@skrr-ai/cli 0.1.115 → 0.1.117

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/toolOperationOutcome.js

@@ -0,0 +1,75 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var toolOperationOutcome_exports = {};
+__export(toolOperationOutcome_exports, {
+  mergeToolOperationOutcome: () => mergeToolOperationOutcome,
+  readToolOperationOutcome: () => readToolOperationOutcome,
+  toolOperationState: () => toolOperationState,
+  unknownToolOperationOutcome: () => unknownToolOperationOutcome
+});
+module.exports = __toCommonJS(toolOperationOutcome_exports);
+const statuses = /* @__PURE__ */ new Set(["succeeded", "failed", "not_run", "unknown"]);
+const sources = /* @__PURE__ */ new Set(["executor", "permission_resolver", "runtime_observer"]);
+const reasons = /* @__PURE__ */ new Set([
+  "command_failed",
+  "permission_denied",
+  "unavailable_before_dispatch",
+  "transport_unconfirmed",
+  "background_pending",
+  "unobserved",
+  "conflicting_receipts"
+]);
+function readToolOperationOutcome(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return void 0;
+  const v = value;
+  if (v.version !== 1 || typeof v.status !== "string" || typeof v.source !== "string" || !statuses.has(v.status) || !sources.has(v.source) || v.reason !== void 0 && (typeof v.reason !== "string" || !reasons.has(v.reason)) || v.source === "runtime_observer" && v.status !== "unknown" || v.source === "permission_resolver" && v.status !== "not_run")
+    return void 0;
+  return {
+    version: 1,
+    status: v.status,
+    source: v.source,
+    ...v.reason === void 0 ? {} : { reason: v.reason }
+  };
+}
+function unknownToolOperationOutcome(reason = "unobserved") {
+  return { version: 1, status: "unknown", source: "runtime_observer", reason };
+}
+function mergeToolOperationOutcome(previous, next) {
+  const before = readToolOperationOutcome(previous);
+  const after = readToolOperationOutcome(next);
+  if (!after)
+    return before;
+  if (!before || before.source === "runtime_observer" && before.reason === "unobserved")
+    return after;
+  if (after.source === "runtime_observer" && after.reason === "unobserved")
+    return before;
+  return JSON.stringify(before) === JSON.stringify(after) ? before : unknownToolOperationOutcome("conflicting_receipts");
+}
+function toolOperationState(value) {
+  const outcome = readToolOperationOutcome(value);
+  return !outcome ? void 0 : outcome.status === "succeeded" ? "completed" : outcome.status === "unknown" ? "unreported" : "error";
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  mergeToolOperationOutcome,
+  readToolOperationOutcome,
+  toolOperationState,
+  unknownToolOperationOutcome
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/ttlParser.js

@@ -1,87 +1,75 @@
 "use strict";
-/**
- * ttlParser.ts — shared TTL-duration grammar for CI-token lifetimes.
- *
- * Single source of truth for the `--ttl` flag accepted by both
- * `oversky create-token` (daemon CLI) and `sky create-token` (CLI).
- * Before this module the CLI accepted bare integers only while the
- * daemon accepted `30d`/`1y`/`1w` — users would learn the daemon
- * grammar, hit a cryptic oclif integer-parser error when they tried
- * the same string on `sky`, and file a confused bug (ADD-CLI1).
- *
- * Grammar:
- *   <number><unit?>
- *     unit := 'd' | 'w' | 'y'    (default 'd' if absent)
- *
- * Constraints:
- *   days ∈ [MIN_TTL_DAYS, MAX_TTL_DAYS]  (1 .. 365)
- *
- * Errors are returned as a discriminated-union value rather than
- * thrown, so each CLI can surface them with its own idioms
- * (`this.error(...)` on oclif vs `showError(); process.exit(2)` on
- * the daemon) without the parser owning process-exit semantics.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = void 0;
-exports.parseTtlDays = parseTtlDays;
-exports.MIN_TTL_DAYS = 1;
-exports.MAX_TTL_DAYS = 365;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ttlParser_exports = {};
+__export(ttlParser_exports, {
+  MAX_TTL_DAYS: () => MAX_TTL_DAYS,
+  MIN_TTL_DAYS: () => MIN_TTL_DAYS,
+  parseTtlDays: () => parseTtlDays
+});
+module.exports = __toCommonJS(ttlParser_exports);
+const MIN_TTL_DAYS = 1;
+const MAX_TTL_DAYS = 365;
 const TTL_RE = /^(\d+)\s*([dwy]?)$/i;
-/**
- * Parse a `--ttl` string into a concrete day count. Pure; never
- * throws. Accepts `undefined`/empty as "use default."
