds");
-    // Manifest numbers are integers; use the existing exact-token parser before lossy Number conversion.
-    let value;
-    try {
-        value = parseWorkJson(text);
-    }
-    catch {
-        throw new TypeError("invalid retention JSON");
-    }
-    return buildExecutionRetentionManifest(value);
-}
-//# sourceMappingURL=retention-v2-contract.js.map

package/dist/generated/retention-v2-json.d.ts

@@ -1,24 +0,0 @@
-import { type WorkFrozen, type WorkProblem, type WorkConflict } from "./retention-v2-work-types.js";
-export declare const WORK_EVENT_BYTES: number;
-export declare const WORK_TEXT_BYTES: number;
-export declare const WORK_RECORDS = 10000;
-export type WorkJson = null | boolean | number | string | WorkJson[] | {
-    [key: string]: WorkJson;
-};
-/** Inspect descriptors rather than serializing: no getters/toJSON or lossy JSON coercion. */
-export declare function ownWorkFields(value: unknown): Record<string, PropertyDescriptor>;
-/** Detach only the approved JSON value profile, before any serialization or validation use. */
-export declare function copyWorkJson(value: unknown): WorkJson;
-/** Bounded syntax tree: syntax, decoded duplicates, then exact numeric/string profile. */
-export declare function parseWorkJson(text: string): WorkJson;
-/** RFC 8785 emission restricted to our validated JSON profile; not an archival-byte identity. */
-export declare function canonicalWorkJson(value: unknown): string;
-export declare function workDigest(value: unknown): string;
-/** @internal ONLY validated constituents / internally constructed plain results. Output collections
- * are not wire records: they may contain >256 claims, problems, labels, or conflict alternatives.
- * Never use this emitter in place of copyWorkJson/strict ingestion at an input boundary. */
-export declare function workResultKey<T>(value: T): string;
-export declare function sortWorkResults<T>(values: Iterable<T>): T[];
-export declare function mergeWorkProblems(values: readonly WorkFrozen<WorkProblem>[]): WorkFrozen<WorkProblem>[];
-export declare function mergeWorkConflicts(values: readonly WorkFrozen<WorkConflict>[]): WorkFrozen<WorkConflict>[];
-export declare function freezeWork<T>(value: T): WorkFrozen<T>;