- *
- * Examples:
- *   parseTtlDays('30d')      → { ok: true, days: 30 }
- *   parseTtlDays('1y')       → { ok: true, days: 365 }
- *   parseTtlDays('2w')       → { ok: true, days: 14 }
- *   parseTtlDays('90')       → { ok: true, days: 90 }
- *   parseTtlDays('0')        → { ok: false, code: 'OUT_OF_RANGE' }
- *   parseTtlDays('abc')      → { ok: false, code: 'INVALID_FORMAT' }
- *   parseTtlDays('2y')       → { ok: false, code: 'OUT_OF_RANGE' } // 730d > 365
- *
- * The default-days argument is a day count, not a string, because the
- * caller already knows it's in range — no need to re-parse.
- */
 function parseTtlDays(input, defaultDays) {
-    if (input == null || input === '') {
-        return { ok: true, days: defaultDays, input: '' };
-    }
-    const trimmed = String(input).trim();
-    const m = trimmed.match(TTL_RE);
-    if (!m) {
-        return {
-            ok: false,
-            code: 'INVALID_FORMAT',
-            input: trimmed,
-            message: `Invalid --ttl value "${trimmed}". ` +
-                `Examples: 30d (30 days), 2w (14 days), 1y (365 days), 90 (treated as days).`,
-        };
-    }
-    const n = parseInt(m[1], 10);
-    const unit = (m[2] || 'd').toLowerCase();
-    let days;
-    switch (unit) {
-        case 'd':
-            days = n;
-            break;
-        case 'w':
-            days = n * 7;
-            break;
-        case 'y':
-            days = n * 365;
-            break;
-        default:
-            days = n;
-            break;
-    }
-    if (!Number.isFinite(days) || days < exports.MIN_TTL_DAYS || days > exports.MAX_TTL_DAYS) {
-        return {
-            ok: false,
-            code: 'OUT_OF_RANGE',
-            input: trimmed,
-            message: `--ttl must be ${exports.MIN_TTL_DAYS}–${exports.MAX_TTL_DAYS} days (got ${days} days from "${trimmed}").`,
-        };
-    }
-    return { ok: true, days, input: trimmed };
+  if (input == null || input === "") {
+    return { ok: true, days: defaultDays, input: "" };
+  }
+  const trimmed = String(input).trim();
+  const m = trimmed.match(TTL_RE);
+  if (!m) {
+    return {
+      ok: false,
+      code: "INVALID_FORMAT",
+      input: trimmed,
+      message: `Invalid --ttl value "${trimmed}". Examples: 30d (30 days), 2w (14 days), 1y (365 days), 90 (treated as days).`
+    };
+  }
+  const n = parseInt(m[1], 10);
+  const unit = (m[2] || "d").toLowerCase();
+  let days;
+  switch (unit) {
+    case "d":
+      days = n;
+      break;
+    case "w":
+      days = n * 7;
+      break;
+    case "y":
+      days = n * 365;
+      break;
+    default:
+      days = n;
+      break;
+  }
+  if (!Number.isFinite(days) || days < MIN_TTL_DAYS || days > MAX_TTL_DAYS) {
+    return {
+      ok: false,
+      code: "OUT_OF_RANGE",
+      input: trimmed,
+      message: `--ttl must be ${MIN_TTL_DAYS}\u2013${MAX_TTL_DAYS} days (got ${days} days from "${trimmed}").`
+    };
+  }
+  return { ok: true, days, input: trimmed };
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MAX_TTL_DAYS,
+  MIN_TTL_DAYS,
+  parseTtlDays
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/types.js

@@ -1,37 +1,56 @@
 "use strict";
-/**
- * Shared types & error classes used across refresh, refreshScheduler, and
- * fdToken modules. Lives in its own file so consumers can `import type` from
- * the package without dragging in side-effecting modules.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TransientAuthFailure = exports.PermanentAuthFailure = void 0;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+__export(types_exports, {
+  PermanentAuthFailure: () => PermanentAuthFailure,
+  TransientAuthFailure: () => TransientAuthFailure
+});
+module.exports = __toCommonJS(types_exports);
 class PermanentAuthFailure extends Error {
-    code;
-    /**
-     * OSK-16941 — for `SESSION_REVOKED`, the server's `reason` (a
-     * `SESSION_REVOCATION_REASONS` value, `./sessionRevocation.ts`) exactly as
-     * received, or undefined when the server sent none. Deliberately not
-     * normalized here: a surface rendering it with `describeSessionRevocation`
-     * turns a missing or unknown value into the "we could not tell why" copy,
-     * and keeps an unrecognised code visible rather than losing it.