package/dist/generated/retention-v2-json.js

@@ -1,268 +0,0 @@
-// GENERATED by scripts/vendor-execution-retention.mjs from pi-daddy 7c78769c47177b1972b09e1f5c5474ad44cd2cac. Do not hand-edit.
-import { createHash } from "node:crypto";
-import { WorkInputError } from "./retention-v2-work-types.js";
-export const WORK_EVENT_BYTES = 64 * 1024;
-export const WORK_TEXT_BYTES = 16 * 1024 * 1024;
-export const WORK_RECORDS = 10_000;
-const MAX_DEPTH = 16;
-const MAX_ARRAY = 256;
-const invalid = () => { throw new WorkInputError("WORK_SCHEMA_INVALID"); };
-const limit = () => { throw new WorkInputError("WORK_LIMIT_EXCEEDED"); };
-function unicode(value) {
-    // RFC 8785 refuses lone UTF-16 surrogates, including ones decoded from escapes.
-    for (let i = 0; i < value.length; i++) {
-        const code = value.charCodeAt(i);
-        if (code >= 0xd800 && code <= 0xdbff) {
-            const next = value.charCodeAt(++i);
-            if (!(next >= 0xdc00 && next <= 0xdfff))
-                invalid();
-        }
-        else if (code >= 0xdc00 && code <= 0xdfff)
-            invalid();
-    }
-    return value;
-}
-/** Inspect descriptors rather than serializing: no getters/toJSON or lossy JSON coercion. */
-export function ownWorkFields(value) {
-    if (value === null || typeof value !== "object" || Array.isArray(value))
-        invalid();
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== Object.prototype && prototype !== null)
-        invalid();
-    const descriptors = Object.getOwnPropertyDescriptors(value);
-    for (const key of Reflect.ownKeys(descriptors)) {
-        if (typeof key !== "string")
-            return invalid();
-        const descriptor = descriptors[key];
-        if (!Object.hasOwn(descriptor, "value") || !descriptor.enumerable)
-            invalid();
-        unicode(key);
-    }
-    return descriptors;
-}
-/** Detach only the approved JSON value profile, before any serialization or validation use. */
-export function copyWorkJson(value) {
-    const ancestors = new Set();
-    function copy(v, depth) {
-        if (v === null || typeof v === "boolean")
-            return v;
-        if (typeof v === "string")
-            return unicode(v);
-        if (typeof v === "number")
-            return Number.isSafeInteger(v) ? v : invalid();
-        if (typeof v !== "object")
-            return invalid();
-        if (depth > MAX_DEPTH)
-            limit();
-        if (ancestors.has(v))
-            invalid();
-        ancestors.add(v);
-        let result;
-        if (Array.isArray(v)) {
-            if (Object.getPrototypeOf(v) !== Array.prototype)
-                invalid();
-            if (v.length > MAX_ARRAY)
-                limit();
-            const fields = Object.getOwnPropertyDescriptors(v);
-            if (Reflect.ownKeys(fields).length !== v.length + 1)
-                invalid();
-            result = [];
-            for (let i = 0; i < v.length; i++) {
-                const d = fields[String(i)];
-                if (!d || !Object.hasOwn(d, "value") || !d.enumerable)
-                    invalid();
-                result.push(copy(d.value, depth + 1));
-            }
-        }
-        else {
-            const fields = ownWorkFields(v);
-            result = {};
-            for (const key of Object.keys(fields)) {
-                Object.defineProperty(result, key, { value: copy(fields[key].value, depth + 1), enumerable: true, writable: true, configurable: true });
-            }
-        }
-        ancestors.delete(v);
-        return result;
-    }
-    return copy(value, 1);
-}
-/** Exact decimal arithmetic BEFORE Number conversion, without unbounded exponent allocation. */
-function integerToken(token) {
-    const match = /^(-?)(\d+)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(token);
-    let digits = (match[2] + (match[3] ?? "")).replace(/^0+/, "");
-    if (!digits)
-        return 0;
-    let shift = BigInt(match[4] ?? "0") - BigInt((match[3] ?? "").length);
-    const trailing = /0*$/.exec(digits)[0].length;
-    digits = digits.slice(0, digits.length - trailing);
-    shift += BigInt(trailing);
-    if (shift < 0n || BigInt(digits.length) + shift > 16n)
-        invalid();
-    const exact = BigInt(digits) * (10n ** shift);
-    if (exact > BigInt(Number.MAX_SAFE_INTEGER))
-        invalid();
-    return Number(match[1] === "-" ? -exact : exact);
-}
-function checkMembers(node) {
-    if (node.type === "object") {
-        const names = new Set();
-        for (const [key, child] of node.entries) {
-            if (names.has(key))
-                throw new WorkInputError("WORK_DUPLICATE_MEMBER");
-            names.add(key);
-            checkMembers(child);
-        }
-    }
-    else if (node.type === "array")
-        node.items.forEach(checkMembers);
-}
-function materialize(node) {
-    if (node.type === "number")
-        return integerToken(node.token);
-    if (node.type === "literal")
-        return typeof node.value === "string" ? unicode(node.value) : node.value;
-    if (node.type === "array")
-        return node.items.map(materialize);
-    return Object.fromEntries(node.entries.map(([key, child]) => [unicode(key), materialize(child)]));
-}
-/** Bounded syntax tree: syntax, decoded duplicates, then exact numeric/string profile. */
-export function parseWorkJson(text) {
-    if (typeof text !== "string")
-        invalid();
-    if (Buffer.byteLength(text, "utf8") > WORK_EVENT_BYTES)
-        limit();
-    let at = 0;
-    const syntax = () => { throw new WorkInputError("WORK_JSON_INVALID"); };
-    const whitespace = () => { while (at < text.length && /[ \t\r\n]/.test(text[at]))
-        at++; };
-    function string() {
-        const start = at++;
-        while (at < text.length) {
-            const char = text[at++];
-            if (char === '"') {
-                // JSON.parse is used ONLY for one lexically delimited string token, never an object.
-                return JSON.parse(text.slice(start, at));
-            }
-            if (char.charCodeAt(0) < 0x20)
-                syntax();
-            if (char === "\\") {
-                const escape = text[at++];
-                if (escape === "u") {
-                    if (!/^[0-9a-fA-F]{4}$/.test(text.slice(at, at + 4)))
-                        syntax();
-                    at += 4;
-                }
-                else if (!escape || !'"\\/bfnrt'.includes(escape))
-                    syntax();
-            }
-        }
-        return syntax();
-    }
-    function value(depth) {
-        whitespace();
-        const char = text[at];
-        if (char === '"')
-            return { type: "literal", value: string() };
-        if (char === "{" || char === "[") {
-            if (depth > MAX_DEPTH)
-                limit();
-            at++;
-            whitespace();
-            const object = char === "{";
-            const end = object ? "}" : "]";
-            const entries = [];
-            const items = [];
-            if (text[at] !== end)
-                for (;;) {
-                    whitespace();
-                    let key = "";
-                    if (object) {
-                        if (text[at] !== '"')
-                            syntax();
-                        key = string();
-                        whitespace();
-                        if (text[at++] !== ":")
-                            syntax();
-                    }
-                    else if (items.length >= MAX_ARRAY)
-                        limit();
-                    const child = value(depth + 1);
-                    if (object)
-                        entries.push([key, child]);
-                    else
-                        items.push(child);
-                    whitespace();
-                    if (text[at] === end)
-                        break;
-                    if (text[at++] !== ",")
-                        syntax();
-                }
-            at++;
-            return object ? { type: "object", entries } : { type: "array", items };
-        }
-        for (const [token, literal] of [["null", null], ["true", true], ["false", false]]) {
-            if (text.startsWith(token, at)) {
-                at += token.length;
-                return { type: "literal", value: literal };
-            }
-        }
-        const token = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(text.slice(at));
-        if (!token)
-            return syntax();
-        at += token[0].length;
-        return { type: "number", token: token[0] };
-    }
-    const result = value(1);
-    whitespace();
-    if (at !== text.length)
-        syntax();
-    checkMembers(result);
-    return materialize(result);
-}
-function emit(value) {
-    if (value === null || typeof value !== "object")
-        return JSON.stringify(value);
-    if (Array.isArray(value))
-        return `[${value.map(emit).join(",")}]`;
-    // Emit keys directly: reconstructing a JS object would reorder numeric-looking keys.
-    return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${emit(value[key])}`).join(",")}}`;
-}
-/** RFC 8785 emission restricted to our validated JSON profile; not an archival-byte identity. */
-export function canonicalWorkJson(value) { return emit(copyWorkJson(value)); }
-export function workDigest(value) {
-    return createHash("sha256").update(canonicalWorkJson(value), "utf8").digest("hex");
-}
-/** @internal ONLY validated constituents / internally constructed plain results. Output collections
- * are not wire records: they may contain >256 claims, problems, labels, or conflict alternatives.
- * Never use this emitter in place of copyWorkJson/strict ingestion at an input boundary. */
-export function workResultKey(value) { return emit(value); }
-export function sortWorkResults(values) {
-    const rows = new Map([...values].map(value => [workResultKey(value), value]));
-    return [...rows].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, value]) => value);
-}
-export function mergeWorkProblems(values) {
-    const rows = new Map();
-    for (const row of values) {
-        const id = workResultKey([row.code, row.reference]), prior = rows.get(id);
-        rows.set(id, { ...row, affectedObligations: sortWorkResults([...(prior?.affectedObligations ?? []), ...row.affectedObligations]) });
-    }
-    return sortWorkResults(rows.values());
-}
-export function mergeWorkConflicts(values) {
-    const rows = new Map();
-    for (const row of values) {
-        const id = workResultKey([row.kind, row.id]), prior = rows.get(id);
-        rows.set(id, { ...row, digests: sortWorkResults([...(prior?.digests ?? []), ...row.digests]),
-            affectedObligations: sortWorkResults([...(prior?.affectedObligations ?? []), ...row.affectedObligations]) });
-    }
-    return sortWorkResults(rows.values());
-}
-export function freezeWork(value) {
-    if (value !== null && typeof value === "object") {
-        for (const child of Object.values(value))
-            freezeWork(child);
-        Object.freeze(value);
-    }
-    return value;
-}
-//# sourceMappingURL=retention-v2-json.js.map