-     */
-    revocationReason;
-    constructor(code, message, revocationReason) {
-        super(message);
-        this.name = 'PermanentAuthFailure';
-        this.code = code;
-        if (revocationReason !== undefined)
-            this.revocationReason = revocationReason;
-    }
+  code;
+  /**
+   * OSK-16941 — for `SESSION_REVOKED`, the server's `reason` (a
+   * `SESSION_REVOCATION_REASONS` value, `./sessionRevocation.ts`) exactly as
+   * received, or undefined when the server sent none. Deliberately not
+   * normalized here: a surface rendering it with `describeSessionRevocation`
+   * turns a missing or unknown value into the "we could not tell why" copy,
+   * and keeps an unrecognised code visible rather than losing it.
+   */
+  revocationReason;
+  constructor(code, message, revocationReason) {
+    super(message);
+    this.name = "PermanentAuthFailure";
+    this.code = code;
+    if (revocationReason !== void 0)
+      this.revocationReason = revocationReason;
+  }
 }
-exports.PermanentAuthFailure = PermanentAuthFailure;
 class TransientAuthFailure extends Error {
-    cause;
-    constructor(message, cause) {
-        super(message);
-        this.name = 'TransientAuthFailure';
-        this.cause = cause;
-    }
+  cause;
+  constructor(message, cause) {
+    super(message);
+    this.name = "TransientAuthFailure";
+    this.cause = cause;
+  }
 }
-exports.TransientAuthFailure = TransientAuthFailure;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PermanentAuthFailure,
+  TransientAuthFailure
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/workspaceIsolationProbeWire.js

@@ -1,50 +1,50 @@
 "use strict";
-/**
- * The workspace-isolation probe wire contract (OSK-15099).
- *
- * A Commitment Run is always isolated: the daemon cuts it a private git
- * worktree from the directory the Run is rooted in, and refuses the Run with
- * `EXECUTION_ISOLATION_UNAVAILABLE` before any tool when it cannot. Preflight
- * had no way to read that machine's filesystem, so it reported `ready`,
- * activation succeeded, and the first Run failed. The daemon now answers the
- * same question BEFORE a Run, through the same predicate its executor refuses
- * on, and this module is the one place both ends spell it.
- *
- * - The daemon announces {@link WORKSPACE_ISOLATION_PROBE_CAPABILITY}. A daemon
- *   that does not is never asked, and the server reports the prerequisite as
- *   UNVERIFIED — never as satisfied (unknown is never ok).
- * - The server sends {@link WORKSPACE_ISOLATION_PROBE_METHOD} as a control RPC
- *   with `{ workingDirectory? }`: exactly the directory it would put on the
- *   Run's request (`agent.workingDirectory || daemon cwd`).
- * - The daemon answers {@link WorkspaceIsolationProbeAnswer}.
- *
- * Pure: no I/O, safe for the browser, the CLI and the API.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.REFUSING_WORKTREE_BASE_VERDICTS = exports.WORKTREE_BASE_VERDICTS = exports.WORKSPACE_ISOLATION_PROBE_METHOD = exports.WORKSPACE_ISOLATION_PROBE_CAPABILITY = void 0;
-exports.isWorktreeBaseVerdict = isWorktreeBaseVerdict;
-exports.WORKSPACE_ISOLATION_PROBE_CAPABILITY = 'workspace_isolation_probe_v1';
-exports.WORKSPACE_ISOLATION_PROBE_METHOD = 'daemon:workspace:isolation-probe';
-/**
- * What an explicit isolation request can be given from a base directory.