package/dist/generated/retention-v2-native-json.d.ts

@@ -1,2 +0,0 @@
-/** Strict JSON framing for retention metadata/native records. Floats in native usage remain supported. */
-export declare function parseRetentionJson(text: string, maxBytes?: number): unknown;

package/dist/generated/retention-v2-native-json.js

@@ -1,33 +0,0 @@
-// GENERATED by scripts/vendor-execution-retention.mjs from pi-daddy 7c78769c47177b1972b09e1f5c5474ad44cd2cac. Do not hand-edit.
-/** Strict JSON framing for retention metadata/native records. Floats in native usage remain supported. */
-export function parseRetentionJson(text, maxBytes = 64 * 1024) {
-    if (Buffer.byteLength(text) > maxBytes)
-        throw new TypeError("retention JSON exceeds bounds");
-    const value = JSON.parse(text);
-    const stack = [];
-    for (const match of text.matchAll(/"(?:[^"\\]|\\[\s\S])*"|[{}\[\],:]|[^\s{}\[\],:]+/g)) {
-        const token = match[0], top = stack.at(-1);
-        if (token === "{" || token === "[") {
-            if (stack.length >= 64)
-                throw new TypeError("retention JSON exceeds depth");
-            stack.push({ object: token === "{", key: token === "{", seen: new Set() });
-        }
-        else if (token === "}" || token === "]")
-            stack.pop();
-        else if (token === ",") {
-            if (top?.object)
-                top.key = true;
-        }
-        else if (token.startsWith('"') && top?.object && top.key) {
-            const key = JSON.parse(token);
-            if (top.seen.has(key))
-                throw new TypeError("duplicate retention JSON member");
-            top.seen.add(key);
-            top.key = false;
-        }
-        else if (/^-?\d/.test(token) && !Number.isFinite(Number(token)))
-            throw new TypeError("non-finite retention JSON number");
-    }
-    return value;
-}
-//# sourceMappingURL=retention-v2-native-json.js.map

package/dist/generated/retention-v2-native.d.ts

@@ -1,58 +0,0 @@
-export declare const ENV_NATIVE_SESSION_ROOT = "PI_GRANTS_NATIVE_SESSION_ROOT";
-export declare const MAX_NATIVE_SESSION_BYTES: number;
-export type NativeSessionSource = "herdr-id" | "herdr-path" | "pi-session-file" | "pi-session-manager";
-export interface NativeSessionObservation {
-    source: NativeSessionSource | null;
-    status: "missing" | "verified" | "invalid" | "changed" | "truncated" | "unsupported";
-    sessionId: string | null;
-    sessionPath: string | null;
-    parentSessionPath: string | null;
-    branchLeafId: string | null;
-    branchState: "unknown" | "observed";
-    lastPersistedEntryId: string | null;
-    sha256: string | null;
-    reason: string | null;
-}
-export interface NativeSessionCapture {
-    observation: NativeSessionObservation;
-    bytes?: Buffer;
-    fileIdentity?: {
-        device: string;
-        inode: string;
-    };
-}
-/** Read-only methods of pi 0.84.2's public SessionManager; no runtime/session creation or model work. */
-export interface NativeSessionManager {
-    getSessionFile(): string | undefined;
-    getSessionId(): string;
-    getLeafId(): string | null;
-}
-export declare const missingNativeSession: () => NativeSessionObservation;
-/** Parse the retained native v3 bytes, never load/migrate/rewrite a session via SessionManager.open(). */
-export declare function parseNativeSessionBytes(bytes: Uint8Array, input: {
-    source: NativeSessionSource;
-    path: string;
-    expectedSessionId?: string;
-    truncated?: boolean;
-    liveLeaf?: {
-        sessionId: string;
-        leafId: string | null;
-    };
-}): NativeSessionCapture;
-/** Private allowlisted files only, bounded non-following descriptor reads, no scan of session/auth dirs. */
-export declare function readNativeSession(input: {
-    path: string;
-    source: NativeSessionSource;
-    expectedSessionId?: string;
-    allowedRoot?: string;
-    manager?: NativeSessionManager;
-    expectedFile?: {
-        device: string;
-        inode: string;
-    };
-}): Promise<NativeSessionCapture>;
-/** Herdr 0.8.2 protocol 20 AgentInfo.agent_session; never scrape terminal text, PID or names. */
-export declare function herdrSessionReference(value: unknown, expectedPane: string): {
-    source: "herdr-id" | "herdr-path";
-    value: string;
-} | null;