- *
- *   - `worktree`          — a git repository with a commit: a worktree is cut;
- *   - `sandbox`           — the daemon's own bare scratch workspace: an empty
- *                           private sandbox is used instead;
- *   - `not_a_repository`  — refused: not inside a git repository;
- *   - `no_initial_commit` — refused: a repository with an unborn HEAD.
- */
-exports.WORKTREE_BASE_VERDICTS = Object.freeze([
-    'worktree',
-    'sandbox',
-    'not_a_repository',
-    'no_initial_commit',
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var workspaceIsolationProbeWire_exports = {};
+__export(workspaceIsolationProbeWire_exports, {
+  REFUSING_WORKTREE_BASE_VERDICTS: () => REFUSING_WORKTREE_BASE_VERDICTS,
+  WORKSPACE_ISOLATION_PROBE_CAPABILITY: () => WORKSPACE_ISOLATION_PROBE_CAPABILITY,
+  WORKSPACE_ISOLATION_PROBE_METHOD: () => WORKSPACE_ISOLATION_PROBE_METHOD,
+  WORKTREE_BASE_VERDICTS: () => WORKTREE_BASE_VERDICTS,
+  isWorktreeBaseVerdict: () => isWorktreeBaseVerdict
+});
+module.exports = __toCommonJS(workspaceIsolationProbeWire_exports);
+const WORKSPACE_ISOLATION_PROBE_CAPABILITY = "workspace_isolation_probe_v1";
+const WORKSPACE_ISOLATION_PROBE_METHOD = "daemon:workspace:isolation-probe";
+const WORKTREE_BASE_VERDICTS = Object.freeze([
+  "worktree",
+  "sandbox",
+  "not_a_repository",
+  "no_initial_commit"
 ]);
-/** The verdicts on which the daemon refuses an isolated Run before any tool. */
-exports.REFUSING_WORKTREE_BASE_VERDICTS = new Set([
-    'not_a_repository',
-    'no_initial_commit',
+const REFUSING_WORKTREE_BASE_VERDICTS = /* @__PURE__ */ new Set([
+  "not_a_repository",
+  "no_initial_commit"
 ]);
 function isWorktreeBaseVerdict(value) {
-    return typeof value === 'string' && exports.WORKTREE_BASE_VERDICTS.includes(value);
+  return typeof value === "string" && WORKTREE_BASE_VERDICTS.includes(value);
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  REFUSING_WORKTREE_BASE_VERDICTS,
+  WORKSPACE_ISOLATION_PROBE_CAPABILITY,
+  WORKSPACE_ISOLATION_PROBE_METHOD,
+  WORKTREE_BASE_VERDICTS,
+  isWorktreeBaseVerdict
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/restartArtifact.d.ts

@@ -0,0 +1,10 @@
+export interface RestartArtifact {
+    path: string;
+    mtimeMs: number;
+    sha256: string;
+}
+/**
+ * First-party build readiness identity; dependency/assets integrity remains the
+ * signed installer's authority. JS binds build files, not just index.js.
+ */
+export declare function captureRestartArtifact(input: string): RestartArtifact;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/restartArtifact.js

@@ -0,0 +1,138 @@
+import { createHash } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, openSync, opendirSync, readSync, realpathSync, statSync } from 'node:fs';
+import { dirname, extname, join, relative, resolve } from 'node:path';
+const CODE_EXTENSIONS = new Set(['.js', '.cjs', '.mjs', '.json', '.node', '.wasm']);
+const OMIT_DIRECTORIES = new Set(['node_modules', '.git', '__tests__', '__fixtures__']);
+const MAX_FILES = 25_000;
+const MAX_BYTES = 256 * 1024 * 1024;
+const MAX_DEPTH = 32;
+const MAX_ENTRIES = 50_000;
+function stamp(file) {
+    const value = statSync(file, { bigint: true });
+    return `${value.dev}:${value.ino}:${value.size}:${value.mtimeNs}:${value.ctimeNs}`;
+}
+function executableHeader(bytes) {
+    const magic = bytes.subarray(0, 4).toString('hex');
+    return bytes.subarray(0, 2).toString() === 'MZ' ||
+        ['7f454c46', 'feedface', 'cefaedfe', 'feedfacf', 'cffaedfe', 'cafebabe', 'bebafeca', 'cafebabf', 'bfbafeca'].includes(magic);
+}
+/**
+ * First-party build readiness identity; dependency/assets integrity remains the
+ * signed installer's authority. JS binds build files, not just index.js.