package/dist/generated/retention-v2-native.js

@@ -1,155 +0,0 @@
-// GENERATED by scripts/vendor-execution-retention.mjs from pi-daddy 7c78769c47177b1972b09e1f5c5474ad44cd2cac. Do not hand-edit.
-import { constants } from "node:fs";
-import { open, lstat, realpath } from "node:fs/promises";
-import { isAbsolute, relative, sep } from "node:path";
-import { createHash } from "node:crypto";
-import { parseRetentionJson } from "./retention-v2-native-json.js";
-export const ENV_NATIVE_SESSION_ROOT = "PI_GRANTS_NATIVE_SESSION_ROOT";
-export const MAX_NATIVE_SESSION_BYTES = 1024 * 1024;
-export const missingNativeSession = () => ({ source: null, status: "missing", sessionId: null,
-    sessionPath: null, parentSessionPath: null, branchLeafId: null, branchState: "unknown", lastPersistedEntryId: null,
-    sha256: null, reason: "native-session-unavailable" });
-const id = (x) => typeof x === "string" && /^[a-zA-Z0-9_-]{1,128}$/.test(x);
-const uuid = (x) => typeof x === "string" && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(x);
-const obj = (x) => x !== null && typeof x === "object" && !Array.isArray(x);
-const filePath = (x) => typeof x === "string" && x.length <= 4096 && isAbsolute(x) && !x.includes("\0");
-/** Parse the retained native v3 bytes, never load/migrate/rewrite a session via SessionManager.open(). */
-export function parseNativeSessionBytes(bytes, input) {
-    const observation = { ...missingNativeSession(), source: input.source, sessionPath: input.path };
-    const result = { observation };
-    const fail = (status, reason) => {
-        observation.status = status;
-        observation.reason = reason;
-        observation.branchLeafId = null;
-        observation.branchState = "unknown";
-        return result;
-    };
-    if (bytes.length > MAX_NATIVE_SESSION_BYTES)
-        return fail("truncated", "native-session-size-limit");
-    const raw = Buffer.from(bytes), newline = raw.indexOf(10);
-    let header;
-    try {
-        header = parseRetentionJson(new TextDecoder("utf-8", { fatal: true }).decode(raw.subarray(0, newline < 0 ? raw.length : newline)), MAX_NATIVE_SESSION_BYTES);
-    }
-    catch {
-        return fail("invalid", "native-session-header-invalid");
-    }
-    if (!obj(header) || header.type !== "session" || header.version !== 3 || !uuid(header.id) ||
-        !filePath(header.cwd) || typeof header.timestamp !== "string" || !Number.isFinite(Date.parse(header.timestamp)) ||
-        (header.parentSession !== undefined && !filePath(header.parentSession)))
-        return fail("invalid", "native-session-header-invalid");
-    if (input.expectedSessionId !== undefined && header.id !== input.expectedSessionId)
-        return fail("changed", "native-session-id-changed");
-    // Only validated session headers admit transcript bytes; arbitrary files are never archived here.
-    result.bytes = Buffer.from(bytes);
-    observation.sessionId = header.id;
-    observation.parentSessionPath = header.parentSession ?? null;
-    observation.sha256 = createHash("sha256").update(bytes).digest("hex");
-    if (input.truncated || raw.at(-1) !== 10)
-        return fail("truncated", "native-session-incomplete-bytes");
-    let text;
-    try {
-        text = new TextDecoder("utf-8", { fatal: true }).decode(raw);
-    }
-    catch {
-        return fail("invalid", "native-session-utf8-invalid");
-    }
-    const lines = text.split("\n");
-    const ids = new Set();
-    if (lines.length > 10002)
-        return fail("invalid", "native-session-entry-limit");
-    for (const line of lines.slice(1, -1)) {
-        let entry;
-        try {
-            entry = parseRetentionJson(line, MAX_NATIVE_SESSION_BYTES);
-        }
-        catch {
-            return fail("invalid", "native-session-entry-invalid");
-        }
-        if (!obj(entry) || typeof entry.type !== "string" || entry.type === "session" || !id(entry.id) || ids.has(entry.id) ||
-            !(entry.parentId === null || (id(entry.parentId) && ids.has(entry.parentId))) || typeof entry.timestamp !== "string" ||
-            !Number.isFinite(Date.parse(entry.timestamp)))
-            return fail("invalid", "native-session-parent-link-invalid");
-        ids.add(entry.id);
-        observation.lastPersistedEntryId = entry.id;
-    }
-    if (input.liveLeaf) {
-        if (input.liveLeaf.sessionId !== header.id || (input.liveLeaf.leafId !== null && !ids.has(input.liveLeaf.leafId))) {
-            return fail("changed", "native-session-live-leaf-mismatch");
-        }
-        observation.branchLeafId = input.liveLeaf.leafId;
-        observation.branchState = "observed";
-    }
-    observation.status = "verified";
-    observation.reason = observation.branchState === "unknown" ? "active-branch-unknown" : null;
-    return result;
-}
-/** Private allowlisted files only, bounded non-following descriptor reads, no scan of session/auth dirs. */
-export async function readNativeSession(input) {
-    const gap = (status, reason) => ({ observation: {