+ */
+export function captureRestartArtifact(input) {
+    const path = resolve(input);
+    const entry = realpathSync(path);
+    const initialEntry = stamp(entry);
+    const extension = extname(entry);
+    const javascript = ['.js', '.cjs', '.mjs'].includes(extension);
+    const hash = createHash('sha256');
+    const seen = [];
+    let bytes = 0;
+    const addFile = (file, name) => {
+        if (seen.length >= MAX_FILES)
+            throw new Error('Restart build exceeds the file limit');
+        const before = stamp(file);
+        const fd = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+            const info = fstatSync(fd);
+            if (!info.isFile())
+                throw new Error('Restart build contains a linked or special code file');
+            if (info.size > MAX_BYTES - bytes)
+                throw new Error('Restart build exceeds the byte limit');
+            // Length framing prevents ambiguous file boundaries; read in bounded chunks
+            // so a file growing after fstat cannot defeat the snapshot's memory bound.
+            hash.update(JSON.stringify([name, info.size]));
+            const chunk = Buffer.allocUnsafe(64 * 1024);
+            let readBytes = 0;
+            for (;;) {
+                const count = readSync(fd, chunk, 0, Math.min(chunk.length, MAX_BYTES - bytes + 1), null);
+                if (!count)
+                    break;
+                if (!javascript && readBytes === 0 && !executableHeader(chunk.subarray(0, count))) {
+                    throw new Error('Restart artifact is not a supported native executable');
+                }
+                bytes += count;
+                readBytes += count;
+                if (bytes > MAX_BYTES)
+                    throw new Error('Restart build exceeds the byte limit');
+                hash.update(chunk.subarray(0, count));
+            }
+            if (readBytes !== info.size || (!javascript && readBytes === 0) || stamp(file) !== before) {
+                throw new Error('Restart build changed while its identity was captured');
+            }
+        }
+        finally {
+            closeSync(fd);
+        }
+        seen.push([file, before]);
+    };
+    if (javascript) {
+        hash.update('skrr-restart-javascript-v1\0');
+        const root = dirname(entry);
+        const directories = [];
+        let entries = 0;
+        const walk = (dir, depth) => {
+            if (depth > MAX_DEPTH)
+                throw new Error('Restart build exceeds the directory depth limit');
+            directories.push([dir, stamp(dir)]);
+            const names = [];
+            const directory = opendirSync(dir);
+            try {
+                for (let item = directory.readSync(); item; item = directory.readSync()) {
+                    if (++entries > MAX_ENTRIES)
+                        throw new Error('Restart build exceeds the directory entry limit');
+                    names.push(item.name);
+                }
+            }
+            finally {
+                directory.closeSync();
+            }
+            for (const name of names.sort()) {
+                if (OMIT_DIRECTORIES.has(name))
+                    continue;
+                const file = join(dir, name);
+                const info = lstatSync(file);
+                if (info.isSymbolicLink())
+                    throw new Error('Restart build contains a linked or special code file');
+                if (info.isDirectory()) {
+                    walk(file, depth + 1);
+                }
+                else if (CODE_EXTENSIONS.has(extname(name)) && !/\.(?:test|spec)\.[cm]?js$/.test(name)) {
+                    if (!info.isFile())
+                        throw new Error('Restart build contains a linked or special code file');
+                    addFile(file, relative(root, file).split('\\').join('/'));
+                }
+            }
+        };
+        walk(root, 0);
+        // Packaged builds already carry a dependency receipt made after pruning.
+        // Bind that authority as well as the declared dependency/version contract.
+        for (const name of ['package.json', 'dependency-receipt.json']) {
+            const metadataFile = join(root, '..', name);
+            try {
+                if (lstatSync(metadataFile).isFile())
+                    addFile(metadataFile, `../${name}`);
+                else
+                    throw new Error('Restart package metadata is not a regular file');
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        if (directories.some(([dir, before]) => stamp(dir) !== before)) {
+            throw new Error('Restart build directory changed while its identity was captured');
+        }
+    }
+    else {
+        // Source/shell launchers are not complete artifacts: only native executable
+        // formats can take this path without a separately bound dependency tree.
+        addFile(entry, 'executable');
+    }
+    if (realpathSync(path) !== entry || stamp(entry) !== initialEntry ||
+        seen.some(([file, before]) => stamp(file) !== before)) {
+        throw new Error('Restart build changed while its identity was captured');
+    }
+    return { path, mtimeMs: statSync(entry).mtimeMs, sha256: hash.digest('hex') };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/toolOperationOutcome.d.ts

@@ -0,0 +1,16 @@
+/** An operation receipt is separate from an SDK hook/carrier decision and from
+ * the agent turn's outcome. Only a producer or exact permission resolver writes
+ * this field; JSON inside tool stdout is never an observation. */
+export interface ToolOperationOutcomeV1 {
+    version: 1;
+    status: 'succeeded' | 'failed' | 'not_run' | 'unknown';
+    source: 'executor' | 'permission_resolver' | 'runtime_observer';
+    reason?: 'command_failed' | 'permission_denied' | 'unavailable_before_dispatch' | 'transport_unconfirmed' | 'background_pending' | 'unobserved' | 'conflicting_receipts';
+}
+/** Unknown/future versions cannot become an authoritative success. */
+export declare function readToolOperationOutcome(value: unknown): ToolOperationOutcomeV1 | undefined;
+export declare function unknownToolOperationOutcome(reason?: 'unobserved' | 'conflicting_receipts'): ToolOperationOutcomeV1;
+/** A late receipt can resolve missing evidence. Contradictory receipts stay
+ * unknown rather than silently choosing the last success. */
+export declare function mergeToolOperationOutcome(previous: unknown, next: unknown): ToolOperationOutcomeV1 | undefined;
+export declare function toolOperationState(value: unknown): 'completed' | 'error' | 'unreported' | undefined;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/toolOperationOutcome.js

@@ -0,0 +1,40 @@
+const statuses = new Set(['succeeded', 'failed', 'not_run', 'unknown']);
+const sources = new Set(['executor', 'permission_resolver', 'runtime_observer']);
+const reasons = new Set(['command_failed', 'permission_denied', 'unavailable_before_dispatch',
+    'transport_unconfirmed', 'background_pending', 'unobserved', 'conflicting_receipts']);
+/** Unknown/future versions cannot become an authoritative success. */
+export function readToolOperationOutcome(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const v = value;
+    if (v.version !== 1 || typeof v.status !== 'string' || typeof v.source !== 'string' ||
+        !statuses.has(v.status) || !sources.has(v.source) ||
+        v.reason !== undefined && (typeof v.reason !== 'string' || !reasons.has(v.reason)) ||
+        v.source === 'runtime_observer' && v.status !== 'unknown' ||
+        v.source === 'permission_resolver' && v.status !== 'not_run')
+        return undefined;
+    return { version: 1, status: v.status,
+        source: v.source,
+        ...(v.reason === undefined ? {} : { reason: v.reason }) };
+}
+export function unknownToolOperationOutcome(reason = 'unobserved') {
+    return { version: 1, status: 'unknown', source: 'runtime_observer', reason };
+}
+/** A late receipt can resolve missing evidence. Contradictory receipts stay
+ * unknown rather than silently choosing the last success. */
+export function mergeToolOperationOutcome(previous, next) {
+    const before = readToolOperationOutcome(previous);
+    const after = readToolOperationOutcome(next);
+    if (!after)
+        return before;
+    if (!before || before.source === 'runtime_observer' && before.reason === 'unobserved')
+        return after;
+    if (after.source === 'runtime_observer' && after.reason === 'unobserved')
+        return before;
+    return JSON.stringify(before) === JSON.stringify(after) ? before : unknownToolOperationOutcome('conflicting_receipts');
+}
+export function toolOperationState(value) {
+    const outcome = readToolOperationOutcome(value);
+    return !outcome ? undefined : outcome.status === 'succeeded' ? 'completed'
+        : outcome.status === 'unknown' ? 'unreported' : 'error';
+}