-            ...missingNativeSession(), source: input.source, status, reason, sessionPath: filePath(input.path) ? input.path : null,
-        } });
-    const root = input.allowedRoot ?? process.env[ENV_NATIVE_SESSION_ROOT];
-    if (!filePath(input.path) || !input.path.endsWith(".jsonl") || !root || !filePath(root))
-        return gap("unsupported", "native-session-private-root-required");
-    const within = (base, candidate) => { const p = relative(base, candidate); return p !== "" && p !== ".." && !p.startsWith(`..${sep}`) && !isAbsolute(p); };
-    if (!within(root, input.path))
-        return gap("unsupported", "native-session-outside-private-root");
-    let handle;
-    try {
-        const canonicalRoot = await realpath(root), canonicalFile = await realpath(input.path);
-        const rootStat = await lstat(canonicalRoot);
-        if (!rootStat.isDirectory() || (rootStat.mode & 0o077) !== 0 || (typeof process.getuid === "function" && rootStat.uid !== process.getuid()))
-            return gap("unsupported", "native-session-root-not-private");
-        if (!within(canonicalRoot, canonicalFile) || (await lstat(input.path)).isSymbolicLink())
-            return gap("unsupported", "native-session-path-alias");
-        handle = await open(input.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-        const before = await handle.stat();
-        if (!before.isFile() || before.nlink !== 1 || (typeof process.getuid === "function" && before.uid !== process.getuid())) {
-            return gap("unsupported", "native-session-not-private-regular-file");
-        }
-        const fileIdentity = { device: String(before.dev), inode: String(before.ino) };
-        if (input.expectedFile && (input.expectedFile.device !== fileIdentity.device || input.expectedFile.inode !== fileIdentity.inode))
-            return gap("changed", "native-session-file-replaced");
-        const live = input.manager ? { sessionId: input.manager.getSessionId(), leafId: input.manager.getLeafId(), path: input.manager.getSessionFile() } : undefined;
-        if (live && live.path !== input.path)
-            return gap("changed", "native-session-manager-path-changed");
-        const bytes = Buffer.alloc(Math.min(before.size, MAX_NATIVE_SESSION_BYTES));
-        let offset = 0;
-        while (offset < bytes.length) {
-            const read = await handle.read(bytes, offset, bytes.length - offset, offset);
-            if (!read.bytesRead)
-                break;
-            offset += read.bytesRead;
-        }
-        const after = await handle.stat(), location = await lstat(input.path);
-        if (before.dev !== location.dev || before.ino !== location.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs ||
-            before.ctimeMs !== after.ctimeMs || location.isSymbolicLink() || after.size !== location.size)
-            return gap("changed", "native-session-file-changed");
-        if (live && (input.manager.getSessionId() !== live.sessionId || input.manager.getLeafId() !== live.leafId || input.manager.getSessionFile() !== live.path)) {
-            return gap("changed", "native-session-live-state-changed");
-        }
-        return { ...parseNativeSessionBytes(bytes.subarray(0, offset), { ...input, liveLeaf: live,
-                truncated: before.size > MAX_NATIVE_SESSION_BYTES || offset !== before.size }), fileIdentity };
-    }
-    catch (error) {
-        return gap(error.code === "ENOENT" ? "missing" : "invalid", "native-session-read-failed");
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
-}
-/** Herdr 0.8.2 protocol 20 AgentInfo.agent_session; never scrape terminal text, PID or names. */
-export function herdrSessionReference(value, expectedPane) {
-    if (!obj(value) || value.pane_id !== expectedPane || value.agent !== "pi" || !obj(value.agent_session))
-        return null;
-    const s = value.agent_session;
-    if (s.agent !== "pi" || typeof s.source !== "string" || s.source.length > 128)
-        return null;
-    if (s.kind === "id" && uuid(s.value))
-        return { source: "herdr-id", value: s.value };
-    if (s.kind === "path" && filePath(s.value))
-        return { source: "herdr-path", value: s.value };
-    return null;
-}
-//# sourceMappingURL=retention-v2-native.js.map

package/dist/generated/retention-v2-pin.d.ts

@@ -1,2 +0,0 @@
-export declare const RETENTION_V2_COMMIT = "7c78769c47177b1972b09e1f5c5474ad44cd2cac";
-export declare const RETENTION_V2_SCHEMA_SHA256 = "a0934a2f04b3f1fae0e4057fa2cb07ee26cd392937498d7fc9fb5b3bbd90632c";

package/dist/generated/retention-v2-pin.js

@@ -1,4 +0,0 @@
-// GENERATED by scripts/vendor-execution-retention.mjs from pi-daddy 7c78769c47177b1972b09e1f5c5474ad44cd2cac. Do not hand-edit.
-export const RETENTION_V2_COMMIT = "7c78769c47177b1972b09e1f5c5474ad44cd2cac";
-export const RETENTION_V2_SCHEMA_SHA256 = "a0934a2f04b3f1fae0e4057fa2cb07ee26cd392937498d7fc9fb5b3bbd90632c";
-//# sourceMappingURL=retention-v2-pin.js.map